@ch4p/cli 0.2.3 → 0.3.0

package/dist/chunk-2JQRW4PJ.js

@@ -0,0 +1,2411 @@
+import {
+  GatewayServer,
+  LogChannel,
+  MessageRouter,
+  PairingManager,
+  Scheduler,
+  SessionManager
+} from "./chunk-WYXCGS55.js";
+import {
+  BlueBubblesChannel,
+  ChannelRegistry,
+  CliChannel,
+  DiscordChannel,
+  GoogleChatChannel,
+  IMessageChannel,
+  IrcChannel,
+  MacOSChannel,
+  MatrixChannel,
+  SignalChannel,
+  SlackChannel,
+  TeamsChannel,
+  TelegramChannel,
+  WebChatChannel,
+  WhatsAppChannel,
+  ZaloChannel,
+  ZaloPersonalChannel
+} from "./chunk-3CYOOHMM.js";
+import {
+  DeepgramSTT,
+  DefaultSecurityPolicy,
+  ElevenLabsTTS,
+  NativeEngine,
+  ProviderRegistry,
+  VoiceProcessor,
+  WhisperSTT,
+  buildSystemPrompt,
+  createClaudeCliEngine,
+  createCodexCliEngine,
+  createMemoryBackend,
+  createObserver
+} from "./chunk-KLGE5YZR.js";
+import {
+  LoadSkillTool,
+  ToolRegistry
+} from "./chunk-MABLWEGE.js";
+import {
+  SkillRegistry
+} from "./chunk-6BURGD2Y.js";
+import {
+  AgentLoop,
+  ContextManager,
+  FormatVerifier,
+  LLMVerifier,
+  Session,
+  ToolWorkerPool,
+  createAutoRecallHook,
+  createAutoSummarizeHook
+} from "./chunk-UNF4S4CA.js";
+import {
+  backoffDelay,
+  generateId
+} from "./chunk-YSCX2QQQ.js";
+import {
+  getCh4pDir,
+  getLogsDir,
+  loadConfig,
+  saveConfig
+} from "./chunk-AORLXQHZ.js";
+import {
+  BOLD,
+  DIM,
+  GREEN,
+  RED,
+  RESET,
+  TEAL,
+  YELLOW,
+  box,
+  kvRow
+} from "./chunk-NMGPBPNU.js";
+
+// src/commands/gateway.ts
+import { createRequire } from "module";
+
+// ../../packages/plugin-x402/dist/index.js
+import { ethers } from "ethers";
+var PUBLIC_PATHS = /* @__PURE__ */ new Set([
+  "/health",
+  "/.well-known/agent.json",
+  "/pair"
+]);
+var DEFAULT_ASSET = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+var DEFAULT_NETWORK = "base";
+var DEFAULT_TIMEOUT = 300;
+function pathMatches(urlPath, pattern) {
+  if (pattern === "*" || pattern === "/**") return true;
+  if (pattern.endsWith("/*")) {
+    const prefix = pattern.slice(0, -2);
+    return urlPath === prefix || urlPath.startsWith(prefix + "/");
+  }
+  return urlPath === pattern;
+}
+function extractPath(url) {
+  const qIdx = url.indexOf("?");
+  return qIdx >= 0 ? url.slice(0, qIdx) : url;
+}
+function send402(res, requirements) {
+  const body = JSON.stringify({
+    x402Version: 1,
+    error: "X402",
+    accepts: [requirements]
+  });
+  res.writeHead(402, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
+function decodePaymentHeader(header) {
+  try {
+    const json = Buffer.from(header, "base64").toString("utf-8");
+    const parsed = JSON.parse(json);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const p = parsed;
+    if (p["x402Version"] !== 1) return null;
+    if (p["scheme"] !== "exact") return null;
+    if (typeof p["network"] !== "string") return null;
+    const payload = p["payload"];
+    if (typeof payload !== "object" || payload === null) return null;
+    const pl = payload;
+    if (typeof pl["signature"] !== "string") return null;
+    const auth = pl["authorization"];
+    if (typeof auth !== "object" || auth === null) return null;
+    const a = auth;
+    if (typeof a["from"] !== "string" || typeof a["to"] !== "string" || typeof a["value"] !== "string") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function createX402Middleware(config) {
+  if (!config.enabled || !config.server) return null;
+  const serverCfg = config.server;
+  const asset = serverCfg.asset ?? DEFAULT_ASSET;
+  const network = serverCfg.network ?? DEFAULT_NETWORK;
+  const maxTimeoutSeconds = serverCfg.maxTimeoutSeconds ?? DEFAULT_TIMEOUT;
+  const description = serverCfg.description ?? "Payment required to access this gateway resource.";
+  const protectedPaths = serverCfg.protectedPaths ?? ["/*"];
+  return async (req, res) => {
+    const rawUrl = req.url ?? "/";
+    const urlPath = extractPath(rawUrl);
+    if (PUBLIC_PATHS.has(urlPath)) return false;
+    const isProtected = protectedPaths.some((p) => pathMatches(urlPath, p));
+    if (!isProtected) return false;
+    const matchedRoute = serverCfg.routes?.find((r) => pathMatches(urlPath, r.path));
+    const effectiveAmount = matchedRoute?.amount ?? serverCfg.amount;
+    const effectiveDescription = matchedRoute?.description ?? description;
+    const requirements = {
+      scheme: "exact",
+      network,
+      maxAmountRequired: effectiveAmount,
+      resource: urlPath,
+      description: effectiveDescription,
+      mimeType: "application/json",
+      payTo: serverCfg.payTo,
+      maxTimeoutSeconds,
+      asset,
+      extra: {}
+    };
+    const paymentHeader = req.headers["x-payment"];
+    if (!paymentHeader || typeof paymentHeader !== "string") {
+      send402(res, requirements);
+      return true;
+    }
+    const payment = decodePaymentHeader(paymentHeader);
+    if (!payment) {
+      send402(res, requirements);
+      return true;
+    }
+    if (payment.network !== network) {
+      send402(res, requirements);
+      return true;
+    }
+    if (serverCfg.verifyPayment) {
+      const allowed = await serverCfg.verifyPayment(payment, requirements);
+      if (!allowed) {
+        send402(res, requirements);
+        return true;
+      }
+    }
+    req["_x402Authenticated"] = true;
+    return false;
+  };
+}
+var PLACEHOLDER_SIG = "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
+var X402PayTool = class {
+  name = "x402_pay";
+  description = "Generate an X-PAYMENT header for a resource that returned HTTP 402 Payment Required. Provide the 402 response body JSON and a payer wallet address. Returns the base64-encoded X-PAYMENT value to include when retrying the request. Full payment execution requires an IIdentityProvider with wallet signing support.";
+  weight = "lightweight";
+  parameters = {
+    type: "object",
+    properties: {
+      url: {
+        type: "string",
+        description: "The URL of the resource that returned 402 (used to match the requirement).",
+        minLength: 1
+      },
+      x402_response: {
+        type: "string",
+        description: "The JSON body of the 402 response. Stringify the x402 error response object.",
+        minLength: 2
+      },
+      wallet_address: {
+        type: "string",
+        description: "Payer wallet address (0x + 40 hex chars). If omitted, the identity provider wallet address is used when available.",
+        pattern: "^0x[0-9a-fA-F]{40}$"
+      }
+    },
+    required: ["url", "x402_response"],
+    additionalProperties: false
+  };
+  validate(args) {
+    if (typeof args !== "object" || args === null) {
+      return { valid: false, errors: ["Arguments must be an object."] };
+    }
+    const { url, x402_response, wallet_address } = args;
+    const errors = [];
+    if (typeof url !== "string" || url.trim().length === 0) {
+      errors.push("url must be a non-empty string.");
+    }
+    if (typeof x402_response !== "string" || x402_response.trim().length === 0) {
+      errors.push("x402_response must be a non-empty string.");
+    }
+    if (wallet_address !== void 0) {
+      if (typeof wallet_address !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(wallet_address)) {
+        errors.push("wallet_address must be a valid Ethereum address (0x + 40 hex chars).");
+      }
+    }
+    return errors.length > 0 ? { valid: false, errors } : { valid: true };
+  }
+  async execute(args, context) {
+    const validation = this.validate(args);
+    if (!validation.valid) {
+      return {
+        success: false,
+        output: "",
+        error: `Invalid arguments: ${validation.errors.join(" ")}`
+      };
+    }
+    const { url, x402_response, wallet_address } = args;
+    const x402Context = context;
+    let response;
+    try {
+      response = JSON.parse(x402_response);
+    } catch {
+      return { success: false, output: "", error: "x402_response is not valid JSON." };
+    }
+    if (!Array.isArray(response.accepts) || response.accepts.length === 0) {
+      return {
+        success: false,
+        output: "",
+        error: 'x402 response contains no payment requirements in "accepts".'
+      };
+    }
+    const requirements = response.accepts.find((r) => r.scheme === "exact" && r.network === "base") ?? response.accepts.find((r) => r.scheme === "exact") ?? response.accepts[0];
+    const payer = wallet_address ?? x402Context.agentWalletAddress;
+    if (!payer) {
+      return {
+        success: false,
+        output: "",
+        error: "No wallet address available. Provide wallet_address or configure agentWalletAddress via toolContextExtensions in the agent runtime."
+      };
+    }
+    const nowSecs = Math.floor(Date.now() / 1e3);
+    const randomBytes = new Uint8Array(32);
+    if (typeof globalThis.crypto !== "undefined") {
+      globalThis.crypto.getRandomValues(randomBytes);
+    } else {
+      console.warn("x402: crypto.getRandomValues unavailable; using insecure Math.random fallback for nonce.");
+      for (let i = 0; i < 32; i++) {
+        randomBytes[i] = Math.floor(Math.random() * 256);
+      }
+    }
+    const nonce = "0x" + Array.from(randomBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+    const authorization = {
+      from: payer,
+      to: requirements.payTo,
+      value: requirements.maxAmountRequired,
+      validAfter: "0",
+      validBefore: String(nowSecs + requirements.maxTimeoutSeconds),
+      nonce
+    };
+    let signature;
+    let unsigned = false;
+    if (x402Context.x402Signer) {
+      try {
+        signature = await x402Context.x402Signer(authorization);
+      } catch (err) {
+        return {
+          success: false,
+          output: "",
+          error: `Signing failed: ${err.message}`
+        };
+      }
+    } else {
+      signature = PLACEHOLDER_SIG;
+      unsigned = true;
+    }
+    const paymentPayload = {
+      x402Version: 1,
+      scheme: "exact",
+      network: requirements.network,
+      payload: { signature, authorization }
+    };
+    const headerValue = Buffer.from(JSON.stringify(paymentPayload)).toString("base64");
+    const lines = [
+      `Resource:  ${url}`,
+      `Network:   ${requirements.network}`,
+      `Amount:    ${requirements.maxAmountRequired} (asset ${requirements.asset})`,
+      `Pay to:    ${requirements.payTo}`,
+      `From:      ${payer}`,
+      "",
+      "X-PAYMENT header value (add to your retry request):",
+      headerValue
+    ];
+    if (unsigned) {
+      lines.push(
+        "",
+        "WARNING: Placeholder signature \u2014 cannot be used for real on-chain payments.",
+        "Configure an IIdentityProvider with a bound wallet to enable live signing."
+      );
+    }
+    return {
+      success: true,
+      output: lines.join("\n"),
+      metadata: {
+        headerValue,
+        network: requirements.network,
+        amount: requirements.maxAmountRequired,
+        payTo: requirements.payTo,
+        asset: requirements.asset,
+        unsigned
+      }
+    };
+  }
+};
+var KNOWN_TOKENS = {
+  base: {
+    address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    chainId: 8453,
+    name: "USD Coin",
+    version: "2"
+  },
+  "base-sepolia": {
+    address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+    chainId: 84532,
+    name: "USD Coin",
+    version: "2"
+  }
+};
+var TRANSFER_WITH_AUTHORIZATION_TYPES = {
+  TransferWithAuthorization: [
+    { name: "from", type: "address" },
+    { name: "to", type: "address" },
+    { name: "value", type: "uint256" },
+    { name: "validAfter", type: "uint256" },
+    { name: "validBefore", type: "uint256" },
+    { name: "nonce", type: "bytes32" }
+  ]
+};
+function assertValidPrivateKey(key) {
+  if (!/^0x[a-fA-F0-9]{64}$/.test(key)) {
+    throw new Error(
+      "Invalid private key: expected a 0x-prefixed 64-character hex string (32 bytes)."
+    );
+  }
+}
+function createEIP712Signer(privateKey, opts = {}) {
+  assertValidPrivateKey(privateKey);
+  const wallet = new ethers.Wallet(privateKey);
+  const domain = {
+    name: opts.tokenName ?? KNOWN_TOKENS.base.name,
+    version: opts.tokenVersion ?? KNOWN_TOKENS.base.version,
+    chainId: opts.chainId ?? KNOWN_TOKENS.base.chainId,
+    verifyingContract: opts.tokenAddress ?? KNOWN_TOKENS.base.address
+  };
+  return async (auth) => {
+    const message = {
+      from: auth.from,
+      to: auth.to,
+      value: BigInt(auth.value),
+      validAfter: BigInt(auth.validAfter),
+      validBefore: BigInt(auth.validBefore),
+      nonce: auth.nonce
+    };
+    return wallet.signTypedData(domain, TRANSFER_WITH_AUTHORIZATION_TYPES, message);
+  };
+}
+function walletAddress(privateKey) {
+  assertValidPrivateKey(privateKey);
+  return new ethers.Wallet(privateKey).address;
+}
+
+// src/session-notes.ts
+import { createHash } from "crypto";
+import {
+  mkdirSync,
+  writeFileSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  existsSync
+} from "fs";
+import { join } from "path";
+var SessionNotes = class {
+  dir;
+  constructor(dataDir) {
+    this.dir = join(dataDir, "sessions");
+    mkdirSync(this.dir, { recursive: true });
+  }
+  keyToFile(contextKey) {
+    const hash = createHash("sha256").update(contextKey).digest("hex").slice(0, 16);
+    return join(this.dir, `${hash}.json`);
+  }
+  /**
+   * Upsert a note at the START of each agent run.
+   * Replaces any prior note for the same contextKey. `recentActivity` resets
+   * to empty so it only reflects the current run's progress.
+   */
+  upsert(note) {
+    const path = this.keyToFile(note.contextKey);
+    writeFileSync(path, JSON.stringify(note, null, 2), "utf8");
+  }
+  /**
+   * Append a brief snippet of agent progress AFTER each LLM turn.
+   * Capped at the last 3 entries; each snippet truncated to 200 chars.
+   * Silent no-op if the note file doesn't exist yet.
+   */
+  appendActivity(contextKey, snippet) {
+    const path = this.keyToFile(contextKey);
+    if (!existsSync(path)) return;
+    try {
+      const note = JSON.parse(readFileSync(path, "utf8"));
+      note.recentActivity = [...note.recentActivity, snippet.slice(0, 200)].slice(-3);
+      writeFileSync(path, JSON.stringify(note, null, 2), "utf8");
+    } catch {
+    }
+  }
+  /**
+   * Delete the note on successful completion or idle eviction.
+   * Silent no-op if the file doesn't exist.
+   */
+  delete(contextKey) {
+    try {
+      rmSync(this.keyToFile(contextKey));
+    } catch {
+    }
+  }
+  /**
+   * Return all notes younger than `maxAgeMs` (default 10 minutes).
+   * Used once on startup to discover sessions that need to be resumed.
+   * Skips unreadable / malformed files silently.
+   */
+  loadRecent(maxAgeMs = 10 * 6e4) {
+    const cutoff = Date.now() - maxAgeMs;
+    try {
+      const files = readdirSync(this.dir).filter((f) => f.endsWith(".json"));
+      const results = [];
+      for (const file of files) {
+        try {
+          const raw = readFileSync(join(this.dir, file), "utf8");
+          const note = JSON.parse(raw);
+          if (typeof note.requestAt === "number" && note.requestAt >= cutoff) {
+            results.push(note);
+          }
+        } catch {
+        }
+      }
+      return results;
+    } catch {
+      return [];
+    }
+  }
+};
+
+// ../../packages/tunnels/dist/index.js
+import { spawn } from "child_process";
+import { spawn as spawn2, execSync } from "child_process";
+import { spawn as spawn3 } from "child_process";
+var CloudflareTunnel = class {
+  id = "cloudflare";
+  process = null;
+  publicUrl = null;
+  active = false;
+  startedAt = null;
+  // -----------------------------------------------------------------------
+  // ITunnelProvider implementation
+  // -----------------------------------------------------------------------
+  async start(config) {
+    if (this.active) {
+      throw new Error("Cloudflare tunnel is already running");
+    }
+    const cfg = config;
+    const binaryPath = cfg.binaryPath ?? "cloudflared";
+    const protocol = cfg.protocol ?? "http";
+    const localUrl = `${protocol}://localhost:${config.port}`;
+    const args = ["tunnel"];
+    if (cfg.tunnelName) {
+      args.push("run", "--url", localUrl, cfg.tunnelName);
+    } else {
+      args.push("--url", localUrl);
+    }
+    return new Promise((resolve, reject) => {
+      const child = spawn(binaryPath, args, {
+        env: { ...process.env },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      this.process = child;
+      let resolved = false;
+      let stderr = "";
+      child.stderr?.on("data", (data) => {
+        const text = data.toString();
+        stderr += text;
+        const urlMatch = text.match(/(https:\/\/[a-z0-9-]+\.trycloudflare\.com)/);
+        if (urlMatch && !resolved) {
+          resolved = true;
+          this.publicUrl = urlMatch[1];
+          this.active = true;
+          this.startedAt = /* @__PURE__ */ new Date();
+          resolve({
+            publicUrl: this.publicUrl,
+            provider: this.id,
+            startedAt: this.startedAt
+          });
+        }
+        const namedMatch = text.match(/https:\/\/([a-z0-9-]+\.cfargotunnel\.com)/);
+        if (namedMatch && !resolved && cfg.tunnelName) {
+          resolved = true;
+          this.publicUrl = `https://${namedMatch[1]}`;
+          this.active = true;
+          this.startedAt = /* @__PURE__ */ new Date();
+          resolve({
+            publicUrl: this.publicUrl,
+            provider: this.id,
+            startedAt: this.startedAt
+          });
+        }
+        if (!resolved) {
+          const fallback = text.match(/(https:\/\/[a-z0-9-]+\.[a-z0-9.-]*cloudflare[a-z]*\.[a-z]+)/);
+          if (fallback) {
+            resolved = true;
+            this.publicUrl = fallback[1];
+            this.active = true;
+            this.startedAt = /* @__PURE__ */ new Date();
+            resolve({
+              publicUrl: this.publicUrl,
+              provider: this.id,
+              startedAt: this.startedAt
+            });
+          }
+        }
+      });
+      child.on("error", (err) => {
+        if (!resolved) {
+          resolved = true;
+          reject(new Error(`Failed to start cloudflared: ${err.message}`));
+        }
+      });
+      child.on("close", (code) => {
+        this.active = false;
+        if (!resolved) {
+          resolved = true;
+          reject(new Error(
+            `cloudflared exited with code ${code}${stderr ? ": " + stderr.slice(0, 500) : ""}`
+          ));
+        }
+      });
+      setTimeout(() => {
+        if (!resolved) {
+          resolved = true;
+          try {
+            child.kill("SIGTERM");
+          } catch {
+          }
+          reject(new Error("Cloudflare tunnel startup timed out"));
+        }
+      }, 3e4);
+    });
+  }
+  async stop() {
+    if (this.process && !this.process.killed) {
+      this.process.kill("SIGTERM");
+    }
+    this.process = null;
+    this.publicUrl = null;
+    this.active = false;
+  }
+  isActive() {
+    return this.active;
+  }
+  getPublicUrl() {
+    return this.publicUrl;
+  }
+};
+var TailscaleTunnel = class {
+  id = "tailscale";
+  process = null;
+  publicUrl = null;
+  active = false;
+  startedAt = null;
+  // -----------------------------------------------------------------------
+  // ITunnelProvider implementation
+  // -----------------------------------------------------------------------
+  async start(config) {
+    if (this.active) {
+      throw new Error("Tailscale tunnel is already running");
+    }
+    const cfg = config;
+    const binaryPath = cfg.binaryPath ?? "tailscale";
+    const hostname = this.getTailscaleHostname(binaryPath);
+    if (!hostname) {
+      throw new Error("Could not determine Tailscale hostname. Is Tailscale running?");
+    }
+    this.publicUrl = `https://${hostname}:${config.port}`;
+    const args = ["funnel", String(config.port)];
+    if (cfg.background) {
+      args.push("--bg");
+    }
+    return new Promise((resolve, reject) => {
+      const child = spawn2(binaryPath, args, {
+        env: { ...process.env },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      this.process = child;
+      let resolved = false;
+      let output = "";
+      const handler = (data) => {
+        const text = data.toString();
+        output += text;
+        if ((text.includes("Funnel started") || text.includes("https://") || text.includes("Available on the internet")) && !resolved) {
+          resolved = true;
+          this.active = true;
+          this.startedAt = /* @__PURE__ */ new Date();
+          const urlMatch = text.match(/(https:\/\/[^\s]+)/);
+          if (urlMatch) {
+            this.publicUrl = urlMatch[1];
+          }
+          resolve({
+            publicUrl: this.publicUrl,
+            provider: this.id,
+            startedAt: this.startedAt
+          });
+        }
+      };
+      child.stdout?.on("data", handler);
+      child.stderr?.on("data", handler);
+      child.on("error", (err) => {
+        if (!resolved) {
+          resolved = true;
+          reject(new Error(`Failed to start tailscale funnel: ${err.message}`));
+        }
+      });
+      child.on("close", (code) => {
+        this.active = false;
+        if (cfg.background && code === 0 && !resolved) {
+          resolved = true;
+          this.active = true;
+          this.startedAt = /* @__PURE__ */ new Date();
+          resolve({
+            publicUrl: this.publicUrl,
+            provider: this.id,
+            startedAt: this.startedAt
+          });
+          return;
+        }
+        if (!resolved) {
+          resolved = true;
+          reject(new Error(
+            `tailscale funnel exited with code ${code}${output ? ": " + output.slice(0, 500) : ""}`
+          ));
+        }
+      });
+      setTimeout(() => {
+        if (!resolved) {
+          resolved = true;
+          this.active = true;
+          this.startedAt = /* @__PURE__ */ new Date();
+          resolve({
+            publicUrl: this.publicUrl,
+            provider: this.id,
+            startedAt: this.startedAt
+          });
+        }
+      }, 15e3);
+    });
+  }
+  async stop() {
+    if (this.process && !this.process.killed) {
+      this.process.kill("SIGTERM");
+    }
+    try {
+      execSync("tailscale funnel off", { stdio: "ignore", timeout: 5e3 });
+    } catch {
+    }
+    this.process = null;
+    this.publicUrl = null;
+    this.active = false;
+  }
+  isActive() {
+    return this.active;
+  }
+  getPublicUrl() {
+    return this.publicUrl;
+  }
+  // -----------------------------------------------------------------------
+  // Private helpers
+  // -----------------------------------------------------------------------
+  getTailscaleHostname(binary) {
+    try {
+      const output = execSync(`${binary} status --json`, {
+        timeout: 5e3,
+        encoding: "utf8"
+      });
+      const status = JSON.parse(output);
+      const dnsName = status.Self?.DNSName;
+      return dnsName ? dnsName.replace(/\.$/, "") : null;
+    } catch {
+      return null;
+    }
+  }
+};
+var NgrokTunnel = class {
+  id = "ngrok";
+  process = null;
+  publicUrl = null;
+  active = false;
+  startedAt = null;
+  // -----------------------------------------------------------------------
+  // ITunnelProvider implementation
+  // -----------------------------------------------------------------------
+  async start(config) {
+    if (this.active) {
+      throw new Error("ngrok tunnel is already running");
+    }
+    const cfg = config;
+    const binaryPath = cfg.binaryPath ?? "ngrok";
+    const apiUrl = cfg.apiUrl ?? "http://127.0.0.1:4040";
+    const args = ["http", String(config.port)];
+    if (cfg.authToken) {
+      args.push("--authtoken", cfg.authToken);
+    }
+    if (cfg.subdomain) {
+      args.push("--subdomain", cfg.subdomain);
+    }
+    if (cfg.region) {
+      args.push("--region", cfg.region);
+    }
+    const child = spawn3(binaryPath, args, {
+      env: { ...process.env },
+      stdio: ["ignore", "ignore", "pipe"]
+    });
+    this.process = child;
+    child.on("error", () => {
+      this.active = false;
+    });
+    child.on("close", () => {
+      this.active = false;
+    });
+    const url = await this.waitForTunnel(apiUrl, 15e3);
+    if (!url) {
+      this.stop();
+      throw new Error("Could not retrieve ngrok public URL from local API");
+    }
+    this.publicUrl = url;
+    this.active = true;
+    this.startedAt = /* @__PURE__ */ new Date();
+    return {
+      publicUrl: this.publicUrl,
+      provider: this.id,
+      startedAt: this.startedAt
+    };
+  }
+  async stop() {
+    if (this.process && !this.process.killed) {
+      this.process.kill("SIGTERM");
+    }
+    this.process = null;
+    this.publicUrl = null;
+    this.active = false;
+  }
+  isActive() {
+    return this.active;
+  }
+  getPublicUrl() {
+    return this.publicUrl;
+  }
+  // -----------------------------------------------------------------------
+  // Private: poll ngrok local API
+  // -----------------------------------------------------------------------
+  /**
+   * Poll the ngrok local API to get the public tunnel URL.
+   * ngrok exposes tunnel info at http://127.0.0.1:4040/api/tunnels.
+   */
+  async waitForTunnel(apiUrl, timeoutMs) {
+    const start = Date.now();
+    const pollInterval = 500;
+    while (Date.now() - start < timeoutMs) {
+      try {
+        const response = await fetch(`${apiUrl}/api/tunnels`);
+        if (response.ok) {
+          const data = await response.json();
+          const httpsTunnel = data.tunnels.find((t) => t.proto === "https");
+          const anyTunnel = data.tunnels[0];
+          const tunnel = httpsTunnel ?? anyTunnel;
+          if (tunnel?.public_url) {
+            return tunnel.public_url;
+          }
+        }
+      } catch {
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    return null;
+  }
+};
+function createTunnelProvider(name) {
+  switch (name) {
+    case "cloudflare":
+      return new CloudflareTunnel();
+    case "tailscale":
+      return new TailscaleTunnel();
+    case "ngrok":
+      return new NgrokTunnel();
+    default:
+      throw new Error(`Unknown tunnel provider: "${name}". Supported: cloudflare, tailscale, ngrok`);
+  }
+}
+
+// ../../packages/supervisor/dist/index.js
+import { EventEmitter } from "events";
+import { EventEmitter as EventEmitter2 } from "events";
+var DEFAULT_RESTART_POLICY = {
+  strategy: "one-for-one",
+  maxRestarts: 5,
+  windowMs: 6e4,
+  backoffBaseMs: 1e3,
+  backoffMaxMs: 3e4
+};
+var MAX_CRASH_HISTORY = 256;
+var DEFAULT_HEALTH_CONFIG = {
+  heartbeatIntervalMs: 5e3,
+  missedThreshold: 3
+};
+var HealthMonitor = class extends EventEmitter {
+  config;
+  children = /* @__PURE__ */ new Map();
+  checkTimer = null;
+  constructor(config) {
+    super();
+    this.config = { ...DEFAULT_HEALTH_CONFIG, ...config };
+  }
+  // ── Lifecycle ────────────────────────────────────────────────────────
+  /** Begin the periodic heartbeat check loop. */
+  start() {
+    if (this.checkTimer !== null) return;
+    this.checkTimer = setInterval(() => {
+      this.checkHeartbeats();
+    }, this.config.heartbeatIntervalMs);
+    this.checkTimer.unref();
+  }
+  /** Stop the periodic check loop and clear all tracked state. */
+  stop() {
+    if (this.checkTimer !== null) {
+      clearInterval(this.checkTimer);
+      this.checkTimer = null;
+    }
+  }
+  /** Remove all tracked children and stop the timer. */
+  dispose() {
+    this.stop();
+    this.children.clear();
+    this.removeAllListeners();
+  }
+  // ── Child registration ───────────────────────────────────────────────
+  /** Register a new child for health tracking. Idempotent. */
+  registerChild(childId) {
+    if (this.children.has(childId)) return;
+    this.children.set(childId, {
+      lastHeartbeat: Date.now(),
+      missedCount: 0,
+      healthy: true,
+      crashHistory: []
+    });
+  }
+  /** Unregister a child and drop its state. */
+  unregisterChild(childId) {
+    this.children.delete(childId);
+  }
+  // ── Heartbeat API ────────────────────────────────────────────────────
+  /** Record a heartbeat for a child, resetting its missed count. */
+  recordHeartbeat(childId) {
+    const state = this.children.get(childId);
+    if (!state) return;
+    const wasPreviouslyUnhealthy = !state.healthy;
+    state.lastHeartbeat = Date.now();
+    state.missedCount = 0;
+    state.healthy = true;
+    if (wasPreviouslyUnhealthy) {
+      this.emit("healthy", childId);
+    }
+  }
+  /** Whether a specific child is currently considered healthy. */
+  isHealthy(childId) {
+    const state = this.children.get(childId);
+    if (!state) return false;
+    return state.healthy;
+  }
+  // ── Crash recording ──────────────────────────────────────────────────
+  /** Record a crash for a child. Appends to history and emits 'crashed'. */
+  recordCrash(childId, error, exitCode, signal) {
+    let state = this.children.get(childId);
+    if (!state) {
+      state = {
+        lastHeartbeat: 0,
+        missedCount: 0,
+        healthy: false,
+        crashHistory: []
+      };
+      this.children.set(childId, state);
+    }
+    state.healthy = false;
+    const record = {
+      childId,
+      timestamp: Date.now(),
+      error,
+      exitCode,
+      signal
+    };
+    state.crashHistory.push(record);
+    if (state.crashHistory.length > MAX_CRASH_HISTORY) {
+      state.crashHistory.shift();
+    }
+    this.emit("crashed", childId, error);
+  }
+  /** Notify the monitor that a child has been restarted. */
+  recordRestart(childId) {
+    const state = this.children.get(childId);
+    if (state) {
+      state.lastHeartbeat = Date.now();
+      state.missedCount = 0;
+      state.healthy = true;
+    }
+    this.emit("restarted", childId);
+  }
+  // ── Queries ──────────────────────────────────────────────────────────
+  /** Get the full crash history for a child. */
+  getCrashHistory(childId) {
+    return this.children.get(childId)?.crashHistory ?? [];
+  }
+  /** Returns true only when ALL registered children are healthy. */
+  getOverallHealth() {
+    if (this.children.size === 0) return true;
+    for (const state of this.children.values()) {
+      if (!state.healthy) return false;
+    }
+    return true;
+  }
+  /** Get the health state snapshot for a specific child. */
+  getChildHealth(childId) {
+    const state = this.children.get(childId);
+    if (!state) return void 0;
+    return { ...state, crashHistory: [...state.crashHistory] };
+  }
+  // ── Internal ─────────────────────────────────────────────────────────
+  /** Runs on a timer to detect missed heartbeats. */
+  checkHeartbeats() {
+    const now = Date.now();
+    for (const [childId, state] of this.children) {
+      if (!state.healthy && state.missedCount >= this.config.missedThreshold) {
+        continue;
+      }
+      const elapsed = now - state.lastHeartbeat;
+      if (elapsed > this.config.heartbeatIntervalMs) {
+        state.missedCount += 1;
+        if (state.missedCount >= this.config.missedThreshold && state.healthy) {
+          state.healthy = false;
+          this.emit("unhealthy", childId, state.missedCount);
+        }
+      }
+    }
+  }
+};
+var Supervisor = class extends EventEmitter2 {
+  children = [];
+  childIndex = /* @__PURE__ */ new Map();
+  policy;
+  health;
+  running = false;
+  stopping = false;
+  /** Tracks in-flight restart promises so we can await them during stop(). */
+  pendingRestarts = /* @__PURE__ */ new Map();
+  /** AbortController used to cancel pending backoff sleeps on shutdown. */
+  shutdownController = null;
+  constructor(policy, health) {
+    super();
+    this.policy = { ...DEFAULT_RESTART_POLICY, ...policy };
+    this.health = health ?? new HealthMonitor();
+  }
+  // ── Queries ──────────────────────────────────────────────────────────
+  get isRunning() {
+    return this.running;
+  }
+  getChildState(id) {
+    const state = this.childIndex.get(id);
+    if (!state) return void 0;
+    return { ...state, restartTimestamps: [...state.restartTimestamps] };
+  }
+  getChildren() {
+    return this.children.map((s) => ({
+      ...s,
+      restartTimestamps: [...s.restartTimestamps]
+    }));
+  }
+  getHealthMonitor() {
+    return this.health;
+  }
+  // ── Child management ─────────────────────────────────────────────────
+  /**
+   * Register a child specification. If the supervisor is already running the
+   * child will be started immediately.
+   */
+  async addChild(spec) {
+    if (this.childIndex.has(spec.id)) {
+      throw new Error(`Child "${spec.id}" is already registered`);
+    }
+    const state = {
+      spec,
+      handle: null,
+      status: "stopped",
+      restartCount: 0,
+      restartTimestamps: []
+    };
+    this.children.push(state);
+    this.childIndex.set(spec.id, state);
+    this.health.registerChild(spec.id);
+    if (this.running && !this.stopping) {
+      await this.startChild(state);
+    }
+  }
+  /**
+   * Remove a child. Shuts the child down first if it is running.
+   */
+  async removeChild(id) {
+    const state = this.childIndex.get(id);
+    if (!state) return;
+    this.pendingRestarts.delete(id);
+    if (state.handle && state.status === "running") {
+      await this.stopChild(state);
+    }
+    const idx = this.children.indexOf(state);
+    if (idx !== -1) this.children.splice(idx, 1);
+    this.childIndex.delete(id);
+    this.health.unregisterChild(id);
+  }
+  // ── Lifecycle ────────────────────────────────────────────────────────
+  /**
+   * Start the supervisor and all registered children in order.
+   */
+  async start() {
+    if (this.running) return;
+    this.running = true;
+    this.stopping = false;
+    this.shutdownController = new AbortController();
+    this.health.start();
+    for (const child of this.children) {
+      if (this.stopping) break;
+      await this.startChild(child);
+    }
+    this.emit("supervisor:started");
+  }
+  /**
+   * Gracefully stop the supervisor and all children (reverse order).
+   */
+  async stop() {
+    if (!this.running) return;
+    this.stopping = true;
+    this.shutdownController?.abort();
+    if (this.pendingRestarts.size > 0) {
+      await Promise.allSettled([...this.pendingRestarts.values()]);
+    }
+    for (let i = this.children.length - 1; i >= 0; i--) {
+      const child = this.children[i];
+      if (child.status === "running" || child.status === "restarting") {
+        await this.stopChild(child);
+      }
+    }
+    this.health.stop();
+    this.running = false;
+    this.stopping = false;
+    this.pendingRestarts.clear();
+    this.shutdownController = null;
+    this.emit("supervisor:stopped");
+  }
+  // ── Manual restart ───────────────────────────────────────────────────
+  /**
+   * Manually restart a specific child (e.g. triggered via admin API).
+   */
+  async restartChild(id) {
+    const state = this.childIndex.get(id);
+    if (!state) throw new Error(`Unknown child "${id}"`);
+    if (this.stopping) return;
+    if (state.handle && state.status === "running") {
+      await this.stopChild(state);
+    }
+    await this.startChild(state);
+  }
+  // ── Crash handling (called by subclasses) ────────────────────────────
+  /**
+   * Should be called by subclasses or child monitors when a child crashes.
+   * Applies the configured restart strategy.
+   */
+  handleChildCrash(childId, error) {
+    if (this.stopping) return;
+    const state = this.childIndex.get(childId);
+    if (!state) return;
+    state.status = "crashed";
+    state.lastError = error;
+    state.handle = null;
+    this.health.recordCrash(childId, error);
+    this.emit("child:crashed", childId, error);
+    const effectivePolicy = {
+      ...this.policy,
+      ...state.spec.restartPolicy
+    };
+    const restartPromise = this.applyStrategy(effectivePolicy, state).catch((strategyError) => {
+      if (strategyError instanceof Error && strategyError.message.startsWith("Max restarts")) {
+        return;
+      }
+      this.emit("error", strategyError);
+    }).finally(() => {
+      this.pendingRestarts.delete(childId);
+    });
+    this.pendingRestarts.set(childId, restartPromise);
+  }
+  // ── Strategy application ─────────────────────────────────────────────
+  async applyStrategy(policy, crashedState) {
+    if (this.stopping) return;
+    switch (policy.strategy) {
+      case "one-for-one":
+        await this.restartWithBackoff(crashedState, policy);
+        break;
+      case "rest-for-one": {
+        const idx = this.children.indexOf(crashedState);
+        if (idx === -1) return;
+        const toRestart = [];
+        for (let i = this.children.length - 1; i > idx; i--) {
+          const sibling = this.children[i];
+          if (sibling.status === "running") {
+            await this.stopChild(sibling);
+          }
+          toRestart.unshift(sibling);
+        }
+        await this.restartWithBackoff(crashedState, policy);
+        for (const sibling of toRestart) {
+          if (this.stopping) break;
+          await this.startChild(sibling);
+        }
+        break;
+      }
+      case "one-for-all": {
+        for (let i = this.children.length - 1; i >= 0; i--) {
+          const child = this.children[i];
+          if (child !== crashedState && child.status === "running") {
+            await this.stopChild(child);
+          }
+        }
+        for (const child of this.children) {
+          if (this.stopping) break;
+          if (child === crashedState) {
+            await this.restartWithBackoff(child, policy);
+          } else {
+            await this.startChild(child);
+          }
+        }
+        break;
+      }
+    }
+  }
+  // ── Backoff + restart ────────────────────────────────────────────────
+  async restartWithBackoff(state, policy) {
+    if (this.stopping) return;
+    const now = Date.now();
+    state.restartTimestamps = state.restartTimestamps.filter(
+      (ts) => now - ts < policy.windowMs
+    );
+    if (state.restartTimestamps.length >= policy.maxRestarts) {
+      state.status = "crashed";
+      this.emit(
+        "supervisor:max_restarts_exceeded",
+        state.spec.id,
+        state.restartTimestamps.length,
+        policy.windowMs
+      );
+      throw new Error(
+        `Max restarts (${policy.maxRestarts}) exceeded for "${state.spec.id}" within ${policy.windowMs}ms window`
+      );
+    }
+    state.status = "restarting";
+    state.restartCount += 1;
+    state.restartTimestamps.push(now);
+    const delay = backoffDelay(
+      state.restartTimestamps.length - 1,
+      policy.backoffBaseMs,
+      policy.backoffMaxMs
+    );
+    try {
+      await this.interruptibleSleep(delay);
+    } catch {
+      return;
+    }
+    if (this.stopping) return;
+    await this.startChild(state);
+    this.health.recordRestart(state.spec.id);
+    if (state.handle) {
+      this.emit(
+        "child:restarted",
+        state.spec.id,
+        state.handle,
+        state.restartCount
+      );
+    }
+  }
+  // ── Child start / stop primitives ────────────────────────────────────
+  async startChild(state) {
+    if (this.stopping) return;
+    try {
+      const handle = await state.spec.start();
+      state.handle = handle;
+      state.status = "running";
+      this.emit("child:started", state.spec.id, handle);
+    } catch (err) {
+      const error = err instanceof Error ? err : new Error(String(err));
+      state.status = "crashed";
+      state.lastError = error;
+      this.handleChildCrash(state.spec.id, error);
+    }
+  }
+  async stopChild(state) {
+    const { handle, spec } = state;
+    if (!handle) {
+      state.status = "stopped";
+      return;
+    }
+    try {
+      if (spec.shutdown) {
+        await spec.shutdown(handle);
+      } else {
+        handle.kill();
+      }
+    } catch {
+      try {
+        handle.kill();
+      } catch {
+      }
+    }
+    state.handle = null;
+    state.status = "stopped";
+    this.emit("child:stopped", spec.id);
+  }
+  // ── Utilities ────────────────────────────────────────────────────────
+  /**
+   * Sleep that can be interrupted by the shutdown controller.
+   * Throws if aborted so the caller can bail out.
+   */
+  interruptibleSleep(ms) {
+    const controller = this.shutdownController;
+    if (!controller || controller.signal.aborted) {
+      return Promise.reject(new Error("Supervisor is shutting down"));
+    }
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        cleanup();
+        resolve();
+      }, ms);
+      const onAbort = () => {
+        clearTimeout(timer);
+        cleanup();
+        reject(new Error("Supervisor is shutting down"));
+      };
+      const cleanup = () => {
+        controller.signal.removeEventListener("abort", onAbort);
+      };
+      controller.signal.addEventListener("abort", onAbort);
+    });
+  }
+};
+
+// src/agent-router.ts
+var AgentRouter = class {
+  constructor(config) {
+    this.config = config;
+    const rules = config.routing?.rules ?? [];
+    this.compiledRules = rules.map((rule) => {
+      const channelPattern = rule.channel && rule.channel !== "*" ? new RegExp(`^${rule.channel.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "i") : null;
+      const matchPattern = rule.match ? new RegExp(rule.match, "i") : null;
+      return { channelPattern, matchPattern, agent: rule.agent };
+    });
+  }
+  compiledRules;
+  /**
+   * Evaluate routing rules against an inbound message.
+   *
+   * @param msg   The inbound message from any channel.
+   * @param defaultSystemPrompt  The system prompt built for the default agent.
+   * @returns     A RoutingDecision describing which agent to use.
+   */
+  route(msg, defaultSystemPrompt) {
+    const channelId = msg.channelId ?? "";
+    const text = msg.text ?? "";
+    const agents = this.config.routing?.agents ?? {};
+    for (const rule of this.compiledRules) {
+      if (rule.channelPattern && !rule.channelPattern.test(channelId)) {
+        continue;
+      }
+      if (rule.matchPattern && !rule.matchPattern.test(text)) {
+        continue;
+      }
+      const agentCfg = agents[rule.agent];
+      if (!agentCfg) {
+        continue;
+      }
+      return this.buildDecision(rule.agent, agentCfg, defaultSystemPrompt);
+    }
+    return this.defaultDecision(defaultSystemPrompt);
+  }
+  /**
+   * Return a decision for a named agent. Used by tests and direct lookups.
+   */
+  routeToAgent(agentName, defaultSystemPrompt) {
+    const agents = this.config.routing?.agents ?? {};
+    const agentCfg = agents[agentName];
+    if (!agentCfg) return this.defaultDecision(defaultSystemPrompt);
+    return this.buildDecision(agentName, agentCfg, defaultSystemPrompt);
+  }
+  /** True when routing configuration is present and has at least one rule. */
+  hasRules() {
+    return (this.config.routing?.rules?.length ?? 0) > 0;
+  }
+  /** List all defined agent names (excluding "default"). */
+  agentNames() {
+    return Object.keys(this.config.routing?.agents ?? {});
+  }
+  // -------------------------------------------------------------------------
+  // Private helpers
+  // -------------------------------------------------------------------------
+  buildDecision(agentName, agentCfg, defaultSystemPrompt) {
+    return {
+      agentName,
+      systemPrompt: agentCfg.systemPrompt ?? defaultSystemPrompt,
+      model: agentCfg.model,
+      maxIterations: agentCfg.maxIterations ?? 20,
+      toolExclude: agentCfg.toolExclude ?? []
+    };
+  }
+  defaultDecision(defaultSystemPrompt) {
+    return {
+      agentName: "default",
+      systemPrompt: defaultSystemPrompt,
+      model: void 0,
+      maxIterations: 20,
+      toolExclude: []
+    };
+  }
+};
+
+// src/commands/gateway.ts
+function createChannelInstance(channelName) {
+  switch (channelName) {
+    case "telegram":
+      return new TelegramChannel();
+    case "discord":
+      return new DiscordChannel();
+    case "slack":
+      return new SlackChannel();
+    case "cli":
+      return new CliChannel();
+    case "matrix":
+      return new MatrixChannel();
+    case "whatsapp":
+      return new WhatsAppChannel();
+    case "signal":
+      return new SignalChannel();
+    case "imessage":
+      return new IMessageChannel();
+    case "teams":
+      return new TeamsChannel();
+    case "zalo":
+      return new ZaloChannel();
+    case "zalo-personal":
+      return new ZaloPersonalChannel();
+    case "bluebubbles":
+      return new BlueBubblesChannel();
+    case "googlechat":
+      return new GoogleChatChannel();
+    case "webchat":
+      return new WebChatChannel();
+    case "irc":
+      return new IrcChannel();
+    case "macos":
+      return new MacOSChannel();
+    default:
+      return null;
+  }
+}
+function createGatewayEngine(config) {
+  const engineId = config.engines?.default ?? "native";
+  const engineConfig = config.engines?.available?.[engineId];
+  if (engineId === "claude-cli") {
+    try {
+      return createClaudeCliEngine({
+        command: engineConfig?.command ?? void 0,
+        cwd: engineConfig?.cwd ?? void 0,
+        timeout: engineConfig?.timeout ?? void 0
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn(`  ${YELLOW}\u26A0 ${engineId} engine failed to initialize: ${msg}${RESET}`);
+      console.warn(`  ${DIM}Falling back to native SDK engine.${RESET}`);
+    }
+  }
+  if (engineId === "codex-cli") {
+    try {
+      return createCodexCliEngine({
+        command: engineConfig?.command ?? void 0,
+        cwd: engineConfig?.cwd ?? void 0,
+        timeout: engineConfig?.timeout ?? void 0
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn(`  ${YELLOW}\u26A0 ${engineId} engine failed to initialize: ${msg}${RESET}`);
+      console.warn(`  ${DIM}Falling back to native SDK engine.${RESET}`);
+    }
+  }
+  const providerName = config.agent.provider;
+  const providerConfig = config.providers?.[providerName];
+  const apiKey = providerConfig?.apiKey;
+  if (providerName !== "ollama" && (!apiKey || apiKey.trim().length === 0)) {
+    return null;
+  }
+  try {
+    const provider = ProviderRegistry.createProvider({
+      id: providerName,
+      type: providerName,
+      ...providerConfig
+    });
+    return new NativeEngine({ provider, defaultModel: config.agent.model });
+  } catch {
+    return null;
+  }
+}
+var MAX_CONTEXTS = 500;
+var GATEWAY_CONTEXT_MAX_TOKENS = 32e3;
+var MAX_PENDING_PER_USER = 2;
+function buildSafeConfig(cfg) {
+  return {
+    agent: {
+      model: cfg.agent.model,
+      provider: cfg.agent.provider,
+      thinkingLevel: cfg.agent.thinkingLevel
+    },
+    gateway: { requirePairing: cfg.gateway.requirePairing },
+    memory: { autoSave: cfg.memory.autoSave },
+    autonomy: { level: cfg.autonomy.level },
+    observability: { logLevel: cfg.observability.logLevel },
+    skills: { enabled: cfg.skills.enabled },
+    tunnel: { provider: cfg.tunnel.provider }
+  };
+}
+function applySafeUpdates(current, updates) {
+  const result = { ...current };
+  if (updates.agent && typeof updates.agent === "object") {
+    const u = updates.agent;
+    result.agent = {
+      ...current.agent,
+      ...u.model !== void 0 && { model: String(u.model) },
+      ...u.provider !== void 0 && { provider: String(u.provider) },
+      ...u.thinkingLevel !== void 0 && { thinkingLevel: u.thinkingLevel }
+    };
+  }
+  if (updates.gateway && typeof updates.gateway === "object") {
+    const u = updates.gateway;
+    result.gateway = {
+      ...current.gateway,
+      ...u.requirePairing !== void 0 && { requirePairing: Boolean(u.requirePairing) }
+    };
+  }
+  if (updates.memory && typeof updates.memory === "object") {
+    const u = updates.memory;
+    result.memory = {
+      ...current.memory,
+      ...u.autoSave !== void 0 && { autoSave: Boolean(u.autoSave) }
+    };
+  }
+  if (updates.autonomy && typeof updates.autonomy === "object") {
+    const u = updates.autonomy;
+    result.autonomy = {
+      ...current.autonomy,
+      ...u.level !== void 0 && { level: u.level }
+    };
+  }
+  if (updates.observability && typeof updates.observability === "object") {
+    const u = updates.observability;
+    result.observability = {
+      ...current.observability,
+      ...u.logLevel !== void 0 && { logLevel: u.logLevel }
+    };
+  }
+  if (updates.skills && typeof updates.skills === "object") {
+    const u = updates.skills;
+    result.skills = {
+      ...current.skills,
+      ...u.enabled !== void 0 && { enabled: Boolean(u.enabled) }
+    };
+  }
+  if (updates.tunnel && typeof updates.tunnel === "object") {
+    const u = updates.tunnel;
+    result.tunnel = {
+      ...current.tunnel,
+      ...u.provider !== void 0 && { provider: String(u.provider) }
+    };
+  }
+  return result;
+}
+async function gateway(args) {
+  let config;
+  try {
+    config = loadConfig();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`
+  ${RED}Failed to load config:${RESET} ${message}`);
+    console.error(`  ${DIM}Run ${TEAL}ch4p onboard${DIM} to set up ch4p.${RESET}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  let port = config.gateway.port;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--port" && args[i + 1]) {
+      const parsed = parseInt(args[i + 1], 10);
+      if (!isNaN(parsed) && parsed > 0 && parsed <= 65535) {
+        port = parsed;
+      }
+    }
+  }
+  const host = config.gateway.allowPublicBind ? "0.0.0.0" : "127.0.0.1";
+  const requirePairing = config.gateway.requirePairing;
+  const sessionManager = new SessionManager();
+  const pairingManager = requirePairing ? new PairingManager() : void 0;
+  const engine = createGatewayEngine(config);
+  if (!engine) {
+    const providerName = config.agent?.provider ?? "unknown";
+    console.error(`
+  ${RED}No engine available.${RESET} Provider "${providerName}" has no API key.`);
+    console.error(`  ${DIM}Run ${TEAL}ch4p onboard${DIM} to configure a provider, or set the API key`);
+    console.error(`  ${DIM}in ${TEAL}~/.ch4p/.env${DIM} as ${TEAL}${providerName.toUpperCase()}_API_KEY${RESET}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  let skillRegistry;
+  try {
+    if (config.skills?.enabled && config.skills?.paths?.length) {
+      skillRegistry = SkillRegistry.createFromPaths(config.skills.paths);
+    }
+  } catch {
+  }
+  let memoryBackend;
+  try {
+    const memCfg = {
+      backend: config.memory.backend,
+      vectorWeight: config.memory.vectorWeight,
+      keywordWeight: config.memory.keywordWeight,
+      embeddingProvider: config.memory.embeddingProvider,
+      openaiApiKey: config.providers?.openai?.apiKey || void 0
+    };
+    memoryBackend = createMemoryBackend(memCfg);
+  } catch {
+  }
+  const hasMemory = !!memoryBackend;
+  const hasSearch = !!(config.search?.enabled && config.search.apiKey);
+  const defaultSystemPrompt = buildSystemPrompt({ hasMemory, hasSearch, skillRegistry });
+  const defaultSessionConfig = {
+    engineId: config.engines?.default ?? "native",
+    model: config.agent.model,
+    provider: config.agent.provider,
+    systemPrompt: defaultSystemPrompt
+  };
+  let sharedVerifier;
+  const vCfg = config.verification;
+  if (vCfg?.enabled) {
+    const formatOpts = { maxToolErrorRatio: vCfg.maxToolErrorRatio ?? 0.5 };
+    if (vCfg.semantic && engine) {
+      try {
+        const providerName = config.agent.provider;
+        const providerConfig = config.providers?.[providerName];
+        const verifierProvider = ProviderRegistry.createProvider({
+          id: `${providerName}-verifier`,
+          type: providerName,
+          ...providerConfig
+        });
+        sharedVerifier = new LLMVerifier({ provider: verifierProvider, model: config.agent.model, formatOpts });
+      } catch {
+        sharedVerifier = new FormatVerifier(formatOpts);
+      }
+    } else {
+      sharedVerifier = new FormatVerifier(formatOpts);
+    }
+  }
+  const agentRouter = new AgentRouter(config);
+  if (agentRouter.hasRules()) {
+    const agents = config.routing?.agents ?? {};
+    const rules = config.routing?.rules ?? [];
+    for (const rule of rules) {
+      if (rule.agent && !agents[rule.agent]) {
+        console.warn(
+          `  ${YELLOW}\u26A0 Routing rule references undefined agent "${rule.agent}" \u2014 rule will be skipped.${RESET}`
+        );
+      }
+    }
+  }
+  let agentRegistration;
+  if (config.identity?.enabled) {
+    agentRegistration = {
+      type: "AgentRegistrationFile",
+      name: "ch4p",
+      description: "ch4p personal AI assistant",
+      image: "",
+      services: [],
+      active: true,
+      ...config.identity.agentId ? { agentId: config.identity.agentId } : {},
+      ...config.identity.chainId ? { chainId: config.identity.chainId } : {}
+    };
+  }
+  const x402Cfg = config.x402;
+  const x402Middleware = x402Cfg ? createX402Middleware(x402Cfg) : null;
+  if (x402Cfg?.enabled && x402Cfg.client?.privateKey) {
+    if (!/^0x[a-fA-F0-9]{64}$/.test(x402Cfg.client.privateKey)) {
+      console.error(`
+  ${RED}x402.client.privateKey is invalid:${RESET} expected a 0x-prefixed 64-character hex string.`);
+      console.error(`  ${DIM}Set it via the X402_PRIVATE_KEY env var: ${TEAL}"privateKey": "\${X402_PRIVATE_KEY}"${RESET}
+`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const messageRouter = new MessageRouter(sessionManager, defaultSessionConfig);
+  const obsCfg = {
+    observers: config.observability.observers ?? ["console"],
+    logLevel: config.observability.logLevel ?? "info",
+    logPath: `${getLogsDir()}/gateway.jsonl`
+  };
+  const observer = createObserver(obsCfg);
+  const _require = createRequire(import.meta.url);
+  let workerPool;
+  try {
+    const workerScriptPath = _require.resolve("@ch4p/agent/worker");
+    workerPool = new ToolWorkerPool({
+      workerScript: workerScriptPath,
+      maxWorkers: 4,
+      taskTimeoutMs: 6e4
+    });
+  } catch {
+    workerPool = void 0;
+  }
+  let voiceProcessor;
+  const voiceCfg = config.voice;
+  if (voiceCfg?.enabled) {
+    try {
+      const sttProvider = voiceCfg.stt.provider === "deepgram" ? new DeepgramSTT({ apiKey: voiceCfg.stt.apiKey ?? "" }) : new WhisperSTT({ apiKey: voiceCfg.stt.apiKey ?? "" });
+      const ttsProvider = voiceCfg.tts.provider === "elevenlabs" ? new ElevenLabsTTS({ apiKey: voiceCfg.tts.apiKey ?? "", voiceId: voiceCfg.tts.voiceId }) : void 0;
+      voiceProcessor = new VoiceProcessor({
+        stt: sttProvider,
+        tts: ttsProvider,
+        config: voiceCfg
+      });
+    } catch {
+    }
+  }
+  let inFlightCount = 0;
+  let drainResolve = null;
+  function waitForDrain(timeoutMs = 3e4) {
+    if (inFlightCount === 0) return Promise.resolve();
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        drainResolve = null;
+        console.log(`  ${YELLOW}\u26A0 Drain timeout after ${timeoutMs / 1e3}s \u2014 ${inFlightCount} message(s) still in flight${RESET}`);
+        resolve();
+      }, timeoutMs);
+      drainResolve = () => {
+        clearTimeout(timer);
+        resolve();
+      };
+    });
+  }
+  function trackInflight(delta) {
+    inFlightCount += delta;
+    if (inFlightCount <= 0 && drainResolve) {
+      inFlightCount = 0;
+      const cb = drainResolve;
+      drainResolve = null;
+      cb();
+    }
+  }
+  const conversationContexts = /* @__PURE__ */ new Map();
+  const sessionNotes = new SessionNotes(getCh4pDir());
+  const inFlightLoops = /* @__PURE__ */ new Map();
+  const pendingMessages = /* @__PURE__ */ new Map();
+  const rawWebhookHandlers = /* @__PURE__ */ new Map();
+  const logChannel = new LogChannel({
+    onResponse: () => {
+    }
+  });
+  const server = new GatewayServer({
+    port,
+    host,
+    sessionManager,
+    pairingManager,
+    defaultSessionConfig,
+    agentRegistration,
+    preHandler: x402Middleware ?? void 0,
+    onWebhook: (name, payload) => {
+      const syntheticMsg = {
+        id: generateId(16),
+        channelId: `webhook:${name}`,
+        from: { channelId: `webhook:${name}`, userId: payload.userId ?? "webhook" },
+        text: payload.message,
+        timestamp: /* @__PURE__ */ new Date()
+      };
+      handleInboundMessage({
+        msg: syntheticMsg,
+        channel: logChannel,
+        router: messageRouter,
+        engine,
+        config,
+        observer,
+        conversationContexts,
+        agentRouter,
+        defaultSystemPrompt,
+        memoryBackend,
+        skillRegistry,
+        voiceProcessor,
+        onInflightChange: trackInflight,
+        workerPool,
+        inFlightLoops,
+        pendingMessages,
+        sharedVerifier
+      });
+    },
+    onRawWebhook: (name, body) => {
+      const handler = rawWebhookHandlers.get(name);
+      if (!handler) return false;
+      handler(body);
+      return true;
+    },
+    onSteer: (sessionId, message) => {
+      for (const entry of inFlightLoops.values()) {
+        if (entry.loop.getSessionId() === sessionId) {
+          entry.loop.steerEngine(message);
+          return;
+        }
+      }
+    },
+    onGetConfig: () => buildSafeConfig(config),
+    onSaveConfig: async (updates) => {
+      config = applySafeUpdates(config, updates);
+      saveConfig(config);
+    }
+  });
+  try {
+    await server.start();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`  ${RED}Failed to start gateway:${RESET} ${message}`);
+    process.exitCode = 1;
+    return;
+  }
+  const addr = server.getAddress();
+  const bindDisplay = addr ? `${addr.host}:${addr.port}` : `${host}:${port}`;
+  console.log("\n" + box("ch4p Gateway", [
+    kvRow("Server", `${GREEN}${BOLD}listening${RESET} on ${bindDisplay}`),
+    kvRow("Pairing", requirePairing ? `${GREEN}required${RESET}` : `${YELLOW}disabled${RESET}`),
+    kvRow("Engine", engine ? engine.name : `${YELLOW}none (no API key)${RESET}`),
+    kvRow("Memory", memoryBackend ? config.memory.backend : `${DIM}disabled${RESET}`),
+    kvRow("Voice", voiceProcessor ? `${GREEN}enabled${RESET} (STT: ${voiceCfg?.stt.provider ?? "?"}, TTS: ${voiceCfg?.tts.provider ?? "none"})` : `${DIM}disabled${RESET}`),
+    kvRow("Workers", workerPool ? `${GREEN}enabled${RESET} ${DIM}(max 4 threads)${RESET}` : `${DIM}inline (worker script not built)${RESET}`),
+    kvRow("Identity", agentRegistration ? `${GREEN}enabled${RESET} (chain ${config.identity?.chainId ?? 8453})` : `${DIM}disabled${RESET}`),
+    kvRow("x402", x402Cfg?.enabled ? `${GREEN}enabled${RESET} ${DIM}(${x402Cfg.server?.network ?? "base"})${RESET}` : `${DIM}disabled${RESET}`)
+  ]));
+  console.log("");
+  console.log(`  ${DIM}Routes:${RESET}`);
+  console.log(`  ${DIM}  GET    /health              - liveness probe${RESET}`);
+  console.log(`  ${DIM}  GET    /ready               - readiness probe${RESET}`);
+  if (agentRegistration) {
+    console.log(`  ${DIM}  GET    /.well-known/agent.json - agent discovery${RESET}`);
+  }
+  console.log(`  ${DIM}  POST   /pair                - exchange pairing code for token${RESET}`);
+  console.log(`  ${DIM}  GET    /sessions            - list active sessions${RESET}`);
+  console.log(`  ${DIM}  POST   /sessions            - create a new session${RESET}`);
+  console.log(`  ${DIM}  GET    /sessions/:id        - get session details${RESET}`);
+  console.log(`  ${DIM}  POST   /sessions/:id/steer  - inject message into session${RESET}`);
+  console.log(`  ${DIM}  DELETE /sessions/:id        - end a session${RESET}`);
+  console.log("");
+  const channelRegistry = new ChannelRegistry();
+  const startedChannels = [];
+  const channelNames = Object.keys(config.channels);
+  const channelSupervisor = new Supervisor({ strategy: "one-for-one", maxRestarts: 5, windowMs: 6e4 });
+  channelSupervisor.on("child:crashed", (childId, error) => {
+    console.log(`  ${YELLOW}\u26A0 Channel ${childId} crashed:${RESET} ${error.message}`);
+  });
+  channelSupervisor.on("child:restarted", (childId, _handle, attempt) => {
+    console.log(`  ${GREEN}\u2713${RESET} Channel ${childId} restarted ${DIM}(attempt ${attempt})${RESET}`);
+  });
+  channelSupervisor.on("supervisor:max_restarts_exceeded", (childId, count, windowMs) => {
+    console.log(`  ${RED}\u2717${RESET} Channel ${childId} exceeded max restarts (${count} in ${Math.round(windowMs / 1e3)}s)`);
+  });
+  if (channelNames.length > 0) {
+    console.log(`  ${BOLD}Channels:${RESET}`);
+    for (const channelName of channelNames) {
+      const channelCfg = config.channels[channelName];
+      const channel = createChannelInstance(channelName);
+      if (!channel) {
+        console.log(`    ${YELLOW}\u26A0 Unknown channel type: ${channelName}${RESET}`);
+        continue;
+      }
+      try {
+        await channel.start(channelCfg);
+        channelRegistry.register(channel);
+        startedChannels.push(channel);
+        channel.onMessage((msg) => {
+          handleInboundMessage({
+            msg,
+            channel,
+            router: messageRouter,
+            engine,
+            config,
+            observer,
+            conversationContexts,
+            agentRouter,
+            defaultSystemPrompt,
+            memoryBackend,
+            skillRegistry,
+            voiceProcessor,
+            onInflightChange: trackInflight,
+            workerPool,
+            inFlightLoops,
+            pendingMessages,
+            sharedVerifier,
+            sessionNotes
+          });
+        });
+        if (channelName === "teams" && "handleIncomingActivity" in channel) {
+          rawWebhookHandlers.set("teams", (body) => {
+            try {
+              const activity = JSON.parse(body);
+              channel.handleIncomingActivity(activity);
+            } catch {
+            }
+          });
+        }
+        if (channelName === "googlechat" && "handleIncomingEvent" in channel) {
+          rawWebhookHandlers.set("googlechat", (body) => {
+            try {
+              const event = JSON.parse(body);
+              channel.handleIncomingEvent(event);
+            } catch {
+            }
+          });
+        }
+        let alive = true;
+        await channelSupervisor.addChild({
+          id: channelName,
+          start: async () => {
+            if (!alive) {
+              await channel.start(channelCfg);
+            }
+            alive = true;
+            return {
+              id: channelName,
+              kill: () => {
+                alive = false;
+                void channel.stop();
+              },
+              isAlive: () => alive
+            };
+          },
+          shutdown: async () => {
+            alive = false;
+            await channel.stop();
+          }
+        });
+        console.log(`    ${GREEN}\u2713${RESET} ${channelName} ${DIM}(${channel.name})${RESET}`);
+      } catch (err) {
+        const errMsg = err instanceof Error ? err.message : String(err);
+        console.log(`    ${RED}\u2717${RESET} ${channelName}: ${errMsg}`);
+      }
+    }
+    await channelSupervisor.start();
+    console.log("");
+  } else {
+    console.log(`  ${DIM}No channels configured. Add channels to ~/.ch4p/config.json.${RESET}`);
+    console.log("");
+  }
+  let tunnel = null;
+  const tunnelProvider = config.tunnel.provider;
+  if (tunnelProvider && tunnelProvider !== "none") {
+    try {
+      tunnel = createTunnelProvider(tunnelProvider);
+      const tunnelCfg = {
+        ...config.tunnel,
+        port,
+        localHost: host
+      };
+      const tunnelInfo = await tunnel.start(tunnelCfg);
+      server.setTunnelUrl(tunnelInfo.publicUrl);
+      console.log(`  ${GREEN}${BOLD}Tunnel active${RESET} ${DIM}(${tunnelProvider})${RESET}`);
+      console.log(`  ${BOLD}Public URL${RESET}    ${TEAL}${tunnelInfo.publicUrl}${RESET}`);
+      console.log("");
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      console.log(`  ${YELLOW}\u26A0 Tunnel failed to start:${RESET} ${errMsg}`);
+      console.log(`  ${DIM}Gateway is still accessible locally at ${bindDisplay}.${RESET}`);
+      console.log("");
+      tunnel = null;
+    }
+  } else {
+    console.log(`  ${BOLD}Tunnel${RESET}        ${DIM}disabled${RESET}`);
+    console.log("");
+  }
+  let scheduler;
+  const schedulerCfg = config.scheduler;
+  if (schedulerCfg?.enabled) {
+    const jobs = schedulerCfg.jobs ?? [];
+    if (jobs.length > 0) {
+      scheduler = new Scheduler({
+        onTrigger: (job) => {
+          const syntheticMsg = {
+            id: generateId(16),
+            channelId: `cron:${job.name}`,
+            from: { channelId: `cron:${job.name}`, userId: job.userId ?? "cron" },
+            text: job.message,
+            timestamp: /* @__PURE__ */ new Date()
+          };
+          handleInboundMessage({
+            msg: syntheticMsg,
+            channel: logChannel,
+            router: messageRouter,
+            engine,
+            config,
+            observer,
+            conversationContexts,
+            agentRouter,
+            defaultSystemPrompt,
+            memoryBackend,
+            skillRegistry,
+            voiceProcessor,
+            onInflightChange: trackInflight,
+            workerPool,
+            inFlightLoops,
+            pendingMessages,
+            sharedVerifier
+          });
+        }
+      });
+      for (const job of jobs) {
+        try {
+          scheduler.addJob(job);
+          console.log(`  ${GREEN}\u2713${RESET} cron: ${job.name} ${DIM}(${job.schedule})${RESET}`);
+        } catch (err) {
+          const errMsg = err instanceof Error ? err.message : String(err);
+          console.log(`  ${RED}\u2717${RESET} cron: ${job.name}: ${errMsg}`);
+        }
+      }
+      scheduler.start();
+      console.log(`  ${BOLD}Scheduler${RESET}     ${GREEN}running${RESET} (${scheduler.size} job${scheduler.size === 1 ? "" : "s"})`);
+      console.log("");
+    }
+  }
+  console.log(`  ${BOLD}Webhooks${RESET}      ${GREEN}enabled${RESET} ${DIM}(POST /webhooks/:name)${RESET}`);
+  console.log("");
+  if (requirePairing && pairingManager) {
+    const code = pairingManager.generateCode("CLI startup");
+    console.log(`  ${BOLD}Initial pairing code:${RESET} ${TEAL}${BOLD}${code.code}${RESET}`);
+    console.log(`  ${DIM}Expires in 5 minutes. Use POST /pair to exchange for a token.${RESET}`);
+    console.log("");
+  }
+  console.log(`  ${DIM}Press Ctrl+C to stop.${RESET}
+`);
+  const RESUME_MAX_AGE_MS = 10 * 6e4;
+  void (async () => {
+    await new Promise((r) => setTimeout(r, 5e3));
+    const staleNotes = sessionNotes.loadRecent(RESUME_MAX_AGE_MS);
+    if (staleNotes.length === 0) return;
+    let resumed = 0;
+    for (const note of staleNotes) {
+      const ch = channelRegistry.get(note.channelId);
+      if (!ch) continue;
+      const preamble = note.recentActivity.length > 0 ? `[Resuming after gateway restart. Recent progress: ${note.recentActivity.join(" ")}]
+` : "[Resuming after gateway restart.]\n";
+      const syntheticMsg = {
+        id: `resume:${note.contextKey}:${Date.now()}`,
+        channelId: note.channelId,
+        from: {
+          channelId: note.channelId,
+          userId: note.userId || void 0,
+          groupId: note.groupId || void 0,
+          threadId: note.threadId || void 0
+        },
+        text: preamble + note.request,
+        timestamp: /* @__PURE__ */ new Date()
+      };
+      handleInboundMessage({
+        msg: syntheticMsg,
+        channel: ch,
+        router: messageRouter,
+        engine,
+        config,
+        observer,
+        conversationContexts,
+        agentRouter,
+        defaultSystemPrompt,
+        memoryBackend,
+        skillRegistry,
+        voiceProcessor,
+        onInflightChange: trackInflight,
+        workerPool,
+        inFlightLoops,
+        pendingMessages,
+        sharedVerifier,
+        sessionNotes
+      });
+      resumed++;
+      await new Promise((r) => setTimeout(r, 500));
+    }
+    if (resumed > 0) {
+      console.log(`  ${GREEN}[recovery]${RESET} Resumed ${resumed} in-flight session(s) from notes.`);
+    }
+  })();
+  const CONTEXT_IDLE_MS = 60 * 6e4;
+  const evictionTimer = setInterval(() => {
+    gatewayRateLimiter.evictStale();
+    const heap = process.memoryUsage();
+    const heapMB = Math.round(heap.heapUsed / 1024 / 1024);
+    const rssMB = Math.round(heap.rss / 1024 / 1024);
+    const contextIdleMs = heapMB > 500 ? 5 * 6e4 : CONTEXT_IDLE_MS;
+    const now = Date.now();
+    for (const [key, entry] of conversationContexts) {
+      if (now - entry.lastActiveAt > contextIdleMs) {
+        conversationContexts.delete(key);
+        sessionNotes.delete(key);
+      }
+    }
+    sessionManager.evictIdle(contextIdleMs);
+    messageRouter.evictStale();
+    server.evictIdleCanvas(contextIdleMs);
+    if (heapMB > 500 && typeof globalThis.gc === "function") {
+      globalThis.gc();
+    }
+    console.log(
+      `  ${DIM}[eviction] heap=${heapMB}MB rss=${rssMB}MB contexts=${conversationContexts.size} sessions=${sessionManager.size}${RESET}`
+    );
+    if (heapMB > 1500) {
+      console.log(
+        `  ${YELLOW}[OOM warning]${RESET} Heap at ${heapMB}MB \u2014 restart the gateway or set NODE_OPTIONS=--max-old-space-size=512`
+      );
+    } else if (heapMB > 500) {
+      console.log(`  ${DIM}[mem pressure]${RESET} Heap at ${heapMB}MB \u2014 evicting with 5 min idle window${RESET}`);
+    }
+  }, 5 * 6e4);
+  await new Promise((resolve) => {
+    const shutdown = async () => {
+      clearInterval(evictionTimer);
+      console.log(`
+  ${DIM}Shutting down gateway...${RESET}`);
+      if (scheduler) {
+        scheduler.stop();
+      }
+      if (channelSupervisor.isRunning) {
+        try {
+          await channelSupervisor.stop();
+        } catch {
+        }
+      }
+      if (inFlightCount > 0) {
+        console.log(`  ${DIM}Draining ${inFlightCount} in-flight message(s)...${RESET}`);
+        await waitForDrain(3e4);
+      }
+      if (tunnel) {
+        try {
+          await tunnel.stop();
+        } catch {
+        }
+      }
+      if (workerPool) {
+        try {
+          await workerPool.shutdown();
+        } catch {
+        }
+      }
+      if (memoryBackend) {
+        try {
+          await memoryBackend.close();
+        } catch {
+        }
+      }
+      await server.stop();
+      await observer.flush?.();
+      console.log(`  ${DIM}Goodbye!${RESET}
+`);
+      resolve();
+    };
+    const onSignal = () => void shutdown();
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+    process.on("unhandledRejection", (reason) => {
+      const msg = reason instanceof Error ? reason.message : String(reason);
+      console.error(`  ${RED}\u2717 Unhandled rejection:${RESET} ${msg}`);
+      observer.onError(new Error(`Unhandled rejection: ${msg}`), { source: "gateway" });
+    });
+  });
+}
+var RateLimiter = class {
+  constructor(maxRequests, windowMs) {
+    this.maxRequests = maxRequests;
+    this.windowMs = windowMs;
+  }
+  windows = /* @__PURE__ */ new Map();
+  /** Returns true if the request is allowed; false if rate-limited. */
+  allow(key) {
+    const now = Date.now();
+    const cutoff = now - this.windowMs;
+    const timestamps = (this.windows.get(key) ?? []).filter((t) => t > cutoff);
+    if (timestamps.length >= this.maxRequests) {
+      return false;
+    }
+    timestamps.push(now);
+    this.windows.set(key, timestamps);
+    return true;
+  }
+  /** Remove keys whose timestamps have all expired. */
+  evictStale() {
+    const now = Date.now();
+    const cutoff = now - this.windowMs;
+    for (const [key, timestamps] of this.windows) {
+      if (timestamps.every((t) => t <= cutoff)) {
+        this.windows.delete(key);
+      }
+    }
+  }
+};
+var gatewayRateLimiter = new RateLimiter(20, 6e4);
+function handleInboundMessage(opts) {
+  const {
+    msg,
+    channel,
+    router,
+    engine,
+    config,
+    observer,
+    conversationContexts,
+    agentRouter,
+    defaultSystemPrompt,
+    memoryBackend,
+    skillRegistry,
+    voiceProcessor,
+    onInflightChange,
+    workerPool,
+    inFlightLoops,
+    pendingMessages,
+    sharedVerifier,
+    sessionNotes
+  } = opts;
+  if (!engine) {
+    channel.send(msg.from, {
+      text: "ch4p is not configured with an LLM engine. Please set up an API key via `ch4p onboard`.",
+      replyTo: msg.id
+    }).catch(() => {
+    });
+    return;
+  }
+  const hasAudio = msg.attachments?.some((a) => a.type === "audio") ?? false;
+  if (!msg.text && !hasAudio) return;
+  const { userId } = msg.from;
+  const rateLimitKey = `${msg.channelId ?? "unknown"}:${userId ?? "anonymous"}`;
+  if (!gatewayRateLimiter.allow(rateLimitKey)) {
+    channel.send(msg.from, {
+      text: "You are sending messages too quickly. Please wait a moment.",
+      replyTo: msg.id
+    }).catch(() => {
+    });
+    return;
+  }
+  const userKey = `${msg.channelId ?? "unknown"}:${msg.from.userId ?? "anonymous"}`;
+  if (inFlightLoops) {
+    const inflight = inFlightLoops.get(userKey);
+    if (inflight) {
+      if (inflight.permissionPending) {
+        inflight.loop.steerEngine(msg.text ?? "");
+        inflight.permissionPending = false;
+      } else if (pendingMessages) {
+        const queue = pendingMessages.get(userKey) ?? [];
+        if (queue.length < MAX_PENDING_PER_USER) {
+          queue.push({ msg, channel });
+        } else {
+          queue[queue.length - 1] = { msg, channel };
+        }
+        pendingMessages.set(userKey, queue);
+        if (queue.length === 1) {
+          channel.send(msg.from, {
+            text: "Got it \u2014 I'll get to your message once I finish what I'm working on.",
+            replyTo: msg.id
+          }).catch(() => {
+          });
+        }
+      } else {
+        channel.send(msg.from, {
+          text: "I'm still working on your previous message. Please wait for me to finish.",
+          replyTo: msg.id
+        }).catch(() => {
+        });
+      }
+      return;
+    }
+  }
+  const routeResult = router.route(msg);
+  if (!routeResult) return;
+  onInflightChange?.(1);
+  void (async () => {
+    let runTimer;
+    let contextKey = "";
+    try {
+      const processedMsg = voiceProcessor ? await voiceProcessor.processInbound(msg) : msg;
+      if (!processedMsg.text) return;
+      const routing = agentRouter.route(processedMsg, defaultSystemPrompt);
+      const { userId: userId2, groupId, threadId } = msg.from;
+      contextKey = groupId && threadId ? `${msg.channelId ?? ""}:group:${groupId}:thread:${threadId}` : groupId ? `${msg.channelId ?? ""}:group:${groupId}:user:${userId2 ?? "anonymous"}` : `${msg.channelId ?? ""}:${userId2 ?? "anonymous"}`;
+      let contextEntry = conversationContexts.get(contextKey);
+      if (!contextEntry) {
+        if (conversationContexts.size >= MAX_CONTEXTS) {
+          let oldestKey;
+          let oldestTime = Infinity;
+          for (const [k, v] of conversationContexts) {
+            if (v.lastActiveAt < oldestTime) {
+              oldestTime = v.lastActiveAt;
+              oldestKey = k;
+            }
+          }
+          if (oldestKey) conversationContexts.delete(oldestKey);
+        }
+        const ctx = new ContextManager({ maxTokens: GATEWAY_CONTEXT_MAX_TOKENS });
+        const initPrompt = routing.systemPrompt ?? routeResult.config.systemPrompt ?? defaultSystemPrompt;
+        ctx.setSystemPrompt(initPrompt);
+        contextEntry = { ctx, lastActiveAt: Date.now() };
+        conversationContexts.set(contextKey, contextEntry);
+      } else {
+        contextEntry.lastActiveAt = Date.now();
+      }
+      const sharedContext = contextEntry.ctx;
+      sessionNotes?.upsert({
+        contextKey,
+        channelId: msg.channelId,
+        userId: userId2 ?? "anonymous",
+        groupId: msg.from.groupId,
+        threadId: msg.from.threadId,
+        request: processedMsg.text,
+        requestAt: Date.now(),
+        recentActivity: []
+      });
+      const routedSessionConfig = {
+        ...routeResult.config,
+        model: routing.model ?? routeResult.config.model,
+        systemPrompt: routing.systemPrompt ?? routeResult.config.systemPrompt
+      };
+      const session = new Session(routedSessionConfig, {
+        sharedContext,
+        maxErrors: config.agent.maxSessionErrors
+      });
+      const toolExclude = config.autonomy.level === "readonly" ? ["bash", "file_write", "file_edit", "delegate", "browser"] : ["delegate", "browser"];
+      if (!config.mesh?.enabled) {
+        toolExclude.push("mesh");
+      }
+      for (const t of routing.toolExclude) {
+        if (!toolExclude.includes(t)) toolExclude.push(t);
+      }
+      const tools = ToolRegistry.createDefault({ exclude: toolExclude });
+      if (skillRegistry && skillRegistry.size > 0) {
+        tools.register(new LoadSkillTool(skillRegistry));
+      }
+      const x402PluginCfg = config.x402;
+      if (x402PluginCfg?.enabled) {
+        tools.register(new X402PayTool());
+      }
+      const securityPolicy = new DefaultSecurityPolicy({
+        workspace: routeResult.config.cwd ?? process.cwd(),
+        autonomyLevel: config.autonomy.level,
+        allowedCommands: config.autonomy.allowedCommands,
+        blockedPaths: config.security.blockedPaths
+      });
+      const autoSave = config.memory.autoSave !== false;
+      const memNamespace = `u:${msg.channelId ?? "unknown"}:${userId2 ?? "anonymous"}`;
+      const onBeforeFirstRun = memoryBackend && autoSave ? createAutoRecallHook(memoryBackend, { namespace: memNamespace }) : void 0;
+      const onAfterComplete = memoryBackend && autoSave ? createAutoSummarizeHook(memoryBackend, { namespace: memNamespace }) : void 0;
+      const toolContextExtensions = {};
+      if (config.search?.enabled && config.search.apiKey) {
+        toolContextExtensions.searchApiKey = config.search.apiKey;
+        toolContextExtensions.searchConfig = {
+          maxResults: config.search.maxResults,
+          country: config.search.country,
+          searchLang: config.search.searchLang
+        };
+      }
+      if (x402PluginCfg?.enabled && x402PluginCfg.client?.privateKey) {
+        const cc = x402PluginCfg.client;
+        toolContextExtensions.x402Signer = createEIP712Signer(cc.privateKey, {
+          chainId: cc.chainId,
+          tokenAddress: cc.tokenAddress,
+          tokenName: cc.tokenName,
+          tokenVersion: cc.tokenVersion
+        });
+        toolContextExtensions.agentWalletAddress = walletAddress(cc.privateKey);
+      }
+      toolContextExtensions.resolveEngine = (_engineId) => engine;
+      const loop = new AgentLoop(session, engine, tools.list(), observer, {
+        maxIterations: routing.maxIterations,
+        // Per-agent routing override.
+        maxRetries: 2,
+        enableStateSnapshots: true,
+        verifier: sharedVerifier,
+        memoryBackend,
+        securityPolicy,
+        onBeforeFirstRun,
+        onAfterComplete,
+        toolContextExtensions: Object.keys(toolContextExtensions).length > 0 ? toolContextExtensions : void 0,
+        workerPool,
+        maxToolResults: config.agent.maxToolResults,
+        maxToolOutputLen: config.agent.maxToolOutputLen,
+        maxStateRecords: config.agent.maxStateRecords
+      });
+      if (inFlightLoops) {
+        inFlightLoops.set(userKey, { loop, permissionPending: false });
+      }
+      const DEFAULT_RUN_TIMEOUT_MS = 3e5;
+      const runTimeoutMs = config.agent.runTimeout ?? DEFAULT_RUN_TIMEOUT_MS;
+      runTimer = setTimeout(() => {
+        loop.abort("Gateway run timeout exceeded");
+      }, runTimeoutMs);
+      let responseText = "";
+      const PERM_RE = /\[y\/n\]|\[Y\/N\]|do you want to|allow this|permission required/i;
+      for await (const event of loop.run(processedMsg.text)) {
+        if (event.type === "text") {
+          responseText = event.partial;
+          if (inFlightLoops && PERM_RE.test(event.partial)) {
+            const entry = inFlightLoops.get(userKey);
+            if (entry) entry.permissionPending = true;
+          }
+        } else if (event.type === "complete") {
+          responseText = event.answer;
+          if (event.answer) sessionNotes?.appendActivity(contextKey, event.answer);
+        } else if (event.type === "error") {
+          responseText = `Error: ${event.error.message}`;
+        }
+      }
+      if (responseText) {
+        const outbound = {
+          text: responseText,
+          replyTo: msg.id,
+          format: "text"
+        };
+        const finalOutbound = voiceProcessor ? await voiceProcessor.processOutbound(outbound) : outbound;
+        await channel.send(msg.from, finalOutbound);
+      }
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      await channel.send(msg.from, {
+        text: `Sorry, I encountered an error: ${errMsg}`,
+        replyTo: msg.id
+      }).catch(() => {
+      });
+    } finally {
+      clearTimeout(runTimer);
+      sessionNotes?.delete(contextKey);
+      const queue = pendingMessages?.get(userKey);
+      const next = queue?.shift();
+      if (queue && queue.length === 0) pendingMessages.delete(userKey);
+      if (next) {
+        inFlightLoops?.delete(userKey);
+        handleInboundMessage({ ...opts, msg: next.msg, channel: next.channel });
+      } else {
+        inFlightLoops?.delete(userKey);
+        onInflightChange?.(-1);
+      }
+    }
+  })();
+}
+
+export {
+  buildSafeConfig,
+  applySafeUpdates,
+  gateway
+};