openclaw-cortex 3.1.0 → 3.2.0

package/dist/{gateway-cli-Cfs77-mk.js → gateway-cli-D_RCXTvo.js}

@@ -23,7 +23,7 @@ import { t as rawDataToString } from "./ws-_-dDG5N0.js";
 import { n as pickPrimaryTailnetIPv4, r as pickPrimaryTailnetIPv6 } from "./tailnet-Cmumpn76.js";
 import { a as isValidIPv4, c as pickPrimaryLanIPv4, d as resolveGatewayListenHosts, f as resolveHostName, i as isTrustedProxyAddress, l as resolveGatewayBindHost, n as isLoopbackHost, o as normalizeHostHeader, t as isLoopbackAddress, u as resolveGatewayClientIp } from "./net-BxenOPeq.js";
 import { i as normalizeInputProvenance } from "./input-provenance-B7mgmKVR.js";
-import { $n as OPENAI_TTS_VOICES, At as stripLegacyDeliveryFields, B as getTotalPendingReplies, Bn as resolveUserTimezone, Bt as deferGatewayRestartUntilIdle, C as agentCommand, Cn as extractFileContentFromSource, Ct as normalizeOptionalSessionKey, D as createOutboundSendDeps, Dt as migrateLegacyCronPayload, E as resolveAgentOutboundTarget, En as resolveInputFileLimits, Et as normalizeRequiredName, Ft as getHookType, G as resolveCronStyleNow, Gn as resolveTtsAutoMode, Gt as setGatewaySigusr1RestartPolicy, Hn as isTtsEnabled, Ht as isGatewaySigusr1RestartExternallyAllowed, In as isAbortTrigger, It as isExternalHookSession, J as runCliAgent, Jn as resolveTtsProviderOrder, K as getCliSessionId, Kn as resolveTtsConfig, Kt as setPreRestartDeferralCheck, Ln as stopSubagentsForRequester, Lt as applyBrowserProxyPaths, N as buildHistoryContextFromEntries, Nn as formatZonedTimestamp, Nt as buildSafeExternalPrompt, O as createDefaultDeps, On as resolveAgentTimeoutMs, Ot as buildDeliveryFromLegacyPayload, Pt as detectSuspiciousPatterns, Q as resolveAnnounceTargetFromKey, Qn as OPENAI_TTS_MODELS, R as dispatchInboundMessage, Rt as persistBrowserProxyFiles, S as sleepWithAbort, Sn as DEFAULT_INPUT_TIMEOUT_MS, St as normalizeOptionalAgentId, T as resolveAgentDeliveryPlan, Tn as normalizeMimeList, Tt as normalizePayloadToSystemText, U as BARE_SESSION_RESET_PROMPT, Un as isTtsProviderConfigured, Ut as markGatewaySigusr1RestartHandled, Vn as getTtsProvider, Vt as emitGatewayRestart, Wn as resolveTtsApiKey, Wt as scheduleGatewaySigusr1Restart, X as createOpenClawTools, Xn as setTtsProvider, Yn as setTtsEnabled, Yt as loadProviderUsageSummary, Z as readLatestAssistantReply, Zn as textToSpeech, _t as writeRestartSentinel, a as runSubagentAnnounceFlow, ar as waitForActiveTasks, at as resolveSessionDeliveryTarget, b as requestBodyErrorToText, bn as DEFAULT_INPUT_IMAGE_MIMES, bt as normalizeCronJobPatch, c as abortEmbeddedPiRun, d as applyToolPolicyPipeline, dr as stripHeartbeatToken, dt as consumeRestartSentinel, er as getActiveTaskCount, et as ensureOutboundSessionEntry, f as buildDefaultToolPolicyPipelineSteps, fn as applyModelOverrideToSessionEntry, fr as clearAgentRunContext, ft as formatDoctorNonInteractiveHint, g as loadOpenClawPlugins, gn as isSystemEventContextChanged, gr as registerAgentRunContext, hn as enqueueSystemEvent, hr as onAgentEvent, ht as summarizeRestartSentinel, ir as setCommandLaneConcurrency, it as resolveOutboundTarget, k as createOutboundSendDeps$1, kt as hasLegacyDeliveryHints, l as getActiveEmbeddedRunCount, lt as runWithModelFallback, m as getPluginToolMeta, mn as parseVerboseOverride, mr as getAgentRunContext, n as initSubagentRegistry, nr as getTotalQueueSize, o as clearSessionQueues, on as normalizeSendPolicy, or as CommandLane, pn as applyVerboseOverride, pr as emitAgentEvent, pt as formatRestartSentinelMessage, q as setCliSessionId, qn as resolveTtsPrefsPath, qt as normalizeGroupActivation, r as listDescendantRunsForRequester, rn as requestHeartbeatNow, rr as resetAllLanes, s as runEmbeddedPiAgent, sn as resolveSendPolicy, sr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, st as resetDirectoryCache, t as countActiveDescendantRuns, tt as resolveOutboundSessionRoute, u as waitForEmbeddedPiRunEnd, v as handleSlackHttpRequest, vt as normalizeHttpWebhookUrl, wn as extractImageContentFromSource, wt as normalizeOptionalText, x as computeBackoff, xn as DEFAULT_INPUT_MAX_REDIRECTS, xt as inferLegacyName, y as readJsonBodyWithLimit, yn as DEFAULT_INPUT_IMAGE_MAX_BYTES, yt as normalizeCronJobCreate, z as createReplyDispatcher, zt as consumeGatewaySigusr1RestartAuthorization } from "./subagent-registry-D5OOZhWd.js";
+import { $n as OPENAI_TTS_VOICES, At as stripLegacyDeliveryFields, B as getTotalPendingReplies, Bn as resolveUserTimezone, Bt as deferGatewayRestartUntilIdle, C as agentCommand, Cn as extractFileContentFromSource, Ct as normalizeOptionalSessionKey, D as createOutboundSendDeps, Dt as migrateLegacyCronPayload, E as resolveAgentOutboundTarget, En as resolveInputFileLimits, Et as normalizeRequiredName, Ft as getHookType, G as resolveCronStyleNow, Gn as resolveTtsAutoMode, Gt as setGatewaySigusr1RestartPolicy, Hn as isTtsEnabled, Ht as isGatewaySigusr1RestartExternallyAllowed, In as isAbortTrigger, It as isExternalHookSession, J as runCliAgent, Jn as resolveTtsProviderOrder, K as getCliSessionId, Kn as resolveTtsConfig, Kt as setPreRestartDeferralCheck, Ln as stopSubagentsForRequester, Lt as applyBrowserProxyPaths, N as buildHistoryContextFromEntries, Nn as formatZonedTimestamp, Nt as buildSafeExternalPrompt, O as createDefaultDeps, On as resolveAgentTimeoutMs, Ot as buildDeliveryFromLegacyPayload, Pt as detectSuspiciousPatterns, Q as resolveAnnounceTargetFromKey, Qn as OPENAI_TTS_MODELS, R as dispatchInboundMessage, Rt as persistBrowserProxyFiles, S as sleepWithAbort, Sn as DEFAULT_INPUT_TIMEOUT_MS, St as normalizeOptionalAgentId, T as resolveAgentDeliveryPlan, Tn as normalizeMimeList, Tt as normalizePayloadToSystemText, U as BARE_SESSION_RESET_PROMPT, Un as isTtsProviderConfigured, Ut as markGatewaySigusr1RestartHandled, Vn as getTtsProvider, Vt as emitGatewayRestart, Wn as resolveTtsApiKey, Wt as scheduleGatewaySigusr1Restart, X as createOpenClawTools, Xn as setTtsProvider, Yn as setTtsEnabled, Yt as loadProviderUsageSummary, Z as readLatestAssistantReply, Zn as textToSpeech, _t as writeRestartSentinel, a as runSubagentAnnounceFlow, ar as waitForActiveTasks, at as resolveSessionDeliveryTarget, b as requestBodyErrorToText, bn as DEFAULT_INPUT_IMAGE_MIMES, bt as normalizeCronJobPatch, c as abortEmbeddedPiRun, d as applyToolPolicyPipeline, dr as stripHeartbeatToken, dt as consumeRestartSentinel, er as getActiveTaskCount, et as ensureOutboundSessionEntry, f as buildDefaultToolPolicyPipelineSteps, fn as applyModelOverrideToSessionEntry, fr as clearAgentRunContext, ft as formatDoctorNonInteractiveHint, g as loadOpenClawPlugins, gn as isSystemEventContextChanged, gr as registerAgentRunContext, hn as enqueueSystemEvent, hr as onAgentEvent, ht as summarizeRestartSentinel, ir as setCommandLaneConcurrency, it as resolveOutboundTarget, k as createOutboundSendDeps$1, kt as hasLegacyDeliveryHints, l as getActiveEmbeddedRunCount, lt as runWithModelFallback, m as getPluginToolMeta, mn as parseVerboseOverride, mr as getAgentRunContext, n as initSubagentRegistry, nr as getTotalQueueSize, o as clearSessionQueues, on as normalizeSendPolicy, or as CommandLane, pn as applyVerboseOverride, pr as emitAgentEvent, pt as formatRestartSentinelMessage, q as setCliSessionId, qn as resolveTtsPrefsPath, qt as normalizeGroupActivation, r as listDescendantRunsForRequester, rn as requestHeartbeatNow, rr as resetAllLanes, s as runEmbeddedPiAgent, sn as resolveSendPolicy, sr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, st as resetDirectoryCache, t as countActiveDescendantRuns, tt as resolveOutboundSessionRoute, u as waitForEmbeddedPiRunEnd, v as handleSlackHttpRequest, vt as normalizeHttpWebhookUrl, wn as extractImageContentFromSource, wt as normalizeOptionalText, x as computeBackoff, xn as DEFAULT_INPUT_MAX_REDIRECTS, xt as inferLegacyName, y as readJsonBodyWithLimit, yn as DEFAULT_INPUT_IMAGE_MAX_BYTES, yt as normalizeCronJobCreate, z as createReplyDispatcher, zt as consumeGatewaySigusr1RestartAuthorization } from "./subagent-registry-zIjho4Sx.js";
 import { E as resolveSessionResetPolicy, F as resolveMainSessionKeyFromConfig, G as mergeDeliveryContext, L as snapshotSessionOrigin, M as resolveAgentMainSessionKey, N as resolveExplicitAgentSessionKey, P as resolveMainSessionKey, U as deliveryContextFromSession, V as cleanStaleLockFiles, _ as readSessionMessages, a as loadSessionStore, b as resolveSessionTranscriptCandidates, g as capArrayByJsonBytes, h as archiveSessionTranscripts, j as canonicalizeMainSessionAlias, m as archiveFileOnDisk, n as parseSessionThreadInfo, q as normalizeSessionDeliveryFields, t as extractDeliveryInfo, u as updateSessionStore, v as readSessionPreviewItemsFromTranscript, w as evaluateSessionFreshness, x as stripEnvelopeFromMessages } from "./sessions-CZFgqqFB.js";
 import { n as SILENT_REPLY_TOKEN, r as isSilentReplyText } from "./tokens-DgTg5We6.js";
 import { n as normalizeWhatsAppTarget } from "./normalize-JhFp-UPh.js";
@@ -62,10 +62,10 @@ import { c as resolveStorePath, i as resolveSessionTranscriptPath, n as resolveS
 import { a as normalizeElevatedLevel, c as normalizeUsageDisplay, d as supportsXHighThinking, l as normalizeVerboseLevel, n as formatXHighModelHint, o as normalizeReasoningLevel, s as normalizeThinkLevel, t as formatThinkingLevels } from "./thinking-DTY6T_br.js";
 import "./models-config-CBf4GFNL.js";
 import { a as resolveAgentIdentity, t as createReplyPrefixOptions } from "./reply-prefix-eqKSCWjU.js";
-import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-D1uj5PFF.js";
+import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-oTchxxCo.js";
 import { n as resolveMemorySearchConfig } from "./manager-BVmTvJv5.js";
 import "./gemini-auth-BNz8ukjq.js";
-import "./sqlite-BymrTufT.js";
+import { t as requireNodeSqlite } from "./sqlite-BymrTufT.js";
 import "./retry-CpQnihk7.js";
 import "./chunk-QdCd8YF1.js";
 import "./markdown-tables-DQ49Pa3m.js";
@@ -112,45 +112,45 @@ import { i as onHeartbeatEvent, r as getLastHeartbeatEvent, t as resolveHeartbea
 import { t as ensureOpenClawCliOnPath } from "./path-env-Co_fin1B.js";
 import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-B8QrxStA.js";
 import { n as inheritOptionFromParent } from "./command-options-6wdtBBWB.js";
-import { t as buildChannelUiCatalog } from "./catalog-DAXVp4Hp.js";
-import { t as WizardCancelledError } from "./prompts-m1IJwIAx.js";
-import { t as resolveChannelDefaultAccountId } from "./helpers-BIUvY7vn.js";
-import { t as applyPluginAutoEnable } from "./plugin-auto-enable-bi7o87Rj.js";
-import "./install-safe-path-BK8js28D.js";
-import "./skill-scanner-Bheo_OM5.js";
-import { t as buildChannelAccountSnapshot } from "./status-BUedPCLb.js";
-import "./channels-status-issues-DanmEwDB.js";
-import "./daemon-runtime-CS81-2xm.js";
-import "./runtime-guard-Cs_ClFhP.js";
-import "./systemd-CzUdukgB.js";
-import "./service-0NbohZ8s.js";
-import "./lifecycle-core-BsxpzMSa.js";
-import "./systemd-hints-BgcSCvUs.js";
-import { t as parsePort$1 } from "./parse-port-DnJYkByg.js";
-import "./runners-BrJPcqyJ.js";
-import "./diagnostics-23-FTnVz.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-BlsF7JRB.js";
-import "./table-CnYUWV1p.js";
-import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-D_JsGJ9_.js";
-import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-D8AUGe9Z.js";
-import { c as probeGateway, o as isNodeCommandAllowed, s as resolveNodeCommandAllowlist } from "./audit-D2RyL2xf.js";
-import { t as discoverGatewayBeacons } from "./bonjour-discovery-Bbq821TB.js";
-import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-BP3UtuGr.js";
-import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines } from "./health-fyXf4lEO.js";
-import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-DVRic6kO.js";
-import { a as resolveNpmChannelTag, c as DEFAULT_PACKAGE_CHANNEL, m as normalizeUpdateChannel, n as compareSemverStrings, t as checkUpdateStatus } from "./update-check-BJw7yNjU.js";
-import { t as runOnboardingWizard } from "./onboarding-CQzBfGpz.js";
-import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns-CdHUueH2.js";
-import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-ZFcCjPly.js";
-import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, s as loadAgentIdentityFromWorkspace, t as applyAgentConfig } from "./agents.config-BPyTmpPK.js";
-import "./dm-policy-shared-ClEAJ4JJ.js";
-import "./node-service-CPLJsCSU.js";
-import "./status.update-BUCokEjk.js";
-import { n as validateSystemRunCommandConsistency, t as formatExecCommand } from "./system-run-command-PyKttz6b.js";
-import { t as installSkill } from "./skills-install-D9QMhbxP.js";
-import { n as runGatewayUpdate, t as resolveAgentSessionDirs } from "./session-dirs-HNLtHJ3O.js";
-import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-NVPAcG5w.js";
-import { n as forceFreePortAndWait } from "./ports-BsxTf9Nu.js";
+import { t as buildChannelUiCatalog } from "./catalog-2EmOju0o.js";
+import { t as WizardCancelledError } from "./prompts-DbHSz44H.js";
+import { t as resolveChannelDefaultAccountId } from "./helpers-Npa3_iL5.js";
+import { t as applyPluginAutoEnable } from "./plugin-auto-enable-Co1CxSEm.js";
+import "./install-safe-path-C__62m3G.js";
+import "./skill-scanner-CIuC1feQ.js";
+import { t as buildChannelAccountSnapshot } from "./status-B8TZsG0t.js";
+import "./channels-status-issues-C4ciBh-M.js";
+import "./daemon-runtime-DnzXuU_x.js";
+import "./runtime-guard-DOhPjoet.js";
+import "./systemd-DemAzd31.js";
+import "./service-Cu7ieLvZ.js";
+import "./lifecycle-core-D-idKcJT.js";
+import "./systemd-hints-D6arXULU.js";
+import { t as parsePort$1 } from "./parse-port-QkaTJ4ru.js";
+import "./runners-C2-1DcXS.js";
+import "./diagnostics-D3Hu1kBI.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-Bpc5ZmKC.js";
+import "./table-CUa4MMQL.js";
+import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-BiHqFzVe.js";
+import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-CrPSzpAK.js";
+import { c as probeGateway, o as isNodeCommandAllowed, s as resolveNodeCommandAllowlist } from "./audit-DkAW6KBR.js";
+import { t as discoverGatewayBeacons } from "./bonjour-discovery-DZl6ArZI.js";
+import { i as pickGatewaySelfPresence, r as getStatusSummary } from "./status-CwTBZYF8.js";
+import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines } from "./health-CuD8XoQy.js";
+import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-DnNkT3mI.js";
+import { a as resolveNpmChannelTag, c as DEFAULT_PACKAGE_CHANNEL, m as normalizeUpdateChannel, n as compareSemverStrings, t as checkUpdateStatus } from "./update-check-BrrYgTQO.js";
+import { t as runOnboardingWizard } from "./onboarding-D5BRyKY0.js";
+import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns-DgHzRUEl.js";
+import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-C4IVVrZO.js";
+import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, s as loadAgentIdentityFromWorkspace, t as applyAgentConfig } from "./agents.config-DHoLdlhC.js";
+import "./dm-policy-shared-DfAxaWbA.js";
+import "./node-service-BuwCiN6g.js";
+import "./status.update-DUXJAggs.js";
+import { n as validateSystemRunCommandConsistency, t as formatExecCommand } from "./system-run-command-CPFFvnG3.js";
+import { t as installSkill } from "./skills-install-Czf3NCmL.js";
+import { n as runGatewayUpdate, t as resolveAgentSessionDirs } from "./session-dirs-CCdhZT0k.js";
+import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-IziJxxVr.js";
+import { n as forceFreePortAndWait } from "./ports-DCcAHTa_.js";
 import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
@@ -912,7 +912,7 @@ function truncateCloseReason(reason, maxBytes = CLOSE_REASON_MAX_BYTES) {
 
 //#endregion
 //#region src/infra/exec-approval-forwarder.ts
-const log$7 = createSubsystemLogger("gateway/exec-approvals");
+const log$8 = createSubsystemLogger("gateway/exec-approvals");
 const DEFAULT_MODE = "session";
 function normalizeMode(mode) {
 	return mode ?? DEFAULT_MODE;
@@ -1030,7 +1030,7 @@ async function deliverToTargets(params) {
 				payloads: [{ text: params.text }]
 			});
 		} catch (err) {
-			log$7.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
+			log$8.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
 		}
 	});
 	await Promise.allSettled(deliveries);
@@ -1265,7 +1265,7 @@ function scheduleGatewayUpdateCheck(params) {
 
 //#endregion
 //#region src/gateway/channel-health-monitor.ts
-const log$6 = createSubsystemLogger("gateway/health-monitor");
+const log$7 = createSubsystemLogger("gateway/health-monitor");
 const DEFAULT_CHECK_INTERVAL_MS = 5 * 6e4;
 const DEFAULT_STARTUP_GRACE_MS = 6e4;
 const DEFAULT_COOLDOWN_CYCLES = 2;
@@ -1314,11 +1314,11 @@ function startChannelHealthMonitor(deps) {
 					if (now - record.lastRestartAt <= cooldownMs) continue;
 					pruneOldRestarts(record, now);
 					if (record.restartsThisHour.length >= maxRestartsPerHour) {
-						log$6.warn?.(`[${channelId}:${accountId}] health-monitor: hit ${maxRestartsPerHour} restarts/hour limit, skipping`);
+						log$7.warn?.(`[${channelId}:${accountId}] health-monitor: hit ${maxRestartsPerHour} restarts/hour limit, skipping`);
 						continue;
 					}
 					const reason = !status.running ? status.reconnectAttempts && status.reconnectAttempts >= 10 ? "gave-up" : "stopped" : "stuck";
-					log$6.info?.(`[${channelId}:${accountId}] health-monitor: restarting (reason: ${reason})`);
+					log$7.info?.(`[${channelId}:${accountId}] health-monitor: restarting (reason: ${reason})`);
 					try {
 						if (status.running) await channelManager.stopChannel(channelId, accountId);
 						channelManager.resetRestartAttempts(channelId, accountId);
@@ -1327,7 +1327,7 @@ function startChannelHealthMonitor(deps) {
 						record.restartsThisHour.push({ at: now });
 						restartRecords.set(key, record);
 					} catch (err) {
-						log$6.error?.(`[${channelId}:${accountId}] health-monitor: restart failed: ${String(err)}`);
+						log$7.error?.(`[${channelId}:${accountId}] health-monitor: restart failed: ${String(err)}`);
 					}
 				}
 			}
@@ -1347,7 +1347,7 @@ function startChannelHealthMonitor(deps) {
 		abortSignal?.addEventListener("abort", stop, { once: true });
 		timer = setInterval(() => void runCheck(), checkIntervalMs);
 		if (typeof timer === "object" && "unref" in timer) timer.unref();
-		log$6.info?.(`started (interval: ${Math.round(checkIntervalMs / 1e3)}s, grace: ${Math.round(startupGraceMs / 1e3)}s)`);
+		log$7.info?.(`started (interval: ${Math.round(checkIntervalMs / 1e3)}s, grace: ${Math.round(startupGraceMs / 1e3)}s)`);
 	}
 	return { stop };
 }
@@ -2521,7 +2521,7 @@ function createAgentEventHandler({ broadcast, broadcastToConnIds, nodeSendToSess
 * Automatically starts `gog gmail watch serve` when the gateway starts,
 * if hooks.gmail is configured with an account.
 */
-const log$5 = createSubsystemLogger("gmail-watcher");
+const log$6 = createSubsystemLogger("gmail-watcher");
 const ADDRESS_IN_USE_RE = /address already in use|EADDRINUSE/i;
 function isAddressInUseError(line) {
 	return ADDRESS_IN_USE_RE.test(line);
@@ -2545,13 +2545,13 @@ async function startGmailWatch(cfg) {
 		const result = await runCommandWithTimeout(args, { timeoutMs: 12e4 });
 		if (result.code !== 0) {
 			const message = result.stderr || result.stdout || "gog watch start failed";
-			log$5.error(`watch start failed: ${message}`);
+			log$6.error(`watch start failed: ${message}`);
 			return false;
 		}
-		log$5.info(`watch started for ${cfg.account}`);
+		log$6.info(`watch started for ${cfg.account}`);
 		return true;
 	} catch (err) {
-		log$5.error(`watch start error: ${String(err)}`);
+		log$6.error(`watch start error: ${String(err)}`);
 		return false;
 	}
 }
@@ -2560,7 +2560,7 @@ async function startGmailWatch(cfg) {
 */
 function spawnGogServe(cfg) {
 	const args = buildGogWatchServeArgs(cfg);
-	log$5.info(`starting gog ${args.join(" ")}`);
+	log$6.info(`starting gog ${args.join(" ")}`);
 	let addressInUse = false;
 	const child = spawn("gog", args, {
 		stdio: [
@@ -2572,25 +2572,25 @@ function spawnGogServe(cfg) {
 	});
 	child.stdout?.on("data", (data) => {
 		const line = data.toString().trim();
-		if (line) log$5.info(`[gog] ${line}`);
+		if (line) log$6.info(`[gog] ${line}`);
 	});
 	child.stderr?.on("data", (data) => {
 		const line = data.toString().trim();
 		if (!line) return;
 		if (isAddressInUseError(line)) addressInUse = true;
-		log$5.warn(`[gog] ${line}`);
+		log$6.warn(`[gog] ${line}`);
 	});
 	child.on("error", (err) => {
-		log$5.error(`gog process error: ${String(err)}`);
+		log$6.error(`gog process error: ${String(err)}`);
 	});
 	child.on("exit", (code, signal) => {
 		if (shuttingDown) return;
 		if (addressInUse) {
-			log$5.warn("gog serve failed to bind (address already in use); stopping restarts. Another watcher is likely running. Set OPENCLAW_SKIP_GMAIL_WATCHER=1 or stop the other process.");
+			log$6.warn("gog serve failed to bind (address already in use); stopping restarts. Another watcher is likely running. Set OPENCLAW_SKIP_GMAIL_WATCHER=1 or stop the other process.");
 			watcherProcess = null;
 			return;
 		}
-		log$5.warn(`gog exited (code=${code}, signal=${signal}); restarting in 5s`);
+		log$6.warn(`gog exited (code=${code}, signal=${signal}); restarting in 5s`);
 		watcherProcess = null;
 		setTimeout(() => {
 			if (shuttingDown || !currentConfig) return;
@@ -2630,15 +2630,15 @@ async function startGmailWatcher(cfg) {
 			port: runtimeConfig.serve.port,
 			target: runtimeConfig.tailscale.target
 		});
-		log$5.info(`tailscale ${runtimeConfig.tailscale.mode} configured for port ${runtimeConfig.serve.port}`);
+		log$6.info(`tailscale ${runtimeConfig.tailscale.mode} configured for port ${runtimeConfig.serve.port}`);
 	} catch (err) {
-		log$5.error(`tailscale setup failed: ${String(err)}`);
+		log$6.error(`tailscale setup failed: ${String(err)}`);
 		return {
 			started: false,
 			reason: `tailscale setup failed: ${String(err)}`
 		};
 	}
-	if (!await startGmailWatch(runtimeConfig)) log$5.warn("gmail watch start failed, but continuing with serve");
+	if (!await startGmailWatch(runtimeConfig)) log$6.warn("gmail watch start failed, but continuing with serve");
 	shuttingDown = false;
 	watcherProcess = spawnGogServe(runtimeConfig);
 	const renewMs = runtimeConfig.renewEveryMinutes * 6e4;
@@ -2646,7 +2646,7 @@ async function startGmailWatcher(cfg) {
 		if (shuttingDown) return;
 		startGmailWatch(runtimeConfig);
 	}, renewMs);
-	log$5.info(`gmail watcher started for ${runtimeConfig.account} (renew every ${runtimeConfig.renewEveryMinutes}m)`);
+	log$6.info(`gmail watcher started for ${runtimeConfig.account} (renew every ${runtimeConfig.renewEveryMinutes}m)`);
 	return { started: true };
 }
 /**
@@ -2659,7 +2659,7 @@ async function stopGmailWatcher() {
 		renewInterval = null;
 	}
 	if (watcherProcess) {
-		log$5.info("stopping gmail watcher");
+		log$6.info("stopping gmail watcher");
 		watcherProcess.kill("SIGTERM");
 		await new Promise((resolve) => {
 			const timeout = setTimeout(() => {
@@ -2674,7 +2674,7 @@ async function stopGmailWatcher() {
 		watcherProcess = null;
 	}
 	currentConfig = null;
-	log$5.info("gmail watcher stopped");
+	log$6.info("gmail watcher stopped");
 }
 
 //#endregion
@@ -6431,7 +6431,10 @@ const BASE_METHODS = [
 	"browser.request",
 	"chat.history",
 	"chat.abort",
-	"chat.send"
+	"chat.send",
+	"audit.query",
+	"audit.stats",
+	"audit.prune"
 ];
 function listGatewayMethods() {
 	const channelMethods = listChannelPlugins().flatMap((plugin) => plugin.gatewayMethods ?? []);
@@ -6459,6 +6462,200 @@ const GATEWAY_EVENTS = [
 	GATEWAY_EVENT_UPDATE_AVAILABLE
 ];
 
+//#endregion
+//#region src/audit/audit-logger.ts
+/**
+* Audit Logger — Phase 1 Security Foundation
+*
+* Singleton service for writing, querying, and pruning audit log events.
+* Uses node:sqlite (DatabaseSync) following the same pattern as memory/manager.ts.
+*/
+const log$5 = createSubsystemLogger("audit");
+const SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS audit_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  timestamp TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+  actor_type TEXT NOT NULL,
+  actor_id TEXT,
+  action TEXT NOT NULL,
+  resource TEXT,
+  details TEXT,
+  ip TEXT,
+  result TEXT NOT NULL DEFAULT 'success',
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON audit_log(created_at);
+CREATE INDEX IF NOT EXISTS idx_audit_actor ON audit_log(actor_id);
+CREATE INDEX IF NOT EXISTS idx_audit_action ON audit_log(action);
+`;
+let instance = null;
+var AuditLogger = class AuditLogger {
+	constructor(opts) {
+		this.db = null;
+		this.pruneTimer = null;
+		this.initialized = false;
+		const stateDir = resolveStateDir(process.env);
+		this.dbPath = opts?.dbPath ?? path.join(stateDir, "audit.db");
+		this.retentionDays = opts?.retentionDays ?? 90;
+	}
+	/** Initialize the database and schema. Safe to call multiple times. */
+	init() {
+		if (this.initialized) return;
+		try {
+			const dir = path.dirname(this.dbPath);
+			if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+			const { DatabaseSync: SqliteDatabase } = requireNodeSqlite();
+			this.db = new SqliteDatabase(this.dbPath);
+			this.db.exec(SCHEMA_SQL);
+			this.initialized = true;
+			this.pruneTimer = setInterval(() => {
+				try {
+					this.prune(this.retentionDays);
+				} catch (err) {
+					log$5.warn(`auto-prune failed: ${String(err)}`);
+				}
+			}, 360 * 60 * 1e3);
+			if (this.pruneTimer?.unref) this.pruneTimer.unref();
+			try {
+				this.prune(this.retentionDays);
+			} catch {}
+			log$5.info(`audit log initialized at ${this.dbPath}`);
+		} catch (err) {
+			log$5.warn(`audit logger failed to initialize: ${String(err)}`);
+			this.initialized = false;
+		}
+	}
+	/** Log an audit event. Non-blocking, never throws. */
+	log(event) {
+		try {
+			if (!this.db) return;
+			this.db.prepare(`INSERT INTO audit_log (actor_type, actor_id, action, resource, details, ip, result)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`).run(event.actor_type, event.actor_id ?? null, event.action, event.resource ?? null, event.details ?? null, event.ip ?? null, event.result ?? "success");
+		} catch (err) {
+			log$5.warn(`audit log write failed: ${String(err)}`);
+		}
+	}
+	/** Query audit entries with filters. */
+	query(filters = {}) {
+		if (!this.db) return [];
+		try {
+			const conditions = [];
+			const params = [];
+			if (filters.action) {
+				conditions.push("action = ?");
+				params.push(filters.action);
+			}
+			if (filters.actor) {
+				conditions.push("actor_id = ?");
+				params.push(filters.actor);
+			}
+			if (filters.since != null) {
+				conditions.push("created_at >= ?");
+				params.push(filters.since);
+			}
+			if (filters.until != null) {
+				conditions.push("created_at <= ?");
+				params.push(filters.until);
+			}
+			if (filters.result) {
+				conditions.push("result = ?");
+				params.push(filters.result);
+			}
+			const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+			const limit = Math.min(filters.limit ?? 100, 1e3);
+			const offset = filters.offset ?? 0;
+			const sql = `SELECT * FROM audit_log ${where} ORDER BY created_at DESC LIMIT ? OFFSET ?`;
+			params.push(limit, offset);
+			return this.db.prepare(sql).all(...params);
+		} catch (err) {
+			log$5.warn(`audit query failed: ${String(err)}`);
+			return [];
+		}
+	}
+	/** Get summary statistics. */
+	stats() {
+		if (!this.db) return {
+			total: 0,
+			byAction: {},
+			byActor: {},
+			failures: 0,
+			oldestTimestamp: null,
+			newestTimestamp: null
+		};
+		try {
+			const totalRow = this.db.prepare("SELECT COUNT(*) as cnt FROM audit_log").get();
+			const failureRow = this.db.prepare("SELECT COUNT(*) as cnt FROM audit_log WHERE result != 'success'").get();
+			const actionRows = this.db.prepare("SELECT action, COUNT(*) as cnt FROM audit_log GROUP BY action ORDER BY cnt DESC LIMIT 50").all();
+			const actorRows = this.db.prepare("SELECT actor_id, COUNT(*) as cnt FROM audit_log WHERE actor_id IS NOT NULL GROUP BY actor_id ORDER BY cnt DESC LIMIT 50").all();
+			const oldestRow = this.db.prepare("SELECT timestamp FROM audit_log ORDER BY created_at ASC LIMIT 1").get();
+			const newestRow = this.db.prepare("SELECT timestamp FROM audit_log ORDER BY created_at DESC LIMIT 1").get();
+			const byAction = {};
+			for (const row of actionRows) byAction[row.action] = row.cnt;
+			const byActor = {};
+			for (const row of actorRows) byActor[row.actor_id] = row.cnt;
+			return {
+				total: totalRow.cnt,
+				byAction,
+				byActor,
+				failures: failureRow.cnt,
+				oldestTimestamp: oldestRow?.timestamp ?? null,
+				newestTimestamp: newestRow?.timestamp ?? null
+			};
+		} catch (err) {
+			log$5.warn(`audit stats failed: ${String(err)}`);
+			return {
+				total: 0,
+				byAction: {},
+				byActor: {},
+				failures: 0,
+				oldestTimestamp: null,
+				newestTimestamp: null
+			};
+		}
+	}
+	/** Delete entries older than the given number of days. Returns count deleted. */
+	prune(olderThanDays) {
+		if (!this.db) return 0;
+		try {
+			const cutoff = Math.floor(Date.now() / 1e3) - olderThanDays * 86400;
+			const deleted = this.db.prepare("DELETE FROM audit_log WHERE created_at < ?").run(cutoff).changes ?? 0;
+			if (deleted > 0) log$5.info(`pruned ${deleted} audit entries older than ${olderThanDays} days`);
+			return deleted;
+		} catch (err) {
+			log$5.warn(`audit prune failed: ${String(err)}`);
+			return 0;
+		}
+	}
+	/** Graceful shutdown. */
+	close() {
+		if (this.pruneTimer) {
+			clearInterval(this.pruneTimer);
+			this.pruneTimer = null;
+		}
+		try {
+			this.db?.close();
+		} catch {}
+		this.db = null;
+		this.initialized = false;
+	}
+	/** Get singleton instance. */
+	static getInstance() {
+		if (!instance) instance = new AuditLogger();
+		return instance;
+	}
+	/** Initialize singleton. Call at gateway startup. */
+	static init(opts) {
+		if (!instance) instance = new AuditLogger(opts);
+		instance.init();
+		return instance;
+	}
+	/** Destroy singleton (for testing). */
+	static destroy() {
+		instance?.close();
+		instance = null;
+	}
+};
+
 //#endregion
 //#region src/gateway/control-plane-audit.ts
 function normalizePart$1(value, fallback) {
@@ -8321,6 +8518,58 @@ const agentsHandlers = {
 	}
 };
 
+//#endregion
+//#region src/gateway/server-methods/audit.ts
+/**
+* Audit RPC method handlers (#6)
+* Registers audit.query and audit.stats as gateway RPC methods.
+*/
+const auditHandlers = {
+	"audit.query": ({ params, respond }) => {
+		try {
+			const logger = AuditLogger.getInstance();
+			const filters = {};
+			if (typeof params.action === "string") filters.action = params.action;
+			if (typeof params.actor === "string") filters.actor = params.actor;
+			if (typeof params.since === "number") filters.since = params.since;
+			if (typeof params.until === "number") filters.until = params.until;
+			if (typeof params.result === "string") filters.result = params.result;
+			if (typeof params.limit === "number") filters.limit = params.limit;
+			if (typeof params.offset === "number") filters.offset = params.offset;
+			const entries = logger.query(filters);
+			respond(true, {
+				entries,
+				count: entries.length
+			}, void 0);
+		} catch (err) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, `audit query failed: ${String(err)}`));
+		}
+	},
+	"audit.stats": ({ respond }) => {
+		try {
+			respond(true, AuditLogger.getInstance().stats(), void 0);
+		} catch (err) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, `audit stats failed: ${String(err)}`));
+		}
+	},
+	"audit.prune": ({ params, respond }) => {
+		try {
+			const logger = AuditLogger.getInstance();
+			const olderThanDays = typeof params.olderThanDays === "number" ? params.olderThanDays : 90;
+			if (olderThanDays < 1) {
+				respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "olderThanDays must be >= 1"));
+				return;
+			}
+			respond(true, {
+				deleted: logger.prune(olderThanDays),
+				olderThanDays
+			}, void 0);
+		} catch (err) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, `audit prune failed: ${String(err)}`));
+		}
+	}
+};
+
 //#endregion
 //#region src/gateway/server-methods/nodes.helpers.ts
 function respondInvalidParams(params) {
@@ -12445,7 +12694,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-GvqKSJEV.js");
+			const { handleNodeEvent } = await import("./server-node-events-DWWxWJHk.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,
@@ -14313,6 +14562,54 @@ const CONTROL_PLANE_WRITE_METHODS = new Set([
 	"config.patch",
 	"update.run"
 ]);
+/** Methods that always get audit logged when audit is enabled. */
+const AUDIT_SENSITIVE_METHODS = new Set([
+	"config.set",
+	"config.apply",
+	"config.patch",
+	"device.pair.approve",
+	"device.pair.reject",
+	"node.pair.approve",
+	"node.pair.reject",
+	"exec.approvals.set",
+	"sessions.delete",
+	"update.run"
+]);
+function resolveAuditConfig() {
+	try {
+		const security = loadConfig().security;
+		return {
+			enabled: security?.audit?.enabled !== false,
+			level: security?.audit?.level ?? "sensitive"
+		};
+	} catch {
+		return {
+			enabled: true,
+			level: "sensitive"
+		};
+	}
+}
+function shouldAuditMethod(method, level) {
+	if (level === "off") return false;
+	if (level === "all") return true;
+	return AUDIT_SENSITIVE_METHODS.has(method);
+}
+function auditLogMethodCall(method, client, result) {
+	try {
+		const logger = AuditLogger.getInstance();
+		const actorType = client?.connect?.role ?? "unknown";
+		const actorId = client?.connect?.client?.id ?? client?.connect?.device?.id ?? void 0;
+		const ip = client?.clientIp ?? void 0;
+		logger.log({
+			actor_type: actorType,
+			actor_id: actorId,
+			action: method,
+			ip,
+			result,
+			details: result !== "success" ? `method ${method} ${result}` : void 0
+		});
+	} catch {}
+}
 function authorizeGatewayMethod(method, client) {
 	if (!client?.connect) return null;
 	if (method === "health") return null;
@@ -14355,12 +14652,14 @@ const coreGatewayHandlers = {
 	...usageHandlers,
 	...agentHandlers,
 	...agentsHandlers,
-	...browserHandlers
+	...browserHandlers,
+	...auditHandlers
 };
 async function handleGatewayRequest(opts) {
 	const { req, respond, client, isWebchatConnect, context } = opts;
 	const authError = authorizeGatewayMethod(req.method, client);
 	if (authError) {
+		if (resolveAuditConfig().enabled) auditLogMethodCall(req.method, client, "denied");
 		respond(false, void 0, authError);
 		return;
 	}
@@ -14385,7 +14684,22 @@ async function handleGatewayRequest(opts) {
 		respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `unknown method: ${req.method}`));
 		return;
 	}
-	await handler({
+	const auditCfg = resolveAuditConfig();
+	if (auditCfg.enabled && shouldAuditMethod(req.method, auditCfg.level)) {
+		const originalRespond = respond;
+		const auditedRespond = (ok, payload, error, meta) => {
+			auditLogMethodCall(req.method, client, ok ? "success" : "failure");
+			originalRespond(ok, payload, error, meta);
+		};
+		await handler({
+			req,
+			params: req.params ?? {},
+			client,
+			isWebchatConnect,
+			respond: auditedRespond,
+			context
+		});
+	} else await handler({
 		req,
 		params: req.params ?? {},
 		client,
@@ -18862,6 +19176,12 @@ async function startGatewayMemoryBackend(params) {
 //#region src/gateway/server-startup.ts
 const SESSION_LOCK_STALE_MS = 1800 * 1e3;
 async function startGatewaySidecars(params) {
+	try {
+		const auditRetention = params.cfg.security;
+		AuditLogger.init({ retentionDays: auditRetention?.audit?.retentionDays });
+	} catch (err) {
+		params.log.warn(`audit logger initialization failed: ${String(err)}`);
+	}
 	try {
 		const sessionDirs = await resolveAgentSessionDirs(resolveStateDir(process.env));
 		for (const sessionsDir of sessionDirs) await cleanStaleLockFiles({