@cosmicstack/mercury-agent 0.4.1 → 0.5.0

package/dist/index.js

@@ -5,8 +5,8 @@ import { readFileSync as readFileSync12, writeFileSync as writeFileSync13, exist
 import { fileURLToPath } from "url";
 import { dirname as dirname3, join as join11 } from "path";
 import { Command } from "commander";
-import readline2 from "readline";
-import chalk6 from "chalk";
+import readline3 from "readline";
+import chalk7 from "chalk";
 
 // src/utils/config.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
@@ -95,7 +95,10 @@ function getDefaultConfig() {
         botToken: getEnv("TELEGRAM_BOT_TOKEN", ""),
         webhookUrl: getEnv("TELEGRAM_WEBHOOK_URL", ""),
         allowedChatIds: getEnv("TELEGRAM_ALLOWED_CHAT_IDS", "").split(",").filter(Boolean).map(Number),
-        streaming: getEnvBool("TELEGRAM_STREAMING", true)
+        streaming: getEnvBool("TELEGRAM_STREAMING", true),
+        admins: [],
+        members: [],
+        pending: []
       }
     },
     github: {
@@ -122,9 +125,9 @@ function loadConfig() {
     const raw = readFileSync(CONFIG_PATH, "utf-8");
     const fileConfig = parseYaml(raw);
     const defaults = getDefaultConfig();
-    return deepMerge(defaults, fileConfig);
+    return migrateLegacyTelegramAccess(deepMerge(defaults, fileConfig));
   }
-  return getDefaultConfig();
+  return migrateLegacyTelegramAccess(getDefaultConfig());
 }
 function saveConfig(config) {
   const dir = getMercuryHome();
@@ -168,18 +171,145 @@ function isProviderConfigured(provider) {
   }
   return provider.apiKey.length > 0;
 }
-function setTelegramPairing(config, userId, chatId, username) {
-  config.channels.telegram.pairedUserId = userId;
-  config.channels.telegram.pairedChatId = chatId;
-  config.channels.telegram.pairedUsername = username || void 0;
-  return config;
+function getTelegramApprovedUsers(config) {
+  return [
+    ...config.channels.telegram.admins,
+    ...config.channels.telegram.members
+  ];
+}
+function getTelegramApprovedChatIds(config) {
+  return [...new Set(getTelegramApprovedUsers(config).map((user) => user.chatId))];
+}
+function getTelegramAdmins(config) {
+  return config.channels.telegram.admins;
+}
+function getTelegramPendingRequests(config) {
+  return config.channels.telegram.pending;
+}
+function findTelegramApprovedUser(config, userId) {
+  return getTelegramApprovedUsers(config).find((user) => user.userId === userId);
+}
+function findTelegramAdmin(config, userId) {
+  return config.channels.telegram.admins.find((user) => user.userId === userId);
+}
+function findTelegramPendingRequest(config, userId) {
+  return config.channels.telegram.pending.find((request) => request.userId === userId);
+}
+function findTelegramPendingRequestByPairingCode(config, pairingCode) {
+  return config.channels.telegram.pending.find((request) => request.pairingCode === pairingCode);
+}
+function hasTelegramAdmins(config) {
+  return config.channels.telegram.admins.length > 0;
+}
+function getTelegramAccessSummary(config) {
+  return `${config.channels.telegram.admins.length} admin${config.channels.telegram.admins.length === 1 ? "" : "s"}, ${config.channels.telegram.members.length} member${config.channels.telegram.members.length === 1 ? "" : "s"}, ${config.channels.telegram.pending.length} pending`;
+}
+function addTelegramPendingRequest(config, request) {
+  const existing = findTelegramPendingRequest(config, request.userId);
+  if (existing) {
+    existing.chatId = request.chatId;
+    existing.username = request.username || existing.username;
+    existing.firstName = request.firstName || existing.firstName;
+    existing.pairingCode = request.pairingCode || existing.pairingCode;
+    return existing;
+  }
+  const created = {
+    ...request,
+    requestedAt: request.requestedAt || (/* @__PURE__ */ new Date()).toISOString()
+  };
+  config.channels.telegram.pending.push(created);
+  return created;
+}
+function approveTelegramPendingRequest(config, userId, role = "member") {
+  const request = findTelegramPendingRequest(config, userId);
+  if (!request) return null;
+  const approvedUser = {
+    userId: request.userId,
+    chatId: request.chatId,
+    username: request.username,
+    firstName: request.firstName,
+    requestedAt: request.requestedAt,
+    approvedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  config.channels.telegram.pending = config.channels.telegram.pending.filter((entry) => entry.userId !== userId);
+  config.channels.telegram.admins = config.channels.telegram.admins.filter((entry) => entry.userId !== userId);
+  config.channels.telegram.members = config.channels.telegram.members.filter((entry) => entry.userId !== userId);
+  if (role === "admin") {
+    config.channels.telegram.admins.push(approvedUser);
+  } else {
+    config.channels.telegram.members.push(approvedUser);
+  }
+  return approvedUser;
+}
+function approveTelegramPendingRequestByPairingCode(config, pairingCode) {
+  const request = findTelegramPendingRequestByPairingCode(config, pairingCode);
+  if (!request) return null;
+  const role = hasTelegramAdmins(config) ? "member" : "admin";
+  return approveTelegramPendingRequest(config, request.userId, role);
+}
+function rejectTelegramPendingRequest(config, userId) {
+  const request = findTelegramPendingRequest(config, userId);
+  if (!request) return null;
+  config.channels.telegram.pending = config.channels.telegram.pending.filter((entry) => entry.userId !== userId);
+  return request;
+}
+function removeTelegramUser(config, userId) {
+  const admin = config.channels.telegram.admins.find((entry) => entry.userId === userId);
+  if (admin) {
+    config.channels.telegram.admins = config.channels.telegram.admins.filter((entry) => entry.userId !== userId);
+    return admin;
+  }
+  const member = config.channels.telegram.members.find((entry) => entry.userId === userId);
+  if (member) {
+    config.channels.telegram.members = config.channels.telegram.members.filter((entry) => entry.userId !== userId);
+    return member;
+  }
+  return null;
+}
+function promoteTelegramUserToAdmin(config, userId) {
+  const member = config.channels.telegram.members.find((entry) => entry.userId === userId);
+  if (!member) return null;
+  config.channels.telegram.members = config.channels.telegram.members.filter((entry) => entry.userId !== userId);
+  config.channels.telegram.admins.push(member);
+  return member;
+}
+function demoteTelegramAdmin(config, userId) {
+  if (config.channels.telegram.admins.length <= 1) {
+    return null;
+  }
+  const admin = config.channels.telegram.admins.find((entry) => entry.userId === userId);
+  if (!admin) return null;
+  config.channels.telegram.admins = config.channels.telegram.admins.filter((entry) => entry.userId !== userId);
+  config.channels.telegram.members.push(admin);
+  return admin;
 }
-function clearTelegramPairing(config) {
+function clearTelegramAccess(config) {
+  config.channels.telegram.admins = [];
+  config.channels.telegram.members = [];
+  config.channels.telegram.pending = [];
   delete config.channels.telegram.pairedUserId;
   delete config.channels.telegram.pairedChatId;
   delete config.channels.telegram.pairedUsername;
   return config;
 }
+function migrateLegacyTelegramAccess(config) {
+  const telegram = config.channels.telegram;
+  telegram.admins = telegram.admins || [];
+  telegram.members = telegram.members || [];
+  telegram.pending = telegram.pending || [];
+  if (telegram.admins.length === 0 && telegram.members.length === 0 && typeof telegram.pairedUserId === "number" && typeof telegram.pairedChatId === "number") {
+    telegram.admins.push({
+      userId: telegram.pairedUserId,
+      chatId: telegram.pairedChatId,
+      username: telegram.pairedUsername,
+      approvedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  delete telegram.pairedUserId;
+  delete telegram.pairedChatId;
+  delete telegram.pairedUsername;
+  return config;
+}
 
 // src/utils/logger.ts
 import pino from "pino";
@@ -761,208 +891,710 @@ var Lifecycle = class {
   }
 };
 
-// src/core/agent.ts
-var ToolCallLoopDetector = class {
-  recentCalls = [];
-  maxEntries = 10;
-  record(toolName, params) {
-    const paramsKey = JSON.stringify(params).slice(0, 100);
-    this.recentCalls.push({ tool: toolName, params: paramsKey });
-    if (this.recentCalls.length > this.maxEntries) {
-      this.recentCalls.shift();
-    }
+// src/channels/cli.ts
+import readline2 from "readline";
+import fs from "fs";
+import path from "path";
+import chalk3 from "chalk";
+
+// src/channels/base.ts
+var BaseChannel = class {
+  messageHandler;
+  ready = false;
+  isReady() {
+    return this.ready;
   }
-  detect() {
-    if (this.recentCalls.length < 3) return null;
-    const last = this.recentCalls[this.recentCalls.length - 1];
-    let consecutiveCount = 0;
-    for (let i = this.recentCalls.length - 1; i >= 0; i--) {
-      if (this.recentCalls[i].tool === last.tool && this.recentCalls[i].params === last.params) {
-        consecutiveCount++;
-      } else {
-        break;
-      }
-    }
-    if (consecutiveCount >= 3) {
-      return { tool: last.tool, count: consecutiveCount };
-    }
-    const lastTool = last.tool;
-    let toolCount = 0;
-    for (let i = this.recentCalls.length - 1; i >= 0; i--) {
-      if (this.recentCalls[i].tool === lastTool) {
-        toolCount++;
-      } else {
-        break;
-      }
-    }
-    if (toolCount >= 4) {
-      return { tool: lastTool, count: toolCount };
-    }
-    return null;
+  onMessage(handler) {
+    this.messageHandler = handler;
   }
-  reset() {
-    this.recentCalls = [];
+  emit(message) {
+    this.messageHandler?.(message);
   }
 };
-var MAX_STEPS = 10;
-var Agent = class {
-  constructor(config, providers, identity, shortTerm, longTerm, episodic, channels, tokenBudget, capabilities, scheduler) {
-    this.config = config;
-    this.providers = providers;
-    this.identity = identity;
-    this.shortTerm = shortTerm;
-    this.longTerm = longTerm;
-    this.episodic = episodic;
-    this.channels = channels;
-    this.tokenBudget = tokenBudget;
-    this.lifecycle = new Lifecycle();
-    this.scheduler = scheduler;
-    this.capabilities = capabilities;
-    this.telegramStreaming = config.channels.telegram.streaming ?? true;
-    this.scheduler.setOnScheduledTask(async (manifest) => this.handleScheduledTask(manifest));
-    this.channels.onIncomingMessage((msg) => this.enqueueMessage(msg));
-    this.scheduler.onHeartbeat(async () => {
-      await this.heartbeat();
-    });
+
+// src/utils/markdown.ts
+import { Marked } from "marked";
+import chalk from "chalk";
+var lexer = new Marked();
+function renderMarkdown(text) {
+  try {
+    const tokens = lexer.lexer(text);
+    const result = renderTokens(tokens);
+    return result.replace(/\n{3,}/g, "\n\n").trimEnd();
+  } catch {
+    return text;
   }
-  config;
-  providers;
-  identity;
-  shortTerm;
-  longTerm;
-  episodic;
-  channels;
-  tokenBudget;
-  lifecycle;
-  scheduler;
-  capabilities;
-  running = false;
-  messageQueue = [];
-  processing = false;
-  telegramStreaming;
-  enqueueMessage(msg) {
-    logger.info({ from: msg.channelType, content: msg.content.slice(0, 50) }, "Message enqueued");
-    this.messageQueue.push(msg);
-    this.processQueue();
+}
+function renderTokens(tokens) {
+  return tokens.map((t) => renderToken(t)).join("");
+}
+function renderToken(t) {
+  if (!t || typeof t !== "object") return String(t ?? "");
+  switch (t.type) {
+    case "heading":
+      return renderHeading(t);
+    case "paragraph":
+      return renderInline(t.tokens) + "\n\n";
+    case "strong":
+      return chalk.bold(renderInline(t.tokens));
+    case "em":
+      return chalk.italic(renderInline(t.tokens));
+    case "del":
+      return chalk.dim.strikethrough(renderInline(t.tokens));
+    case "codespan":
+      return chalk.yellow(t.text);
+    case "code":
+      return renderCodeBlock(t);
+    case "list":
+      return renderList(t);
+    case "blockquote":
+      return renderBlockquote(t);
+    case "hr":
+      return chalk.dim("\u2500".repeat(50)) + "\n\n";
+    case "link":
+      return `${chalk.blue.underline(renderInline(t.tokens))} ${chalk.dim(`(${t.href})`)}`;
+    case "image":
+      return chalk.blue(`\u{1F5BC} ${t.title || t.href}`);
+    case "table":
+      return renderTable(t);
+    case "text":
+      if (t.tokens) return renderInline(t.tokens);
+      return t.text || "";
+    case "html":
+      return t.text || "";
+    case "space":
+      return "";
+    default:
+      return t.text || "";
   }
-  async processQueue() {
-    if (this.processing) return;
-    if (this.messageQueue.length === 0) return;
-    if (!this.lifecycle.is("idle")) return;
-    this.processing = true;
-    while (this.messageQueue.length > 0) {
-      const msg = this.messageQueue.shift();
-      try {
-        await this.handleMessage(msg);
-      } catch (err) {
-        logger.error({ err, msg: msg.content.slice(0, 50) }, "Failed to handle message");
+}
+function renderHeading(t) {
+  const text = renderInline(t.tokens);
+  if (t.depth === 1) return `
+${chalk.bold.cyan(text)}
+
+`;
+  if (t.depth === 2) return `
+${chalk.bold.cyan(`  \u25A0 ${text}`)}
+
+`;
+  return `
+${chalk.bold(`    \u25A0 ${text}`)}
+
+`;
+}
+function renderInline(tokens) {
+  if (!tokens) return "";
+  return tokens.map((t) => {
+    if (typeof t === "string") return t;
+    if (t.type === "strong") return chalk.bold(renderInline(t.tokens));
+    if (t.type === "em") return chalk.italic(renderInline(t.tokens));
+    if (t.type === "del") return chalk.dim.strikethrough(renderInline(t.tokens));
+    if (t.type === "codespan") return chalk.yellow(t.text);
+    if (t.type === "link") return `${chalk.blue.underline(renderInline(t.tokens))} ${chalk.dim(`(${t.href})`)}`;
+    if (t.type === "image") return chalk.blue(`\u{1F5BC} ${t.title || t.href}`);
+    if (t.type === "text") {
+      return t.tokens ? renderInline(t.tokens) : t.text || "";
+    }
+    if (t.type === "html") return t.text || "";
+    return t.text || "";
+  }).join("");
+}
+function renderCodeBlock(t) {
+  const lines = t.text.split("\n").map((l) => `${chalk.dim("  ")}${chalk.yellow(l)}`).join("\n");
+  const langStr = t.lang ? chalk.dim(` [${t.lang}]`) : "";
+  return `
+${langStr}
+${lines}
+
+`;
+}
+function renderList(t) {
+  const lines = [];
+  const items = t.items || [];
+  items.forEach((item, i) => {
+    const bullet = t.ordered ? `${i + 1}.` : "\u2022";
+    const firstLine = renderInline(item.tokens?.[0]?.tokens || [{ text: item.text }]);
+    lines.push(`  ${chalk.dim(bullet)} ${firstLine}`);
+    const restTokens = (item.tokens || []).slice(1);
+    for (const sub of restTokens) {
+      if (sub.type === "list") {
+        const subLines = renderList(sub).split("\n").filter(Boolean).map((l) => `    ${l}`).join("\n");
+        lines.push(subLines);
+      } else if (sub.type === "text") {
+        lines.push(`    ${chalk.dim("\u2022")} ${renderInline(sub.tokens)}`);
       }
     }
-    this.processing = false;
-  }
-  async birth() {
-    this.lifecycle.transition("birthing");
-    logger.info({ name: this.config.identity.name }, "Mercury is being born...");
-    this.lifecycle.transition("onboarding");
-  }
-  async wake() {
-    this.lifecycle.transition("onboarding");
-    this.lifecycle.transition("idle");
-    this.scheduler.restorePersistedTasks();
-    this.scheduler.startHeartbeat();
-    await this.channels.startAll();
-    this.running = true;
-    const activeChannels = this.channels.getActiveChannels();
-    const toolNames = this.capabilities.getToolNames();
-    logger.info({ channels: activeChannels, tools: toolNames }, "Mercury is awake");
+  });
+  return lines.join("\n") + "\n\n";
+}
+function renderBlockquote(t) {
+  const content = renderTokens(t.tokens || []);
+  const lines = content.split("\n").filter((l) => l.trim()).map((l) => `${chalk.dim("\u2502 ")}${chalk.gray(l)}`).join("\n");
+  return `
+${lines}
+
+`;
+}
+function renderTable(t) {
+  const headers = (t.header || []).map((h) => chalk.bold(renderInline(h.tokens)));
+  const colWidths = (t.header || []).map((h, i) => {
+    const hLen = (h.text || "").length;
+    const rowLens = (t.rows || []).map((row) => {
+      const cell = row[i];
+      return cell?.text?.length ?? 0;
+    });
+    return Math.max(hLen, ...rowLens) + 2;
+  });
+  const headerLine = headers.map((h, i) => h.padEnd(colWidths[i])).join(chalk.dim(" \u2502 "));
+  const separator = colWidths.map((w) => "\u2500".repeat(w)).join(chalk.dim("\u2500\u253C\u2500"));
+  const dataLines = (t.rows || []).map(
+    (row) => row.map((cell, i) => {
+      const text = renderInline(cell.tokens) || cell.text || "";
+      return text.padEnd(colWidths[i]);
+    }).join(chalk.dim(" \u2502 "))
+  );
+  return `
+${headerLine}
+${chalk.dim(separator)}
+${dataLines.join("\n")}
+
+`;
+}
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function mdToTelegram(text) {
+  let out = text;
+  const codeBlocks = [];
+  out = out.replace(/```(\w*)\n([\s\S]*?)```/g, (_match, lang, code) => {
+    const placeholder = `__CODEBLOCK_${codeBlocks.length}__`;
+    codeBlocks.push(`<pre><code class="${lang}">${escapeHtml(code)}</code></pre>`);
+    return placeholder;
+  });
+  const inlineCodes = [];
+  out = out.replace(/`([^`]+)`/g, (_match, code) => {
+    const placeholder = `__INLINECODE_${inlineCodes.length}__`;
+    inlineCodes.push(`<code>${escapeHtml(code)}</code>`);
+    return placeholder;
+  });
+  const links = [];
+  out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_match, label, href) => {
+    const placeholder = `__LINK_${links.length}__`;
+    links.push(`<a href="${escapeHtml(href)}">${escapeHtml(label)}</a>`);
+    return placeholder;
+  });
+  out = escapeHtml(out);
+  out = out.replace(/^### (.+)$/gm, "<b><i>$1</i></b>");
+  out = out.replace(/^## (.+)$/gm, "<b>$1</b>");
+  out = out.replace(/^# (.+)$/gm, "<b>$1</b>");
+  out = out.replace(/\*\*([^*]+)\*\*/g, "<b>$1</b>");
+  out = out.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g, "<i>$1</i>");
+  out = out.replace(/~~([^~]+)~~/g, "<s>$1</s>");
+  for (let i = 0; i < inlineCodes.length; i++) {
+    out = out.replace(`__INLINECODE_${i}__`, inlineCodes[i]);
   }
-  async sleep() {
-    this.running = false;
-    this.scheduler.stopAll();
-    await this.channels.stopAll();
-    this.lifecycle.transition("sleeping");
-    logger.info("Mercury is sleeping");
+  for (let i = 0; i < codeBlocks.length; i++) {
+    out = out.replace(`__CODEBLOCK_${i}__`, codeBlocks[i]);
   }
-  async handleMessage(msg) {
-    this.lifecycle.transition("thinking");
-    const startTime = Date.now();
-    const isInternal = msg.channelType === "internal";
-    const isScheduled = msg.senderId === "system" && msg.channelType !== "internal";
-    if (isInternal || isScheduled) {
-      this.capabilities.permissions.setAutoApproveAll(true);
+  for (let i = 0; i < links.length; i++) {
+    out = out.replace(`__LINK_${i}__`, links[i]);
+  }
+  if (out.length > 4096) {
+    out = out.slice(0, 4090) + "...";
+  }
+  return out;
+}
+
+// src/utils/arrow-select.ts
+import readline from "readline";
+import chalk2 from "chalk";
+var ArrowSelectCancelledError = class extends Error {
+  constructor(message = "Arrow select cancelled") {
+    super(message);
+    this.name = "ArrowSelectCancelledError";
+  }
+};
+async function selectWithArrowKeys(title, options, config = {}) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY || options.length === 0) {
+    return options[0]?.value ?? "";
+  }
+  readline.emitKeypressEvents(process.stdin);
+  const stdin = process.stdin;
+  const stdout = process.stdout;
+  const canUseRawMode = typeof stdin.setRawMode === "function";
+  const helperText = config.helperText || "Use the arrow keys, then press Enter.";
+  const maxVisibleOptions = Math.max(
+    1,
+    Math.min(
+      options.length,
+      config.maxVisibleOptions ?? Math.max(5, (stdout.rows || 12) - 7)
+    )
+  );
+  let activeIndex = 0;
+  let renderedLineCount = 0;
+  let windowStart = 0;
+  const topIndicator = (hasHiddenAbove) => hasHiddenAbove ? chalk2.dim("  \u2191 more") : "  ";
+  const bottomIndicator = (hasHiddenBelow) => hasHiddenBelow ? chalk2.dim("  \u2193 more") : "  ";
+  const writeLines = (lines) => {
+    if (renderedLineCount > 0) {
+      readline.moveCursor(stdout, 0, -(renderedLineCount - 1));
+    }
+    for (let index = 0; index < lines.length; index += 1) {
+      readline.cursorTo(stdout, 0);
+      readline.clearLine(stdout, 0);
+      stdout.write(lines[index]);
+      if (index < lines.length - 1) {
+        stdout.write("\n");
+      }
     }
-    try {
-      const trimmed = msg.content.trim();
-      if (trimmed.startsWith("/budget")) {
-        const subcommand = trimmed.slice("/budget".length).trim();
-        await this.handleBudgetCommand(subcommand || "status", msg.channelType, msg.channelId);
-        this.lifecycle.transition("idle");
-        return;
+  };
+  const render = () => {
+    if (activeIndex < windowStart) {
+      windowStart = activeIndex;
+    } else if (activeIndex >= windowStart + maxVisibleOptions) {
+      windowStart = activeIndex - maxVisibleOptions + 1;
+    }
+    const visibleOptions = options.slice(windowStart, windowStart + maxVisibleOptions);
+    const hasHiddenAbove = windowStart > 0;
+    const hasHiddenBelow = windowStart + maxVisibleOptions < options.length;
+    const lines = [
+      chalk2.bold.white(`  ${title}`),
+      chalk2.dim(`  ${helperText}`),
+      "",
+      topIndicator(hasHiddenAbove),
+      ...visibleOptions.map((option, visibleIndex) => {
+        const index = windowStart + visibleIndex;
+        const isActive = index === activeIndex;
+        const marker = isActive ? chalk2.cyanBright("\u25CF") : chalk2.dim("\xB7");
+        const text = isActive ? chalk2.cyanBright(option.label) : chalk2.dim(option.label);
+        return `  ${marker} ${text}`;
+      }),
+      bottomIndicator(hasHiddenBelow),
+      ""
+    ];
+    writeLines(lines);
+    renderedLineCount = lines.length;
+  };
+  return await new Promise((resolve13, reject) => {
+    const cleanup = () => {
+      stdin.off("keypress", onKeypress);
+      config.signal?.removeEventListener("abort", onAbort);
+      if (canUseRawMode) {
+        stdin.setRawMode(false);
       }
-      if (trimmed === "/budget_override") {
-        await this.handleBudgetCommand("override", msg.channelType, msg.channelId);
-        this.lifecycle.transition("idle");
+    };
+    const onAbort = () => {
+      cleanup();
+      reject(new ArrowSelectCancelledError());
+    };
+    const onKeypress = (_input, key) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        process.kill(process.pid, "SIGINT");
         return;
       }
-      if (trimmed === "/budget_reset") {
-        await this.handleBudgetCommand("reset", msg.channelType, msg.channelId);
-        this.lifecycle.transition("idle");
+      if (key.name === "up") {
+        activeIndex = (activeIndex - 1 + options.length) % options.length;
+        render();
         return;
       }
-      if (trimmed.startsWith("/budget_set")) {
-        const args = trimmed.slice("/budget_set".length).trim();
-        await this.handleBudgetCommand("set " + args, msg.channelType, msg.channelId);
-        this.lifecycle.transition("idle");
+      if (key.name === "down") {
+        activeIndex = (activeIndex + 1) % options.length;
+        render();
         return;
       }
-      if (trimmed.startsWith("/stream")) {
-        const sub = trimmed.slice("/stream".length).trim().toLowerCase();
-        if (sub === "off") {
-          this.telegramStreaming = false;
-        } else if (sub === "on") {
-          this.telegramStreaming = true;
-        } else {
-          this.telegramStreaming = !this.telegramStreaming;
-        }
-        const ch = this.channels.get(msg.channelType);
-        if (ch) await ch.send(
-          this.telegramStreaming ? "Telegram streaming enabled. Responses will appear progressively." : "Telegram streaming disabled. Responses will arrive as a single message.",
-          msg.channelId
-        );
-        this.lifecycle.transition("idle");
-        return;
+      if (key.name === "return") {
+        const selected = options[activeIndex]?.value ?? "";
+        cleanup();
+        stdout.write("\n");
+        resolve13(selected);
       }
-      if (await this.handleChatCommand(trimmed, msg.channelType, msg.channelId)) {
-        this.lifecycle.transition("idle");
+    };
+    if (canUseRawMode) {
+      stdin.setRawMode(true);
+    }
+    stdin.resume();
+    stdin.on("keypress", onKeypress);
+    config.signal?.addEventListener("abort", onAbort, { once: true });
+    if (config.signal?.aborted) {
+      onAbort();
+      return;
+    }
+    render();
+  });
+}
+
+// src/channels/cli.ts
+var CLIChannel = class extends BaseChannel {
+  type = "cli";
+  rl = null;
+  agentName;
+  menuDepth = 0;
+  menuAbortController = null;
+  outputInProgress = 0;
+  constructor(agentName = "Mercury") {
+    super();
+    this.agentName = agentName;
+  }
+  setAgentName(name) {
+    this.agentName = name;
+  }
+  async start() {
+    this.createInterface();
+    this.ready = true;
+    this.showPrompt();
+    logger.info("CLI channel started");
+  }
+  createInterface() {
+    this.rl = readline2.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      prompt: "  You: "
+    });
+    this.rl.on("line", (line) => {
+      const trimmed = line.trim();
+      if (!trimmed) {
+        this.showPrompt();
         return;
       }
-      if (this.tokenBudget.isOverBudget()) {
-        const channel2 = this.channels.getChannelForMessage(msg);
-        if (channel2 && msg.channelType !== "internal") {
-          if (msg.channelType === "cli") {
-            if (["1", "2", "3", "4"].includes(trimmed)) {
-              await this.handleBudgetCommand(trimmed, msg.channelType, msg.channelId);
-              this.lifecycle.transition("idle");
-              return;
-            }
-            await this.handleBudgetOverrideCLI(channel2, msg);
-          } else {
-            await channel2.send(
-              `I've exceeded my daily token budget (${this.tokenBudget.getStatusText()}).
-
-You can override this:
-\u2022 /budget override \u2014 allow one more request
-\u2022 /budget reset \u2014 reset usage to zero
-\u2022 /budget set <number> \u2014 change daily budget`,
-              msg.channelId
-            );
-          }
+      const msg = {
+        id: Date.now().toString(36),
+        channelId: "cli",
+        channelType: "cli",
+        senderId: "owner",
+        content: trimmed,
+        timestamp: Date.now()
+      };
+      this.emit(msg);
+    });
+  }
+  async stop() {
+    this.rl?.close();
+    this.rl = null;
+    this.ready = false;
+  }
+  async send(content, _targetId, elapsedMs) {
+    this.closeActiveMenu();
+    this.beginOutput();
+    const timeStr = elapsedMs != null ? chalk3.dim(` (${(elapsedMs / 1e3).toFixed(1)}s)`) : "";
+    const rendered = renderMarkdown(content);
+    console.log("");
+    console.log(chalk3.cyan(`  ${this.agentName}:`) + timeStr);
+    const indented = rendered.split("\n").map((line) => `  ${line}`).join("\n");
+    console.log(indented);
+    console.log("");
+    this.endOutput();
+  }
+  async sendFile(filePath, _targetId) {
+    this.closeActiveMenu();
+    this.beginOutput();
+    const resolved = path.resolve(filePath);
+    if (!fs.existsSync(resolved)) {
+      console.log(chalk3.red(`  File not found: ${filePath}`));
+      this.endOutput();
+      return;
+    }
+    const stat = fs.statSync(resolved);
+    const sizeStr = stat.size > 1024 * 1024 ? `${(stat.size / (1024 * 1024)).toFixed(1)}MB` : stat.size > 1024 ? `${(stat.size / 1024).toFixed(1)}KB` : `${stat.size}B`;
+    console.log("");
+    console.log(chalk3.cyan(`  ${this.agentName}:`) + chalk3.dim(" (file)"));
+    console.log(chalk3.dim(`  path: ${resolved}`));
+    console.log(chalk3.dim(`  size: ${sizeStr}`));
+    console.log("");
+    this.endOutput();
+  }
+  async stream(content, _targetId) {
+    this.closeActiveMenu();
+    this.beginOutput();
+    console.log("");
+    process.stdout.write(chalk3.cyan(`  ${this.agentName}: `));
+    let full = "";
+    for await (const chunk of content) {
+      process.stdout.write(chunk);
+      full += chunk;
+    }
+    console.log("\n");
+    this.endOutput();
+    return full;
+  }
+  async typing(_targetId) {
+    process.stdout.write(chalk3.dim(`  ${this.agentName} is thinking...\r`));
+  }
+  showPrompt() {
+    if (this.rl) {
+      this.rl.setPrompt("  You: ");
+      this.rl.prompt();
+    }
+  }
+  async withMenu(runner) {
+    this.menuDepth += 1;
+    this.menuAbortController = new AbortController();
+    this.suspendPrompt();
+    try {
+      return await runner((title, options) => selectWithArrowKeys(title, options, {
+        signal: this.menuAbortController?.signal
+      }));
+    } catch (error) {
+      if (error instanceof ArrowSelectCancelledError) {
+        return void 0;
+      }
+      throw error;
+    } finally {
+      this.menuDepth = Math.max(0, this.menuDepth - 1);
+      if (this.menuDepth === 0) {
+        this.menuAbortController = null;
+      }
+      if (this.menuDepth === 0) {
+        this.resumePrompt();
+        if (this.outputInProgress === 0) {
+          this.showPrompt();
         }
-        this.lifecycle.transition("idle");
-        return;
       }
-      const systemPrompt = this.buildSystemPrompt();
-      const recentMemory = this.shortTerm.getRecent(msg.channelId, 10);
+    }
+  }
+  closeActiveMenu() {
+    if (!this.menuAbortController?.signal.aborted) {
+      this.menuAbortController?.abort();
+    }
+  }
+  beginOutput() {
+    this.outputInProgress += 1;
+  }
+  endOutput() {
+    this.outputInProgress = Math.max(0, this.outputInProgress - 1);
+    if (this.menuDepth === 0 && this.outputInProgress === 0) {
+      this.showPrompt();
+    }
+  }
+  suspendPrompt() {
+    if (!this.rl) return;
+    process.stdout.write("\n");
+    this.rl.close();
+    this.rl = null;
+  }
+  resumePrompt() {
+    if (!this.ready || this.rl) return;
+    this.createInterface();
+  }
+  async prompt(question) {
+    return new Promise((resolve13) => {
+      this.rl?.question(question, (answer) => resolve13(answer.trim()));
+    });
+  }
+  async askPermission(prompt) {
+    return new Promise((resolve13) => {
+      console.log("");
+      console.log(chalk3.yellow(`  \u26A0 ${prompt}`));
+      this.rl?.question(chalk3.yellow("  > "), (answer) => {
+        resolve13(answer.trim());
+      });
+    });
+  }
+};
+
+// src/core/agent.ts
+var ToolCallLoopDetector = class {
+  recentCalls = [];
+  maxEntries = 10;
+  record(toolName, params) {
+    const paramsKey = JSON.stringify(params).slice(0, 100);
+    this.recentCalls.push({ tool: toolName, params: paramsKey });
+    if (this.recentCalls.length > this.maxEntries) {
+      this.recentCalls.shift();
+    }
+  }
+  detect() {
+    if (this.recentCalls.length < 3) return null;
+    const last = this.recentCalls[this.recentCalls.length - 1];
+    let consecutiveCount = 0;
+    for (let i = this.recentCalls.length - 1; i >= 0; i--) {
+      if (this.recentCalls[i].tool === last.tool && this.recentCalls[i].params === last.params) {
+        consecutiveCount++;
+      } else {
+        break;
+      }
+    }
+    if (consecutiveCount >= 3) {
+      return { tool: last.tool, count: consecutiveCount };
+    }
+    const lastTool = last.tool;
+    let toolCount = 0;
+    for (let i = this.recentCalls.length - 1; i >= 0; i--) {
+      if (this.recentCalls[i].tool === lastTool) {
+        toolCount++;
+      } else {
+        break;
+      }
+    }
+    if (toolCount >= 4) {
+      return { tool: lastTool, count: toolCount };
+    }
+    return null;
+  }
+  reset() {
+    this.recentCalls = [];
+  }
+};
+var MAX_STEPS = 10;
+var Agent = class {
+  constructor(config, providers, identity, shortTerm, longTerm, episodic, channels, tokenBudget, capabilities, scheduler) {
+    this.config = config;
+    this.providers = providers;
+    this.identity = identity;
+    this.shortTerm = shortTerm;
+    this.longTerm = longTerm;
+    this.episodic = episodic;
+    this.channels = channels;
+    this.tokenBudget = tokenBudget;
+    this.lifecycle = new Lifecycle();
+    this.scheduler = scheduler;
+    this.capabilities = capabilities;
+    this.telegramStreaming = config.channels.telegram.streaming ?? true;
+    this.scheduler.setOnScheduledTask(async (manifest) => this.handleScheduledTask(manifest));
+    this.channels.onIncomingMessage((msg) => this.enqueueMessage(msg));
+    this.scheduler.onHeartbeat(async () => {
+      await this.heartbeat();
+    });
+  }
+  config;
+  providers;
+  identity;
+  shortTerm;
+  longTerm;
+  episodic;
+  channels;
+  tokenBudget;
+  lifecycle;
+  scheduler;
+  capabilities;
+  running = false;
+  messageQueue = [];
+  processing = false;
+  telegramStreaming;
+  enqueueMessage(msg) {
+    logger.info({ from: msg.channelType, content: msg.content.slice(0, 50) }, "Message enqueued");
+    this.messageQueue.push(msg);
+    this.processQueue();
+  }
+  async processQueue() {
+    if (this.processing) return;
+    if (this.messageQueue.length === 0) return;
+    if (!this.lifecycle.is("idle")) return;
+    this.processing = true;
+    while (this.messageQueue.length > 0) {
+      const msg = this.messageQueue.shift();
+      try {
+        await this.handleMessage(msg);
+      } catch (err) {
+        logger.error({ err, msg: msg.content.slice(0, 50) }, "Failed to handle message");
+      }
+    }
+    this.processing = false;
+  }
+  async birth() {
+    this.lifecycle.transition("birthing");
+    logger.info({ name: this.config.identity.name }, "Mercury is being born...");
+    this.lifecycle.transition("onboarding");
+  }
+  async wake() {
+    this.lifecycle.transition("onboarding");
+    this.lifecycle.transition("idle");
+    this.scheduler.restorePersistedTasks();
+    this.scheduler.startHeartbeat();
+    await this.channels.startAll();
+    this.running = true;
+    const activeChannels = this.channels.getActiveChannels();
+    const toolNames = this.capabilities.getToolNames();
+    logger.info({ channels: activeChannels, tools: toolNames }, "Mercury is awake");
+  }
+  async sleep() {
+    this.running = false;
+    this.scheduler.stopAll();
+    await this.channels.stopAll();
+    this.lifecycle.transition("sleeping");
+    logger.info("Mercury is sleeping");
+  }
+  async handleMessage(msg) {
+    this.lifecycle.transition("thinking");
+    const startTime = Date.now();
+    const isInternal = msg.channelType === "internal";
+    const isScheduled = msg.senderId === "system" && msg.channelType !== "internal";
+    if (isInternal || isScheduled) {
+      this.capabilities.permissions.setAutoApproveAll(true);
+    }
+    try {
+      const trimmed = msg.content.trim();
+      if (trimmed.startsWith("/budget")) {
+        const subcommand = trimmed.slice("/budget".length).trim();
+        await this.handleBudgetCommand(subcommand || "status", msg.channelType, msg.channelId);
+        this.lifecycle.transition("idle");
+        return;
+      }
+      if (trimmed === "/budget_override") {
+        await this.handleBudgetCommand("override", msg.channelType, msg.channelId);
+        this.lifecycle.transition("idle");
+        return;
+      }
+      if (trimmed === "/budget_reset") {
+        await this.handleBudgetCommand("reset", msg.channelType, msg.channelId);
+        this.lifecycle.transition("idle");
+        return;
+      }
+      if (trimmed.startsWith("/budget_set")) {
+        const args = trimmed.slice("/budget_set".length).trim();
+        await this.handleBudgetCommand("set " + args, msg.channelType, msg.channelId);
+        this.lifecycle.transition("idle");
+        return;
+      }
+      if (trimmed.startsWith("/stream")) {
+        const sub = trimmed.slice("/stream".length).trim().toLowerCase();
+        if (sub === "off") {
+          this.telegramStreaming = false;
+        } else if (sub === "on") {
+          this.telegramStreaming = true;
+        } else {
+          this.telegramStreaming = !this.telegramStreaming;
+        }
+        const ch = this.channels.get(msg.channelType);
+        if (ch) await ch.send(
+          this.telegramStreaming ? "Telegram streaming enabled. Responses will appear progressively." : "Telegram streaming disabled. Responses will arrive as a single message.",
+          msg.channelId
+        );
+        this.lifecycle.transition("idle");
+        return;
+      }
+      if (await this.handleChatCommand(trimmed, msg.channelType, msg.channelId)) {
+        this.lifecycle.transition("idle");
+        return;
+      }
+      if (this.tokenBudget.isOverBudget()) {
+        const channel2 = this.channels.getChannelForMessage(msg);
+        if (channel2 && msg.channelType !== "internal") {
+          if (msg.channelType === "cli") {
+            if (["1", "2", "3", "4"].includes(trimmed)) {
+              await this.handleBudgetCommand(trimmed, msg.channelType, msg.channelId);
+              this.lifecycle.transition("idle");
+              return;
+            }
+            await this.handleBudgetOverrideCLI(channel2, msg);
+          } else {
+            await channel2.send(
+              `I've exceeded my daily token budget (${this.tokenBudget.getStatusText()}).
+
+You can override this:
+\u2022 /budget override \u2014 allow one more request
+\u2022 /budget reset \u2014 reset usage to zero
+\u2022 /budget set <number> \u2014 change daily budget`,
+              msg.channelId
+            );
+          }
+        }
+        this.lifecycle.transition("idle");
+        return;
+      }
+      const systemPrompt = this.buildSystemPrompt();
+      const recentMemory = this.shortTerm.getRecent(msg.channelId, 10);
       const relevantFacts = this.longTerm.search(msg.content, 3);
       const messages = [];
       const recentSteps = this.shortTerm.getRecent(msg.channelId, 4);
@@ -1364,7 +1996,8 @@ Or use /budget override, /budget reset, /budget set <number> anytime.`,
     }
   }
   async handleChatCommand(content, channelType, channelId) {
-    const cmd = content.toLowerCase().trim();
+    const trimmed = content.trim();
+    const cmd = trimmed.toLowerCase();
     const channel = this.channels.get(channelType);
     if (!channel) return false;
     const ctx = this.capabilities.getChatCommandContext();
@@ -1376,48 +2009,217 @@ Or use /budget override, /budget reset, /budget set <number> anytime.`,
     if (cmd === "/status") {
       const config = ctx.config();
       const budget = ctx.tokenBudget();
-      const telegramPairing = config.channels.telegram.pairedUserId != null ? `paired to user ${config.channels.telegram.pairedUserId}${config.channels.telegram.pairedUsername ? ` (@${config.channels.telegram.pairedUsername})` : ""}` : "unpaired";
       const lines = [
         `**${config.identity.name}** \u2014 Status`,
         `Owner: ${config.identity.owner || "(not set)"}`,
         `Provider: ${config.providers.default}`,
         `Telegram: ${config.channels.telegram.enabled ? "enabled" : "disabled"}`,
-        `Telegram pairing: ${telegramPairing}`,
+        `Telegram access: ${getTelegramAccessSummary(config)}`,
         `Budget: ${budget.getStatusText()}`,
         `Skills: ${ctx.skillNames().length > 0 ? ctx.skillNames().join(", ") : "none"}`
       ];
       await channel.send(lines.join("\n"), channelId);
       return true;
     }
-    if (cmd === "/tools") {
-      const tools = ctx.toolNames();
-      const grouped = [
-        `**${tools.length} tools loaded:**`,
-        "",
-        ...tools.sort().map((t) => `\u2022 \`${t}\``)
-      ];
-      await channel.send(grouped.join("\n"), channelId);
-      return true;
-    }
-    if (cmd === "/skills") {
-      const names = ctx.skillNames();
-      if (names.length === 0) {
-        await channel.send('No skills installed. Ask me to "install skill from <url>" to add one.', channelId);
-      } else {
+    if (cmd.startsWith("/telegram")) {
+      if (channelType !== "cli") {
+        await channel.send("`/telegram` is only available from the Mercury CLI chat.", channelId);
+        return true;
+      }
+      const config = ctx.config();
+      const rawSubcommand = trimmed.slice("/telegram".length).trim();
+      if (!rawSubcommand && channel instanceof CLIChannel) {
+        await channel.withMenu(async (select) => {
+          await this.openCliTelegramMenu(channel, channelId, select);
+        });
+        return true;
+      }
+      const parts = rawSubcommand.split(/\s+/).filter(Boolean);
+      const action = parts[0]?.toLowerCase() || "help";
+      const formatTelegramUser2 = (user) => {
+        const username = user.username ? ` (@${user.username})` : "";
+        const firstName = user.firstName ? ` ${user.firstName}` : "";
+        const pairingCode = user.pairingCode ? ` [code: ${user.pairingCode}]` : "";
+        return `${user.userId}${username}${firstName}${pairingCode}`;
+      };
+      const sendTelegramOverview = async () => {
         const lines = [
-          `**${names.length} skill${names.length > 1 ? "s" : ""} installed:**`,
+          "**Telegram Management**",
           "",
-          ...names.map((n) => `\u2022 ${n}`)
+          `Access: ${getTelegramAccessSummary(config)}`,
+          `Admins: ${config.channels.telegram.admins.length > 0 ? config.channels.telegram.admins.map(formatTelegramUser2).join(", ") : "none"}`,
+          `Members: ${config.channels.telegram.members.length > 0 ? config.channels.telegram.members.map(formatTelegramUser2).join(", ") : "none"}`,
+          `Pending: ${config.channels.telegram.pending.length > 0 ? config.channels.telegram.pending.map(formatTelegramUser2).join(", ") : "none"}`,
+          "",
+          "Commands:",
+          "\u2022 `/telegram pending`",
+          "\u2022 `/telegram users`",
+          "\u2022 `/telegram approve <pairing-code|user-id>`",
+          "\u2022 `/telegram reject <user-id>`",
+          "\u2022 `/telegram remove <user-id>`",
+          "\u2022 `/telegram promote <user-id>`",
+          "\u2022 `/telegram demote <user-id>`",
+          "\u2022 `/telegram reset`"
         ];
         await channel.send(lines.join("\n"), channelId);
+      };
+      if (action === "help" || action === "status") {
+        await sendTelegramOverview();
+        return true;
       }
-      return true;
-    }
-    if (cmd === "/stream on") {
-      this.telegramStreaming = true;
-      await channel.send("Telegram streaming enabled. Responses will appear progressively.", channelId);
-      return true;
-    }
+      if (action === "pending") {
+        const pending = getTelegramPendingRequests(config);
+        const lines = [
+          "**Telegram Pending Requests**",
+          "",
+          pending.length > 0 ? pending.map(formatTelegramUser2).join("\n") : "No pending Telegram requests."
+        ];
+        await channel.send(lines.join("\n"), channelId);
+        return true;
+      }
+      if (action === "users") {
+        const approved = getTelegramApprovedUsers(config);
+        const lines = [
+          "**Telegram Approved Users**",
+          "",
+          `Admins: ${config.channels.telegram.admins.length > 0 ? config.channels.telegram.admins.map(formatTelegramUser2).join(", ") : "none"}`,
+          `Members: ${config.channels.telegram.members.length > 0 ? config.channels.telegram.members.map(formatTelegramUser2).join(", ") : "none"}`,
+          "",
+          `Total approved: ${approved.length}`
+        ];
+        await channel.send(lines.join("\n"), channelId);
+        return true;
+      }
+      if (action === "approve") {
+        const value = parts[1];
+        if (!value) {
+          await channel.send("Usage: `/telegram approve <pairing-code|user-id>`", channelId);
+          return true;
+        }
+        let approved = approveTelegramPendingRequestByPairingCode(config, value);
+        let resultLabel = value;
+        if (!approved) {
+          const userId = Number(value);
+          if (!isNaN(userId)) {
+            approved = approveTelegramPendingRequest(config, userId, "member");
+            resultLabel = userId.toString();
+          }
+        }
+        if (!approved) {
+          await channel.send(`No pending Telegram request found for \`${resultLabel}\`.`, channelId);
+          return true;
+        }
+        saveConfig(config);
+        await channel.send(`Approved Telegram user ${formatTelegramUser2(approved)}.`, channelId);
+        return true;
+      }
+      if (action === "reject") {
+        const value = Number(parts[1]);
+        if (isNaN(value)) {
+          await channel.send("Usage: `/telegram reject <user-id>`", channelId);
+          return true;
+        }
+        const rejected = rejectTelegramPendingRequest(config, value);
+        if (!rejected) {
+          await channel.send(`No pending Telegram request found for \`${value}\`.`, channelId);
+          return true;
+        }
+        saveConfig(config);
+        await channel.send(`Rejected Telegram request for ${formatTelegramUser2(rejected)}.`, channelId);
+        return true;
+      }
+      if (action === "remove") {
+        const value = Number(parts[1]);
+        if (isNaN(value)) {
+          await channel.send("Usage: `/telegram remove <user-id>`", channelId);
+          return true;
+        }
+        const removed = removeTelegramUser(config, value);
+        if (!removed) {
+          await channel.send(`No approved Telegram user found for \`${value}\`.`, channelId);
+          return true;
+        }
+        saveConfig(config);
+        await channel.send(`Removed Telegram access for ${formatTelegramUser2(removed)}.`, channelId);
+        return true;
+      }
+      if (action === "promote") {
+        const value = Number(parts[1]);
+        if (isNaN(value)) {
+          await channel.send("Usage: `/telegram promote <user-id>`", channelId);
+          return true;
+        }
+        const promoted = promoteTelegramUserToAdmin(config, value);
+        if (!promoted) {
+          await channel.send(`No Telegram member found for \`${value}\`.`, channelId);
+          return true;
+        }
+        saveConfig(config);
+        await channel.send(`Promoted ${formatTelegramUser2(promoted)} to Telegram admin.`, channelId);
+        return true;
+      }
+      if (action === "demote") {
+        const value = Number(parts[1]);
+        if (isNaN(value)) {
+          await channel.send("Usage: `/telegram demote <user-id>`", channelId);
+          return true;
+        }
+        const demoted = demoteTelegramAdmin(config, value);
+        if (!demoted) {
+          await channel.send("Could not demote that Telegram admin. Mercury must keep at least one admin.", channelId);
+          return true;
+        }
+        saveConfig(config);
+        await channel.send(`Demoted ${formatTelegramUser2(demoted)} to Telegram member.`, channelId);
+        return true;
+      }
+      if (action === "reset" || action === "unpair") {
+        config.channels.telegram.admins = [];
+        config.channels.telegram.members = [];
+        config.channels.telegram.pending = [];
+        saveConfig(config);
+        await channel.send("Telegram access reset. New users can send /start to begin pairing again.", channelId);
+        return true;
+      }
+      await channel.send(
+        `Unknown Telegram command "${action}". Try \`/telegram\`, \`/telegram pending\`, or \`/telegram users\`.`,
+        channelId
+      );
+      return true;
+    }
+    if ((cmd === "/" || cmd === "/menu") && channelType === "cli" && channel instanceof CLIChannel) {
+      await this.openCliCommandMenu(channel, channelId);
+      return true;
+    }
+    if (cmd === "/tools") {
+      const tools = ctx.toolNames();
+      const grouped = [
+        `**${tools.length} tools loaded:**`,
+        "",
+        ...tools.sort().map((t) => `\u2022 \`${t}\``)
+      ];
+      await channel.send(grouped.join("\n"), channelId);
+      return true;
+    }
+    if (cmd === "/skills") {
+      const names = ctx.skillNames();
+      if (names.length === 0) {
+        await channel.send('No skills installed. Ask me to "install skill from <url>" to add one.', channelId);
+      } else {
+        const lines = [
+          `**${names.length} skill${names.length > 1 ? "s" : ""} installed:**`,
+          "",
+          ...names.map((n) => `\u2022 ${n}`)
+        ];
+        await channel.send(lines.join("\n"), channelId);
+      }
+      return true;
+    }
+    if (cmd === "/stream on") {
+      this.telegramStreaming = true;
+      await channel.send("Telegram streaming enabled. Responses will appear progressively.", channelId);
+      return true;
+    }
     if (cmd === "/stream off") {
       this.telegramStreaming = false;
       await channel.send("Telegram streaming disabled. Responses will arrive as a single message.", channelId);
@@ -1438,6 +2240,205 @@ Or use /budget override, /budget reset, /budget set <number> anytime.`,
     }
     return false;
   }
+  async openCliCommandMenu(channel, channelId) {
+    const ctx = this.capabilities.getChatCommandContext();
+    if (!ctx) return;
+    await channel.withMenu(async (select) => {
+      while (true) {
+        const streamLabel = this.telegramStreaming ? "Disable Telegram Streaming" : "Enable Telegram Streaming";
+        const action = await select("Mercury Commands", [
+          { value: "status", label: "Status" },
+          { value: "telegram", label: "Telegram" },
+          { value: "tools", label: "Tools" },
+          { value: "skills", label: "Skills" },
+          { value: "stream", label: streamLabel },
+          { value: "help", label: "Help" },
+          { value: "exit", label: "Exit" }
+        ]);
+        if (action === "exit") {
+          return;
+        }
+        if (action === "status") {
+          await this.handleChatCommand("/status", "cli", channelId);
+          continue;
+        }
+        if (action === "telegram") {
+          await this.openCliTelegramMenu(channel, channelId, select);
+          continue;
+        }
+        if (action === "tools") {
+          await this.handleChatCommand("/tools", "cli", channelId);
+          continue;
+        }
+        if (action === "skills") {
+          await this.handleChatCommand("/skills", "cli", channelId);
+          continue;
+        }
+        if (action === "stream") {
+          await this.handleChatCommand("/stream", "cli", channelId);
+          continue;
+        }
+        if (action === "help") {
+          await channel.send(ctx.manual(), channelId);
+        }
+      }
+    });
+  }
+  async openCliTelegramMenu(channel, channelId, select) {
+    const ctx = this.capabilities.getChatCommandContext();
+    if (!ctx) return;
+    const formatTelegramUser2 = (user) => {
+      const username = user.username ? ` (@${user.username})` : "";
+      const firstName = user.firstName ? ` ${user.firstName}` : "";
+      const pairingCode = user.pairingCode ? ` [code: ${user.pairingCode}]` : "";
+      return `${user.userId}${username}${firstName}${pairingCode}`;
+    };
+    const selectFromUsers = async (title, users, emptyMessage, backValue = "back") => {
+      if (users.length === 0) {
+        await channel.send(emptyMessage, channelId);
+        return backValue;
+      }
+      return select(title, [
+        ...users.map((user) => ({
+          value: user.pairingCode || user.userId.toString(),
+          label: formatTelegramUser2(user)
+        })),
+        { value: backValue, label: "Back" }
+      ]);
+    };
+    while (true) {
+      const config = ctx.config();
+      const action = await select("Telegram Commands", [
+        { value: "overview", label: "Overview" },
+        { value: "pending", label: `Pending Requests (${config.channels.telegram.pending.length})` },
+        { value: "users", label: `Approved Users (${getTelegramApprovedUsers(config).length})` },
+        { value: "approve", label: "Approve Request" },
+        { value: "reject", label: "Reject Request" },
+        { value: "remove", label: "Remove User" },
+        { value: "promote", label: "Promote to Admin" },
+        { value: "demote", label: "Demote Admin" },
+        { value: "reset", label: "Reset Telegram Access" },
+        { value: "back", label: "Back" },
+        { value: "exit", label: "Exit" }
+      ]);
+      if (action === "exit") {
+        return;
+      }
+      if (action === "back") {
+        return;
+      }
+      if (action === "overview") {
+        await this.handleChatCommand("/telegram status", "cli", channelId);
+        continue;
+      }
+      if (action === "pending") {
+        await this.handleChatCommand("/telegram pending", "cli", channelId);
+        continue;
+      }
+      if (action === "users") {
+        await this.handleChatCommand("/telegram users", "cli", channelId);
+        continue;
+      }
+      if (action === "approve") {
+        const pending = getTelegramPendingRequests(config);
+        const selected = await selectFromUsers(
+          "Approve Telegram Request",
+          pending,
+          "There are no pending Telegram requests to approve."
+        );
+        if (selected === "back") {
+          continue;
+        }
+        await this.handleChatCommand(`/telegram approve ${selected}`, "cli", channelId);
+        continue;
+      }
+      if (action === "reject") {
+        const pending = getTelegramPendingRequests(config);
+        const selected = await selectFromUsers(
+          "Reject Telegram Request",
+          pending,
+          "There are no pending Telegram requests to reject."
+        );
+        if (selected === "back") {
+          continue;
+        }
+        const request = pending.find((entry) => (entry.pairingCode || entry.userId.toString()) === selected);
+        if (!request) {
+          await channel.send("That Telegram request is no longer pending.", channelId);
+          continue;
+        }
+        await this.handleChatCommand(`/telegram reject ${request.userId}`, "cli", channelId);
+        continue;
+      }
+      if (action === "remove") {
+        const approved = getTelegramApprovedUsers(config);
+        const selected = await selectFromUsers(
+          "Remove Telegram User",
+          approved,
+          "There are no approved Telegram users to remove."
+        );
+        if (selected === "back") {
+          continue;
+        }
+        const user = approved.find((entry) => entry.userId.toString() === selected);
+        if (!user) {
+          await channel.send("That Telegram user is no longer approved.", channelId);
+          continue;
+        }
+        await this.handleChatCommand(`/telegram remove ${user.userId}`, "cli", channelId);
+        continue;
+      }
+      if (action === "promote") {
+        const members = config.channels.telegram.members;
+        const selected = await selectFromUsers(
+          "Promote Telegram Member",
+          members,
+          "There are no Telegram members available to promote."
+        );
+        if (selected === "back") {
+          continue;
+        }
+        const member = members.find((entry) => entry.userId.toString() === selected);
+        if (!member) {
+          await channel.send("That Telegram member is no longer available.", channelId);
+          continue;
+        }
+        await this.handleChatCommand(`/telegram promote ${member.userId}`, "cli", channelId);
+        continue;
+      }
+      if (action === "demote") {
+        const admins = config.channels.telegram.admins;
+        const selected = await selectFromUsers(
+          "Demote Telegram Admin",
+          admins,
+          "There are no Telegram admins available to demote."
+        );
+        if (selected === "back") {
+          continue;
+        }
+        const admin = admins.find((entry) => entry.userId.toString() === selected);
+        if (!admin) {
+          await channel.send("That Telegram admin is no longer available.", channelId);
+          continue;
+        }
+        await this.handleChatCommand(`/telegram demote ${admin.userId}`, "cli", channelId);
+        continue;
+      }
+      if (action === "reset") {
+        const confirmation = await select("Reset Telegram Access?", [
+          { value: "cancel", label: "Cancel" },
+          { value: "confirm", label: "Reset all Telegram access" },
+          { value: "back", label: "Back" }
+        ]);
+        if (confirmation === "confirm") {
+          clearTelegramAccess(config);
+          saveConfig(config);
+          await channel.send("Telegram access reset. New users can send /start to begin pairing again.", channelId);
+        }
+        continue;
+      }
+    }
+  }
 };
 
 // src/core/scheduler.ts
@@ -1496,437 +2497,117 @@ var Scheduler = class {
         await this.heartbeatHandler?.();
       } catch (err) {
         logger.error({ err }, "Heartbeat error");
-      }
-    }, ms);
-  }
-  stopHeartbeat() {
-    if (this.heartbeatTimer) {
-      clearInterval(this.heartbeatTimer);
-      this.heartbeatTimer = null;
-      logger.info("Heartbeat stopped");
-    }
-  }
-  addTask(task) {
-    if (this.tasks.has(task.id)) {
-      this.removeTask(task.id);
-    }
-    const scheduled = cron.schedule(task.cron, async () => {
-      try {
-        await task.handler();
-      } catch (err) {
-        logger.error({ task: task.id, err }, "Scheduled task error");
-      }
-    });
-    this.tasks.set(task.id, scheduled);
-    logger.info({ id: task.id, cron: task.cron, desc: task.description }, "Task scheduled");
-  }
-  addPersistedTask(manifest) {
-    this.taskManifests.set(manifest.id, manifest);
-    this.addTask({
-      id: manifest.id,
-      cron: manifest.cron,
-      description: manifest.description,
-      handler: async () => {
-        logger.info({ task: manifest.id }, "Scheduled task firing");
-        if (this.onScheduledTask) {
-          await this.onScheduledTask(manifest);
-        }
-      }
-    });
-  }
-  addDelayedTask(manifest) {
-    this.taskManifests.set(manifest.id, manifest);
-    const delayMs = (manifest.delaySeconds || 60) * 1e3;
-    const timer = setTimeout(async () => {
-      try {
-        logger.info({ task: manifest.id }, "Delayed task firing");
-        if (this.onScheduledTask) {
-          await this.onScheduledTask(manifest);
-        }
-      } catch (err) {
-        logger.error({ task: manifest.id, err }, "Delayed task error");
-      } finally {
-        this.delayedTasks.delete(manifest.id);
-        this.taskManifests.delete(manifest.id);
-        this.persistSchedules();
-      }
-    }, delayMs);
-    this.delayedTasks.set(manifest.id, timer);
-    logger.info({ id: manifest.id, delaySeconds: manifest.delaySeconds }, "Delayed task scheduled");
-  }
-  removeTask(id) {
-    const task = this.tasks.get(id);
-    if (task) {
-      task.stop();
-      this.tasks.delete(id);
-    }
-    const timer = this.delayedTasks.get(id);
-    if (timer) {
-      clearTimeout(timer);
-      this.delayedTasks.delete(id);
-    }
-    this.taskManifests.delete(id);
-  }
-  getManifests() {
-    return [...this.taskManifests.values()];
-  }
-  restorePersistedTasks() {
-    const persisted = loadSchedules();
-    for (const manifest of persisted) {
-      if (manifest.delaySeconds) {
-        const executeAt = manifest.executeAt ? new Date(manifest.executeAt) : null;
-        const now = Date.now();
-        if (executeAt && executeAt.getTime() > now) {
-          const remainingMs = executeAt.getTime() - now;
-          manifest.delaySeconds = Math.ceil(remainingMs / 1e3);
-          this.addDelayedTask(manifest);
-        } else {
-          logger.info({ id: manifest.id }, "Delayed task already expired, skipping");
-        }
-      } else if (manifest.cron && cron.validate(manifest.cron)) {
-        this.addPersistedTask(manifest);
-      } else {
-        logger.warn({ id: manifest.id, cron: manifest.cron }, "Skipping invalid task");
-      }
-    }
-    if (persisted.length > 0) {
-      logger.info({ count: persisted.length }, "Restored persisted scheduled tasks");
-    }
-  }
-  persistSchedules() {
-    saveSchedules(this.getManifests());
-  }
-  stopAll() {
-    this.stopHeartbeat();
-    for (const [, task] of this.tasks) {
-      task.stop();
-    }
-    for (const [, timer] of this.delayedTasks) {
-      clearTimeout(timer);
-    }
-    this.tasks.clear();
-    this.delayedTasks.clear();
-    this.taskManifests.clear();
-  }
-};
-
-// src/channels/cli.ts
-import readline from "readline";
-import fs from "fs";
-import path from "path";
-import chalk2 from "chalk";
-
-// src/channels/base.ts
-var BaseChannel = class {
-  messageHandler;
-  ready = false;
-  isReady() {
-    return this.ready;
-  }
-  onMessage(handler) {
-    this.messageHandler = handler;
-  }
-  emit(message) {
-    this.messageHandler?.(message);
-  }
-};
-
-// src/utils/markdown.ts
-import { Marked } from "marked";
-import chalk from "chalk";
-var lexer = new Marked();
-function renderMarkdown(text) {
-  try {
-    const tokens = lexer.lexer(text);
-    const result = renderTokens(tokens);
-    return result.replace(/\n{3,}/g, "\n\n").trimEnd();
-  } catch {
-    return text;
-  }
-}
-function renderTokens(tokens) {
-  return tokens.map((t) => renderToken(t)).join("");
-}
-function renderToken(t) {
-  if (!t || typeof t !== "object") return String(t ?? "");
-  switch (t.type) {
-    case "heading":
-      return renderHeading(t);
-    case "paragraph":
-      return renderInline(t.tokens) + "\n\n";
-    case "strong":
-      return chalk.bold(renderInline(t.tokens));
-    case "em":
-      return chalk.italic(renderInline(t.tokens));
-    case "del":
-      return chalk.dim.strikethrough(renderInline(t.tokens));
-    case "codespan":
-      return chalk.yellow(t.text);
-    case "code":
-      return renderCodeBlock(t);
-    case "list":
-      return renderList(t);
-    case "blockquote":
-      return renderBlockquote(t);
-    case "hr":
-      return chalk.dim("\u2500".repeat(50)) + "\n\n";
-    case "link":
-      return `${chalk.blue.underline(renderInline(t.tokens))} ${chalk.dim(`(${t.href})`)}`;
-    case "image":
-      return chalk.blue(`\u{1F5BC} ${t.title || t.href}`);
-    case "table":
-      return renderTable(t);
-    case "text":
-      if (t.tokens) return renderInline(t.tokens);
-      return t.text || "";
-    case "html":
-      return t.text || "";
-    case "space":
-      return "";
-    default:
-      return t.text || "";
-  }
-}
-function renderHeading(t) {
-  const text = renderInline(t.tokens);
-  if (t.depth === 1) return `
-${chalk.bold.cyan(text)}
-
-`;
-  if (t.depth === 2) return `
-${chalk.bold.cyan(`  \u25A0 ${text}`)}
-
-`;
-  return `
-${chalk.bold(`    \u25A0 ${text}`)}
-
-`;
-}
-function renderInline(tokens) {
-  if (!tokens) return "";
-  return tokens.map((t) => {
-    if (typeof t === "string") return t;
-    if (t.type === "strong") return chalk.bold(renderInline(t.tokens));
-    if (t.type === "em") return chalk.italic(renderInline(t.tokens));
-    if (t.type === "del") return chalk.dim.strikethrough(renderInline(t.tokens));
-    if (t.type === "codespan") return chalk.yellow(t.text);
-    if (t.type === "link") return `${chalk.blue.underline(renderInline(t.tokens))} ${chalk.dim(`(${t.href})`)}`;
-    if (t.type === "image") return chalk.blue(`\u{1F5BC} ${t.title || t.href}`);
-    if (t.type === "text") {
-      return t.tokens ? renderInline(t.tokens) : t.text || "";
-    }
-    if (t.type === "html") return t.text || "";
-    return t.text || "";
-  }).join("");
-}
-function renderCodeBlock(t) {
-  const lines = t.text.split("\n").map((l) => `${chalk.dim("  ")}${chalk.yellow(l)}`).join("\n");
-  const langStr = t.lang ? chalk.dim(` [${t.lang}]`) : "";
-  return `
-${langStr}
-${lines}
-
-`;
-}
-function renderList(t) {
-  const lines = [];
-  const items = t.items || [];
-  items.forEach((item, i) => {
-    const bullet = t.ordered ? `${i + 1}.` : "\u2022";
-    const firstLine = renderInline(item.tokens?.[0]?.tokens || [{ text: item.text }]);
-    lines.push(`  ${chalk.dim(bullet)} ${firstLine}`);
-    const restTokens = (item.tokens || []).slice(1);
-    for (const sub of restTokens) {
-      if (sub.type === "list") {
-        const subLines = renderList(sub).split("\n").filter(Boolean).map((l) => `    ${l}`).join("\n");
-        lines.push(subLines);
-      } else if (sub.type === "text") {
-        lines.push(`    ${chalk.dim("\u2022")} ${renderInline(sub.tokens)}`);
-      }
-    }
-  });
-  return lines.join("\n") + "\n\n";
-}
-function renderBlockquote(t) {
-  const content = renderTokens(t.tokens || []);
-  const lines = content.split("\n").filter((l) => l.trim()).map((l) => `${chalk.dim("\u2502 ")}${chalk.gray(l)}`).join("\n");
-  return `
-${lines}
-
-`;
-}
-function renderTable(t) {
-  const headers = (t.header || []).map((h) => chalk.bold(renderInline(h.tokens)));
-  const colWidths = (t.header || []).map((h, i) => {
-    const hLen = (h.text || "").length;
-    const rowLens = (t.rows || []).map((row) => {
-      const cell = row[i];
-      return cell?.text?.length ?? 0;
-    });
-    return Math.max(hLen, ...rowLens) + 2;
-  });
-  const headerLine = headers.map((h, i) => h.padEnd(colWidths[i])).join(chalk.dim(" \u2502 "));
-  const separator = colWidths.map((w) => "\u2500".repeat(w)).join(chalk.dim("\u2500\u253C\u2500"));
-  const dataLines = (t.rows || []).map(
-    (row) => row.map((cell, i) => {
-      const text = renderInline(cell.tokens) || cell.text || "";
-      return text.padEnd(colWidths[i]);
-    }).join(chalk.dim(" \u2502 "))
-  );
-  return `
-${headerLine}
-${chalk.dim(separator)}
-${dataLines.join("\n")}
-
-`;
-}
-function escapeHtml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function mdToTelegram(text) {
-  let out = text;
-  const codeBlocks = [];
-  out = out.replace(/```(\w*)\n([\s\S]*?)```/g, (_match, lang, code) => {
-    const placeholder = `__CODEBLOCK_${codeBlocks.length}__`;
-    codeBlocks.push(`<pre><code class="${lang}">${escapeHtml(code)}</code></pre>`);
-    return placeholder;
-  });
-  const inlineCodes = [];
-  out = out.replace(/`([^`]+)`/g, (_match, code) => {
-    const placeholder = `__INLINECODE_${inlineCodes.length}__`;
-    inlineCodes.push(`<code>${escapeHtml(code)}</code>`);
-    return placeholder;
-  });
-  const links = [];
-  out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_match, label, href) => {
-    const placeholder = `__LINK_${links.length}__`;
-    links.push(`<a href="${escapeHtml(href)}">${escapeHtml(label)}</a>`);
-    return placeholder;
-  });
-  out = escapeHtml(out);
-  out = out.replace(/^### (.+)$/gm, "<b><i>$1</i></b>");
-  out = out.replace(/^## (.+)$/gm, "<b>$1</b>");
-  out = out.replace(/^# (.+)$/gm, "<b>$1</b>");
-  out = out.replace(/\*\*([^*]+)\*\*/g, "<b>$1</b>");
-  out = out.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g, "<i>$1</i>");
-  out = out.replace(/~~([^~]+)~~/g, "<s>$1</s>");
-  for (let i = 0; i < inlineCodes.length; i++) {
-    out = out.replace(`__INLINECODE_${i}__`, inlineCodes[i]);
-  }
-  for (let i = 0; i < codeBlocks.length; i++) {
-    out = out.replace(`__CODEBLOCK_${i}__`, codeBlocks[i]);
-  }
-  for (let i = 0; i < links.length; i++) {
-    out = out.replace(`__LINK_${i}__`, links[i]);
-  }
-  if (out.length > 4096) {
-    out = out.slice(0, 4090) + "...";
-  }
-  return out;
-}
-
-// src/channels/cli.ts
-var CLIChannel = class extends BaseChannel {
-  type = "cli";
-  rl = null;
-  agentName;
-  constructor(agentName = "Mercury") {
-    super();
-    this.agentName = agentName;
+      }
+    }, ms);
   }
-  setAgentName(name) {
-    this.agentName = name;
+  stopHeartbeat() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+      logger.info("Heartbeat stopped");
+    }
   }
-  async start() {
-    this.rl = readline.createInterface({
-      input: process.stdin,
-      output: process.stdout,
-      prompt: "  You: "
-    });
-    this.rl.on("line", (line) => {
-      const trimmed = line.trim();
-      if (!trimmed) {
-        this.showPrompt();
-        return;
+  addTask(task) {
+    if (this.tasks.has(task.id)) {
+      this.removeTask(task.id);
+    }
+    const scheduled = cron.schedule(task.cron, async () => {
+      try {
+        await task.handler();
+      } catch (err) {
+        logger.error({ task: task.id, err }, "Scheduled task error");
       }
-      const msg = {
-        id: Date.now().toString(36),
-        channelId: "cli",
-        channelType: "cli",
-        senderId: "owner",
-        content: trimmed,
-        timestamp: Date.now()
-      };
-      this.emit(msg);
     });
-    this.ready = true;
-    this.showPrompt();
-    logger.info("CLI channel started");
+    this.tasks.set(task.id, scheduled);
+    logger.info({ id: task.id, cron: task.cron, desc: task.description }, "Task scheduled");
   }
-  async stop() {
-    this.rl?.close();
-    this.rl = null;
-    this.ready = false;
+  addPersistedTask(manifest) {
+    this.taskManifests.set(manifest.id, manifest);
+    this.addTask({
+      id: manifest.id,
+      cron: manifest.cron,
+      description: manifest.description,
+      handler: async () => {
+        logger.info({ task: manifest.id }, "Scheduled task firing");
+        if (this.onScheduledTask) {
+          await this.onScheduledTask(manifest);
+        }
+      }
+    });
   }
-  async send(content, _targetId, elapsedMs) {
-    const timeStr = elapsedMs != null ? chalk2.dim(` (${(elapsedMs / 1e3).toFixed(1)}s)`) : "";
-    const rendered = renderMarkdown(content);
-    console.log("");
-    console.log(chalk2.cyan(`  ${this.agentName}:`) + timeStr);
-    const indented = rendered.split("\n").map((line) => `  ${line}`).join("\n");
-    console.log(indented);
-    console.log("");
-    this.showPrompt();
+  addDelayedTask(manifest) {
+    this.taskManifests.set(manifest.id, manifest);
+    const delayMs = (manifest.delaySeconds || 60) * 1e3;
+    const timer = setTimeout(async () => {
+      try {
+        logger.info({ task: manifest.id }, "Delayed task firing");
+        if (this.onScheduledTask) {
+          await this.onScheduledTask(manifest);
+        }
+      } catch (err) {
+        logger.error({ task: manifest.id, err }, "Delayed task error");
+      } finally {
+        this.delayedTasks.delete(manifest.id);
+        this.taskManifests.delete(manifest.id);
+        this.persistSchedules();
+      }
+    }, delayMs);
+    this.delayedTasks.set(manifest.id, timer);
+    logger.info({ id: manifest.id, delaySeconds: manifest.delaySeconds }, "Delayed task scheduled");
   }
-  async sendFile(filePath, _targetId) {
-    const resolved = path.resolve(filePath);
-    if (!fs.existsSync(resolved)) {
-      console.log(chalk2.red(`  File not found: ${filePath}`));
-      return;
+  removeTask(id) {
+    const task = this.tasks.get(id);
+    if (task) {
+      task.stop();
+      this.tasks.delete(id);
     }
-    const stat = fs.statSync(resolved);
-    const sizeStr = stat.size > 1024 * 1024 ? `${(stat.size / (1024 * 1024)).toFixed(1)}MB` : stat.size > 1024 ? `${(stat.size / 1024).toFixed(1)}KB` : `${stat.size}B`;
-    console.log("");
-    console.log(chalk2.cyan(`  ${this.agentName}:`) + chalk2.dim(" (file)"));
-    console.log(chalk2.dim(`  path: ${resolved}`));
-    console.log(chalk2.dim(`  size: ${sizeStr}`));
-    console.log("");
-    this.showPrompt();
-  }
-  async stream(content, _targetId) {
-    console.log("");
-    process.stdout.write(chalk2.cyan(`  ${this.agentName}: `));
-    let full = "";
-    for await (const chunk of content) {
-      process.stdout.write(chunk);
-      full += chunk;
+    const timer = this.delayedTasks.get(id);
+    if (timer) {
+      clearTimeout(timer);
+      this.delayedTasks.delete(id);
     }
-    console.log("\n");
-    this.showPrompt();
-    return full;
+    this.taskManifests.delete(id);
   }
-  async typing(_targetId) {
-    process.stdout.write(chalk2.dim(`  ${this.agentName} is thinking...\r`));
+  getManifests() {
+    return [...this.taskManifests.values()];
   }
-  showPrompt() {
-    if (this.rl) {
-      this.rl.setPrompt("  You: ");
-      this.rl.prompt();
+  restorePersistedTasks() {
+    const persisted = loadSchedules();
+    for (const manifest of persisted) {
+      if (manifest.delaySeconds) {
+        const executeAt = manifest.executeAt ? new Date(manifest.executeAt) : null;
+        const now = Date.now();
+        if (executeAt && executeAt.getTime() > now) {
+          const remainingMs = executeAt.getTime() - now;
+          manifest.delaySeconds = Math.ceil(remainingMs / 1e3);
+          this.addDelayedTask(manifest);
+        } else {
+          logger.info({ id: manifest.id }, "Delayed task already expired, skipping");
+        }
+      } else if (manifest.cron && cron.validate(manifest.cron)) {
+        this.addPersistedTask(manifest);
+      } else {
+        logger.warn({ id: manifest.id, cron: manifest.cron }, "Skipping invalid task");
+      }
+    }
+    if (persisted.length > 0) {
+      logger.info({ count: persisted.length }, "Restored persisted scheduled tasks");
     }
   }
-  async prompt(question) {
-    return new Promise((resolve13) => {
-      this.rl?.question(question, (answer) => resolve13(answer.trim()));
-    });
+  persistSchedules() {
+    saveSchedules(this.getManifests());
   }
-  async askPermission(prompt) {
-    return new Promise((resolve13) => {
-      console.log("");
-      console.log(chalk2.yellow(`  \u26A0 ${prompt}`));
-      this.rl?.question(chalk2.yellow("  > "), (answer) => {
-        resolve13(answer.trim());
-      });
-    });
+  stopAll() {
+    this.stopHeartbeat();
+    for (const [, task] of this.tasks) {
+      task.stop();
+    }
+    for (const [, timer] of this.delayedTasks) {
+      clearTimeout(timer);
+    }
+    this.tasks.clear();
+    this.delayedTasks.clear();
+    this.taskManifests.clear();
   }
 };
 
@@ -1936,16 +2617,16 @@ import path2 from "path";
 import { Bot, InputFile, InlineKeyboard } from "grammy";
 import { autoRetry } from "@grammyjs/auto-retry";
 var MAX_MESSAGE_LENGTH = 4096;
+var ACCESS_ACTION_PREFIX = "tg_access";
 var TelegramChannel = class extends BaseChannel {
   constructor(config) {
     super();
     this.config = config;
-    this.ownerChatId = config.channels.telegram.pairedChatId ?? null;
   }
   config;
   type = "telegram";
   bot = null;
-  ownerChatId = null;
+  lastActiveChatId = null;
   typingInterval = null;
   chatCommandContext;
   pendingApprovals = /* @__PURE__ */ new Map();
@@ -1963,30 +2644,41 @@ var TelegramChannel = class extends BaseChannel {
     bot.on("message:text", async (ctx) => {
       const chatId = ctx.chat.id;
       const userId = ctx.from?.id;
+      const username = ctx.from?.username;
+      const firstName = ctx.from?.first_name;
       const text = ctx.message.text?.trim() || "";
+      const command = this.getCommandName(text);
       if (!userId) return;
       if (ctx.chat.type !== "private") {
         await this.sendDirectMessage(chatId, "This bot is only available in private one-to-one chats.");
         return;
       }
-      if (!this.isPaired()) {
-        await this.handleUnpairedMessage(userId, chatId, text, ctx.from?.username);
+      if (command === "/start" || command === "/pair") {
+        await this.handleAccessRequest(userId, chatId, username, firstName);
         return;
       }
-      if (!this.isAuthorizedUser(userId)) {
-        await this.sendDirectMessage(chatId, "This bot is not available to you.");
+      const approvedUser = findTelegramApprovedUser(this.config, userId);
+      if (!approvedUser) {
+        const pending = findTelegramPendingRequest(this.config, userId);
+        if (pending) {
+          await this.sendDirectMessage(chatId, this.getPendingStatusMessage());
+        } else {
+          await this.sendDirectMessage(chatId, "This bot is not available to you. Send /start to request access.");
+        }
         return;
       }
-      this.ownerChatId = chatId;
+      this.lastActiveChatId = chatId;
       logger.info({ chatId, text: ctx.message.text?.slice(0, 50) }, "Telegram message received");
-      const command = text.toLowerCase();
-      if (command === "/start" || command === "/pair") {
-        await this.sendDirectMessage(chatId, this.getPairingStatusMessage());
-        return;
-      }
       if (command === "/unpair") {
-        this.unpair();
-        await this.sendDirectMessage(chatId, "Telegram pairing removed. Send /start to pair this Mercury instance again.");
+        if (!this.isAdminUser(userId)) {
+          await this.sendDirectMessage(chatId, "Only Telegram admins can reset Telegram access.");
+          return;
+        }
+        this.resetAccess();
+        await this.sendDirectMessage(
+          chatId,
+          "Telegram access reset. New users can send /start to request access. The first request must be approved from the Mercury CLI."
+        );
         return;
       }
       const msg = {
@@ -2003,6 +2695,10 @@ var TelegramChannel = class extends BaseChannel {
     });
     bot.on("callback_query:data", async (ctx) => {
       const data = ctx.callbackQuery.data;
+      if (data.startsWith(`${ACCESS_ACTION_PREFIX}:`)) {
+        await this.handleAccessCallback(ctx, data);
+        return;
+      }
       const resolver = this.pendingApprovals.get(data);
       if (!resolver) {
         await ctx.answerCallbackQuery({ text: "Expired" });
@@ -2017,19 +2713,33 @@ var TelegramChannel = class extends BaseChannel {
       logger.error({ err: err.message }, "Telegram bot error");
     });
     this.bot = bot;
-    await bot.start({
-      onStart: async (info) => {
-        logger.info({ bot: info.username }, "Telegram bot started \u2014 long polling active");
-        this.ready = true;
-        await this.registerCommands();
-      }
+    await new Promise((resolve13, reject) => {
+      let settled = false;
+      void bot.start({
+        onStart: async (info) => {
+          logger.info({ bot: info.username }, "Telegram bot started \u2014 long polling active");
+          this.ready = true;
+          await this.registerCommands();
+          if (!settled) {
+            settled = true;
+            resolve13();
+          }
+        }
+      }).catch((err) => {
+        if (!settled) {
+          settled = true;
+          reject(err);
+          return;
+        }
+        logger.error({ err: err.message }, "Telegram bot start loop failed after startup");
+      });
     });
   }
   async registerCommands() {
     if (!this.bot) return;
     const commands = [
-      { command: "start", description: "Pair this Telegram account to Mercury" },
-      { command: "pair", description: "Pair this Telegram account to Mercury" },
+      { command: "start", description: "Request Telegram access to this Mercury instance" },
+      { command: "pair", description: "Request Telegram access to this Mercury instance" },
       { command: "help", description: "Show capabilities and commands manual" },
       { command: "status", description: "Show agent config, budget, and uptime" },
       { command: "tools", description: "List all loaded tools" },
@@ -2039,7 +2749,7 @@ var TelegramChannel = class extends BaseChannel {
       { command: "budget_reset", description: "Reset token usage to zero" },
       { command: "budget_set", description: "Set new daily token budget" },
       { command: "stream", description: "Toggle text streaming on/off" },
-      { command: "unpair", description: "Remove Telegram pairing for this Mercury instance" }
+      { command: "unpair", description: "Reset all Telegram access for this Mercury instance" }
     ];
     try {
       await this.bot.api.setMyCommands(commands);
@@ -2054,9 +2764,9 @@ var TelegramChannel = class extends BaseChannel {
     this.stopTypingLoop();
   }
   async send(content, targetId, elapsedMs) {
-    const chatId = this.parseChatId(targetId);
-    if (!chatId || !this.bot) {
-      logger.warn({ targetId, chatId }, "Telegram send: no valid chat ID");
+    const chatIds = this.resolveTargetChatIds(targetId);
+    if (chatIds.length === 0 || !this.bot) {
+      logger.warn({ targetId, chatIds }, "Telegram send: no valid chat IDs");
       return;
     }
     const timeSuffix = elapsedMs != null ? `
@@ -2064,69 +2774,79 @@ var TelegramChannel = class extends BaseChannel {
     const fullContent = content + timeSuffix;
     const html = mdToTelegram(fullContent);
     const chunks = this.splitMessage(html, MAX_MESSAGE_LENGTH);
-    for (const chunk of chunks) {
-      try {
-        await this.bot.api.sendMessage(chatId, chunk, { parse_mode: "HTML" });
-      } catch (err) {
-        logger.warn({ err: err.message }, "HTML parse failed, sending as plain text");
+    for (const chatId of chatIds) {
+      for (const chunk of chunks) {
         try {
-          await this.bot.api.sendMessage(chatId, this.stripHtml(chunk));
-        } catch (err2) {
-          logger.error({ err: err2.message }, "Telegram send failed");
+          await this.bot.api.sendMessage(chatId, chunk, { parse_mode: "HTML" });
+        } catch (err) {
+          logger.warn({ err: err.message, chatId }, "HTML parse failed, sending as plain text");
+          try {
+            await this.bot.api.sendMessage(chatId, this.stripHtml(chunk));
+          } catch (err2) {
+            logger.error({ err: err2.message, chatId }, "Telegram send failed");
+          }
         }
       }
     }
   }
   async sendFile(filePath, targetId) {
-    const chatId = this.parseChatId(targetId);
-    if (!chatId || !this.bot) {
-      logger.warn({ targetId, chatId }, "Telegram sendFile: no valid chat ID");
+    const chatIds = this.resolveTargetChatIds(targetId);
+    if (chatIds.length === 0 || !this.bot) {
+      logger.warn({ targetId, chatIds }, "Telegram sendFile: no valid chat IDs");
       return;
     }
     const resolved = path2.resolve(filePath);
     if (!fs2.existsSync(resolved)) {
-      await this.bot.api.sendMessage(chatId, `File not found: ${filePath}`);
+      for (const chatId of chatIds) {
+        await this.bot.api.sendMessage(chatId, `File not found: ${filePath}`).catch(() => {
+        });
+      }
       return;
     }
-    const inputFile = new InputFile(resolved);
     const filename = path2.basename(resolved);
     const ext = path2.extname(resolved).toLowerCase();
-    try {
-      if (this.isImageFile(ext)) {
-        await this.bot.api.sendPhoto(chatId, inputFile, { caption: filename });
-      } else if (this.isAudioFile(ext)) {
-        await this.bot.api.sendAudio(chatId, inputFile, { title: filename });
-      } else if (this.isVideoFile(ext)) {
-        await this.bot.api.sendVideo(chatId, inputFile, { caption: filename });
-      } else {
-        await this.bot.api.sendDocument(chatId, inputFile, { caption: filename });
+    for (const chatId of chatIds) {
+      const inputFile = new InputFile(resolved);
+      try {
+        if (this.isImageFile(ext)) {
+          await this.bot.api.sendPhoto(chatId, inputFile, { caption: filename });
+        } else if (this.isAudioFile(ext)) {
+          await this.bot.api.sendAudio(chatId, inputFile, { title: filename });
+        } else if (this.isVideoFile(ext)) {
+          await this.bot.api.sendVideo(chatId, inputFile, { caption: filename });
+        } else {
+          await this.bot.api.sendDocument(chatId, inputFile, { caption: filename });
+        }
+        logger.info({ file: resolved, chatId }, "File sent via Telegram");
+      } catch (err) {
+        logger.error({ err: err.message, file: resolved, chatId }, "Telegram sendFile failed");
+        await this.bot.api.sendMessage(chatId, `Failed to send file: ${err.message}`).catch(() => {
+        });
       }
-      logger.info({ file: resolved, chatId }, "File sent via Telegram");
-    } catch (err) {
-      logger.error({ err: err.message, file: resolved }, "Telegram sendFile failed");
-      await this.bot.api.sendMessage(chatId, `Failed to send file: ${err.message}`).catch(() => {
-      });
     }
   }
   async stream(content, targetId) {
-    const chatId = this.parseChatId(targetId);
-    if (!chatId || !this.bot) return "";
+    const chatIds = this.resolveTargetChatIds(targetId);
+    if (chatIds.length === 0 || !this.bot) return "";
     let full = "";
     for await (const chunk of content) {
       full += chunk;
     }
     const html = mdToTelegram(full);
-    try {
-      await this.bot.api.sendMessage(chatId, html, { parse_mode: "HTML" });
-    } catch (err) {
-      await this.bot.api.sendMessage(chatId, this.stripHtml(html));
+    for (const chatId of chatIds) {
+      try {
+        await this.bot.api.sendMessage(chatId, html, { parse_mode: "HTML" });
+      } catch (err) {
+        await this.bot.api.sendMessage(chatId, this.stripHtml(html)).catch(() => {
+        });
+      }
     }
     return full;
   }
   async typing(targetId) {
-    const chatId = this.parseChatId(targetId);
-    if (!chatId || !this.bot) return;
-    await this.bot.api.sendChatAction(chatId, "typing");
+    const chatIds = this.resolveTargetChatIds(targetId);
+    if (chatIds.length === 0 || !this.bot) return;
+    await this.bot.api.sendChatAction(chatIds[0], "typing");
   }
   startTypingLoop(chatId) {
     this.stopTypingLoop();
@@ -2200,7 +2920,8 @@ var TelegramChannel = class extends BaseChannel {
     }
   }
   async askPermission(prompt, targetId) {
-    const chatId = this.parseChatId(targetId);
+    const chatIds = this.resolveTargetChatIds(targetId);
+    const chatId = chatIds[0];
     if (!chatId || !this.bot) return "no";
     const id = `perm_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
     const keyboard = new InlineKeyboard().text("Allow", `${id}:yes`).text("Always", `${id}:always`).text("Deny", `${id}:no`);
@@ -2215,17 +2936,189 @@ var TelegramChannel = class extends BaseChannel {
         reply_markup: keyboard
       });
     }
-    return new Promise((resolve13) => {
-      this.pendingApprovals.set(`${id}:yes`, () => resolve13("yes"));
-      this.pendingApprovals.set(`${id}:always`, () => resolve13("always"));
-      this.pendingApprovals.set(`${id}:no`, () => resolve13("no"));
-      setTimeout(() => {
-        this.pendingApprovals.delete(`${id}:yes`);
-        this.pendingApprovals.delete(`${id}:always`);
-        this.pendingApprovals.delete(`${id}:no`);
-        resolve13("no");
-      }, 12e4);
-    });
+    return new Promise((resolve13) => {
+      this.pendingApprovals.set(`${id}:yes`, () => resolve13("yes"));
+      this.pendingApprovals.set(`${id}:always`, () => resolve13("always"));
+      this.pendingApprovals.set(`${id}:no`, () => resolve13("no"));
+      setTimeout(() => {
+        this.pendingApprovals.delete(`${id}:yes`);
+        this.pendingApprovals.delete(`${id}:always`);
+        this.pendingApprovals.delete(`${id}:no`);
+        resolve13("no");
+      }, 12e4);
+    });
+  }
+  async handleAccessRequest(userId, chatId, username, firstName) {
+    const approvedUser = findTelegramApprovedUser(this.config, userId);
+    if (approvedUser) {
+      await this.sendDirectMessage(chatId, this.getApprovedStatusMessage(approvedUser));
+      return;
+    }
+    const existingRequest = findTelegramPendingRequest(this.config, userId);
+    if (existingRequest) {
+      await this.sendDirectMessage(chatId, this.getPendingStatusMessage(existingRequest));
+      return;
+    }
+    if (!hasTelegramAdmins(this.config) && this.config.channels.telegram.pending.length > 0) {
+      await this.sendDirectMessage(
+        chatId,
+        "Initial Telegram pairing is already in progress for another user. Ask the Mercury operator to finish setup or reset Telegram access first."
+      );
+      return;
+    }
+    const request = addTelegramPendingRequest(this.config, {
+      userId,
+      chatId,
+      username,
+      firstName,
+      pairingCode: hasTelegramAdmins(this.config) ? void 0 : this.generatePairingCode()
+    });
+    saveConfig(this.config);
+    logger.info({ chatId, userId, username }, "Telegram access request recorded");
+    await this.sendDirectMessage(chatId, this.getPendingStatusMessage(request));
+    if (!hasTelegramAdmins(this.config)) {
+      return;
+    }
+    await this.notifyAdminsOfPendingRequest(request);
+  }
+  async notifyAdminsOfPendingRequest(request) {
+    if (!this.bot) return;
+    const keyboard = new InlineKeyboard().text("Approve", `${ACCESS_ACTION_PREFIX}:approve:${request.userId}`).text("Reject", `${ACCESS_ACTION_PREFIX}:reject:${request.userId}`);
+    const username = request.username ? ` (@${request.username})` : "";
+    const firstName = request.firstName ? ` (${request.firstName})` : "";
+    const message = [
+      "Telegram access request pending approval.",
+      "",
+      `User ID: ${request.userId}${username}${firstName}`,
+      `Requested: ${new Date(request.requestedAt).toLocaleString()}`,
+      "",
+      "Use the buttons below to approve or reject this user."
+    ].join("\n");
+    for (const admin of getTelegramAdmins(this.config)) {
+      try {
+        await this.bot.api.sendMessage(admin.chatId, mdToTelegram(message), {
+          parse_mode: "HTML",
+          reply_markup: keyboard
+        });
+      } catch {
+        await this.bot.api.sendMessage(admin.chatId, message, {
+          reply_markup: keyboard
+        }).catch(() => {
+        });
+      }
+    }
+  }
+  async handleAccessCallback(ctx, data) {
+    const actorUserId = ctx.from?.id;
+    const actorChatId = ctx.chat?.id;
+    if (!actorUserId || !actorChatId) {
+      await ctx.answerCallbackQuery({ text: "Unavailable" });
+      return;
+    }
+    if (!this.isAdminUser(actorUserId)) {
+      await ctx.answerCallbackQuery({ text: "Admins only" });
+      return;
+    }
+    const [, action, rawUserId] = data.split(":");
+    const requestUserId = Number(rawUserId);
+    if (!requestUserId) {
+      await ctx.answerCallbackQuery({ text: "Invalid request" });
+      return;
+    }
+    const request = findTelegramPendingRequest(this.config, requestUserId);
+    if (!request) {
+      await ctx.answerCallbackQuery({ text: "Already handled" });
+      await ctx.editMessageReplyMarkup({ reply_markup: void 0 }).catch(() => {
+      });
+      return;
+    }
+    if (action === "approve") {
+      const approved = approveTelegramPendingRequest(this.config, requestUserId, "member");
+      if (!approved) {
+        await ctx.answerCallbackQuery({ text: "Already handled" });
+        return;
+      }
+      saveConfig(this.config);
+      await ctx.answerCallbackQuery({ text: "Approved" });
+      await ctx.editMessageReplyMarkup({ reply_markup: void 0 }).catch(() => {
+      });
+      await this.sendDirectMessage(
+        request.chatId,
+        `Telegram access approved. You can now chat with Mercury.
+
+Telegram access: ${getTelegramAccessSummary(this.config)}`
+      );
+      await this.sendDirectMessage(actorChatId, `Approved Telegram access for ${this.formatRequestLabel(request)}.`);
+      return;
+    }
+    if (action === "reject") {
+      const rejected = rejectTelegramPendingRequest(this.config, requestUserId);
+      if (!rejected) {
+        await ctx.answerCallbackQuery({ text: "Already handled" });
+        return;
+      }
+      saveConfig(this.config);
+      await ctx.answerCallbackQuery({ text: "Rejected" });
+      await ctx.editMessageReplyMarkup({ reply_markup: void 0 }).catch(() => {
+      });
+      await this.sendDirectMessage(
+        request.chatId,
+        "Your Telegram access request was rejected. This bot is not available to you."
+      );
+      await this.sendDirectMessage(actorChatId, `Rejected Telegram access for ${this.formatRequestLabel(request)}.`);
+      return;
+    }
+    await ctx.answerCallbackQuery({ text: "Unknown action" });
+  }
+  resolveTargetChatIds(targetId) {
+    if (!targetId || targetId === "notification") {
+      return getTelegramApprovedChatIds(this.config);
+    }
+    if (targetId.startsWith("telegram:")) {
+      const raw = Number(targetId.split(":")[1]);
+      return isNaN(raw) ? [] : [raw];
+    }
+    const num = Number(targetId);
+    return isNaN(num) ? [] : [num];
+  }
+  isAdminUser(userId) {
+    return !!findTelegramAdmin(this.config, userId);
+  }
+  getCommandName(text) {
+    return text.trim().split(/\s+/)[0]?.toLowerCase() || "";
+  }
+  getPendingStatusMessage(request) {
+    if (!hasTelegramAdmins(this.config)) {
+      const pairingCode = request?.pairingCode ?? "unknown";
+      return [
+        "Your Telegram pairing request has been recorded.",
+        "",
+        `Pairing code: ${pairingCode}`,
+        "",
+        "Enter this code in the Mercury terminal to finish setup."
+      ].join("\n");
+    }
+    return "Your Telegram access request has been recorded and is waiting for approval from a Telegram admin.";
+  }
+  getApprovedStatusMessage(user) {
+    const role = this.isAdminUser(user.userId) ? "admin" : "member";
+    return `You are already approved as a Telegram ${role}.
+
+Telegram access: ${getTelegramAccessSummary(this.config)}`;
+  }
+  formatRequestLabel(request) {
+    const username = request.username ? ` (@${request.username})` : "";
+    const firstName = request.firstName ? ` ${request.firstName}` : "";
+    return `${request.userId}${username}${firstName}`;
+  }
+  resetAccess() {
+    clearTelegramAccess(this.config);
+    saveConfig(this.config);
+    this.lastActiveChatId = null;
+    logger.info("Telegram access reset");
+  }
+  generatePairingCode() {
+    return Math.floor(1e5 + Math.random() * 9e5).toString();
   }
   escapeHtml(text) {
     return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -2259,50 +3152,6 @@ var TelegramChannel = class extends BaseChannel {
   isVideoFile(ext) {
     return [".mp4", ".mov", ".avi", ".mkv", ".webm"].includes(ext);
   }
-  parseChatId(targetId) {
-    if (!targetId) return this.ownerChatId ?? this.config.channels.telegram.pairedChatId ?? null;
-    if (targetId.startsWith("telegram:")) {
-      const raw = Number(targetId.split(":")[1]);
-      return isNaN(raw) ? this.ownerChatId ?? this.config.channels.telegram.pairedChatId ?? null : raw;
-    }
-    if (targetId === "notification") return this.ownerChatId ?? this.config.channels.telegram.pairedChatId ?? null;
-    const num = Number(targetId);
-    return isNaN(num) ? this.ownerChatId ?? this.config.channels.telegram.pairedChatId ?? null : num;
-  }
-  isPaired() {
-    return typeof this.config.channels.telegram.pairedUserId === "number";
-  }
-  isAuthorizedUser(userId) {
-    return this.config.channels.telegram.pairedUserId === userId;
-  }
-  async handleUnpairedMessage(userId, chatId, text, username) {
-    const command = text.toLowerCase();
-    if (command === "/start" || command === "/pair") {
-      setTelegramPairing(this.config, userId, chatId, username);
-      saveConfig(this.config);
-      this.ownerChatId = chatId;
-      logger.info({ chatId, userId, username }, "Telegram paired to owner");
-      await this.sendDirectMessage(chatId, this.getPairingStatusMessage(true));
-      return;
-    }
-    await this.sendDirectMessage(
-      chatId,
-      "This Mercury instance is not paired yet. Send /start to pair this bot to your Telegram account."
-    );
-  }
-  getPairingStatusMessage(newlyPaired = false) {
-    const username = this.config.channels.telegram.pairedUsername ? ` (@${this.config.channels.telegram.pairedUsername})` : "";
-    const prefix = newlyPaired ? "Telegram paired successfully." : "This Telegram account is already paired.";
-    return `${prefix}
-
-Owner user ID: ${this.config.channels.telegram.pairedUserId}${username}`;
-  }
-  unpair() {
-    clearTelegramPairing(this.config);
-    saveConfig(this.config);
-    this.ownerChatId = null;
-    logger.info("Telegram pairing cleared");
-  }
   async sendDirectMessage(chatId, content) {
     if (!this.bot) return;
     try {
@@ -3116,7 +3965,7 @@ import { existsSync as existsSync12, statSync as statSync2 } from "fs";
 import { resolve as resolve9, basename, isAbsolute as isAbsolute7 } from "path";
 function createSendFileTool(permissions, getCwd, sendFile) {
   return tool7({
-    description: "Send a file to the user. On Telegram the file is uploaded as an attachment. On CLI the file path and size are displayed. The path must be within an allowed read scope.",
+    description: "Send a file to the user. On Telegram the file is uploaded as an attachment to the relevant approved recipients. On CLI the file path and size are displayed. The path must be within an allowed read scope.",
     parameters: z7.object({
       path: z7.string().describe("Absolute or relative path to the file to send")
     }),
@@ -3154,9 +4003,9 @@ import { tool as tool8 } from "ai";
 import { z as z8 } from "zod";
 function createSendMessageTool(sendMessage) {
   return tool8({
-    description: "Send a message to the paired user through the configured outbound channel. Currently this sends only to the paired Telegram owner. Use this only when the user explicitly asks you to send something to Telegram or asks for scheduled results to be sent there.",
+    description: "Send a message through the configured outbound channel. For Telegram this sends to the approved Telegram recipients. Use this only when the user explicitly asks you to send something to Telegram or asks for scheduled results to be sent there.",
     parameters: z8.object({
-      content: z8.string().describe("The message content to send to the paired Telegram owner")
+      content: z8.string().describe("The message content to send to the approved Telegram recipients")
     }),
     execute: async ({ content }) => {
       const trimmed = content.trim();
@@ -3165,7 +4014,7 @@ function createSendMessageTool(sendMessage) {
       }
       try {
         await sendMessage(trimmed);
-        return "Message sent to the paired Telegram owner.";
+        return "Message sent to the approved Telegram recipients.";
       } catch (err) {
         return `Error sending message: ${err.message}`;
       }
@@ -4332,15 +5181,15 @@ Describe what this skill enables Mercury to do. When invoked via the use_skill t
 };
 
 // src/utils/manual.ts
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 function getManual() {
   const sections = [];
   sections.push("");
-  sections.push(chalk3.bold.cyan("  MERCURY \u2014 Capabilities & Commands"));
-  sections.push(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  sections.push(chalk4.bold.cyan("  MERCURY \u2014 Capabilities & Commands"));
+  sections.push(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   sections.push("");
-  sections.push(chalk3.bold.white("  Built-in Tools"));
-  sections.push(chalk3.dim("  Tools Mercury can use during conversations."));
+  sections.push(chalk4.bold.white("  Built-in Tools"));
+  sections.push(chalk4.dim("  Tools Mercury can use during conversations."));
   sections.push("");
   const tools = [
     ["read_file", "Read file contents", "path (required)"],
@@ -4349,7 +5198,7 @@ function getManual() {
     ["edit_file", "Replace specific text in a file", "path, old_string, new_string"],
     ["list_dir", "List directory contents", "path"],
     ["delete_file", "Delete a file", "path"],
-    ["send_message", "Send a message to the paired Telegram owner", "content"],
+    ["send_message", "Send a message to approved Telegram users", "content"],
     ["run_command", "Execute a shell command", "command"],
     ["approve_command", "Permanently approve a command type", 'command (e.g. "curl")'],
     ["fetch_url", "Fetch a URL and return content", "url, format? (text/markdown)"],
@@ -4368,12 +5217,12 @@ function getManual() {
     ["budget_status", "Check token budget", "\u2014"]
   ];
   for (const [name, desc, params] of tools) {
-    sections.push(`  ${chalk3.cyan(name.padEnd(24))} ${desc}`);
-    sections.push(`  ${" ".repeat(24)} ${chalk3.dim(params)}`);
+    sections.push(`  ${chalk4.cyan(name.padEnd(24))} ${desc}`);
+    sections.push(`  ${" ".repeat(24)} ${chalk4.dim(params)}`);
   }
   sections.push("");
-  sections.push(chalk3.bold.white("  CLI Commands"));
-  sections.push(chalk3.dim("  Run these from your terminal (no API calls consumed)."));
+  sections.push(chalk4.bold.white("  CLI Commands"));
+  sections.push(chalk4.dim("  Run these from your terminal (no API calls consumed)."));
   sections.push("");
   const commands = [
     ["mercury up", "Start persistently (install service + daemon)"],
@@ -4386,7 +5235,13 @@ function getManual() {
     ["mercury doctor", "Reconfigure settings (Enter keeps current)"],
     ["mercury setup", "Re-run the setup wizard"],
     ["mercury status", "Show config and daemon status"],
-    ["mercury telegram unpair", "Clear the paired Telegram owner"],
+    ["mercury telegram list", "Show Telegram admins, members, and pending requests"],
+    ["mercury telegram approve <code|id>", "Approve the first Telegram pairing code or a later Telegram request"],
+    ["mercury telegram reject <id>", "Reject a pending Telegram request"],
+    ["mercury telegram remove <id>", "Remove an approved Telegram user"],
+    ["mercury telegram promote <id>", "Promote a Telegram member to admin"],
+    ["mercury telegram demote <id>", "Demote a Telegram admin to member"],
+    ["mercury telegram unpair", "Reset all Telegram access"],
     ["mercury help", "Show this manual"],
     ["mercury service install", "Install as system service (auto-start)"],
     ["mercury service uninstall", "Uninstall system service"],
@@ -4394,29 +5249,40 @@ function getManual() {
     ["mercury --verbose", "Start with debug logging on stderr"]
   ];
   for (const [cmd, desc] of commands) {
-    sections.push(`  ${chalk3.white(cmd.padEnd(26))} ${desc}`);
+    sections.push(`  ${chalk4.white(cmd.padEnd(26))} ${desc}`);
   }
   sections.push("");
-  sections.push(chalk3.bold.white("  In-Chat Commands"));
-  sections.push(chalk3.dim("  Type these during a conversation (no API calls)."));
+  sections.push(chalk4.bold.white("  In-Chat Commands"));
+  sections.push(chalk4.dim("  Type these during a conversation (no API calls)."));
   sections.push("");
   const chat = [
-    ["/start", "Pair this Telegram account to Mercury"],
-    ["/pair", "Pair this Telegram account to Mercury"],
+    ["/start", "Start Telegram pairing or request Telegram access"],
+    ["/pair", "Start Telegram pairing or request Telegram access"],
+    ["/", "Open the CLI command picker with arrow-key navigation"],
+    ["/menu", "Open the CLI command picker with arrow-key navigation"],
     ["/help", "Show this manual"],
     ["/status", "Show config and budget info"],
+    ["/telegram", "CLI chat only: open the Telegram management menu"],
+    ["/telegram pending", "CLI chat only: list pending Telegram requests"],
+    ["/telegram users", "CLI chat only: list approved Telegram users"],
+    ["/telegram approve <code|id>", "CLI chat only: approve the first pairing code or a later request"],
+    ["/telegram reject <id>", "CLI chat only: reject a pending Telegram request"],
+    ["/telegram remove <id>", "CLI chat only: remove an approved Telegram user"],
+    ["/telegram promote <id>", "CLI chat only: promote a Telegram member to admin"],
+    ["/telegram demote <id>", "CLI chat only: demote a Telegram admin to member"],
+    ["/telegram reset", "CLI chat only: reset all Telegram access"],
     ["/tools", "List currently loaded tools"],
     ["/skills", "List installed skills"],
     ["/stream", "Toggle text streaming on/off (Telegram)"],
     ["/stream on", "Enable streaming (live text updates)"],
     ["/stream off", "Disable streaming (single message)"],
-    ["/unpair", "Remove Telegram pairing for this Mercury instance"]
+    ["/unpair", "Reset all Telegram access for this Mercury instance (admins only)"]
   ];
   for (const [cmd, desc] of chat) {
-    sections.push(`  ${chalk3.white(cmd.padEnd(16))} ${desc}`);
+    sections.push(`  ${chalk4.white(cmd.padEnd(16))} ${desc}`);
   }
   sections.push("");
-  sections.push(chalk3.bold.white("  Permissions"));
+  sections.push(chalk4.bold.white("  Permissions"));
   sections.push("");
   const perms = [
     "Commands are blocked (never run), auto-approved, or need approval.",
@@ -4425,10 +5291,10 @@ function getManual() {
     "File access is scoped \u2014 new paths need approval (y/n/always)."
   ];
   for (const p of perms) {
-    sections.push(`  ${chalk3.dim("\u2022")} ${p}`);
+    sections.push(`  ${chalk4.dim("\u2022")} ${p}`);
   }
   sections.push("");
-  sections.push(chalk3.bold.white("  Skills"));
+  sections.push(chalk4.bold.white("  Skills"));
   sections.push("");
   const skillInfo = [
     "Skills live in ~/.mercury/skills/<name>/SKILL.md",
@@ -4437,10 +5303,10 @@ function getManual() {
     'Schedule: "remind me daily at 9am to run daily-digest skill"'
   ];
   for (const s of skillInfo) {
-    sections.push(`  ${chalk3.dim("\u2022")} ${s}`);
+    sections.push(`  ${chalk4.dim("\u2022")} ${s}`);
   }
   sections.push("");
-  sections.push(chalk3.bold.white("  Scheduling"));
+  sections.push(chalk4.bold.white("  Scheduling"));
   sections.push("");
   const schedInfo = [
     'Recurring: "every day at 9am remind me to\u2026"',
@@ -4448,10 +5314,10 @@ function getManual() {
     "Tasks persist to ~/.mercury/schedules.yaml"
   ];
   for (const s of schedInfo) {
-    sections.push(`  ${chalk3.dim("\u2022")} ${s}`);
+    sections.push(`  ${chalk4.dim("\u2022")} ${s}`);
   }
   sections.push("");
-  sections.push(chalk3.bold.white("  Configuration"));
+  sections.push(chalk4.bold.white("  Configuration"));
   sections.push("");
   const configInfo = [
     ["~/.mercury/mercury.yaml", "Main config (providers, channels, budget)"],
@@ -4463,10 +5329,10 @@ function getManual() {
     ["~/.mercury/memory/", "Short-term, long-term, episodic memory"]
   ];
   for (const [path3, desc] of configInfo) {
-    sections.push(`  ${chalk3.dim(path3.padEnd(36))} ${desc}`);
+    sections.push(`  ${chalk4.dim(path3.padEnd(36))} ${desc}`);
   }
   sections.push("");
-  sections.push(chalk3.dim("  mercury.cosmicstack.org"));
+  sections.push(chalk4.dim("  mercury.cosmicstack.org"));
   sections.push("");
   return sections.join("\n");
 }
@@ -4476,7 +5342,7 @@ import { spawn } from "child_process";
 import { existsSync as existsSync16, readFileSync as readFileSync11, writeFileSync as writeFileSync11, unlinkSync as unlinkSync3, mkdirSync as mkdirSync9, openSync } from "fs";
 import { join as join9 } from "path";
 import process2 from "process";
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 var PID_FILE = "daemon.pid";
 var LOG_FILE = "daemon.log";
 function pidPath() {
@@ -4512,8 +5378,8 @@ function getDaemonStatus() {
 function startBackground() {
   const status = getDaemonStatus();
   if (status.running && status.pid) {
-    console.log(chalk4.yellow(`  Mercury is already running (PID: ${status.pid})`));
-    console.log(chalk4.dim(`  Use \`mercury stop\` to stop it first.`));
+    console.log(chalk5.yellow(`  Mercury is already running (PID: ${status.pid})`));
+    console.log(chalk5.dim(`  Use \`mercury stop\` to stop it first.`));
     console.log("");
     process2.exit(1);
   }
@@ -4539,21 +5405,21 @@ function startBackground() {
   child.unref();
   writeFileSync11(pidPath(), String(child.pid));
   console.log("");
-  console.log(chalk4.green(`  Mercury started in background (PID: ${child.pid})`));
-  console.log(chalk4.dim(`  Logs: ${logFile}`));
-  console.log(chalk4.dim(`  Use \`mercury stop\` to stop.`));
-  console.log(chalk4.dim(`  Use \`mercury logs\` to view logs.`));
+  console.log(chalk5.green(`  Mercury started in background (PID: ${child.pid})`));
+  console.log(chalk5.dim(`  Logs: ${logFile}`));
+  console.log(chalk5.dim(`  Use \`mercury stop\` to stop.`));
+  console.log(chalk5.dim(`  Use \`mercury logs\` to view logs.`));
   console.log("");
 }
 function stopDaemon() {
   const status = getDaemonStatus();
   if (!status.pid) {
-    console.log(chalk4.yellow("  Mercury is not running as a daemon."));
+    console.log(chalk5.yellow("  Mercury is not running as a daemon."));
     console.log("");
     process2.exit(0);
   }
   if (!status.running) {
-    console.log(chalk4.yellow(`  Stale PID file found (PID: ${status.pid} is not running). Cleaning up.`));
+    console.log(chalk5.yellow(`  Stale PID file found (PID: ${status.pid} is not running). Cleaning up.`));
     try {
       unlinkSync3(pidPath());
     } catch {
@@ -4567,9 +5433,9 @@ function stopDaemon() {
     } else {
       process2.kill(status.pid, "SIGTERM");
     }
-    console.log(chalk4.green(`  Mercury stopped (PID: ${status.pid})`));
+    console.log(chalk5.green(`  Mercury stopped (PID: ${status.pid})`));
   } catch {
-    console.log(chalk4.red(`  Failed to stop PID ${status.pid}. You may need to kill it manually.`));
+    console.log(chalk5.red(`  Failed to stop PID ${status.pid}. You may need to kill it manually.`));
   }
   try {
     unlinkSync3(pidPath());
@@ -4580,7 +5446,7 @@ function stopDaemon() {
 function restartDaemon() {
   const status = getDaemonStatus();
   if (status.running && status.pid) {
-    console.log(chalk4.yellow(`  Stopping Mercury (PID: ${status.pid})...`));
+    console.log(chalk5.yellow(`  Stopping Mercury (PID: ${status.pid})...`));
     try {
       if (process2.platform === "win32") {
         process2.kill(status.pid);
@@ -4593,20 +5459,20 @@ function restartDaemon() {
       unlinkSync3(pidPath());
     } catch {
     }
-    console.log(chalk4.green("  Mercury stopped."));
+    console.log(chalk5.green("  Mercury stopped."));
   } else if (status.pid) {
     try {
       unlinkSync3(pidPath());
     } catch {
     }
   }
-  console.log(chalk4.yellow("  Starting Mercury..."));
+  console.log(chalk5.yellow("  Starting Mercury..."));
   startBackground();
 }
 function showLogs() {
   const logFile = logPath();
   if (!existsSync16(logFile)) {
-    console.log(chalk4.dim("  No daemon log file found."));
+    console.log(chalk5.dim("  No daemon log file found."));
     console.log("");
     return;
   }
@@ -4654,7 +5520,7 @@ function tryAutoDaemonize() {
 import { existsSync as existsSync17, mkdirSync as mkdirSync10, writeFileSync as writeFileSync12, unlinkSync as unlinkSync4 } from "fs";
 import { join as join10 } from "path";
 import { homedir as homedir3 } from "os";
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 import { execSync as execSync8 } from "child_process";
 var SERVICE_DESC = "Mercury \u2014 Soul-Driven AI Agent";
 var WIN_TASK_NAME = "MercuryAgent";
@@ -4689,7 +5555,7 @@ function installService() {
   } else if (platform === "win32") {
     installWindows();
   } else {
-    console.log(chalk5.red(`  Unsupported platform: ${platform}`));
+    console.log(chalk6.red(`  Unsupported platform: ${platform}`));
     process.exit(1);
   }
 }
@@ -4702,7 +5568,7 @@ function uninstallService() {
   } else if (platform === "win32") {
     uninstallWindows();
   } else {
-    console.log(chalk5.red(`  Unsupported platform: ${platform}`));
+    console.log(chalk6.red(`  Unsupported platform: ${platform}`));
     process.exit(1);
   }
 }
@@ -4766,22 +5632,22 @@ function installMac() {
   try {
     execSync8(`launchctl load ${plistPath}`, { stdio: "inherit" });
   } catch {
-    console.log(chalk5.yellow("  launchctl load failed. Try running:"));
-    console.log(chalk5.dim(`    launchctl load ${plistPath}`));
+    console.log(chalk6.yellow("  launchctl load failed. Try running:"));
+    console.log(chalk6.dim(`    launchctl load ${plistPath}`));
   }
   console.log("");
-  console.log(chalk5.green("  Mercury service installed (macOS LaunchAgent)"));
-  console.log(chalk5.dim(`  Plist: ${plistPath}`));
-  console.log(chalk5.dim(`  Logs: ${logPath2}`));
-  console.log(chalk5.dim("  Auto-starts on login. Auto-restarts on crash."));
+  console.log(chalk6.green("  Mercury service installed (macOS LaunchAgent)"));
+  console.log(chalk6.dim(`  Plist: ${plistPath}`));
+  console.log(chalk6.dim(`  Logs: ${logPath2}`));
+  console.log(chalk6.dim("  Auto-starts on login. Auto-restarts on crash."));
   console.log("");
-  console.log(chalk5.dim("  Uninstall: mercury service uninstall"));
+  console.log(chalk6.dim("  Uninstall: mercury service uninstall"));
   console.log("");
 }
 function uninstallMac() {
   const plistPath = join10(homedir3(), "Library", "LaunchAgents", "com.cosmicstack.mercury.plist");
   if (!existsSync17(plistPath)) {
-    console.log(chalk5.yellow("  Mercury service is not installed."));
+    console.log(chalk6.yellow("  Mercury service is not installed."));
     console.log("");
     process.exit(0);
   }
@@ -4792,28 +5658,28 @@ function uninstallMac() {
   try {
     unlinkSync4(plistPath);
   } catch {
-    console.log(chalk5.yellow("  Failed to remove plist file. Remove manually:"));
-    console.log(chalk5.dim(`    rm ${plistPath}`));
+    console.log(chalk6.yellow("  Failed to remove plist file. Remove manually:"));
+    console.log(chalk6.dim(`    rm ${plistPath}`));
   }
   console.log("");
-  console.log(chalk5.green("  Mercury service uninstalled"));
+  console.log(chalk6.green("  Mercury service uninstalled"));
   console.log("");
 }
 function showMacStatus() {
   const plistPath = join10(homedir3(), "Library", "LaunchAgents", "com.cosmicstack.mercury.plist");
   if (!existsSync17(plistPath)) {
-    console.log(chalk5.yellow("  Mercury service is not installed."));
-    console.log(chalk5.dim("  Run `mercury service install` to set it up."));
+    console.log(chalk6.yellow("  Mercury service is not installed."));
+    console.log(chalk6.dim("  Run `mercury service install` to set it up."));
     console.log("");
     return;
   }
   try {
     const output = execSync8("launchctl list | grep com.cosmicstack.mercury", { encoding: "utf-8" }).trim();
-    console.log(`  ${chalk5.green("Service installed and loaded")}`);
-    console.log(chalk5.dim(`  ${output}`));
+    console.log(`  ${chalk6.green("Service installed and loaded")}`);
+    console.log(chalk6.dim(`  ${output}`));
   } catch {
-    console.log(`  ${chalk5.yellow("Service installed but not loaded")}`);
-    console.log(chalk5.dim(`  Plist: ${plistPath}`));
+    console.log(`  ${chalk6.yellow("Service installed but not loaded")}`);
+    console.log(chalk6.dim(`  Plist: ${plistPath}`));
   }
   console.log("");
 }
@@ -4849,30 +5715,30 @@ WantedBy=default.target`;
     execSync8("systemctl --user enable mercury.service", { stdio: "inherit" });
     execSync8("systemctl --user start mercury.service", { stdio: "inherit" });
   } catch (err) {
-    console.log(chalk5.yellow("  systemd commands failed. Try running manually:"));
-    console.log(chalk5.dim("    systemctl --user daemon-reload"));
-    console.log(chalk5.dim("    systemctl --user enable mercury.service"));
-    console.log(chalk5.dim("    systemctl --user start mercury.service"));
+    console.log(chalk6.yellow("  systemd commands failed. Try running manually:"));
+    console.log(chalk6.dim("    systemctl --user daemon-reload"));
+    console.log(chalk6.dim("    systemctl --user enable mercury.service"));
+    console.log(chalk6.dim("    systemctl --user start mercury.service"));
   }
   try {
     execSync8(`loginctl enable-linger ${process.env.USER || ""}`, { stdio: "inherit" });
   } catch {
-    console.log(chalk5.yellow("  Enable linger failed (needed for boot-without-login). Try:"));
-    console.log(chalk5.dim(`    sudo loginctl enable-linger ${process.env.USER || "$USER"}`));
+    console.log(chalk6.yellow("  Enable linger failed (needed for boot-without-login). Try:"));
+    console.log(chalk6.dim(`    sudo loginctl enable-linger ${process.env.USER || "$USER"}`));
   }
   console.log("");
-  console.log(chalk5.green("  Mercury service installed (systemd --user)"));
-  console.log(chalk5.dim(`  Service: ${servicePath}`));
-  console.log(chalk5.dim(`  Logs: ${join10(home, "daemon.log")}`));
-  console.log(chalk5.dim("  Auto-starts on login. Auto-restarts on crash (5s delay)."));
+  console.log(chalk6.green("  Mercury service installed (systemd --user)"));
+  console.log(chalk6.dim(`  Service: ${servicePath}`));
+  console.log(chalk6.dim(`  Logs: ${join10(home, "daemon.log")}`));
+  console.log(chalk6.dim("  Auto-starts on login. Auto-restarts on crash (5s delay)."));
   console.log("");
-  console.log(chalk5.dim("  Uninstall: mercury service uninstall"));
+  console.log(chalk6.dim("  Uninstall: mercury service uninstall"));
   console.log("");
 }
 function uninstallLinux() {
   const servicePath = join10(homedir3(), ".config", "systemd", "user", "mercury.service");
   if (!existsSync17(servicePath)) {
-    console.log(chalk5.yellow("  Mercury service is not installed."));
+    console.log(chalk6.yellow("  Mercury service is not installed."));
     console.log("");
     process.exit(0);
   }
@@ -4884,22 +5750,22 @@ function uninstallLinux() {
   try {
     unlinkSync4(servicePath);
   } catch {
-    console.log(chalk5.yellow("  Failed to remove service file. Remove manually:"));
-    console.log(chalk5.dim(`    rm ${servicePath}`));
+    console.log(chalk6.yellow("  Failed to remove service file. Remove manually:"));
+    console.log(chalk6.dim(`    rm ${servicePath}`));
   }
   try {
     execSync8("systemctl --user daemon-reload", { stdio: "inherit" });
   } catch {
   }
   console.log("");
-  console.log(chalk5.green("  Mercury service uninstalled"));
+  console.log(chalk6.green("  Mercury service uninstalled"));
   console.log("");
 }
 function showLinuxStatus() {
   const servicePath = join10(homedir3(), ".config", "systemd", "user", "mercury.service");
   if (!existsSync17(servicePath)) {
-    console.log(chalk5.yellow("  Mercury service is not installed."));
-    console.log(chalk5.dim("  Run `mercury service install` to set it up."));
+    console.log(chalk6.yellow("  Mercury service is not installed."));
+    console.log(chalk6.dim("  Run `mercury service install` to set it up."));
     console.log("");
     return;
   }
@@ -4907,8 +5773,8 @@ function showLinuxStatus() {
     const output = execSync8("systemctl --user status mercury.service", { encoding: "utf-8" }).trim();
     console.log(output);
   } catch (err) {
-    console.log(chalk5.yellow("  Could not get service status:"));
-    console.log(chalk5.dim(`  ${err.message || err}`));
+    console.log(chalk6.yellow("  Could not get service status:"));
+    console.log(chalk6.dim(`  ${err.message || err}`));
   }
   console.log("");
 }
@@ -4924,33 +5790,33 @@ function installWindows() {
       { stdio: "inherit", shell: "cmd.exe" }
     );
   } catch {
-    console.log(chalk5.yellow("  schtasks create failed. Try running from an Administrator cmd:"));
-    console.log(chalk5.dim(`    schtasks /create /tn "${WIN_TASK_NAME}" /tr "${cmd}" /sc onlogon /rl limited /f`));
+    console.log(chalk6.yellow("  schtasks create failed. Try running from an Administrator cmd:"));
+    console.log(chalk6.dim(`    schtasks /create /tn "${WIN_TASK_NAME}" /tr "${cmd}" /sc onlogon /rl limited /f`));
   }
   try {
     execSync8(`schtasks /run /tn "${WIN_TASK_NAME}"`, { stdio: "inherit", shell: "cmd.exe" });
   } catch {
-    console.log(chalk5.yellow("  Task created but failed to start immediately. It will start on next login."));
+    console.log(chalk6.yellow("  Task created but failed to start immediately. It will start on next login."));
   }
   console.log("");
-  console.log(chalk5.green("  Mercury service installed (Windows Task Scheduler)"));
-  console.log(chalk5.dim(`  Task: ${WIN_TASK_NAME}`));
-  console.log(chalk5.dim(`  Trigger: on logon`));
-  console.log(chalk5.dim(`  Logs: ${logPath2}`));
-  console.log(chalk5.dim("  Auto-starts on login. Use --daemon flag for crash recovery."));
+  console.log(chalk6.green("  Mercury service installed (Windows Task Scheduler)"));
+  console.log(chalk6.dim(`  Task: ${WIN_TASK_NAME}`));
+  console.log(chalk6.dim(`  Trigger: on logon`));
+  console.log(chalk6.dim(`  Logs: ${logPath2}`));
+  console.log(chalk6.dim("  Auto-starts on login. Use --daemon flag for crash recovery."));
   console.log("");
-  console.log(chalk5.dim("  Uninstall: mercury service uninstall"));
+  console.log(chalk6.dim("  Uninstall: mercury service uninstall"));
   console.log("");
 }
 function uninstallWindows() {
   try {
     execSync8(`schtasks /delete /tn "${WIN_TASK_NAME}" /f`, { stdio: "inherit", shell: "cmd.exe" });
     console.log("");
-    console.log(chalk5.green("  Mercury service uninstalled"));
+    console.log(chalk6.green("  Mercury service uninstalled"));
     console.log("");
   } catch {
-    console.log(chalk5.yellow("  Task not found or failed to delete. Remove manually:"));
-    console.log(chalk5.dim(`    schtasks /delete /tn "${WIN_TASK_NAME}" /f`));
+    console.log(chalk6.yellow("  Task not found or failed to delete. Remove manually:"));
+    console.log(chalk6.dim(`    schtasks /delete /tn "${WIN_TASK_NAME}" /f`));
     console.log("");
   }
 }
@@ -4963,8 +5829,8 @@ function showWindowsStatus() {
     console.log(output);
     console.log("");
   } catch {
-    console.log(chalk5.yellow("  Mercury service is not installed."));
-    console.log(chalk5.dim("  Run `mercury service install` to set it up."));
+    console.log(chalk6.yellow("  Mercury service is not installed."));
+    console.log(chalk6.dim("  Run `mercury service install` to set it up."));
     console.log("");
   }
 }
@@ -4999,11 +5865,208 @@ function sleep(ms) {
   return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 
+// src/utils/provider-models.ts
+var MAX_MODEL_OPTIONS = 7;
+var OPENAI_PREFERRED_MODELS = [
+  "gpt-5.2",
+  "gpt-5.2-chat-latest",
+  "gpt-5.2-pro",
+  "gpt-5-mini",
+  "gpt-5-nano",
+  "gpt-4.1",
+  "gpt-4.1-mini",
+  "gpt-oss-120b",
+  "gpt-oss-20b"
+];
+var ANTHROPIC_PREFERRED_MODELS = [
+  "claude-sonnet-4-20250514",
+  "claude-opus-4-20250514",
+  "claude-3-7-sonnet-latest",
+  "claude-3-5-sonnet-latest",
+  "claude-3-5-haiku-latest"
+];
+var DEEPSEEK_PREFERRED_MODELS = [
+  "deepseek-chat",
+  "deepseek-reasoner"
+];
+var GROK_PREFERRED_MODELS = [
+  "grok-4",
+  "grok-4-latest",
+  "grok-4.20",
+  "grok-3",
+  "grok-3-latest"
+];
+var OLLAMA_CLOUD_PREFERRED_MODELS = [
+  "gpt-oss:120b",
+  "gpt-oss:120b-cloud",
+  "gpt-oss:20b"
+];
+var OLLAMA_LOCAL_PREFERRED_MODELS = [
+  "gpt-oss:20b",
+  "gpt-oss:120b"
+];
+var ProviderModelFetchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProviderModelFetchError";
+  }
+};
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+async function fetchJson(url, init, invalidMessage) {
+  let response;
+  try {
+    response = await fetch(url, {
+      ...init,
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+    throw new ProviderModelFetchError(invalidMessage);
+  }
+  if (!response.ok) {
+    throw new ProviderModelFetchError(invalidMessage);
+  }
+  try {
+    return await response.json();
+  } catch {
+    throw new ProviderModelFetchError("Mercury could not read the model list returned by this provider.");
+  }
+}
+function uniq(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+function prioritizeModels(models, preferred) {
+  const preferredSet = new Set(preferred);
+  const preferredMatches = preferred.filter((model) => models.includes(model));
+  const others = models.filter((model) => !preferredSet.has(model)).sort((a, b) => a.localeCompare(b));
+  return [...preferredMatches, ...others];
+}
+function limitModels(models) {
+  return models.slice(0, MAX_MODEL_OPTIONS);
+}
+function isOpenAIChatModel(id) {
+  const lower = id.toLowerCase();
+  if (lower.includes("image") || lower.includes("audio") || lower.includes("tts") || lower.includes("transcribe") || lower.includes("embedding") || lower.includes("moderation") || lower.includes("realtime") || lower.includes("whisper") || lower.includes("search") || lower.includes("computer")) {
+    return false;
+  }
+  return lower.startsWith("gpt-") || /^o\d/.test(lower);
+}
+function chooseRecommendedModel(provider, models, currentModel) {
+  const preferredByProvider = {
+    deepseek: DEEPSEEK_PREFERRED_MODELS,
+    openai: OPENAI_PREFERRED_MODELS,
+    anthropic: ANTHROPIC_PREFERRED_MODELS,
+    grok: GROK_PREFERRED_MODELS,
+    ollamaCloud: OLLAMA_CLOUD_PREFERRED_MODELS,
+    ollamaLocal: OLLAMA_LOCAL_PREFERRED_MODELS
+  };
+  for (const candidate of preferredByProvider[provider]) {
+    if (models.includes(candidate)) {
+      return candidate;
+    }
+  }
+  if (currentModel && models.includes(currentModel)) {
+    return currentModel;
+  }
+  return models[0];
+}
+function buildModelCatalog(provider, models, currentModel) {
+  const filtered = uniq(models);
+  if (filtered.length === 0) {
+    throw new ProviderModelFetchError("Mercury could not find any supported chat models for this provider.");
+  }
+  const recommendedModel = chooseRecommendedModel(provider, filtered, currentModel);
+  const preferredByProvider = {
+    deepseek: DEEPSEEK_PREFERRED_MODELS,
+    openai: OPENAI_PREFERRED_MODELS,
+    anthropic: ANTHROPIC_PREFERRED_MODELS,
+    grok: GROK_PREFERRED_MODELS,
+    ollamaCloud: OLLAMA_CLOUD_PREFERRED_MODELS,
+    ollamaLocal: OLLAMA_LOCAL_PREFERRED_MODELS
+  };
+  const withoutRecommended = filtered.filter((model) => model !== recommendedModel);
+  const prioritized = prioritizeModels(withoutRecommended, preferredByProvider[provider]);
+  return {
+    recommendedModel,
+    models: limitModels(prioritized)
+  };
+}
+async function fetchOpenAICompatModels(provider, config) {
+  const data = await fetchJson(
+    `${trimTrailingSlash(config.baseUrl)}/models`,
+    {
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`
+      }
+    },
+    `Mercury could not fetch models for this ${provider === "grok" ? "Grok" : provider === "deepseek" ? "DeepSeek" : "OpenAI"} key. Please re-enter it.`
+  );
+  const ids = (data.data ?? []).map((model) => model.id?.trim() ?? "").filter((id) => {
+    if (provider === "deepseek") {
+      return id.startsWith("deepseek-");
+    }
+    return isOpenAIChatModel(id);
+  });
+  return buildModelCatalog(provider, ids, config.model);
+}
+async function fetchAnthropicModels(config) {
+  const data = await fetchJson(
+    "https://api.anthropic.com/v1/models",
+    {
+      headers: {
+        "x-api-key": config.apiKey,
+        "anthropic-version": "2023-06-01"
+      }
+    },
+    "Mercury could not fetch models for this Anthropic key. Please re-enter it."
+  );
+  const ids = (data.data ?? []).map((model) => model.id?.trim() ?? "").filter((id) => id.startsWith("claude-"));
+  return buildModelCatalog("anthropic", ids, config.model);
+}
+async function fetchGrokModels(config) {
+  const data = await fetchJson(
+    `${trimTrailingSlash(config.baseUrl)}/language-models`,
+    {
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`
+      }
+    },
+    "Mercury could not fetch models for this Grok key. Please re-enter it."
+  );
+  const ids = (data.data ?? []).filter((model) => model.output_modalities?.includes("text") || model.output_modalities == null).map((model) => model.id?.trim() ?? "").filter((id) => id.startsWith("grok-"));
+  return buildModelCatalog("grok", ids, config.model);
+}
+async function fetchOllamaModels(provider, config) {
+  const headers = config.apiKey ? { Authorization: `Bearer ${config.apiKey}` } : void 0;
+  const data = await fetchJson(
+    `${trimTrailingSlash(config.baseUrl)}/tags`,
+    {
+      headers
+    },
+    provider === "ollamaCloud" ? "Mercury could not fetch models for this Ollama Cloud key. Please re-enter it." : "Mercury could not fetch models from this Ollama Local server. Please check the base URL and try again."
+  );
+  const ids = (data.models ?? []).map((model) => model.model?.trim() || model.name?.trim() || "").filter(Boolean);
+  return buildModelCatalog(provider, ids, config.model);
+}
+async function fetchProviderModelCatalog(provider, config) {
+  if (provider === "anthropic") {
+    return fetchAnthropicModels(config);
+  }
+  if (provider === "grok") {
+    return fetchGrokModels(config);
+  }
+  if (provider === "ollamaCloud" || provider === "ollamaLocal") {
+    return fetchOllamaModels(provider, config);
+  }
+  return fetchOpenAICompatModels(provider, config);
+}
+
 // src/index.ts
 var __dirname = dirname3(fileURLToPath(import.meta.url));
 var pkgVersion = JSON.parse(readFileSync12(join11(__dirname, "..", "package.json"), "utf8")).version;
 function hr() {
-  console.log(chalk6.dim("\u2500".repeat(50)));
+  console.log(chalk7.dim("\u2500".repeat(50)));
 }
 var MERCURY_ASCII = [
   "    __  _____________  ________  ________  __",
@@ -5015,26 +6078,26 @@ var MERCURY_ASCII = [
 function banner() {
   console.log("");
   for (const line of MERCURY_ASCII) {
-    console.log(chalk6.bold.cyan(`  ${line}`));
+    console.log(chalk7.bold.cyan(`  ${line}`));
   }
   console.log("");
-  console.log(chalk6.white("  an AI agent for personal tasks"));
-  console.log(chalk6.dim(`  v${pkgVersion} \xB7 by Cosmic Stack \xB7 mercury.cosmicstack.org`));
+  console.log(chalk7.white("  an AI agent for personal tasks"));
+  console.log(chalk7.dim(`  v${pkgVersion} \xB7 by Cosmic Stack \xB7 mercury.cosmicstack.org`));
   console.log("");
 }
 function splashScreen() {
   console.log("");
   for (const line of MERCURY_ASCII) {
-    console.log(chalk6.bold.cyan(`  ${line}`));
+    console.log(chalk7.bold.cyan(`  ${line}`));
   }
   console.log("");
-  console.log(chalk6.dim("  an AI agent for personal tasks"));
-  console.log(chalk6.cyan("  by Cosmic Stack"));
-  console.log(chalk6.dim("  mercury.cosmicstack.org"));
+  console.log(chalk7.dim("  an AI agent for personal tasks"));
+  console.log(chalk7.cyan("  by Cosmic Stack"));
+  console.log(chalk7.dim("  mercury.cosmicstack.org"));
   console.log("");
 }
 async function ask(prompt) {
-  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve13) => {
     rl.question(prompt, (answer) => {
       rl.close();
@@ -5083,14 +6146,14 @@ async function chooseProvidersToConfigure(config, isReconfig) {
     for (let i = 0; i < PROVIDER_OPTIONS.length; i++) {
       const option = PROVIDER_OPTIONS[i];
       const status = configured.includes(option.key) ? " (configured)" : "";
-      console.log(chalk6.white(`    ${i + 1}. ${option.label}${status}`));
+      console.log(chalk7.white(`    ${i + 1}. ${option.label}${status}`));
     }
     console.log("");
-    const prompt = isReconfig ? chalk6.white("  Choose providers to configure [comma-separated, Enter keeps current]: ") : chalk6.white("  Choose providers to configure [comma-separated, Enter for DeepSeek]: ");
+    const prompt = isReconfig ? chalk7.white("  Choose providers to configure [comma-separated, Enter keeps current]: ") : chalk7.white("  Choose providers to configure [comma-separated, Enter for DeepSeek]: ");
     const input = await ask(prompt);
     const parsed = parseProviderSelection(input);
     if (parsed === null) {
-      console.log(chalk6.red("  Please choose valid provider numbers, like `1` or `1,3,5`."));
+      console.log(chalk7.red("  Please choose valid provider numbers, like `1` or `1,3,5`."));
       console.log("");
       continue;
     }
@@ -5106,23 +6169,23 @@ async function chooseDefaultProvider(config) {
   }
   if (configured.length === 1) {
     config.providers.default = configured[0];
-    console.log(chalk6.dim(`  Default provider set to ${getProviderLabel(configured[0])}`));
+    console.log(chalk7.dim(`  Default provider set to ${getProviderLabel(configured[0])}`));
     return;
   }
   const suggested = configured.includes("deepseek") ? "deepseek" : configured[0];
   console.log("");
-  console.log(chalk6.bold.white("  Default Provider"));
-  console.log(chalk6.dim("  Select the LLM provider Mercury should use first."));
+  console.log(chalk7.bold.white("  Default Provider"));
+  console.log(chalk7.dim("  Select the LLM provider Mercury should use first."));
   console.log("");
   for (let i = 0; i < configured.length; i++) {
     const provider = configured[i];
     const recommended = provider === suggested ? " (recommended)" : "";
     const current = provider === config.providers.default ? " (current)" : "";
-    console.log(chalk6.white(`    ${i + 1}. ${getProviderLabel(provider)}${recommended}${current}`));
+    console.log(chalk7.white(`    ${i + 1}. ${getProviderLabel(provider)}${recommended}${current}`));
   }
   console.log("");
   while (true) {
-    const choice = await ask(chalk6.white(`  Choose [1-${configured.length}] [Enter for ${getProviderLabel(suggested)}]: `));
+    const choice = await ask(chalk7.white(`  Choose [1-${configured.length}] [Enter for ${getProviderLabel(suggested)}]: `));
     if (!choice) {
       config.providers.default = suggested;
       return;
@@ -5132,7 +6195,7 @@ async function chooseDefaultProvider(config) {
       config.providers.default = configured[num - 1];
       return;
     }
-    console.log(chalk6.red("  Please choose a valid number from the list above."));
+    console.log(chalk7.red("  Please choose a valid number from the list above."));
   }
 }
 function looksLikeToken(value, minLength = 20) {
@@ -5172,18 +6235,117 @@ function validateModelName(value) {
   if (/\s/.test(value)) return "Model name cannot contain spaces.";
   return null;
 }
+async function chooseProviderModel(providerLabel, recommendedModel, models) {
+  const selection = await selectWithArrowKeys(
+    `${providerLabel} Models`,
+    [
+      {
+        value: "__default__",
+        label: `Use provider default (${recommendedModel})`
+      },
+      ...models.map((model) => ({
+        value: model,
+        label: model
+      })),
+      {
+        value: "__custom__",
+        label: "Enter a custom model name"
+      }
+    ]
+  );
+  if (!selection || selection === "__default__") {
+    return recommendedModel;
+  }
+  if (selection !== "__custom__") {
+    return selection;
+  }
+  while (true) {
+    const customModel = await ask(chalk7.white(`  ${providerLabel} model [Enter or "none" for ${recommendedModel}]: `));
+    if (!customModel || customModel.toLowerCase() === "none") {
+      return recommendedModel;
+    }
+    const error = validateModelName(customModel);
+    if (!error) {
+      return customModel;
+    }
+    console.log(chalk7.red(`  ${error}`));
+  }
+}
+async function promptApiKeyWithModelSelection(config, provider, providerLabel, prompt, isReconfig) {
+  const existingConfig = config.providers[provider];
+  while (true) {
+    const value = await ask(prompt);
+    if (!value) {
+      if (isReconfig && existingConfig.apiKey) {
+        return {
+          apiKey: existingConfig.apiKey,
+          model: existingConfig.model,
+          skipped: true
+        };
+      }
+      return { skipped: true };
+    }
+    const formatError = validateApiKey(provider, value);
+    if (formatError) {
+      console.log(chalk7.red(`  ${formatError}`));
+      continue;
+    }
+    console.log(chalk7.dim(`  Validating ${providerLabel} and fetching models...`));
+    try {
+      const catalog = await fetchProviderModelCatalog(provider, {
+        ...existingConfig,
+        apiKey: value
+      });
+      const model = await chooseProviderModel(
+        providerLabel,
+        catalog.recommendedModel,
+        catalog.models
+      );
+      return { apiKey: value, model, skipped: false };
+    } catch (error) {
+      const message = error instanceof ProviderModelFetchError ? error.message : `Mercury could not fetch models for ${providerLabel}. Please re-enter the key.`;
+      console.log(chalk7.red(`  ${message}`));
+    }
+  }
+}
+async function promptOllamaLocalModelSelection(config) {
+  const existingConfig = config.providers.ollamaLocal;
+  while (true) {
+    const baseUrl = await promptValidatedValue(
+      chalk7.white(`  Ollama Local base URL [${existingConfig.baseUrl}]: `),
+      validateBaseUrl,
+      existingConfig.baseUrl
+    );
+    console.log(chalk7.dim("  Fetching Ollama Local models..."));
+    try {
+      const catalog = await fetchProviderModelCatalog("ollamaLocal", {
+        ...existingConfig,
+        baseUrl
+      });
+      const model = await chooseProviderModel(
+        "Ollama Local",
+        catalog.recommendedModel,
+        catalog.models
+      );
+      return { baseUrl, model, skipped: false };
+    } catch (error) {
+      const message = error instanceof ProviderModelFetchError ? error.message : "Mercury could not fetch Ollama Local models. Please check the base URL and try again.";
+      console.log(chalk7.red(`  ${message}`));
+    }
+  }
+}
 async function promptValidatedValue(prompt, validator, existingValue, options) {
   while (true) {
     const value = await ask(prompt);
     if (!value) {
       if (existingValue) return existingValue;
       if (options?.allowSkip) return void 0;
-      console.log(chalk6.red("  A value is required here."));
+      console.log(chalk7.red("  A value is required here."));
       continue;
     }
     const error = validator(value);
     if (!error) return value;
-    console.log(chalk6.red(`  ${error}`));
+    console.log(chalk7.red(`  ${error}`));
   }
 }
 function appendToEnv(key, value) {
@@ -5205,43 +6367,103 @@ function parseGithubRepo(input) {
   if (shortMatch) return { owner: shortMatch[1], repo: shortMatch[2] };
   return null;
 }
+function formatTelegramUser(user) {
+  const username = user.username ? ` (@${user.username})` : "";
+  const firstName = user.firstName ? ` ${user.firstName}` : "";
+  return `${user.userId}${username}${firstName}`;
+}
+function printTelegramAccessState(config) {
+  const admins = config.channels.telegram.admins;
+  const members = config.channels.telegram.members;
+  const pending = config.channels.telegram.pending;
+  const pendingSummary = pending.length > 0 ? pending.map((entry) => {
+    const code = entry.pairingCode ? ` [code: ${entry.pairingCode}]` : "";
+    return `${formatTelegramUser(entry)}${code}`;
+  }).join(", ") : "";
+  console.log("");
+  console.log(`  Telegram Access: ${chalk7.white(getTelegramAccessSummary(config))}`);
+  console.log(`  Admins:          ${admins.length > 0 ? chalk7.green(admins.map(formatTelegramUser).join(", ")) : chalk7.dim("none")}`);
+  console.log(`  Members:         ${members.length > 0 ? chalk7.green(members.map(formatTelegramUser).join(", ")) : chalk7.dim("none")}`);
+  console.log(`  Pending:         ${pending.length > 0 ? chalk7.yellow(pendingSummary) : chalk7.dim("none")}`);
+}
+function restartDaemonIfRunning(message) {
+  const daemon = getDaemonStatus();
+  if (!daemon.running) return;
+  if (message) {
+    console.log(chalk7.dim(`  ${message}`));
+  }
+  restartDaemon();
+}
+async function completeInitialTelegramPairing(config) {
+  if (!config.channels.telegram.enabled || !config.channels.telegram.botToken || hasTelegramAdmins(config)) {
+    return;
+  }
+  console.log("");
+  console.log(chalk7.bold.white("  Telegram Pairing"));
+  console.log(chalk7.dim("  1. Open Telegram and message your bot."));
+  console.log(chalk7.dim("  2. Send /start to receive your pairing code in Telegram."));
+  console.log(chalk7.dim("  3. Paste that pairing code below to finish setup."));
+  console.log("");
+  const telegram = new TelegramChannel(config);
+  try {
+    await telegram.start();
+    while (true) {
+      const pairingCode = await ask(chalk7.white("  Telegram Pairing Code: "));
+      if (!pairingCode) {
+        console.log(chalk7.red("  Telegram pairing code is required to continue."));
+        continue;
+      }
+      const approved = approveTelegramPendingRequestByPairingCode(config, pairingCode);
+      if (!approved) {
+        console.log(chalk7.red("  That pairing code is not valid yet. Send /start in Telegram, then paste the exact code here."));
+        continue;
+      }
+      saveConfig(config);
+      console.log(chalk7.green(`  \u2713 Telegram paired. First admin: ${formatTelegramUser(approved)}.`));
+      console.log("");
+      break;
+    }
+  } finally {
+    await telegram.stop();
+  }
+}
 async function configure(existingConfig) {
   const isReconfig = !!existingConfig;
   const config = existingConfig ?? loadConfig();
   if (isReconfig) {
     banner();
-    console.log(chalk6.yellow("  Reconfiguring Mercury \u2014 press Enter to keep current value."));
+    console.log(chalk7.yellow("  Reconfiguring Mercury \u2014 press Enter to keep current value."));
   } else {
     splashScreen();
-    console.log(chalk6.yellow("  First run detected \u2014 let's set you up."));
+    console.log(chalk7.yellow("  First run detected \u2014 let's set you up."));
   }
   hr();
   console.log("");
-  console.log(chalk6.bold.white("  Identity"));
+  console.log(chalk7.bold.white("  Identity"));
   console.log("");
   if (isReconfig) {
-    const ownerName = await ask(chalk6.white(`  Your name [${config.identity.owner}]: `));
+    const ownerName = await ask(chalk7.white(`  Your name [${config.identity.owner}]: `));
     if (ownerName) config.identity.owner = ownerName;
-    const agentName = await ask(chalk6.white(`  Agent name [${config.identity.name}]: `));
+    const agentName = await ask(chalk7.white(`  Agent name [${config.identity.name}]: `));
     if (agentName) config.identity.name = agentName;
   } else {
-    const ownerName = await ask(chalk6.white("  Your name: "));
+    const ownerName = await ask(chalk7.white("  Your name: "));
     if (!ownerName) {
-      console.log(chalk6.red("  Name is required."));
+      console.log(chalk7.red("  Name is required."));
       process.exit(1);
     }
     config.identity.owner = ownerName;
-    const agentName = await ask(chalk6.white(`  Agent name [${config.identity.name}]: `));
+    const agentName = await ask(chalk7.white(`  Agent name [${config.identity.name}]: `));
     if (agentName) config.identity.name = agentName;
   }
   config.identity.creator = config.identity.creator || "Cosmic Stack";
   hr();
   console.log("");
-  console.log(chalk6.bold.white("  LLM Providers"));
+  console.log(chalk7.bold.white("  LLM Providers"));
   if (isReconfig) {
-    console.log(chalk6.dim("  Choose which providers to configure now. Existing values are shown where available."));
+    console.log(chalk7.dim("  Choose which providers to configure now. Existing values are shown where available."));
   } else {
-    console.log(chalk6.dim("  Choose one or more providers. Press Enter to configure DeepSeek by default."));
+    console.log(chalk7.dim("  Choose one or more providers. Press Enter to configure DeepSeek by default."));
   }
   console.log("");
   while (true) {
@@ -5250,92 +6472,97 @@ async function configure(existingConfig) {
     for (const provider of selectedProviders) {
       if (provider === "deepseek") {
         const mask = isReconfig && config.providers.deepseek.apiKey ? ` [${maskKey(config.providers.deepseek.apiKey)}]` : "";
-        const key = await promptValidatedValue(
-          chalk6.white(`  DeepSeek API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
-          (value) => validateApiKey("deepseek", value),
-          isReconfig ? config.providers.deepseek.apiKey : void 0,
-          { allowSkip: true }
+        const result = await promptApiKeyWithModelSelection(
+          config,
+          "deepseek",
+          "DeepSeek",
+          chalk7.white(`  DeepSeek API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
+          isReconfig
         );
-        if (key) {
-          config.providers.deepseek.apiKey = key;
+        if (!result.skipped && result.apiKey && result.model) {
+          config.providers.deepseek.apiKey = result.apiKey;
+          config.providers.deepseek.model = result.model;
           config.providers.deepseek.enabled = true;
         }
         continue;
       }
       if (provider === "openai") {
         const mask = isReconfig && config.providers.openai.apiKey ? ` [${maskKey(config.providers.openai.apiKey)}]` : "";
-        const key = await promptValidatedValue(
-          chalk6.white(`  OpenAI API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
-          (value) => validateApiKey("openai", value),
-          isReconfig ? config.providers.openai.apiKey : void 0,
-          { allowSkip: true }
+        const result = await promptApiKeyWithModelSelection(
+          config,
+          "openai",
+          "OpenAI",
+          chalk7.white(`  OpenAI API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
+          isReconfig
         );
-        if (key) {
-          config.providers.openai.apiKey = key;
+        if (!result.skipped && result.apiKey && result.model) {
+          config.providers.openai.apiKey = result.apiKey;
+          config.providers.openai.model = result.model;
           config.providers.openai.enabled = true;
         }
         continue;
       }
       if (provider === "anthropic") {
         const mask = isReconfig && config.providers.anthropic.apiKey ? ` [${maskKey(config.providers.anthropic.apiKey)}]` : "";
-        const key = await promptValidatedValue(
-          chalk6.white(`  Anthropic API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
-          (value) => validateApiKey("anthropic", value),
-          isReconfig ? config.providers.anthropic.apiKey : void 0,
-          { allowSkip: true }
+        const result = await promptApiKeyWithModelSelection(
+          config,
+          "anthropic",
+          "Anthropic",
+          chalk7.white(`  Anthropic API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
+          isReconfig
         );
-        if (key) {
-          config.providers.anthropic.apiKey = key;
+        if (!result.skipped && result.apiKey && result.model) {
+          config.providers.anthropic.apiKey = result.apiKey;
+          config.providers.anthropic.model = result.model;
           config.providers.anthropic.enabled = true;
         }
         continue;
       }
       if (provider === "grok") {
         const mask = isReconfig && config.providers.grok.apiKey ? ` [${maskKey(config.providers.grok.apiKey)}]` : "";
-        const key = await promptValidatedValue(
-          chalk6.white(`  Grok API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
-          (value) => validateApiKey("grok", value),
-          isReconfig ? config.providers.grok.apiKey : void 0,
-          { allowSkip: true }
+        const result = await promptApiKeyWithModelSelection(
+          config,
+          "grok",
+          "Grok",
+          chalk7.white(`  Grok API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
+          isReconfig
         );
-        if (key) {
-          config.providers.grok.apiKey = key;
+        if (!result.skipped && result.apiKey && result.model) {
+          config.providers.grok.apiKey = result.apiKey;
+          config.providers.grok.model = result.model;
           config.providers.grok.enabled = true;
         }
         continue;
       }
       if (provider === "ollamaCloud") {
         const mask = isReconfig && config.providers.ollamaCloud.apiKey ? ` [${maskKey(config.providers.ollamaCloud.apiKey)}]` : "";
-        const key = await promptValidatedValue(
-          chalk6.white(`  Ollama Cloud API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
-          (value) => validateApiKey("ollamaCloud", value),
-          isReconfig ? config.providers.ollamaCloud.apiKey : void 0,
-          { allowSkip: true }
+        const result = await promptApiKeyWithModelSelection(
+          config,
+          "ollamaCloud",
+          "Ollama Cloud",
+          chalk7.white(`  Ollama Cloud API key${mask}${isReconfig ? "" : " (Enter to skip)"}: `),
+          isReconfig
         );
-        if (key) {
-          config.providers.ollamaCloud.apiKey = key;
+        if (!result.skipped && result.apiKey && result.model) {
+          config.providers.ollamaCloud.apiKey = result.apiKey;
+          config.providers.ollamaCloud.model = result.model;
           config.providers.ollamaCloud.enabled = true;
         }
         continue;
       }
       if (provider === "ollamaLocal") {
-        config.providers.ollamaLocal.baseUrl = await promptValidatedValue(
-          chalk6.white(`  Ollama Local base URL [${config.providers.ollamaLocal.baseUrl}]: `),
-          validateBaseUrl,
-          config.providers.ollamaLocal.baseUrl
-        );
-        config.providers.ollamaLocal.model = await promptValidatedValue(
-          chalk6.white(`  Ollama Local model [${config.providers.ollamaLocal.model}]: `),
-          validateModelName,
-          config.providers.ollamaLocal.model
-        );
-        config.providers.ollamaLocal.enabled = true;
+        const result = await promptOllamaLocalModelSelection(config);
+        if (!result.skipped && result.baseUrl && result.model) {
+          config.providers.ollamaLocal.baseUrl = result.baseUrl;
+          config.providers.ollamaLocal.model = result.model;
+          config.providers.ollamaLocal.enabled = true;
+        }
       }
     }
     const configuredProviders = getConfiguredProviderNames(config);
     if (configuredProviders.length === 0) {
-      console.log(chalk6.red("  You need to configure at least one LLM provider to continue."));
-      console.log(chalk6.dim("  Let\u2019s try that step again."));
+      console.log(chalk7.red("  You need to configure at least one LLM provider to continue."));
+      console.log(chalk7.dim("  Let\u2019s try that step again."));
       console.log("");
       continue;
     }
@@ -5344,78 +6571,81 @@ async function configure(existingConfig) {
   }
   hr();
   console.log("");
-  console.log(chalk6.bold.white("  Telegram (optional)"));
+  console.log(chalk7.bold.white("  Telegram (optional)"));
   if (isReconfig) {
-    console.log(chalk6.dim('  Leave empty to keep current value. Enter "none" to disable.'));
+    console.log(chalk7.dim('  Leave empty to keep current value. Enter "none" to disable.'));
   } else {
-    console.log(chalk6.dim("  Leave empty to skip. You can add it later."));
-    console.log(chalk6.dim("  To create a bot token:"));
-    console.log(chalk6.dim("    1. Open Telegram and message @BotFather"));
-    console.log(chalk6.dim("    2. Run /newbot and follow the prompts"));
-    console.log(chalk6.dim("    3. Copy the bot token BotFather gives you"));
-    console.log(chalk6.dim("    4. Paste that token here"));
+    console.log(chalk7.dim("  Leave empty to skip. You can add it later."));
+    console.log(chalk7.dim("  To create a bot token:"));
+    console.log(chalk7.dim("    1. Open Telegram and message @BotFather"));
+    console.log(chalk7.dim("    2. Run /newbot and follow the prompts"));
+    console.log(chalk7.dim("    3. Copy the bot token BotFather gives you"));
+    console.log(chalk7.dim("    4. Paste that token here"));
+    console.log(chalk7.dim("  After setup, users send /start to request access."));
+    console.log(chalk7.dim("  The first Telegram user gets a pairing code, and you approve that code from the CLI."));
   }
   console.log("");
   const tgMask = isReconfig && config.channels.telegram.botToken ? ` [${maskKey(config.channels.telegram.botToken)}]` : "";
-  const telegramToken = await ask(chalk6.white(`  Telegram Bot Token${tgMask}: `));
+  const telegramToken = await ask(chalk7.white(`  Telegram Bot Token${tgMask}: `));
   if (isReconfig && telegramToken.toLowerCase() === "none") {
     config.channels.telegram.enabled = false;
     config.channels.telegram.botToken = "";
-    clearTelegramPairing(config);
+    clearTelegramAccess(config);
   } else if (telegramToken) {
     if (telegramToken !== config.channels.telegram.botToken) {
-      clearTelegramPairing(config);
+      clearTelegramAccess(config);
     }
     config.channels.telegram.botToken = telegramToken;
     config.channels.telegram.enabled = true;
   }
+  await completeInitialTelegramPairing(config);
   hr();
   console.log("");
-  console.log(chalk6.bold.white("  GitHub Integration (optional)"));
-  console.log(chalk6.dim("  Connect Mercury to GitHub so it can create PRs, manage issues,"));
-  console.log(chalk6.dim("  review code, and co-author commits on your behalf."));
-  console.log(chalk6.dim("  Leave empty to skip. You can add it later with mercury doctor."));
+  console.log(chalk7.bold.white("  GitHub Integration (optional)"));
+  console.log(chalk7.dim("  Connect Mercury to GitHub so it can create PRs, manage issues,"));
+  console.log(chalk7.dim("  review code, and co-author commits on your behalf."));
+  console.log(chalk7.dim("  Leave empty to skip. You can add it later with mercury doctor."));
   console.log("");
   const ghUserCurrent = isReconfig && config.github.username ? ` [${config.github.username}]` : "";
-  const ghUsername = await ask(chalk6.white(`  1. Your GitHub username${ghUserCurrent}: `));
+  const ghUsername = await ask(chalk7.white(`  1. Your GitHub username${ghUserCurrent}: `));
   if (ghUsername) config.github.username = ghUsername;
   if (!config.github.email) {
     config.github.email = "mercury@cosmicstack.org";
   }
   console.log("");
-  console.log(chalk6.dim("     You need a Personal Access Token (PAT) with repo access."));
-  console.log(chalk6.dim("     Fine-grained (recommended): github.com/settings/personal-access-tokens/new"));
-  console.log(chalk6.dim("       \u2192 Permissions: Contents (R/W), Pull requests (R/W), Issues (R/W)"));
-  console.log(chalk6.dim("     Classic: github.com/settings/tokens/new"));
-  console.log(chalk6.dim("       \u2192 Scope: repo (full control)"));
+  console.log(chalk7.dim("     You need a Personal Access Token (PAT) with repo access."));
+  console.log(chalk7.dim("     Fine-grained (recommended): github.com/settings/personal-access-tokens/new"));
+  console.log(chalk7.dim("       \u2192 Permissions: Contents (R/W), Pull requests (R/W), Issues (R/W)"));
+  console.log(chalk7.dim("     Classic: github.com/settings/tokens/new"));
+  console.log(chalk7.dim("       \u2192 Scope: repo (full control)"));
   const ghTokenCurrent = process.env.GITHUB_TOKEN ? ` [${maskKey(process.env.GITHUB_TOKEN)}]` : "";
-  const ghToken = await ask(chalk6.white(`  2. GitHub PAT${ghTokenCurrent}: `));
+  const ghToken = await ask(chalk7.white(`  2. GitHub PAT${ghTokenCurrent}: `));
   if (ghToken) {
     appendToEnv("GITHUB_TOKEN", ghToken);
   }
   if (config.github.username || process.env.GITHUB_TOKEN) {
     console.log("");
-    console.log(chalk6.dim('     Set a default repo so you can say "create an issue" without'));
-    console.log(chalk6.dim("     specifying the repo every time. Enter owner/name or a full URL."));
-    console.log(chalk6.dim("     Example: hotheadhacker/mercury-agent"));
-    console.log(chalk6.dim("     Example: https://github.com/hotheadhacker/mercury-agent"));
+    console.log(chalk7.dim('     Set a default repo so you can say "create an issue" without'));
+    console.log(chalk7.dim("     specifying the repo every time. Enter owner/name or a full URL."));
+    console.log(chalk7.dim("     Example: hotheadhacker/mercury-agent"));
+    console.log(chalk7.dim("     Example: https://github.com/hotheadhacker/mercury-agent"));
     const ghOwnerCurrent = isReconfig && config.github.defaultOwner ? ` [${config.github.defaultOwner}/${config.github.defaultRepo}]` : "";
-    const ghRepoInput = await ask(chalk6.white(`  3. Default repo${ghOwnerCurrent}: `));
+    const ghRepoInput = await ask(chalk7.white(`  3. Default repo${ghOwnerCurrent}: `));
     if (ghRepoInput) {
       const parsed = parseGithubRepo(ghRepoInput);
       if (parsed) {
         config.github.defaultOwner = parsed.owner;
         config.github.defaultRepo = parsed.repo;
       } else {
-        console.log(chalk6.yellow("  Could not parse repo. Use format: owner/repo or a GitHub URL."));
+        console.log(chalk7.yellow("  Could not parse repo. Use format: owner/repo or a GitHub URL."));
       }
     }
   }
   hr();
   console.log("");
-  console.log(chalk6.bold.white("  Token Budget"));
+  console.log(chalk7.bold.white("  Token Budget"));
   console.log("");
-  const budgetPrompt = isReconfig ? chalk6.white(`  Daily token budget [${config.tokens.dailyBudget.toLocaleString()}]: `) : chalk6.white(`  Daily token budget [${config.tokens.dailyBudget.toLocaleString()}]: `);
+  const budgetPrompt = isReconfig ? chalk7.white(`  Daily token budget [${config.tokens.dailyBudget.toLocaleString()}]: `) : chalk7.white(`  Daily token budget [${config.tokens.dailyBudget.toLocaleString()}]: `);
   const budgetStr = await ask(budgetPrompt);
   if (budgetStr) {
     const budget = parseInt(budgetStr.replace(/,/g, ""), 10);
@@ -5427,14 +6657,14 @@ async function configure(existingConfig) {
   saveConfig(config);
   const home = getMercuryHome();
   console.log("");
-  console.log(chalk6.green(`  \u2713 Config saved to ${home}/mercury.yaml`));
-  console.log(chalk6.green(`  \u2713 Soul files seeded in ${home}/soul/`));
-  console.log(chalk6.green(`  \u2713 Memory stored in ${home}/memory/`));
-  console.log(chalk6.green(`  \u2713 Permissions seeded in ${home}/permissions.yaml`));
-  console.log(chalk6.green(`  \u2713 Skills directory ready in ${home}/skills/`));
+  console.log(chalk7.green(`  \u2713 Config saved to ${home}/mercury.yaml`));
+  console.log(chalk7.green(`  \u2713 Soul files seeded in ${home}/soul/`));
+  console.log(chalk7.green(`  \u2713 Memory stored in ${home}/memory/`));
+  console.log(chalk7.green(`  \u2713 Permissions seeded in ${home}/permissions.yaml`));
+  console.log(chalk7.green(`  \u2713 Skills directory ready in ${home}/skills/`));
   console.log("");
-  console.log(chalk6.cyan(`  ${config.identity.name} is ready. Run \`mercury start\` to chat.`));
-  console.log(chalk6.dim("  mercury.cosmicstack.org"));
+  console.log(chalk7.cyan(`  ${config.identity.name} is ready. Run \`mercury start\` to chat.`));
+  console.log(chalk7.dim("  mercury.cosmicstack.org"));
   console.log("");
 }
 function autoDaemonize() {
@@ -5442,22 +6672,22 @@ function autoDaemonize() {
   if (daemon.running) {
     return;
   }
-  console.log(chalk6.dim("  Setting up background mode..."));
+  console.log(chalk7.dim("  Setting up background mode..."));
   try {
     if (!isServiceInstalled()) {
       installService();
     }
   } catch {
-    console.log(chalk6.dim("  Service install skipped (can run `mercury service install` later)."));
+    console.log(chalk7.dim("  Service install skipped (can run `mercury service install` later)."));
   }
   const ok = tryAutoDaemonize();
   if (ok) {
     const status = getDaemonStatus();
-    console.log(chalk6.green(`  \u2713 Mercury is running in background (PID: ${status.pid})`));
-    console.log(chalk6.green("  \u2713 Auto-starts on login. Auto-restarts on crash."));
-    console.log(chalk6.dim("  Use `mercury stop` to stop. `mercury restart` to restart."));
+    console.log(chalk7.green(`  \u2713 Mercury is running in background (PID: ${status.pid})`));
+    console.log(chalk7.green("  \u2713 Auto-starts on login. Auto-restarts on crash."));
+    console.log(chalk7.dim("  Use `mercury stop` to stop. `mercury restart` to restart."));
   } else {
-    console.log(chalk6.dim("  Background mode not available. Run `mercury up` to set it up."));
+    console.log(chalk7.dim("  Background mode not available. Run `mercury up` to set it up."));
   }
   console.log("");
 }
@@ -5467,7 +6697,7 @@ async function runAgent(isDaemon = false) {
   const name = config.identity.name;
   if (!isDaemon) {
     banner();
-    console.log(chalk6.white(`  ${name} is waking up...`));
+    console.log(chalk7.white(`  ${name} is waking up...`));
     console.log("");
   } else {
     logger.info(`${name} is waking up (daemon mode)...`);
@@ -5479,19 +6709,25 @@ async function runAgent(isDaemon = false) {
       logger.error("No LLM providers available. Run `mercury doctor` to configure providers.");
       return;
     }
-    console.log(chalk6.red("  No LLM providers available. Run `mercury doctor` to configure providers."));
+    console.log(chalk7.red("  No LLM providers available. Run `mercury doctor` to configure providers."));
     process.exit(1);
   }
   const available = providers.listAvailable();
+  const providerLabels = available.map((provider) => getProviderLabel(provider));
+  const providerModels = available.map((provider) => {
+    const key = provider;
+    return `${getProviderLabel(key)}: ${config.providers[key].model}`;
+  });
   if (!isDaemon) {
-    console.log(chalk6.dim(`  Providers: ${available.join(", ")}`));
+    console.log(chalk7.dim(`  Providers: ${providerLabels.join(", ")}`));
+    console.log(chalk7.dim(`  Models: ${providerModels.join(" | ")}`));
   } else {
     logger.info({ providers: available }, "Providers loaded");
   }
   const skillLoader = new SkillLoader();
   const skills = skillLoader.discover();
   if (!isDaemon) {
-    console.log(chalk6.dim(`  Skills: ${skills.length > 0 ? skills.map((s) => s.name).join(", ") : "none installed"}`));
+    console.log(chalk7.dim(`  Skills: ${skills.length > 0 ? skills.map((s) => s.name).join(", ") : "none installed"}`));
   }
   const scheduler = new Scheduler(config);
   const identity = new Identity();
@@ -5508,22 +6744,30 @@ async function runAgent(isDaemon = false) {
     manual: () => getManual()
   });
   capabilities.setSendFileHandler(async (filePath) => {
-    const msg = channels.getActiveChannels().includes("telegram") ? channels.get("telegram") : channels.get("cli");
-    if (msg) {
-      await msg.sendFile(filePath);
+    const { channelId, channelType } = capabilities.getChannelContext();
+    const telegram = channels.get("telegram");
+    if (channelType === "telegram" && telegram) {
+      await telegram.sendFile(filePath, channelId);
+      return;
+    }
+    if (config.channels.telegram.enabled && telegram && getTelegramApprovedUsers(config).length > 0) {
+      await telegram.sendFile(filePath);
+      return;
+    }
+    const cli = channels.get("cli");
+    if (cli) {
+      await cli.sendFile(filePath);
     }
   });
   capabilities.setSendMessageHandler(async (content) => {
     const telegram = channels.get("telegram");
-    const pairedChatId = config.channels.telegram.pairedChatId;
-    const pairedUserId = config.channels.telegram.pairedUserId;
     if (!config.channels.telegram.enabled || !telegram) {
       throw new Error("Telegram is not configured. Add a bot token in setup or run `mercury doctor`.");
     }
-    if (pairedChatId == null || pairedUserId == null) {
-      throw new Error("Telegram is not paired. Complete the pairing flow with /start or /pair from the Telegram owner account.");
+    if (getTelegramApprovedUsers(config).length === 0) {
+      throw new Error("Telegram has no approved users. Ask someone to send /start, then approve the request from Mercury.");
     }
-    await telegram.send(content, `telegram:${pairedChatId}`);
+    await telegram.send(content);
   });
   if (process.env.GITHUB_TOKEN) {
     setGitHubToken(process.env.GITHUB_TOKEN);
@@ -5558,17 +6802,13 @@ async function runAgent(isDaemon = false) {
   const activeCh = channels.getActiveChannels();
   const toolNames = capabilities.getToolNames();
   if (!isDaemon) {
-    console.log(chalk6.dim(`  Channels: ${activeCh.join(", ")}`));
-    console.log(chalk6.dim(`  Tools: ${toolNames.join(", ")}`));
-    console.log(chalk6.dim(`  Permissions: ${getMercuryHome()}/permissions.yaml`));
-    console.log(chalk6.dim(`  Schedules: ${getMercuryHome()}/schedules.yaml`));
     if (config.identity.creator) {
-      console.log(chalk6.dim(`  Creator: ${config.identity.creator}`));
+      console.log(chalk7.dim(`  Creator: ${config.identity.creator}`));
     }
     hr();
     console.log("");
-    console.log(chalk6.green(`  ${name} is live. Type a message and press Enter.`));
-    console.log(chalk6.dim("  Ctrl+C to exit \xB7 /help for commands"));
+    console.log(chalk7.green(`  ${name} is live. Type a message and press Enter.`));
+    console.log(chalk7.dim("  Ctrl+C to exit \xB7 /help for commands"));
     console.log("");
   } else {
     logger.info({ channels: activeCh, tools: toolNames }, "Mercury is live (daemon mode)");
@@ -5576,7 +6816,7 @@ async function runAgent(isDaemon = false) {
   const shutdown = async () => {
     if (!isDaemon) {
       console.log("");
-      console.log(chalk6.dim(`  ${name} is shutting down...`));
+      console.log(chalk7.dim(`  ${name} is shutting down...`));
     } else {
       logger.info("Mercury is shutting down (daemon mode)");
     }
@@ -5623,17 +6863,17 @@ program.command("up").description("Ensure Mercury is running persistently \u2014
   const daemon = getDaemonStatus();
   if (daemon.running && daemon.pid) {
     console.log("");
-    console.log(chalk6.green(`  Mercury is already running (PID: ${daemon.pid})`));
-    console.log(chalk6.dim(`  Logs: ${daemon.logPath}`));
+    console.log(chalk7.green(`  Mercury is already running (PID: ${daemon.pid})`));
+    console.log(chalk7.dim(`  Logs: ${daemon.logPath}`));
     console.log("");
     return;
   }
   if (!isServiceInstalled()) {
     console.log("");
-    console.log(chalk6.cyan("  Installing Mercury as a system service..."));
+    console.log(chalk7.cyan("  Installing Mercury as a system service..."));
     installService();
   }
-  console.log(chalk6.cyan("  Starting Mercury in background..."));
+  console.log(chalk7.cyan("  Starting Mercury in background..."));
   startBackground();
 });
 program.command("logs").description("Show recent daemon logs").action(() => {
@@ -5660,43 +6900,175 @@ program.command("status").description("Show current configuration and daemon sta
   const skills = skillLoader.discover();
   const daemon = getDaemonStatus();
   banner();
-  console.log(`  Name:     ${chalk6.cyan(config.identity.name)}`);
-  console.log(`  Owner:    ${chalk6.white(config.identity.owner || "(not set)")}`);
+  console.log(`  Name:     ${chalk7.cyan(config.identity.name)}`);
+  console.log(`  Owner:    ${chalk7.white(config.identity.owner || "(not set)")}`);
   if (config.identity.creator) {
-    console.log(`  Creator:  ${chalk6.white(config.identity.creator)}`);
-  }
-  console.log(`  Provider: ${chalk6.white(getProviderLabel(config.providers.default))}`);
-  console.log(`  Telegram: ${config.channels.telegram.enabled ? chalk6.green("enabled") : chalk6.dim("disabled")}`);
-  console.log(`  Telegram Pairing: ${config.channels.telegram.pairedUserId != null ? chalk6.green(`paired to user ${config.channels.telegram.pairedUserId}${config.channels.telegram.pairedUsername ? ` (@${config.channels.telegram.pairedUsername})` : ""}`) : chalk6.dim("unpaired")}`);
-  console.log(`  Skills:   ${skills.length > 0 ? chalk6.green(skills.map((s) => s.name).join(", ")) : chalk6.dim("none")}`);
-  console.log(`  Budget:   ${chalk6.white(config.tokens.dailyBudget.toLocaleString())} tokens/day`);
-  console.log(`  Setup:    ${isSetupComplete() ? chalk6.green("complete") : chalk6.red("not done")}`);
-  console.log(`  Daemon:   ${daemon.running ? chalk6.green(`running (PID: ${daemon.pid})`) : chalk6.dim("not running")}`);
-  console.log(`  Home:     ${chalk6.dim(home)}`);
+    console.log(`  Creator:  ${chalk7.white(config.identity.creator)}`);
+  }
+  console.log(`  Provider: ${chalk7.white(getProviderLabel(config.providers.default))}`);
+  console.log(`  Telegram: ${config.channels.telegram.enabled ? chalk7.green("enabled") : chalk7.dim("disabled")}`);
+  console.log(`  Telegram Access: ${chalk7.white(getTelegramAccessSummary(config))}`);
+  console.log(`  Skills:   ${skills.length > 0 ? chalk7.green(skills.map((s) => s.name).join(", ")) : chalk7.dim("none")}`);
+  console.log(`  Budget:   ${chalk7.white(config.tokens.dailyBudget.toLocaleString())} tokens/day`);
+  console.log(`  Setup:    ${isSetupComplete() ? chalk7.green("complete") : chalk7.red("not done")}`);
+  console.log(`  Daemon:   ${daemon.running ? chalk7.green(`running (PID: ${daemon.pid})`) : chalk7.dim("not running")}`);
+  console.log(`  Home:     ${chalk7.dim(home)}`);
+  printTelegramAccessState(config);
   console.log("");
 });
 program.command("help").description("Show capabilities and commands manual").action(() => {
   console.log(getManual());
 });
-var telegramCmd = program.command("telegram").description("Manage Telegram pairing and access");
-telegramCmd.command("unpair").description("Clear the paired Telegram owner for this Mercury instance").action(() => {
+var telegramCmd = program.command("telegram").description("Manage Telegram access approvals and admins");
+telegramCmd.command("list").description("Show approved Telegram users and pending access requests").action(() => {
   const config = loadConfig();
-  const daemon = getDaemonStatus();
-  if (config.channels.telegram.pairedUserId == null) {
+  console.log("");
+  printTelegramAccessState(config);
+  console.log("");
+});
+telegramCmd.command("approve <codeOrUserId>").description("Approve a pending Telegram access request by pairing code or user ID").action((codeOrUserId) => {
+  const config = loadConfig();
+  const hasAdmins = hasTelegramAdmins(config);
+  if (!hasAdmins) {
+    const approved2 = approveTelegramPendingRequestByPairingCode(config, codeOrUserId.trim());
+    if (!approved2) {
+      console.log("");
+      console.log(chalk7.red(`  No pending first-time Telegram pairing found for code ${codeOrUserId}.`));
+      console.log("");
+      return;
+    }
+    saveConfig(config);
+    console.log("");
+    console.log(chalk7.green(`  \u2713 Approved first Telegram admin ${formatTelegramUser(approved2)}.`));
+    restartDaemonIfRunning("Restarting the background daemon to apply the change immediately...");
+    console.log("");
+    return;
+  }
+  const targetUserId = Number(codeOrUserId);
+  if (isNaN(targetUserId)) {
+    console.log("");
+    console.log(chalk7.red("  Please provide a numeric Telegram user ID once Telegram already has an admin."));
+    console.log("");
+    return;
+  }
+  const approved = approveTelegramPendingRequest(config, targetUserId, "member");
+  if (!approved) {
     console.log("");
-    console.log(chalk6.dim("  Telegram is already unpaired."));
+    console.log(chalk7.red(`  No pending Telegram request found for user ${codeOrUserId}.`));
     console.log("");
     return;
   }
-  clearTelegramPairing(config);
   saveConfig(config);
   console.log("");
-  console.log(chalk6.green("  \u2713 Telegram pairing cleared."));
-  if (daemon.running) {
-    console.log(chalk6.dim("  Restarting the background daemon to apply the change immediately..."));
-    restartDaemon();
-  } else {
-    console.log(chalk6.dim("  The next private Telegram user to send /start will pair this Mercury instance."));
+  console.log(chalk7.green(`  \u2713 Approved Telegram member ${formatTelegramUser(approved)}.`));
+  restartDaemonIfRunning("Restarting the background daemon to apply the change immediately...");
+  console.log("");
+});
+telegramCmd.command("reject <userId>").description("Reject a pending Telegram access request").action((userId) => {
+  const config = loadConfig();
+  const targetUserId = Number(userId);
+  if (isNaN(targetUserId)) {
+    console.log("");
+    console.log(chalk7.red("  Please provide a numeric Telegram user ID."));
+    console.log("");
+    return;
+  }
+  const rejected = rejectTelegramPendingRequest(config, targetUserId);
+  if (!rejected) {
+    console.log("");
+    console.log(chalk7.red(`  No pending Telegram request found for user ${userId}.`));
+    console.log("");
+    return;
+  }
+  saveConfig(config);
+  console.log("");
+  console.log(chalk7.green(`  \u2713 Rejected Telegram request for ${formatTelegramUser(rejected)}.`));
+  restartDaemonIfRunning("Restarting the background daemon to apply the change immediately...");
+  console.log("");
+});
+telegramCmd.command("remove <userId>").description("Remove an approved Telegram admin or member").action((userId) => {
+  const config = loadConfig();
+  const targetUserId = Number(userId);
+  if (isNaN(targetUserId)) {
+    console.log("");
+    console.log(chalk7.red("  Please provide a numeric Telegram user ID."));
+    console.log("");
+    return;
+  }
+  const removed = removeTelegramUser(config, targetUserId);
+  if (!removed) {
+    console.log("");
+    console.log(chalk7.red(`  No approved Telegram user found for ${userId}.`));
+    console.log("");
+    return;
+  }
+  saveConfig(config);
+  console.log("");
+  console.log(chalk7.green(`  \u2713 Removed Telegram access for ${formatTelegramUser(removed)}.`));
+  restartDaemonIfRunning("Restarting the background daemon to apply the change immediately...");
+  console.log("");
+});
+telegramCmd.command("promote <userId>").description("Promote an approved Telegram member to admin").action((userId) => {
+  const config = loadConfig();
+  const targetUserId = Number(userId);
+  if (isNaN(targetUserId)) {
+    console.log("");
+    console.log(chalk7.red("  Please provide a numeric Telegram user ID."));
+    console.log("");
+    return;
+  }
+  const promoted = promoteTelegramUserToAdmin(config, targetUserId);
+  if (!promoted) {
+    console.log("");
+    console.log(chalk7.red(`  No Telegram member found for ${userId}.`));
+    console.log("");
+    return;
+  }
+  saveConfig(config);
+  console.log("");
+  console.log(chalk7.green(`  \u2713 Promoted ${formatTelegramUser(promoted)} to Telegram admin.`));
+  restartDaemonIfRunning("Restarting the background daemon to apply the change immediately...");
+  console.log("");
+});
+telegramCmd.command("demote <userId>").description("Demote a Telegram admin to member").action((userId) => {
+  const config = loadConfig();
+  const targetUserId = Number(userId);
+  if (isNaN(targetUserId)) {
+    console.log("");
+    console.log(chalk7.red("  Please provide a numeric Telegram user ID."));
+    console.log("");
+    return;
+  }
+  const demoted = demoteTelegramAdmin(config, targetUserId);
+  if (!demoted) {
+    console.log("");
+    console.log(chalk7.red("  Could not demote that Telegram admin. Mercury must keep at least one admin."));
+    console.log("");
+    return;
+  }
+  saveConfig(config);
+  console.log("");
+  console.log(chalk7.green(`  \u2713 Demoted ${formatTelegramUser(demoted)} to Telegram member.`));
+  restartDaemonIfRunning("Restarting the background daemon to apply the change immediately...");
+  console.log("");
+});
+telegramCmd.command("unpair").description("Reset all Telegram access for this Mercury instance").action(() => {
+  const config = loadConfig();
+  const hasAnyAccess = getTelegramApprovedUsers(config).length > 0 || getTelegramPendingRequests(config).length > 0;
+  if (!hasAnyAccess) {
+    console.log("");
+    console.log(chalk7.dim("  Telegram access is already empty."));
+    console.log("");
+    return;
+  }
+  clearTelegramAccess(config);
+  saveConfig(config);
+  console.log("");
+  console.log(chalk7.green("  \u2713 Telegram access reset."));
+  restartDaemonIfRunning("Restarting the background daemon to apply the change immediately...");
+  if (!getDaemonStatus().running) {
+    console.log(chalk7.dim("  New private Telegram users can send /start to request access."));
+    console.log(chalk7.dim("  The first request must be approved from the CLI with `mercury telegram approve <pairing-code>`."));
   }
   console.log("");
 });