@letta-ai/letta-code 0.28.13 → 0.28.14

package/letta.js

@@ -4853,7 +4853,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@letta-ai/letta-code",
-    version: "0.28.13",
+    version: "0.28.14",
     description: "Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.",
     type: "module",
     packageManager: "bun@1.3.0",
@@ -159124,6 +159124,8 @@ Creating crons:
 - Recurring monitoring/heartbeat: \`letta cron add --name <short-name> --description <description> --prompt <future-message> --every "2h"\` or \`--cron "0 9 * * *"\`
 Always include \`--name\`, \`--description\`, and \`--prompt\`. \`$AGENT_ID\` is automatically injected into the shell environment, and \`letta cron\` uses it by default, so you do not need to specify which agent to invoke unless overriding the current agent intentionally.
 
+Where crons run: for cloud agents, schedules default to durable Cloud schedules that fire from the cloud and execute in your cloud sandbox — they survive local shutdown, so this is the right default. If the scheduled work must run on a specific computer (e.g. it needs that computer's filesystem or local services), add \`--computer <deviceId>\` (from \`letta environments list\`) to keep the durable Cloud schedule but execute on that computer, with sandbox fallback if it is offline. Use \`--runner local\` only when that fallback is unacceptable; local schedules only fire while a Letta session is running on that computer.
+
 # Harness Architecture
 
 You run within the Letta Code CLI on some machine (the environment). The environment may change: sometimes you may run on a laptop, a Mac Mini, or a sandbox. Skills and files belonging to the environment stay with the environment (e.g. \`AGENTS.md\` or \`.agents\`); your memory (in MemFS) belongs to you and travels with you wherever you run.
@@ -166511,6 +166513,12 @@ function cloneAccount(account) {
     ...account,
     allowedUsers: [...account.allowedUsers]
   };
+  if (account.adminUsers) {
+    cloned.adminUsers = [...account.adminUsers];
+  }
+  if (account.userAllowedCommands) {
+    cloned.userAllowedCommands = [...account.userAllowedCommands];
+  }
   if (isTelegramChannelAccount(account)) {
     cloned.binding = { ...account.binding };
   }
@@ -166882,9 +166890,12 @@ var init_accounts = __esm(() => {
   init_types7();
   SNAKE_TO_CAMEL = {
     account_uuid: "accountUuid",
+    admin_users: "adminUsers",
     allowed_channels: "allowedChannels",
     allowed_groups: "allowedGroups",
     allow_bots: "allowBots",
+    group_policy: "groupPolicy",
+    user_allowed_commands: "userAllowedCommands",
     auto_thread_on_mention: "autoThreadOnMention",
     base_url: "baseUrl",
     acknowledge_message_reaction: "acknowledgeMessageReaction",
@@ -167334,7 +167345,551 @@ var init_account_display2 = __esm(() => {
   init_utils5();
 });
 
-// src/channels/feedback.ts
+// src/channels/pairing.ts
+var exports_pairing = {};
+__export(exports_pairing, {
+  rollbackPairingApproval: () => rollbackPairingApproval,
+  removePairingStateForAccount: () => removePairingStateForAccount,
+  loadPairingStore: () => loadPairingStore,
+  isUserApproved: () => isUserApproved,
+  getPendingPairings: () => getPendingPairings,
+  getApprovedUsers: () => getApprovedUsers,
+  createPairingCode: () => createPairingCode,
+  consumePairingCode: () => consumePairingCode,
+  clearPairingStores: () => clearPairingStores,
+  __testOverrideSavePairingStore: () => __testOverrideSavePairingStore,
+  __testOverrideLoadPairingStore: () => __testOverrideLoadPairingStore
+});
+import { randomInt } from "node:crypto";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "node:fs";
+function normalizeAccountId(accountId) {
+  return accountId ?? LEGACY_CHANNEL_ACCOUNT_ID;
+}
+function getStore2(channelId) {
+  let store = stores2.get(channelId);
+  if (!store) {
+    store = { pending: [], approved: [] };
+    stores2.set(channelId, store);
+  }
+  return store;
+}
+function loadPairingStore(channelId) {
+  if (loadPairingStoreOverride) {
+    const overridden = loadPairingStoreOverride(channelId);
+    if (overridden === null) {
+      return;
+    }
+    stores2.set(channelId, {
+      pending: [...overridden.pending],
+      approved: [...overridden.approved]
+    });
+    return;
+  }
+  const path5 = getChannelPairingPath(channelId);
+  if (!existsSync8(path5))
+    return;
+  try {
+    const text = readFileSync7(path5, "utf-8");
+    const parsed = JSON.parse(text);
+    stores2.set(channelId, {
+      pending: parsed.pending ?? [],
+      approved: parsed.approved ?? []
+    });
+  } catch {}
+}
+function savePairingStore(channelId) {
+  const store = getStore2(channelId);
+  if (savePairingStoreOverride) {
+    savePairingStoreOverride(channelId, {
+      pending: [...store.pending],
+      approved: [...store.approved]
+    });
+    return;
+  }
+  const dir = getChannelDir(channelId);
+  mkdirSync5(dir, { recursive: true });
+  writeFileSync3(getChannelPairingPath(channelId), `${JSON.stringify(store, null, 2)}
+`, "utf-8");
+}
+function generateCode(length = 6) {
+  let code2 = "";
+  for (let i2 = 0;i2 < length; i2++) {
+    code2 += CODE_CHARS[randomInt(CODE_CHARS.length)];
+  }
+  return code2;
+}
+function isUserApproved(channelId, userId, accountId) {
+  const store = getStore2(channelId);
+  const normalizedAccountId = normalizeAccountId(accountId);
+  return store.approved.some((u) => u.senderId === userId && normalizeAccountId(u.accountId) === normalizedAccountId);
+}
+function createPairingCode(channelId, userId, chatId, username, accountId) {
+  const store = getStore2(channelId);
+  const normalizedAccountId = normalizeAccountId(accountId);
+  const nowMs = Date.now();
+  const existing = store.pending.find((p) => p.senderId === userId && normalizeAccountId(p.accountId) === normalizedAccountId && new Date(p.expiresAt).getTime() > nowMs);
+  if (existing) {
+    return existing.code;
+  }
+  store.pending = store.pending.filter((p) => !(p.senderId === userId && normalizeAccountId(p.accountId) === normalizedAccountId));
+  const now = Date.now();
+  store.pending = store.pending.filter((p) => new Date(p.expiresAt).getTime() > now);
+  while (store.pending.length >= MAX_PENDING_CODES) {
+    store.pending.shift();
+  }
+  const code2 = generateCode();
+  const pending = {
+    accountId: normalizedAccountId,
+    code: code2,
+    senderId: userId,
+    senderName: username,
+    chatId,
+    createdAt: new Date().toISOString(),
+    expiresAt: new Date(now + PAIRING_CODE_TTL_MS).toISOString()
+  };
+  store.pending.push(pending);
+  savePairingStore(channelId);
+  return code2;
+}
+function consumePairingCode(channelId, code2, accountId) {
+  const store = getStore2(channelId);
+  const upperCode = code2.toUpperCase();
+  const normalizedAccountId = accountId === undefined ? undefined : normalizeAccountId(accountId);
+  const matches = store.pending.map((pending2, index2) => ({ pending: pending2, index: index2 })).filter(({ pending: pending2 }) => pending2.code === upperCode && (normalizedAccountId === undefined || normalizeAccountId(pending2.accountId) === normalizedAccountId));
+  if (matches.length > 1) {
+    return null;
+  }
+  const index = matches[0]?.index ?? -1;
+  if (index === -1)
+    return null;
+  const pending = store.pending[index];
+  const pendingAccountId = normalizeAccountId(pending.accountId);
+  if (new Date(pending.expiresAt).getTime() < Date.now()) {
+    store.pending.splice(index, 1);
+    savePairingStore(channelId);
+    return null;
+  }
+  store.pending.splice(index, 1);
+  if (!store.approved.some((u) => u.senderId === pending.senderId && normalizeAccountId(u.accountId) === pendingAccountId)) {
+    const approved = {
+      accountId: pendingAccountId,
+      senderId: pending.senderId,
+      senderName: pending.senderName,
+      approvedAt: new Date().toISOString()
+    };
+    store.approved.push(approved);
+  }
+  savePairingStore(channelId);
+  return pending;
+}
+function getPendingPairings(channelId, accountId) {
+  const store = getStore2(channelId);
+  const now = Date.now();
+  const normalizedAccountId = accountId === undefined ? undefined : normalizeAccountId(accountId);
+  return store.pending.filter((p) => new Date(p.expiresAt).getTime() > now && (normalizedAccountId === undefined || normalizeAccountId(p.accountId) === normalizedAccountId));
+}
+function getApprovedUsers(channelId, accountId) {
+  const normalizedAccountId = accountId === undefined ? undefined : normalizeAccountId(accountId);
+  return getStore2(channelId).approved.filter((user) => normalizedAccountId === undefined || normalizeAccountId(user.accountId) === normalizedAccountId);
+}
+function rollbackPairingApproval(channelId, pending) {
+  const store = getStore2(channelId);
+  const normalizedAccountId = normalizeAccountId(pending.accountId);
+  store.approved = store.approved.filter((u) => !(u.senderId === pending.senderId && normalizeAccountId(u.accountId) === normalizedAccountId));
+  store.pending.push(pending);
+  savePairingStore(channelId);
+}
+function removePairingStateForAccount(channelId, accountId) {
+  const store = getStore2(channelId);
+  const normalizedAccountId = normalizeAccountId(accountId);
+  const nextPending = store.pending.filter((pending) => normalizeAccountId(pending.accountId) !== normalizedAccountId);
+  const nextApproved = store.approved.filter((approved) => normalizeAccountId(approved.accountId) !== normalizedAccountId);
+  const pendingRemoved = store.pending.length - nextPending.length;
+  const approvedRemoved = store.approved.length - nextApproved.length;
+  if (pendingRemoved === 0 && approvedRemoved === 0) {
+    return { pendingRemoved, approvedRemoved };
+  }
+  store.pending = nextPending;
+  store.approved = nextApproved;
+  savePairingStore(channelId);
+  return { pendingRemoved, approvedRemoved };
+}
+function clearPairingStores() {
+  stores2.clear();
+}
+function __testOverrideLoadPairingStore(fn) {
+  loadPairingStoreOverride = fn;
+}
+function __testOverrideSavePairingStore(fn) {
+  savePairingStoreOverride = fn;
+}
+var PAIRING_CODE_TTL_MS, MAX_PENDING_CODES = 50, CODE_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789", stores2, loadPairingStoreOverride = null, savePairingStoreOverride = null;
+var init_pairing = __esm(() => {
+  init_accounts();
+  init_config2();
+  PAIRING_CODE_TTL_MS = 15 * 60 * 1000;
+  stores2 = new Map;
+});
+
+// src/channels/signal/target.ts
+function assertSignalHttpProtocol(url2) {
+  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
+    throw new Error(`Signal base URL protocol must be http or https, got ${url2.protocol}`);
+  }
+}
+function trimPrefix(value, prefix) {
+  if (!value.toLowerCase().startsWith(prefix)) {
+    return null;
+  }
+  return value.slice(prefix.length).trim();
+}
+function normalizeSignalBaseUrl(input) {
+  const trimmed = input.trim();
+  if (!trimmed) {
+    return "";
+  }
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
+  const withScheme = hasScheme ? trimmed : `http://${trimmed}`;
+  const parsed = new URL(withScheme);
+  assertSignalHttpProtocol(parsed);
+  if (parsed.username || parsed.password) {
+    throw new Error("Signal base URL must not include credentials.");
+  }
+  return withScheme.replace(/\/+$/, "");
+}
+function parseSignalTarget(input) {
+  const trimmed = input.trim();
+  if (!trimmed) {
+    throw new Error("Signal target is required.");
+  }
+  const signalTarget = trimPrefix(trimmed, "signal:");
+  const value = signalTarget !== null ? signalTarget : trimmed;
+  if (!value) {
+    throw new Error("Signal target is required.");
+  }
+  const groupId = trimPrefix(value, "group:");
+  if (groupId) {
+    return { kind: "group", groupId };
+  }
+  const username = trimPrefix(value, "username:");
+  if (username) {
+    return { kind: "username", username };
+  }
+  const usernameAlias = trimPrefix(value, "u:");
+  if (usernameAlias) {
+    return { kind: "username", username: `u:${usernameAlias}` };
+  }
+  const recipient = value;
+  if (!recipient) {
+    throw new Error("Signal recipient is required.");
+  }
+  return { kind: "recipient", recipient };
+}
+function signalTargetToSendRpcParams(target2) {
+  switch (target2.kind) {
+    case "group":
+      return { groupId: target2.groupId };
+    case "username":
+      return { username: [target2.username] };
+    case "recipient":
+      return { recipient: [target2.recipient] };
+  }
+}
+function signalTargetToReactionRpcParams(target2) {
+  switch (target2.kind) {
+    case "group":
+      return { groupIds: [target2.groupId] };
+    case "recipient":
+      return { recipients: [target2.recipient] };
+    case "username":
+      throw new Error("Signal reactions require a recipient or group target.");
+  }
+}
+function normalizeSignalSenderId(value) {
+  if (!value) {
+    return "";
+  }
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return "";
+  }
+  return trimmed.toLowerCase();
+}
+function normalizeSignalPhone(value) {
+  if (!value) {
+    return "";
+  }
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return "";
+  }
+  const withoutPrefix = trimmed.toLowerCase().startsWith("signal:") ? trimmed.slice("signal:".length) : trimmed;
+  return withoutPrefix.replace(/[^0-9+]/g, "");
+}
+function signalAllowedUsersIncludes(allowedUsers, senderId) {
+  const normalizedSender = normalizeSignalSenderId(senderId);
+  const senderPhone = normalizeSignalPhone(senderId);
+  return allowedUsers.some((entry) => {
+    const normalizedEntry = normalizeSignalSenderId(entry);
+    if (normalizedEntry === normalizedSender) {
+      return true;
+    }
+    const entryPhone = normalizeSignalPhone(entry);
+    return !!senderPhone && !!entryPhone && senderPhone === entryPhone;
+  });
+}
+function isSignalGroupAllowed(allowedGroups, groupId) {
+  if (!allowedGroups || allowedGroups.length === 0) {
+    return true;
+  }
+  const normalized = groupId.trim();
+  return allowedGroups.some((entry) => entry.trim() === normalized);
+}
+function matchesSignalMentionPatterns(text, mentionPatterns) {
+  const normalizedText = text.toLowerCase();
+  return (mentionPatterns ?? []).map((entry) => entry.trim().toLowerCase()).filter(Boolean).some((entry) => normalizedText.includes(entry));
+}
+var init_target2 = () => {};
+
+// src/channels/whatsapp/jid.ts
+function stripDeviceSuffix(jid) {
+  if (!jid)
+    return "";
+  return jid.replace(/:\d+(@|$)/, "$1");
+}
+function isLidJid(jid) {
+  return !!jid && stripDeviceSuffix(jid).endsWith(WHATSAPP_LID_SUFFIX);
+}
+function isGroupJid(jid) {
+  return !!jid && stripDeviceSuffix(jid).endsWith(WHATSAPP_GROUP_SUFFIX);
+}
+function isStatusOrBroadcastJid(jid) {
+  if (!jid)
+    return true;
+  const normalized = stripDeviceSuffix(jid);
+  return normalized === "status@broadcast" || normalized.endsWith("@broadcast") || normalized.endsWith("@newsletter");
+}
+function jidToDigits(jid) {
+  if (!jid)
+    return "";
+  const base2 = stripDeviceSuffix(jid).split("@")[0] ?? "";
+  return base2.replace(/\D/g, "");
+}
+function normalizePhoneLike(value) {
+  if (!value)
+    return "";
+  return jidToDigits(value.trim());
+}
+function phoneDigitsToJid(phoneDigits) {
+  const digits = normalizePhoneLike(phoneDigits);
+  return digits ? `${digits}${WHATSAPP_PHONE_SUFFIX}` : "";
+}
+function normalizeMaybePhoneJid(value) {
+  if (!value)
+    return null;
+  const trimmed = value.trim();
+  if (!trimmed)
+    return null;
+  if (isLidJid(trimmed))
+    return null;
+  if (trimmed.includes("@"))
+    return stripDeviceSuffix(trimmed);
+  return phoneDigitsToJid(trimmed) || null;
+}
+function isSelfChat(remoteJid, selfPhoneJid, selfLid) {
+  const remote = stripDeviceSuffix(remoteJid);
+  if (!remote)
+    return false;
+  const phone = stripDeviceSuffix(selfPhoneJid);
+  if (phone && remote === phone)
+    return true;
+  const lid = stripDeviceSuffix(selfLid);
+  if (lid && remote === lid)
+    return true;
+  return false;
+}
+function senderIdFromJid(jid) {
+  return jidToDigits(jid);
+}
+function allowedUsersIncludes(allowedUsers, senderId) {
+  const normalizedSender = normalizePhoneLike(senderId);
+  return allowedUsers.some((entry) => normalizePhoneLike(entry) === normalizedSender);
+}
+function resolveLidToPhoneJid(params) {
+  const { lidJid, message, sock } = params;
+  if (!isLidJid(lidJid))
+    return normalizeMaybePhoneJid(lidJid);
+  const msg = message;
+  const senderPn = normalizeMaybePhoneJid(msg?.key?.senderPn ?? undefined);
+  if (senderPn)
+    return senderPn;
+  const repo = sock?.signalRepository;
+  const mapped3 = normalizeMaybePhoneJid(repo?.lidMapping?.get(stripDeviceSuffix(lidJid)));
+  if (mapped3)
+    return mapped3;
+  return null;
+}
+function resolveSendJid(params) {
+  const { chatId, selfPhoneJid, selfLid, lidToJid, sock } = params;
+  if (!isLidJid(chatId))
+    return stripDeviceSuffix(chatId);
+  const normalized = stripDeviceSuffix(chatId);
+  if (selfLid && normalized === stripDeviceSuffix(selfLid) && selfPhoneJid) {
+    return stripDeviceSuffix(selfPhoneJid);
+  }
+  const mapped3 = normalizeMaybePhoneJid(lidToJid?.get(normalized));
+  if (mapped3)
+    return mapped3;
+  const repo = sock?.signalRepository;
+  const signalMapped = normalizeMaybePhoneJid(repo?.lidMapping?.get(normalized));
+  if (signalMapped)
+    return signalMapped;
+  throw new Error(`Cannot send to unresolved WhatsApp LID: ${chatId}`);
+}
+function sanitizePathSegment(input) {
+  const cleaned = input.replace(/[^A-Za-z0-9._-]/g, "_").replace(/^_+|_+$/g, "");
+  return cleaned || "whatsapp";
+}
+var WHATSAPP_PHONE_SUFFIX = "@s.whatsapp.net", WHATSAPP_LID_SUFFIX = "@lid", WHATSAPP_GROUP_SUFFIX = "@g.us";
+
+// src/channels/access-control.ts
+function resolveChannelAccessScope(chatType) {
+  return chatType === "channel" ? "group" : "dm";
+}
+function channelEnvKey(channelId, suffix) {
+  const normalized = channelId.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+  return `LETTA_${normalized}_${suffix}`;
+}
+function parseUserList(raw) {
+  if (!raw)
+    return [];
+  return raw.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+}
+function isEnvFlagEnabled(raw) {
+  const normalized = (raw ?? "").trim().toLowerCase();
+  return normalized === "1" || normalized === "true" || normalized === "yes";
+}
+function getChannelEnvAllowedUsers(channelId) {
+  return [
+    ...parseUserList(process.env[GLOBAL_ALLOWED_USERS_ENV]),
+    ...parseUserList(process.env[channelEnvKey(channelId, "ALLOWED_USERS")])
+  ];
+}
+function getChannelEnvAdminUsers(channelId) {
+  return [
+    ...parseUserList(process.env[GLOBAL_ADMIN_USERS_ENV]),
+    ...parseUserList(process.env[channelEnvKey(channelId, "ADMIN_USERS")])
+  ];
+}
+function isChannelAllowAllUsersEnabled(channelId) {
+  return isEnvFlagEnabled(process.env[GLOBAL_ALLOW_ALL_ENV]) || isEnvFlagEnabled(process.env[channelEnvKey(channelId, "ALLOW_ALL_USERS")]);
+}
+function effectiveAllowedUsers(account, channelId) {
+  return [
+    ...account.allowedUsers,
+    ...account.adminUsers ?? [],
+    ...getChannelEnvAllowedUsers(channelId),
+    ...getChannelEnvAdminUsers(channelId)
+  ];
+}
+function allowlistMatches(channelId, allowed, senderId) {
+  if (allowed.includes("*")) {
+    return true;
+  }
+  if (!senderId) {
+    return false;
+  }
+  if (channelId === "whatsapp") {
+    return allowedUsersIncludes(allowed, senderId);
+  }
+  if (channelId === "signal") {
+    return signalAllowedUsersIncludes(allowed, senderId);
+  }
+  return allowed.includes(senderId);
+}
+function isPairedApproved(channelId, senderId, accountId) {
+  if (isUserApproved(channelId, senderId, accountId)) {
+    return true;
+  }
+  loadPairingStore(channelId);
+  return isUserApproved(channelId, senderId, accountId);
+}
+function evaluateChannelSenderAccess(input) {
+  const { account, channelId, senderId, chatType } = input;
+  if (isChannelAllowAllUsersEnabled(channelId)) {
+    return "allow";
+  }
+  const allowed = effectiveAllowedUsers(account, channelId);
+  if (allowlistMatches(channelId, allowed, senderId)) {
+    return "allow";
+  }
+  const envAllowlistConfigured = getChannelEnvAllowedUsers(channelId).length > 0;
+  const scope = resolveChannelAccessScope(chatType);
+  const restrictive = envAllowlistConfigured || (scope === "group" ? (account.groupPolicy ?? "open") === "allowlist" : account.dmPolicy !== "open");
+  if (!restrictive) {
+    return "allow";
+  }
+  if (senderId && isPairedApproved(channelId, senderId, account.accountId)) {
+    return "allow";
+  }
+  if (scope === "group") {
+    return "deny";
+  }
+  if (account.dmPolicy === "pairing" && !envAllowlistConfigured) {
+    return channelId === "slack" ? "allow" : "pair";
+  }
+  return "deny";
+}
+function buildChannelAccessDeniedMessage(channelId) {
+  const noun = ACCESS_DENIED_NOUNS[channelId] ?? "bot";
+  return `You are not on the allowed users list for this ${noun}.`;
+}
+function floorOnlyChannelCommandGate() {
+  return {
+    enabled: true,
+    isAdmin: false,
+    allowedCommands: [],
+    pairingPending: true
+  };
+}
+function normalizeCommandName(name) {
+  return name.trim().replace(/^\/+/, "").toLowerCase();
+}
+function canonicalizeChannelCommandName(name) {
+  const normalized = normalizeCommandName(name);
+  return normalized === "reflect" ? "reflection" : normalized;
+}
+function resolveChannelCommandGate(params) {
+  const admins = [
+    ...params.account.adminUsers ?? [],
+    ...getChannelEnvAdminUsers(params.channelId)
+  ].filter((entry) => entry.length > 0);
+  const enabled = admins.length > 0;
+  const allowedCommands = (params.account.userAllowedCommands ?? []).map(canonicalizeChannelCommandName).filter((name) => name.length > 0);
+  return {
+    enabled,
+    isAdmin: !enabled || allowlistMatches(params.channelId, admins, params.senderId),
+    allowedCommands
+  };
+}
+function canRunChannelCommand(gate, commandName) {
+  if (!gate.enabled || gate.isAdmin) {
+    return true;
+  }
+  const canonical = canonicalizeChannelCommandName(commandName);
+  return CHANNEL_COMMAND_FLOOR.includes(canonical) || gate.allowedCommands.includes(canonical);
+}
+function runnableCommandsForUser(gate) {
+  const seen = new Set;
+  const runnable = [];
+  for (const name of [...CHANNEL_COMMAND_FLOOR, ...gate.allowedCommands]) {
+    if (!seen.has(name)) {
+      seen.add(name);
+      runnable.push(name);
+    }
+  }
+  return runnable;
+}
 function channelDisplayName(channelId) {
   try {
     return getChannelDisplayName(channelId);
@@ -167342,8 +167897,60 @@ function channelDisplayName(channelId) {
     return channelId;
   }
 }
+function buildChannelCommandDeniedMessage(channelId, commandName, gate) {
+  const runnable = runnableCommandsForUser(gate).map((name) => `/${name}`).join(", ");
+  const restriction = gate.pairingPending ? "is available after pairing completes" : "is limited to admins here";
+  return [
+    `${channelDisplayName(channelId)}: /${normalizeCommandName(commandName)} ${restriction}.`,
+    `Commands you can run: ${runnable}. Use /whoami to see your access.`
+  ].join(`
+`);
+}
+function buildChannelWhoamiMessage(msg, gate) {
+  const scope = resolveChannelAccessScope(msg.chatType) === "dm" ? "DM" : "group/channel";
+  const who = msg.senderName ? `${msg.senderName} (${msg.senderId})` : msg.senderId;
+  const lines = [
+    `You — ${channelDisplayName(msg.channel)} (${scope})`,
+    `User ID: ${who}`
+  ];
+  if (!gate || !gate.enabled) {
+    lines.push("Tier: unrestricted (no admin list configured for this account)", "Commands: all available");
+  } else if (gate.pairingPending) {
+    const runnable = runnableCommandsForUser(gate).map((name) => `/${name}`).join(", ");
+    lines.push("Tier: pending pairing", `Commands you can run: ${runnable}`);
+  } else if (gate.isAdmin) {
+    lines.push("Tier: admin", "Commands: all available");
+  } else {
+    const runnable = runnableCommandsForUser(gate).map((name) => `/${name}`).join(", ");
+    lines.push("Tier: user", `Commands you can run: ${runnable}`);
+  }
+  return lines.join(`
+`);
+}
+var GLOBAL_ALLOWED_USERS_ENV = "LETTA_CHANNELS_ALLOWED_USERS", GLOBAL_ADMIN_USERS_ENV = "LETTA_CHANNELS_ADMIN_USERS", GLOBAL_ALLOW_ALL_ENV = "LETTA_CHANNELS_ALLOW_ALL_USERS", ACCESS_DENIED_NOUNS, CHANNEL_COMMAND_FLOOR;
+var init_access_control = __esm(() => {
+  init_pairing();
+  init_plugin_registry();
+  init_target2();
+  ACCESS_DENIED_NOUNS = {
+    slack: "Slack app",
+    discord: "Discord bot",
+    whatsapp: "WhatsApp account",
+    signal: "Signal account"
+  };
+  CHANNEL_COMMAND_FLOOR = ["help", "status", "whoami"];
+});
+
+// src/channels/feedback.ts
+function channelDisplayName2(channelId) {
+  try {
+    return getChannelDisplayName(channelId);
+  } catch {
+    return channelId;
+  }
+}
 function buildChannelFeedbackUsageMessage(channelId) {
-  const displayName = channelDisplayName(channelId);
+  const displayName = channelDisplayName2(channelId);
   return [
     `${displayName} received /feedback without a message.`,
     "Usage: /feedback <message>"
@@ -167352,11 +167959,11 @@ function buildChannelFeedbackUsageMessage(channelId) {
 `);
 }
 function buildChannelFeedbackTooLongMessage(channelId, maxLength3 = CHANNEL_FEEDBACK_MESSAGE_MAX) {
-  const displayName = channelDisplayName(channelId);
+  const displayName = channelDisplayName2(channelId);
   return `${displayName} feedback message is too long. Maximum is ${maxLength3.toLocaleString()} characters.`;
 }
 function buildChannelFeedbackNoRouteMessage(channelId) {
-  const displayName = channelDisplayName(channelId);
+  const displayName = channelDisplayName2(channelId);
   const instruction = channelId === "slack" ? "Mention the app with a normal message in this chat or thread first so it can connect, then send /feedback <message> while mentioning the app." : "Send a normal message first and follow the pairing instructions, then try /feedback <message>.";
   return [
     `${displayName} cannot submit /feedback until this chat is connected to a Letta agent conversation.`,
@@ -167366,11 +167973,11 @@ function buildChannelFeedbackNoRouteMessage(channelId) {
 `);
 }
 function buildChannelFeedbackSubmittedMessage(channelId) {
-  const displayName = channelDisplayName(channelId);
+  const displayName = channelDisplayName2(channelId);
   return `${displayName} feedback submitted. Thanks for helping improve Letta Code.`;
 }
 function buildChannelFeedbackFailedMessage(channelId) {
-  const displayName = channelDisplayName(channelId);
+  const displayName = channelDisplayName2(channelId);
   return `${displayName} could not submit feedback right now. Please try again later.`;
 }
 function withDefinedValues2(payload) {
@@ -167433,7 +168040,7 @@ var init_feedback2 = __esm(() => {
 });
 
 // src/channels/commands.ts
-function channelDisplayName2(channelId) {
+function channelDisplayName3(channelId) {
   try {
     return getChannelDisplayName(channelId);
   } catch {
@@ -167516,7 +168123,7 @@ function isSlackMentionControlCommand(msg, command) {
   return command.raw.startsWith("!") || isSlackMentionSlashCommand(msg, command);
 }
 function buildChannelHelpMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   if (channelId === "slack") {
     return [
       `${displayName} is connected to Letta Code.`,
@@ -167548,7 +168155,7 @@ function buildChannelHelpMessage(channelId) {
 `);
 }
 function buildUnsupportedChannelCommandMessage(channelId, command) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   const isBang = command.raw.startsWith("!");
   const commandKind = isBang ? "bang" : "slash";
   const supportedCommands = isBang ? supportedBangCommandsText() : channelId === "slack" ? supportedSlackMentionSlashCommandsText() : supportedCommandsText();
@@ -167562,7 +168169,7 @@ function buildUnsupportedChannelCommandMessage(channelId, command) {
 `);
 }
 function buildChannelStatusMessage(msg, context3) {
-  const displayName = channelDisplayName2(msg.channel);
+  const displayName = channelDisplayName3(msg.channel);
   const route = context3.route;
   const routeStatus = route ? "Connected to a Letta agent conversation." : "No route is connected for this chat yet.";
   const accountStatus = !context3.accountConfigured ? "No channel account is configured for this receiver." : context3.accountEnabled === false ? "Channel account is configured but disabled." : "Channel account is configured and enabled.";
@@ -167590,7 +168197,7 @@ function buildChannelStatusMessage(msg, context3) {
 `);
 }
 function buildChannelNoRouteMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return [
     `${displayName} could not find an existing route for this chat.`,
     "Send a normal message first and follow the pairing instructions, then try again."
@@ -167599,23 +168206,23 @@ function buildChannelNoRouteMessage(channelId) {
 `);
 }
 function buildChannelPausedMessage(channelId, route) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   const conversation = route.conversationId ? ` Conversation: ${route.conversationId}.` : "";
   return `${displayName} paused agent routing for this chat.${conversation} Send /resume here to turn replies back on.`;
 }
 function buildChannelAlreadyPausedMessage(channelId) {
-  return `${channelDisplayName2(channelId)} agent routing is already paused for this chat. Send /resume here to turn replies back on.`;
+  return `${channelDisplayName3(channelId)} agent routing is already paused for this chat. Send /resume here to turn replies back on.`;
 }
 function buildChannelResumedMessage(channelId, route) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   const conversation = route.conversationId ? ` Conversation: ${route.conversationId}.` : "";
   return `${displayName} resumed agent routing for this chat.${conversation} Normal messages here will go to the connected agent again.`;
 }
 function buildChannelAlreadyActiveMessage(channelId) {
-  return `${channelDisplayName2(channelId)} agent routing is already active for this chat.`;
+  return `${channelDisplayName3(channelId)} agent routing is already active for this chat.`;
 }
 function buildChannelCancelUnavailableMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return [
     `${displayName} received /cancel, but this chat is not connected to an active Letta Code conversation yet.`,
     "Send a normal message first to connect this chat to an agent."
@@ -167624,15 +168231,15 @@ function buildChannelCancelUnavailableMessage(channelId) {
 `);
 }
 function buildChannelCancelNoActiveTurnMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} received /cancel, but there is no in-progress agent turn to cancel for this chat.`;
 }
 function buildChannelCancelAcceptedMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} cancelled the in-progress agent turn for this chat.`;
 }
 function buildChannelChatLinkMessage(channelId, route, chatUrl) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return [
     `${displayName} chat for this route: ${chatUrl}`,
     `Agent: ${route.agentId}.`,
@@ -167641,27 +168248,27 @@ function buildChannelChatLinkMessage(channelId, route, chatUrl) {
 `);
 }
 function buildChannelChatUnavailableMessage(channelId, route) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} chat UI is not available for local backend agent ${route.agentId}.`;
 }
 function buildChannelDetachUnsupportedMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} can only detach Slack channel threads.`;
 }
 function buildChannelDetachedMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} detached this thread. I will ignore follow-up replies here until someone mentions the app again.`;
 }
 function buildChannelAlreadyDetachedMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} is already detached from this thread. Mention the app again to reattach.`;
 }
 function buildChannelNewConversationMessage(channelId, route) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} started a new conversation for this chat. Conversation: ${route.conversationId}.`;
 }
 function buildChannelNewConversationUnavailableMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} cannot start a new conversation for this chat because no agent is configured.`;
 }
 function getModelEntryRank(entry) {
@@ -167720,7 +168327,7 @@ function buildChannelModelNotFoundText(channelId) {
   return `Model not found. Use ${modelCommandPrefix(channelId)} list to see available models.`;
 }
 function buildChannelCurrentModelMessage(channelId, params) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   const scope = params.scope === "agent" ? "agent" : "conversation";
   const handleText = params.modelHandle && params.modelHandle !== params.modelLabel ? ` (${params.modelHandle})` : "";
   const switchCommand = modelCommandPrefix(channelId);
@@ -167748,7 +168355,7 @@ function appendModelEntrySection(lines, channelId, title, entries, limit3) {
   }
 }
 function buildChannelModelListMessage(channelId, params) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   const limit3 = params.limit ?? DEFAULT_CHANNEL_MODEL_LIST_LIMIT;
   const entries = params.entries;
   const byHandle = buildModelEntriesByHandle(entries);
@@ -167781,33 +168388,33 @@ function buildChannelModelListMessage(channelId, params) {
 `);
 }
 function buildChannelModelListUnavailableMessage(channelId, error54) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} could not load the model list: ${error54}`;
 }
 function buildChannelCurrentModelUnavailableMessage(channelId, error54) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} could not load the current model: ${error54}`;
 }
 function buildChannelModelUpdatedMessage(channelId, params) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   const scope = params.appliedTo === "agent" ? "agent" : "conversation";
   const handleText = params.modelHandle === params.modelLabel ? "" : ` (${params.modelHandle})`;
   return `${displayName} updated this ${scope}'s model to ${params.modelLabel}${handleText}.`;
 }
 function buildChannelModelUpdateFailedMessage(channelId, identifier2, error54) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} could not switch this chat's routed model to ${identifier2}: ${error54}`;
 }
 function buildChannelModelUnavailableMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} cannot use /model because the listener is not ready yet. Try again in a moment.`;
 }
 function buildChannelReflectionUnavailableMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} cannot start reflection for this chat because the listener is not ready yet. Try again in a moment.`;
 }
 function buildChannelReloadUnavailableMessage(channelId) {
-  const displayName = channelDisplayName2(channelId);
+  const displayName = channelDisplayName3(channelId);
   return `${displayName} cannot reload listener settings for this chat because the listener is not ready yet. Try again in a moment.`;
 }
 async function handleScopedCommand(params) {
@@ -167844,10 +168451,17 @@ async function tryHandleChannelSlashCommand(adapter, msg, options3 = {}) {
     await adapter.sendDirectReply(msg.chatId, buildUnsupportedChannelCommandMessage(msg.channel, command), msg.threadId ? { replyToMessageId: msg.threadId } : undefined);
     return true;
   }
+  const canonicalName = canonicalizeChannelCommandName(command.name);
+  if (options3.commandGate && !canRunChannelCommand(options3.commandGate, canonicalName)) {
+    await adapter.sendDirectReply(msg.chatId, buildChannelCommandDeniedMessage(msg.channel, canonicalName, options3.commandGate), msg.threadId ? { replyToMessageId: msg.threadId } : undefined);
+    return true;
+  }
   const reply = normalizeDirectReplyPayload(await (async () => {
     switch (command.name) {
       case "help":
         return buildChannelHelpMessage(msg.channel);
+      case "whoami":
+        return buildChannelWhoamiMessage(msg, options3.commandGate);
       case "status":
         return buildChannelStatusMessage(msg, options3.statusContext ?? {
           adapterRunning: adapter.isRunning(),
@@ -167941,6 +168555,7 @@ async function tryHandleChannelSlashCommand(adapter, msg, options3 = {}) {
 }
 var CHANNEL_SLASH_COMMANDS, SLACK_MENTION_COMMAND_NAMES, SLACK_MENTION_SLASH_COMMAND_EXAMPLES, DEFAULT_CHANNEL_MODEL_LIST_LIMIT = 8;
 var init_commands = __esm(() => {
+  init_access_control();
   init_feedback2();
   init_plugin_registry();
   CHANNEL_SLASH_COMMANDS = [
@@ -167954,6 +168569,11 @@ var init_commands = __esm(() => {
       kind: "direct",
       summary: "Show this chat's channel connection status."
     },
+    {
+      name: "whoami",
+      kind: "direct",
+      summary: "Show your access tier and runnable commands here."
+    },
     {
       name: "pause",
       kind: "direct",
@@ -168001,6 +168621,7 @@ var init_commands = __esm(() => {
   SLACK_MENTION_SLASH_COMMAND_EXAMPLES = [
     "@agent /help",
     "@agent /status",
+    "@agent /whoami",
     "@agent /model",
     "@agent /model list",
     "@agent /model <handle-or-id>",
@@ -168100,19 +168721,24 @@ Handle: ${escapeSlackMrkdwn(params.current.modelHandle)}` : "";
       text: {
         type: "mrkdwn",
         text: "Choose a model for this routed conversation:"
-      },
-      accessory: {
-        type: "static_select",
-        action_id: SLACK_MODEL_SELECT_ACTION_ID,
-        placeholder: {
-          type: "plain_text",
-          text: "Select a model",
-          emoji: true
-        },
-        options: options3,
-        ...initialOption ? { initial_option: initialOption } : {}
       }
     },
+    {
+      type: "actions",
+      elements: [
+        {
+          type: "static_select",
+          action_id: SLACK_MODEL_SELECT_ACTION_ID,
+          placeholder: {
+            type: "plain_text",
+            text: "Select a model",
+            emoji: true
+          },
+          options: options3,
+          ...initialOption ? { initial_option: initialOption } : {}
+        }
+      ]
+    },
     {
       type: "context",
       elements: [
@@ -170977,9 +171603,9 @@ __export(exports_process_manager, {
 import {
   appendFileSync as appendFileSync2,
   chmodSync as chmodSync2,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync6,
   mkdtempSync as mkdtempSync2,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join13 } from "node:path";
@@ -171138,7 +171764,7 @@ function __resetBackgroundOutputDirForTests() {
   backgroundOutputDir = undefined;
 }
 function ensureBackgroundOutputDir(dir) {
-  mkdirSync5(dir, { recursive: true, mode: 448 });
+  mkdirSync6(dir, { recursive: true, mode: 448 });
   if (!process.env.LETTA_SCRATCHPAD) {
     chmodSync2(dir, 448);
   }
@@ -171147,7 +171773,7 @@ function createBackgroundOutputFile(id2) {
   const dir = getBackgroundOutputDir();
   ensureBackgroundOutputDir(dir);
   const filePath = join13(dir, `${id2}.log`);
-  writeFileSync3(filePath, "", { mode: 384 });
+  writeFileSync4(filePath, "", { mode: 384 });
   chmodSync2(filePath, 384);
   return filePath;
 }
@@ -171240,12 +171866,12 @@ var init_attachment_task = __esm(() => {
 });
 
 // src/channels/targets.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
-function getStore2(channelId) {
-  let store = stores2.get(channelId);
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
+function getStore3(channelId) {
+  let store = stores3.get(channelId);
   if (!store) {
     store = { targets: [] };
-    stores2.set(channelId, store);
+    stores3.set(channelId, store);
   }
   return store;
 }
@@ -171255,35 +171881,35 @@ function loadTargetStore(channelId) {
     return;
   }
   const path5 = getChannelTargetsPath(channelId);
-  if (!existsSync8(path5)) {
+  if (!existsSync9(path5)) {
     return;
   }
   try {
-    const text = readFileSync7(path5, "utf-8");
+    const text = readFileSync8(path5, "utf-8");
     const parsed = JSON.parse(text);
-    stores2.set(channelId, {
+    stores3.set(channelId, {
       targets: parsed.targets ?? []
     });
   } catch {}
 }
 function saveTargetStore(channelId) {
   if (saveTargetStoreOverride) {
-    saveTargetStoreOverride(channelId, getStore2(channelId));
+    saveTargetStoreOverride(channelId, getStore3(channelId));
     return;
   }
   const dir = getChannelDir(channelId);
-  mkdirSync6(dir, { recursive: true });
-  writeFileSync4(getChannelTargetsPath(channelId), `${JSON.stringify(getStore2(channelId), null, 2)}
+  mkdirSync7(dir, { recursive: true });
+  writeFileSync5(getChannelTargetsPath(channelId), `${JSON.stringify(getStore3(channelId), null, 2)}
 `, "utf-8");
 }
 function listChannelTargets(channelId, accountId) {
-  const normalizedAccountId = accountId === undefined ? undefined : normalizeAccountId(accountId);
-  return getStore2(channelId).targets.filter((target2) => normalizedAccountId === undefined || normalizeAccountId(target2.accountId) === normalizedAccountId);
+  const normalizedAccountId = accountId === undefined ? undefined : normalizeAccountId2(accountId);
+  return getStore3(channelId).targets.filter((target2) => normalizedAccountId === undefined || normalizeAccountId2(target2.accountId) === normalizedAccountId);
 }
 function upsertChannelTarget(channelId, target2) {
-  const store = getStore2(channelId);
-  const normalizedAccountId = normalizeAccountId(target2.accountId);
-  const existingIndex = store.targets.findIndex((candidate) => candidate.targetId === target2.targetId && normalizeAccountId(candidate.accountId) === normalizedAccountId);
+  const store = getStore3(channelId);
+  const normalizedAccountId = normalizeAccountId2(target2.accountId);
+  const existingIndex = store.targets.findIndex((candidate) => candidate.targetId === target2.targetId && normalizeAccountId2(candidate.accountId) === normalizedAccountId);
   if (existingIndex >= 0) {
     const existing = store.targets[existingIndex];
     if (!existing) {
@@ -171311,9 +171937,9 @@ function upsertChannelTarget(channelId, target2) {
   };
 }
 function removeChannelTarget(channelId, targetId, accountId) {
-  const store = getStore2(channelId);
-  const normalizedAccountId = normalizeAccountId(accountId);
-  const nextTargets = store.targets.filter((target2) => !(target2.targetId === targetId && normalizeAccountId(target2.accountId) === normalizedAccountId));
+  const store = getStore3(channelId);
+  const normalizedAccountId = normalizeAccountId2(accountId);
+  const nextTargets = store.targets.filter((target2) => !(target2.targetId === targetId && normalizeAccountId2(target2.accountId) === normalizedAccountId));
   if (nextTargets.length === store.targets.length) {
     return false;
   }
@@ -171322,9 +171948,9 @@ function removeChannelTarget(channelId, targetId, accountId) {
   return true;
 }
 function removeChannelTargetsForAccount(channelId, accountId) {
-  const store = getStore2(channelId);
-  const normalizedAccountId = normalizeAccountId(accountId);
-  const nextTargets = store.targets.filter((target2) => normalizeAccountId(target2.accountId) !== normalizedAccountId);
+  const store = getStore3(channelId);
+  const normalizedAccountId = normalizeAccountId2(accountId);
+  const nextTargets = store.targets.filter((target2) => normalizeAccountId2(target2.accountId) !== normalizedAccountId);
   const removed = store.targets.length - nextTargets.length;
   if (removed === 0) {
     return 0;
@@ -171333,14 +171959,14 @@ function removeChannelTargetsForAccount(channelId, accountId) {
   saveTargetStore(channelId);
   return removed;
 }
-function normalizeAccountId(accountId) {
+function normalizeAccountId2(accountId) {
   return accountId ?? LEGACY_CHANNEL_ACCOUNT_ID;
 }
-var stores2, loadTargetStoreOverride = null, saveTargetStoreOverride = null;
+var stores3, loadTargetStoreOverride = null, saveTargetStoreOverride = null;
 var init_targets = __esm(() => {
   init_accounts();
   init_config2();
-  stores2 = new Map;
+  stores3 = new Map;
 });
 
 // src/channels/slack/target-resolution.ts
@@ -171933,12 +172559,12 @@ function resolveDiscordChannelMode(channelId, parentChannelId, isThread, allowed
 
 // src/channels/discord/media.ts
 import { randomUUID as randomUUID10 } from "node:crypto";
-import { mkdirSync as mkdirSync7 } from "node:fs";
+import { mkdirSync as mkdirSync8 } from "node:fs";
 import { writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
 import { join as join14 } from "node:path";
 function ensureAttachmentsDir() {
-  mkdirSync7(DISCORD_ATTACHMENTS_DIR, { recursive: true });
+  mkdirSync8(DISCORD_ATTACHMENTS_DIR, { recursive: true });
   return DISCORD_ATTACHMENTS_DIR;
 }
 function sanitizeDiscordPathSegment(input) {
@@ -173183,107 +173809,6 @@ var init_plugin4 = __esm(() => {
   };
 });
 
-// src/channels/whatsapp/jid.ts
-function stripDeviceSuffix(jid) {
-  if (!jid)
-    return "";
-  return jid.replace(/:\d+(@|$)/, "$1");
-}
-function isLidJid(jid) {
-  return !!jid && stripDeviceSuffix(jid).endsWith(WHATSAPP_LID_SUFFIX);
-}
-function isGroupJid(jid) {
-  return !!jid && stripDeviceSuffix(jid).endsWith(WHATSAPP_GROUP_SUFFIX);
-}
-function isStatusOrBroadcastJid(jid) {
-  if (!jid)
-    return true;
-  const normalized = stripDeviceSuffix(jid);
-  return normalized === "status@broadcast" || normalized.endsWith("@broadcast") || normalized.endsWith("@newsletter");
-}
-function jidToDigits(jid) {
-  if (!jid)
-    return "";
-  const base2 = stripDeviceSuffix(jid).split("@")[0] ?? "";
-  return base2.replace(/\D/g, "");
-}
-function normalizePhoneLike(value) {
-  if (!value)
-    return "";
-  return jidToDigits(value.trim());
-}
-function phoneDigitsToJid(phoneDigits) {
-  const digits = normalizePhoneLike(phoneDigits);
-  return digits ? `${digits}${WHATSAPP_PHONE_SUFFIX}` : "";
-}
-function normalizeMaybePhoneJid(value) {
-  if (!value)
-    return null;
-  const trimmed = value.trim();
-  if (!trimmed)
-    return null;
-  if (isLidJid(trimmed))
-    return null;
-  if (trimmed.includes("@"))
-    return stripDeviceSuffix(trimmed);
-  return phoneDigitsToJid(trimmed) || null;
-}
-function isSelfChat(remoteJid, selfPhoneJid, selfLid) {
-  const remote = stripDeviceSuffix(remoteJid);
-  if (!remote)
-    return false;
-  const phone = stripDeviceSuffix(selfPhoneJid);
-  if (phone && remote === phone)
-    return true;
-  const lid = stripDeviceSuffix(selfLid);
-  if (lid && remote === lid)
-    return true;
-  return false;
-}
-function senderIdFromJid(jid) {
-  return jidToDigits(jid);
-}
-function allowedUsersIncludes(allowedUsers, senderId) {
-  const normalizedSender = normalizePhoneLike(senderId);
-  return allowedUsers.some((entry) => normalizePhoneLike(entry) === normalizedSender);
-}
-function resolveLidToPhoneJid(params) {
-  const { lidJid, message, sock } = params;
-  if (!isLidJid(lidJid))
-    return normalizeMaybePhoneJid(lidJid);
-  const msg = message;
-  const senderPn = normalizeMaybePhoneJid(msg?.key?.senderPn ?? undefined);
-  if (senderPn)
-    return senderPn;
-  const repo = sock?.signalRepository;
-  const mapped3 = normalizeMaybePhoneJid(repo?.lidMapping?.get(stripDeviceSuffix(lidJid)));
-  if (mapped3)
-    return mapped3;
-  return null;
-}
-function resolveSendJid(params) {
-  const { chatId, selfPhoneJid, selfLid, lidToJid, sock } = params;
-  if (!isLidJid(chatId))
-    return stripDeviceSuffix(chatId);
-  const normalized = stripDeviceSuffix(chatId);
-  if (selfLid && normalized === stripDeviceSuffix(selfLid) && selfPhoneJid) {
-    return stripDeviceSuffix(selfPhoneJid);
-  }
-  const mapped3 = normalizeMaybePhoneJid(lidToJid?.get(normalized));
-  if (mapped3)
-    return mapped3;
-  const repo = sock?.signalRepository;
-  const signalMapped = normalizeMaybePhoneJid(repo?.lidMapping?.get(normalized));
-  if (signalMapped)
-    return signalMapped;
-  throw new Error(`Cannot send to unresolved WhatsApp LID: ${chatId}`);
-}
-function sanitizePathSegment(input) {
-  const cleaned = input.replace(/[^A-Za-z0-9._-]/g, "_").replace(/^_+|_+$/g, "");
-  return cleaned || "whatsapp";
-}
-var WHATSAPP_PHONE_SUFFIX = "@s.whatsapp.net", WHATSAPP_LID_SUFFIX = "@lid", WHATSAPP_GROUP_SUFFIX = "@g.us";
-
 // src/channels/whatsapp/media.ts
 import { randomUUID as randomUUID12 } from "node:crypto";
 import { mkdir as mkdir5, writeFile as writeFile7 } from "node:fs/promises";
@@ -173612,7 +174137,7 @@ var init_state = __esm(() => {
 });
 
 // src/channels/whatsapp/session.ts
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join16 } from "node:path";
 function shouldDropLine(line) {
@@ -173686,7 +174211,7 @@ function defaultIsProcessAlive(pid) {
 }
 function readLeaseOwner(lockDir) {
   try {
-    const owner = JSON.parse(readFileSync8(join16(lockDir, "owner.json"), "utf8"));
+    const owner = JSON.parse(readFileSync9(join16(lockDir, "owner.json"), "utf8"));
     return {
       pid: typeof owner.pid === "number" ? owner.pid : undefined,
       command: typeof owner.command === "string" ? owner.command : undefined
@@ -173705,8 +174230,8 @@ function acquireWhatsAppSessionLease(accountId, options3 = {}) {
   }
   for (let attempt = 0;attempt < 2; attempt += 1) {
     try {
-      mkdirSync8(lockDir);
-      writeFileSync5(join16(lockDir, "owner.json"), `${JSON.stringify({
+      mkdirSync9(lockDir);
+      writeFileSync6(join16(lockDir, "owner.json"), `${JSON.stringify({
         accountId,
         pid,
         command: process.argv.join(" "),
@@ -173784,7 +174309,7 @@ function renderQrTerminal(qrMod, input) {
 async function createWhatsAppSocket(params) {
   installWhatsAppConsoleFilters();
   const authDir = getWhatsAppAuthDir(params.accountId);
-  mkdirSync8(authDir, { recursive: true });
+  mkdirSync9(authDir, { recursive: true });
   const sessionLease = acquireWhatsAppSessionLease(params.accountId);
   setWhatsAppConnectionState(params.accountId, { status: "connecting" });
   try {
@@ -174584,126 +175109,6 @@ var init_plugin5 = __esm(() => {
   };
 });
 
-// src/channels/signal/target.ts
-function assertSignalHttpProtocol(url2) {
-  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
-    throw new Error(`Signal base URL protocol must be http or https, got ${url2.protocol}`);
-  }
-}
-function trimPrefix(value, prefix) {
-  if (!value.toLowerCase().startsWith(prefix)) {
-    return null;
-  }
-  return value.slice(prefix.length).trim();
-}
-function normalizeSignalBaseUrl(input) {
-  const trimmed = input.trim();
-  if (!trimmed) {
-    return "";
-  }
-  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
-  const withScheme = hasScheme ? trimmed : `http://${trimmed}`;
-  const parsed = new URL(withScheme);
-  assertSignalHttpProtocol(parsed);
-  if (parsed.username || parsed.password) {
-    throw new Error("Signal base URL must not include credentials.");
-  }
-  return withScheme.replace(/\/+$/, "");
-}
-function parseSignalTarget(input) {
-  const trimmed = input.trim();
-  if (!trimmed) {
-    throw new Error("Signal target is required.");
-  }
-  const signalTarget = trimPrefix(trimmed, "signal:");
-  const value = signalTarget !== null ? signalTarget : trimmed;
-  if (!value) {
-    throw new Error("Signal target is required.");
-  }
-  const groupId = trimPrefix(value, "group:");
-  if (groupId) {
-    return { kind: "group", groupId };
-  }
-  const username = trimPrefix(value, "username:");
-  if (username) {
-    return { kind: "username", username };
-  }
-  const usernameAlias = trimPrefix(value, "u:");
-  if (usernameAlias) {
-    return { kind: "username", username: `u:${usernameAlias}` };
-  }
-  const recipient = value;
-  if (!recipient) {
-    throw new Error("Signal recipient is required.");
-  }
-  return { kind: "recipient", recipient };
-}
-function signalTargetToSendRpcParams(target2) {
-  switch (target2.kind) {
-    case "group":
-      return { groupId: target2.groupId };
-    case "username":
-      return { username: [target2.username] };
-    case "recipient":
-      return { recipient: [target2.recipient] };
-  }
-}
-function signalTargetToReactionRpcParams(target2) {
-  switch (target2.kind) {
-    case "group":
-      return { groupIds: [target2.groupId] };
-    case "recipient":
-      return { recipients: [target2.recipient] };
-    case "username":
-      throw new Error("Signal reactions require a recipient or group target.");
-  }
-}
-function normalizeSignalSenderId(value) {
-  if (!value) {
-    return "";
-  }
-  const trimmed = value.trim();
-  if (!trimmed) {
-    return "";
-  }
-  return trimmed.toLowerCase();
-}
-function normalizeSignalPhone(value) {
-  if (!value) {
-    return "";
-  }
-  const trimmed = value.trim();
-  if (!trimmed) {
-    return "";
-  }
-  const withoutPrefix = trimmed.toLowerCase().startsWith("signal:") ? trimmed.slice("signal:".length) : trimmed;
-  return withoutPrefix.replace(/[^0-9+]/g, "");
-}
-function signalAllowedUsersIncludes(allowedUsers, senderId) {
-  const normalizedSender = normalizeSignalSenderId(senderId);
-  const senderPhone = normalizeSignalPhone(senderId);
-  return allowedUsers.some((entry) => {
-    const normalizedEntry = normalizeSignalSenderId(entry);
-    if (normalizedEntry === normalizedSender) {
-      return true;
-    }
-    const entryPhone = normalizeSignalPhone(entry);
-    return !!senderPhone && !!entryPhone && senderPhone === entryPhone;
-  });
-}
-function isSignalGroupAllowed(allowedGroups, groupId) {
-  if (!allowedGroups || allowedGroups.length === 0) {
-    return true;
-  }
-  const normalized = groupId.trim();
-  return allowedGroups.some((entry) => entry.trim() === normalized);
-}
-function matchesSignalMentionPatterns(text, mentionPatterns) {
-  const normalizedText = text.toLowerCase();
-  return (mentionPatterns ?? []).map((entry) => entry.trim().toLowerCase()).filter(Boolean).some((entry) => normalizedText.includes(entry));
-}
-var init_target2 = () => {};
-
 // src/channels/signal/client.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
 import { request as httpRequest } from "node:http";
@@ -175054,9 +175459,9 @@ var init_client5 = __esm(() => {
 import { randomUUID as randomUUID15 } from "node:crypto";
 import {
   copyFileSync,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync10,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   realpathSync as realpathSync2,
   statSync as statSync3
 } from "node:fs";
@@ -175334,7 +175739,7 @@ function copySignalAttachment(params) {
   const mimeType = normalizeSignalMimeType(params.attachment.contentType) ?? inferSignalMimeTypeFromName(fileName);
   const kind = inferSignalAttachmentKind({ mimeType, fileName });
   const inboundDir = join17(getChannelDir("signal"), "inbound", sanitizeSignalPathSegment(params.accountId));
-  mkdirSync9(inboundDir, { recursive: true });
+  mkdirSync10(inboundDir, { recursive: true });
   const localPath = join17(inboundDir, `${Date.now()}-${randomUUID15()}-${sanitizeSignalPathSegment(fileName)}`);
   copyFileSync(params.sourcePath, localPath);
   const attachment = {
@@ -175346,7 +175751,7 @@ function copySignalAttachment(params) {
     localPath
   };
   if (kind === "image" && sizeBytes <= MAX_SIGNAL_INLINE_IMAGE_BYTES) {
-    attachment.imageDataBase64 = readFileSync9(localPath).toString("base64");
+    attachment.imageDataBase64 = readFileSync10(localPath).toString("base64");
   }
   return attachment;
 }
@@ -176034,7 +176439,7 @@ var init_runtime5 = __esm(() => {
 
 // src/channels/signal/setup-runtime.ts
 import { execFileSync as execFileSync2, spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 function getSignalDockerRunCommand() {
   return [
     "docker run -d",
@@ -176076,7 +176481,7 @@ function detectNativeSignalCliConfigDir() {
     }
   } catch {}
   const defaultDir = getDefaultSignalCliConfigDir();
-  return defaultDir && existsSync9(defaultDir) ? defaultDir : null;
+  return defaultDir && existsSync10(defaultDir) ? defaultDir : null;
 }
 function runNativeSignalCli(args) {
   try {
@@ -176842,7 +177247,7 @@ __export(exports_plugin_registry, {
   getChannelDisplayName: () => getChannelDisplayName,
   __testClearUserChannelPluginCache: () => __testClearUserChannelPluginCache
 });
-import { existsSync as existsSync10, readdirSync as readdirSync3, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolve4, sep } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 function isValidChannelId(value) {
@@ -176853,11 +177258,11 @@ function readStringArray(value) {
 }
 function readChannelManifest(channelDir) {
   const manifestPath = resolve4(channelDir, "channel.json");
-  if (!existsSync10(manifestPath)) {
+  if (!existsSync11(manifestPath)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync10(manifestPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync11(manifestPath, "utf-8"));
     if (!isRecord(parsed)) {
       return null;
     }
@@ -176933,7 +177338,7 @@ function createUserChannelRegistration(manifest) {
 function discoverUserChannelRegistrations() {
   const registrations = new Map;
   const channelsRoot = getChannelsRoot();
-  if (!existsSync10(channelsRoot)) {
+  if (!existsSync11(channelsRoot)) {
     return registrations;
   }
   let entries;
@@ -177096,186 +177501,6 @@ var init_plugin_registry = __esm(() => {
   loadedUserPlugins = new Map;
 });
 
-// src/channels/pairing.ts
-var exports_pairing = {};
-__export(exports_pairing, {
-  rollbackPairingApproval: () => rollbackPairingApproval,
-  removePairingStateForAccount: () => removePairingStateForAccount,
-  loadPairingStore: () => loadPairingStore,
-  isUserApproved: () => isUserApproved,
-  getPendingPairings: () => getPendingPairings,
-  getApprovedUsers: () => getApprovedUsers,
-  createPairingCode: () => createPairingCode,
-  consumePairingCode: () => consumePairingCode,
-  clearPairingStores: () => clearPairingStores,
-  __testOverrideSavePairingStore: () => __testOverrideSavePairingStore,
-  __testOverrideLoadPairingStore: () => __testOverrideLoadPairingStore
-});
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "node:fs";
-function normalizeAccountId2(accountId) {
-  return accountId ?? LEGACY_CHANNEL_ACCOUNT_ID;
-}
-function getStore3(channelId) {
-  let store = stores3.get(channelId);
-  if (!store) {
-    store = { pending: [], approved: [] };
-    stores3.set(channelId, store);
-  }
-  return store;
-}
-function loadPairingStore(channelId) {
-  if (loadPairingStoreOverride) {
-    const overridden = loadPairingStoreOverride(channelId);
-    if (overridden === null) {
-      return;
-    }
-    stores3.set(channelId, {
-      pending: [...overridden.pending],
-      approved: [...overridden.approved]
-    });
-    return;
-  }
-  const path5 = getChannelPairingPath(channelId);
-  if (!existsSync11(path5))
-    return;
-  try {
-    const text = readFileSync11(path5, "utf-8");
-    const parsed = JSON.parse(text);
-    stores3.set(channelId, {
-      pending: parsed.pending ?? [],
-      approved: parsed.approved ?? []
-    });
-  } catch {}
-}
-function savePairingStore(channelId) {
-  const store = getStore3(channelId);
-  if (savePairingStoreOverride) {
-    savePairingStoreOverride(channelId, {
-      pending: [...store.pending],
-      approved: [...store.approved]
-    });
-    return;
-  }
-  const dir = getChannelDir(channelId);
-  mkdirSync10(dir, { recursive: true });
-  writeFileSync6(getChannelPairingPath(channelId), `${JSON.stringify(store, null, 2)}
-`, "utf-8");
-}
-function generateCode(length = 6) {
-  let code2 = "";
-  for (let i2 = 0;i2 < length; i2++) {
-    code2 += CODE_CHARS[Math.floor(Math.random() * CODE_CHARS.length)];
-  }
-  return code2;
-}
-function isUserApproved(channelId, userId, accountId) {
-  const store = getStore3(channelId);
-  const normalizedAccountId = normalizeAccountId2(accountId);
-  return store.approved.some((u) => u.senderId === userId && normalizeAccountId2(u.accountId) === normalizedAccountId);
-}
-function createPairingCode(channelId, userId, chatId, username, accountId) {
-  const store = getStore3(channelId);
-  const normalizedAccountId = normalizeAccountId2(accountId);
-  store.pending = store.pending.filter((p) => !(p.senderId === userId && normalizeAccountId2(p.accountId) === normalizedAccountId));
-  const now = Date.now();
-  store.pending = store.pending.filter((p) => new Date(p.expiresAt).getTime() > now);
-  while (store.pending.length >= MAX_PENDING_CODES) {
-    store.pending.shift();
-  }
-  const code2 = generateCode();
-  const pending = {
-    accountId: normalizedAccountId,
-    code: code2,
-    senderId: userId,
-    senderName: username,
-    chatId,
-    createdAt: new Date().toISOString(),
-    expiresAt: new Date(now + PAIRING_CODE_TTL_MS).toISOString()
-  };
-  store.pending.push(pending);
-  savePairingStore(channelId);
-  return code2;
-}
-function consumePairingCode(channelId, code2, accountId) {
-  const store = getStore3(channelId);
-  const upperCode = code2.toUpperCase();
-  const normalizedAccountId = accountId === undefined ? undefined : normalizeAccountId2(accountId);
-  const matches = store.pending.map((pending2, index2) => ({ pending: pending2, index: index2 })).filter(({ pending: pending2 }) => pending2.code === upperCode && (normalizedAccountId === undefined || normalizeAccountId2(pending2.accountId) === normalizedAccountId));
-  if (matches.length > 1) {
-    return null;
-  }
-  const index = matches[0]?.index ?? -1;
-  if (index === -1)
-    return null;
-  const pending = store.pending[index];
-  const pendingAccountId = normalizeAccountId2(pending.accountId);
-  if (new Date(pending.expiresAt).getTime() < Date.now()) {
-    store.pending.splice(index, 1);
-    savePairingStore(channelId);
-    return null;
-  }
-  store.pending.splice(index, 1);
-  if (!store.approved.some((u) => u.senderId === pending.senderId && normalizeAccountId2(u.accountId) === pendingAccountId)) {
-    const approved = {
-      accountId: pendingAccountId,
-      senderId: pending.senderId,
-      senderName: pending.senderName,
-      approvedAt: new Date().toISOString()
-    };
-    store.approved.push(approved);
-  }
-  savePairingStore(channelId);
-  return pending;
-}
-function getPendingPairings(channelId, accountId) {
-  const store = getStore3(channelId);
-  const now = Date.now();
-  const normalizedAccountId = accountId === undefined ? undefined : normalizeAccountId2(accountId);
-  return store.pending.filter((p) => new Date(p.expiresAt).getTime() > now && (normalizedAccountId === undefined || normalizeAccountId2(p.accountId) === normalizedAccountId));
-}
-function getApprovedUsers(channelId, accountId) {
-  const normalizedAccountId = accountId === undefined ? undefined : normalizeAccountId2(accountId);
-  return getStore3(channelId).approved.filter((user) => normalizedAccountId === undefined || normalizeAccountId2(user.accountId) === normalizedAccountId);
-}
-function rollbackPairingApproval(channelId, pending) {
-  const store = getStore3(channelId);
-  const normalizedAccountId = normalizeAccountId2(pending.accountId);
-  store.approved = store.approved.filter((u) => !(u.senderId === pending.senderId && normalizeAccountId2(u.accountId) === normalizedAccountId));
-  store.pending.push(pending);
-  savePairingStore(channelId);
-}
-function removePairingStateForAccount(channelId, accountId) {
-  const store = getStore3(channelId);
-  const normalizedAccountId = normalizeAccountId2(accountId);
-  const nextPending = store.pending.filter((pending) => normalizeAccountId2(pending.accountId) !== normalizedAccountId);
-  const nextApproved = store.approved.filter((approved) => normalizeAccountId2(approved.accountId) !== normalizedAccountId);
-  const pendingRemoved = store.pending.length - nextPending.length;
-  const approvedRemoved = store.approved.length - nextApproved.length;
-  if (pendingRemoved === 0 && approvedRemoved === 0) {
-    return { pendingRemoved, approvedRemoved };
-  }
-  store.pending = nextPending;
-  store.approved = nextApproved;
-  savePairingStore(channelId);
-  return { pendingRemoved, approvedRemoved };
-}
-function clearPairingStores() {
-  stores3.clear();
-}
-function __testOverrideLoadPairingStore(fn) {
-  loadPairingStoreOverride = fn;
-}
-function __testOverrideSavePairingStore(fn) {
-  savePairingStoreOverride = fn;
-}
-var PAIRING_CODE_TTL_MS, MAX_PENDING_CODES = 50, CODE_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789", stores3, loadPairingStoreOverride = null, savePairingStoreOverride = null;
-var init_pairing = __esm(() => {
-  init_accounts();
-  init_config2();
-  PAIRING_CODE_TTL_MS = 15 * 60 * 1000;
-  stores3 = new Map;
-});
-
 // src/cli/helpers/app-urls.ts
 function isLocalAgentId2(agentId) {
   return isLocalAgentId(agentId);
@@ -177320,7 +177545,7 @@ var init_app_urls = __esm(() => {
 });
 
 // src/channels/registry-presentation.ts
-function channelDisplayName3(channelId) {
+function channelDisplayName4(channelId) {
   try {
     return getChannelDisplayName(channelId);
   } catch {
@@ -177338,7 +177563,7 @@ function getConfiguredAgentId(config3) {
   return normalizeAgentId(source2.agentId) ?? normalizeAgentId(source2.binding?.agentId);
 }
 function buildPairingInstructions(channelId, code2, options3 = {}) {
-  const displayName = channelDisplayName3(channelId);
+  const displayName = channelDisplayName4(channelId);
   const configuredAgentId = normalizeAgentId(options3.agentId);
   const pairingCommand = `letta channels pair --channel ${channelId} --code ${code2} --agent ${configuredAgentId ?? "<agent-id>"}`;
   const agentLookupLines = configuredAgentId ? [] : ["Find the target agent with: letta agents list"];
@@ -177372,7 +177597,7 @@ function buildPairingInstructions(channelId, code2, options3 = {}) {
 `);
 }
 function buildUnboundRouteInstructions(channelId, chatId) {
-  const displayName = channelDisplayName3(channelId);
+  const displayName = channelDisplayName4(channelId);
   if (!isFirstPartyChannelPlugin(channelId)) {
     return `This chat isn't connected to a Letta agent yet.
 
@@ -178220,6 +178445,9 @@ class ChannelControlRequests {
       this.requestIdByScope.delete(scopeKey);
       return false;
     }
+    if (pending.event.source.senderId && pending.event.source.senderId !== msg.senderId) {
+      return false;
+    }
     if (msg.channel === "slack" && pending.event.kind === "generic_tool_approval") {
       return false;
     }
@@ -178789,10 +179017,27 @@ function createChannelInboundRouter(deps) {
     const adapter = deps.getAdapter(msg.channel, accountId);
     if (!adapter)
       return;
+    const config3 = getChannelAccount(msg.channel, accountId);
+    const senderAccess = config3 ? evaluateChannelSenderAccess({
+      account: config3,
+      channelId: msg.channel,
+      senderId: msg.senderId,
+      chatType: msg.chatType
+    }) : null;
+    if (senderAccess === "deny") {
+      if (msg.reaction) {
+        return;
+      }
+      if (resolveChannelAccessScope(msg.chatType) === "dm") {
+        await adapter.sendDirectReply(msg.chatId, buildChannelAccessDeniedMessage(msg.channel));
+      } else {
+        console.log(`[channels] Dropped ${msg.channel} group message from unauthorized sender ${msg.senderId} in chat ${msg.chatId}`);
+      }
+      return;
+    }
     if (await deps.controls.tryHandleInbound(adapter, msg)) {
       return;
     }
-    const config3 = getChannelAccount(msg.channel, accountId);
     if (deps.commands.shouldDropUnroutedSlackThreadInput(msg, accountId, config3)) {
       return;
     }
@@ -178822,7 +179067,12 @@ function createChannelInboundRouter(deps) {
         reload: async (_command, commandMsg) => deps.commands.handleReloadSlashCommand(commandMsg),
         resume: async () => deps.commands.handlePauseResumeSlashCommand("resume", msg)
       },
-      enableBangCommands: msg.channel === "slack" && msg.isMention === true
+      enableBangCommands: msg.channel === "slack" && msg.isMention === true,
+      commandGate: config3 ? senderAccess === "pair" ? floorOnlyChannelCommandGate() : resolveChannelCommandGate({
+        account: config3,
+        channelId: msg.channel,
+        senderId: msg.senderId
+      }) : undefined
     })) {
       return;
     }
@@ -178937,32 +179187,19 @@ function createChannelInboundRouter(deps) {
       });
       return;
     }
-    if (config3.dmPolicy === "allowlist") {
-      if (!config3.allowedUsers.includes(msg.senderId)) {
-        if (msg.reaction) {
-          return;
-        }
-        await adapter.sendDirectReply(msg.chatId, "You are not on the allowed users list for this bot.");
-        return;
-      }
-    } else if (config3.dmPolicy === "pairing") {
-      if (!isUserApproved(msg.channel, msg.senderId, accountId)) {
-        loadPairingStore(msg.channel);
-      }
-      if (!isUserApproved(msg.channel, msg.senderId, accountId)) {
-        if (msg.reaction) {
-          return;
-        }
-        const code2 = createPairingCode(msg.channel, msg.senderId, msg.chatId, msg.senderName, accountId);
-        deps.emitEvent({
-          type: "pairings_updated",
-          channelId: msg.channel
-        });
-        await adapter.sendDirectReply(msg.chatId, buildPairingInstructions(msg.channel, code2, {
-          agentId: getConfiguredAgentId(config3)
-        }));
+    if (senderAccess === "pair") {
+      if (msg.reaction) {
         return;
       }
+      const code2 = createPairingCode(msg.channel, msg.senderId, msg.chatId, msg.senderName, accountId);
+      deps.emitEvent({
+        type: "pairings_updated",
+        channelId: msg.channel
+      });
+      await adapter.sendDirectReply(msg.chatId, buildPairingInstructions(msg.channel, code2, {
+        agentId: getConfiguredAgentId(config3)
+      }));
+      return;
     }
     let route = getRoute(msg.channel, msg.chatId, accountId, msg.threadId);
     if (!route) {
@@ -178984,6 +179221,7 @@ function createChannelInboundRouter(deps) {
   return { handleInboundMessage };
 }
 var init_registry_inbound = __esm(() => {
+  init_access_control();
   init_accounts();
   init_commands();
   init_pairing();
@@ -179040,12 +179278,6 @@ function createChannelRouteProvisioner(deps) {
       await adapter.sendDirectReply(msg.chatId, buildSlackAppSetupInstructions(), buildDirectReplyOptions(msg));
       return null;
     }
-    if (msg.chatType === "direct") {
-      if (config3.dmPolicy === "allowlist" && !config3.allowedUsers.includes(msg.senderId)) {
-        await adapter.sendDirectReply(msg.chatId, "You are not on the allowed users list for this Slack app.", buildDirectReplyOptions(msg));
-        return null;
-      }
-    }
     const accountId = msg.accountId ?? LEGACY_CHANNEL_ACCOUNT_ID;
     const routeThreadId = msg.channel === "slack" ? msg.threadId ?? null : null;
     let route = getRoute(msg.channel, msg.chatId, accountId, routeThreadId);
@@ -179194,10 +179426,6 @@ function createChannelRouteProvisioner(deps) {
       }
       return null;
     }
-    if (msg.chatType === "direct" && config3.dmPolicy === "allowlist" && !config3.allowedUsers.includes(msg.senderId)) {
-      await adapter.sendDirectReply(msg.chatId, "You are not on the allowed users list for this Discord bot.");
-      return null;
-    }
     const accountId = msg.accountId ?? LEGACY_CHANNEL_ACCOUNT_ID;
     const routeThreadId = msg.threadId ?? null;
     let route = getRoute(msg.channel, msg.chatId, accountId, routeThreadId);
@@ -179245,10 +179473,6 @@ function createChannelRouteProvisioner(deps) {
       }
       return null;
     }
-    if (msg.chatType === "direct" && config3.dmPolicy === "allowlist" && !allowedUsersIncludes(config3.allowedUsers, msg.senderId)) {
-      await adapter.sendDirectReply(msg.chatId, "You are not on the allowed users list for this WhatsApp account.");
-      return null;
-    }
     const accountId = msg.accountId ?? LEGACY_CHANNEL_ACCOUNT_ID;
     let route = getRoute(msg.channel, msg.chatId, accountId, null);
     if (!route) {
@@ -179310,12 +179534,6 @@ function createChannelRouteProvisioner(deps) {
       }
       return null;
     }
-    if (msg.chatType === "direct" && config3.dmPolicy === "allowlist" && !signalAllowedUsersIncludes(config3.allowedUsers, msg.senderId)) {
-      if (!msg.reaction) {
-        await adapter.sendDirectReply(msg.chatId, "You are not on the allowed users list for this Signal account.");
-      }
-      return null;
-    }
     const accountId = msg.accountId ?? LEGACY_CHANNEL_ACCOUNT_ID;
     let route = getRoute(msg.channel, msg.chatId, accountId, null);
     if (!route) {
@@ -179363,7 +179581,6 @@ var init_registry_routes = __esm(() => {
   init_accounts();
   init_registry_presentation();
   init_routing();
-  init_target2();
   init_targets();
 });
 
@@ -448250,6 +448467,100 @@ var init_cron = __esm(async () => {
   await init_scheduler();
 });
 
+// src/backend/api/environments.ts
+var exports_environments2 = {};
+__export(exports_environments2, {
+  sendEnvironmentMessage: () => sendEnvironmentMessage,
+  resolveEnvironmentConnectionId: () => resolveEnvironmentConnectionId,
+  resolveAgentSandboxConnectionId: () => resolveAgentSandboxConnectionId,
+  listEnvironments: () => listEnvironments,
+  isEnvironmentOnline: () => isEnvironmentOnline,
+  getEnvironmentConnection: () => getEnvironmentConnection,
+  describeEnvironment: () => describeEnvironment,
+  createAgentSandbox: () => createAgentSandbox
+});
+async function listEnvironments(options3 = {}) {
+  return apiRequest("GET", "/v1/environments", undefined, {
+    query: {
+      limit: options3.limit,
+      after: options3.after,
+      onlineOnly: options3.onlineOnly
+    }
+  });
+}
+async function sendEnvironmentMessage(connectionId, body3) {
+  return apiRequest("POST", `/v1/environments/${encodeURIComponent(connectionId)}/messages`, body3);
+}
+async function getEnvironmentConnection(deviceId) {
+  return apiRequest("GET", `/v1/environments/${encodeURIComponent(deviceId)}`);
+}
+async function createAgentSandbox(agentId) {
+  return apiRequest("POST", `/v1/agents/${encodeURIComponent(agentId)}/sandboxes`, {});
+}
+function isEnvironmentOnline(environment2) {
+  return typeof environment2.connectionId === "string" && environment2.connectionId.length > 0 && typeof environment2.lastHeartbeat === "number" && Date.now() - environment2.lastHeartbeat < 120000;
+}
+function describeEnvironment(environment2) {
+  const status = isEnvironmentOnline(environment2) ? "online" : "offline";
+  return `${environment2.connectionName} (${environment2.deviceId}, ${status})`;
+}
+async function resolveEnvironmentConnectionId(selector) {
+  const trimmed = selector.trim();
+  if (!trimmed) {
+    throw new Error("Environment selector must not be empty");
+  }
+  const response = await listEnvironments({ limit: 100 });
+  const matches2 = response.connections.filter((environment3) => {
+    return environment3.connectionId === trimmed || environment3.id === trimmed || environment3.deviceId === trimmed || environment3.connectionName === trimmed;
+  });
+  if (matches2.length === 0) {
+    throw new Error(`Environment "${trimmed}" not found. Run \`letta environments list\` to discover available environments.`);
+  }
+  const onlineMatches = matches2.filter(isEnvironmentOnline);
+  if (onlineMatches.length === 0) {
+    throw new Error(`Environment "${trimmed}" is offline. Matched: ${matches2.map(describeEnvironment).join(", ")}`);
+  }
+  if (onlineMatches.length > 1) {
+    throw new Error(`Environment "${trimmed}" is ambiguous. Matched: ${onlineMatches.map(describeEnvironment).join(", ")}`);
+  }
+  const environment2 = onlineMatches[0];
+  if (!environment2) {
+    throw new Error(`Environment "${trimmed}" is offline`);
+  }
+  if (!environment2.connectionId) {
+    throw new Error(`Environment "${trimmed}" has no active connection id`);
+  }
+  return { connectionId: environment2.connectionId, environment: environment2 };
+}
+async function resolveAgentSandboxConnectionId(agentId, options3 = {}) {
+  const timeoutMs = options3.timeoutMs ?? 3 * 60000;
+  const pollIntervalMs = options3.pollIntervalMs ?? 2000;
+  const sandbox = await createAgentSandbox(agentId);
+  const deviceId = sandbox.deviceId || `sandbox-${agentId}`;
+  const deadline = Date.now() + timeoutMs;
+  let lastEnvironment = null;
+  let lastError = null;
+  while (Date.now() < deadline) {
+    try {
+      const environment2 = await getEnvironmentConnection(deviceId);
+      lastEnvironment = environment2;
+      if (isEnvironmentOnline(environment2) && environment2.connectionId) {
+        return { connectionId: environment2.connectionId, environment: environment2 };
+      }
+    } catch (error54) {
+      lastError = error54;
+    }
+    await new Promise((resolve30) => setTimeout(resolve30, pollIntervalMs));
+  }
+  if (lastEnvironment) {
+    throw new Error(`Timed out waiting for cloud sandbox ${sandbox.connectionName} to come online. Last status: ${describeEnvironment(lastEnvironment)}`);
+  }
+  throw new Error(`Timed out waiting for cloud sandbox ${sandbox.connectionName} to register${lastError instanceof Error ? `: ${lastError.message}` : ""}`);
+}
+var init_environments2 = __esm(() => {
+  init_request();
+});
+
 // src/backend/api/search.ts
 async function warmSearchCache(body3) {
   return apiRequest("POST", "/v1/_internal_search/cache-warm", body3);
@@ -450607,89 +450918,6 @@ var init_reflection_launcher = __esm(() => {
   pendingReflectionLaunches = new Map;
 });
 
-// src/backend/api/environments.ts
-async function listEnvironments(options3 = {}) {
-  return apiRequest("GET", "/v1/environments", undefined, {
-    query: {
-      limit: options3.limit,
-      after: options3.after,
-      onlineOnly: options3.onlineOnly
-    }
-  });
-}
-async function sendEnvironmentMessage(connectionId, body3) {
-  return apiRequest("POST", `/v1/environments/${encodeURIComponent(connectionId)}/messages`, body3);
-}
-async function getEnvironmentConnection(deviceId) {
-  return apiRequest("GET", `/v1/environments/${encodeURIComponent(deviceId)}`);
-}
-async function createAgentSandbox(agentId) {
-  return apiRequest("POST", `/v1/agents/${encodeURIComponent(agentId)}/sandboxes`, {});
-}
-function isEnvironmentOnline(environment2) {
-  return typeof environment2.connectionId === "string" && environment2.connectionId.length > 0 && typeof environment2.lastHeartbeat === "number" && Date.now() - environment2.lastHeartbeat < 120000;
-}
-function describeEnvironment(environment2) {
-  const status = isEnvironmentOnline(environment2) ? "online" : "offline";
-  return `${environment2.connectionName} (${environment2.deviceId}, ${status})`;
-}
-async function resolveEnvironmentConnectionId(selector) {
-  const trimmed = selector.trim();
-  if (!trimmed) {
-    throw new Error("Environment selector must not be empty");
-  }
-  const response = await listEnvironments({ limit: 100 });
-  const matches2 = response.connections.filter((environment3) => {
-    return environment3.connectionId === trimmed || environment3.id === trimmed || environment3.deviceId === trimmed || environment3.connectionName === trimmed;
-  });
-  if (matches2.length === 0) {
-    throw new Error(`Environment "${trimmed}" not found. Run \`letta environments list\` to discover available environments.`);
-  }
-  const onlineMatches = matches2.filter(isEnvironmentOnline);
-  if (onlineMatches.length === 0) {
-    throw new Error(`Environment "${trimmed}" is offline. Matched: ${matches2.map(describeEnvironment).join(", ")}`);
-  }
-  if (onlineMatches.length > 1) {
-    throw new Error(`Environment "${trimmed}" is ambiguous. Matched: ${onlineMatches.map(describeEnvironment).join(", ")}`);
-  }
-  const environment2 = onlineMatches[0];
-  if (!environment2) {
-    throw new Error(`Environment "${trimmed}" is offline`);
-  }
-  if (!environment2.connectionId) {
-    throw new Error(`Environment "${trimmed}" has no active connection id`);
-  }
-  return { connectionId: environment2.connectionId, environment: environment2 };
-}
-async function resolveAgentSandboxConnectionId(agentId, options3 = {}) {
-  const timeoutMs = options3.timeoutMs ?? 3 * 60000;
-  const pollIntervalMs = options3.pollIntervalMs ?? 2000;
-  const sandbox = await createAgentSandbox(agentId);
-  const deviceId = sandbox.deviceId || `sandbox-${agentId}`;
-  const deadline = Date.now() + timeoutMs;
-  let lastEnvironment = null;
-  let lastError = null;
-  while (Date.now() < deadline) {
-    try {
-      const environment2 = await getEnvironmentConnection(deviceId);
-      lastEnvironment = environment2;
-      if (isEnvironmentOnline(environment2) && environment2.connectionId) {
-        return { connectionId: environment2.connectionId, environment: environment2 };
-      }
-    } catch (error54) {
-      lastError = error54;
-    }
-    await new Promise((resolve31) => setTimeout(resolve31, pollIntervalMs));
-  }
-  if (lastEnvironment) {
-    throw new Error(`Timed out waiting for cloud sandbox ${sandbox.connectionName} to come online. Last status: ${describeEnvironment(lastEnvironment)}`);
-  }
-  throw new Error(`Timed out waiting for cloud sandbox ${sandbox.connectionName} to register${lastError instanceof Error ? `: ${lastError.message}` : ""}`);
-}
-var init_environments2 = __esm(() => {
-  init_request();
-});
-
 // node_modules/cli-spinners/spinners.json
 var require_spinners = __commonJS((exports, module3) => {
   module3.exports = {
@@ -473975,13 +474203,13 @@ function AgentSelector({
   });
   const renderAgentItem = (agent2, _index, isSelected, extra) => {
     const isCurrent = agent2.id === currentAgentId;
-    const isLocalAgent = isLocalAgentId(agent2.id);
+    const isLocalAgent2 = isLocalAgentId(agent2.id);
     const relativeTime = formatRelativeTime3(agent2.last_run_completion);
     const blockCount = agent2.blocks?.length ?? 0;
     const modelStr = formatModel2(agent2);
     const metadataParts = [
       relativeTime,
-      ...isLocalAgent ? [] : [`${blockCount} memory block${blockCount === 1 ? "" : "s"}`],
+      ...isLocalAgent2 ? [] : [`${blockCount} memory block${blockCount === 1 ? "" : "s"}`],
       modelStr
     ];
     const nameLen = (agent2.name || "Unnamed").length;
@@ -481959,7 +482187,7 @@ var init_reflection_arena_hf_upload = __esm(() => {
 
 // src/cli/helpers/reflection-arena.ts
 import { execFile as execFileCb6 } from "node:child_process";
-import { randomInt, randomUUID as randomUUID32 } from "node:crypto";
+import { randomInt as randomInt2, randomUUID as randomUUID32 } from "node:crypto";
 import { appendFile as appendFile3, mkdir as mkdir18, readFile as readFile26, writeFile as writeFile20 } from "node:fs/promises";
 import { homedir as homedir39 } from "node:os";
 import { join as join71 } from "node:path";
@@ -481970,7 +482198,7 @@ function sampleReflectionArenaComparisonModel(excludedModels = []) {
   const totalWeight = candidates2.reduce((sum, entry) => sum + Math.max(0, entry.weight), 0);
   if (totalWeight <= 0)
     return "letta/auto";
-  let offset = randomInt(totalWeight);
+  let offset = randomInt2(totalWeight);
   for (const candidate of candidates2) {
     offset -= Math.max(0, candidate.weight);
     if (offset < 0)
@@ -482035,7 +482263,7 @@ async function updateReflectionArenaRun(runId, update2) {
   return updated;
 }
 function shuffledLabels() {
-  return randomInt(2) === 0 ? ["1", "2"] : ["2", "1"];
+  return randomInt2(2) === 0 ? ["1", "2"] : ["2", "1"];
 }
 function truncateReport(report) {
   if (!report?.trim())
@@ -492774,8 +493002,8 @@ var init_AgentInfoBar = __esm(async () => {
       return settingsManager.isAgentPinned(agentId);
     }, [agentId]);
     const isCloudUser = serverUrl?.includes("api.letta.com");
-    const isLocalAgent = agentId ? isLocalAgentId2(agentId) : false;
-    const showCloudLinks = Boolean(isCloudUser && agentId && !isLocalAgent);
+    const isLocalAgent2 = agentId ? isLocalAgentId2(agentId) : false;
+    const showCloudLinks = Boolean(isCloudUser && agentId && !isLocalAgent2);
     const adeConversationUrl = showCloudLinks && agentId && agentId !== "loading" ? buildChatUrl(agentId, { conversationId }) : "";
     const usageUrl = buildChatWebUrl("/preferences/usage");
     const showBottomBar = agentId && agentId !== "loading";
@@ -501159,8 +501387,8 @@ function MemfsTreeViewer({
   const terminalWidth = useTerminalWidth();
   const solidLine = SOLID_LINE15.repeat(Math.max(terminalWidth, 10));
   const isTmux = Boolean(process.env.TMUX);
-  const isLocalAgent = isLocalAgentId2(agentId);
-  const adeUrl = isLocalAgent ? null : buildChatUrl(agentId, { view: "memory", conversationId });
+  const isLocalAgent2 = isLocalAgentId2(agentId);
+  const adeUrl = isLocalAgent2 ? null : buildChatUrl(agentId, { view: "memory", conversationId });
   const [selectedIndex, setSelectedIndex] = import_react90.useState(0);
   const [treeScrollOffset, setTreeScrollOffset] = import_react90.useState(0);
   const [viewMode, setViewMode] = import_react90.useState("split");
@@ -501651,8 +501879,8 @@ function MemoryTabViewer({
   const terminalWidth = useTerminalWidth();
   const solidLine = SOLID_LINE16.repeat(Math.max(terminalWidth, 10));
   const isTmux = Boolean(process.env.TMUX);
-  const isLocalAgent = isLocalAgentId2(agentId);
-  const adeUrl = isLocalAgent ? null : buildChatUrl(agentId, { view: "memory", conversationId });
+  const isLocalAgent2 = isLocalAgentId2(agentId);
+  const adeUrl = isLocalAgent2 ? null : buildChatUrl(agentId, { view: "memory", conversationId });
   const [selectedTabIndex, setSelectedTabIndex] = import_react91.useState(0);
   const [scrollOffset, setScrollOffset] = import_react91.useState(0);
   const [freshBlocks, setFreshBlocks] = import_react91.useState(null);
@@ -548433,8 +548661,142 @@ Provider '${providerName}' saved.`);
 }
 
 // src/cli/subcommands/cron.ts
-await init_cron();
+init_request();
 import { parseArgs as parseArgs5 } from "node:util";
+
+// src/backend/api/schedules.ts
+init_request();
+function schedulePath(agentId) {
+  return `/v1/agents/${encodeURIComponent(agentId)}/schedule`;
+}
+async function createCloudSchedule(agentId, input) {
+  return apiRequest("POST", schedulePath(agentId), {
+    ...input,
+    use_sandbox: true
+  });
+}
+async function listCloudSchedules(agentId, options3 = {}) {
+  return apiRequest("GET", schedulePath(agentId), undefined, {
+    query: {
+      limit: options3.limit ?? 100,
+      after: options3.after
+    }
+  });
+}
+async function getCloudSchedule(agentId, scheduleId) {
+  return apiRequest("GET", `${schedulePath(agentId)}/${encodeURIComponent(scheduleId)}`);
+}
+async function deleteCloudSchedule(agentId, scheduleId) {
+  await apiRequest("DELETE", `${schedulePath(agentId)}/${encodeURIComponent(scheduleId)}`, {});
+}
+async function listCloudScheduleHistory(agentId, scheduleId, options3 = {}) {
+  return apiRequest("GET", `${schedulePath(agentId)}/${encodeURIComponent(scheduleId)}/history`, undefined, {
+    query: {
+      limit: options3.limit,
+      offset: options3.offset
+    }
+  });
+}
+
+// src/cli/subcommands/cron.ts
+init_backend_mode();
+await init_cron();
+
+// src/cli/subcommands/cron-runner.ts
+var CLOUD_EXECUTION_TARGET = "cloud-sandbox";
+function isLocalAgent(agentId) {
+  return agentId.startsWith("agent-local-");
+}
+function resolveCronRunner(params) {
+  const { explicit, agentId, backendMode, cloudSchedulesSupported } = params;
+  if (explicit !== undefined && explicit !== "local" && explicit !== "cloud") {
+    return {
+      error: `invalid --runner "${explicit}". Expected "local" or "cloud".`
+    };
+  }
+  if (explicit === "local") {
+    return { runner: "local", reason: "explicit --runner local" };
+  }
+  if (backendMode === "local" || isLocalAgent(agentId)) {
+    if (explicit === "cloud") {
+      return {
+        error: "Cloud schedules are not available for local-backend agents. Use --runner local."
+      };
+    }
+    return { runner: "local", reason: "local-backend agent" };
+  }
+  if (cloudSchedulesSupported === false) {
+    if (explicit === "cloud") {
+      return {
+        error: "This Letta server does not serve Cloud schedule routes (self-hosted?). Use --runner local."
+      };
+    }
+    return {
+      runner: "local",
+      reason: "server does not support Cloud schedules"
+    };
+  }
+  return {
+    runner: "cloud",
+    reason: explicit === "cloud" ? "explicit --runner cloud" : "cloud agent defaults to durable Cloud schedules"
+  };
+}
+var SYNTHETIC_CLOUD_DEVICE_ID = "__letta_cloud__";
+var SYNTHETIC_LOCAL_PLACEHOLDER_ID = "local";
+function validateTargetDevice(deviceId, environment2) {
+  if (deviceId === SYNTHETIC_CLOUD_DEVICE_ID) {
+    return {
+      ok: false,
+      error: `"Cloud" is the default execution target, not a computer. Omit --computer to run in the agent's cloud sandbox.`
+    };
+  }
+  if (deviceId === SYNTHETIC_LOCAL_PLACEHOLDER_ID) {
+    return {
+      ok: false,
+      error: '"local" is a placeholder entry, not a connected computer. Run `letta server` on the machine you want to target, then use its deviceId.'
+    };
+  }
+  if (environment2?.organizationId === "local") {
+    return {
+      ok: false,
+      error: `Device ${deviceId} is this computer's local desktop connection, not a computer connected to your Letta account. Cloud schedules can only target connected computers — run \`letta server\` on that machine (or enable remote access in the desktop app) to connect it.`
+    };
+  }
+  return { ok: true };
+}
+var CLOUD_CRON_UTC_NOTE = "Recurring Cloud schedules currently interpret cron expressions in UTC (timezone support is tracked in LET-9815).";
+var CLOUD_DEVICE_FALLBACK_NOTE = "If the target computer is offline when the schedule fires, execution falls back to the agent's cloud sandbox.";
+function buildCloudScheduleInput(params) {
+  const notes = [];
+  let schedule;
+  if (params.recurring) {
+    schedule = { type: "recurring", cron_expression: params.cron };
+    notes.push(CLOUD_CRON_UTC_NOTE);
+  } else {
+    const scheduledAt = params.scheduledFor?.getTime();
+    if (!scheduledAt || Number.isNaN(scheduledAt)) {
+      throw new Error("One-shot Cloud schedules require a resolved --at time.");
+    }
+    schedule = { type: "one-time", scheduled_at: scheduledAt };
+  }
+  const targetDeviceId = params.targetDeviceId?.trim();
+  if (targetDeviceId) {
+    notes.push(CLOUD_DEVICE_FALLBACK_NOTE);
+  }
+  return {
+    input: {
+      name: params.name,
+      description: params.description,
+      ...params.conversationId && { conversation_id: params.conversationId },
+      messages: [{ role: "user", content: params.prompt }],
+      schedule,
+      ...targetDeviceId && { target_device_id: targetDeviceId }
+    },
+    notes
+  };
+}
+
+// src/cli/subcommands/cron.ts
 function printUsage4() {
   console.log(`
 Usage:
@@ -548442,10 +548804,10 @@ Usage:
   letta cron add --prompt <text> --at <time> [--once] [options]
   letta cron add --prompt <text> --cron <expr> [options]
   letta cron list [options]
-  letta cron get <id>
-  letta cron runs --id <id> [--limit <n>]
-  letta cron delete <id>
-  letta cron delete --all [--agent <id>]
+  letta cron get <id> [--runner local|cloud]
+  letta cron runs --id <id> [--limit <n>] [--runner local|cloud]
+  letta cron delete <id> [--runner local|cloud]
+  letta cron delete --all [--agent <id>] [--runner local|cloud]
 
 Add options:
   --prompt <text>        Prompt to send to the agent (required)
@@ -548455,10 +548817,23 @@ Add options:
   --cron <expr>          Raw 5-field cron expression
   --agent <id>           Agent ID (defaults to LETTA_AGENT_ID)
   --conversation <id>    Conversation ID (defaults to LETTA_CONVERSATION_ID or "default")
+  --runner <runner>      Where the schedule lives and fires:
+                           cloud - durable Cloud schedule; executes in the
+                                   agent's managed cloud sandbox (default for
+                                   cloud agents)
+                           local - this device's scheduler (~/.letta/crons.json);
+                                   only fires while a session runs here (default
+                                   for local-backend agents / self-hosted)
+  --computer <id>        (cloud runner only) Execute on one of your
+                         connected computers (deviceId from
+                         \`letta environments list\`) instead of the agent's
+                         cloud sandbox. Falls back to the sandbox if the
+                         computer is offline at fire time.
 
 List/filter options:
   --agent <id>           Filter by agent ID
   --conversation <id>    Filter by conversation ID
+  --runner <runner>      Only show tasks owned by this runner
 
 Delete options:
   --all                  Delete all tasks for the given agent
@@ -548480,7 +548855,9 @@ var CRON_OPTIONS = {
   all: { type: "boolean" },
   id: { type: "string" },
   limit: { type: "string" },
-  "run-id": { type: "string" }
+  "run-id": { type: "string" },
+  runner: { type: "string" },
+  computer: { type: "string" }
 };
 function parseCronArgs(argv) {
   return parseArgs5({
@@ -548496,7 +548873,75 @@ function getAgentId3(fromArgs) {
 function getConversationId3(fromArgs) {
   return fromArgs || process.env.LETTA_CONVERSATION_ID || "default";
 }
-function handleAdd(values2) {
+async function probeCloudScheduleSupport(agentId) {
+  try {
+    await listCloudSchedules(agentId, { limit: 1 });
+    return true;
+  } catch (err) {
+    if (err instanceof ApiRequestError && (err.status === 404 || err.status === 405)) {
+      return false;
+    }
+    return true;
+  }
+}
+async function ensureSettingsForCloud() {
+  const { settingsManager: settingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), exports_settings_manager));
+  await settingsManager2.initialize();
+}
+async function getRunnerForAgent(explicit, agentId) {
+  const backendMode = resolveBackendMode();
+  const preliminary = resolveCronRunner({ explicit, agentId, backendMode });
+  if ("error" in preliminary || preliminary.runner === "local") {
+    return preliminary;
+  }
+  await ensureSettingsForCloud();
+  const cloudSchedulesSupported = await probeCloudScheduleSupport(agentId);
+  return resolveCronRunner({
+    explicit,
+    agentId,
+    backendMode,
+    cloudSchedulesSupported
+  });
+}
+function isRunnerFlagValid(value) {
+  return value === undefined || value === "local" || value === "cloud";
+}
+async function lookupEnvironmentForTarget(deviceId) {
+  try {
+    const { getEnvironmentConnection: getEnvironmentConnection2 } = await Promise.resolve().then(() => (init_environments2(), exports_environments2));
+    return await getEnvironmentConnection2(deviceId);
+  } catch {
+    return null;
+  }
+}
+function extractPromptFromCloudSchedule(schedule) {
+  const messages = schedule.message?.messages;
+  if (!Array.isArray(messages))
+    return null;
+  const first = messages[0];
+  if (!first || typeof first.content !== "string")
+    return null;
+  return first.content;
+}
+function formatCloudScheduleOutput(schedule) {
+  const targetDeviceId = schedule.target_device_id ?? null;
+  return {
+    id: schedule.id,
+    runner: "cloud",
+    execution_target: targetDeviceId ?? CLOUD_EXECUTION_TARGET,
+    ...targetDeviceId && { target_device_id: targetDeviceId },
+    agent_id: schedule.agent_id,
+    conversation_id: schedule.conversation_id ?? "default",
+    name: schedule.name ?? null,
+    description: schedule.description ?? null,
+    prompt: extractPromptFromCloudSchedule(schedule),
+    schedule: schedule.schedule,
+    recurring: schedule.schedule.type === "recurring",
+    next_scheduled_time: schedule.next_scheduled_time,
+    created_at: schedule.created_at ?? null
+  };
+}
+async function handleAdd(values2) {
   const name = values2.name;
   if (!name || typeof name !== "string") {
     console.error("Error: --name is required.");
@@ -548568,6 +549013,37 @@ function handleAdd(values2) {
     console.error("Error: no schedule specified.");
     return 1;
   }
+  const targetDeviceId = values2.computer?.trim() || undefined;
+  const resolved = await getRunnerForAgent(values2.runner, agentId);
+  if ("error" in resolved) {
+    console.error(`Error: ${resolved.error}`);
+    return 1;
+  }
+  if (targetDeviceId && resolved.runner !== "cloud") {
+    console.error("Error: --computer requires the cloud runner. Run `letta cron add` on the target computer itself (with --runner local) to schedule there locally.");
+    return 1;
+  }
+  if (targetDeviceId) {
+    const validity = validateTargetDevice(targetDeviceId, await lookupEnvironmentForTarget(targetDeviceId));
+    if (!validity.ok) {
+      console.error(`Error: ${validity.error}`);
+      return 1;
+    }
+  }
+  if (resolved.runner === "cloud") {
+    return handleCloudAdd({
+      agentId,
+      conversationId,
+      name,
+      description,
+      prompt,
+      cron,
+      recurring,
+      scheduledFor,
+      note,
+      targetDeviceId
+    });
+  }
   try {
     const result = addTask({
       agent_id: agentId,
@@ -548581,6 +549057,7 @@ function handleAdd(values2) {
     });
     const output = {
       id: result.task.id,
+      runner: "local",
       status: result.task.status,
       cron: result.task.cron,
       recurring: result.task.recurring,
@@ -548601,37 +549078,152 @@ function handleAdd(values2) {
       output.warning = result.warning;
     }
     console.log(JSON.stringify(output, null, 2));
+    console.error("Created local schedule: it only fires while a Letta session is running on this device.");
     return 0;
   } catch (err) {
     console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
     return 1;
   }
 }
-function handleList(values2) {
+async function handleCloudAdd(params) {
+  let built;
+  try {
+    built = buildCloudScheduleInput({
+      name: params.name,
+      description: params.description,
+      prompt: params.prompt,
+      conversationId: params.conversationId,
+      cron: params.cron,
+      recurring: params.recurring,
+      scheduledFor: params.scheduledFor,
+      targetDeviceId: params.targetDeviceId
+    });
+  } catch (err) {
+    console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+    return 1;
+  }
+  try {
+    const result = await createCloudSchedule(params.agentId, built.input);
+    const targetDeviceId = result.target_device_id ?? built.input.target_device_id ?? null;
+    const output = {
+      id: result.id,
+      runner: "cloud",
+      execution_target: targetDeviceId ?? CLOUD_EXECUTION_TARGET,
+      ...targetDeviceId && { target_device_id: targetDeviceId },
+      agent_id: params.agentId,
+      conversation_id: params.conversationId,
+      recurring: params.recurring,
+      schedule: built.input.schedule,
+      ...result.next_scheduled_at && {
+        next_scheduled_at: result.next_scheduled_at
+      }
+    };
+    const notes = [...built.notes];
+    if (params.note)
+      notes.unshift(params.note);
+    if (notes.length > 0) {
+      output.notes = notes;
+    }
+    console.log(JSON.stringify(output, null, 2));
+    console.error(targetDeviceId ? `Created Cloud schedule: it fires from the cloud and runs on computer "${targetDeviceId}" (sandbox fallback if offline).` : "Created Cloud schedule: it fires from the cloud and runs in this agent's managed cloud sandbox (survives local shutdown).");
+    return 0;
+  } catch (err) {
+    console.error(`Error: failed to create Cloud schedule: ${err instanceof Error ? err.message : String(err)}`);
+    console.error("No schedule was created. Retry, or pass --runner local to schedule on this device instead.");
+    return 1;
+  }
+}
+async function handleList(values2) {
+  if (!isRunnerFlagValid(values2.runner)) {
+    console.error(`Error: invalid --runner "${values2.runner}". Expected "local" or "cloud".`);
+    return 1;
+  }
   const agentId = values2.agent || process.env.LETTA_AGENT_ID || undefined;
   const conversationId = values2.conversation || undefined;
-  const tasks2 = listTasks2({
-    agent_id: agentId,
-    conversation_id: conversationId
-  });
-  console.log(JSON.stringify(tasks2, null, 2));
+  const includeLocal = values2.runner !== "cloud";
+  const includeCloud = values2.runner !== "local";
+  const output = [];
+  if (includeLocal) {
+    const tasks2 = listTasks2({
+      agent_id: agentId,
+      conversation_id: conversationId
+    });
+    for (const task2 of tasks2) {
+      output.push({ ...task2, runner: "local" });
+    }
+  }
+  if (includeCloud && agentId) {
+    const resolved = await getRunnerForAgent(undefined, agentId);
+    const cloudCapable = !("error" in resolved) && resolved.runner === "cloud";
+    const cloudExplicit = values2.runner === "cloud";
+    if (cloudCapable || cloudExplicit) {
+      try {
+        const response = await listCloudSchedules(agentId);
+        for (const schedule of response.scheduled_messages) {
+          if (conversationId && (schedule.conversation_id ?? "default") !== conversationId) {
+            continue;
+          }
+          output.push(formatCloudScheduleOutput(schedule));
+        }
+      } catch (err) {
+        console.error(`Warning: failed to list Cloud schedules: ${err instanceof Error ? err.message : String(err)}`);
+        if (cloudExplicit) {
+          return 1;
+        }
+      }
+    }
+  } else if (includeCloud && values2.runner === "cloud" && !agentId) {
+    console.error("Error: --agent or LETTA_AGENT_ID required to list Cloud schedules.");
+    return 1;
+  }
+  console.log(JSON.stringify(output, null, 2));
   return 0;
 }
-function handleGet(positionals) {
+async function handleGet(values2, positionals) {
+  if (!isRunnerFlagValid(values2.runner)) {
+    console.error(`Error: invalid --runner "${values2.runner}". Expected "local" or "cloud".`);
+    return 1;
+  }
   const taskId = positionals[1];
   if (!taskId) {
     console.error("Error: task ID required. Usage: letta cron get <id>");
     return 1;
   }
-  const task2 = getTask2(taskId);
-  if (!task2) {
-    console.error(`Error: task ${taskId} not found.`);
+  if (values2.runner !== "cloud") {
+    const task2 = getTask2(taskId);
+    if (task2) {
+      console.log(JSON.stringify({ ...task2, runner: "local" }, null, 2));
+      return 0;
+    }
+    if (values2.runner === "local") {
+      console.error(`Error: task ${taskId} not found.`);
+      return 1;
+    }
+  }
+  const agentId = getAgentId3(values2.agent);
+  if (!agentId) {
+    console.error(`Error: task ${taskId} not found locally, and --agent or LETTA_AGENT_ID is required to look up Cloud schedules.`);
+    return 1;
+  }
+  try {
+    await ensureSettingsForCloud();
+    const schedule = await getCloudSchedule(agentId, taskId);
+    console.log(JSON.stringify(formatCloudScheduleOutput(schedule), null, 2));
+    return 0;
+  } catch (err) {
+    if (err instanceof ApiRequestError && err.status === 404) {
+      console.error(`Error: task ${taskId} not found.`);
+    } else {
+      console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+    }
     return 1;
   }
-  console.log(JSON.stringify(task2, null, 2));
-  return 0;
 }
-function handleRuns(values2) {
+async function handleRuns(values2) {
+  if (!isRunnerFlagValid(values2.runner)) {
+    console.error(`Error: invalid --runner "${values2.runner}". Expected "local" or "cloud".`);
+    return 1;
+  }
   const id2 = values2.id;
   if (!id2 || typeof id2 !== "string") {
     console.error("Error: --id is required. Usage: letta cron runs --id <id>");
@@ -548640,42 +549232,125 @@ function handleRuns(values2) {
   const limitRaw = Number.parseInt(String(values2.limit ?? "50"), 10);
   const limit3 = Number.isFinite(limitRaw) && limitRaw > 0 ? limitRaw : 50;
   const runId = values2["run-id"];
+  if (values2.runner !== "cloud" && getTask2(id2)) {
+    try {
+      const logPath = getCronRunLogPath(id2);
+      const page = readCronRunLogEntriesPage(logPath, {
+        jobId: id2,
+        limit: limit3,
+        ...typeof runId === "string" && runId.trim() ? { runId } : {}
+      });
+      console.log(JSON.stringify(page, null, 2));
+      return 0;
+    } catch (err) {
+      console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+      return 1;
+    }
+  }
+  if (values2.runner === "local") {
+    console.error(`Error: task ${id2} not found.`);
+    return 1;
+  }
+  const agentId = getAgentId3(values2.agent);
+  if (!agentId) {
+    console.error(`Error: task ${id2} not found locally, and --agent or LETTA_AGENT_ID is required to look up Cloud schedule runs.`);
+    return 1;
+  }
   try {
-    const logPath = getCronRunLogPath(id2);
-    const page = readCronRunLogEntriesPage(logPath, {
-      jobId: id2,
-      limit: limit3,
-      ...typeof runId === "string" && runId.trim() ? { runId } : {}
-    });
-    console.log(JSON.stringify(page, null, 2));
+    await ensureSettingsForCloud();
+    const response = await listCloudScheduleHistory(agentId, id2, { limit: limit3 });
+    console.log(JSON.stringify({
+      runner: "cloud",
+      entries: response.history,
+      has_next_page: response.has_next_page
+    }, null, 2));
     return 0;
   } catch (err) {
     console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
     return 1;
   }
 }
-function handleDelete(values2, positionals) {
+async function handleDelete(values2, positionals) {
+  if (!isRunnerFlagValid(values2.runner)) {
+    console.error(`Error: invalid --runner "${values2.runner}". Expected "local" or "cloud".`);
+    return 1;
+  }
   if (values2.all) {
-    const agentId = getAgentId3(values2.agent);
-    if (!agentId) {
-      console.error("Error: --agent or LETTA_AGENT_ID required with --all.");
-      return 1;
-    }
-    const count = deleteAllTasks(agentId);
-    console.log(JSON.stringify({ deleted: count, agent_id: agentId }));
-    return 0;
+    return handleDeleteAll(values2);
   }
   const taskId = positionals[1];
   if (!taskId) {
     console.error("Error: task ID required. Usage: letta cron delete <id> or --all --agent <id>");
     return 1;
   }
-  const found = deleteTask(taskId);
-  if (!found) {
-    console.error(`Error: task ${taskId} not found.`);
+  if (values2.runner !== "cloud") {
+    const found = deleteTask(taskId);
+    if (found) {
+      console.log(JSON.stringify({ deleted: taskId, runner: "local" }));
+      return 0;
+    }
+    if (values2.runner === "local") {
+      console.error(`Error: task ${taskId} not found.`);
+      return 1;
+    }
+  }
+  const agentId = getAgentId3(values2.agent);
+  if (!agentId) {
+    console.error(`Error: task ${taskId} not found locally, and --agent or LETTA_AGENT_ID is required to delete Cloud schedules.`);
+    return 1;
+  }
+  try {
+    await ensureSettingsForCloud();
+    await getCloudSchedule(agentId, taskId);
+    await deleteCloudSchedule(agentId, taskId);
+    console.log(JSON.stringify({ deleted: taskId, runner: "cloud" }));
+    return 0;
+  } catch (err) {
+    if (err instanceof ApiRequestError && err.status === 404) {
+      console.error(`Error: task ${taskId} not found.`);
+    } else {
+      console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return 1;
+  }
+}
+async function handleDeleteAll(values2) {
+  const agentId = getAgentId3(values2.agent);
+  if (!agentId) {
+    console.error("Error: --agent or LETTA_AGENT_ID required with --all.");
     return 1;
   }
-  console.log(JSON.stringify({ deleted: taskId }));
+  const includeLocal = values2.runner !== "cloud";
+  const includeCloud = values2.runner !== "local";
+  let localDeleted = 0;
+  if (includeLocal) {
+    localDeleted = deleteAllTasks(agentId);
+  }
+  let cloudDeleted = 0;
+  if (includeCloud) {
+    const resolved = await getRunnerForAgent(undefined, agentId);
+    const cloudCapable = !("error" in resolved) && resolved.runner === "cloud";
+    const cloudExplicit = values2.runner === "cloud";
+    if (cloudCapable || cloudExplicit) {
+      try {
+        const response = await listCloudSchedules(agentId);
+        for (const schedule of response.scheduled_messages) {
+          await deleteCloudSchedule(agentId, schedule.id);
+          cloudDeleted += 1;
+        }
+      } catch (err) {
+        console.error(`Error: failed to delete Cloud schedules: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`Deleted so far: ${localDeleted} local, ${cloudDeleted} cloud.`);
+        return 1;
+      }
+    }
+  }
+  console.log(JSON.stringify({
+    deleted: localDeleted + cloudDeleted,
+    local_deleted: localDeleted,
+    cloud_deleted: cloudDeleted,
+    agent_id: agentId
+  }));
   return 0;
 }
 async function runCronSubcommand(argv) {
@@ -548698,7 +549373,7 @@ async function runCronSubcommand(argv) {
     case "list":
       return handleList(parsed.values);
     case "get":
-      return handleGet(parsed.positionals);
+      return handleGet(parsed.values, parsed.positionals);
     case "runs":
       return handleRuns(parsed.values);
     case "delete":
@@ -557864,4 +558539,4 @@ Error during initialization: ${message}`);
 }
 main2();
 
-//# debugId=8849A89953C6484464756E2164756E21
+//# debugId=E8D52F75291B5E0B64756E2164756E21