@kl-c/matrixos 0.1.23 → 0.1.24

package/dist/cli/config-manager/load-gateway-env.d.ts

@@ -5,6 +5,7 @@
  * - Warns and returns if the file is missing or unreadable — never throws.
  * - Parses `KEY=VALUE` lines tolerating an optional leading `export ` and
  *   surrounding quotes.
- * - Only sets keys that are NOT already present in `process.env`.
+ * - By default, only sets keys that are NOT already present in `process.env`.
+ *   Pass `force: true` to overwrite existing values (used during hot-reload).
  */
-export declare function loadGatewayEnvFile(configDir?: string): void;
+export declare function loadGatewayEnvFile(configDir?: string, force?: boolean): void;

package/dist/cli/index.js

@@ -2145,7 +2145,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@kl-c/matrixos",
-    version: "0.1.23",
+    version: "0.1.24",
     description: "MaTrixOS \u2014 Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.",
     main: "./dist/index.js",
     types: "dist/index.d.ts",
@@ -117621,19 +117621,19 @@ __export(exports_generate, {
   executeGenerateCommand: () => executeGenerateCommand,
   ProfileNotFoundError: () => ProfileNotFoundError
 });
-import { existsSync as existsSync70, readFileSync as readFileSync55, realpathSync as realpathSync10 } from "fs";
-import { dirname as dirname28, isAbsolute as isAbsolute6, join as join75, resolve as resolve16 } from "path";
+import { existsSync as existsSync70, readFileSync as readFileSync56, realpathSync as realpathSync10 } from "fs";
+import { dirname as dirname28, isAbsolute as isAbsolute6, join as join76, resolve as resolve16 } from "path";
 function profilesDirFor(opts) {
   if (opts.profilesDir)
     return opts.profilesDir;
   if (opts.cwd)
-    return join75(opts.cwd, PROFILES_RELATIVE);
-  return join75(REPO_ROOT, PROFILES_RELATIVE);
+    return join76(opts.cwd, PROFILES_RELATIVE);
+  return join76(REPO_ROOT, PROFILES_RELATIVE);
 }
 function loadProfile(name2, options = {}) {
   const fs21 = options.fs ?? defaultFS2;
   const dir = profilesDirFor(options);
-  const path27 = join75(dir, `${name2}.json`);
+  const path27 = join76(dir, `${name2}.json`);
   if (!fs21.existsSync(path27)) {
     throw new ProfileNotFoundError(name2);
   }
@@ -117646,7 +117646,7 @@ function listProfiles(options = {}) {
   const known = options.knownNames ?? ["trader", "plumber"];
   const out = [];
   for (const name2 of known) {
-    const path27 = join75(dir, `${name2}.json`);
+    const path27 = join76(dir, `${name2}.json`);
     if (fs21.existsSync(path27)) {
       try {
         const raw = JSON.parse(fs21.readFileSync(path27, "utf-8"));
@@ -117719,7 +117719,7 @@ var init_generate = __esm(() => {
   init_src4();
   init_src4();
   REPO_ROOT = resolve16(dirname28(new URL(import.meta.url).pathname), "..", "..", "..", "..", "..");
-  defaultFS2 = { existsSync: existsSync70, readFileSync: readFileSync55, realpathSync: realpathSync10 };
+  defaultFS2 = { existsSync: existsSync70, readFileSync: readFileSync56, realpathSync: realpathSync10 };
   ProfileNotFoundError = class ProfileNotFoundError extends Error {
     profileName;
     constructor(profileName) {
@@ -117871,8 +117871,8 @@ var exports_profile_resolve = {};
 __export(exports_profile_resolve, {
   executeProfileResolveCommand: () => executeProfileResolveCommand
 });
-import { existsSync as existsSync72, readdirSync as readdirSync15, readFileSync as readFileSync56 } from "fs";
-import { join as join77, resolve as resolve17, dirname as dirname29 } from "path";
+import { existsSync as existsSync72, readdirSync as readdirSync15, readFileSync as readFileSync57 } from "fs";
+import { join as join78, resolve as resolve17, dirname as dirname29 } from "path";
 function executeProfileResolveCommand(args) {
   if (args.options.help) {
     return {
@@ -117897,7 +117897,7 @@ function executeProfileResolveCommand(args) {
 ` };
   }
   const name2 = nameRaw.endsWith(".json") ? nameRaw.slice(0, -5) : nameRaw;
-  const profilesDir = join77(REPO_ROOT2, PROFILES_RELATIVE2);
+  const profilesDir = join78(REPO_ROOT2, PROFILES_RELATIVE2);
   if (!existsSync72(profilesDir)) {
     return { exitCode: 1, stdout: `error: profiles directory not found at ${profilesDir}
 ` };
@@ -117917,8 +117917,8 @@ function executeProfileResolveCommand(args) {
   const registry2 = {};
   for (const file3 of profileFiles) {
     try {
-      const filePath = join77(profilesDir, file3);
-      const raw = JSON.parse(readFileSync56(filePath, "utf-8"));
+      const filePath = join78(profilesDir, file3);
+      const raw = JSON.parse(readFileSync57(filePath, "utf-8"));
       const profile2 = ProfileSchema.parse(raw);
       registry2[profile2.name] = profile2;
     } catch {}
@@ -117980,8 +117980,8 @@ __export(exports_export, {
   getShell: () => getShell,
   executeExportCommand: () => executeExportCommand
 });
-import { existsSync as existsSync73, readFileSync as readFileSync57, writeFileSync as writeFileSync25, copyFileSync as copyFileSync7, realpathSync as realpathSync11, mkdirSync as mkdirSync26 } from "fs";
-import { isAbsolute as isAbsolute7, join as join78, resolve as resolve18, dirname as dirname30 } from "path";
+import { existsSync as existsSync73, readFileSync as readFileSync58, writeFileSync as writeFileSync25, copyFileSync as copyFileSync7, realpathSync as realpathSync11, mkdirSync as mkdirSync26 } from "fs";
+import { isAbsolute as isAbsolute7, join as join79, resolve as resolve18, dirname as dirname30 } from "path";
 import { spawnSync as spawnSync3 } from "child_process";
 function setShell(shell) {
   activeShell = shell;
@@ -118022,7 +118022,7 @@ function executeExportCommand(args) {
     return { exitCode: 1, stdout: `error: generate failed: ${message}
 ` };
   }
-  const pkgPath = join78(absoluteTargetDir, "package.json");
+  const pkgPath = join79(absoluteTargetDir, "package.json");
   let pkg;
   try {
     pkg = JSON.parse(fs21.readFileSync(pkgPath, "utf-8"));
@@ -118062,7 +118062,7 @@ ${packResult.stdout}
     return { exitCode: 1, stdout: `error: npm pack produced no tarball name in output
 ` };
   }
-  let tgzPath = join78(absoluteTargetDir, tgzName);
+  let tgzPath = join79(absoluteTargetDir, tgzName);
   if (args.options.output) {
     const outputPath = args.options.output;
     const absoluteOutput = isAbsolute7(outputPath) ? outputPath : resolve18(process.cwd(), outputPath);
@@ -118104,7 +118104,7 @@ var init_export = __esm(() => {
   activeShell = defaultShell;
   defaultExportFS = {
     existsSync: existsSync73,
-    readFileSync: readFileSync57,
+    readFileSync: readFileSync58,
     writeFileSync: writeFileSync25,
     copyFileSync: copyFileSync7,
     realpathSync: realpathSync11,
@@ -122216,6 +122216,13 @@ init_zod();
 var CronConfigSchema = exports_external.object({
   enabled: exports_external.boolean().default(true)
 }).strict();
+// packages/omo-opencode/src/config/schema/dashboard.ts
+init_zod();
+var DashboardConfigSchema = exports_external.object({
+  enabled: exports_external.boolean().optional(),
+  port: exports_external.number().int().min(1).max(65535).optional(),
+  gateway_passphrase: exports_external.string().optional()
+});
 // packages/omo-opencode/src/config/schema/default-mode.ts
 init_zod();
 var DefaultModeConfigSchema = exports_external.object({
@@ -122723,6 +122730,7 @@ var OhMyOpenCodeConfigSchema = exports_external.object({
   morpheus: MorpheusConfigSchema.optional(),
   start_work: StartWorkConfigSchema.optional(),
   gateway: GatewayConfigSectionSchema,
+  dashboard: DashboardConfigSchema.optional(),
   watchdog: WatchdogConfigSchema.optional(),
   egress: EgressConfigSectionSchema,
   cron: CronConfigSchema.optional(),
@@ -141144,6 +141152,7 @@ async function traceCli(sessionId, options = {}) {
 
 // packages/omo-opencode/src/cli/dashboard.ts
 import * as path25 from "path";
+import { readFileSync as readFileSync55 } from "fs";
 
 // packages/omo-opencode/src/features/dashboard/data-provider.ts
 import * as os12 from "os";
@@ -141703,6 +141712,7 @@ function createDataProvider(config4) {
 }
 
 // packages/omo-opencode/src/features/dashboard/server.ts
+init_write_gateway_env();
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".css": "text/css; charset=utf-8",
@@ -141726,8 +141736,8 @@ function createDashboardServer(dataProvider, config4) {
           const path25 = url3.pathname;
           const corsHeaders = {
             "Access-Control-Allow-Origin": "*",
-            "Access-Control-Allow-Methods": "GET, OPTIONS",
-            "Access-Control-Allow-Headers": "Content-Type"
+            "Access-Control-Allow-Methods": "GET, POST, PUT, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type, x-passphrase"
           };
           if (req.method === "OPTIONS") {
             return new Response(null, { headers: corsHeaders });
@@ -141799,6 +141809,30 @@ function createDashboardServer(dataProvider, config4) {
                   return Response.json(dataProvider.getMemory(), { headers: jsonHeaders });
                 case "/api/skills":
                   return Response.json(dataProvider.getSkills(), { headers: jsonHeaders });
+                case "/api/gateway/token": {
+                  if (req.method !== "POST") {
+                    return new Response("Method Not Allowed", { status: 405, headers: corsHeaders });
+                  }
+                  const body = await req.json();
+                  const type2 = body.type;
+                  const token = body.token;
+                  const passphrase = body.passphrase;
+                  if (type2 !== "telegram" && type2 !== "discord") {
+                    return Response.json({ error: "Invalid type. Must be 'telegram' or 'discord'" }, { status: 400, headers: jsonHeaders });
+                  }
+                  if (typeof token !== "string" || token.length === 0) {
+                    return Response.json({ error: "Missing or empty token" }, { status: 400, headers: jsonHeaders });
+                  }
+                  if (!config4.gatewayPassphrase) {
+                    return Response.json({ error: "Passphrase not configured" }, { status: 400, headers: jsonHeaders });
+                  }
+                  if (passphrase !== config4.gatewayPassphrase) {
+                    return Response.json({ error: "Invalid passphrase" }, { status: 401, headers: jsonHeaders });
+                  }
+                  const key = type2 === "telegram" ? "TELEGRAM_BOT_TOKEN" : "DISCORD_BOT_TOKEN";
+                  const envPath = writeGatewayEnvToken(key, token);
+                  return Response.json({ ok: true, path: envPath }, { headers: jsonHeaders });
+                }
                 default:
                   return new Response("Not Found", { status: 404, headers: corsHeaders });
               }
@@ -141834,21 +141868,36 @@ function createDashboardServer(dataProvider, config4) {
       server2 = null;
     },
     get port() {
-      return config4.port;
+      return server2?.port ?? config4.port;
     }
   };
 }
 
 // packages/omo-opencode/src/cli/dashboard.ts
+init_config_context();
+init_jsonc_parser2();
+function loadGatewayPassphrase() {
+  try {
+    const configDir = getConfigDir();
+    const configPath = path25.join(configDir, "matrixos.jsonc");
+    const raw = readFileSync55(configPath, "utf-8");
+    const config4 = parseJsonc(raw);
+    const dashboard2 = config4.dashboard;
+    return typeof dashboard2?.gateway_passphrase === "string" ? dashboard2.gateway_passphrase : undefined;
+  } catch {
+    return;
+  }
+}
 async function dashboardCli(options) {
   const port = options.port ?? 9123;
   const host = options.host ?? "0.0.0.0";
   const frontendDir = path25.resolve(import.meta.dir, "../features/dashboard/frontend");
+  const gatewayPassphrase = loadGatewayPassphrase();
   console.log(`[dashboard] starting MaTrixOS dashboard on http://${host}:${port}`);
   console.log(`[dashboard] frontend: ${frontendDir}`);
   try {
     const dataProvider = createDataProvider();
-    const server2 = createDashboardServer(dataProvider, { port, host, frontendDir });
+    const server2 = createDashboardServer(dataProvider, { port, host, frontendDir, gatewayPassphrase });
     server2.start();
     console.log(`[dashboard] ready \u2014 http://${host}:${port}`);
     if (!options.daemon) {
@@ -141875,11 +141924,11 @@ async function dashboardCli(options) {
 }
 
 // packages/omo-opencode/src/cli/architect.ts
-import { join as join73 } from "path";
+import { join as join74 } from "path";
 var IMPROVEMENTS_DIR = ".matrixos/improvements";
 function getStore(directory) {
   const baseDir = directory ?? process.cwd();
-  return createImprovementStore(join73(baseDir, IMPROVEMENTS_DIR));
+  return createImprovementStore(join74(baseDir, IMPROVEMENTS_DIR));
 }
 async function architectReview(options) {
   const store4 = getStore(options.directory);

package/dist/cli-node/index.js

@@ -2145,7 +2145,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@kl-c/matrixos",
-    version: "0.1.23",
+    version: "0.1.24",
     description: "MaTrixOS \u2014 Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.",
     main: "./dist/index.js",
     types: "dist/index.d.ts",
@@ -117676,19 +117676,19 @@ __export(exports_generate, {
   executeGenerateCommand: () => executeGenerateCommand,
   ProfileNotFoundError: () => ProfileNotFoundError
 });
-import { existsSync as existsSync70, readFileSync as readFileSync55, realpathSync as realpathSync10 } from "fs";
-import { dirname as dirname28, isAbsolute as isAbsolute6, join as join75, resolve as resolve16 } from "path";
+import { existsSync as existsSync70, readFileSync as readFileSync56, realpathSync as realpathSync10 } from "fs";
+import { dirname as dirname28, isAbsolute as isAbsolute6, join as join76, resolve as resolve16 } from "path";
 function profilesDirFor(opts) {
   if (opts.profilesDir)
     return opts.profilesDir;
   if (opts.cwd)
-    return join75(opts.cwd, PROFILES_RELATIVE);
-  return join75(REPO_ROOT, PROFILES_RELATIVE);
+    return join76(opts.cwd, PROFILES_RELATIVE);
+  return join76(REPO_ROOT, PROFILES_RELATIVE);
 }
 function loadProfile(name2, options = {}) {
   const fs21 = options.fs ?? defaultFS2;
   const dir = profilesDirFor(options);
-  const path27 = join75(dir, `${name2}.json`);
+  const path27 = join76(dir, `${name2}.json`);
   if (!fs21.existsSync(path27)) {
     throw new ProfileNotFoundError(name2);
   }
@@ -117701,7 +117701,7 @@ function listProfiles(options = {}) {
   const known = options.knownNames ?? ["trader", "plumber"];
   const out = [];
   for (const name2 of known) {
-    const path27 = join75(dir, `${name2}.json`);
+    const path27 = join76(dir, `${name2}.json`);
     if (fs21.existsSync(path27)) {
       try {
         const raw = JSON.parse(fs21.readFileSync(path27, "utf-8"));
@@ -117774,7 +117774,7 @@ var init_generate = __esm(() => {
   init_src4();
   init_src4();
   REPO_ROOT = resolve16(dirname28(new URL(import.meta.url).pathname), "..", "..", "..", "..", "..");
-  defaultFS2 = { existsSync: existsSync70, readFileSync: readFileSync55, realpathSync: realpathSync10 };
+  defaultFS2 = { existsSync: existsSync70, readFileSync: readFileSync56, realpathSync: realpathSync10 };
   ProfileNotFoundError = class ProfileNotFoundError extends Error {
     profileName;
     constructor(profileName) {
@@ -117926,8 +117926,8 @@ var exports_profile_resolve = {};
 __export(exports_profile_resolve, {
   executeProfileResolveCommand: () => executeProfileResolveCommand
 });
-import { existsSync as existsSync72, readdirSync as readdirSync15, readFileSync as readFileSync56 } from "fs";
-import { join as join77, resolve as resolve17, dirname as dirname29 } from "path";
+import { existsSync as existsSync72, readdirSync as readdirSync15, readFileSync as readFileSync57 } from "fs";
+import { join as join78, resolve as resolve17, dirname as dirname29 } from "path";
 function executeProfileResolveCommand(args) {
   if (args.options.help) {
     return {
@@ -117952,7 +117952,7 @@ function executeProfileResolveCommand(args) {
 ` };
   }
   const name2 = nameRaw.endsWith(".json") ? nameRaw.slice(0, -5) : nameRaw;
-  const profilesDir = join77(REPO_ROOT2, PROFILES_RELATIVE2);
+  const profilesDir = join78(REPO_ROOT2, PROFILES_RELATIVE2);
   if (!existsSync72(profilesDir)) {
     return { exitCode: 1, stdout: `error: profiles directory not found at ${profilesDir}
 ` };
@@ -117972,8 +117972,8 @@ function executeProfileResolveCommand(args) {
   const registry2 = {};
   for (const file3 of profileFiles) {
     try {
-      const filePath = join77(profilesDir, file3);
-      const raw = JSON.parse(readFileSync56(filePath, "utf-8"));
+      const filePath = join78(profilesDir, file3);
+      const raw = JSON.parse(readFileSync57(filePath, "utf-8"));
       const profile2 = ProfileSchema.parse(raw);
       registry2[profile2.name] = profile2;
     } catch {}
@@ -118035,8 +118035,8 @@ __export(exports_export, {
   getShell: () => getShell,
   executeExportCommand: () => executeExportCommand
 });
-import { existsSync as existsSync73, readFileSync as readFileSync57, writeFileSync as writeFileSync25, copyFileSync as copyFileSync7, realpathSync as realpathSync11, mkdirSync as mkdirSync26 } from "fs";
-import { isAbsolute as isAbsolute7, join as join78, resolve as resolve18, dirname as dirname30 } from "path";
+import { existsSync as existsSync73, readFileSync as readFileSync58, writeFileSync as writeFileSync25, copyFileSync as copyFileSync7, realpathSync as realpathSync11, mkdirSync as mkdirSync26 } from "fs";
+import { isAbsolute as isAbsolute7, join as join79, resolve as resolve18, dirname as dirname30 } from "path";
 import { spawnSync as spawnSync3 } from "child_process";
 function setShell(shell) {
   activeShell = shell;
@@ -118077,7 +118077,7 @@ function executeExportCommand(args) {
     return { exitCode: 1, stdout: `error: generate failed: ${message}
 ` };
   }
-  const pkgPath = join78(absoluteTargetDir, "package.json");
+  const pkgPath = join79(absoluteTargetDir, "package.json");
   let pkg;
   try {
     pkg = JSON.parse(fs21.readFileSync(pkgPath, "utf-8"));
@@ -118117,7 +118117,7 @@ ${packResult.stdout}
     return { exitCode: 1, stdout: `error: npm pack produced no tarball name in output
 ` };
   }
-  let tgzPath = join78(absoluteTargetDir, tgzName);
+  let tgzPath = join79(absoluteTargetDir, tgzName);
   if (args.options.output) {
     const outputPath = args.options.output;
     const absoluteOutput = isAbsolute7(outputPath) ? outputPath : resolve18(process.cwd(), outputPath);
@@ -118159,7 +118159,7 @@ var init_export = __esm(() => {
   activeShell = defaultShell;
   defaultExportFS = {
     existsSync: existsSync73,
-    readFileSync: readFileSync57,
+    readFileSync: readFileSync58,
     writeFileSync: writeFileSync25,
     copyFileSync: copyFileSync7,
     realpathSync: realpathSync11,
@@ -122271,6 +122271,13 @@ init_zod();
 var CronConfigSchema = exports_external.object({
   enabled: exports_external.boolean().default(true)
 }).strict();
+// packages/omo-opencode/src/config/schema/dashboard.ts
+init_zod();
+var DashboardConfigSchema = exports_external.object({
+  enabled: exports_external.boolean().optional(),
+  port: exports_external.number().int().min(1).max(65535).optional(),
+  gateway_passphrase: exports_external.string().optional()
+});
 // packages/omo-opencode/src/config/schema/default-mode.ts
 init_zod();
 var DefaultModeConfigSchema = exports_external.object({
@@ -122778,6 +122785,7 @@ var OhMyOpenCodeConfigSchema = exports_external.object({
   morpheus: MorpheusConfigSchema.optional(),
   start_work: StartWorkConfigSchema.optional(),
   gateway: GatewayConfigSectionSchema,
+  dashboard: DashboardConfigSchema.optional(),
   watchdog: WatchdogConfigSchema.optional(),
   egress: EgressConfigSectionSchema,
   cron: CronConfigSchema.optional(),
@@ -141199,6 +141207,7 @@ async function traceCli(sessionId, options = {}) {
 
 // packages/omo-opencode/src/cli/dashboard.ts
 import * as path25 from "path";
+import { readFileSync as readFileSync55 } from "fs";
 
 // packages/omo-opencode/src/features/dashboard/data-provider.ts
 import * as os12 from "os";
@@ -141758,6 +141767,7 @@ function createDataProvider(config4) {
 }
 
 // packages/omo-opencode/src/features/dashboard/server.ts
+init_write_gateway_env();
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".css": "text/css; charset=utf-8",
@@ -141781,8 +141791,8 @@ function createDashboardServer(dataProvider, config4) {
           const path25 = url3.pathname;
           const corsHeaders = {
             "Access-Control-Allow-Origin": "*",
-            "Access-Control-Allow-Methods": "GET, OPTIONS",
-            "Access-Control-Allow-Headers": "Content-Type"
+            "Access-Control-Allow-Methods": "GET, POST, PUT, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type, x-passphrase"
           };
           if (req.method === "OPTIONS") {
             return new Response(null, { headers: corsHeaders });
@@ -141854,6 +141864,30 @@ function createDashboardServer(dataProvider, config4) {
                   return Response.json(dataProvider.getMemory(), { headers: jsonHeaders });
                 case "/api/skills":
                   return Response.json(dataProvider.getSkills(), { headers: jsonHeaders });
+                case "/api/gateway/token": {
+                  if (req.method !== "POST") {
+                    return new Response("Method Not Allowed", { status: 405, headers: corsHeaders });
+                  }
+                  const body = await req.json();
+                  const type2 = body.type;
+                  const token = body.token;
+                  const passphrase = body.passphrase;
+                  if (type2 !== "telegram" && type2 !== "discord") {
+                    return Response.json({ error: "Invalid type. Must be 'telegram' or 'discord'" }, { status: 400, headers: jsonHeaders });
+                  }
+                  if (typeof token !== "string" || token.length === 0) {
+                    return Response.json({ error: "Missing or empty token" }, { status: 400, headers: jsonHeaders });
+                  }
+                  if (!config4.gatewayPassphrase) {
+                    return Response.json({ error: "Passphrase not configured" }, { status: 400, headers: jsonHeaders });
+                  }
+                  if (passphrase !== config4.gatewayPassphrase) {
+                    return Response.json({ error: "Invalid passphrase" }, { status: 401, headers: jsonHeaders });
+                  }
+                  const key = type2 === "telegram" ? "TELEGRAM_BOT_TOKEN" : "DISCORD_BOT_TOKEN";
+                  const envPath = writeGatewayEnvToken(key, token);
+                  return Response.json({ ok: true, path: envPath }, { headers: jsonHeaders });
+                }
                 default:
                   return new Response("Not Found", { status: 404, headers: corsHeaders });
               }
@@ -141889,21 +141923,36 @@ function createDashboardServer(dataProvider, config4) {
       server2 = null;
     },
     get port() {
-      return config4.port;
+      return server2?.port ?? config4.port;
     }
   };
 }
 
 // packages/omo-opencode/src/cli/dashboard.ts
+init_config_context();
+init_jsonc_parser2();
+function loadGatewayPassphrase() {
+  try {
+    const configDir = getConfigDir();
+    const configPath = path25.join(configDir, "matrixos.jsonc");
+    const raw = readFileSync55(configPath, "utf-8");
+    const config4 = parseJsonc(raw);
+    const dashboard2 = config4.dashboard;
+    return typeof dashboard2?.gateway_passphrase === "string" ? dashboard2.gateway_passphrase : undefined;
+  } catch {
+    return;
+  }
+}
 async function dashboardCli(options) {
   const port = options.port ?? 9123;
   const host = options.host ?? "0.0.0.0";
   const frontendDir = path25.resolve(import.meta.dir, "../features/dashboard/frontend");
+  const gatewayPassphrase = loadGatewayPassphrase();
   console.log(`[dashboard] starting MaTrixOS dashboard on http://${host}:${port}`);
   console.log(`[dashboard] frontend: ${frontendDir}`);
   try {
     const dataProvider = createDataProvider();
-    const server2 = createDashboardServer(dataProvider, { port, host, frontendDir });
+    const server2 = createDashboardServer(dataProvider, { port, host, frontendDir, gatewayPassphrase });
     server2.start();
     console.log(`[dashboard] ready \u2014 http://${host}:${port}`);
     if (!options.daemon) {
@@ -141930,11 +141979,11 @@ async function dashboardCli(options) {
 }
 
 // packages/omo-opencode/src/cli/architect.ts
-import { join as join73 } from "path";
+import { join as join74 } from "path";
 var IMPROVEMENTS_DIR = ".matrixos/improvements";
 function getStore(directory) {
   const baseDir = directory ?? process.cwd();
-  return createImprovementStore(join73(baseDir, IMPROVEMENTS_DIR));
+  return createImprovementStore(join74(baseDir, IMPROVEMENTS_DIR));
 }
 async function architectReview(options) {
   const store4 = getStore(options.directory);

package/dist/config/schema/dashboard.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+export declare const DashboardConfigSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    port: z.ZodOptional<z.ZodNumber>;
+    gateway_passphrase: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DashboardConfig = z.infer<typeof DashboardConfigSchema>;

package/dist/config/schema/oh-my-opencode-config.d.ts

@@ -2446,6 +2446,11 @@ export declare const OhMyOpenCodeConfigSchema: z.ZodObject<{
         auditLogPath: z.ZodOptional<z.ZodString>;
         enabled: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strict>>;
+    dashboard: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        port: z.ZodOptional<z.ZodNumber>;
+        gateway_passphrase: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     watchdog: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         doomLoopThreshold: z.ZodDefault<z.ZodNumber>;

package/dist/config/schema.d.ts

@@ -9,6 +9,7 @@ export * from "./schema/codegraph";
 export * from "./schema/comment-checker";
 export * from "./schema/commands";
 export * from "./schema/cron";
+export * from "./schema/dashboard";
 export * from "./schema/default-mode";
 export * from "./schema/dynamic-context-pruning";
 export * from "./schema/egress";

package/dist/features/dashboard/frontend/css/style.css

@@ -207,5 +207,17 @@ body{font-family:var(--font-body);font-size:var(--text-base);color:var(--text-pr
 .config-editor{width:100%;min-height:400px;background:var(--bg-base);color:var(--text-primary);font-family:var(--font-mono);font-size:var(--text-sm);border:none;padding:var(--space-4);resize:vertical;tab-size:2;line-height:1.5}
 .config-editor:focus{outline:1px solid var(--accent-primary)}
 
+/* FORM CONTROLS (gateway + future forms) */
+.label{display:block;font-size:var(--text-xs);color:var(--text-secondary);font-weight:500;margin-bottom:var(--space-1);text-transform:uppercase;letter-spacing:.05em}
+.input,.select{width:100%;background:var(--bg-base);color:var(--text-primary);border:1px solid var(--border-default);border-radius:var(--radius-lg);padding:var(--space-2) var(--space-3);font-size:var(--text-sm);font-family:var(--font-body);transition:border-color .15s}
+.input:focus,.select:focus{outline:none;border-color:var(--accent-primary)}
+.input::placeholder{color:var(--text-tertiary)}
+.select{cursor:pointer;appearance:none;-webkit-appearance:none;background-image:url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12' fill='none' stroke='%238B8D97' stroke-width='1.5'><path d='M3 5l3 3 3-3'/></svg>");background-repeat:no-repeat;background-position:right var(--space-3) center;padding-right:var(--space-6)}
+.gateway-form{display:flex;flex-direction:column;gap:var(--space-4);max-width:480px}
+.gateway-help{font-size:var(--text-xs);color:var(--text-secondary);line-height:1.5;margin-bottom:var(--space-1)}
+.form-row{display:flex;flex-direction:column}
+.form-actions{display:flex;align-items:center;gap:var(--space-3);margin-top:var(--space-2)}
+.gateway-status{font-size:var(--text-sm);color:var(--text-tertiary)}
+
 @media(max-width:1024px){.kpi-grid,.grid-2{grid-template-columns:repeat(2,1fr)}.kanban-board{grid-template-columns:repeat(2,1fr)}.gauge-grid{grid-template-columns:repeat(2,1fr)}}
 @media(max-width:768px){.kpi-grid,.grid-2{grid-template-columns:1fr}.kanban-board{grid-template-columns:1fr}.agent-grid{grid-template-columns:1fr}}

package/dist/features/dashboard/frontend/index.html

@@ -166,6 +166,7 @@
         </div>
       </div>
       <div class="card"><div class="card-header"><span class="card-title">matrixos.jsonc</span><span id="configStatus" style="font-size:var(--text-xs);color:var(--text-tertiary)"></span></div><div class="card-body"><textarea id="configEditor" class="config-editor" spellcheck="false"></textarea></div></div>
+      <div class="card"><div class="card-header"><span class="card-title">Connecter un canal de messagerie</span><span class="badge badge-purple">Gateway</span></div><div class="card-body" id="gatewayBody"></div></div>
     </div>
 
     <div id="tab-schedule" class="tab-panel">

package/dist/features/dashboard/frontend/js/api.js

@@ -1,2 +1,2 @@
-const API={health:()=>fetchJSON('/health'),agents:()=>fetchJSON('/agents'),sessions:(l)=>fetchJSON(`/sessions?limit=${l}`),cost:()=>fetchJSON('/cost'),kanban:()=>fetchJSON('/kanban'),incidents:(l)=>fetchJSON(`/incidents?limit=${l}`),metrics:()=>fetchJSON('/metrics'),config:()=>fetchJSON('/config'),memory:()=>fetchJSON('/memory'),skills:()=>fetchJSON('/skills')}
-async function fetchJSON(e){const r=await fetch(`/api${e}`);if(!r.ok)throw new Error(`API ${e}: ${r.status}`);return r.json()}
+const API={health:()=>fetchJSON('/health'),agents:()=>fetchJSON('/agents'),sessions:(l)=>fetchJSON(`/sessions?limit=${l}`),cost:()=>fetchJSON('/cost'),kanban:()=>fetchJSON('/kanban'),incidents:(l)=>fetchJSON(`/incidents?limit=${l}`),metrics:()=>fetchJSON('/metrics'),config:()=>fetchJSON('/config'),memory:()=>fetchJSON('/memory'),skills:()=>fetchJSON('/skills'),gatewayToken:(type,token,passphrase)=>fetch('/api/gateway/token',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({type,token,passphrase})}).then(r=>r.json())}
+async function fetchJSON(e){const r=await fetch(`/api${e}`);if(!r.ok)throw new Error(`API ${e}: ${r.status}`);return r.json()}

package/dist/features/dashboard/frontend/js/app.js

@@ -266,6 +266,66 @@ async function loadConfig(){
     }catch(e){status.textContent=`Invalid JSON: ${e.message}`;status.style.color='var(--danger)'}
   }
   document.getElementById('configRefreshBtn').onclick=loadConfig
+  loadGateway()
+}
+
+// ===== GATEWAY (Connecter un canal) =====
+function loadGateway(){
+  const body=document.getElementById('gatewayBody')
+  if(!body)return
+  body.innerHTML=`
+    <div class="gateway-form">
+      <p class="gateway-help">Renseignez le token du bot et la passphrase pour connecter un canal de messagerie. Le token est envoyé au backend et n'est jamais stocké côté navigateur.</p>
+      <div class="form-row">
+        <label class="label" for="gwType">Type</label>
+        <select class="select" id="gwType">
+          <option value="telegram">Telegram</option>
+          <option value="discord">Discord</option>
+        </select>
+      </div>
+      <div class="form-row">
+        <label class="label" for="gwToken">Token du bot</label>
+        <input class="input" type="password" id="gwToken" autocomplete="off" placeholder="123456:ABC-DEF...">
+      </div>
+      <div class="form-row">
+        <label class="label" for="gwPass">Passphrase</label>
+        <input class="input" type="password" id="gwPass" autocomplete="off" placeholder="Passphrase configurée côté serveur">
+      </div>
+      <div class="form-actions">
+        <button class="btn btn-primary" id="gwSubmit">Enregistrer</button>
+        <span class="gateway-status" id="gwStatus"></span>
+      </div>
+    </div>`
+  const submit=document.getElementById('gwSubmit')
+  const status=document.getElementById('gwStatus')
+  submit.onclick=async()=>{
+    const type=document.getElementById('gwType').value
+    const token=document.getElementById('gwToken').value
+    const passphrase=document.getElementById('gwPass').value
+    if(!token){status.textContent='Token requis';status.style.color='var(--danger)';return}
+    if(!passphrase){status.textContent='Passphrase requise';status.style.color='var(--danger)';return}
+    submit.disabled=true
+    status.textContent='Envoi en cours...'
+    status.style.color='var(--text-tertiary)'
+    try{
+      const res=await API.gatewayToken(type,token,passphrase)
+      if(res&&res.ok){
+        status.textContent='Token enregistré ✓'
+        status.style.color='var(--success)'
+        document.getElementById('gwToken').value=''
+        document.getElementById('gwPass').value=''
+      }else{
+        const msg=(res&&res.error)||(Array.isArray(res)&&res[0]&&res[0].error)||'Erreur inconnue'
+        status.textContent='Erreur : '+msg
+        status.style.color='var(--danger)'
+      }
+    }catch(e){
+      status.textContent='Erreur : '+e.message
+      status.style.color='var(--danger)'
+    }finally{
+      submit.disabled=false
+    }
+  }
 }
 
 // ===== MEMORY =====