openclaw-multi-auto 1.7.6 → 1.7.8

package/dist/{gateway-cli-vQfsLSPv.js → gateway-cli-Bq7xXLEB.js}

@@ -1,10 +1,10 @@
 import { g as resolveStateDir, i as isNixMode, l as resolveGatewayLockDir, o as resolveConfigPath, r as STATE_DIR, t as CONFIG_PATH, u as resolveGatewayPort } from "./paths-tuenh9TL.js";
 import { A as theme, M as getLogger, N as getResolvedLoggerSettings, O as colorize, S as logVerbose, a as setConsoleSubsystemFilter, c as sanitizeForLog, j as getChildLogger, k as isRich, n as runtimeForLogger, o as setConsoleTimestampPrefix, p as defaultRuntime, t as createSubsystemLogger, w as setVerbose } from "./subsystem-G54saDcg.js";
 import { C as sleep, D as isPlainObject, E as truncateUtf16Safe, S as shortenHomePath, c as ensureDir, r as clamp, y as resolveUserPath } from "./utils-B8zCe27d.js";
-import { $c as parseSessionLabel, $h as isTrustedProxyAddress, $i as buildOutboundSessionContext, $l as enqueueCommandInLane, $p as resolveAgentMainSessionKey, $s as validateDeviceTokenRotateParams, $t as getRemoteSkillEligibility, Aa as triggerOpenClawRestart, Ac as validateSessionsListParams, Ad as normalizePollInput, Ai as resolveAgentIdentity, Am as cleanStaleLockFiles, Ap as archiveFileOnDisk, Ar as runBeforeToolCallHook, As as validateChatHistoryParams, Ba as normalizeCronJobPatch, Bc as validateTalkConfigParams, Bd as setTtsProvider, Bn as dispatchInboundMessage, Bo as resolveSystemRunApprovalRuntimeContext, Bp as stripInlineDirectiveTagsFromMessageForDisplay, Bs as validateConnectParams, Ca as deferGatewayRestartUntilIdle, Cc as validatePushTestParams, Cg as collectExplicitAllowlist, Ci as lookupContextTokens, Cl as ensureExecApprovals, Cm as GATEWAY_CLIENT_IDS, Cr as buildDefaultToolPolicyPipelineSteps, Cs as validateAgentsFilesListParams, Cu as stripHeartbeatToken, Da as scheduleGatewaySigusr1Restart, Dc as validateSendParams, Dh as mergeGatewayTailscaleConfig, Dm as normalizeGatewayClientMode, Dp as mergeDeliveryContext, Dr as resolveGroupToolPolicy, Ds as validateChannelsLogoutParams, Du as isSilentReplyText, E_ as parseByteSize, Ea as markGatewaySigusr1RestartHandled, Ec as validateSecretsResolveResult, Eg as PROFILE_OPTIONS, Eh as mergeGatewayAuthConfig, Ei as sleepWithAbort, El as mergeExecApprovalsSocketDefaults, Em as hasGatewayClientCap, Ep as deliveryContextFromSession, Er as resolveEffectiveToolPolicy, Es as validateAgentsUpdateParams, F as resolveDefaultModelForAgent, F_ as looksLikeAvatarPath, Fa as summarizeRestartSentinel, Fc as validateSessionsUsageParams, Fd as resolveTtsAutoMode, Fh as authorizeWsControlUiGatewayConnect, Fp as readSessionPreviewItemsFromTranscript, Fr as initSubagentRegistry, Fs as validateConfigPatchParams, G as withProgress, Ga as normalizeOptionalAgentId, Gc as validateWebLoginStartParams, Gh as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, Gn as DEFAULT_INPUT_TIMEOUT_MS, Go as missingSystemRunApprovalBinding, Gr as resolveIngressWorkspaceOverrideForSpawnedRun, Gs as validateCronRunsParams, Gt as resolveAssistantAvatarUrl, Gv as normalizeThinkLevel, H as createPluginRuntime, Ha as resolveCronStaggerMs, Hc as validateToolsCatalogParams, Hd as OPENAI_TTS_MODELS, Hh as readGatewayTokenEnv, Hn as getTotalPendingReplies, Ho as resolveSystemRunCommandRequest, Hp as jsonUtf8Bytes, Hr as resolveAgentTimeoutMs, Hs as validateCronListParams, Ht as CONTROL_UI_AVATAR_PREFIX, Hv as normalizeElevatedLevel, I as resolveHooksGmailModel, Ic as validateSkillsBinsParams, Id as resolveTtsConfig, Ih as isLocalDirectRequest, Il as saveExecApprovals, In as buildHistoryContextFromEntries, Ip as resolveSessionTranscriptCandidates, Is as validateConfigSchemaLookupParams, Iv as DEFAULT_MODEL, Ja as normalizePayloadToSystemText, Jc as validateWizardNextParams, Jh as normalizeRateLimitClientIp, Jl as resolveUserTimezone, Jm as createBrowserRouteDispatcher, Jn as normalizeMimeList, Jr as getAgentRunContext, Js as validateDevicePairApproveParams, Jt as resolveExecApprovalCommandDisplay, Ka as normalizeOptionalSessionKey, Kc as validateWebLoginWaitParams, Kh as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, Kn as extractFileContentFromSource, Kr as clearAgentRunContext, Ks as validateCronStatusParams, Kv as normalizeUsageDisplay, La as writeRestartSentinel, Lc as validateSkillsInstallParams, Ld as resolveTtsPrefsPath, Lh as resolveGatewayAuth, Lp as stripEnvelopeFromMessage, Lr as listDescendantRunsForRequester, Ls as validateConfigSchemaLookupResult, Lu as isRestartEnabled, Lv as DEFAULT_PROVIDER, M as resolveAllowedModelRef, M_ as AVATAR_MAX_BYTES, Ma as formatDoctorNonInteractiveHint, Mc as validateSessionsPreviewParams, Md as isTtsEnabled, Mm as readJsonFile, Mp as capArrayByJsonBytes, Mr as countActiveDescendantRuns, Ms as validateChatSendParams, N_ as isAvatarHttpUrl, Na as formatRestartSentinelMessage, Nc as validateSessionsResetParams, Nd as isTtsProviderConfigured, Nh as assertGatewayAuthConfigured, Nm as writeJsonAtomic, Np as cleanupArchivedSessionTranscripts, Ns as validateConfigApplyParams, Oa as setGatewaySigusr1RestartPolicy, Oc as validateSessionsCompactParams, Og as listCoreToolSections, Oh as resolveConfiguredSecretInputString, Oi as clearSessionQueues, Ol as normalizeExecApprovals, On as resolveAgentAvatar, Op as normalizeSessionDeliveryFields, Or as resolveSubagentToolPolicy, Os as validateChannelsStatusParams, Ou as getAcpSessionManager, P as resolveConfiguredModelRef, P_ as isAvatarImageDataUrl, Pc as validateSessionsResolveParams, Pd as resolveTtsApiKey, Ph as authorizeHttpGatewayConnect, Pi as normalizeGroupActivation, Pn as createReplyPrefixOptions, Pp as readSessionMessages, Ps as validateConfigGetParams, Pv as normalizeSecretInput, Q_ as ensureControlUiAllowedOriginsForNonLoopbackBind, Qa as normalizeLegacyDeliveryInput, Qc as errorShape, Qi as resolveSessionDeliveryTarget, Qn as resolveSendPolicy, Qp as canonicalizeMainSessionAlias, Qs as validateDeviceTokenRevokeParams, R as resolveSubagentConfiguredModelSelection, Ra as normalizeHttpWebhookUrl, Rc as validateSkillsStatusParams, Rd as resolveTtsProviderOrder, Rl as getPluginToolMeta, Rp as stripEnvelopeFromMessages, Rs as validateConfigSchemaParams, Rv as formatThinkingLevels, Sa as consumeGatewaySigusr1RestartAuthorization, Sc as validatePollParams, Sf as runGlobalGatewayStopSafely, Sh as SsrFBlockedError, Sm as GATEWAY_CLIENT_CAPS, So as evaluateGatewayAuthSurfaceStates, Sr as applyToolPolicyPipeline, Ss as validateAgentsFilesGetParams, T as isCliProvider, T_ as parseDurationMs, Ta as isGatewaySigusr1RestartExternallyAllowed, Tc as validateSecretsResolveParams, Tg as resolveToolProfilePolicy, Th as ensureGatewayStartupAuth, Ti as computeBackoff, Tm as GATEWAY_CLIENT_NAMES, Tn as unbindThreadBindingsBySessionKey, To as isKnownSecretTargetId, Ts as validateAgentsListParams, Tu as SILENT_REPLY_TOKEN, Ua as resolveDefaultCronStaggerMs, Uc as validateUpdateRunParams, Ud as OPENAI_TTS_VOICES, Ui as ensureOutboundSessionEntry, Un as DEFAULT_INPUT_IMAGE_MAX_BYTES, Uo as buildSystemRunApprovalBinding, Us as validateCronRemoveParams, Ut as buildControlUiAvatarUrl, Uv as normalizeFastMode, V as loadOpenClawPlugins, Va as normalizeCronStaggerMs, Vc as validateTalkModeParams, Vd as textToSpeech, Vh as readGatewayPasswordEnv, Vi as parseTimeoutMsWithFallback, Vn as createReplyDispatcher, Vp as normalizeInputProvenance, Vs as validateCronAddParams, Wc as validateWakeParams, Wh as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, Wi as resolveOutboundSessionRoute, Wn as DEFAULT_INPUT_IMAGE_MIMES, Wo as matchSystemRunApprovalBinding, Wr as normalizeSpawnedRunMetadata, Ws as validateCronRunParams, Wt as normalizeControlUiBasePath, Wv as normalizeReasoningLevel, X_ as applyMergePatch, Xc as validateWizardStatusParams, Xh as isLoopbackAddress, Xm as startBrowserControlServiceFromConfig, Xr as registerAgentRunContext, Xs as validateDevicePairRejectParams, Xu as readChannelAllowFromStoreSync, Ya as normalizeRequiredName, Yc as validateWizardStartParams, Yh as isLocalishHost, Ym as createBrowserControlContext, Yn as resolveInputFileLimits, Yo as buildExecApprovalPendingReplyPayload, Yp as mergeSessionEntry, Yr as onAgentEvent, Ys as validateDevicePairListParams, Yt as sanitizeExecApprovalDisplayText, Yv as supportsXHighThinking, Z_ as applyLegacyMigrations, Za as parseAbsoluteTimeMs, Zc as ErrorCodes, Zh as isLoopbackHost, Zi as resolveOutboundTarget, Zl as clearBootstrapSnapshot, Zn as normalizeSendPolicy, Zo as ToolInputError, Zp as setSessionRuntimeModel, Zs as validateDevicePairRemoveParams, _c as validateNodePairVerifyParams, _i as migrateAndPruneGatewaySessionStoreKey, _l as requestHeartbeatNow, _m as isGatewayMessageChannel, _o as clearSecretsRuntimeSnapshot, _p as loadSessionStore, _s as validateAgentIdentityParams, _t as handleSlackHttpRequest, a as runCliAgent, aa as normalizeReplyPayloadsForDelivery, ac as validateExecApprovalsSetParams, ad as enqueueSystemEvent, ag as resolveGatewayListenHosts, ai as resolvePreferredSessionKeyForSessionIdMatches, al as normalizeDeviceMetadataForAuth, an as setSkillsRemoteRegistry, au as setCommandLaneConcurrency, b_ as OpenClawSchema, bc as validateNodePendingEnqueueParams, bm as normalizeMessageChannel, bn as registerSkillsChangeListener, bo as resolveCommandSecretsFromActiveRuntimeSnapshot, bs as validateAgentsCreateParams, bu as getMachineDisplayName, ca as applyPluginAutoEnable, cc as validateNodeDescribeParams, cg as pickPrimaryTailnetIPv4, cl as loadGatewayTlsRuntime$1, cn as rejectNodePairing, cs as ADMIN_SCOPE$3, ct as loadCronStore, cv as buildTalkConfigResponse, d as parseVerboseOverride, d_ as loadConfig, da as buildChannelUiCatalog, dc as validateNodeInvokeResultParams, dg as disableTailscaleFunnel, di as canonicalizeSpawnedByForAgent, dl as normalizeDevicePublicKeyBase64Url, dn as updatePairedNodeMetadata, do as getHookType, dp as resolveAgentSessionDirs, dr as waitForActiveEmbeddedRuns, dt as buildTelegramExecApprovalButtons, dv as VERSION, ea as deliverOutboundPayloads, ec as validateExecApprovalRequestParams, eg as isValidIPv4, eh as movePathToTrash, ei as readLatestAssistantReply, el as ConnectErrorDetailCodes, em as resolveExplicitAgentSessionKey, en as primeRemoteSkillsCache, eu as getActiveTaskCount, f_ as parseConfigJson5, fc as validateNodeListParams, ff as loadModelCatalog, fg as disableTailscaleServe, fl as publicKeyRawBase64UrlFromPem, fn as verifyNodeToken, fo as isExternalHookSession, fr as waitForEmbeddedPiRunEnd, fs as WRITE_SCOPE, ft as resolveExecApprovalSessionTarget, fu as isDiagnosticsEnabled, fv as resolveRuntimeServiceVersion, g_ as resolveConfigSnapshotHash, ga as resolveMessageChannelSelection, gc as validateNodePairRequestParams, gg as getTailnetHostname, gi as loadSessionEntry, gm as isGatewayCliClient, go as activateSecretsRuntimeSnapshot, gp as archiveRemovedSessionTranscripts, gr as resolveFastModeState, gs as formatValidationErrors, h_ as readConfigFileSnapshotForWrite, ha as resetDirectoryCache, hc as validateNodePairRejectParams, hd as getChannelActivity, hi as loadCombinedSessionStoreForGateway, hm as isDeliverableMessageChannel, ho as persistBrowserProxyFiles, hr as resolveBootstrapWarningSignaturesSeen, i as setCliSessionId, ic as validateExecApprovalsNodeSetParams, ig as resolveGatewayBindHost, ii as resolveNestedAgentLane, il as buildDeviceAuthPayloadV3, in as removeRemoteNodeInfo, ip as estimateBase64DecodedBytes, ir as stopSubagentsForRequester, iu as resetAllLanes, ja as consumeRestartSentinel, jc as validateSessionsPatchParams, jd as getTtsProvider, jl as readExecApprovalsSnapshot, jm as createAsyncLock, jp as archiveSessionTranscripts, jr as createOpenClawTools, js as validateChatInjectParams, k as normalizeModelSelection, ka as setPreRestartDeferralCheck, kc as validateSessionsDeleteParams, kg as resolveCoreToolProfiles, ks as validateChatAbortParams, kt as handleReset, kv as isPidAlive, l_ as migrateLegacyConfig, lc as validateNodeEventParams, lf as registerUnhandledRejectionHandler, lg as pickPrimaryTailnetIPv6, ll as deriveDeviceIdFromPublicKey, ln as renamePairedNode, lo as buildSafeExternalPrompt, lr as abortEmbeddedPiRun, ls as APPROVALS_SCOPE$1, lt as resolveCronStorePath, lu as startDiagnosticHeartbeat, lv as resolveAgentMaxConcurrent, m_ as readConfigFileSnapshot, ma as maybeResolveIdLikeTarget, mc as validateNodePairListParams, mg as enableTailscaleServe, mi as listSessionsFromStore, ml as verifyDeviceSignature, mm as INTERNAL_MESSAGE_CHANNEL, mo as applyBrowserProxyPaths, mp as parseSessionThreadInfo, ms as isNodeRoleMethod, mt as resolveAgentOutboundIdentity, mu as resolveMemoryBackendConfig, n as buildBareSessionResetPrompt, nc as validateExecApprovalsGetParams, ng as pickPrimaryLanIPv4, nl as resolveDeviceAuthConnectErrorDetailCode, nm as resolveMainSessionKeyFromConfig, nn as refreshRemoteBinsForConnectedNodes, nu as getTotalQueueSize, oc as validateLogsTailParams, od as isSystemEventContextChanged, of as extractTextFromChatContent, og as resolveRequestClientIp, oh as rawDataToString, oi as applyModelOverrideToSessionEntry, on as approveNodePairing, ot as sendTypingTelegram, ou as waitForActiveTasks, p_ as readBestEffortConfig, pc as validateNodePairApproveParams, pg as enableTailscaleFunnel, pi as listAgentsForGateway, po as closeTrackedBrowserTabsForSessions, pp as extractDeliveryInfo, ps as authorizeOperatorScopesForMethod, pu as getMemorySearchManager, q as formatHelpExamples, qa as normalizeOptionalText$1, qc as validateWizardCancelParams, qh as createAuthRateLimiter, qn as extractImageContentFromSource, qo as toSystemRunApprovalMismatchError, qr as emitAgentEvent, qs as validateCronUpdateParams, qv as normalizeVerboseLevel, r as getCliSessionId, rc as validateExecApprovalsNodeGetParams, rg as resolveClientIp, rl as buildDeviceAuthPayload, rm as snapshotSessionOrigin, rn as refreshRemoteNodeBins, rr as isAbortRequestText, rs as callGateway, ru as markGatewayDraining, sa as resolveOutboundChannelPlugin, sc as validateModelsListParams, sf as fetchWithSsrFGuard, sh as cleanOldMedia, si as loadProviderUsageSummary, sl as normalizeDeviceAuthScopes, sn as listNodePairing, sr as runEmbeddedPiAgent, su as CommandLane, tc as validateExecApprovalResolveParams, tg as normalizeHostHeader, ti as resolveAnnounceTargetFromKey, tl as resolveAuthConnectErrorDetailCode, tm as resolveMainSessionKey, tn as recordRemoteNodeInfo, u as applyVerboseOverride, u_ as createConfigIO, uc as validateNodeInvokeParams, ug as safeEqualSecret, ul as loadOrCreateDeviceIdentity, un as requestNodePairing, uo as detectSuspiciousPatterns, ur as getActiveEmbeddedRunCount, us as PAIRING_SCOPE$1, ut as saveCronStore, uu as stopDiagnosticHeartbeat, uv as resolveSubagentMaxConcurrent, v_ as writeConfigFile, va as runWithModelFallback, vc as validateNodePendingAckParams, vi as resolveGatewaySessionStoreTarget, vn as listAgentWorkspaceDirs, vo as getActiveSecretsRuntimeSnapshot, vs as validateAgentParams, w as getModelRefStatus, wa as emitGatewayRestart, wc as validateRequestFrame, wg as mergeAlsoAllowPolicy, wm as GATEWAY_CLIENT_MODES, wn as resolveSessionAuthProfileOverride, ws as validateAgentsFilesSetParams, x as buildAllowedModelSet, xa as resolveFailoverReasonFromError, xc as validateNodeRenameParams, xf as getGlobalHookRunner, xl as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS, xo as GATEWAY_AUTH_SURFACE_PATHS, xp as updateSessionStore, xr as resolveToolLoopDetectionConfig, xs as validateAgentsDeleteParams, y_ as validateConfigObjectWithPlugins, yc as validateNodePendingDrainParams, yi as resolveSessionModelRef, yl as setHeartbeatsEnabled, ym as isWebchatClient, yn as getSkillsSnapshotVersion, yo as prepareSecretsRuntimeSnapshot, yr as resolveCronStyleNow, ys as validateAgentWaitParams, yu as resolveMemorySearchConfig, z as resolveThinkingDefault, za as normalizeCronJobCreate, zc as validateSkillsUpdateParams, zd as setTtsEnabled, zl as resolvePluginTools, zn as formatZonedTimestamp, zo as resolveSystemRunApprovalRequestContext, zp as stripInlineDirectiveTagsForDisplay, zs as validateConfigSetParams, zv as formatXHighModelHint } from "./reply-gX1XTS9Y.js";
-import { C as DEFAULT_MEMORY_FILENAME, D as ensureAgentWorkspace, E as DEFAULT_USER_FILENAME, M as resolveWorkspaceTemplateDir, S as DEFAULT_MEMORY_ALT_FILENAME, T as DEFAULT_TOOLS_FILENAME, _ as DEFAULT_AGENTS_FILENAME, a as resolveAgentDir, b as DEFAULT_HEARTBEAT_FILENAME, d as resolveAgentWorkspaceDir, f as resolveDefaultAgentId, h as resolveSessionAgentId, i as resolveAgentConfig, j as resolveDefaultAgentWorkspaceDir, k as isWorkspaceOnboardingCompleted, l as resolveAgentModelFallbacksOverride, n as listAgentEntries, r as listAgentIds, u as resolveAgentSkillsFilter, w as DEFAULT_SOUL_FILENAME, x as DEFAULT_IDENTITY_FILENAME, y as DEFAULT_BOOTSTRAP_FILENAME } from "./agent-scope-sd1-3XH0.js";
+import { $c as parseSessionLabel, $h as isTrustedProxyAddress, $i as buildOutboundSessionContext, $l as enqueueCommandInLane, $p as resolveAgentMainSessionKey, $s as validateDeviceTokenRotateParams, $t as getRemoteSkillEligibility, Aa as triggerOpenClawRestart, Ac as validateSessionsListParams, Ad as normalizePollInput, Ai as resolveAgentIdentity, Am as cleanStaleLockFiles, Ap as archiveFileOnDisk, Ar as runBeforeToolCallHook, As as validateChatHistoryParams, Ba as normalizeCronJobPatch, Bc as validateTalkConfigParams, Bd as setTtsProvider, Bn as dispatchInboundMessage, Bo as resolveSystemRunApprovalRuntimeContext, Bp as stripInlineDirectiveTagsFromMessageForDisplay, Bs as validateConnectParams, Ca as deferGatewayRestartUntilIdle, Cc as validatePushTestParams, Cg as collectExplicitAllowlist, Ci as lookupContextTokens, Cl as ensureExecApprovals, Cm as GATEWAY_CLIENT_IDS, Cr as buildDefaultToolPolicyPipelineSteps, Cs as validateAgentsFilesListParams, Cu as stripHeartbeatToken, Da as scheduleGatewaySigusr1Restart, Dc as validateSendParams, Dh as mergeGatewayTailscaleConfig, Dm as normalizeGatewayClientMode, Dp as mergeDeliveryContext, Dr as resolveGroupToolPolicy, Ds as validateChannelsLogoutParams, Du as isSilentReplyText, E_ as parseByteSize, Ea as markGatewaySigusr1RestartHandled, Ec as validateSecretsResolveResult, Eg as PROFILE_OPTIONS, Eh as mergeGatewayAuthConfig, Ei as sleepWithAbort, El as mergeExecApprovalsSocketDefaults, Em as hasGatewayClientCap, Ep as deliveryContextFromSession, Er as resolveEffectiveToolPolicy, Es as validateAgentsUpdateParams, F as resolveDefaultModelForAgent, F_ as looksLikeAvatarPath, Fa as summarizeRestartSentinel, Fc as validateSessionsUsageParams, Fd as resolveTtsAutoMode, Fh as authorizeWsControlUiGatewayConnect, Fp as readSessionPreviewItemsFromTranscript, Fr as initSubagentRegistry, Fs as validateConfigPatchParams, G as withProgress, Ga as normalizeOptionalAgentId, Gc as validateWebLoginStartParams, Gh as AUTH_RATE_LIMIT_SCOPE_HOOK_AUTH, Gn as DEFAULT_INPUT_TIMEOUT_MS, Go as missingSystemRunApprovalBinding, Gr as resolveIngressWorkspaceOverrideForSpawnedRun, Gs as validateCronRunsParams, Gt as resolveAssistantAvatarUrl, Gv as normalizeThinkLevel, H as createPluginRuntime, Ha as resolveCronStaggerMs, Hc as validateToolsCatalogParams, Hd as OPENAI_TTS_MODELS, Hh as readGatewayTokenEnv, Hn as getTotalPendingReplies, Ho as resolveSystemRunCommandRequest, Hp as jsonUtf8Bytes, Hr as resolveAgentTimeoutMs, Hs as validateCronListParams, Ht as CONTROL_UI_AVATAR_PREFIX, Hv as normalizeElevatedLevel, I as resolveHooksGmailModel, Ic as validateSkillsBinsParams, Id as resolveTtsConfig, Ih as isLocalDirectRequest, Il as saveExecApprovals, In as buildHistoryContextFromEntries, Ip as resolveSessionTranscriptCandidates, Is as validateConfigSchemaLookupParams, Iv as DEFAULT_MODEL, Ja as normalizePayloadToSystemText, Jc as validateWizardNextParams, Jh as normalizeRateLimitClientIp, Jl as resolveUserTimezone, Jm as createBrowserRouteDispatcher, Jn as normalizeMimeList, Jr as getAgentRunContext, Js as validateDevicePairApproveParams, Jt as resolveExecApprovalCommandDisplay, Ka as normalizeOptionalSessionKey, Kc as validateWebLoginWaitParams, Kh as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, Kn as extractFileContentFromSource, Kr as clearAgentRunContext, Ks as validateCronStatusParams, Kv as normalizeUsageDisplay, La as writeRestartSentinel, Lc as validateSkillsInstallParams, Ld as resolveTtsPrefsPath, Lh as resolveGatewayAuth, Lp as stripEnvelopeFromMessage, Lr as listDescendantRunsForRequester, Ls as validateConfigSchemaLookupResult, Lu as isRestartEnabled, Lv as DEFAULT_PROVIDER, M as resolveAllowedModelRef, M_ as AVATAR_MAX_BYTES, Ma as formatDoctorNonInteractiveHint, Mc as validateSessionsPreviewParams, Md as isTtsEnabled, Mm as readJsonFile, Mp as capArrayByJsonBytes, Mr as countActiveDescendantRuns, Ms as validateChatSendParams, N_ as isAvatarHttpUrl, Na as formatRestartSentinelMessage, Nc as validateSessionsResetParams, Nd as isTtsProviderConfigured, Nh as assertGatewayAuthConfigured, Nm as writeJsonAtomic, Np as cleanupArchivedSessionTranscripts, Ns as validateConfigApplyParams, Oa as setGatewaySigusr1RestartPolicy, Oc as validateSessionsCompactParams, Og as listCoreToolSections, Oh as resolveConfiguredSecretInputString, Oi as clearSessionQueues, Ol as normalizeExecApprovals, On as resolveAgentAvatar, Op as normalizeSessionDeliveryFields, Or as resolveSubagentToolPolicy, Os as validateChannelsStatusParams, Ou as getAcpSessionManager, P as resolveConfiguredModelRef, P_ as isAvatarImageDataUrl, Pc as validateSessionsResolveParams, Pd as resolveTtsApiKey, Ph as authorizeHttpGatewayConnect, Pi as normalizeGroupActivation, Pn as createReplyPrefixOptions, Pp as readSessionMessages, Ps as validateConfigGetParams, Pv as normalizeSecretInput, Q_ as ensureControlUiAllowedOriginsForNonLoopbackBind, Qa as normalizeLegacyDeliveryInput, Qc as errorShape, Qi as resolveSessionDeliveryTarget, Qn as resolveSendPolicy, Qp as canonicalizeMainSessionAlias, Qs as validateDeviceTokenRevokeParams, R as resolveSubagentConfiguredModelSelection, Ra as normalizeHttpWebhookUrl, Rc as validateSkillsStatusParams, Rd as resolveTtsProviderOrder, Rl as getPluginToolMeta, Rp as stripEnvelopeFromMessages, Rs as validateConfigSchemaParams, Rv as formatThinkingLevels, Sa as consumeGatewaySigusr1RestartAuthorization, Sc as validatePollParams, Sf as runGlobalGatewayStopSafely, Sh as SsrFBlockedError, Sm as GATEWAY_CLIENT_CAPS, So as evaluateGatewayAuthSurfaceStates, Sr as applyToolPolicyPipeline, Ss as validateAgentsFilesGetParams, T as isCliProvider, T_ as parseDurationMs, Ta as isGatewaySigusr1RestartExternallyAllowed, Tc as validateSecretsResolveParams, Tg as resolveToolProfilePolicy, Th as ensureGatewayStartupAuth, Ti as computeBackoff, Tm as GATEWAY_CLIENT_NAMES, Tn as unbindThreadBindingsBySessionKey, To as isKnownSecretTargetId, Ts as validateAgentsListParams, Tu as SILENT_REPLY_TOKEN, Ua as resolveDefaultCronStaggerMs, Uc as validateUpdateRunParams, Ud as OPENAI_TTS_VOICES, Ui as ensureOutboundSessionEntry, Un as DEFAULT_INPUT_IMAGE_MAX_BYTES, Uo as buildSystemRunApprovalBinding, Us as validateCronRemoveParams, Ut as buildControlUiAvatarUrl, Uv as normalizeFastMode, V as loadOpenClawPlugins, Va as normalizeCronStaggerMs, Vc as validateTalkModeParams, Vd as textToSpeech, Vh as readGatewayPasswordEnv, Vi as parseTimeoutMsWithFallback, Vn as createReplyDispatcher, Vp as normalizeInputProvenance, Vs as validateCronAddParams, Wc as validateWakeParams, Wh as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN, Wi as resolveOutboundSessionRoute, Wn as DEFAULT_INPUT_IMAGE_MIMES, Wo as matchSystemRunApprovalBinding, Wr as normalizeSpawnedRunMetadata, Ws as validateCronRunParams, Wt as normalizeControlUiBasePath, Wv as normalizeReasoningLevel, X_ as applyMergePatch, Xc as validateWizardStatusParams, Xh as isLoopbackAddress, Xm as startBrowserControlServiceFromConfig, Xr as registerAgentRunContext, Xs as validateDevicePairRejectParams, Xu as readChannelAllowFromStoreSync, Ya as normalizeRequiredName, Yc as validateWizardStartParams, Yh as isLocalishHost, Ym as createBrowserControlContext, Yn as resolveInputFileLimits, Yo as buildExecApprovalPendingReplyPayload, Yp as mergeSessionEntry, Yr as onAgentEvent, Ys as validateDevicePairListParams, Yt as sanitizeExecApprovalDisplayText, Yv as supportsXHighThinking, Z_ as applyLegacyMigrations, Za as parseAbsoluteTimeMs, Zc as ErrorCodes, Zh as isLoopbackHost, Zi as resolveOutboundTarget, Zl as clearBootstrapSnapshot, Zn as normalizeSendPolicy, Zo as ToolInputError, Zp as setSessionRuntimeModel, Zs as validateDevicePairRemoveParams, _c as validateNodePairVerifyParams, _i as migrateAndPruneGatewaySessionStoreKey, _l as requestHeartbeatNow, _m as isGatewayMessageChannel, _o as clearSecretsRuntimeSnapshot, _p as loadSessionStore, _s as validateAgentIdentityParams, _t as handleSlackHttpRequest, a as runCliAgent, aa as normalizeReplyPayloadsForDelivery, ac as validateExecApprovalsSetParams, ad as enqueueSystemEvent, ag as resolveGatewayListenHosts, ai as resolvePreferredSessionKeyForSessionIdMatches, al as normalizeDeviceMetadataForAuth, an as setSkillsRemoteRegistry, au as setCommandLaneConcurrency, b_ as OpenClawSchema, bc as validateNodePendingEnqueueParams, bm as normalizeMessageChannel, bn as registerSkillsChangeListener, bo as resolveCommandSecretsFromActiveRuntimeSnapshot, bs as validateAgentsCreateParams, bu as getMachineDisplayName, ca as applyPluginAutoEnable, cc as validateNodeDescribeParams, cg as pickPrimaryTailnetIPv4, cl as loadGatewayTlsRuntime$1, cn as rejectNodePairing, cs as ADMIN_SCOPE$3, ct as loadCronStore, cv as buildTalkConfigResponse, d as parseVerboseOverride, d_ as loadConfig, da as buildChannelUiCatalog, dc as validateNodeInvokeResultParams, dg as disableTailscaleFunnel, di as canonicalizeSpawnedByForAgent, dl as normalizeDevicePublicKeyBase64Url, dn as updatePairedNodeMetadata, do as getHookType, dp as resolveAgentSessionDirs, dr as waitForActiveEmbeddedRuns, dt as buildTelegramExecApprovalButtons, dv as VERSION, ea as deliverOutboundPayloads, ec as validateExecApprovalRequestParams, eg as isValidIPv4, eh as movePathToTrash, ei as readLatestAssistantReply, el as ConnectErrorDetailCodes, em as resolveExplicitAgentSessionKey, en as primeRemoteSkillsCache, eu as getActiveTaskCount, f_ as parseConfigJson5, fc as validateNodeListParams, ff as loadModelCatalog, fg as disableTailscaleServe, fl as publicKeyRawBase64UrlFromPem, fn as verifyNodeToken, fo as isExternalHookSession, fr as waitForEmbeddedPiRunEnd, fs as WRITE_SCOPE, ft as resolveExecApprovalSessionTarget, fu as isDiagnosticsEnabled, fv as resolveRuntimeServiceVersion, g_ as resolveConfigSnapshotHash, ga as resolveMessageChannelSelection, gc as validateNodePairRequestParams, gg as getTailnetHostname, gi as loadSessionEntry, gm as isGatewayCliClient, go as activateSecretsRuntimeSnapshot, gp as archiveRemovedSessionTranscripts, gr as resolveFastModeState, gs as formatValidationErrors, h_ as readConfigFileSnapshotForWrite, ha as resetDirectoryCache, hc as validateNodePairRejectParams, hd as getChannelActivity, hi as loadCombinedSessionStoreForGateway, hm as isDeliverableMessageChannel, ho as persistBrowserProxyFiles, hr as resolveBootstrapWarningSignaturesSeen, i as setCliSessionId, ic as validateExecApprovalsNodeSetParams, ig as resolveGatewayBindHost, ii as resolveNestedAgentLane, il as buildDeviceAuthPayloadV3, in as removeRemoteNodeInfo, ip as estimateBase64DecodedBytes, ir as stopSubagentsForRequester, iu as resetAllLanes, ja as consumeRestartSentinel, jc as validateSessionsPatchParams, jd as getTtsProvider, jl as readExecApprovalsSnapshot, jm as createAsyncLock, jp as archiveSessionTranscripts, jr as createOpenClawTools, js as validateChatInjectParams, k as normalizeModelSelection, ka as setPreRestartDeferralCheck, kc as validateSessionsDeleteParams, kg as resolveCoreToolProfiles, ks as validateChatAbortParams, kt as handleReset, kv as isPidAlive, l_ as migrateLegacyConfig, lc as validateNodeEventParams, lf as registerUnhandledRejectionHandler, lg as pickPrimaryTailnetIPv6, ll as deriveDeviceIdFromPublicKey, ln as renamePairedNode, lo as buildSafeExternalPrompt, lr as abortEmbeddedPiRun, ls as APPROVALS_SCOPE$1, lt as resolveCronStorePath, lu as startDiagnosticHeartbeat, lv as resolveAgentMaxConcurrent, m_ as readConfigFileSnapshot, ma as maybeResolveIdLikeTarget, mc as validateNodePairListParams, mg as enableTailscaleServe, mi as listSessionsFromStore, ml as verifyDeviceSignature, mm as INTERNAL_MESSAGE_CHANNEL, mo as applyBrowserProxyPaths, mp as parseSessionThreadInfo, ms as isNodeRoleMethod, mt as resolveAgentOutboundIdentity, mu as resolveMemoryBackendConfig, n as buildBareSessionResetPrompt, nc as validateExecApprovalsGetParams, ng as pickPrimaryLanIPv4, nl as resolveDeviceAuthConnectErrorDetailCode, nm as resolveMainSessionKeyFromConfig, nn as refreshRemoteBinsForConnectedNodes, nu as getTotalQueueSize, oc as validateLogsTailParams, od as isSystemEventContextChanged, of as extractTextFromChatContent, og as resolveRequestClientIp, oh as rawDataToString, oi as applyModelOverrideToSessionEntry, on as approveNodePairing, ot as sendTypingTelegram, ou as waitForActiveTasks, p_ as readBestEffortConfig, pc as validateNodePairApproveParams, pg as enableTailscaleFunnel, pi as listAgentsForGateway, po as closeTrackedBrowserTabsForSessions, pp as extractDeliveryInfo, ps as authorizeOperatorScopesForMethod, pu as getMemorySearchManager, q as formatHelpExamples, qa as normalizeOptionalText$1, qc as validateWizardCancelParams, qh as createAuthRateLimiter, qn as extractImageContentFromSource, qo as toSystemRunApprovalMismatchError, qr as emitAgentEvent, qs as validateCronUpdateParams, qv as normalizeVerboseLevel, r as getCliSessionId, rc as validateExecApprovalsNodeGetParams, rg as resolveClientIp, rl as buildDeviceAuthPayload, rm as snapshotSessionOrigin, rn as refreshRemoteNodeBins, rr as isAbortRequestText, rs as callGateway, ru as markGatewayDraining, sa as resolveOutboundChannelPlugin, sc as validateModelsListParams, sf as fetchWithSsrFGuard, sh as cleanOldMedia, si as loadProviderUsageSummary, sl as normalizeDeviceAuthScopes, sn as listNodePairing, sr as runEmbeddedPiAgent, su as CommandLane, tc as validateExecApprovalResolveParams, tg as normalizeHostHeader, ti as resolveAnnounceTargetFromKey, tl as resolveAuthConnectErrorDetailCode, tm as resolveMainSessionKey, tn as recordRemoteNodeInfo, u as applyVerboseOverride, u_ as createConfigIO, uc as validateNodeInvokeParams, ug as safeEqualSecret, ul as loadOrCreateDeviceIdentity, un as requestNodePairing, uo as detectSuspiciousPatterns, ur as getActiveEmbeddedRunCount, us as PAIRING_SCOPE$1, ut as saveCronStore, uu as stopDiagnosticHeartbeat, uv as resolveSubagentMaxConcurrent, v_ as writeConfigFile, va as runWithModelFallback, vc as validateNodePendingAckParams, vi as resolveGatewaySessionStoreTarget, vn as listAgentWorkspaceDirs, vo as getActiveSecretsRuntimeSnapshot, vs as validateAgentParams, w as getModelRefStatus, wa as emitGatewayRestart, wc as validateRequestFrame, wg as mergeAlsoAllowPolicy, wm as GATEWAY_CLIENT_MODES, wn as resolveSessionAuthProfileOverride, ws as validateAgentsFilesSetParams, x as buildAllowedModelSet, xa as resolveFailoverReasonFromError, xc as validateNodeRenameParams, xf as getGlobalHookRunner, xl as DEFAULT_EXEC_APPROVAL_TIMEOUT_MS, xo as GATEWAY_AUTH_SURFACE_PATHS, xp as updateSessionStore, xr as resolveToolLoopDetectionConfig, xs as validateAgentsDeleteParams, y_ as validateConfigObjectWithPlugins, yc as validateNodePendingDrainParams, yi as resolveSessionModelRef, yl as setHeartbeatsEnabled, ym as isWebchatClient, yn as getSkillsSnapshotVersion, yo as prepareSecretsRuntimeSnapshot, yr as resolveCronStyleNow, ys as validateAgentWaitParams, yu as resolveMemorySearchConfig, z as resolveThinkingDefault, za as normalizeCronJobCreate, zc as validateSkillsUpdateParams, zd as setTtsEnabled, zl as resolvePluginTools, zn as formatZonedTimestamp, zo as resolveSystemRunApprovalRequestContext, zp as stripInlineDirectiveTagsForDisplay, zs as validateConfigSetParams, zv as formatXHighModelHint } from "./reply-Cf5Mm7vB.js";
+import { C as DEFAULT_MEMORY_FILENAME, D as ensureAgentWorkspace, E as DEFAULT_USER_FILENAME, M as resolveWorkspaceTemplateDir, S as DEFAULT_MEMORY_ALT_FILENAME, T as DEFAULT_TOOLS_FILENAME, _ as DEFAULT_AGENTS_FILENAME, a as resolveAgentDir, b as DEFAULT_HEARTBEAT_FILENAME, d as resolveAgentWorkspaceDir, f as resolveDefaultAgentId, h as resolveSessionAgentId, i as resolveAgentConfig, j as resolveDefaultAgentWorkspaceDir, k as isWorkspaceOnboardingCompleted, l as resolveAgentModelFallbacksOverride, n as listAgentEntries, r as listAgentIds, u as resolveAgentSkillsFilter, w as DEFAULT_SOUL_FILENAME, x as DEFAULT_IDENTITY_FILENAME, y as DEFAULT_BOOTSTRAP_FILENAME } from "./agent-scope-DmTcOjk4.js";
 import { C as isCronRunSessionKey, E as parseAgentSessionKey, S as isAcpSessionKey, T as isSubagentSessionKey, _ as normalizeAccountId$1, c as normalizeAgentId, g as DEFAULT_ACCOUNT_ID, h as toAgentStoreSessionKey, l as normalizeMainKey, m as toAgentRequestSessionKey, o as classifySessionKeyShape, r as buildAgentMainSessionKey, t as DEFAULT_AGENT_ID, u as resolveAgentIdFromSessionKey, v as normalizeOptionalAccountId } from "./session-key-DjKQluAa.js";
-import { a as openBoundaryFileSync, f as isNotFoundPathError, g as matchesSkillFilter, i as openBoundaryFile, o as openVerifiedFileSync, s as sameFileIdentity, t as resolveOpenClawPackageRoot } from "./openclaw-root-dlCz9toZ.js";
+import { a as openBoundaryFileSync, f as isNotFoundPathError, g as matchesSkillFilter, i as openBoundaryFile, o as openVerifiedFileSync, s as sameFileIdentity, t as resolveOpenClawPackageRoot } from "./openclaw-root-B5jXk2td.js";
 import { i as logWarn, t as logDebug } from "./logger-BohkHL0S.js";
 import { n as runExec, t as runCommandWithTimeout } from "./exec-CNtAq7Md.js";
 import { a as hasConfiguredSecretInput } from "./types.secrets-d7ZFrG7U.js";
@@ -14,16 +14,16 @@ import "./boolean-B938tROv.js";
 import { n as logAcceptedEnvOption, t as isTruthyEnvValue } from "./env-CQxWwTMn.js";
 import "./env-overrides-BYyMsIvB.js";
 import { A as triggerInternalHook, D as clearInternalHooks, O as createInternalHookEvent, b as canonicalizePathVariant, h as createEmptyPluginRegistry, k as registerInternalHook, t as CHANNEL_IDS, u as getActivePluginRegistry, v as PROTECTED_PLUGIN_ROUTE_PREFIXES, y as canonicalizePathForSecurity } from "./registry-aHEgjCIQ.js";
-import { T as isTestDefaultMemorySlotDisabled, i as loadWorkspaceSkillEntries, r as buildWorkspaceSkillSnapshot } from "./skills-vhlUaliH.js";
+import { T as isTestDefaultMemorySlotDisabled, i as loadWorkspaceSkillEntries, r as buildWorkspaceSkillSnapshot } from "./skills-Jz-BSwRd.js";
 import { f as hasBinary } from "./frontmatter-BngyYhS0.js";
-import { Y as buildChannelAccountBindings, b as resolveWhatsAppAccount, bt as resolveAccountEntry, g as resolveChannelDefaultAccountId, m as normalizeWhatsAppTarget, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-BVbKGpQJ.js";
-import { $ as writeFileWithinRoot, J as openFileWithinRoot, N as detectMime, W as SafeOpenError, Z as readLocalFileSafely } from "./query-expansion-AnOnkIqf.js";
+import { Y as buildChannelAccountBindings, b as resolveWhatsAppAccount, bt as resolveAccountEntry, g as resolveChannelDefaultAccountId, m as normalizeWhatsAppTarget, n as listChannelPlugins, r as normalizeChannelId, t as getChannelPlugin } from "./plugins-om7vnHk0.js";
+import { $ as writeFileWithinRoot, J as openFileWithinRoot, N as detectMime, W as SafeOpenError, Z as readLocalFileSafely } from "./query-expansion-BNb6Vys6.js";
 import { a as testRegexWithBoundedInput, i as compileSafeRegex } from "./redact-owRpqMhM.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-B6owPyQX.js";
-import "./fetch-ggeyBJ4j.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-BEqdGdn9.js";
+import "./fetch-CGW2R_wh.js";
 import { o as isErrno, r as formatErrorMessage } from "./errors-DNKaAVHN.js";
-import { d as inspectPortUsage, l as ensurePortAvailable, m as formatPortDiagnostics } from "./cmd-argv-Dz5qUtqp.js";
-import { t as cleanStaleGatewayProcessesSync } from "./restart-stale-pids-B6E7QavX.js";
+import { d as inspectPortUsage, l as ensurePortAvailable, m as formatPortDiagnostics } from "./cmd-argv-BdNFwuhe.js";
+import { t as cleanStaleGatewayProcessesSync } from "./restart-stale-pids-ZfbSMILU.js";
 import "./delivery-queue-B7zSt4zY.js";
 import { a as resolveSessionTranscriptPath, c as resolveSessionTranscriptsDirForAgent, i as resolveSessionFilePathOptions, l as resolveStorePath, r as resolveSessionFilePath } from "./paths-CfmKJcO5.js";
 import { c as formatUsd, d as deriveSessionTotalTokens, f as hasNonzeroUsage, i as loadSessionUsageTimeSeries, n as loadCostUsageSummary, r as loadSessionCostSummary, s as formatTokenCount, t as discoverAllSessions } from "./session-cost-usage-C2jrTKxW.js";
@@ -31,59 +31,59 @@ import "./prompt-style-DlcWUCNR.js";
 import { t as formatDocsLink } from "./links-BpKafJs4.js";
 import { n as runCommandWithRuntime } from "./cli-utils-BSURvrmb.js";
 import { i as onHeartbeatEvent, r as getLastHeartbeatEvent, t as resolveHeartbeatVisibility } from "./heartbeat-visibility-DRnbwSep.js";
-import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-B6HgPp5e.js";
+import { n as createOutboundSendDeps, t as createDefaultDeps } from "./deps-Cgw7M-k3.js";
 import { t as ensureOpenClawCliOnPath } from "./path-env-_M4X1ggC.js";
 import "./runtime-guard-C4h47dl7.js";
-import { n as waitForPortBindable, t as forceFreePortAndWait } from "./ports-CrZzXxTl.js";
-import { t as createOutboundSendDeps$1 } from "./outbound-send-deps-Bid3Xegx.js";
-import { a as resolveAgentOutboundTarget, i as resolveAgentDeliveryPlan, n as agentCommandFromIngress } from "./agent-CaQagdQ7.js";
-import { t as buildWorkspaceSkillStatus } from "./skills-status-DHMQ6A2H.js";
+import { n as waitForPortBindable, t as forceFreePortAndWait } from "./ports-CVD9jTxH.js";
+import { t as createOutboundSendDeps$1 } from "./outbound-send-deps-dRaNZNE7.js";
+import { a as resolveAgentOutboundTarget, i as resolveAgentDeliveryPlan, n as agentCommandFromIngress } from "./agent-B8D73rdQ.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-PMeXzDbC.js";
 import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-GYTW9RSz.js";
-import { t as readSecretFromFile } from "./secret-file-CuiwToxK.js";
+import { t as readSecretFromFile } from "./secret-file-7smmAVRV.js";
 import { n as inheritOptionFromParent } from "./command-options-B_WRgMFd.js";
 import { t as WizardCancelledError } from "./prompts-88Dfc7Av.js";
-import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-DpC62EoF.js";
-import { t as isWithinDir } from "./path-safety-DN7L46Yk.js";
-import "./install-safe-path-CnIWvuEU.js";
-import "./skill-scanner-DaUNX-tW.js";
-import { n as formatConfigIssueLines } from "./issue-format-CtBob7pd.js";
-import { t as buildChannelAccountSnapshot } from "./status-D9mVTxuB.js";
-import "./channels-status-issues-C6mRI9nP.js";
-import { n as verifyDeviceBootstrapToken } from "./device-bootstrap-oW1bwgs7.js";
-import { a as buildBaseHints, i as applySensitiveHints, n as redactConfigSnapshot, o as mapSensitivePaths, r as restoreRedactedValues, s as applyDerivedTags, t as redactConfigObject } from "./redact-snapshot-lCMXNHo3.js";
-import "./daemon-install-plan.shared-g5FPfccc.js";
-import "./gateway-install-token-CQHd6wSt.js";
+import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-Crwrvv0Y.js";
+import { t as isWithinDir } from "./path-safety-TRhr8lhQ.js";
+import "./install-safe-path-BvwKN_9n.js";
+import "./skill-scanner-BzjuMMKN.js";
+import { n as formatConfigIssueLines } from "./issue-format-34LidjQQ.js";
+import { t as buildChannelAccountSnapshot } from "./status-1patzIRq.js";
+import "./channels-status-issues-B-PoQaOZ.js";
+import { n as verifyDeviceBootstrapToken } from "./device-bootstrap-DSXbseT6.js";
+import { a as buildBaseHints, i as applySensitiveHints, n as redactConfigSnapshot, o as mapSensitivePaths, r as restoreRedactedValues, s as applyDerivedTags, t as redactConfigObject } from "./redact-snapshot-sudZsVoX.js";
+import "./daemon-install-plan.shared-BfFSRwqA.js";
+import "./gateway-install-token-C40ge2lh.js";
 import "./runtime-parse-l56zRsXX.js";
-import { p as scheduleDetachedLaunchdRestartHandoff } from "./launchd-D7vxtTg7.js";
-import { c as isGatewayArgv, l as parseProcCmdline } from "./service-LNrViUVb.js";
-import "./systemd-DSK6B3bg.js";
-import "./lifecycle-core-CKec6MyM.js";
-import "./systemd-hints-DsQTPBGt.js";
+import { p as scheduleDetachedLaunchdRestartHandoff } from "./launchd-BLFV2ME0.js";
+import { c as isGatewayArgv, l as parseProcCmdline } from "./service-RXVSlLiU.js";
+import "./systemd-D47rkLi7.js";
+import "./lifecycle-core-C07n1IOr.js";
+import "./systemd-hints-DHfXVo8k.js";
 import { t as parsePort$1 } from "./parse-port-C_3w9_cU.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-CgEObThe.js";
-import { r as probeGateway } from "./probe-auth-H1_HjX3c.js";
-import "./diagnostics-iZHasrpQ.js";
-import "./inspect-C0iPD7zZ.js";
-import { a as rejectDevicePairing, c as revokeDeviceToken, d as updatePairedDeviceMetadata, f as verifyDeviceToken, i as listDevicePairing, l as rotateDeviceToken, n as ensureDeviceToken, o as removePairedDevice, p as roleScopesAllow, r as getPairedDevice, s as requestDevicePairing, t as approveDevicePairing, u as summarizeDeviceTokens } from "./device-pairing-CMxl0D-M.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-TvT5eeIP.js";
+import { r as probeGateway } from "./probe-auth-CRm2yob0.js";
+import "./diagnostics-1AwcyuKi.js";
+import "./inspect-D3lV5ful.js";
+import { a as rejectDevicePairing, c as revokeDeviceToken, d as updatePairedDeviceMetadata, f as verifyDeviceToken, i as listDevicePairing, l as rotateDeviceToken, n as ensureDeviceToken, o as removePairedDevice, p as roleScopesAllow, r as getPairedDevice, s as requestDevicePairing, t as approveDevicePairing, u as summarizeDeviceTokens } from "./device-pairing-RZV6Mnep.js";
 import "./table-DpnYa9iY.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-clEQGTnj.js";
-import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-c6JUv5At.js";
-import { t as discoverGatewayBeacons } from "./bonjour-discovery-CgQeXj94.js";
-import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status-QQiIsfFq.js";
-import { a as styleHealthChannelLine, c as startHeartbeatRunner, l as resolveCronSession, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines } from "./health-CTOG7Tdy.js";
-import { a as resolveControlUiRootOverrideSync, n as isPackageProvenControlUiRootSync, o as resolveControlUiRootSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-B9I2TpME.js";
-import { m as normalizeUpdateChannel, n as checkUpdateStatus, o as resolveNpmChannelTag, r as compareSemverStrings } from "./channel-account-context-F18H2wEh.js";
-import "./onboarding.secret-input-D75Xjj5j.js";
-import { t as runOnboardingWizard } from "./onboarding-CAQDdLGu.js";
-import { a as resolveApnsAuthConfigFromEnv, c as shouldClearStoredApnsRegistration, d as parseMessageWithAttachments, f as formatForLog, g as setGatewayWsLogStyle, h as summarizeAgentEventForWsLog, l as resolveApnsRelayConfigFromEnv, m as shouldLogWs, n as loadApnsRegistration, o as sendApnsAlert, p as logWs, r as normalizeApnsEnvironment, s as sendApnsBackgroundWake, t as clearApnsRegistrationIfCurrent, u as normalizeRpcAttachmentsToChatAttachments } from "./push-apns-DQdHdrq8.js";
+import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-CoL161wD.js";
+import { t as discoverGatewayBeacons } from "./bonjour-discovery-Cnl-PHZ4.js";
+import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status-BaLZ1uQV.js";
+import { a as styleHealthChannelLine, c as startHeartbeatRunner, l as resolveCronSession, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines } from "./health-D_dD9-ET.js";
+import { a as resolveControlUiRootOverrideSync, n as isPackageProvenControlUiRootSync, o as resolveControlUiRootSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-D5CuaZfV.js";
+import { m as normalizeUpdateChannel, n as checkUpdateStatus, o as resolveNpmChannelTag, r as compareSemverStrings } from "./channel-account-context-DMK0G0sK.js";
+import "./onboarding.secret-input-OwIXA7An.js";
+import { t as runOnboardingWizard } from "./onboarding-BgeTWLi_.js";
+import { a as resolveApnsAuthConfigFromEnv, c as shouldClearStoredApnsRegistration, d as parseMessageWithAttachments, f as formatForLog, g as setGatewayWsLogStyle, h as summarizeAgentEventForWsLog, l as resolveApnsRelayConfigFromEnv, m as shouldLogWs, n as loadApnsRegistration, o as sendApnsAlert, p as logWs, r as normalizeApnsEnvironment, s as sendApnsBackgroundWake, t as clearApnsRegistrationIfCurrent, u as normalizeRpcAttachmentsToChatAttachments } from "./push-apns-6Yefl4vF.js";
 import { _ as buildGogWatchStartArgs, g as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, w as resolveGmailHookRuntimeConfig } from "./gmail-setup-utils-CzxzkzZ7.js";
-import { f as normalizeStoredCronJobs, h as computePreviousRunAtMs, m as computeNextRunAtMs, p as coerceFiniteScheduleNumber, t as runGatewayUpdate } from "./update-runner-CfkBU1BA.js";
-import { n as isNodeCommandAllowed, r as resolveNodeCommandAllowlist } from "./node-command-policy-C9YoIlNR.js";
-import { _ as resolveHookTargetAgentId, a as getHookAgentPolicyError, b as resolveFunctionModuleExport, c as normalizeAgentPayload, d as normalizeWakePayload, f as readJsonBody, g as resolveHookSessionKey, h as resolveHookIdempotencyKey, i as extractHookToken, l as normalizeHookDispatchSessionKey, m as resolveHookDeliver, n as collectEnabledInsecureOrDangerousFlags, o as getHookChannelError, p as resolveHookChannel, s as isHookAgentAllowed, u as normalizeHookHeaders, v as resolveHooksConfig, y as applyHookMappings } from "./audit-COOnp_TQ.js";
-import "./node-service-D7xRD6Op.js";
-import "./status.update-DY13od-q.js";
-import { t as installSkill } from "./skills-install-BnRu7wO4.js";
-import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-BTsqd19h.js";
+import { f as normalizeStoredCronJobs, h as computePreviousRunAtMs, m as computeNextRunAtMs, p as coerceFiniteScheduleNumber, t as runGatewayUpdate } from "./update-runner-oqYBjs5t.js";
+import { n as isNodeCommandAllowed, r as resolveNodeCommandAllowlist } from "./node-command-policy-BVIbeciX.js";
+import { _ as resolveHookTargetAgentId, a as getHookAgentPolicyError, b as resolveFunctionModuleExport, c as normalizeAgentPayload, d as normalizeWakePayload, f as readJsonBody, g as resolveHookSessionKey, h as resolveHookIdempotencyKey, i as extractHookToken, l as normalizeHookDispatchSessionKey, m as resolveHookDeliver, n as collectEnabledInsecureOrDangerousFlags, o as getHookChannelError, p as resolveHookChannel, s as isHookAgentAllowed, u as normalizeHookHeaders, v as resolveHooksConfig, y as applyHookMappings } from "./audit-CX3KlHoS.js";
+import "./node-service-ESc5ToCS.js";
+import "./status.update-DrzJ1YWu.js";
+import { t as installSkill } from "./skills-install-DFkV3GsC.js";
+import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-CWne7yqK.js";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import * as fsSync from "node:fs";
 import fs from "node:fs";
@@ -91,7 +91,7 @@ import os from "node:os";
 import path from "node:path";
 import chalk from "chalk";
 import { isDeepStrictEqual } from "node:util";
-import fsPromises from "node:fs/promises";
+import fs$1 from "node:fs/promises";
 import { exec, spawn, spawnSync } from "node:child_process";
 import crypto, { createHash, randomBytes, randomUUID } from "node:crypto";
 import { z } from "zod";
@@ -1272,7 +1272,7 @@ function resolveCheckIntervalMs(cfg) {
 }
 async function readState(statePath) {
 	try {
-		const raw = await fsPromises.readFile(statePath, "utf-8");
+		const raw = await fs$1.readFile(statePath, "utf-8");
 		const parsed = JSON.parse(raw);
 		return parsed && typeof parsed === "object" ? parsed : {};
 	} catch {
@@ -1353,7 +1353,7 @@ async function runAutoUpdateCommand(params) {
 			path.join(params.root, "dist", "index.mjs")
 		];
 		for (const candidate of candidates) try {
-			await fsPromises.access(candidate);
+			await fs$1.access(candidate);
 			argv.push(execPath, candidate, ...baseArgs);
 			break;
 		} catch {}
@@ -4687,7 +4687,7 @@ function resolveCronRunLogPath(params) {
 }
 const writesByPath = /* @__PURE__ */ new Map();
 async function setSecureFileMode(filePath) {
-	await fsPromises.chmod(filePath, 384).catch(() => void 0);
+	await fs$1.chmod(filePath, 384).catch(() => void 0);
 }
 const DEFAULT_CRON_RUN_LOG_MAX_BYTES = 2e6;
 const DEFAULT_CRON_RUN_LOG_KEEP_LINES = 2e3;
@@ -4711,30 +4711,30 @@ async function drainPendingWrite(filePath) {
 	if (pending) await pending.catch(() => void 0);
 }
 async function pruneIfNeeded(filePath, opts) {
-	const stat = await fsPromises.stat(filePath).catch(() => null);
+	const stat = await fs$1.stat(filePath).catch(() => null);
 	if (!stat || stat.size <= opts.maxBytes) return;
-	const lines = (await fsPromises.readFile(filePath, "utf-8").catch(() => "")).split("\n").map((l) => l.trim()).filter(Boolean);
+	const lines = (await fs$1.readFile(filePath, "utf-8").catch(() => "")).split("\n").map((l) => l.trim()).filter(Boolean);
 	const kept = lines.slice(Math.max(0, lines.length - opts.keepLines));
 	const { randomBytes } = await import("node:crypto");
 	const tmp = `${filePath}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
-	await fsPromises.writeFile(tmp, `${kept.join("\n")}\n`, {
+	await fs$1.writeFile(tmp, `${kept.join("\n")}\n`, {
 		encoding: "utf-8",
 		mode: 384
 	});
 	await setSecureFileMode(tmp);
-	await fsPromises.rename(tmp, filePath);
+	await fs$1.rename(tmp, filePath);
 	await setSecureFileMode(filePath);
 }
 async function appendCronRunLog(filePath, entry, opts) {
 	const resolved = path.resolve(filePath);
 	const next = (writesByPath.get(resolved) ?? Promise.resolve()).catch(() => void 0).then(async () => {
 		const runDir = path.dirname(resolved);
-		await fsPromises.mkdir(runDir, {
+		await fs$1.mkdir(runDir, {
 			recursive: true,
 			mode: 448
 		});
-		await fsPromises.chmod(runDir, 448).catch(() => void 0);
-		await fsPromises.appendFile(resolved, `${JSON.stringify(entry)}\n`, {
+		await fs$1.chmod(runDir, 448).catch(() => void 0);
+		await fs$1.appendFile(resolved, `${JSON.stringify(entry)}\n`, {
 			encoding: "utf-8",
 			mode: 384
 		});
@@ -4832,7 +4832,7 @@ function filterRunLogEntries(entries, opts) {
 async function readCronRunLogEntriesPage(filePath, opts) {
 	await drainPendingWrite(filePath);
 	const limit = Math.max(1, Math.min(200, Math.floor(opts?.limit ?? 50)));
-	const raw = await fsPromises.readFile(path.resolve(filePath), "utf-8").catch(() => "");
+	const raw = await fs$1.readFile(path.resolve(filePath), "utf-8").catch(() => "");
 	const statuses = normalizeRunStatuses(opts);
 	const deliveryStatuses = normalizeDeliveryStatuses(opts);
 	const query = opts?.query?.trim().toLowerCase() ?? "";
@@ -4868,7 +4868,7 @@ async function readCronRunLogEntriesPageAll(opts) {
 	const query = opts.query?.trim().toLowerCase() ?? "";
 	const sortDir = opts.sortDir === "asc" ? "asc" : "desc";
 	const runsDir = path.resolve(path.dirname(path.resolve(opts.storePath)), "runs");
-	const jsonlFiles = (await fsPromises.readdir(runsDir, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path.join(runsDir, entry.name));
+	const jsonlFiles = (await fs$1.readdir(runsDir, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => path.join(runsDir, entry.name));
 	if (jsonlFiles.length === 0) return {
 		entries: [],
 		total: 0,
@@ -4879,7 +4879,7 @@ async function readCronRunLogEntriesPageAll(opts) {
 	};
 	await Promise.all(jsonlFiles.map((f) => drainPendingWrite(f)));
 	const filtered = filterRunLogEntries((await Promise.all(jsonlFiles.map(async (filePath) => {
-		return parseAllRunLogEntries(await fsPromises.readFile(filePath, "utf-8").catch(() => ""));
+		return parseAllRunLogEntries(await fs$1.readFile(filePath, "utf-8").catch(() => ""));
 	}))).flat(), {
 		statuses,
 		deliveryStatuses,
@@ -9380,7 +9380,7 @@ function resolveWorkspaceFilePathResultOrThrow(params) {
 }
 async function resolveWorkspaceRealPath(workspaceDir) {
 	try {
-		return await fsPromises.realpath(workspaceDir);
+		return await fs$1.realpath(workspaceDir);
 	} catch {
 		return path.resolve(workspaceDir);
 	}
@@ -9409,7 +9409,7 @@ async function resolveAgentWorkspaceFilePath(params) {
 	};
 	let candidateLstat;
 	try {
-		candidateLstat = await fsPromises.lstat(candidatePath);
+		candidateLstat = await fs$1.lstat(candidatePath);
 	} catch (err) {
 		return resolveWorkspaceFilePathResultOrThrow({
 			error: err,
@@ -9420,7 +9420,7 @@ async function resolveAgentWorkspaceFilePath(params) {
 	if (candidateLstat.isSymbolicLink()) {
 		let targetReal;
 		try {
-			targetReal = await fsPromises.realpath(candidatePath);
+			targetReal = await fs$1.realpath(candidatePath);
 		} catch (err) {
 			return resolveWorkspaceFilePathResultOrThrow({
 				error: err,
@@ -9430,7 +9430,7 @@ async function resolveAgentWorkspaceFilePath(params) {
 		}
 		let targetStat;
 		try {
-			targetStat = await fsPromises.stat(targetReal);
+			targetStat = await fs$1.stat(targetReal);
 		} catch (err) {
 			return resolveWorkspaceFilePathResultOrThrow({
 				error: err,
@@ -9468,13 +9468,13 @@ async function resolveAgentWorkspaceFilePath(params) {
 	return {
 		kind: "ready",
 		requestPath,
-		ioPath: await fsPromises.realpath(candidatePath).catch(() => candidatePath),
+		ioPath: await fs$1.realpath(candidatePath).catch(() => candidatePath),
 		workspaceReal
 	};
 }
 async function statFileSafely(filePath) {
 	try {
-		const [stat, lstat] = await Promise.all([fsPromises.stat(filePath), fsPromises.lstat(filePath)]);
+		const [stat, lstat] = await Promise.all([fs$1.stat(filePath), fs$1.lstat(filePath)]);
 		if (lstat.isSymbolicLink() || !stat.isFile()) return null;
 		if (stat.nlink > 1) return null;
 		if (!sameFileIdentity(stat, lstat)) return null;
@@ -9568,7 +9568,7 @@ function respondAgentNotFound(respond, agentId) {
 async function moveToTrashBestEffort(pathname) {
 	if (!pathname) return;
 	try {
-		await fsPromises.access(pathname);
+		await fs$1.access(pathname);
 	} catch {
 		return;
 	}
@@ -9644,7 +9644,7 @@ const agentsHandlers = {
 			dir: workspaceDir,
 			ensureBootstrapFiles: !Boolean(nextConfig.agents?.defaults?.skipBootstrap)
 		});
-		await fsPromises.mkdir(resolveSessionTranscriptsDirForAgent(agentId), { recursive: true });
+		await fs$1.mkdir(resolveSessionTranscriptsDirForAgent(agentId), { recursive: true });
 		await writeConfigFile(nextConfig);
 		const safeName = sanitizeIdentityLine(rawName);
 		const emoji = resolveOptionalStringParam(params.emoji);
@@ -9657,7 +9657,7 @@ const agentsHandlers = {
 			...avatar ? [`- Avatar: ${sanitizeIdentityLine(avatar)}`] : [],
 			""
 		];
-		await fsPromises.appendFile(identityPath, lines.join("\n"), "utf-8");
+		await fs$1.appendFile(identityPath, lines.join("\n"), "utf-8");
 		respond(true, {
 			ok: true,
 			agentId,
@@ -9692,9 +9692,9 @@ const agentsHandlers = {
 		});
 		if (avatar) {
 			const workspace = workspaceDir ?? resolveAgentWorkspaceDir(nextConfig, agentId);
-			await fsPromises.mkdir(workspace, { recursive: true });
+			await fs$1.mkdir(workspace, { recursive: true });
 			const identityPath = path.join(workspace, DEFAULT_IDENTITY_FILENAME);
-			await fsPromises.appendFile(identityPath, `\n- Avatar: ${sanitizeIdentityLine(avatar)}\n`, "utf-8");
+			await fs$1.appendFile(identityPath, `\n- Avatar: ${sanitizeIdentityLine(avatar)}\n`, "utf-8");
 		}
 		respond(true, {
 			ok: true,
@@ -9818,7 +9818,7 @@ const agentsHandlers = {
 		const resolved = resolveAgentWorkspaceFileOrRespondError(params, respond);
 		if (!resolved) return;
 		const { agentId, workspaceDir, name } = resolved;
-		await fsPromises.mkdir(workspaceDir, { recursive: true });
+		await fs$1.mkdir(workspaceDir, { recursive: true });
 		const filePath = path.join(workspaceDir, name);
 		const resolvedPath = await resolveWorkspaceFilePathOrRespond({
 			respond,
@@ -12633,14 +12633,14 @@ function isRollingLogFile(file) {
 	return ROLLING_LOG_RE.test(path.basename(file));
 }
 async function resolveLogFile(file) {
-	if (await fsPromises.stat(file).catch(() => null)) return file;
+	if (await fs$1.stat(file).catch(() => null)) return file;
 	if (!isRollingLogFile(file)) return file;
 	const dir = path.dirname(file);
-	const entries = await fsPromises.readdir(dir, { withFileTypes: true }).catch(() => null);
+	const entries = await fs$1.readdir(dir, { withFileTypes: true }).catch(() => null);
 	if (!entries) return file;
 	return (await Promise.all(entries.filter((entry) => entry.isFile() && ROLLING_LOG_RE.test(entry.name)).map(async (entry) => {
 		const fullPath = path.join(dir, entry.name);
-		const fileStat = await fsPromises.stat(fullPath).catch(() => null);
+		const fileStat = await fs$1.stat(fullPath).catch(() => null);
 		return fileStat ? {
 			path: fullPath,
 			mtimeMs: fileStat.mtimeMs
@@ -12648,7 +12648,7 @@ async function resolveLogFile(file) {
 	}))).filter((entry) => Boolean(entry)).toSorted((a, b) => b.mtimeMs - a.mtimeMs)[0]?.path ?? file;
 }
 async function readLogSlice(params) {
-	const stat = await fsPromises.stat(params.file).catch(() => null);
+	const stat = await fs$1.stat(params.file).catch(() => null);
 	if (!stat) return {
 		cursor: 0,
 		size: 0,
@@ -12686,7 +12686,7 @@ async function readLogSlice(params) {
 		truncated,
 		reset
 	};
-	const handle = await fsPromises.open(params.file, "r");
+	const handle = await fs$1.open(params.file, "r");
 	try {
 		let prefix = "";
 		if (start > 0) {
@@ -13983,7 +13983,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-aTSoNGTe.js");
+			const { handleNodeEvent } = await import("./server-node-events-p5ykMQz-.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,
@@ -17404,7 +17404,7 @@ async function startGmailWatcherWithLogs(params) {
 async function startBrowserControlServerIfEnabled() {
 	if (isTruthyEnvValue(process.env.OPENCLAW_SKIP_BROWSER_CONTROL_SERVER)) return null;
 	const override = process.env.OPENCLAW_BROWSER_CONTROL_MODULE?.trim();
-	const mod = override ? await import(override) : await import("./server-Cnc4lO11.js");
+	const mod = override ? await import(override) : await import("./server-DiTziwvC.js");
 	const start = typeof mod.startBrowserControlServiceFromConfig === "function" ? mod.startBrowserControlServiceFromConfig : mod.startBrowserControlServerFromConfig;
 	const stop = typeof mod.stopBrowserControlService === "function" ? mod.stopBrowserControlService : mod.stopBrowserControlServer;
 	if (!start) return null;
@@ -17436,7 +17436,7 @@ async function resolveFileWithinRoot(rootReal, urlPath) {
 	if (normalized.endsWith("/")) return await tryOpen(path.posix.join(rel, "index.html"));
 	const candidate = path.join(rootReal, rel);
 	try {
-		const st = await fsPromises.lstat(candidate);
+		const st = await fs$1.lstat(candidate);
 		if (st.isSymbolicLink()) return null;
 		if (st.isDirectory()) return await tryOpen(path.posix.join(rel, "index.html"));
 	} catch {}
@@ -17472,8 +17472,8 @@ async function resolveA2uiRoot() {
 	for (const dir of candidates) try {
 		const indexPath = path.join(dir, "index.html");
 		const bundlePath = path.join(dir, "a2ui.bundle.js");
-		await fsPromises.stat(indexPath);
-		await fsPromises.stat(bundlePath);
+		await fs$1.stat(indexPath);
+		await fs$1.stat(bundlePath);
 		return dir;
 	} catch {}
 	return null;
@@ -17482,7 +17482,7 @@ async function resolveA2uiRootReal() {
 	if (cachedA2uiRootReal !== void 0 && (cachedA2uiRootReal !== null || Date.now() - cachedA2uiResolvedAtMs < A2UI_ROOT_RETRY_NULL_AFTER_MS)) return cachedA2uiRootReal;
 	if (!resolvingA2uiRoot) resolvingA2uiRoot = (async () => {
 		const root = await resolveA2uiRoot();
-		cachedA2uiRootReal = root ? await fsPromises.realpath(root) : null;
+		cachedA2uiRootReal = root ? await fs$1.realpath(root) : null;
 		cachedA2uiResolvedAtMs = Date.now();
 		resolvingA2uiRoot = null;
 		return cachedA2uiRootReal;
@@ -20892,13 +20892,13 @@ function normalizeBasePath(rawPath) {
 }
 async function prepareCanvasRoot(rootDir) {
 	await ensureDir(rootDir);
-	const rootReal = await fsPromises.realpath(rootDir);
+	const rootReal = await fs$1.realpath(rootDir);
 	try {
 		const indexPath = path.join(rootReal, "index.html");
-		await fsPromises.stat(indexPath);
+		await fs$1.stat(indexPath);
 	} catch {
 		try {
-			await fsPromises.writeFile(path.join(rootReal, "index.html"), defaultIndexHTML(), "utf8");
+			await fs$1.writeFile(path.join(rootReal, "index.html"), defaultIndexHTML(), "utf8");
 		} catch {}
 	}
 	return rootReal;
@@ -21198,7 +21198,7 @@ async function resolveGatewayOwnerStatus(pid, payload, platform, port) {
 }
 async function readLockPayload(lockPath) {
 	try {
-		const raw = await fsPromises.readFile(lockPath, "utf8");
+		const raw = await fs$1.readFile(lockPath, "utf8");
 		const parsed = JSON.parse(raw);
 		if (typeof parsed.pid !== "number") return null;
 		if (typeof parsed.createdAt !== "string") return null;
@@ -21233,11 +21233,11 @@ async function acquireGatewayLock(opts = {}) {
 	const platform = opts.platform ?? process.platform;
 	const port = opts.port;
 	const { lockPath, configPath } = resolveGatewayLockPath(env);
-	await fsPromises.mkdir(path.dirname(lockPath), { recursive: true });
+	await fs$1.mkdir(path.dirname(lockPath), { recursive: true });
 	const startedAt = Date.now();
 	let lastPayload = null;
 	while (Date.now() - startedAt < timeoutMs) try {
-		const handle = await fsPromises.open(lockPath, "wx");
+		const handle = await fs$1.open(lockPath, "wx");
 		const startTime = platform === "linux" ? readLinuxStartTime(process.pid) : null;
 		const payload = {
 			pid: process.pid,
@@ -21251,7 +21251,7 @@ async function acquireGatewayLock(opts = {}) {
 			configPath,
 			release: async () => {
 				await handle.close().catch(() => void 0);
-				await fsPromises.rm(lockPath, { force: true });
+				await fs$1.rm(lockPath, { force: true });
 			}
 		};
 	} catch (err) {
@@ -21260,7 +21260,7 @@ async function acquireGatewayLock(opts = {}) {
 		const ownerPid = lastPayload?.pid;
 		const ownerStatus = ownerPid ? await resolveGatewayOwnerStatus(ownerPid, lastPayload, platform, port) : "unknown";
 		if (ownerStatus === "dead" && ownerPid) {
-			await fsPromises.rm(lockPath, { force: true });
+			await fs$1.rm(lockPath, { force: true });
 			continue;
 		}
 		if (ownerStatus !== "alive") {
@@ -21270,13 +21270,13 @@ async function acquireGatewayLock(opts = {}) {
 				stale = Number.isFinite(createdAt) ? Date.now() - createdAt > staleMs : false;
 			}
 			if (!stale) try {
-				const st = await fsPromises.stat(lockPath);
+				const st = await fs$1.stat(lockPath);
 				stale = Date.now() - st.mtimeMs > staleMs;
 			} catch {
 				stale = false;
 			}
 			if (stale) {
-				await fsPromises.rm(lockPath, { force: true });
+				await fs$1.rm(lockPath, { force: true });
 				continue;
 			}
 		}
@@ -23793,7 +23793,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	if (!minimalTestGateway) cron.start().catch((err) => logCron.error(`failed to start: ${String(err)}`));
 	if (!minimalTestGateway) (async () => {
 		const { recoverPendingDeliveries } = await import("./delivery-queue-B7zSt4zY.js").then((n) => n.n);
-		const { deliverOutboundPayloads } = await import("./reply-gX1XTS9Y.js").then((n) => n.ta);
+		const { deliverOutboundPayloads } = await import("./reply-Cf5Mm7vB.js").then((n) => n.ta);
 		await recoverPendingDeliveries({
 			deliver: deliverOutboundPayloads,
 			log: log.child("delivery-recovery"),

package/dist/{gateway-install-token-CQHd6wSt.js → gateway-install-token-C40ge2lh.js}

@@ -1,9 +1,9 @@
-import { Hh as readGatewayTokenEnv, It as randomToken, Kg as resolveSecretRefValues, Lh as resolveGatewayAuth, Mh as hasAmbiguousGatewayAuthModeConfig, m_ as readConfigFileSnapshot, sv as collectConfigServiceEnvVars, v_ as writeConfigFile, wv as loadAuthProfileStoreForSecretsRuntime } from "./reply-gX1XTS9Y.js";
+import { Hh as readGatewayTokenEnv, It as randomToken, Kg as resolveSecretRefValues, Lh as resolveGatewayAuth, Mh as hasAmbiguousGatewayAuthModeConfig, m_ as readConfigFileSnapshot, sv as collectConfigServiceEnvVars, v_ as writeConfigFile, wv as loadAuthProfileStoreForSecretsRuntime } from "./reply-Cf5Mm7vB.js";
 import { a as hasConfiguredSecretInput, d as resolveSecretInputRef } from "./types.secrets-d7ZFrG7U.js";
 import { t as formatCliCommand } from "./command-format-p_4ya3m0.js";
-import { Mt as secretRefKey } from "./plugins-BVbKGpQJ.js";
+import { Mt as secretRefKey } from "./plugins-om7vnHk0.js";
 import { l as resolveGatewayLaunchAgentLabel } from "./constants-D-pfuSKJ.js";
-import { f as resolveGatewayProgramArguments, n as resolveDaemonInstallRuntimeInputs, t as emitDaemonInstallRuntimeWarning, u as buildServiceEnvironment } from "./daemon-install-plan.shared-g5FPfccc.js";
+import { f as resolveGatewayProgramArguments, n as resolveDaemonInstallRuntimeInputs, t as emitDaemonInstallRuntimeWarning, u as buildServiceEnvironment } from "./daemon-install-plan.shared-BfFSRwqA.js";
 //#region src/commands/daemon-install-helpers.ts
 function collectAuthProfileServiceEnvVars(params) {
 	const authStore = params.authStore ?? loadAuthProfileStoreForSecretsRuntime();

package/dist/{gateway-rpc-DrDqntyT.js → gateway-rpc-DUJcLoxb.js}

@@ -1,4 +1,4 @@
-import { G as withProgress, Tm as GATEWAY_CLIENT_NAMES, rs as callGateway, wm as GATEWAY_CLIENT_MODES } from "./reply-gX1XTS9Y.js";
+import { G as withProgress, Tm as GATEWAY_CLIENT_NAMES, rs as callGateway, wm as GATEWAY_CLIENT_MODES } from "./reply-Cf5Mm7vB.js";
 //#region src/cli/gateway-rpc.ts
 function addGatewayClientOptions(cmd) {
 	return cmd.option("--url <url>", "Gateway WebSocket URL (defaults to gateway.remote.url when configured)").option("--token <token>", "Gateway token (if required)").option("--timeout <ms>", "Timeout in ms", "30000").option("--expect-final", "Wait for final response (agent)", false);