openclaw-cortex 3.1.0 → 3.2.0

package/dist/{gateway-cli-bSwcceJd.js → gateway-cli-yd0wJM_1.js}

@@ -2,7 +2,7 @@ import { _ as expandHomePrefix, g as resolveStateDir, i as isNixMode, l as resol
 import { B as getResolvedLoggerSettings, D as isPlainObject, E as truncateUtf16Safe, P as setVerbose, R as getChildLogger, S as shortenHomePath, c as ensureDir, r as clamp, t as CONFIG_DIR, y as resolveUserPath, z as getLogger } from "./utils-cLdsPM0M.js";
 import { n as isRich, r as theme, t as colorize } from "./theme-CvDUwCeH.js";
 import { a as normalizeElevatedLevel, c as normalizeUsageDisplay, d as supportsXHighThinking, l as normalizeVerboseLevel, n as formatXHighModelHint, o as normalizeReasoningLevel, s as normalizeThinkLevel, t as formatThinkingLevels } from "./thinking-B3X4Pu2T.js";
-import { $ as normalizeOptionalAgentId, $n as CommandLane, $t as isExternalHookSession, A as resolveOutboundSessionRoute, An as getAgentRunContext, At as sleepWithAbort, B as setGatewaySigusr1RestartPolicy, Bn as resolveTtsPrefsPath, Bt as normalizeSendPolicy, C as loadCombinedSessionStoreForGateway, Cn as countActiveDescendantRuns, Cr as normalizeMimeList, D as resolveSessionModelRef, Dn as runSubagentAnnounceFlow, Dt as readJsonBodyWithLimit, E as resolveGatewaySessionStoreTarget, Er as resolveAgentTimeoutMs, Et as handleSlackHttpRequest, F as deferGatewayRestartUntilIdle, Fn as isTtsEnabled, Gn as OPENAI_TTS_MODELS, Gt as getCliSessionId, H as consumeRestartSentinel, Hn as setTtsEnabled, Ht as createDefaultDeps, I as emitGatewayRestart, In as isTtsProviderConfigured, J as writeRestartSentinel, K as summarizeRestartSentinel, Kn as OPENAI_TTS_VOICES, Kt as setCliSessionId, L as isGatewaySigusr1RestartExternallyAllowed, Ln as resolveTtsApiKey, Lt as resolveOutboundTarget, M as resetDirectoryCache, Mn as registerAgentRunContext, Nn as resolveUserTimezone, Nt as resolveAgentDeliveryPlan, On as clearAgentRunContext, Ot as requestBodyErrorToText, P as consumeGatewaySigusr1RestartAuthorization, Pn as getTtsProvider, Pt as resolveAgentOutboundTarget, Q as inferLegacyName, Qn as waitForActiveTasks, Qt as getHookType, R as markGatewaySigusr1RestartHandled, Rn as resolveTtsAutoMode, Rt as resolveSessionDeliveryTarget, S as listSessionsFromStore, Sr as extractImageContentFromSource, T as pruneLegacyStoreKeys, Tn as listDescendantRunsForRequester, U as formatDoctorNonInteractiveHint, Un as setTtsProvider, Ut as createOutboundSendDeps$1, V as setPreRestartDeferralCheck, Vn as resolveTtsProviderOrder, Vt as resolveSendPolicy, W as formatRestartSentinelMessage, Wn as textToSpeech, Wt as runWithModelFallback, X as normalizeCronJobCreate, Xn as resetAllLanes, Xt as buildSafeExternalPrompt, Y as normalizeHttpWebhookUrl, Yn as getTotalQueueSize, Z as normalizeCronJobPatch, Zn as setCommandLaneConcurrency, Zt as detectSuspiciousPatterns, _ as readLatestAssistantReply, _r as DEFAULT_INPUT_IMAGE_MAX_BYTES, _t as loadOpenClawPlugins, ar as lookupContextTokens, at as buildDeliveryFromLegacyPayload, bn as stopSubagentsForRequester, br as DEFAULT_INPUT_TIMEOUT_MS, c as clearSessionQueues, cn as dispatchInboundMessage, d as getActiveEmbeddedRunCount, dr as applyVerboseOverride, dt as persistBrowserProxyFiles, er as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, et as normalizeOptionalSessionKey, f as waitForEmbeddedPiRunEnd, fr as parseVerboseOverride, ft as requestHeartbeatNow, g as createOpenClawTools, gn as formatZonedTimestamp, ht as getPluginToolMeta, i as resolveCronStyleNow, ir as stripHeartbeatToken, it as migrateLegacyCronPayload, jn as onAgentEvent, jt as agentCommand, k as ensureOutboundSessionEntry, kn as emitAgentEvent, kt as computeBackoff, l as runEmbeddedPiAgent, ln as createReplyDispatcher, m as buildDefaultToolPolicyPipelineSteps, mr as isSystemEventContextChanged, n as BARE_SESSION_RESET_PROMPT, nt as normalizePayloadToSystemText, ot as hasLegacyDeliveryHints, p as applyToolPolicyPipeline, pr as enqueueSystemEvent, qn as getActiveTaskCount, qt as runCliAgent, rn as buildHistoryContextFromEntries, rt as normalizeRequiredName, st as stripLegacyDeliveryFields, tt as normalizeOptionalText, u as abortEmbeddedPiRun, un as getTotalPendingReplies, ur as applyModelOverrideToSessionEntry, ut as applyBrowserProxyPaths, v as resolveAnnounceTargetFromKey, vr as DEFAULT_INPUT_IMAGE_MIMES, w as loadSessionEntry, wn as initSubagentRegistry, wr as resolveInputFileLimits, x as listAgentsForGateway, xr as extractFileContentFromSource, xt as loadProviderUsageSummary, y as canonicalizeSpawnedByForAgent, yn as isAbortTrigger, yr as DEFAULT_INPUT_MAX_REDIRECTS, yt as normalizeGroupActivation, z as scheduleGatewaySigusr1Restart, zn as resolveTtsConfig, zt as createOutboundSendDeps } from "./reply-CwuYaPUY.js";
+import { $ as normalizeOptionalAgentId, $n as CommandLane, $t as isExternalHookSession, A as resolveOutboundSessionRoute, An as getAgentRunContext, At as sleepWithAbort, B as setGatewaySigusr1RestartPolicy, Bn as resolveTtsPrefsPath, Bt as normalizeSendPolicy, C as loadCombinedSessionStoreForGateway, Cn as countActiveDescendantRuns, Cr as normalizeMimeList, D as resolveSessionModelRef, Dn as runSubagentAnnounceFlow, Dt as readJsonBodyWithLimit, E as resolveGatewaySessionStoreTarget, Er as resolveAgentTimeoutMs, Et as handleSlackHttpRequest, F as deferGatewayRestartUntilIdle, Fn as isTtsEnabled, Gn as OPENAI_TTS_MODELS, Gt as getCliSessionId, H as consumeRestartSentinel, Hn as setTtsEnabled, Ht as createDefaultDeps, I as emitGatewayRestart, In as isTtsProviderConfigured, J as writeRestartSentinel, K as summarizeRestartSentinel, Kn as OPENAI_TTS_VOICES, Kt as setCliSessionId, L as isGatewaySigusr1RestartExternallyAllowed, Ln as resolveTtsApiKey, Lt as resolveOutboundTarget, M as resetDirectoryCache, Mn as registerAgentRunContext, Nn as resolveUserTimezone, Nt as resolveAgentDeliveryPlan, On as clearAgentRunContext, Ot as requestBodyErrorToText, P as consumeGatewaySigusr1RestartAuthorization, Pn as getTtsProvider, Pt as resolveAgentOutboundTarget, Q as inferLegacyName, Qn as waitForActiveTasks, Qt as getHookType, R as markGatewaySigusr1RestartHandled, Rn as resolveTtsAutoMode, Rt as resolveSessionDeliveryTarget, S as listSessionsFromStore, Sr as extractImageContentFromSource, T as pruneLegacyStoreKeys, Tn as listDescendantRunsForRequester, U as formatDoctorNonInteractiveHint, Un as setTtsProvider, Ut as createOutboundSendDeps$1, V as setPreRestartDeferralCheck, Vn as resolveTtsProviderOrder, Vt as resolveSendPolicy, W as formatRestartSentinelMessage, Wn as textToSpeech, Wt as runWithModelFallback, X as normalizeCronJobCreate, Xn as resetAllLanes, Xt as buildSafeExternalPrompt, Y as normalizeHttpWebhookUrl, Yn as getTotalQueueSize, Z as normalizeCronJobPatch, Zn as setCommandLaneConcurrency, Zt as detectSuspiciousPatterns, _ as readLatestAssistantReply, _r as DEFAULT_INPUT_IMAGE_MAX_BYTES, _t as loadOpenClawPlugins, ar as lookupContextTokens, at as buildDeliveryFromLegacyPayload, bn as stopSubagentsForRequester, br as DEFAULT_INPUT_TIMEOUT_MS, c as clearSessionQueues, cn as dispatchInboundMessage, d as getActiveEmbeddedRunCount, dr as applyVerboseOverride, dt as persistBrowserProxyFiles, er as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, et as normalizeOptionalSessionKey, f as waitForEmbeddedPiRunEnd, fr as parseVerboseOverride, ft as requestHeartbeatNow, g as createOpenClawTools, gn as formatZonedTimestamp, ht as getPluginToolMeta, i as resolveCronStyleNow, ir as stripHeartbeatToken, it as migrateLegacyCronPayload, jn as onAgentEvent, jt as agentCommand, k as ensureOutboundSessionEntry, kn as emitAgentEvent, kt as computeBackoff, l as runEmbeddedPiAgent, ln as createReplyDispatcher, m as buildDefaultToolPolicyPipelineSteps, mr as isSystemEventContextChanged, n as BARE_SESSION_RESET_PROMPT, nt as normalizePayloadToSystemText, ot as hasLegacyDeliveryHints, p as applyToolPolicyPipeline, pr as enqueueSystemEvent, qn as getActiveTaskCount, qt as runCliAgent, rn as buildHistoryContextFromEntries, rt as normalizeRequiredName, st as stripLegacyDeliveryFields, tt as normalizeOptionalText, u as abortEmbeddedPiRun, un as getTotalPendingReplies, ur as applyModelOverrideToSessionEntry, ut as applyBrowserProxyPaths, v as resolveAnnounceTargetFromKey, vr as DEFAULT_INPUT_IMAGE_MIMES, w as loadSessionEntry, wn as initSubagentRegistry, wr as resolveInputFileLimits, x as listAgentsForGateway, xr as extractFileContentFromSource, xt as loadProviderUsageSummary, y as canonicalizeSpawnedByForAgent, yn as isAbortTrigger, yr as DEFAULT_INPUT_MAX_REDIRECTS, yt as normalizeGroupActivation, z as scheduleGatewaySigusr1Restart, zn as resolveTtsConfig, zt as createOutboundSendDeps } from "./reply-BNfv4Ttn.js";
 import { b as isSubagentSessionKey, d as resolveAgentIdFromSessionKey, h as toAgentStoreSessionKey, i as buildAgentMainSessionKey, l as normalizeAgentId, m as toAgentRequestSessionKey, n as DEFAULT_AGENT_ID, s as classifySessionKeyShape, t as DEFAULT_ACCOUNT_ID, u as normalizeMainKey, v as isCronRunSessionKey, x as parseAgentSessionKey } from "./session-key-DAZmp8ll.js";
 import { r as matchesSkillFilter, t as resolveOpenClawPackageRoot } from "./openclaw-root-ColUA4L7.js";
 import { C as createInternalHookEvent, S as clearInternalHooks, T as triggerInternalHook, d as getActivePluginRegistry, m as createEmptyPluginRegistry, r as DEFAULT_CHAT_CHANNEL, t as CHANNEL_IDS, w as registerInternalHook } from "./registry-DDRoNo5B.js";
@@ -20,7 +20,7 @@ import "./send-ClCfv1Nb.js";
 import { B as resolveSubagentMaxConcurrent, C as parseDurationMs, H as resolveRuntimeServiceVersion, N as applyMergePatch, P as applyLegacyMigrations, S as sensitive, V as VERSION, a as parseConfigJson5, c as resolveConfigSnapshotHash, d as OpenClawSchema, i as loadConfig, l as writeConfigFile, n as migrateLegacyConfig, o as readConfigFileSnapshot, r as createConfigIO, s as readConfigFileSnapshotForWrite, u as validateConfigObjectWithPlugins, z as resolveAgentMaxConcurrent } from "./config-CfZKt-lz.js";
 import { a as isPathInsideWithRealpath } from "./legacy-names-BIsQcGF_.js";
 import { l as isTestDefaultMemorySlotDisabled } from "./manifest-registry-Dc6dLoSA.js";
-import { d as registerUnhandledRejectionHandler } from "./runner-CXxgpUTT.js";
+import { d as registerUnhandledRejectionHandler } from "./runner-DZGwjCQ8.js";
 import "./image-Cubocx3K.js";
 import "./models-config-DtKtMZJY.js";
 import "./pi-model-discovery-Bakt-Qrp.js";
@@ -63,8 +63,8 @@ import "./tool-display-7iDQNAJ5.js";
 import { t as fetchWithSsrFGuard } from "./fetch-guard-BVr_v0Vr.js";
 import "./api-key-rotation-BpUXNMYn.js";
 import "./local-roots-Cze75B7o.js";
-import "./sqlite-BGYD8ULr.js";
-import { n as loadModelCatalog } from "./model-catalog-yzrJiO3y.js";
+import { t as requireNodeSqlite } from "./sqlite-BGYD8ULr.js";
+import { n as loadModelCatalog } from "./model-catalog-CbowpOxX.js";
 import { n as SILENT_REPLY_TOKEN, r as isSilentReplyText } from "./tokens-dp8h1iSk.js";
 import { n as createBrowserRouteDispatcher, r as getMachineDisplayName } from "./with-timeout-Con3HGLp.js";
 import { C as getGlobalHookRunner, T as runGlobalGatewayStopSafely, o as normalizeReplyPayloadsForDelivery, t as deliverOutboundPayloads } from "./deliver-Dy_w9w-y.js";
@@ -73,7 +73,7 @@ import "./diagnostic-session-state-Cmft6aFp.js";
 import "./send-YNV1KCGc.js";
 import "./model-CWyK3rP8.js";
 import { a as resolveAgentIdentity, t as createReplyPrefixOptions } from "./reply-prefix-qYNJ-Dun.js";
-import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-DWydhV-V.js";
+import { i as resolveMemoryBackendConfig, r as getMemorySearchManager } from "./memory-cli-BuqY12GX.js";
 import { n as resolveMemorySearchConfig } from "./manager-zXFSa7G6.js";
 import "./retry-BfUkac0g.js";
 import "./chunk-DyTaAomH.js";
@@ -121,42 +121,42 @@ import { t as buildChannelUiCatalog } from "./catalog-Ce6N7fVU.js";
 import { t as buildWorkspaceSkillStatus } from "./skills-status-Dfz_xnsm.js";
 import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-m4gs9MB5.js";
 import { n as inheritOptionFromParent } from "./command-options-DOOvAdsg.js";
-import { t as WizardCancelledError } from "./prompts-NOUgk6FH.js";
-import { t as resolveChannelDefaultAccountId } from "./helpers-Ctj8giHC.js";
-import { t as applyPluginAutoEnable } from "./plugin-auto-enable-Czk5vqi1.js";
-import "./install-safe-path-Cx0jIhFX.js";
-import "./skill-scanner-CwX9i_5k.js";
-import { t as buildChannelAccountSnapshot } from "./status-TtGsgDjP.js";
-import "./channels-status-issues-COukP8Y6.js";
-import "./daemon-runtime-D4iQgg-u.js";
-import "./systemd-0aPKXWO6.js";
-import "./service-Bci1KDFO.js";
-import "./lifecycle-core-Bt5BqaIY.js";
-import "./systemd-hints-k45i-vVl.js";
-import { t as parsePort$1 } from "./parse-port-C02PeAGr.js";
-import "./runners-BAXojh38.js";
-import "./diagnostics-Ef27CLfy.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-CAME8LzX.js";
-import "./table-BUWXR5y-.js";
-import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-Ch3SpQBE.js";
-import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-DNTO_mJp.js";
-import { c as probeGateway, o as isNodeCommandAllowed, s as resolveNodeCommandAllowlist } from "./audit-BjY3NDuN.js";
-import { t as discoverGatewayBeacons } from "./bonjour-discovery-Dci4cd0G.js";
-import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status-_qW_2na1.js";
-import { c as startHeartbeatRunner, i as styleHealthChannelLine, n as getHealthSnapshot, o as runHeartbeatOnce, s as setHeartbeatsEnabled, t as formatHealthChannelLines } from "./health-6g5hi28u.js";
-import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-DDs6rXoP.js";
-import { a as resolveNpmChannelTag, c as DEFAULT_PACKAGE_CHANNEL, m as normalizeUpdateChannel, n as compareSemverStrings, t as checkUpdateStatus } from "./update-check-xr9SsfM1.js";
-import { t as runOnboardingWizard } from "./onboarding-De7bUYn0.js";
-import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns-ByshEodu.js";
-import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-DhpSrQNl.js";
-import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, s as loadAgentIdentityFromWorkspace, t as applyAgentConfig } from "./agents.config-D731KhB0.js";
-import "./dm-policy-shared-CVbsDo_m.js";
-import "./node-service-D1-7_1cb.js";
-import "./status.update-P7aU2obf.js";
-import { n as validateSystemRunCommandConsistency, t as formatExecCommand } from "./system-run-command-BOJwzLhj.js";
-import { t as installSkill } from "./skills-install-DlMTcQDE.js";
-import { n as runGatewayUpdate, t as resolveAgentSessionDirs } from "./session-dirs-BMCU5I9u.js";
-import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-BPoYjLyJ.js";
+import { t as WizardCancelledError } from "./prompts-C27EhvcG.js";
+import { t as resolveChannelDefaultAccountId } from "./helpers-xdkmLQDw.js";
+import { t as applyPluginAutoEnable } from "./plugin-auto-enable-CgzsK3UF.js";
+import "./install-safe-path-BUZoxvjo.js";
+import "./skill-scanner-DnsSvRKK.js";
+import { t as buildChannelAccountSnapshot } from "./status-DmhrztXn.js";
+import "./channels-status-issues-xbZicfvF.js";
+import "./daemon-runtime-diKhAkzH.js";
+import "./systemd-DokFcnJ7.js";
+import "./service-7TtUcMJq.js";
+import "./lifecycle-core-DtN4Wg9p.js";
+import "./systemd-hints-DKcj1qba.js";
+import { t as parsePort$1 } from "./parse-port-BnVa643B.js";
+import "./runners-GZYUkx-2.js";
+import "./diagnostics-D7bn87xJ.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-zo00dvxw.js";
+import "./table-D6Gdu916.js";
+import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-5AVs3ht0.js";
+import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-CzoHL8EG.js";
+import { c as probeGateway, o as isNodeCommandAllowed, s as resolveNodeCommandAllowlist } from "./audit-qELipjtd.js";
+import { t as discoverGatewayBeacons } from "./bonjour-discovery-D7009yxB.js";
+import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status--mrN_W_U.js";
+import { c as startHeartbeatRunner, i as styleHealthChannelLine, n as getHealthSnapshot, o as runHeartbeatOnce, s as setHeartbeatsEnabled, t as formatHealthChannelLines } from "./health-HfXeNmAj.js";
+import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-LA1g8l2Z.js";
+import { a as resolveNpmChannelTag, c as DEFAULT_PACKAGE_CHANNEL, m as normalizeUpdateChannel, n as compareSemverStrings, t as checkUpdateStatus } from "./update-check-DnX0d2ne.js";
+import { t as runOnboardingWizard } from "./onboarding-JoS3gVBZ.js";
+import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns-CBVQ1O88.js";
+import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-Rfb3FX0J.js";
+import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, s as loadAgentIdentityFromWorkspace, t as applyAgentConfig } from "./agents.config-sDVfdzxD.js";
+import "./dm-policy-shared-CwzTKPWR.js";
+import "./node-service-DMNdtnuy.js";
+import "./status.update-s8H29Man.js";
+import { n as validateSystemRunCommandConsistency, t as formatExecCommand } from "./system-run-command-B8ZYVrSF.js";
+import { t as installSkill } from "./skills-install-DZ5aRsyP.js";
+import { n as runGatewayUpdate, t as resolveAgentSessionDirs } from "./session-dirs-CIPNs4EK.js";
+import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-C1EdIb-r.js";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import * as fsSync from "node:fs";
 import fs from "node:fs";
@@ -918,7 +918,7 @@ function truncateCloseReason(reason, maxBytes = CLOSE_REASON_MAX_BYTES) {
 
 //#endregion
 //#region src/infra/exec-approval-forwarder.ts
-const log$7 = createSubsystemLogger("gateway/exec-approvals");
+const log$8 = createSubsystemLogger("gateway/exec-approvals");
 const DEFAULT_MODE = "session";
 function normalizeMode(mode) {
 	return mode ?? DEFAULT_MODE;
@@ -1036,7 +1036,7 @@ async function deliverToTargets(params) {
 				payloads: [{ text: params.text }]
 			});
 		} catch (err) {
-			log$7.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
+			log$8.error(`exec approvals: failed to deliver to ${channel}:${target.to}: ${String(err)}`);
 		}
 	});
 	await Promise.allSettled(deliveries);
@@ -1271,7 +1271,7 @@ function scheduleGatewayUpdateCheck(params) {
 
 //#endregion
 //#region src/gateway/channel-health-monitor.ts
-const log$6 = createSubsystemLogger("gateway/health-monitor");
+const log$7 = createSubsystemLogger("gateway/health-monitor");
 const DEFAULT_CHECK_INTERVAL_MS = 5 * 6e4;
 const DEFAULT_STARTUP_GRACE_MS = 6e4;
 const DEFAULT_COOLDOWN_CYCLES = 2;
@@ -1320,11 +1320,11 @@ function startChannelHealthMonitor(deps) {
 					if (now - record.lastRestartAt <= cooldownMs) continue;
 					pruneOldRestarts(record, now);
 					if (record.restartsThisHour.length >= maxRestartsPerHour) {
-						log$6.warn?.(`[${channelId}:${accountId}] health-monitor: hit ${maxRestartsPerHour} restarts/hour limit, skipping`);
+						log$7.warn?.(`[${channelId}:${accountId}] health-monitor: hit ${maxRestartsPerHour} restarts/hour limit, skipping`);
 						continue;
 					}
 					const reason = !status.running ? status.reconnectAttempts && status.reconnectAttempts >= 10 ? "gave-up" : "stopped" : "stuck";
-					log$6.info?.(`[${channelId}:${accountId}] health-monitor: restarting (reason: ${reason})`);
+					log$7.info?.(`[${channelId}:${accountId}] health-monitor: restarting (reason: ${reason})`);
 					try {
 						if (status.running) await channelManager.stopChannel(channelId, accountId);
 						channelManager.resetRestartAttempts(channelId, accountId);
@@ -1333,7 +1333,7 @@ function startChannelHealthMonitor(deps) {
 						record.restartsThisHour.push({ at: now });
 						restartRecords.set(key, record);
 					} catch (err) {
-						log$6.error?.(`[${channelId}:${accountId}] health-monitor: restart failed: ${String(err)}`);
+						log$7.error?.(`[${channelId}:${accountId}] health-monitor: restart failed: ${String(err)}`);
 					}
 				}
 			}
@@ -1353,7 +1353,7 @@ function startChannelHealthMonitor(deps) {
 		abortSignal?.addEventListener("abort", stop, { once: true });
 		timer = setInterval(() => void runCheck(), checkIntervalMs);
 		if (typeof timer === "object" && "unref" in timer) timer.unref();
-		log$6.info?.(`started (interval: ${Math.round(checkIntervalMs / 1e3)}s, grace: ${Math.round(startupGraceMs / 1e3)}s)`);
+		log$7.info?.(`started (interval: ${Math.round(checkIntervalMs / 1e3)}s, grace: ${Math.round(startupGraceMs / 1e3)}s)`);
 	}
 	return { stop };
 }
@@ -2527,7 +2527,7 @@ function createAgentEventHandler({ broadcast, broadcastToConnIds, nodeSendToSess
 * Automatically starts `gog gmail watch serve` when the gateway starts,
 * if hooks.gmail is configured with an account.
 */
-const log$5 = createSubsystemLogger("gmail-watcher");
+const log$6 = createSubsystemLogger("gmail-watcher");
 const ADDRESS_IN_USE_RE = /address already in use|EADDRINUSE/i;
 function isAddressInUseError(line) {
 	return ADDRESS_IN_USE_RE.test(line);
@@ -2551,13 +2551,13 @@ async function startGmailWatch(cfg) {
 		const result = await runCommandWithTimeout(args, { timeoutMs: 12e4 });
 		if (result.code !== 0) {
 			const message = result.stderr || result.stdout || "gog watch start failed";
-			log$5.error(`watch start failed: ${message}`);
+			log$6.error(`watch start failed: ${message}`);
 			return false;
 		}
-		log$5.info(`watch started for ${cfg.account}`);
+		log$6.info(`watch started for ${cfg.account}`);
 		return true;
 	} catch (err) {
-		log$5.error(`watch start error: ${String(err)}`);
+		log$6.error(`watch start error: ${String(err)}`);
 		return false;
 	}
 }
@@ -2566,7 +2566,7 @@ async function startGmailWatch(cfg) {
 */
 function spawnGogServe(cfg) {
 	const args = buildGogWatchServeArgs(cfg);
-	log$5.info(`starting gog ${args.join(" ")}`);
+	log$6.info(`starting gog ${args.join(" ")}`);
 	let addressInUse = false;
 	const child = spawn("gog", args, {
 		stdio: [
@@ -2578,25 +2578,25 @@ function spawnGogServe(cfg) {
 	});
 	child.stdout?.on("data", (data) => {
 		const line = data.toString().trim();
-		if (line) log$5.info(`[gog] ${line}`);
+		if (line) log$6.info(`[gog] ${line}`);
 	});
 	child.stderr?.on("data", (data) => {
 		const line = data.toString().trim();
 		if (!line) return;
 		if (isAddressInUseError(line)) addressInUse = true;
-		log$5.warn(`[gog] ${line}`);
+		log$6.warn(`[gog] ${line}`);
 	});
 	child.on("error", (err) => {
-		log$5.error(`gog process error: ${String(err)}`);
+		log$6.error(`gog process error: ${String(err)}`);
 	});
 	child.on("exit", (code, signal) => {
 		if (shuttingDown) return;
 		if (addressInUse) {
-			log$5.warn("gog serve failed to bind (address already in use); stopping restarts. Another watcher is likely running. Set OPENCLAW_SKIP_GMAIL_WATCHER=1 or stop the other process.");
+			log$6.warn("gog serve failed to bind (address already in use); stopping restarts. Another watcher is likely running. Set OPENCLAW_SKIP_GMAIL_WATCHER=1 or stop the other process.");
 			watcherProcess = null;
 			return;
 		}
-		log$5.warn(`gog exited (code=${code}, signal=${signal}); restarting in 5s`);
+		log$6.warn(`gog exited (code=${code}, signal=${signal}); restarting in 5s`);
 		watcherProcess = null;
 		setTimeout(() => {
 			if (shuttingDown || !currentConfig) return;
@@ -2636,15 +2636,15 @@ async function startGmailWatcher(cfg) {
 			port: runtimeConfig.serve.port,
 			target: runtimeConfig.tailscale.target
 		});
-		log$5.info(`tailscale ${runtimeConfig.tailscale.mode} configured for port ${runtimeConfig.serve.port}`);
+		log$6.info(`tailscale ${runtimeConfig.tailscale.mode} configured for port ${runtimeConfig.serve.port}`);
 	} catch (err) {
-		log$5.error(`tailscale setup failed: ${String(err)}`);
+		log$6.error(`tailscale setup failed: ${String(err)}`);
 		return {
 			started: false,
 			reason: `tailscale setup failed: ${String(err)}`
 		};
 	}
-	if (!await startGmailWatch(runtimeConfig)) log$5.warn("gmail watch start failed, but continuing with serve");
+	if (!await startGmailWatch(runtimeConfig)) log$6.warn("gmail watch start failed, but continuing with serve");
 	shuttingDown = false;
 	watcherProcess = spawnGogServe(runtimeConfig);
 	const renewMs = runtimeConfig.renewEveryMinutes * 6e4;
@@ -2652,7 +2652,7 @@ async function startGmailWatcher(cfg) {
 		if (shuttingDown) return;
 		startGmailWatch(runtimeConfig);
 	}, renewMs);
-	log$5.info(`gmail watcher started for ${runtimeConfig.account} (renew every ${runtimeConfig.renewEveryMinutes}m)`);
+	log$6.info(`gmail watcher started for ${runtimeConfig.account} (renew every ${runtimeConfig.renewEveryMinutes}m)`);
 	return { started: true };
 }
 /**
@@ -2665,7 +2665,7 @@ async function stopGmailWatcher() {
 		renewInterval = null;
 	}
 	if (watcherProcess) {
-		log$5.info("stopping gmail watcher");
+		log$6.info("stopping gmail watcher");
 		watcherProcess.kill("SIGTERM");
 		await new Promise((resolve) => {
 			const timeout = setTimeout(() => {
@@ -2680,7 +2680,7 @@ async function stopGmailWatcher() {
 		watcherProcess = null;
 	}
 	currentConfig = null;
-	log$5.info("gmail watcher stopped");
+	log$6.info("gmail watcher stopped");
 }
 
 //#endregion
@@ -6437,7 +6437,10 @@ const BASE_METHODS = [
 	"browser.request",
 	"chat.history",
 	"chat.abort",
-	"chat.send"
+	"chat.send",
+	"audit.query",
+	"audit.stats",
+	"audit.prune"
 ];
 function listGatewayMethods() {
 	const channelMethods = listChannelPlugins().flatMap((plugin) => plugin.gatewayMethods ?? []);
@@ -6465,6 +6468,200 @@ const GATEWAY_EVENTS = [
 	GATEWAY_EVENT_UPDATE_AVAILABLE
 ];
 
+//#endregion
+//#region src/audit/audit-logger.ts
+/**
+* Audit Logger — Phase 1 Security Foundation
+*
+* Singleton service for writing, querying, and pruning audit log events.
+* Uses node:sqlite (DatabaseSync) following the same pattern as memory/manager.ts.
+*/
+const log$5 = createSubsystemLogger("audit");
+const SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS audit_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  timestamp TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+  actor_type TEXT NOT NULL,
+  actor_id TEXT,
+  action TEXT NOT NULL,
+  resource TEXT,
+  details TEXT,
+  ip TEXT,
+  result TEXT NOT NULL DEFAULT 'success',
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON audit_log(created_at);
+CREATE INDEX IF NOT EXISTS idx_audit_actor ON audit_log(actor_id);
+CREATE INDEX IF NOT EXISTS idx_audit_action ON audit_log(action);
+`;
+let instance = null;
+var AuditLogger = class AuditLogger {
+	constructor(opts) {
+		this.db = null;
+		this.pruneTimer = null;
+		this.initialized = false;
+		const stateDir = resolveStateDir(process.env);
+		this.dbPath = opts?.dbPath ?? path.join(stateDir, "audit.db");
+		this.retentionDays = opts?.retentionDays ?? 90;
+	}
+	/** Initialize the database and schema. Safe to call multiple times. */
+	init() {
+		if (this.initialized) return;
+		try {
+			const dir = path.dirname(this.dbPath);
+			if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+			const { DatabaseSync: SqliteDatabase } = requireNodeSqlite();
+			this.db = new SqliteDatabase(this.dbPath);
+			this.db.exec(SCHEMA_SQL);
+			this.initialized = true;
+			this.pruneTimer = setInterval(() => {
+				try {
+					this.prune(this.retentionDays);
+				} catch (err) {
+					log$5.warn(`auto-prune failed: ${String(err)}`);
+				}
+			}, 360 * 60 * 1e3);
+			if (this.pruneTimer?.unref) this.pruneTimer.unref();
+			try {
+				this.prune(this.retentionDays);
+			} catch {}
+			log$5.info(`audit log initialized at ${this.dbPath}`);
+		} catch (err) {
+			log$5.warn(`audit logger failed to initialize: ${String(err)}`);
+			this.initialized = false;
+		}
+	}
+	/** Log an audit event. Non-blocking, never throws. */
+	log(event) {
+		try {
+			if (!this.db) return;
+			this.db.prepare(`INSERT INTO audit_log (actor_type, actor_id, action, resource, details, ip, result)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`).run(event.actor_type, event.actor_id ?? null, event.action, event.resource ?? null, event.details ?? null, event.ip ?? null, event.result ?? "success");
+		} catch (err) {
+			log$5.warn(`audit log write failed: ${String(err)}`);
+		}
+	}
+	/** Query audit entries with filters. */
+	query(filters = {}) {
+		if (!this.db) return [];
+		try {
+			const conditions = [];
+			const params = [];
+			if (filters.action) {
+				conditions.push("action = ?");
+				params.push(filters.action);
+			}
+			if (filters.actor) {
+				conditions.push("actor_id = ?");
+				params.push(filters.actor);
+			}
+			if (filters.since != null) {
+				conditions.push("created_at >= ?");
+				params.push(filters.since);
+			}
+			if (filters.until != null) {
+				conditions.push("created_at <= ?");
+				params.push(filters.until);
+			}
+			if (filters.result) {
+				conditions.push("result = ?");
+				params.push(filters.result);
+			}
+			const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+			const limit = Math.min(filters.limit ?? 100, 1e3);
+			const offset = filters.offset ?? 0;
+			const sql = `SELECT * FROM audit_log ${where} ORDER BY created_at DESC LIMIT ? OFFSET ?`;
+			params.push(limit, offset);
+			return this.db.prepare(sql).all(...params);
+		} catch (err) {
+			log$5.warn(`audit query failed: ${String(err)}`);
+			return [];
+		}
+	}
+	/** Get summary statistics. */
+	stats() {
+		if (!this.db) return {
+			total: 0,
+			byAction: {},
+			byActor: {},
+			failures: 0,
+			oldestTimestamp: null,
+			newestTimestamp: null
+		};
+		try {
+			const totalRow = this.db.prepare("SELECT COUNT(*) as cnt FROM audit_log").get();
+			const failureRow = this.db.prepare("SELECT COUNT(*) as cnt FROM audit_log WHERE result != 'success'").get();
+			const actionRows = this.db.prepare("SELECT action, COUNT(*) as cnt FROM audit_log GROUP BY action ORDER BY cnt DESC LIMIT 50").all();
+			const actorRows = this.db.prepare("SELECT actor_id, COUNT(*) as cnt FROM audit_log WHERE actor_id IS NOT NULL GROUP BY actor_id ORDER BY cnt DESC LIMIT 50").all();
+			const oldestRow = this.db.prepare("SELECT timestamp FROM audit_log ORDER BY created_at ASC LIMIT 1").get();
+			const newestRow = this.db.prepare("SELECT timestamp FROM audit_log ORDER BY created_at DESC LIMIT 1").get();
+			const byAction = {};
+			for (const row of actionRows) byAction[row.action] = row.cnt;
+			const byActor = {};
+			for (const row of actorRows) byActor[row.actor_id] = row.cnt;
+			return {
+				total: totalRow.cnt,
+				byAction,
+				byActor,
+				failures: failureRow.cnt,
+				oldestTimestamp: oldestRow?.timestamp ?? null,
+				newestTimestamp: newestRow?.timestamp ?? null
+			};
+		} catch (err) {
+			log$5.warn(`audit stats failed: ${String(err)}`);
+			return {
+				total: 0,
+				byAction: {},
+				byActor: {},
+				failures: 0,
+				oldestTimestamp: null,
+				newestTimestamp: null
+			};
+		}
+	}
+	/** Delete entries older than the given number of days. Returns count deleted. */
+	prune(olderThanDays) {
+		if (!this.db) return 0;
+		try {
+			const cutoff = Math.floor(Date.now() / 1e3) - olderThanDays * 86400;
+			const deleted = this.db.prepare("DELETE FROM audit_log WHERE created_at < ?").run(cutoff).changes ?? 0;
+			if (deleted > 0) log$5.info(`pruned ${deleted} audit entries older than ${olderThanDays} days`);
+			return deleted;
+		} catch (err) {
+			log$5.warn(`audit prune failed: ${String(err)}`);
+			return 0;
+		}
+	}
+	/** Graceful shutdown. */
+	close() {
+		if (this.pruneTimer) {
+			clearInterval(this.pruneTimer);
+			this.pruneTimer = null;
+		}
+		try {
+			this.db?.close();
+		} catch {}
+		this.db = null;
+		this.initialized = false;
+	}
+	/** Get singleton instance. */
+	static getInstance() {
+		if (!instance) instance = new AuditLogger();
+		return instance;
+	}
+	/** Initialize singleton. Call at gateway startup. */
+	static init(opts) {
+		if (!instance) instance = new AuditLogger(opts);
+		instance.init();
+		return instance;
+	}
+	/** Destroy singleton (for testing). */
+	static destroy() {
+		instance?.close();
+		instance = null;
+	}
+};
+
 //#endregion
 //#region src/gateway/control-plane-audit.ts
 function normalizePart$1(value, fallback) {
@@ -8327,6 +8524,58 @@ const agentsHandlers = {
 	}
 };
 
+//#endregion
+//#region src/gateway/server-methods/audit.ts
+/**
+* Audit RPC method handlers (#6)
+* Registers audit.query and audit.stats as gateway RPC methods.
+*/
+const auditHandlers = {
+	"audit.query": ({ params, respond }) => {
+		try {
+			const logger = AuditLogger.getInstance();
+			const filters = {};
+			if (typeof params.action === "string") filters.action = params.action;
+			if (typeof params.actor === "string") filters.actor = params.actor;
+			if (typeof params.since === "number") filters.since = params.since;
+			if (typeof params.until === "number") filters.until = params.until;
+			if (typeof params.result === "string") filters.result = params.result;
+			if (typeof params.limit === "number") filters.limit = params.limit;
+			if (typeof params.offset === "number") filters.offset = params.offset;
+			const entries = logger.query(filters);
+			respond(true, {
+				entries,
+				count: entries.length
+			}, void 0);
+		} catch (err) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, `audit query failed: ${String(err)}`));
+		}
+	},
+	"audit.stats": ({ respond }) => {
+		try {
+			respond(true, AuditLogger.getInstance().stats(), void 0);
+		} catch (err) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, `audit stats failed: ${String(err)}`));
+		}
+	},
+	"audit.prune": ({ params, respond }) => {
+		try {
+			const logger = AuditLogger.getInstance();
+			const olderThanDays = typeof params.olderThanDays === "number" ? params.olderThanDays : 90;
+			if (olderThanDays < 1) {
+				respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, "olderThanDays must be >= 1"));
+				return;
+			}
+			respond(true, {
+				deleted: logger.prune(olderThanDays),
+				olderThanDays
+			}, void 0);
+		} catch (err) {
+			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, `audit prune failed: ${String(err)}`));
+		}
+	}
+};
+
 //#endregion
 //#region src/gateway/server-methods/nodes.helpers.ts
 function respondInvalidParams(params) {
@@ -12451,7 +12700,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-7Xu3f7tS.js");
+			const { handleNodeEvent } = await import("./server-node-events-BBifAwDM.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,
@@ -14319,6 +14568,54 @@ const CONTROL_PLANE_WRITE_METHODS = new Set([
 	"config.patch",
 	"update.run"
 ]);
+/** Methods that always get audit logged when audit is enabled. */
+const AUDIT_SENSITIVE_METHODS = new Set([
+	"config.set",
+	"config.apply",
+	"config.patch",
+	"device.pair.approve",
+	"device.pair.reject",
+	"node.pair.approve",
+	"node.pair.reject",
+	"exec.approvals.set",
+	"sessions.delete",
+	"update.run"
+]);
+function resolveAuditConfig() {
+	try {
+		const security = loadConfig().security;
+		return {
+			enabled: security?.audit?.enabled !== false,
+			level: security?.audit?.level ?? "sensitive"
+		};
+	} catch {
+		return {
+			enabled: true,
+			level: "sensitive"
+		};
+	}
+}
+function shouldAuditMethod(method, level) {
+	if (level === "off") return false;
+	if (level === "all") return true;
+	return AUDIT_SENSITIVE_METHODS.has(method);
+}
+function auditLogMethodCall(method, client, result) {
+	try {
+		const logger = AuditLogger.getInstance();
+		const actorType = client?.connect?.role ?? "unknown";
+		const actorId = client?.connect?.client?.id ?? client?.connect?.device?.id ?? void 0;
+		const ip = client?.clientIp ?? void 0;
+		logger.log({
+			actor_type: actorType,
+			actor_id: actorId,
+			action: method,
+			ip,
+			result,
+			details: result !== "success" ? `method ${method} ${result}` : void 0
+		});
+	} catch {}
+}
 function authorizeGatewayMethod(method, client) {
 	if (!client?.connect) return null;
 	if (method === "health") return null;
@@ -14361,12 +14658,14 @@ const coreGatewayHandlers = {
 	...usageHandlers,
 	...agentHandlers,
 	...agentsHandlers,
-	...browserHandlers
+	...browserHandlers,
+	...auditHandlers
 };
 async function handleGatewayRequest(opts) {
 	const { req, respond, client, isWebchatConnect, context } = opts;
 	const authError = authorizeGatewayMethod(req.method, client);
 	if (authError) {
+		if (resolveAuditConfig().enabled) auditLogMethodCall(req.method, client, "denied");
 		respond(false, void 0, authError);
 		return;
 	}
@@ -14391,7 +14690,22 @@ async function handleGatewayRequest(opts) {
 		respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, `unknown method: ${req.method}`));
 		return;
 	}
-	await handler({
+	const auditCfg = resolveAuditConfig();
+	if (auditCfg.enabled && shouldAuditMethod(req.method, auditCfg.level)) {
+		const originalRespond = respond;
+		const auditedRespond = (ok, payload, error, meta) => {
+			auditLogMethodCall(req.method, client, ok ? "success" : "failure");
+			originalRespond(ok, payload, error, meta);
+		};
+		await handler({
+			req,
+			params: req.params ?? {},
+			client,
+			isWebchatConnect,
+			respond: auditedRespond,
+			context
+		});
+	} else await handler({
 		req,
 		params: req.params ?? {},
 		client,
@@ -18868,6 +19182,12 @@ async function startGatewayMemoryBackend(params) {
 //#region src/gateway/server-startup.ts
 const SESSION_LOCK_STALE_MS = 1800 * 1e3;
 async function startGatewaySidecars(params) {
+	try {
+		const auditRetention = params.cfg.security;
+		AuditLogger.init({ retentionDays: auditRetention?.audit?.retentionDays });
+	} catch (err) {
+		params.log.warn(`audit logger initialization failed: ${String(err)}`);
+	}
 	try {
 		const sessionDirs = await resolveAgentSessionDirs(resolveStateDir(process.env));
 		for (const sessionsDir of sessionDirs) await cleanStaleLockFiles({