fix(scripts): authenticate notification daemon requests

.beads/.gitignore

@@ -0,0 +1,51 @@
+# Dolt database (managed by Dolt, not git)
+dolt/
+dolt-access.lock
+
+# Runtime files
+bd.sock
+bd.sock.startlock
+sync-state.json
+last-touched
+
+# Local version tracking (prevents upgrade notification spam after git ops)
+.local_version
+
+# Worktree redirect file (contains relative path to main repo's .beads/)
+# Must not be committed as paths would be wrong in other clones
+redirect
+
+# Sync state (local-only, per-machine)
+# These files are machine-specific and should not be shared across clones
+.sync.lock
+export-state/
+
+# Ephemeral store (SQLite - wisps/molecules, intentionally not versioned)
+ephemeral.sqlite3
+ephemeral.sqlite3-journal
+ephemeral.sqlite3-wal
+ephemeral.sqlite3-shm
+
+# Dolt server management (auto-started by bd)
+dolt-server.pid
+dolt-server.log
+dolt-server.lock
+dolt-server.port
+dolt-server.activity
+dolt-monitor.pid
+
+# Backup data (auto-exported JSONL, local-only)
+backup/
+
+# Legacy files (from pre-Dolt versions)
+*.db
+*.db?*
+*.db-journal
+*.db-wal
+*.db-shm
+db.sqlite
+bd.db
+# NOTE: Do NOT add negation patterns here.
+# They would override fork protection in .git/info/exclude.
+# Config files (metadata.json, config.yaml) are tracked by git by default
+# since no pattern above ignores them.

.beads/README.md

@@ -0,0 +1,81 @@
+# Beads - AI-Native Issue Tracking
+
+Welcome to Beads! This repository uses **Beads** for issue tracking - a modern, AI-native tool designed to live directly in your codebase alongside your code.
+
+## What is Beads?
+
+Beads is issue tracking that lives in your repo, making it perfect for AI coding agents and developers who want their issues close to their code. No web UI required - everything works through the CLI and integrates seamlessly with git.
+
+**Learn more:** [github.com/steveyegge/beads](https://github.com/steveyegge/beads)
+
+## Quick Start
+
+### Essential Commands
+
+```bash
+# Create new issues
+bd create "Add user authentication"
+
+# View all issues
+bd list
+
+# View issue details
+bd show <issue-id>
+
+# Update issue status
+bd update <issue-id> --claim
+bd update <issue-id> --status done
+
+# Sync with Dolt remote
+bd dolt push
+```
+
+### Working with Issues
+
+Issues in Beads are:
+- **Git-native**: Stored in Dolt database with version control and branching
+- **AI-friendly**: CLI-first design works perfectly with AI coding agents
+- **Branch-aware**: Issues can follow your branch workflow
+- **Always in sync**: Auto-syncs with your commits
+
+## Why Beads?
+
+✨ **AI-Native Design**
+- Built specifically for AI-assisted development workflows
+- CLI-first interface works seamlessly with AI coding agents
+- No context switching to web UIs
+
+🚀 **Developer Focused**
+- Issues live in your repo, right next to your code
+- Works offline, syncs when you push
+- Fast, lightweight, and stays out of your way
+
+🔧 **Git Integration**
+- Automatic sync with git commits
+- Branch-aware issue tracking
+- Dolt-native three-way merge resolution
+
+## Get Started with Beads
+
+Try Beads in your own projects:
+
+```bash
+# Install Beads
+curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash
+
+# Initialize in your repo
+bd init
+
+# Create your first issue
+bd create "Try out Beads"
+```
+
+## Learn More
+
+- **Documentation**: [github.com/steveyegge/beads/docs](https://github.com/steveyegge/beads/tree/main/docs)
+- **Quick Start Guide**: Run `bd quickstart`
+- **Examples**: [github.com/steveyegge/beads/examples](https://github.com/steveyegge/beads/tree/main/examples)
+
+---
+
+*Beads: Issue tracking that moves at the speed of thought* ⚡

.beads/config.yaml

@@ -0,0 +1,54 @@
+# Beads Configuration File
+# This file configures default behavior for all bd commands in this repository
+# All settings can also be set via environment variables (BD_* prefix)
+# or overridden with command-line flags
+
+# Issue prefix for this repository (used by bd init)
+# If not set, bd init will auto-detect from directory name
+# Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.
+# issue-prefix: ""
+
+# Use no-db mode: JSONL-only, no Dolt database
+# When true, bd will use .beads/issues.jsonl as the source of truth
+# no-db: false
+
+# Enable JSON output by default
+# json: false
+
+# Feedback title formatting for mutating commands (create/update/close/dep/edit)
+# 0 = hide titles, N > 0 = truncate to N characters
+# output:
+#   title-length: 255
+
+# Default actor for audit trails (overridden by BD_ACTOR or --actor)
+# actor: ""
+
+# Export events (audit trail) to .beads/events.jsonl on each flush/sync
+# When enabled, new events are appended incrementally using a high-water mark.
+# Use 'bd export --events' to trigger manually regardless of this setting.
+# events-export: false
+
+# Multi-repo configuration (experimental - bd-307)
+# Allows hydrating from multiple repositories and routing writes to the correct database
+# repos:
+#   primary: "."  # Primary repo (where this database lives)
+#   additional:   # Additional repos to hydrate from (read-only)
+#     - ~/beads-planning  # Personal planning repo
+#     - ~/work-planning   # Work planning repo
+
+# JSONL backup (periodic export for off-machine recovery)
+# Auto-enabled when a git remote exists. Override explicitly:
+# backup:
+#   enabled: false     # Disable auto-backup entirely
+#   interval: 15m      # Minimum time between auto-exports
+#   git-push: false    # Disable git push (export locally only)
+#   git-repo: ""       # Separate git repo for backups (default: project repo)
+
+# Integration settings (access with 'bd config get/set')
+# These are stored in the database, not in this file:
+# - jira.url
+# - jira.project
+# - linear.url
+# - linear.api-key
+# - github.org
+# - github.repo

.beads/hooks/post-checkout

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v0.59.0 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  bd hooks run post-checkout "$@"
+  _bd_exit=$?; if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v0.59.0 ---

.beads/hooks/post-merge

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v0.59.0 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  bd hooks run post-merge "$@"
+  _bd_exit=$?; if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v0.59.0 ---

.beads/hooks/pre-commit

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v0.59.0 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  bd hooks run pre-commit "$@"
+  _bd_exit=$?; if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v0.59.0 ---

.beads/hooks/pre-push

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v0.59.0 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  bd hooks run pre-push "$@"
+  _bd_exit=$?; if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v0.59.0 ---

.beads/hooks/prepare-commit-msg

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v0.59.0 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  bd hooks run prepare-commit-msg "$@"
+  _bd_exit=$?; if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v0.59.0 ---

.beads/metadata.json

@@ -0,0 +1,7 @@
+{
+  "database": "dolt",
+  "backend": "dolt",
+  "dolt_mode": "server",
+  "dolt_database": "mission_control",
+  "project_id": "9e919157-e9d2-4cce-8bc5-bc81503dd2fa"
+}

.dockerignore

@@ -8,3 +8,4 @@ node_modules
 ops
 scripts/*
 !scripts/check-node-version.mjs
+!scripts/openclaw-cli-shim.py

.env.example

@@ -1,17 +1,32 @@
 # ═══════════════════════════════════════════════════════════════════════════════
 # Mission Control — Environment Variables
 # ═══════════════════════════════════════════════════════════════════════════════
-# Copy to .env and adjust for your deployment mode.
 #
 # IMPORTANT: NEXT_PUBLIC_* variables are baked into the client-side JavaScript
 # bundle at build time (pnpm build). If you change any NEXT_PUBLIC_* variable,
 # you MUST run `pnpm build` again for the change to take effect in the browser.
 # Server-side variables (OPENCLAW_*, AUTH_*, etc.) are read at runtime and do
 # not require a rebuild.
 
+# MC_MODE=prod
+MC_MODE=dev
+# 0, если нужно без OpenClaw
+OPENCLAW_ENABLED=1
+
 # === Server Port ===
 # PORT=3000
 
+# === Make / Docker local runtime ===
+# `make up` and `make status` resolve MC_URL from these keys.
+
+# --- Mission Control: базовый URL приложения ---
+# Протокол внешнего доступа к MC: http для локальной разработки, https для прод/публичного доступа.
+MC_URL_SCHEME=http
+# Хост, на котором доступен Mission Control.
+MC_HOST=127.0.0.1
+# Порт Mission Control на хосте.
+MC_PORT=7012
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # Authentication
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -28,13 +43,22 @@
 # Auto-generated on first run if not set. Persisted to .data/.auto-generated.
 # AUTH_SECRET=
 
-MC_COOKIE_SECURE=
-MC_COOKIE_SAMESITE=strict
-
+# --- Опционально: безопасность Mission Control ---
 # Network access control (production: blocked unless host is explicitly allowed)
 # Patterns: exact "app.example.com", subdomain "*.example.com", prefix "100.*"
-# MC_ALLOW_ANY_HOST=
+# Разрешённые host-заголовки через запятую.
 MC_ALLOWED_HOSTS=localhost,127.0.0.1,::1
+# Включить HSTS (ТОЛЬКО при HTTPS, иначе можно сломать доступ по HTTP).
+MC_ENABLE_HSTS=
+# Secure-cookie (ТОЛЬКО при HTTPS; для HTTP оставьте пустым).
+# Set to 1 only when Mission Control is served over HTTPS.
+# Keep blank for local/plain-HTTP deployments.
+MC_COOKIE_SECURE=
+
+MC_COOKIE_SAMESITE=strict
+# Set to 1 only when TLS terminates at your proxy/load-balancer.
+# MC_ENABLE_HSTS=1
+
 
 # Trusted reverse proxy / header authentication
 # MC_PROXY_AUTH_HEADER=X-User-Email
@@ -57,11 +81,33 @@ NEXT_PUBLIC_GOOGLE_CLIENT_ID=
 # For local development, both point to the same machine (127.0.0.1).
 # For Docker or remote servers, they will differ.
 
-# ─── Local Development ────────────────────────────────────────────────────────
-# Both MC and gateway run on the same machine. No special config needed.
-OPENCLAW_GATEWAY_HOST=127.0.0.1
-OPENCLAW_GATEWAY_PORT=18789
-# OPENCLAW_GATEWAY_TOKEN=
+## ─── Local Development ────────────────────────────────────────────────────────
+## Both MC and gateway run on the same machine. No special config needed.
+#OPENCLAW_GATEWAY_HOST=127.0.0.1
+#
+## --- OpenClaw: хост для health/status проверок ---
+#OPENCLAW_STATUS_HOST=127.0.0.1
+#
+## --- OpenClaw: внешние порты (host bind) ---
+## Внешний порт OpenClaw gateway.
+#OPENCLAW_GATEWAY_PORT=18789
+## Внешний порт панели управления OpenClaw (Control UI).
+#OPENCLAW_CONTROL_UI_PORT=18791
+#
+## --- OpenClaw: внутренние/bridge порты ---
+## Внутренний порт gateway внутри контейнера.
+#OPENCLAW_GATEWAY_INTERNAL_PORT=18789
+## Внешний порт bridge на хосте.
+#OPENCLAW_BRIDGE_PORT=18790
+## Внутренний порт bridge внутри контейнера.
+#OPENCLAW_BRIDGE_INTERNAL_PORT=18790
+
+# --- OpenClaw: токен доступа к gateway (секрет) ---
+# Секретный токен для авторизации в OpenClaw gateway.
+# Никогда не публикуйте реальный токен в git.
+OPENCLAW_GATEWAY_TOKEN=...
+
+
 NEXT_PUBLIC_GATEWAY_HOST=
 NEXT_PUBLIC_GATEWAY_PORT=18789
 
@@ -105,6 +151,12 @@ NEXT_PUBLIC_GATEWAY_PORT=18789
 OPENCLAW_HOME=
 # OPENCLAW_CONFIG_PATH=
 OPENCLAW_TOOLS_PROFILE=coding
+# Visibility of group chat replies when projecting OpenClaw state (automatic|message_tool).
+OPENCLAW_MESSAGES_GROUPCHAT_VISIBLE_REPLIES=automatic
+# Sandbox tooling relies on Docker; the OpenClaw stack mounts /var/run/docker.sock read/write when enabled.
+# Optional: if the socket gid differs from the container's Docker group, set DOCKER_SOCKET_GID.
+# When unset, the compose stack auto-detects from the mounted socket.
+DOCKER_SOCKET_GID=
 
 NEXT_PUBLIC_GATEWAY_PROTOCOL=
 NEXT_PUBLIC_GATEWAY_URL=
@@ -120,6 +172,14 @@ MC_DEFAULT_GATEWAY_NAME=primary
 MC_COORDINATOR_AGENT=coordinator
 NEXT_PUBLIC_COORDINATOR_AGENT=coordinator
 
+# ═══════════════════════════════════════════════════════════════════════════════
+# Automation (optional)
+# ═══════════════════════════════════════════════════════════════════════════════
+# Enable automatic daily backups without toggling it in the UI. Accepts 1/true/yes/on.
+# Backup directory will be created automatically when scheduled backups run.
+# Example: MC_AUTO_BACKUP=1
+MC_AUTO_BACKUP=
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # Data Paths (all optional, defaults to .data/ in project root)
 # ═══════════════════════════════════════════════════════════════════════════════