@n1creator/openacp-cli 2026.712.9 → 2026.712.10

package/dist/index.js

@@ -458,22 +458,22 @@ __export(config_registry_exports, {
   resolveOptions: () => resolveOptions,
   setFieldValueAsync: () => setFieldValueAsync
 });
-function getFieldDef(path37) {
-  return CONFIG_REGISTRY.find((f) => f.path === path37);
+function getFieldDef(path38) {
+  return CONFIG_REGISTRY.find((f) => f.path === path38);
 }
 function getSafeFields() {
   return CONFIG_REGISTRY.filter((f) => f.scope === "safe");
 }
-function isHotReloadable(path37) {
-  const def = getFieldDef(path37);
+function isHotReloadable(path38) {
+  const def = getFieldDef(path38);
   return def?.hotReload ?? false;
 }
 function resolveOptions(def, config) {
   if (!def.options) return void 0;
   return typeof def.options === "function" ? def.options(config) : def.options;
 }
-function getConfigValue(config, path37) {
-  const parts = path37.split(".");
+function getConfigValue(config, path38) {
+  const parts = path38.split(".");
   let current = config;
   for (const part of parts) {
     if (current && typeof current === "object" && part in current) {
@@ -1546,7 +1546,7 @@ async function downloadAndExtract(agentId, archiveUrl, progress, agentsDir, scop
   const destDir = path10.join(agentsDir ?? DEFAULT_AGENTS_DIR, agentId);
   fs11.mkdirSync(destDir, { recursive: true });
   await progress?.onStep("Downloading...");
-  log11.info({ agentId, url: archiveUrl }, "Downloading agent binary");
+  log12.info({ agentId, url: archiveUrl }, "Downloading agent binary");
   const response = await scopedFetch(archiveUrl);
   if (!response.ok) {
     throw new Error(`Download failed: ${response.status} ${response.statusText}`);
@@ -1656,17 +1656,17 @@ async function uninstallAgent(agentKey, store, agentsDir) {
   if (agent.binaryPath && fs11.existsSync(agent.binaryPath)) {
     validateUninstallPath(agent.binaryPath, agentsDir ?? DEFAULT_AGENTS_DIR);
     fs11.rmSync(agent.binaryPath, { recursive: true, force: true });
-    log11.info({ agentKey, binaryPath: agent.binaryPath }, "Deleted agent binary");
+    log12.info({ agentKey, binaryPath: agent.binaryPath }, "Deleted agent binary");
   }
   store.removeAgent(agentKey);
 }
-var log11, DEFAULT_AGENTS_DIR, MAX_DOWNLOAD_SIZE, validateTarContents, ARCH_MAP, PLATFORM_MAP;
+var log12, DEFAULT_AGENTS_DIR, MAX_DOWNLOAD_SIZE, validateTarContents, ARCH_MAP, PLATFORM_MAP;
 var init_agent_installer = __esm({
   "src/core/agents/agent-installer.ts"() {
     "use strict";
     init_log();
     init_agent_dependencies();
-    log11 = createChildLogger({ module: "agent-installer" });
+    log12 = createChildLogger({ module: "agent-installer" });
     DEFAULT_AGENTS_DIR = path10.join(os4.homedir(), ".openacp", "agents");
     MAX_DOWNLOAD_SIZE = 500 * 1024 * 1024;
     validateTarContents = validateArchiveContents;
@@ -2242,7 +2242,7 @@ function copyResponse(response, body) {
   }
   return copy;
 }
-var enabledDebug, PROXY_ENV_KEYS, ProxyValidationError, ProxyUnknownScopeError, ProxyProfileInUseError, ProxyRouteTestError, ProxyProfileTestError, ProxyService;
+var enabledDebug, PROXY_ENV_KEYS, ProxyValidationError, ProxyUnknownScopeError, ProxyProfileInUseError, ProxyProfileNotFoundError, ProxyProfileExistsError, ProxyRouteTestError, ProxyProfileTestError, ProxyService;
 var init_proxy_service = __esm({
   "src/core/network/proxy-service.ts"() {
     "use strict";
@@ -2281,6 +2281,16 @@ var init_proxy_service = __esm({
         super(`Proxy profile "${id}" is still used by routing`, "PROXY_PROFILE_IN_USE");
       }
     };
+    ProxyProfileNotFoundError = class extends ProxyValidationError {
+      constructor(id) {
+        super(`Proxy profile "${id}" does not exist`, "PROXY_PROFILE_NOT_FOUND");
+      }
+    };
+    ProxyProfileExistsError = class extends ProxyValidationError {
+      constructor(id) {
+        super(`Proxy profile "${id}" already exists`, "PROXY_PROFILE_EXISTS");
+      }
+    };
     ProxyRouteTestError = class extends Error {
       code = "PROXY_ROUTE_TEST_FAILED";
       constructor(scope, cause) {
@@ -2390,13 +2400,28 @@ var init_proxy_service = __esm({
         return profile;
       }
       buildProfile(input2, config, secrets) {
+        input2 = this.normalizeProfileInput(input2);
         validateId(input2.id, "profile id");
-        if (!PROXY_PROTOCOLS.includes(input2.protocol)) throw new ProxyValidationError(`Unsupported proxy protocol: ${input2.protocol}`);
+        if (input2.name !== void 0) {
+          const name = input2.name.trim();
+          if (!name || name.length > 100) throw new ProxyValidationError("Proxy profile name must contain 1-100 non-whitespace characters");
+          input2 = { ...input2, name };
+        }
+        if (!input2.protocol || !PROXY_PROTOCOLS.includes(input2.protocol)) throw new ProxyValidationError(`Unsupported proxy protocol: ${input2.protocol}`);
         if (!Number.isInteger(input2.port) || input2.port < 1 || input2.port > 65535) throw new ProxyValidationError("Proxy port must be between 1 and 65535");
-        const host = canonicalHost(input2.host);
+        const host = canonicalHost(input2.host ?? "");
+        for (const [label, value] of [["username", input2.username], ["password", input2.password]]) {
+          if (value !== void 0 && (value.length > 4096 || /[\r\n\u0000]/.test(value))) {
+            throw new ProxyValidationError(`Proxy ${label} contains unsupported control characters or exceeds 4096 characters`);
+          }
+        }
+        if (input2.noProxy && (input2.noProxy.length > 256 || input2.noProxy.some((item) => !item || /[\u0000-\u0020\u007f]/.test(item)))) {
+          throw new ProxyValidationError("NO_PROXY entries must be non-empty, whitespace-free values (maximum 256 entries)");
+        }
         const existing = config.profiles.find((p) => p.id === input2.id);
         const nextSecrets = structuredClone(secrets);
-        if (input2.username !== void 0 || input2.password !== void 0) nextSecrets[input2.id] = { username: input2.username ?? nextSecrets[input2.id]?.username, password: input2.password ?? nextSecrets[input2.id]?.password };
+        if (input2.clearCredentials) delete nextSecrets[input2.id];
+        else if (input2.username !== void 0 || input2.password !== void 0) nextSecrets[input2.id] = { username: input2.username ?? nextSecrets[input2.id]?.username, password: input2.password ?? nextSecrets[input2.id]?.password };
         const secret = nextSecrets[input2.id];
         return { profile: {
           id: input2.id,
@@ -2409,11 +2434,68 @@ var init_proxy_service = __esm({
           hasCredentials: Boolean(secret?.username || secret?.password)
         }, nextSecrets };
       }
+      /** Parse a write-only proxy URL into canonical components without retaining it. */
+      parseProxyUrlInput(proxyUrl2) {
+        if (!proxyUrl2 || /[\u0000-\u001f\u007f]/.test(proxyUrl2)) throw new ProxyValidationError("Proxy URL contains invalid control characters");
+        let url;
+        try {
+          url = new URL(proxyUrl2);
+        } catch {
+          throw new ProxyValidationError("Proxy URL is invalid");
+        }
+        const protocol = url.protocol.slice(0, -1);
+        if (!PROXY_PROTOCOLS.includes(protocol)) throw new ProxyValidationError(`Unsupported proxy protocol: ${protocol}`);
+        if (url.pathname && url.pathname !== "/" || url.search || url.hash) throw new ProxyValidationError("Proxy URL must not contain a path, query, or fragment");
+        const authority = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(proxyUrl2)?.[1];
+        const hostPort = authority?.slice(authority.lastIndexOf("@") + 1 || 0);
+        const explicitPort = hostPort?.startsWith("[") ? /^\[[^\]]+\]:(\d+)$/.exec(hostPort)?.[1] : /:(\d+)$/.exec(hostPort ?? "")?.[1];
+        if (!explicitPort) throw new ProxyValidationError("Proxy URL must include an explicit port");
+        let username = "";
+        let password2 = "";
+        try {
+          username = decodeURIComponent(url.username);
+          password2 = decodeURIComponent(url.password);
+        } catch {
+          throw new ProxyValidationError("Proxy URL credentials contain invalid percent encoding");
+        }
+        return {
+          protocol,
+          host: url.hostname,
+          port: Number(url.port || explicitPort),
+          ...username ? { username } : {},
+          ...password2 ? { password: password2 } : {},
+          // Replacing an existing endpoint with a URL that has no userinfo must
+          // remove the old write-only secret instead of silently retaining it.
+          clearCredentials: !username && !password2
+        };
+      }
+      normalizeProfileInput(input2) {
+        if (input2.proxyUrl !== void 0) {
+          const componentKeys = ["protocol", "host", "port", "username", "password", "clearCredentials"];
+          if (componentKeys.some((key) => input2[key] !== void 0)) throw new ProxyValidationError("proxyUrl is mutually exclusive with endpoint and credential fields");
+          const { proxyUrl: proxyUrl2, ...metadata } = input2;
+          return { ...metadata, ...this.parseProxyUrlInput(proxyUrl2) };
+        }
+        if (!input2.protocol || !input2.host || input2.port === void 0) throw new ProxyValidationError("protocol, host, and port are required when proxyUrl is not provided");
+        return input2;
+      }
       async saveProfileSafely(input2, expectedRevision) {
+        return this.mutateProfileSafely(input2, "upsert", expectedRevision);
+      }
+      async createProfileSafely(input2, expectedRevision) {
+        return this.mutateProfileSafely(input2, "create", expectedRevision);
+      }
+      async updateProfileSafely(input2, expectedRevision) {
+        return this.mutateProfileSafely(input2, "update", expectedRevision);
+      }
+      async mutateProfileSafely(input2, operation, expectedRevision) {
         return this.serialize(async () => {
           const config = this.store.load();
           const secrets = this.store.getSecrets();
           if (expectedRevision !== void 0 && config.revision !== expectedRevision) throw new ProxyRevisionConflictError(expectedRevision, config.revision);
+          const exists = config.profiles.some((profile) => profile.id === input2.id);
+          if (operation === "create" && exists) throw new ProxyProfileExistsError(input2.id);
+          if (operation === "update" && !exists) throw new ProxyProfileNotFoundError(input2.id);
           const { profile: candidate, nextSecrets } = this.buildProfile(input2, config, secrets);
           const affectedScopes = this.scopesUsingProfile(config, input2.id);
           const candidateSecret = nextSecrets[input2.id];
@@ -2431,7 +2513,18 @@ var init_proxy_service = __esm({
           }
           this.invalidatePolicyBeforeCommit(config, input2.id);
           config.profiles = [...config.profiles.filter((p) => p.id !== candidate.id), candidate];
-          const saved = this.store.commit(config, nextSecrets, config.revision).profiles.find((p) => p.id === candidate.id);
+          let committed;
+          try {
+            committed = this.store.commit(config, nextSecrets, config.revision);
+          } catch (error) {
+            if (error instanceof ProxyRevisionConflictError && operation !== "upsert") {
+              const latestExists = this.store.load().profiles.some((profile) => profile.id === input2.id);
+              if (operation === "create" && latestExists) throw new ProxyProfileExistsError(input2.id);
+              if (operation === "update" && !latestExists) throw new ProxyProfileNotFoundError(input2.id);
+            }
+            throw error;
+          }
+          const saved = committed.profiles.find((p) => p.id === candidate.id);
           this.retireScopes(affectedScopes);
           return saved;
         });
@@ -2486,15 +2579,37 @@ var init_proxy_service = __esm({
         return this.saveProfileSafely(this.parseEnvFile(id, envFile, name), expectedRevision);
       }
       async deleteProfile(id, expectedRevision) {
+        await this.deleteProfileSafely(id, void 0, expectedRevision);
+      }
+      /** Delete a profile, optionally reassigning every direct reference in one tested CAS transaction. */
+      async deleteProfileSafely(id, reassign, expectedRevision) {
         return this.serialize(async () => {
           const config = this.store.load();
           const secrets = this.store.getSecrets();
           if (expectedRevision !== void 0 && config.revision !== expectedRevision) throw new ProxyRevisionConflictError(expectedRevision, config.revision);
-          if (!config.profiles.some((p) => p.id === id)) throw new ProxyValidationError(`Proxy profile "${id}" does not exist`);
-          if (Object.values(config.routing.routes).includes(`profile:${id}`) || config.routing.global === `profile:${id}`) throw new ProxyProfileInUseError(id);
-          config.profiles = config.profiles.filter((p) => p.id !== id);
+          if (!config.profiles.some((p) => p.id === id)) throw new ProxyProfileNotFoundError(id);
+          const directScopes = Object.entries(config.routing.routes).filter(([, route]) => route === `profile:${id}`).map(([scope]) => scope);
+          const globalUsesProfile = config.routing.global === `profile:${id}`;
+          if ((directScopes.length || globalUsesProfile) && !reassign) throw new ProxyProfileInUseError(id);
+          if (reassign === `profile:${id}`) throw new ProxyValidationError("A deleted profile cannot be reassigned to itself");
+          if (reassign) this.validateRoute(reassign);
+          const candidate = structuredClone(config);
+          if (globalUsesProfile) candidate.routing.global = reassign;
+          for (const scope of directScopes) candidate.routing.routes[scope] = reassign;
+          const changedScopes = this.changedResolutionScopes(config, candidate);
+          try {
+            await this.testCandidateRoutes(config, candidate);
+          } catch (error) {
+            throw new ProxyRouteTestError(globalUsesProfile ? "global" : directScopes[0], error);
+          }
+          candidate.profiles = candidate.profiles.filter((p) => p.id !== id);
           delete secrets[id];
-          this.store.commit(config, secrets, config.revision);
+          this.invalidatePolicyBeforeCommit(config, id);
+          this.store.commit(candidate, secrets, config.revision);
+          this.retireScopes(changedScopes);
+          if (globalUsesProfile) for (const listener of this.listeners) await listener("global", reassign);
+          for (const scope of directScopes) for (const listener of this.listeners) await listener(scope, reassign);
+          return { reassignedScopes: [.../* @__PURE__ */ new Set([...globalUsesProfile ? ["global"] : [], ...directScopes])] };
         });
       }
       resolve(scope, routeOverride) {
@@ -2713,6 +2828,27 @@ var init_proxy_service = __esm({
           fetcher?.destroy?.();
         }
       }
+      /** Test an unsaved profile candidate entirely in memory. Credentials never reach persistence. */
+      async testProfileCandidate(input2, targetUrl) {
+        const config = this.store.load();
+        const { profile, nextSecrets } = this.buildProfile(input2, config, this.store.getSecrets());
+        const fetcher = this.createProfileFetch(profile, nextSecrets[profile.id]);
+        let response;
+        try {
+          response = await fetcher(targetUrl ?? "https://api.ipify.org?format=json", {
+            signal: AbortSignal.timeout(1e4)
+          });
+          return { ok: response.ok, status: response.status };
+        } catch (error) {
+          return { ok: false, error: error instanceof Error ? redactNetworkSecrets(error.message) : "Proxy test failed" };
+        } finally {
+          try {
+            await response?.body?.cancel();
+          } catch {
+          }
+          fetcher.destroy?.();
+        }
+      }
       status() {
         const config = this.store.load();
         const scopes = this.getKnownScopes();
@@ -3035,6 +3171,19 @@ var init_agents = __esm({
   }
 });
 
+// src/core/telegram-command-scopes.ts
+function effectiveTelegramGroupCommands(lists, administrator) {
+  const candidates = administrator ? [lists.chatAdmins, lists.chat, lists.allAdmins, lists.allGroup, lists.default] : [lists.chat, lists.allGroup, lists.default];
+  return candidates.find((commands) => commands.length > 0) ?? [];
+}
+var TELEGRAM_COMMAND_LOCALES;
+var init_telegram_command_scopes = __esm({
+  "src/core/telegram-command-scopes.ts"() {
+    "use strict";
+    TELEGRAM_COMMAND_LOCALES = ["", "en", "ru"];
+  }
+});
+
 // src/core/plugin/settings-manager.ts
 var settings_manager_exports = {};
 __export(settings_manager_exports, {
@@ -3150,13 +3299,350 @@ var init_settings_manager = __esm({
   }
 });
 
+// src/plugins/telegram/command-ownership-store.ts
+var command_ownership_store_exports = {};
+__export(command_ownership_store_exports, {
+  TelegramCommandOwnerConflictError: () => TelegramCommandOwnerConflictError,
+  TelegramCommandOwnershipStore: () => TelegramCommandOwnershipStore,
+  telegramCommandHostId: () => telegramCommandHostId,
+  telegramCommandInstanceKey: () => telegramCommandInstanceKey
+});
+import fs20 from "fs";
+import path19 from "path";
+import os5 from "os";
+import { createHash as createHash2 } from "crypto";
+function telegramCommandHostId() {
+  let source = `${os5.hostname()}|${typeof process.getuid === "function" ? process.getuid() : "unknown"}`;
+  try {
+    source = fs20.readFileSync("/etc/machine-id", "utf8").trim() || source;
+  } catch {
+  }
+  return createHash2("sha256").update(source).digest("hex");
+}
+function telegramCommandInstanceKey(instanceRoot) {
+  return createHash2("sha256").update(path19.resolve(instanceRoot)).digest("hex");
+}
+function emptyLedger() {
+  return { version: STORE_VERSION, bots: {} };
+}
+function validateLedger(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid root");
+  const ledger = value;
+  if (ledger.version !== STORE_VERSION || !ledger.bots || typeof ledger.bots !== "object") throw new Error("invalid version/bots");
+  const botEntries = Object.entries(ledger.bots);
+  if (botEntries.length > MAX_BOTS) throw new Error("too many bots");
+  for (const [botId, bot] of botEntries) {
+    if (!/^\d{1,20}$/.test(botId) || !bot || typeof bot !== "object" || !bot.scopes || typeof bot.scopes !== "object") throw new Error("invalid bot");
+    if (bot.owner) {
+      const owner = bot.owner;
+      if (typeof owner.instanceId !== "string" || !owner.instanceId || owner.instanceId.length > 128 || /[\u0000-\u001f\u007f]/.test(owner.instanceId) || !/^[a-f0-9]{64}$/.test(owner.instanceKey) || !/^[a-f0-9]{64}$/.test(owner.hostId) || !Number.isSafeInteger(owner.pid) || owner.pid <= 0 || !Number.isFinite(Date.parse(owner.heartbeatAt)) || owner.stoppedAt !== void 0 && !Number.isFinite(Date.parse(owner.stoppedAt))) throw new Error("invalid owner");
+    }
+    const scopes = Object.entries(bot.scopes);
+    if (scopes.length > MAX_SCOPES_PER_BOT) throw new Error("too many scopes");
+    for (const [key, scope] of scopes) {
+      if (!/^(default|chat:[a-f0-9]{16}|chat_administrators:[a-f0-9]{16})\|(neutral|en|ru)$/.test(key)) throw new Error("invalid scope key");
+      if (!scope || !Array.isArray(scope.owned) || scope.owned.length > MAX_NAMES_PER_SCOPE) throw new Error("invalid ownership");
+      if (scope.owned.some((name) => typeof name !== "string" || !/^[a-z0-9_]{1,32}$/.test(name))) throw new Error("invalid command name");
+    }
+  }
+  return structuredClone(ledger);
+}
+var STORE_VERSION, MAX_BOTS, MAX_SCOPES_PER_BOT, MAX_NAMES_PER_SCOPE, TelegramCommandOwnerConflictError, TelegramCommandOwnershipStore;
+var init_command_ownership_store = __esm({
+  "src/plugins/telegram/command-ownership-store.ts"() {
+    "use strict";
+    STORE_VERSION = 2;
+    MAX_BOTS = 8;
+    MAX_SCOPES_PER_BOT = 64;
+    MAX_NAMES_PER_SCOPE = 100;
+    TelegramCommandOwnerConflictError = class extends Error {
+      constructor(ownerInstanceId) {
+        super("This Telegram bot command menu is owned by another OpenACP instance. Configure a unique bot per instance, stop the current owner, or perform an explicit same-host takeover.");
+        this.ownerInstanceId = ownerInstanceId;
+        this.name = "TelegramCommandOwnerConflictError";
+      }
+      ownerInstanceId;
+      code = "TELEGRAM_COMMAND_OWNER_CONFLICT";
+    };
+    TelegramCommandOwnershipStore = class {
+      file;
+      lockFile;
+      constructor(instanceRoot) {
+        this.file = path19.join(instanceRoot, "telegram-command-ownership.json");
+        this.lockFile = `${this.file}.lock`;
+      }
+      async withLock(operation) {
+        fs20.mkdirSync(path19.dirname(this.file), { recursive: true, mode: 448 });
+        const deadline = Date.now() + 1e4;
+        let fd;
+        while (fd === void 0) {
+          try {
+            fd = fs20.openSync(this.lockFile, "wx", 384);
+            fs20.writeFileSync(fd, String(process.pid));
+          } catch (error) {
+            if (error.code !== "EEXIST") throw error;
+            try {
+              const owner = Number(fs20.readFileSync(this.lockFile, "utf8"));
+              let alive = Number.isSafeInteger(owner) && owner > 0;
+              if (alive) {
+                try {
+                  process.kill(owner, 0);
+                } catch {
+                  alive = false;
+                }
+              }
+              if (!alive) fs20.unlinkSync(this.lockFile);
+            } catch {
+            }
+            if (Date.now() >= deadline) throw new Error("Timed out waiting for Telegram command ownership lock");
+            await new Promise((resolve7) => setTimeout(resolve7, 50));
+          }
+        }
+        try {
+          return await operation(this.load());
+        } finally {
+          try {
+            fs20.closeSync(fd);
+          } catch {
+          }
+          try {
+            fs20.unlinkSync(this.lockFile);
+          } catch {
+          }
+        }
+      }
+      load() {
+        if (!fs20.existsSync(this.file)) return { ledger: emptyLedger(), conservative: false };
+        try {
+          return { ledger: validateLedger(JSON.parse(fs20.readFileSync(this.file, "utf8"))), conservative: false };
+        } catch {
+          const quarantine = `${this.file}.corrupt.${Date.now()}`;
+          try {
+            fs20.renameSync(this.file, quarantine);
+          } catch {
+          }
+          return { ledger: emptyLedger(), conservative: true };
+        }
+      }
+      getOwned(ledger, botId, scopeKey) {
+        return ledger.bots[botId]?.scopes[scopeKey]?.owned;
+      }
+      /** Claim command-list ownership while the ledger lock is held. */
+      claimOwner(ledger, botId, identity, allowTakeover = false) {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const bot = this.ensureBot(ledger, botId, now);
+        const current = bot.owner;
+        const sameProcess = current?.hostId === identity.hostId && current.instanceKey === identity.instanceKey && current.pid === identity.pid;
+        if (!current || sameProcess || current.stoppedAt && current.hostId === identity.hostId && current.instanceKey === identity.instanceKey) {
+          bot.owner = { ...identity, heartbeatAt: now };
+          bot.updatedAt = now;
+          return;
+        }
+        const sameHost = current.hostId === identity.hostId;
+        const provablyStopped = sameHost && (Boolean(current.stoppedAt) || !this.processAlive(current.pid));
+        if (allowTakeover && provablyStopped) {
+          bot.owner = { ...identity, heartbeatAt: now };
+          bot.updatedAt = now;
+          return;
+        }
+        throw new TelegramCommandOwnerConflictError(current.instanceId);
+      }
+      async heartbeatOwner(botId, identity) {
+        return this.withLock(async ({ ledger }) => {
+          const bot = ledger.bots[botId];
+          const owner = bot?.owner;
+          if (!owner || owner.hostId !== identity.hostId || owner.instanceKey !== identity.instanceKey || owner.pid !== identity.pid || owner.stoppedAt) return false;
+          owner.heartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
+          bot.updatedAt = owner.heartbeatAt;
+          this.save(ledger);
+          return true;
+        });
+      }
+      async releaseOwner(botId, identity) {
+        await this.withLock(async ({ ledger }) => {
+          const bot = ledger.bots[botId];
+          const owner = bot?.owner;
+          if (!owner || owner.hostId !== identity.hostId || owner.instanceKey !== identity.instanceKey || owner.pid !== identity.pid) return;
+          owner.stoppedAt = (/* @__PURE__ */ new Date()).toISOString();
+          owner.heartbeatAt = owner.stoppedAt;
+          bot.updatedAt = owner.stoppedAt;
+          this.save(ledger);
+        });
+      }
+      getOwner(botId) {
+        return this.load().ledger.bots[botId]?.owner;
+      }
+      setOwned(ledger, botId, scopeKey, names) {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const bot = this.ensureBot(ledger, botId, now);
+        bot.updatedAt = now;
+        bot.scopes[scopeKey] = { owned: [...new Set(names)].slice(0, MAX_NAMES_PER_SCOPE), updatedAt: now };
+      }
+      ensureBot(ledger, botId, now) {
+        if (!ledger.bots[botId]) {
+          const entries = Object.entries(ledger.bots).sort((a, b) => a[1].updatedAt.localeCompare(b[1].updatedAt));
+          while (entries.length >= MAX_BOTS) {
+            const oldest = entries.shift();
+            if (oldest) delete ledger.bots[oldest[0]];
+          }
+          ledger.bots[botId] = { scopes: {}, updatedAt: now };
+        }
+        return ledger.bots[botId];
+      }
+      processAlive(pid) {
+        try {
+          process.kill(pid, 0);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      save(ledger) {
+        const clean = validateLedger(ledger);
+        fs20.mkdirSync(path19.dirname(this.file), { recursive: true, mode: 448 });
+        const tmp = `${this.file}.${process.pid}.${Date.now()}.tmp`;
+        fs20.writeFileSync(tmp, `${JSON.stringify(clean, null, 2)}
+`, { mode: 384, flag: "wx" });
+        fs20.chmodSync(tmp, 384);
+        const fd = fs20.openSync(tmp, "r");
+        fs20.fsyncSync(fd);
+        fs20.closeSync(fd);
+        fs20.renameSync(tmp, this.file);
+        try {
+          const dir = fs20.openSync(path19.dirname(this.file), "r");
+          fs20.fsyncSync(dir);
+          fs20.closeSync(dir);
+        } catch {
+        }
+      }
+    };
+  }
+});
+
+// src/core/instance/instance-context.ts
+var instance_context_exports = {};
+__export(instance_context_exports, {
+  createInstanceContext: () => createInstanceContext,
+  generateSlug: () => generateSlug,
+  getGlobalRoot: () => getGlobalRoot,
+  resolveInstanceRoot: () => resolveInstanceRoot,
+  resolveRunningInstance: () => resolveRunningInstance
+});
+import path20 from "path";
+import fs21 from "fs";
+import os6 from "os";
+function createInstanceContext(opts) {
+  const { id, root } = opts;
+  const globalRoot = getGlobalRoot();
+  return {
+    id,
+    root,
+    paths: {
+      config: path20.join(root, "config.json"),
+      sessions: path20.join(root, "sessions.json"),
+      agents: path20.join(root, "agents.json"),
+      registryCache: path20.join(globalRoot, "cache", "registry-cache.json"),
+      plugins: path20.join(root, "plugins"),
+      pluginsData: path20.join(root, "plugins", "data"),
+      pluginRegistry: path20.join(root, "plugins.json"),
+      logs: path20.join(root, "logs"),
+      pid: path20.join(root, "openacp.pid"),
+      running: path20.join(root, "running"),
+      apiPort: path20.join(root, "api.port"),
+      apiSecret: path20.join(root, "api-secret"),
+      bin: path20.join(globalRoot, "bin"),
+      cache: path20.join(root, "cache"),
+      tunnels: path20.join(root, "tunnels.json"),
+      agentsDir: path20.join(globalRoot, "agents")
+    }
+  };
+}
+function generateSlug(name) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return slug || "openacp";
+}
+function expandHome3(p) {
+  if (p.startsWith("~")) return path20.join(os6.homedir(), p.slice(1));
+  return p;
+}
+function resolveInstanceRoot(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const home = os6.homedir();
+  const globalRoot = getGlobalRoot();
+  if (opts.dir) return path20.join(expandHome3(opts.dir), ".openacp");
+  if (opts.local) return path20.join(cwd, ".openacp");
+  const cwdRoot = path20.join(cwd, ".openacp");
+  if (fs21.existsSync(path20.join(cwdRoot, "config.json"))) return cwdRoot;
+  let dir = path20.resolve(cwd);
+  while (true) {
+    const parent = path20.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+    const candidate = path20.join(dir, ".openacp");
+    if (candidate === globalRoot) {
+      if (dir === home) break;
+      continue;
+    }
+    if (fs21.existsSync(path20.join(candidate, "config.json"))) return candidate;
+    if (dir === home) break;
+  }
+  if (path20.resolve(cwd) === path20.resolve(home)) {
+    const defaultWs = path20.join(home, "openacp-workspace", ".openacp");
+    if (fs21.existsSync(path20.join(defaultWs, "config.json"))) return defaultWs;
+  }
+  if (process.env.OPENACP_INSTANCE_ROOT) return process.env.OPENACP_INSTANCE_ROOT;
+  return null;
+}
+function getGlobalRoot() {
+  return path20.join(os6.homedir(), ".openacp");
+}
+async function resolveRunningInstance(cwd) {
+  const globalRoot = getGlobalRoot();
+  const home = os6.homedir();
+  let dir = path20.resolve(cwd);
+  while (true) {
+    const candidate = path20.join(dir, ".openacp");
+    if (candidate !== globalRoot && fs21.existsSync(candidate)) {
+      if (await isInstanceRunning(candidate)) return candidate;
+    }
+    const parent = path20.dirname(dir);
+    if (parent === dir) break;
+    if (dir === home) break;
+    dir = parent;
+  }
+  return null;
+}
+async function isInstanceRunning(instanceRoot) {
+  const portFile = path20.join(instanceRoot, "api.port");
+  try {
+    const content = fs21.readFileSync(portFile, "utf-8").trim();
+    const port = parseInt(content, 10);
+    if (isNaN(port)) return false;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2e3);
+    const res = await fetch(`http://127.0.0.1:${port}/api/v1/system/health`, {
+      signal: controller.signal
+    });
+    clearTimeout(timeout);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+var init_instance_context = __esm({
+  "src/core/instance/instance-context.ts"() {
+    "use strict";
+  }
+});
+
 // src/core/doctor/checks/telegram.ts
-import * as path19 from "path";
+import * as path21 from "path";
 var BOT_TOKEN_REGEX, telegramCheck;
 var init_telegram = __esm({
   "src/core/doctor/checks/telegram.ts"() {
     "use strict";
     init_network_redaction();
+    init_telegram_command_scopes();
     BOT_TOKEN_REGEX = /^\d+:[A-Za-z0-9_-]{35,}$/;
     telegramCheck = {
       name: "Telegram",
@@ -3168,7 +3654,7 @@ var init_telegram = __esm({
           return results;
         }
         const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
-        const sm = new SettingsManager2(path19.join(ctx.pluginsDir, "data"));
+        const sm = new SettingsManager2(path21.join(ctx.pluginsDir, "data"));
         const ps = await sm.loadSettings("@openacp/telegram");
         const botToken = ps.botToken;
         const chatId = ps.chatId;
@@ -3209,6 +3695,24 @@ var init_telegram = __esm({
           results.push({ status: "fail", message: "Chat ID not configured" });
           return results;
         }
+        try {
+          const [{ TelegramCommandOwnershipStore: TelegramCommandOwnershipStore2, telegramCommandInstanceKey: telegramCommandInstanceKey2 }, { getGlobalRoot: getGlobalRoot2 }] = await Promise.all([
+            Promise.resolve().then(() => (init_command_ownership_store(), command_ownership_store_exports)),
+            Promise.resolve().then(() => (init_instance_context(), instance_context_exports))
+          ]);
+          const owner = new TelegramCommandOwnershipStore2(getGlobalRoot2()).getOwner(String(botId));
+          if (owner && owner.instanceKey !== telegramCommandInstanceKey2(ctx.dataDir)) {
+            results.push({
+              status: "warn",
+              message: "Telegram command sync is owned by another OpenACP instance. Use a unique bot per instance. For a stopped same-host owner only, request one explicit takeover with OPENACP_TELEGRAM_COMMAND_TAKEOVER=1."
+            });
+          }
+        } catch (err) {
+          results.push({
+            status: "warn",
+            message: `Cannot inspect Telegram command-sync ownership: ${redactNetworkSecrets(err instanceof Error ? err.message : String(err))}`
+          });
+        }
         try {
           const res = await telegramFetch(`https://api.telegram.org/bot${botToken}/getChat`, {
             method: "POST",
@@ -3255,6 +3759,54 @@ var init_telegram = __esm({
           const message = err instanceof Error ? err.message : String(err);
           results.push({ status: "fail", message: `Admin check failed: ${redactNetworkSecrets(message)}` });
         }
+        try {
+          const getCommands = async (scope, languageCode) => {
+            const res = await telegramFetch(`https://api.telegram.org/bot${botToken}/getMyCommands`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ scope, ...languageCode ? { language_code: languageCode } : {} })
+            });
+            const data = await res.json();
+            if (!data.ok || !Array.isArray(data.result)) {
+              throw new Error(data.description || "Telegram returned an invalid command list");
+            }
+            return data.result;
+          };
+          const missing = [];
+          for (const locale of TELEGRAM_COMMAND_LOCALES) {
+            const [defaultCommands, groupCommands, globalAdminCommands, chatCommands, chatAdminCommands] = await Promise.all([
+              getCommands({ type: "default" }, locale),
+              getCommands({ type: "all_group_chats" }, locale),
+              getCommands({ type: "all_chat_administrators" }, locale),
+              getCommands({ type: "chat", chat_id: chatId }, locale),
+              getCommands({ type: "chat_administrators", chat_id: chatId }, locale)
+            ]);
+            const lists = {
+              default: defaultCommands,
+              allGroup: groupCommands,
+              allAdmins: globalAdminCommands,
+              chat: chatCommands,
+              chatAdmins: chatAdminCommands
+            };
+            const localeName = locale || "neutral";
+            if (!effectiveTelegramGroupCommands(lists, false).some((command) => command.command === "proxy")) missing.push(`${localeName} members`);
+            if (!effectiveTelegramGroupCommands(lists, true).some((command) => command.command === "proxy")) missing.push(`${localeName} administrators`);
+          }
+          if (missing.length === 0) {
+            results.push({ status: "pass", message: "Telegram command menus are synchronized for neutral/en/ru scopes (including /proxy)" });
+          } else {
+            results.push({
+              status: "warn",
+              message: `Telegram command menu is out of sync for ${missing.join(", ")} (missing /proxy). Restart OpenACP; if the warning remains, inspect Telegram connectivity logs.`
+            });
+          }
+        } catch (err) {
+          const message = redactNetworkSecrets(err instanceof Error ? err.message : String(err));
+          results.push({
+            status: "warn",
+            message: `Cannot verify Telegram command menus: ${message}. Restart OpenACP; if the warning remains, inspect Telegram connectivity logs.`
+          });
+        }
         return results;
       }
     };
@@ -3262,7 +3814,7 @@ var init_telegram = __esm({
 });
 
 // src/core/doctor/checks/storage.ts
-import * as fs20 from "fs";
+import * as fs22 from "fs";
 var storageCheck;
 var init_storage = __esm({
   "src/core/doctor/checks/storage.ts"() {
@@ -3272,28 +3824,28 @@ var init_storage = __esm({
       order: 4,
       async run(ctx) {
         const results = [];
-        if (!fs20.existsSync(ctx.dataDir)) {
+        if (!fs22.existsSync(ctx.dataDir)) {
           results.push({
             status: "fail",
             message: "Data directory ~/.openacp does not exist",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs20.mkdirSync(ctx.dataDir, { recursive: true });
+              fs22.mkdirSync(ctx.dataDir, { recursive: true });
               return { success: true, message: "created directory" };
             }
           });
         } else {
           try {
-            fs20.accessSync(ctx.dataDir, fs20.constants.W_OK);
+            fs22.accessSync(ctx.dataDir, fs22.constants.W_OK);
             results.push({ status: "pass", message: "Data directory exists and writable" });
           } catch {
             results.push({ status: "fail", message: "Data directory not writable" });
           }
         }
-        if (fs20.existsSync(ctx.sessionsPath)) {
+        if (fs22.existsSync(ctx.sessionsPath)) {
           try {
-            const content = fs20.readFileSync(ctx.sessionsPath, "utf-8");
+            const content = fs22.readFileSync(ctx.sessionsPath, "utf-8");
             const data = JSON.parse(content);
             if (typeof data === "object" && data !== null && "sessions" in data) {
               results.push({ status: "pass", message: "Sessions file valid" });
@@ -3304,7 +3856,7 @@ var init_storage = __esm({
                 fixable: true,
                 fixRisk: "risky",
                 fix: async () => {
-                  fs20.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
+                  fs22.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
                   return { success: true, message: "reset sessions file" };
                 }
               });
@@ -3316,7 +3868,7 @@ var init_storage = __esm({
               fixable: true,
               fixRisk: "risky",
               fix: async () => {
-                fs20.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
+                fs22.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
                 return { success: true, message: "reset sessions file" };
               }
             });
@@ -3324,20 +3876,20 @@ var init_storage = __esm({
         } else {
           results.push({ status: "pass", message: "Sessions file not present yet (created on first session)" });
         }
-        if (!fs20.existsSync(ctx.logsDir)) {
+        if (!fs22.existsSync(ctx.logsDir)) {
           results.push({
             status: "warn",
             message: "Log directory does not exist",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs20.mkdirSync(ctx.logsDir, { recursive: true });
+              fs22.mkdirSync(ctx.logsDir, { recursive: true });
               return { success: true, message: "created log directory" };
             }
           });
         } else {
           try {
-            fs20.accessSync(ctx.logsDir, fs20.constants.W_OK);
+            fs22.accessSync(ctx.logsDir, fs22.constants.W_OK);
             results.push({ status: "pass", message: "Log directory exists and writable" });
           } catch {
             results.push({ status: "fail", message: "Log directory not writable" });
@@ -3350,8 +3902,8 @@ var init_storage = __esm({
 });
 
 // src/core/doctor/checks/workspace.ts
-import * as fs21 from "fs";
-import * as path20 from "path";
+import * as fs23 from "fs";
+import * as path22 from "path";
 var workspaceCheck;
 var init_workspace = __esm({
   "src/core/doctor/checks/workspace.ts"() {
@@ -3361,21 +3913,21 @@ var init_workspace = __esm({
       order: 5,
       async run(ctx) {
         const results = [];
-        const workspace = path20.dirname(ctx.dataDir);
-        if (!fs21.existsSync(workspace)) {
+        const workspace = path22.dirname(ctx.dataDir);
+        if (!fs23.existsSync(workspace)) {
           results.push({
             status: "warn",
             message: `Workspace directory does not exist: ${workspace}`,
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs21.mkdirSync(workspace, { recursive: true });
+              fs23.mkdirSync(workspace, { recursive: true });
               return { success: true, message: "created directory" };
             }
           });
         } else {
           try {
-            fs21.accessSync(workspace, fs21.constants.W_OK);
+            fs23.accessSync(workspace, fs23.constants.W_OK);
             results.push({ status: "pass", message: `Workspace directory exists: ${workspace}` });
           } catch {
             results.push({ status: "fail", message: `Workspace directory not writable: ${workspace}` });
@@ -3388,8 +3940,8 @@ var init_workspace = __esm({
 });
 
 // src/core/doctor/checks/plugins.ts
-import * as fs22 from "fs";
-import * as path21 from "path";
+import * as fs24 from "fs";
+import * as path23 from "path";
 var pluginsCheck;
 var init_plugins = __esm({
   "src/core/doctor/checks/plugins.ts"() {
@@ -3399,16 +3951,16 @@ var init_plugins = __esm({
       order: 6,
       async run(ctx) {
         const results = [];
-        if (!fs22.existsSync(ctx.pluginsDir)) {
+        if (!fs24.existsSync(ctx.pluginsDir)) {
           results.push({
             status: "warn",
             message: "Plugins directory does not exist",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs22.mkdirSync(ctx.pluginsDir, { recursive: true });
-              fs22.writeFileSync(
-                path21.join(ctx.pluginsDir, "package.json"),
+              fs24.mkdirSync(ctx.pluginsDir, { recursive: true });
+              fs24.writeFileSync(
+                path23.join(ctx.pluginsDir, "package.json"),
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
               return { success: true, message: "initialized plugins directory" };
@@ -3417,15 +3969,15 @@ var init_plugins = __esm({
           return results;
         }
         results.push({ status: "pass", message: "Plugins directory exists" });
-        const pkgPath = path21.join(ctx.pluginsDir, "package.json");
-        if (!fs22.existsSync(pkgPath)) {
+        const pkgPath = path23.join(ctx.pluginsDir, "package.json");
+        if (!fs24.existsSync(pkgPath)) {
           results.push({
             status: "warn",
             message: "Plugins package.json missing",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs22.writeFileSync(
+              fs24.writeFileSync(
                 pkgPath,
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
@@ -3435,7 +3987,7 @@ var init_plugins = __esm({
           return results;
         }
         try {
-          const pkg = JSON.parse(fs22.readFileSync(pkgPath, "utf-8"));
+          const pkg = JSON.parse(fs24.readFileSync(pkgPath, "utf-8"));
           const deps = pkg.dependencies || {};
           const count = Object.keys(deps).length;
           results.push({ status: "pass", message: `Plugins package.json valid (${count} plugins)` });
@@ -3446,7 +3998,7 @@ var init_plugins = __esm({
             fixable: true,
             fixRisk: "risky",
             fix: async () => {
-              fs22.writeFileSync(
+              fs24.writeFileSync(
                 pkgPath,
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
@@ -3461,7 +4013,7 @@ var init_plugins = __esm({
 });
 
 // src/core/doctor/checks/daemon.ts
-import * as fs23 from "fs";
+import * as fs25 from "fs";
 import * as net3 from "net";
 function isProcessAlive(pid) {
   try {
@@ -3491,8 +4043,8 @@ var init_daemon = __esm({
       order: 7,
       async run(ctx) {
         const results = [];
-        if (fs23.existsSync(ctx.pidPath)) {
-          const content = fs23.readFileSync(ctx.pidPath, "utf-8").trim();
+        if (fs25.existsSync(ctx.pidPath)) {
+          const content = fs25.readFileSync(ctx.pidPath, "utf-8").trim();
           const pid = parseInt(content, 10);
           if (isNaN(pid)) {
             results.push({
@@ -3501,7 +4053,7 @@ var init_daemon = __esm({
               fixable: true,
               fixRisk: "safe",
               fix: async () => {
-                fs23.unlinkSync(ctx.pidPath);
+                fs25.unlinkSync(ctx.pidPath);
                 return { success: true, message: "removed invalid PID file" };
               }
             });
@@ -3512,7 +4064,7 @@ var init_daemon = __esm({
               fixable: true,
               fixRisk: "safe",
               fix: async () => {
-                fs23.unlinkSync(ctx.pidPath);
+                fs25.unlinkSync(ctx.pidPath);
                 return { success: true, message: "removed stale PID file" };
               }
             });
@@ -3520,8 +4072,8 @@ var init_daemon = __esm({
             results.push({ status: "pass", message: `Daemon running (PID ${pid})` });
           }
         }
-        if (fs23.existsSync(ctx.portFilePath)) {
-          const content = fs23.readFileSync(ctx.portFilePath, "utf-8").trim();
+        if (fs25.existsSync(ctx.portFilePath)) {
+          const content = fs25.readFileSync(ctx.portFilePath, "utf-8").trim();
           const port = parseInt(content, 10);
           if (isNaN(port)) {
             results.push({
@@ -3530,7 +4082,7 @@ var init_daemon = __esm({
               fixable: true,
               fixRisk: "safe",
               fix: async () => {
-                fs23.unlinkSync(ctx.portFilePath);
+                fs25.unlinkSync(ctx.portFilePath);
                 return { success: true, message: "removed invalid port file" };
               }
             });
@@ -3542,8 +4094,8 @@ var init_daemon = __esm({
           const apiPort = 21420;
           const inUse = await checkPortInUse(apiPort);
           if (inUse) {
-            if (fs23.existsSync(ctx.pidPath)) {
-              const pid = parseInt(fs23.readFileSync(ctx.pidPath, "utf-8").trim(), 10);
+            if (fs25.existsSync(ctx.pidPath)) {
+              const pid = parseInt(fs25.readFileSync(ctx.pidPath, "utf-8").trim(), 10);
               if (!isNaN(pid) && isProcessAlive(pid)) {
                 results.push({ status: "pass", message: `API port ${apiPort} in use by OpenACP daemon` });
               } else {
@@ -3563,17 +4115,17 @@ var init_daemon = __esm({
 });
 
 // src/core/utils/install-binary.ts
-import fs24 from "fs";
-import path22 from "path";
+import fs26 from "fs";
+import path24 from "path";
 import https from "https";
-import os5 from "os";
+import os7 from "os";
 import { execFileSync as execFileSync4 } from "child_process";
 function downloadFile(url, dest, maxRedirects = 10) {
   return new Promise((resolve7, reject) => {
-    const file = fs24.createWriteStream(dest);
+    const file = fs26.createWriteStream(dest);
     const cleanup = () => {
       try {
-        if (fs24.existsSync(dest)) fs24.unlinkSync(dest);
+        if (fs26.existsSync(dest)) fs26.unlinkSync(dest);
       } catch {
       }
     };
@@ -3628,8 +4180,8 @@ function downloadFile(url, dest, maxRedirects = 10) {
   });
 }
 function getDownloadUrl(spec) {
-  const platform2 = os5.platform();
-  const arch = os5.arch();
+  const platform2 = os7.platform();
+  const arch = os7.arch();
   const mapping = spec.platforms[platform2];
   if (!mapping) throw new Error(`${spec.name}: unsupported platform ${platform2}`);
   const binary = mapping[arch];
@@ -3639,50 +4191,50 @@ function getDownloadUrl(spec) {
 async function ensureBinary(spec, binDir) {
   const resolvedBinDir = binDir ?? DEFAULT_BIN_DIR;
   const binName = IS_WINDOWS ? `${spec.name}.exe` : spec.name;
-  const binPath = path22.join(resolvedBinDir, binName);
+  const binPath = path24.join(resolvedBinDir, binName);
   if (commandExists(spec.name)) {
-    log18.debug({ name: spec.name }, "Found in PATH");
+    log19.debug({ name: spec.name }, "Found in PATH");
     return spec.name;
   }
-  if (fs24.existsSync(binPath)) {
-    if (!IS_WINDOWS) fs24.chmodSync(binPath, "755");
-    log18.debug({ name: spec.name, path: binPath }, "Found in ~/.openacp/bin");
+  if (fs26.existsSync(binPath)) {
+    if (!IS_WINDOWS) fs26.chmodSync(binPath, "755");
+    log19.debug({ name: spec.name, path: binPath }, "Found in ~/.openacp/bin");
     return binPath;
   }
-  log18.info({ name: spec.name }, "Not found, downloading from GitHub...");
-  fs24.mkdirSync(resolvedBinDir, { recursive: true });
+  log19.info({ name: spec.name }, "Not found, downloading from GitHub...");
+  fs26.mkdirSync(resolvedBinDir, { recursive: true });
   const url = getDownloadUrl(spec);
   const isArchive = spec.isArchive?.(url) ?? false;
-  const downloadDest = isArchive ? path22.join(resolvedBinDir, `${spec.name}.tgz`) : binPath;
+  const downloadDest = isArchive ? path24.join(resolvedBinDir, `${spec.name}.tgz`) : binPath;
   await downloadFile(url, downloadDest);
   if (isArchive) {
     const listing = execFileSync4("tar", ["-tf", downloadDest], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
     validateTarContents(listing, resolvedBinDir);
     execFileSync4("tar", ["-xzf", downloadDest, "-C", resolvedBinDir], { stdio: "pipe" });
     try {
-      fs24.unlinkSync(downloadDest);
+      fs26.unlinkSync(downloadDest);
     } catch {
     }
   }
-  if (!fs24.existsSync(binPath)) {
+  if (!fs26.existsSync(binPath)) {
     throw new Error(`${spec.name}: binary not found at ${binPath} after download/extraction. The archive structure may have changed.`);
   }
   if (!IS_WINDOWS) {
-    fs24.chmodSync(binPath, "755");
+    fs26.chmodSync(binPath, "755");
   }
-  log18.info({ name: spec.name, path: binPath }, "Installed successfully");
+  log19.info({ name: spec.name, path: binPath }, "Installed successfully");
   return binPath;
 }
-var log18, DEFAULT_BIN_DIR, IS_WINDOWS;
+var log19, DEFAULT_BIN_DIR, IS_WINDOWS;
 var init_install_binary = __esm({
   "src/core/utils/install-binary.ts"() {
     "use strict";
     init_log();
     init_agent_dependencies();
     init_agent_installer();
-    log18 = createChildLogger({ module: "binary-installer" });
-    DEFAULT_BIN_DIR = path22.join(os5.homedir(), ".openacp", "bin");
-    IS_WINDOWS = os5.platform() === "win32";
+    log19 = createChildLogger({ module: "binary-installer" });
+    DEFAULT_BIN_DIR = path24.join(os7.homedir(), ".openacp", "bin");
+    IS_WINDOWS = os7.platform() === "win32";
   }
 });
 
@@ -3722,9 +4274,9 @@ var init_install_cloudflared = __esm({
 });
 
 // src/core/doctor/checks/tunnel.ts
-import * as fs25 from "fs";
-import * as path23 from "path";
-import * as os6 from "os";
+import * as fs27 from "fs";
+import * as path25 from "path";
+import * as os8 from "os";
 import { execFileSync as execFileSync5 } from "child_process";
 var tunnelCheck;
 var init_tunnel = __esm({
@@ -3740,7 +4292,7 @@ var init_tunnel = __esm({
           return results;
         }
         const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
-        const sm = new SettingsManager2(path23.join(ctx.pluginsDir, "data"));
+        const sm = new SettingsManager2(path25.join(ctx.pluginsDir, "data"));
         const tunnelSettings = await sm.loadSettings("@openacp/tunnel");
         const tunnelEnabled = tunnelSettings.enabled ?? false;
         const provider = tunnelSettings.provider ?? "cloudflare";
@@ -3751,10 +4303,10 @@ var init_tunnel = __esm({
         }
         results.push({ status: "pass", message: `Tunnel provider: ${provider}` });
         if (provider === "cloudflare") {
-          const binName = os6.platform() === "win32" ? "cloudflared.exe" : "cloudflared";
-          const binPath = path23.join(ctx.dataDir, "bin", binName);
+          const binName = os8.platform() === "win32" ? "cloudflared.exe" : "cloudflared";
+          const binPath = path25.join(ctx.dataDir, "bin", binName);
           let found = false;
-          if (fs25.existsSync(binPath)) {
+          if (fs27.existsSync(binPath)) {
             found = true;
           } else {
             try {
@@ -3828,8 +4380,8 @@ var init_proxy = __esm({
 });
 
 // src/core/doctor/index.ts
-import * as fs26 from "fs";
-import * as path24 from "path";
+import * as fs28 from "fs";
+import * as path26 from "path";
 var ALL_CHECKS, CHECK_TIMEOUT_MS, DoctorEngine;
 var init_doctor = __esm({
   "src/core/doctor/index.ts"() {
@@ -3922,27 +4474,27 @@ var init_doctor = __esm({
       /** Constructs the shared context used by all checks — loads config if available. */
       async buildContext() {
         const dataDir = this.dataDir;
-        const configPath = process.env.OPENACP_CONFIG_PATH || path24.join(dataDir, "config.json");
+        const configPath = process.env.OPENACP_CONFIG_PATH || path26.join(dataDir, "config.json");
         let config = null;
         let rawConfig = null;
         try {
-          const content = fs26.readFileSync(configPath, "utf-8");
+          const content = fs28.readFileSync(configPath, "utf-8");
           rawConfig = JSON.parse(content);
           const cm = new ConfigManager(configPath);
           await cm.load();
           config = cm.get();
         } catch {
         }
-        const logsDir = config ? expandHome2(config.logging.logDir) : path24.join(dataDir, "logs");
+        const logsDir = config ? expandHome2(config.logging.logDir) : path26.join(dataDir, "logs");
         return {
           config,
           rawConfig,
           configPath,
           dataDir,
-          sessionsPath: path24.join(dataDir, "sessions.json"),
-          pidPath: path24.join(dataDir, "openacp.pid"),
-          portFilePath: path24.join(dataDir, "api.port"),
-          pluginsDir: path24.join(dataDir, "plugins"),
+          sessionsPath: path26.join(dataDir, "sessions.json"),
+          pidPath: path26.join(dataDir, "openacp.pid"),
+          portFilePath: path26.join(dataDir, "api.port"),
+          pluginsDir: path26.join(dataDir, "plugins"),
           logsDir,
           fetchForScope: (scope) => this.proxyService.createFetch(scope)
         };
@@ -3951,26 +4503,13 @@ var init_doctor = __esm({
   }
 });
 
-// src/core/instance/instance-context.ts
-import path26 from "path";
-import fs28 from "fs";
-import os8 from "os";
-function getGlobalRoot() {
-  return path26.join(os8.homedir(), ".openacp");
-}
-var init_instance_context = __esm({
-  "src/core/instance/instance-context.ts"() {
-    "use strict";
-  }
-});
-
 // src/core/instance/instance-registry.ts
-import fs29 from "fs";
-import path27 from "path";
+import fs30 from "fs";
+import path28 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 function readIdFromConfig(instanceRoot) {
   try {
-    const raw = JSON.parse(fs29.readFileSync(path27.join(instanceRoot, "config.json"), "utf-8"));
+    const raw = JSON.parse(fs30.readFileSync(path28.join(instanceRoot, "config.json"), "utf-8"));
     return typeof raw.id === "string" && raw.id ? raw.id : null;
   } catch {
     return null;
@@ -3989,7 +4528,7 @@ var init_instance_registry = __esm({
       /** Load the registry from disk. If the file is missing or corrupt, starts fresh. */
       load() {
         try {
-          const raw = fs29.readFileSync(this.registryPath, "utf-8");
+          const raw = fs30.readFileSync(this.registryPath, "utf-8");
           const parsed = JSON.parse(raw);
           if (parsed.version === 1 && parsed.instances) {
             this.data = parsed;
@@ -4016,9 +4555,9 @@ var init_instance_registry = __esm({
       }
       /** Persist the registry to disk, creating parent directories if needed. */
       save() {
-        const dir = path27.dirname(this.registryPath);
-        fs29.mkdirSync(dir, { recursive: true });
-        fs29.writeFileSync(this.registryPath, JSON.stringify(this.data, null, 2));
+        const dir = path28.dirname(this.registryPath);
+        fs30.mkdirSync(dir, { recursive: true });
+        fs30.writeFileSync(this.registryPath, JSON.stringify(this.data, null, 2));
       }
       /** Add or update an instance entry in the registry. Does not persist — call save() after. */
       register(id, root) {
@@ -4085,15 +4624,15 @@ __export(plugin_installer_exports, {
 });
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import * as fs31 from "fs/promises";
-import * as path29 from "path";
+import * as fs32 from "fs/promises";
+import * as path30 from "path";
 import { pathToFileURL } from "url";
 async function importFromDir(packageName, dir) {
-  const pkgDir = path29.join(dir, "node_modules", ...packageName.split("/"));
-  const pkgJsonPath = path29.join(pkgDir, "package.json");
+  const pkgDir = path30.join(dir, "node_modules", ...packageName.split("/"));
+  const pkgJsonPath = path30.join(pkgDir, "package.json");
   let pkgJson;
   try {
-    pkgJson = JSON.parse(await fs31.readFile(pkgJsonPath, "utf-8"));
+    pkgJson = JSON.parse(await fs32.readFile(pkgJsonPath, "utf-8"));
   } catch (err) {
     throw new Error(`Cannot read package.json for "${packageName}" at ${pkgJsonPath}: ${err.message}`);
   }
@@ -4106,9 +4645,9 @@ async function importFromDir(packageName, dir) {
   } else {
     entry = pkgJson.main ?? "index.js";
   }
-  const entryPath = path29.join(pkgDir, entry);
+  const entryPath = path30.join(pkgDir, entry);
   try {
-    await fs31.access(entryPath);
+    await fs32.access(entryPath);
   } catch {
     throw new Error(`Entry point "${entry}" not found for "${packageName}" at ${entryPath}`);
   }
@@ -4201,10 +4740,10 @@ var install_context_exports = {};
 __export(install_context_exports, {
   createInstallContext: () => createInstallContext
 });
-import path30 from "path";
+import path31 from "path";
 function createInstallContext(opts) {
   const { pluginName, settingsManager, basePath, instanceRoot } = opts;
-  const dataDir = path30.join(basePath, pluginName, "data");
+  const dataDir = path31.join(basePath, pluginName, "data");
   return {
     pluginName,
     terminal: createTerminalIO(),
@@ -4232,14 +4771,14 @@ __export(api_client_exports, {
   waitForApiReady: () => waitForApiReady,
   waitForPortFile: () => waitForPortFile
 });
-import * as fs32 from "fs";
-import * as path31 from "path";
+import * as fs33 from "fs";
+import * as path32 from "path";
 import { setTimeout as sleep } from "timers/promises";
 function defaultPortFile(root) {
-  return path31.join(root, "api.port");
+  return path32.join(root, "api.port");
 }
 function defaultSecretFile(root) {
-  return path31.join(root, "api-secret");
+  return path32.join(root, "api-secret");
 }
 async function waitForPortFile(portFilePath, timeoutMs = 5e3, intervalMs = 100) {
   const deadline = Date.now() + timeoutMs;
@@ -4273,7 +4812,7 @@ async function waitForApiReady(instanceRoot, expectedInstanceId, timeoutMs = 1e4
 function readApiPort(portFilePath, instanceRoot) {
   const filePath = portFilePath ?? defaultPortFile(instanceRoot);
   try {
-    const content = fs32.readFileSync(filePath, "utf-8").trim();
+    const content = fs33.readFileSync(filePath, "utf-8").trim();
     const port = parseInt(content, 10);
     return isNaN(port) ? null : port;
   } catch {
@@ -4283,7 +4822,7 @@ function readApiPort(portFilePath, instanceRoot) {
 function readApiSecret(secretFilePath, instanceRoot) {
   const filePath = secretFilePath ?? defaultSecretFile(instanceRoot);
   try {
-    const content = fs32.readFileSync(filePath, "utf-8").trim();
+    const content = fs33.readFileSync(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -4292,7 +4831,7 @@ function readApiSecret(secretFilePath, instanceRoot) {
 function removeStalePortFile(portFilePath, instanceRoot) {
   const filePath = portFilePath ?? defaultPortFile(instanceRoot);
   try {
-    fs32.unlinkSync(filePath);
+    fs33.unlinkSync(filePath);
   } catch {
   }
 }
@@ -4429,8 +4968,8 @@ var init_notification = __esm({
 });
 
 // src/plugins/file-service/file-service.ts
-import fs34 from "fs";
-import path34 from "path";
+import fs35 from "fs";
+import path35 from "path";
 import { OggOpusDecoder } from "ogg-opus-decoder";
 import wav from "node-wav";
 function classifyMime(mimeType) {
@@ -4487,14 +5026,14 @@ var init_file_service = __esm({
         const cutoff = Date.now() - maxAgeDays * 24 * 60 * 60 * 1e3;
         let removed = 0;
         try {
-          const entries = await fs34.promises.readdir(this.baseDir, { withFileTypes: true });
+          const entries = await fs35.promises.readdir(this.baseDir, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory()) continue;
-            const dirPath = path34.join(this.baseDir, entry.name);
+            const dirPath = path35.join(this.baseDir, entry.name);
             try {
-              const stat = await fs34.promises.stat(dirPath);
+              const stat = await fs35.promises.stat(dirPath);
               if (stat.mtimeMs < cutoff) {
-                await fs34.promises.rm(dirPath, { recursive: true, force: true });
+                await fs35.promises.rm(dirPath, { recursive: true, force: true });
                 removed++;
               }
             } catch {
@@ -4513,11 +5052,11 @@ var init_file_service = __esm({
        * so the user-facing name is not lost.
        */
       async saveFile(sessionId, fileName, data, mimeType) {
-        const sessionDir = path34.join(this.baseDir, sessionId);
-        await fs34.promises.mkdir(sessionDir, { recursive: true });
+        const sessionDir = path35.join(this.baseDir, sessionId);
+        await fs35.promises.mkdir(sessionDir, { recursive: true });
         const safeName = `${Date.now()}-${fileName.replace(/[^a-zA-Z0-9._-]/g, "_")}`;
-        const filePath = path34.join(sessionDir, safeName);
-        await fs34.promises.writeFile(filePath, data);
+        const filePath = path35.join(sessionDir, safeName);
+        await fs35.promises.writeFile(filePath, data);
         return {
           type: classifyMime(mimeType),
           filePath,
@@ -4532,14 +5071,14 @@ var init_file_service = __esm({
        */
       async resolveFile(filePath) {
         try {
-          const stat = await fs34.promises.stat(filePath);
+          const stat = await fs35.promises.stat(filePath);
           if (!stat.isFile()) return null;
-          const ext = path34.extname(filePath).toLowerCase();
+          const ext = path35.extname(filePath).toLowerCase();
           const mimeType = EXT_TO_MIME[ext] || "application/octet-stream";
           return {
             type: classifyMime(mimeType),
             filePath,
-            fileName: path34.basename(filePath),
+            fileName: path35.basename(filePath),
             mimeType,
             size: stat.size
           };
@@ -4804,7 +5343,7 @@ function createAuthPreHandler(getSecret, getJwtSecret, tokenStore) {
     const queryToken = request.query?.token;
     const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : queryToken;
     if (queryToken && !authHeader) {
-      log22.warn(
+      log23.warn(
         { url: request.url.replace(/([?&]token=)[^&]+/, "$1[REDACTED]") },
         "Token passed via URL query param \u2014 use Authorization: Bearer header to avoid token leakage in tunnel/proxy logs"
       );
@@ -4858,7 +5397,7 @@ function requireRole(role) {
     }
   };
 }
-var log22;
+var log23;
 var init_auth = __esm({
   "src/plugins/api-server/middleware/auth.ts"() {
     "use strict";
@@ -4866,7 +5405,7 @@ var init_auth = __esm({
     init_jwt();
     init_roles();
     init_log();
-    log22 = createChildLogger({ module: "api-auth" });
+    log23 = createChildLogger({ module: "api-auth" });
   }
 });
 
@@ -5182,8 +5721,8 @@ data: ${JSON.stringify(data)}
 });
 
 // src/plugins/api-server/static-server.ts
-import * as fs35 from "fs";
-import * as path35 from "path";
+import * as fs36 from "fs";
+import * as path36 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var MIME_TYPES, StaticServer;
 var init_static_server = __esm({
@@ -5207,16 +5746,16 @@ var init_static_server = __esm({
         this.uiDir = uiDir;
         if (!this.uiDir) {
           const __filename = fileURLToPath2(import.meta.url);
-          const candidate = path35.resolve(path35.dirname(__filename), "../../ui/dist");
-          if (fs35.existsSync(path35.join(candidate, "index.html"))) {
+          const candidate = path36.resolve(path36.dirname(__filename), "../../ui/dist");
+          if (fs36.existsSync(path36.join(candidate, "index.html"))) {
             this.uiDir = candidate;
           }
           if (!this.uiDir) {
-            const publishCandidate = path35.resolve(
-              path35.dirname(__filename),
+            const publishCandidate = path36.resolve(
+              path36.dirname(__filename),
               "../ui"
             );
-            if (fs35.existsSync(path35.join(publishCandidate, "index.html"))) {
+            if (fs36.existsSync(path36.join(publishCandidate, "index.html"))) {
               this.uiDir = publishCandidate;
             }
           }
@@ -5234,23 +5773,23 @@ var init_static_server = __esm({
       serve(req, res) {
         if (!this.uiDir) return false;
         const urlPath = (req.url || "/").split("?")[0];
-        const safePath = path35.normalize(urlPath);
-        const filePath = path35.join(this.uiDir, safePath);
-        if (!filePath.startsWith(this.uiDir + path35.sep) && filePath !== this.uiDir)
+        const safePath = path36.normalize(urlPath);
+        const filePath = path36.join(this.uiDir, safePath);
+        if (!filePath.startsWith(this.uiDir + path36.sep) && filePath !== this.uiDir)
           return false;
         let realFilePath;
         try {
-          realFilePath = fs35.realpathSync(filePath);
+          realFilePath = fs36.realpathSync(filePath);
         } catch {
           realFilePath = null;
         }
         if (realFilePath !== null) {
-          const realUiDir = fs35.realpathSync(this.uiDir);
-          if (!realFilePath.startsWith(realUiDir + path35.sep) && realFilePath !== realUiDir)
+          const realUiDir = fs36.realpathSync(this.uiDir);
+          if (!realFilePath.startsWith(realUiDir + path36.sep) && realFilePath !== realUiDir)
             return false;
         }
-        if (realFilePath !== null && fs35.existsSync(realFilePath) && fs35.statSync(realFilePath).isFile()) {
-          const ext = path35.extname(filePath);
+        if (realFilePath !== null && fs36.existsSync(realFilePath) && fs36.statSync(realFilePath).isFile()) {
+          const ext = path36.extname(filePath);
           const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
           const isHashed = /\.[a-zA-Z0-9]{8,}\.(js|css)$/.test(filePath);
           const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "no-cache";
@@ -5258,16 +5797,16 @@ var init_static_server = __esm({
             "Content-Type": contentType,
             "Cache-Control": cacheControl
           });
-          fs35.createReadStream(realFilePath).pipe(res);
+          fs36.createReadStream(realFilePath).pipe(res);
           return true;
         }
-        const indexPath = path35.join(this.uiDir, "index.html");
-        if (fs35.existsSync(indexPath)) {
+        const indexPath = path36.join(this.uiDir, "index.html");
+        if (fs36.existsSync(indexPath)) {
           res.writeHead(200, {
             "Content-Type": "text/html; charset=utf-8",
             "Cache-Control": "no-cache"
           });
-          fs35.createReadStream(indexPath).pipe(res);
+          fs36.createReadStream(indexPath).pipe(res);
           return true;
         }
         return false;
@@ -5390,8 +5929,8 @@ var init_exports = __esm({
 });
 
 // src/plugins/context/context-cache.ts
-import * as fs36 from "fs";
-import * as path36 from "path";
+import * as fs37 from "fs";
+import * as path37 from "path";
 import * as crypto2 from "crypto";
 var DEFAULT_TTL_MS, ContextCache;
 var init_context_cache = __esm({
@@ -5402,7 +5941,7 @@ var init_context_cache = __esm({
       constructor(cacheDir, ttlMs = DEFAULT_TTL_MS) {
         this.cacheDir = cacheDir;
         this.ttlMs = ttlMs;
-        fs36.mkdirSync(cacheDir, { recursive: true });
+        fs37.mkdirSync(cacheDir, { recursive: true });
       }
       cacheDir;
       ttlMs;
@@ -5410,23 +5949,23 @@ var init_context_cache = __esm({
         return crypto2.createHash("sha256").update(`${repoPath}:${queryKey}`).digest("hex").slice(0, 16);
       }
       filePath(repoPath, queryKey) {
-        return path36.join(this.cacheDir, `${this.keyHash(repoPath, queryKey)}.json`);
+        return path37.join(this.cacheDir, `${this.keyHash(repoPath, queryKey)}.json`);
       }
       get(repoPath, queryKey) {
         const fp = this.filePath(repoPath, queryKey);
         try {
-          const stat = fs36.statSync(fp);
+          const stat = fs37.statSync(fp);
           if (Date.now() - stat.mtimeMs > this.ttlMs) {
-            fs36.unlinkSync(fp);
+            fs37.unlinkSync(fp);
             return null;
           }
-          return JSON.parse(fs36.readFileSync(fp, "utf-8"));
+          return JSON.parse(fs37.readFileSync(fp, "utf-8"));
         } catch {
           return null;
         }
       }
       set(repoPath, queryKey, result) {
-        fs36.writeFileSync(this.filePath(repoPath, queryKey), JSON.stringify(result));
+        fs37.writeFileSync(this.filePath(repoPath, queryKey), JSON.stringify(result));
       }
     };
   }
@@ -6400,8 +6939,8 @@ function formatToolSummary(name, rawInput, displaySummary) {
   }
   if (lowerName === "grep") {
     const pattern = args.pattern ?? "";
-    const path37 = args.path ?? "";
-    return pattern ? `\u{1F50D} Grep "${pattern}"${path37 ? ` in ${path37}` : ""}` : `\u{1F527} ${name}`;
+    const path38 = args.path ?? "";
+    return pattern ? `\u{1F50D} Grep "${pattern}"${path38 ? ` in ${path38}` : ""}` : `\u{1F527} ${name}`;
   }
   if (lowerName === "glob") {
     const pattern = args.pattern ?? "";
@@ -6437,8 +6976,8 @@ function formatToolTitle(name, rawInput, displayTitle) {
   }
   if (lowerName === "grep") {
     const pattern = args.pattern ?? "";
-    const path37 = args.path ?? "";
-    return pattern ? `"${pattern}"${path37 ? ` in ${path37}` : ""}` : name;
+    const path38 = args.path ?? "";
+    return pattern ? `"${pattern}"${path38 ? ` in ${path38}` : ""}` : name;
   }
   if (lowerName === "glob") {
     return String(args.pattern ?? name);
@@ -7890,7 +8429,7 @@ function setupDangerousModeCallbacks(bot, core) {
         }).catch(() => {
         });
       }
-      log24.info({ sessionId, wantOn }, "Bypass permissions toggled via button");
+      log25.info({ sessionId, wantOn }, "Bypass permissions toggled via button");
       try {
         await ctx.editMessageText(buildSessionStatusText(session), {
           parse_mode: "HTML",
@@ -7913,7 +8452,7 @@ function setupDangerousModeCallbacks(bot, core) {
     const newDangerousMode = !(record.clientOverrides?.bypassPermissions ?? record.dangerousMode ?? false);
     core.sessionManager.patchRecord(sessionId, { clientOverrides: { bypassPermissions: newDangerousMode } }).catch(() => {
     });
-    log24.info(
+    log25.info(
       { sessionId, dangerousMode: newDangerousMode },
       "Bypass permissions toggled via button (store-only, session not in memory)"
     );
@@ -8103,14 +8642,14 @@ async function handleRestart(ctx, core) {
   await new Promise((r) => setTimeout(r, 500));
   await core.requestRestart();
 }
-var log24, OUTPUT_MODE_LABELS;
+var log25, OUTPUT_MODE_LABELS;
 var init_admin = __esm({
   "src/plugins/telegram/commands/admin.ts"() {
     "use strict";
     init_bypass_detection();
     init_formatting();
     init_log();
-    log24 = createChildLogger({ module: "telegram-cmd-admin" });
+    log25 = createChildLogger({ module: "telegram-cmd-admin" });
     OUTPUT_MODE_LABELS = {
       low: "\u{1F507} Low",
       medium: "\u{1F4CA} Medium",
@@ -8125,7 +8664,7 @@ function botFromCtx(ctx) {
   return { api: ctx.api };
 }
 async function createSessionDirect(ctx, core, chatId, agentName, workspace, onControlMessage) {
-  log25.info({ userId: ctx.from?.id, agentName, workspace }, "New session command (direct)");
+  log26.info({ userId: ctx.from?.id, agentName, workspace }, "New session command (direct)");
   let threadId;
   try {
     const topicName = `\u{1F504} New Session`;
@@ -8152,7 +8691,7 @@ async function createSessionDirect(ctx, core, chatId, agentName, workspace, onCo
     onControlMessage?.(session.id, controlMsg.message_id);
     return threadId ?? null;
   } catch (err) {
-    log25.error({ err }, "Session creation failed");
+    log26.error({ err }, "Session creation failed");
     if (threadId) {
       try {
         await ctx.api.deleteForumTopic(chatId, threadId);
@@ -8385,7 +8924,7 @@ Agent: <code>${escapeHtml(agentKey)}</code>
     await _sendCustomPathPrompt(ctx, chatId, agentKey);
   });
 }
-var log25, WS_CACHE_MAX, workspaceCache, nextWsId, _forceReplyMap;
+var log26, WS_CACHE_MAX, workspaceCache, nextWsId, _forceReplyMap;
 var init_new_session = __esm({
   "src/plugins/telegram/commands/new-session.ts"() {
     "use strict";
@@ -8393,7 +8932,7 @@ var init_new_session = __esm({
     init_topics();
     init_log();
     init_admin();
-    log25 = createChildLogger({ module: "telegram-cmd-new-session" });
+    log26 = createChildLogger({ module: "telegram-cmd-new-session" });
     WS_CACHE_MAX = 50;
     workspaceCache = /* @__PURE__ */ new Map();
     nextWsId = 0;
@@ -8458,7 +8997,7 @@ ${lines.join("\n")}${truncated}`,
       { parse_mode: "HTML", reply_markup: keyboard }
     );
   } catch (err) {
-    log26.error({ err }, "handleTopics error");
+    log27.error({ err }, "handleTopics error");
     await ctx.reply("\u274C Failed to list sessions.", { parse_mode: "HTML" }).catch(() => {
     });
   }
@@ -8479,13 +9018,13 @@ async function handleCleanup(ctx, core, chatId, statuses) {
         try {
           await ctx.api.deleteForumTopic(chatId, topicId);
         } catch (err) {
-          log26.warn({ err, sessionId: record.sessionId, topicId }, "Failed to delete forum topic during cleanup");
+          log27.warn({ err, sessionId: record.sessionId, topicId }, "Failed to delete forum topic during cleanup");
         }
       }
       await core.sessionManager.removeRecord(record.sessionId);
       deleted++;
     } catch (err) {
-      log26.error({ err, sessionId: record.sessionId }, "Failed to cleanup session");
+      log27.error({ err, sessionId: record.sessionId }, "Failed to cleanup session");
       failed++;
     }
   }
@@ -8556,7 +9095,7 @@ async function handleCleanupEverythingConfirmed(ctx, core, chatId, systemTopicId
         try {
           await core.sessionManager.cancelSession(record.sessionId);
         } catch (err) {
-          log26.warn({ err, sessionId: record.sessionId }, "Failed to cancel session during cleanup");
+          log27.warn({ err, sessionId: record.sessionId }, "Failed to cancel session during cleanup");
         }
       }
       const topicId = record.platform?.topicId;
@@ -8564,13 +9103,13 @@ async function handleCleanupEverythingConfirmed(ctx, core, chatId, systemTopicId
         try {
           await ctx.api.deleteForumTopic(chatId, topicId);
         } catch (err) {
-          log26.warn({ err, sessionId: record.sessionId, topicId }, "Failed to delete forum topic during cleanup");
+          log27.warn({ err, sessionId: record.sessionId, topicId }, "Failed to delete forum topic during cleanup");
         }
       }
       await core.sessionManager.removeRecord(record.sessionId);
       deleted++;
     } catch (err) {
-      log26.error({ err, sessionId: record.sessionId }, "Failed to cleanup session");
+      log27.error({ err, sessionId: record.sessionId }, "Failed to cleanup session");
       failed++;
     }
   }
@@ -8638,13 +9177,13 @@ async function handleArchiveConfirm(ctx, core, chatId) {
     }
   }
 }
-var log26;
+var log27;
 var init_session = __esm({
   "src/plugins/telegram/commands/session.ts"() {
     "use strict";
     init_formatting();
     init_log();
-    log26 = createChildLogger({ module: "telegram-cmd-session" });
+    log27 = createChildLogger({ module: "telegram-cmd-session" });
   }
 });
 
@@ -9471,7 +10010,7 @@ var init_model = __esm({
 // src/plugins/telegram/commands/resume.ts
 function setupResumeCallbacks(_bot, _core, _chatId, _onControlMessage) {
 }
-var log27;
+var log28;
 var init_resume = __esm({
   "src/plugins/telegram/commands/resume.ts"() {
     "use strict";
@@ -9481,7 +10020,7 @@ var init_resume = __esm({
     init_topics();
     init_admin();
     init_log();
-    log27 = createChildLogger({ module: "telegram-cmd-resume" });
+    log28 = createChildLogger({ module: "telegram-cmd-resume" });
   }
 });
 
@@ -9644,7 +10183,7 @@ function setupSettingsCallbacks(bot, core, getAssistantSession) {
       } catch {
       }
     } catch (err) {
-      log28.error({ err, fieldPath }, "Failed to toggle config");
+      log29.error({ err, fieldPath }, "Failed to toggle config");
       try {
         await ctx.answerCallbackQuery({ text: "\u274C Failed to update" });
       } catch {
@@ -9725,7 +10264,7 @@ Tap to change:`, {
       } catch {
       }
     } catch (err) {
-      log28.error({ err, fieldPath }, "Failed to set config");
+      log29.error({ err, fieldPath }, "Failed to set config");
       try {
         await ctx.answerCallbackQuery({ text: "\u274C Failed to update" });
       } catch {
@@ -9783,13 +10322,13 @@ Tap to change:`, {
     }
   });
 }
-var log28;
+var log29;
 var init_settings = __esm({
   "src/plugins/telegram/commands/settings.ts"() {
     "use strict";
     init_config_registry();
     init_log();
-    log28 = createChildLogger({ module: "telegram-settings" });
+    log29 = createChildLogger({ module: "telegram-settings" });
   }
 });
 
@@ -9836,7 +10375,7 @@ async function handleDoctor(ctx, core) {
       reply_markup: keyboard
     });
   } catch (err) {
-    log29.error({ err }, "Doctor command failed");
+    log30.error({ err }, "Doctor command failed");
     await ctx.api.editMessageText(
       ctx.chat.id,
       statusMsg.message_id,
@@ -9885,7 +10424,7 @@ function setupDoctorCallbacks(bot, core) {
         }
       }
     } catch (err) {
-      log29.error({ err, index }, "Doctor fix callback failed");
+      log30.error({ err, index }, "Doctor fix callback failed");
     }
   });
   bot.callbackQuery("m:doctor", async (ctx) => {
@@ -9896,13 +10435,13 @@ function setupDoctorCallbacks(bot, core) {
     await handleDoctor(ctx, core);
   });
 }
-var log29, pendingFixesStore;
+var log30, pendingFixesStore;
 var init_doctor2 = __esm({
   "src/plugins/telegram/commands/doctor.ts"() {
     "use strict";
     init_doctor();
     init_log();
-    log29 = createChildLogger({ module: "telegram-cmd-doctor" });
+    log30 = createChildLogger({ module: "telegram-cmd-doctor" });
     pendingFixesStore = /* @__PURE__ */ new Map();
   }
 });
@@ -9961,13 +10500,13 @@ function setupTunnelCallbacks(bot, core) {
     }
   });
 }
-var log30;
+var log31;
 var init_tunnel2 = __esm({
   "src/plugins/telegram/commands/tunnel.ts"() {
     "use strict";
     init_formatting();
     init_log();
-    log30 = createChildLogger({ module: "telegram-cmd-tunnel" });
+    log31 = createChildLogger({ module: "telegram-cmd-tunnel" });
   }
 });
 
@@ -9981,10 +10520,10 @@ async function executeSwitchAgent(ctx, core, sessionId, agentName) {
       `Switched to <b>${escapeHtml(agentName)}</b> (${status})`,
       { parse_mode: "HTML" }
     );
-    log31.info({ sessionId, agentName, resumed }, "Agent switched via /switch");
+    log32.info({ sessionId, agentName, resumed }, "Agent switched via /switch");
   } catch (err) {
     await ctx.reply(`Failed to switch agent: ${escapeHtml(String(err.message || err))}`);
-    log31.warn({ sessionId, agentName, err: err.message }, "Agent switch failed");
+    log32.warn({ sessionId, agentName, err: err.message }, "Agent switch failed");
   }
 }
 function setupSwitchCallbacks(bot, core) {
@@ -10029,13 +10568,13 @@ Switch to <b>${escapeHtml(agentName)}</b> anyway?`,
     await executeSwitchAgent(ctx, core, session.id, data);
   });
 }
-var log31;
+var log32;
 var init_switch = __esm({
   "src/plugins/telegram/commands/switch.ts"() {
     "use strict";
     init_formatting();
     init_log();
-    log31 = createChildLogger({ module: "telegram-cmd-switch" });
+    log32 = createChildLogger({ module: "telegram-cmd-switch" });
   }
 });
 
@@ -10258,7 +10797,7 @@ function setupAllCallbacks(bot, core, chatId, systemTopicIds, getAssistantSessio
     if (!menuRegistry) return;
     const item = menuRegistry.getItem(itemId);
     if (!item) {
-      log32.warn({ itemId }, "Menu item not found in registry");
+      log33.warn({ itemId }, "Menu item not found in registry");
       return;
     }
     const topicId = ctx.callbackQuery.message?.message_thread_id;
@@ -10344,7 +10883,7 @@ ${lines}`, { parse_mode: "HTML" }).catch(() => {
     }
   });
 }
-var log32, STATIC_COMMANDS;
+var log33, STATIC_COMMANDS;
 var init_commands = __esm({
   "src/plugins/telegram/commands/index.ts"() {
     "use strict";
@@ -10370,7 +10909,7 @@ var init_commands = __esm({
     init_settings();
     init_doctor2();
     init_resume();
-    log32 = createChildLogger({ module: "telegram-menu-callbacks" });
+    log33 = createChildLogger({ module: "telegram-menu-callbacks" });
     STATIC_COMMANDS = [
       { command: "new", description: "Create new session" },
       { command: "newchat", description: "New chat, same agent & workspace" },
@@ -10386,6 +10925,7 @@ var init_commands = __esm({
       { command: "restart", description: "Restart OpenACP" },
       { command: "update", description: "Update to latest version and restart" },
       { command: "doctor", description: "Run system diagnostics" },
+      { command: "proxy", description: "Manage scoped proxy routing" },
       { command: "retry", description: "Re-check setup prerequisites (use if bot is stuck on startup)" },
       { command: "tunnel", description: "Create/stop tunnel for a local port" },
       { command: "tunnels", description: "List active tunnels" },
@@ -10406,14 +10946,14 @@ var init_commands = __esm({
 // src/plugins/telegram/permissions.ts
 import { InlineKeyboard as InlineKeyboard12 } from "grammy";
 import { nanoid as nanoid4 } from "nanoid";
-var log33, PermissionHandler;
+var log34, PermissionHandler;
 var init_permissions = __esm({
   "src/plugins/telegram/permissions.ts"() {
     "use strict";
     init_formatting();
     init_topics();
     init_log();
-    log33 = createChildLogger({ module: "telegram-permissions" });
+    log34 = createChildLogger({ module: "telegram-permissions" });
     PermissionHandler = class {
       constructor(bot, chatId, getSession, sendNotification) {
         this.bot = bot;
@@ -10491,7 +11031,7 @@ ${escapeHtml(request.description)}`,
           }
           const session = this.getSession(pending.sessionId);
           const isAllow = pending.options.find((o) => o.id === optionId)?.isAllow ?? false;
-          log33.info({ requestId: pending.requestId, optionId, isAllow }, "Permission responded");
+          log34.info({ requestId: pending.requestId, optionId, isAllow }, "Permission responded");
           if (session?.permissionGate.requestId === pending.requestId) {
             session.permissionGate.resolve(optionId);
           }
@@ -10511,7 +11051,7 @@ ${escapeHtml(request.description)}`,
 });
 
 // src/plugins/telegram/activity.ts
-var log34, THINKING_REFRESH_MS, THINKING_MAX_MS, ThinkingIndicator, ToolCard, ActivityTracker2;
+var log35, THINKING_REFRESH_MS, THINKING_MAX_MS, ThinkingIndicator, ToolCard, ActivityTracker2;
 var init_activity = __esm({
   "src/plugins/telegram/activity.ts"() {
     "use strict";
@@ -10521,7 +11061,7 @@ var init_activity = __esm({
     init_stream_accumulator();
     init_stream_accumulator();
     init_display_spec_builder();
-    log34 = createChildLogger({ module: "telegram:activity" });
+    log35 = createChildLogger({ module: "telegram:activity" });
     THINKING_REFRESH_MS = 15e3;
     THINKING_MAX_MS = 3 * 60 * 1e3;
     ThinkingIndicator = class {
@@ -10567,7 +11107,7 @@ var init_activity = __esm({
             }
           }
         } catch (err) {
-          log34.warn({ err }, "ThinkingIndicator.show() failed");
+          log35.warn({ err }, "ThinkingIndicator.show() failed");
         } finally {
           this.sending = false;
         }
@@ -10744,7 +11284,7 @@ var init_activity = __esm({
             this.tracer?.log("telegram", { action: "telegram:delete:overflow", sessionId: this.sessionId, msgId: staleId });
           }
         } catch (err) {
-          log34.warn({ err }, "[ToolCard] send/edit failed");
+          log35.warn({ err }, "[ToolCard] send/edit failed");
         }
       }
     };
@@ -10852,7 +11392,7 @@ var init_activity = __esm({
         const entry = this.toolStateMap.merge(id, status, rawInput, content, viewerLinks, diffStats);
         if (!existed || !entry) return;
         if (viewerLinks || entry.viewerLinks) {
-          log34.debug({ toolId: id, status, hasIncomingLinks: !!viewerLinks, hasEntryLinks: !!entry.viewerLinks, entryLinks: entry.viewerLinks }, "toolUpdate: viewer links trace");
+          log35.debug({ toolId: id, status, hasIncomingLinks: !!viewerLinks, hasEntryLinks: !!entry.viewerLinks, entryLinks: entry.viewerLinks }, "toolUpdate: viewer links trace");
         }
         const spec = this.specBuilder.buildToolSpec(entry, this._outputMode, this.sessionContext);
         this.toolCard.updateFromSpec(spec);
@@ -11210,13 +11750,13 @@ var init_draft_manager = __esm({
 });
 
 // src/plugins/telegram/skill-command-manager.ts
-var log35, SkillCommandManager;
+var log36, SkillCommandManager;
 var init_skill_command_manager = __esm({
   "src/plugins/telegram/skill-command-manager.ts"() {
     "use strict";
     init_commands();
     init_log();
-    log35 = createChildLogger({ module: "skill-commands" });
+    log36 = createChildLogger({ module: "skill-commands" });
     SkillCommandManager = class {
       constructor(bot, chatId, sendQueue, sessionManager) {
         this.bot = bot;
@@ -11291,7 +11831,7 @@ var init_skill_command_manager = __esm({
             disable_notification: true
           });
         } catch (err) {
-          log35.error({ err, sessionId }, "Failed to send skill commands");
+          log36.error({ err, sessionId }, "Failed to send skill commands");
         }
       }
       async cleanup(sessionId) {
@@ -11397,6 +11937,185 @@ var init_renderer2 = __esm({
   }
 });
 
+// src/plugins/identity/types.ts
+var init_types = __esm({
+  "src/plugins/identity/types.ts"() {
+    "use strict";
+  }
+});
+
+// src/core/commands/proxy.ts
+import { randomUUID as randomUUID3 } from "crypto";
+function clearProxyDraftsForChannel(channelId) {
+  const prefix = `${channelId}:`;
+  for (const [id, draft] of drafts) if (draft.owner.startsWith(prefix)) drafts.delete(id);
+}
+var DRAFT_TTL_MS, drafts;
+var init_proxy2 = __esm({
+  "src/core/commands/proxy.ts"() {
+    "use strict";
+    init_proxy_types();
+    init_types();
+    init_proxy_store();
+    init_proxy_service();
+    DRAFT_TTL_MS = 10 * 6e4;
+    drafts = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/plugins/telegram/command-sync.ts
+import { createHash as createHash4 } from "crypto";
+function validDescription(description) {
+  if (typeof description !== "string") return false;
+  const trimmed = description.trim();
+  return trimmed.length > 0 && trimmed.length <= TELEGRAM_DESCRIPTION_LIMIT;
+}
+function prepareTelegramCommandBoundary(coreCommands, registryCommands) {
+  if (coreCommands.length > TELEGRAM_COMMAND_LIMIT) {
+    throw new TelegramCommandBoundaryError("OpenACP core defines more than 100 Telegram commands");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const commands = [];
+  for (const command of coreCommands) {
+    if (!TELEGRAM_COMMAND_NAME.test(command.command) || !validDescription(command.description)) {
+      throw new TelegramCommandBoundaryError("OpenACP core contains an invalid Telegram command definition");
+    }
+    if (seen.has(command.command)) throw new TelegramCommandBoundaryError("OpenACP core contains a duplicate Telegram command definition");
+    seen.add(command.command);
+    commands.push({ command: command.command, description: command.description.trim() });
+  }
+  const skipped = { invalidName: 0, invalidDescription: 0, duplicate: 0, overflow: 0 };
+  const validPlugins = [];
+  for (const command of registryCommands) {
+    if (command.category !== "plugin") continue;
+    if (!TELEGRAM_COMMAND_NAME.test(command.name)) {
+      skipped.invalidName++;
+      continue;
+    }
+    if (!validDescription(command.description)) {
+      skipped.invalidDescription++;
+      continue;
+    }
+    if (seen.has(command.name) || validPlugins.some((entry) => entry.command === command.name)) {
+      skipped.duplicate++;
+      continue;
+    }
+    validPlugins.push({ command: command.name, description: command.description.trim() });
+  }
+  validPlugins.sort((a, b) => a.command.localeCompare(b.command) || a.description.localeCompare(b.description));
+  const capacity = TELEGRAM_COMMAND_LIMIT - commands.length;
+  skipped.overflow = Math.max(0, validPlugins.length - capacity);
+  commands.push(...validPlugins.slice(0, capacity));
+  return { commands, skipped };
+}
+function assertTelegramCommandBoundary(commands) {
+  if (commands.length > TELEGRAM_COMMAND_LIMIT) throw new TelegramCommandBoundaryError("Telegram command list exceeds 100 entries");
+  const seen = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    if (!TELEGRAM_COMMAND_NAME.test(command.command) || !validDescription(command.description) || seen.has(command.command)) {
+      throw new TelegramCommandBoundaryError("Telegram command list failed validation before synchronization");
+    }
+    seen.add(command.command);
+  }
+}
+function commandsEqual(current, desired) {
+  return current.length === desired.length && current.every((command, index) => {
+    const expected = desired[index];
+    return command.command === expected?.command && command.description === expected.description;
+  });
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw signal.reason ?? new DOMException("Aborted", "AbortError");
+}
+function localeLabel(locale) {
+  return locale || "neutral";
+}
+async function synchronizeTelegramCommands(api, chatId, desired, options) {
+  if (!/^\d{1,20}$/.test(options.botId)) throw new Error("Telegram bot identity is invalid");
+  assertTelegramCommandBoundary(desired);
+  const chatKey = createHash4("sha256").update(String(chatId)).digest("hex").slice(0, 16);
+  const scopes = [
+    { name: "default", scope: { type: "default" }, ledgerName: "default" },
+    { name: "chat", scope: { type: "chat", chat_id: chatId }, ledgerName: `chat:${chatKey}` },
+    {
+      name: "chat_administrators",
+      scope: { type: "chat_administrators", chat_id: chatId },
+      ledgerName: `chat_administrators:${chatKey}`,
+      onlyWhenPresent: true
+    }
+  ];
+  const desiredNames = new Set(desired.map((command) => command.command));
+  const result = { updated: [], unchanged: [] };
+  const initialConservative = await options.ownershipStore.withLock(async ({ ledger, conservative }) => {
+    options.ownershipStore.claimOwner(ledger, options.botId, options.ownerIdentity, options.allowOwnerTakeover);
+    options.ownershipStore.save(ledger);
+    return conservative;
+  });
+  options.onOwnerClaimed?.();
+  for (const locale of TELEGRAM_COMMAND_LOCALES) {
+    for (const entry of scopes) {
+      throwIfAborted(options.signal);
+      const label = `${entry.name}:${localeLabel(locale)}`;
+      const scopeKey = `${entry.ledgerName}|${localeLabel(locale)}`;
+      const apiOptions = {
+        scope: entry.scope,
+        ...locale ? { language_code: locale } : {}
+      };
+      const current = await api.getMyCommands(apiOptions, options.signal);
+      throwIfAborted(options.signal);
+      const ownership = await options.ownershipStore.withLock(async ({ ledger, conservative }) => ({
+        priorOwned: options.ownershipStore.getOwned(ledger, options.botId, scopeKey),
+        conservative
+      }));
+      if (entry.onlyWhenPresent && current.length === 0) {
+        await options.ownershipStore.withLock(async ({ ledger }) => {
+          options.ownershipStore.claimOwner(ledger, options.botId, options.ownerIdentity);
+          options.ownershipStore.setOwned(ledger, options.botId, scopeKey, []);
+          options.ownershipStore.save(ledger);
+        });
+        result.unchanged.push(label);
+        continue;
+      }
+      const owned = new Set(ownership.priorOwned ?? (initialConservative || ownership.conservative ? [] : options.historicalOwnedNames));
+      const unmanaged = current.filter((command) => !desiredNames.has(command.command) && !owned.has(command.command));
+      const merged = [...desired, ...unmanaged];
+      if (merged.length > 100) {
+        throw new Error(`Telegram command scope ${label} has no capacity for OpenACP commands without deleting unmanaged commands`);
+      }
+      if (!commandsEqual(current, merged)) {
+        throwIfAborted(options.signal);
+        await api.setMyCommands(merged, apiOptions, options.signal);
+        result.updated.push(label);
+      } else {
+        result.unchanged.push(label);
+      }
+      throwIfAborted(options.signal);
+      await options.ownershipStore.withLock(async ({ ledger }) => {
+        options.ownershipStore.claimOwner(ledger, options.botId, options.ownerIdentity);
+        options.ownershipStore.setOwned(ledger, options.botId, scopeKey, [...desiredNames]);
+        options.ownershipStore.save(ledger);
+      });
+    }
+  }
+  return result;
+}
+var TelegramCommandBoundaryError, TELEGRAM_COMMAND_NAME, TELEGRAM_COMMAND_LIMIT, TELEGRAM_DESCRIPTION_LIMIT;
+var init_command_sync = __esm({
+  "src/plugins/telegram/command-sync.ts"() {
+    "use strict";
+    init_telegram_command_scopes();
+    TelegramCommandBoundaryError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "TelegramCommandBoundaryError";
+      }
+    };
+    TELEGRAM_COMMAND_NAME = /^[a-z0-9_]{1,32}$/;
+    TELEGRAM_COMMAND_LIMIT = 100;
+    TELEGRAM_DESCRIPTION_LIMIT = 256;
+  }
+});
+
 // src/plugins/telegram/validators.ts
 var validators_exports = {};
 __export(validators_exports, {
@@ -11471,7 +12190,7 @@ async function validateBotAdmin(token, chatId, telegramFetch) {
       };
     }
     const { status } = data.result;
-    log36.info(
+    log37.info(
       { status, can_manage_topics: data.result.can_manage_topics, raw_result: data.result },
       "validateBotAdmin: getChatMember raw result"
     );
@@ -11491,7 +12210,7 @@ async function validateBotAdmin(token, chatId, telegramFetch) {
 }
 async function checkTopicsPrerequisites(token, chatId, telegramFetch) {
   const issues = [];
-  log36.info({ chatId }, "checkTopicsPrerequisites: starting checks");
+  log37.info({ chatId }, "checkTopicsPrerequisites: starting checks");
   try {
     const res = await telegramFetch(`https://api.telegram.org/bot${token}/getChat`, {
       method: "POST",
@@ -11499,7 +12218,7 @@ async function checkTopicsPrerequisites(token, chatId, telegramFetch) {
       body: JSON.stringify({ chat_id: chatId })
     });
     const data = await res.json();
-    log36.info(
+    log37.info(
       { chatId, apiOk: data.ok, is_forum: data.result?.is_forum, type: data.result?.type, title: data.result?.title },
       "checkTopicsPrerequisites: getChat result"
     );
@@ -11509,11 +12228,11 @@ async function checkTopicsPrerequisites(token, chatId, telegramFetch) {
       );
     }
   } catch (err) {
-    log36.warn({ err, chatId }, "checkTopicsPrerequisites: getChat failed (network error)");
+    log37.warn({ err, chatId }, "checkTopicsPrerequisites: getChat failed (network error)");
     issues.push("\u274C Could not check if Topics are enabled (network error).");
   }
   const adminResult = await validateBotAdmin(token, chatId, telegramFetch);
-  log36.info(
+  log37.info(
     { chatId, adminOk: adminResult.ok, canManageTopics: adminResult.ok ? adminResult.canManageTopics : void 0, error: !adminResult.ok ? adminResult.error : void 0 },
     "checkTopicsPrerequisites: validateBotAdmin result"
   );
@@ -11528,17 +12247,17 @@ async function checkTopicsPrerequisites(token, chatId, telegramFetch) {
       '\u274C Bot cannot manage topics.\n\u2192 Go to Group Settings \u2192 Administrators \u2192 tap the bot \u2192 enable "Manage Topics" \u2192 tap Save/Done (the checkmark)'
     );
   }
-  log36.info({ chatId, issueCount: issues.length, ok: issues.length === 0 }, "checkTopicsPrerequisites: result");
+  log37.info({ chatId, issueCount: issues.length, ok: issues.length === 0 }, "checkTopicsPrerequisites: result");
   if (issues.length > 0) return { ok: false, issues };
   return { ok: true };
 }
-var log36;
+var log37;
 var init_validators = __esm({
   "src/plugins/telegram/validators.ts"() {
     "use strict";
     init_log();
     init_network_redaction();
-    log36 = createChildLogger({ module: "telegram-validators" });
+    log37 = createChildLogger({ module: "telegram-validators" });
   }
 });
 
@@ -11557,7 +12276,7 @@ function patchedFetch(input2, init, delegate) {
   }
   return delegate(input2, init);
 }
-var log37, TelegramAdapter;
+var log38, HISTORICAL_OPENACP_COMMAND_NAMES, TelegramAdapter;
 var init_adapter = __esm({
   "src/plugins/telegram/adapter.ts"() {
     "use strict";
@@ -11577,7 +12296,19 @@ var init_adapter = __esm({
     init_messaging_adapter();
     init_renderer2();
     init_output_mode_resolver();
-    log37 = createChildLogger({ module: "telegram" });
+    init_proxy2();
+    init_network_redaction();
+    init_command_sync();
+    init_command_ownership_store();
+    init_instance_context();
+    log38 = createChildLogger({ module: "telegram" });
+    HISTORICAL_OPENACP_COMMAND_NAMES = /* @__PURE__ */ new Set([
+      ...STATIC_COMMANDS.map((command) => command.command),
+      "clear",
+      "bypass",
+      "usage",
+      "summary"
+    ]);
     TelegramAdapter = class extends MessagingAdapter {
       name = "telegram";
       renderer = new TelegramRenderer();
@@ -11606,6 +12337,7 @@ var init_adapter = __esm({
       sessionTrackers = /* @__PURE__ */ new Map();
       callbackCache = /* @__PURE__ */ new Map();
       callbackCounter = 0;
+      pendingCommandInputs = /* @__PURE__ */ new Map();
       /** Pending skill commands queued when session.threadId was not yet set */
       _pendingSkillCommands = /* @__PURE__ */ new Map();
       /** Control message IDs per session (for updating status text/buttons) */
@@ -11630,6 +12362,23 @@ var init_adapter = __esm({
       /** Set during normal shutdown so bot.stop() does not trigger a self-restart. */
       _stopping = false;
       unregisterProxyTester;
+      /** Serializes command-list reconciliations triggered by startup and plugin hot reloads. */
+      _commandSyncChain = Promise.resolve();
+      _pendingCommandSnapshot;
+      _commandSyncWorkerRunning = false;
+      _commandSyncGeneration = 0;
+      _commandSyncAbort;
+      _commandSnapshotVersion = 0;
+      _commandsReadyHandler;
+      _latestCommandSnapshot;
+      _commandApiReady = false;
+      _initialCommandSyncScheduled = false;
+      commandOwnershipStore = new TelegramCommandOwnershipStore(getGlobalRoot());
+      commandOwnerIdentity;
+      commandOwnerBotId;
+      commandOwnerTakeoverRequested;
+      _commandOwnerClaimed = false;
+      _commandOwnerHeartbeat;
       telegramFetch() {
         return this.core.proxyService.createFetch("channels.telegram");
       }
@@ -11704,6 +12453,14 @@ var init_adapter = __esm({
         });
         this.core = core;
         this.telegramConfig = config;
+        this.commandOwnerBotId = this.telegramConfig.botToken.split(":", 1)[0] ?? "";
+        this.commandOwnerIdentity = {
+          instanceId: this.core.instanceContext.id,
+          instanceKey: telegramCommandInstanceKey(this.core.instanceContext.root),
+          hostId: telegramCommandHostId(),
+          pid: process.pid
+        };
+        this.commandOwnerTakeoverRequested = process.env.OPENACP_TELEGRAM_COMMAND_TAKEOVER === "1";
         this.saveTopicIds = saveTopicIds;
         this.unregisterProxyTester = this.core.proxyService.registerRouteTester(
           "channels.telegram",
@@ -11716,6 +12473,35 @@ var init_adapter = __esm({
           }
         );
       }
+      /**
+       * Capture command snapshots once startup begins. The normal boot path emits
+       * SYSTEM_COMMANDS_READY before core.start(), so initial reconciliation reads the
+       * authoritative registry state instead of relying on replay of that event. Once
+       * the API is ready, later snapshots drive hot reloads.
+       */
+      subscribeToCommandSnapshots() {
+        if (this._commandsReadyHandler) return;
+        this._commandsReadyHandler = ({ commands }) => {
+          this._latestCommandSnapshot = commands;
+          if (this._commandApiReady) this.syncCommandsWithRetry(commands);
+        };
+        this.core.eventBus.on(BusEvent.SYSTEM_COMMANDS_READY, this._commandsReadyHandler);
+      }
+      /** Schedule one authoritative initial reconciliation after grammY is available. */
+      scheduleInitialCommandSync() {
+        if (this._initialCommandSyncScheduled) return;
+        this._initialCommandSyncScheduled = true;
+        const registry = this.core.lifecycleManager?.serviceRegistry?.get("command-registry");
+        const commands = registry?.getAll() ?? this._latestCommandSnapshot;
+        if (!commands) {
+          log38.warn(
+            { operation: "telegram-command-sync" },
+            "Telegram command registry is not ready; waiting for a commands-ready snapshot"
+          );
+          return;
+        }
+        this.syncCommandsWithRetry(commands);
+      }
       /**
        * Set up the grammY bot, register all callback and message handlers, then perform
        * two-phase startup: Phase 1 starts polling immediately; Phase 2 checks group
@@ -11724,6 +12510,11 @@ var init_adapter = __esm({
        */
       async start() {
         this._stopping = false;
+        this._commandSyncGeneration++;
+        this._commandSyncAbort = new AbortController();
+        this._pendingCommandSnapshot = void 0;
+        this._commandSyncWorkerRunning = false;
+        this.subscribeToCommandSnapshots();
         this.bot = new Bot(this.telegramConfig.botToken, {
           client: {
             baseFetchConfig: { duplex: "half" },
@@ -11748,7 +12539,7 @@ var init_adapter = __esm({
         );
         this.bot.catch((err) => {
           const rootCause = err.error instanceof Error ? err.error : err;
-          log37.error({ err: rootCause }, "Telegram bot error");
+          log38.error({ err: rootCause }, "Telegram bot error");
         });
         this.bot.api.config.use(async (prev, method, payload, signal) => {
           const maxRetries = 3;
@@ -11766,7 +12557,7 @@ var init_adapter = __esm({
             if (rateLimitedMethods.includes(method)) {
               this.sendQueue.onRateLimited();
             }
-            log37.warn(
+            log38.warn(
               { method, retryAfter, attempt: attempt + 1 },
               "Rate limited by Telegram, retrying"
             );
@@ -11784,10 +12575,6 @@ var init_adapter = __esm({
           }
           return prev(method, payload, signal);
         });
-        const onCommandsReady = ({ commands }) => {
-          this.syncCommandsWithRetry(commands);
-        };
-        this.core.eventBus.on(BusEvent.SYSTEM_COMMANDS_READY, onCommandsReady);
         this.bot.use((ctx, next) => {
           const chatId = ctx.chat?.id ?? ctx.callbackQuery?.message?.chat?.id;
           if (chatId !== this.telegramConfig.chatId) return;
@@ -11801,7 +12588,52 @@ var init_adapter = __esm({
         );
         this.bot.on("message:text", async (ctx, next) => {
           const text3 = ctx.message?.text;
-          if (!text3?.startsWith("/")) return next();
+          if (!text3) return next();
+          const topicIdForInput = ctx.message.message_thread_id;
+          const inputKey = `${ctx.chat.id}:${ctx.from?.id ?? 0}:${topicIdForInput ?? 0}`;
+          const pending = this.pendingCommandInputs.get(inputKey);
+          if (!text3.startsWith("/") && pending) {
+            if (pending.promptMessageId !== void 0 && ctx.message.reply_to_message?.message_id !== pending.promptMessageId) {
+              return next();
+            }
+            this.pendingCommandInputs.delete(inputKey);
+            if (pending.expiresAt <= Date.now()) {
+              await ctx.reply("This input request expired. Start the operation again.").catch(() => {
+              });
+              return;
+            }
+            if (pending.sensitive) {
+              try {
+                await ctx.deleteMessage();
+              } catch {
+                await ctx.reply(`\u26A0\uFE0F I could not securely remove that message, so its value was not used. ${pending.fallback}`).catch(() => {
+                });
+                return;
+              }
+            }
+            const registry2 = this.core.lifecycleManager?.serviceRegistry?.get("command-registry");
+            if (!registry2) return;
+            const sessionId = topicIdForInput != null ? (await this.core.getOrResumeSession("telegram", String(topicIdForInput)))?.id ?? null : null;
+            const response = await registry2.execute(pending.command, {
+              raw: "",
+              sessionId,
+              channelId: "telegram",
+              userId: String(ctx.from?.id),
+              conversationId: `${ctx.chat.id}:${topicIdForInput ?? 0}`,
+              interaction: {
+                textInput: true,
+                secureInput: "delete-after-capture",
+                capturedInput: { value: text3, sensitive: pending.sensitive }
+              },
+              reply: async () => {
+              }
+            });
+            if (response.type !== "silent" && response.type !== "delegated") {
+              await this.renderCommandResponse(response, ctx.chat.id, topicIdForInput, String(ctx.from?.id));
+            }
+            return;
+          }
+          if (!text3.startsWith("/")) return next();
           const rawCmd = text3.split(" ")[0].slice(1).split("@")[0].toLowerCase();
           if (rawCmd === "retry") {
             await this.handleRetryCommand(ctx);
@@ -11847,6 +12679,8 @@ var init_adapter = __esm({
               sessionId,
               channelId: "telegram",
               userId: String(ctx.from?.id),
+              conversationId: `${chatId}:${topicId ?? 0}`,
+              interaction: { textInput: true, secureInput: "delete-after-capture" },
               reply: async (content) => {
                 if (typeof content === "string") {
                   await ctx.reply(content);
@@ -11854,7 +12688,8 @@ var init_adapter = __esm({
                   await this.renderCommandResponse(
                     content,
                     chatId,
-                    topicId
+                    topicId,
+                    String(ctx.from?.id)
                   );
                 }
               }
@@ -11865,7 +12700,7 @@ var init_adapter = __esm({
             if (response.type === "silent") {
               return next();
             }
-            await this.renderCommandResponse(response, chatId, topicId);
+            await this.renderCommandResponse(response, chatId, topicId, String(ctx.from?.id));
           } catch (err) {
             await ctx.reply(`\u26A0\uFE0F Command failed: ${String(err)}`);
           }
@@ -11894,6 +12729,8 @@ var init_adapter = __esm({
               sessionId,
               channelId: "telegram",
               userId: String(ctx.from?.id),
+              conversationId: `${chatId}:${topicId ?? 0}`,
+              interaction: { textInput: true, secureInput: "delete-after-capture" },
               reply: async (content) => {
                 if (typeof content === "string") {
                   await ctx.editMessageText(content).catch(() => {
@@ -11902,7 +12739,11 @@ var init_adapter = __esm({
               }
             });
             await ctx.answerCallbackQuery();
-            if (response.type !== "silent") {
+            if (response.type !== "silent" && response.type !== "delegated") {
+              if (response.type === "input") {
+                await this.renderCommandResponse(response, chatId, topicId, String(ctx.from?.id));
+                return;
+              }
               if (response.type === "menu") {
                 const keyboard = response.options.map((opt) => [
                   {
@@ -12010,32 +12851,34 @@ ${p}` : p;
           }
         );
         this.setupRoutes();
+        this._commandApiReady = true;
+        this.scheduleInitialCommandSync();
         void this.bot.start({
           allowed_updates: ["message", "callback_query"],
-          onStart: () => log37.info({ chatId: this.telegramConfig.chatId }, "Telegram bot started")
+          onStart: () => log38.info({ chatId: this.telegramConfig.chatId }, "Telegram bot started")
         }).catch((err) => {
           if (this._stopping) return;
           const inner = err?.error;
           const rootCause = err instanceof Error ? err : inner instanceof Error ? inner : err;
-          log37.error({ err: rootCause }, "Telegram polling stopped unexpectedly");
+          log38.error({ err: rootCause }, "Telegram polling stopped unexpectedly");
           if (this.core.requestRestart) {
             const requestRestart = this.core.requestRestart;
-            log37.error("Restarting OpenACP because Telegram polling stopped");
+            log38.error("Restarting OpenACP because Telegram polling stopped");
             setImmediate(() => {
               if (this._stopping) return;
               void requestRestart().catch((restartErr) => {
-                log37.error({ err: restartErr }, "OpenACP restart request failed after Telegram polling stopped");
+                log38.error({ err: restartErr }, "OpenACP restart request failed after Telegram polling stopped");
               });
             });
           } else {
-            log37.error("Exiting because Telegram polling stopped and no restart hook is available");
+            log38.error("Exiting because Telegram polling stopped and no restart hook is available");
             setImmediate(() => {
               if (this._stopping) return;
               process.exit(1);
             });
           }
         });
-        log37.info(
+        log38.info(
           {
             chatId: this.telegramConfig.chatId,
             notificationTopicId: this.telegramConfig.notificationTopicId,
@@ -12050,12 +12893,12 @@ ${p}` : p;
           this.telegramFetch()
         );
         if (prereqResult.ok) {
-          log37.info("Telegram adapter: prerequisites OK, initializing topic-dependent features");
+          log38.info("Telegram adapter: prerequisites OK, initializing topic-dependent features");
           await this.initTopicDependentFeatures();
         } else {
-          log37.warn({ issues: prereqResult.issues }, "Telegram adapter: prerequisites NOT met, starting watcher");
+          log38.warn({ issues: prereqResult.issues }, "Telegram adapter: prerequisites NOT met, starting watcher");
           for (const issue of prereqResult.issues) {
-            log37.warn({ issue }, "Telegram prerequisite not met");
+            log38.warn({ issue }, "Telegram prerequisite not met");
           }
           this.startPrerequisiteWatcher(prereqResult.issues);
         }
@@ -12071,7 +12914,7 @@ ${p}` : p;
           } catch (err) {
             if (attempt === maxRetries) throw err;
             const delay = baseDelayMs * Math.pow(2, attempt - 1);
-            log37.warn(
+            log38.warn(
               { err, attempt, maxRetries, delayMs: delay, operation: label },
               `${label} failed, retrying in ${delay}ms`
             );
@@ -12086,21 +12929,126 @@ ${p}` : p;
        * from the registry, deduplicating by command name. Non-critical.
        */
       syncCommandsWithRetry(registryCommands) {
-        const staticNames = new Set(STATIC_COMMANDS.map((c2) => c2.command));
-        const pluginCommands = registryCommands.filter((c2) => c2.category === "plugin" && !staticNames.has(c2.name) && /^[a-z0-9_]+$/.test(c2.name)).map((c2) => ({ command: c2.name, description: c2.description.slice(0, 256) }));
-        const allCommands = [...STATIC_COMMANDS, ...pluginCommands].slice(0, 100);
-        this.retryWithBackoff(
-          () => this.bot.api.setMyCommands(allCommands, {
-            scope: { type: "chat", chat_id: this.telegramConfig.chatId }
-          }),
-          "setMyCommands"
-        ).catch((err) => {
-          log37.warn({ err }, "Failed to register Telegram commands after retries (non-critical)");
+        this._pendingCommandSnapshot = registryCommands;
+        this._commandSnapshotVersion++;
+        if (this._commandSyncWorkerRunning) return;
+        this._commandSyncWorkerRunning = true;
+        const generation = this._commandSyncGeneration;
+        const signal = this._commandSyncAbort?.signal;
+        this._commandSyncChain = (async () => {
+          while (this._pendingCommandSnapshot && generation === this._commandSyncGeneration && !signal?.aborted) {
+            const snapshot = this._pendingCommandSnapshot;
+            const snapshotVersion = this._commandSnapshotVersion;
+            this._pendingCommandSnapshot = void 0;
+            let allCommands;
+            try {
+              const boundary = prepareTelegramCommandBoundary(STATIC_COMMANDS, snapshot);
+              allCommands = boundary.commands;
+              const { invalidName, invalidDescription, duplicate, overflow } = boundary.skipped;
+              if (invalidName || invalidDescription || duplicate || overflow) {
+                log38.warn(
+                  { invalidName, invalidDescription, duplicate, overflow, operation: "telegram-command-boundary" },
+                  "Skipped plugin Telegram commands before Bot API sync. Names must match [a-z0-9_]{1,32}, descriptions must contain 1-256 characters, and only the first valid commands up to the 100-command limit are published."
+                );
+              }
+              if (!allCommands.some((command) => command.command === "proxy")) {
+                throw new TelegramCommandBoundaryError("Required OpenACP command /proxy is missing");
+              }
+            } catch (error) {
+              log38.error(
+                { error: redactNetworkSecrets(error instanceof Error ? error.message : String(error)), operation: "telegram-command-boundary" },
+                "OpenACP core Telegram command definitions are invalid; command sync was skipped without changing Telegram state"
+              );
+              continue;
+            }
+            const maxAttempts = 5;
+            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+              if (generation !== this._commandSyncGeneration || signal?.aborted) return;
+              try {
+                const result = await synchronizeTelegramCommands(
+                  this.bot.api,
+                  this.telegramConfig.chatId,
+                  allCommands,
+                  {
+                    ownershipStore: this.commandOwnershipStore,
+                    botId: this.commandOwnerBotId,
+                    ownerIdentity: this.commandOwnerIdentity,
+                    allowOwnerTakeover: this.commandOwnerTakeoverRequested,
+                    onOwnerClaimed: () => {
+                      this._commandOwnerClaimed = true;
+                      this.startCommandOwnerHeartbeat();
+                    },
+                    historicalOwnedNames: HISTORICAL_OPENACP_COMMAND_NAMES,
+                    signal
+                  }
+                );
+                if (generation !== this._commandSyncGeneration || signal?.aborted) return;
+                log38.info(
+                  { updatedScopes: result.updated, unchangedScopes: result.unchanged },
+                  "Telegram command menus synchronized"
+                );
+                break;
+              } catch (err) {
+                if (generation !== this._commandSyncGeneration || signal?.aborted) return;
+                if (err instanceof TelegramCommandOwnerConflictError) {
+                  log38.warn(
+                    { code: err.code, ownerInstanceId: err.ownerInstanceId, instanceId: this.commandOwnerIdentity.instanceId, operation: "telegram-command-sync" },
+                    "Telegram command sync is owned by another OpenACP instance. This instance did not inspect or mutate Telegram command lists. Configure a unique bot per instance, or stop the same-host owner and request an explicit takeover."
+                  );
+                  break;
+                }
+                if (snapshotVersion !== this._commandSnapshotVersion && this._pendingCommandSnapshot) break;
+                const safeError2 = redactNetworkSecrets(err instanceof Error ? err.message : String(err));
+                if (attempt === maxAttempts) {
+                  log38.warn(
+                    { error: safeError2, attempt, maxAttempts, operation: "telegram-command-sync" },
+                    "Telegram command menu sync failed; bot remains online. Run /doctor and inspect Telegram connectivity"
+                  );
+                  break;
+                }
+                const delayMs = 2e3 * Math.pow(2, attempt - 1);
+                log38.warn(
+                  { error: safeError2, attempt, maxAttempts, delayMs, operation: "telegram-command-sync" },
+                  "Telegram command menu sync failed, retrying"
+                );
+                await new Promise((resolve7) => {
+                  const timer = setTimeout(resolve7, delayMs);
+                  signal?.addEventListener("abort", () => {
+                    clearTimeout(timer);
+                    resolve7();
+                  }, { once: true });
+                });
+              }
+            }
+          }
+        })().finally(() => {
+          this._commandSyncWorkerRunning = false;
+          if (this._pendingCommandSnapshot && generation === this._commandSyncGeneration && !signal?.aborted) {
+            this.syncCommandsWithRetry(this._pendingCommandSnapshot);
+          }
         });
       }
+      startCommandOwnerHeartbeat() {
+        if (this._commandOwnerHeartbeat) return;
+        this._commandOwnerHeartbeat = setInterval(() => {
+          void this.commandOwnershipStore.heartbeatOwner(this.commandOwnerBotId, this.commandOwnerIdentity).then((owned) => {
+            if (!owned) {
+              this._commandOwnerClaimed = false;
+              log38.warn(
+                { instanceId: this.commandOwnerIdentity.instanceId, operation: "telegram-command-owner-heartbeat" },
+                "Telegram command-sync ownership was lost; no further command-list writes will be attempted until ownership is resolved."
+              );
+            }
+          }).catch((error) => log38.warn(
+            { error: redactNetworkSecrets(error instanceof Error ? error.message : String(error)), operation: "telegram-command-owner-heartbeat" },
+            "Could not refresh Telegram command-sync ownership heartbeat"
+          ));
+        }, 3e4);
+        this._commandOwnerHeartbeat.unref?.();
+      }
       async initTopicDependentFeatures() {
         if (this._topicsInitialized) return;
-        log37.info(
+        log38.info(
           { notificationTopicId: this.telegramConfig.notificationTopicId, assistantTopicId: this.telegramConfig.assistantTopicId },
           "initTopicDependentFeatures: starting (existing IDs in config)"
         );
@@ -12125,7 +13073,7 @@ ${p}` : p;
         this.assistantTopicId = topics.assistantTopicId;
         this._systemTopicIds.notificationTopicId = topics.notificationTopicId;
         this._systemTopicIds.assistantTopicId = topics.assistantTopicId;
-        log37.info(
+        log38.info(
           { notificationTopicId: this.notificationTopicId, assistantTopicId: this.assistantTopicId },
           "initTopicDependentFeatures: topics ready"
         );
@@ -12156,7 +13104,7 @@ ${p}` : p;
           ).then((msg) => {
             if (msg) this.storeControlMsgId(sessionId, msg.message_id);
           }).catch((err) => {
-            log37.warn({ err, sessionId }, "Failed to send initial messages for new session");
+            log38.warn({ err, sessionId }, "Failed to send initial messages for new session");
           });
         };
         this.core.eventBus.on(BusEvent.SESSION_THREAD_READY, this._threadReadyHandler);
@@ -12198,7 +13146,7 @@ ${p}` : p;
               this._queueNotifications.delete(data.turnId);
               if (result) {
                 this.bot.api.deleteMessage(this.telegramConfig.chatId, result.message_id).catch((err) => {
-                  log37.warn({ err }, "Failed to delete queue notification after race");
+                  log38.warn({ err }, "Failed to delete queue notification after race");
                 });
               }
             } else if (result) {
@@ -12208,7 +13156,7 @@ ${p}` : p;
             }
           } catch (err) {
             this._queueNotifications.delete(data.turnId);
-            log37.warn({ err }, "Failed to send queue notification");
+            log38.warn({ err }, "Failed to send queue notification");
           }
         });
         this.core.eventBus.on(BusEvent.MESSAGE_PROCESSING, async (data) => {
@@ -12217,13 +13165,13 @@ ${p}` : p;
           if (typeof entry === "number") {
             this._queueNotifications.delete(data.turnId);
             this.bot.api.deleteMessage(this.telegramConfig.chatId, entry).catch((err) => {
-              log37.warn({ err }, "Failed to delete queue notification on processing");
+              log38.warn({ err }, "Failed to delete queue notification on processing");
             });
           } else if (entry === "pending") {
             this._queueNotifications.set(data.turnId, "delete");
           }
         });
-        log37.info({ assistantTopicId: this.assistantTopicId }, "initTopicDependentFeatures: sending welcome message");
+        log38.info({ assistantTopicId: this.assistantTopicId }, "initTopicDependentFeatures: sending welcome message");
         try {
           const config = this.core.configManager.get();
           const agents = this.core.agentManager.getAvailableAgents();
@@ -12245,17 +13193,17 @@ ${p}` : p;
               this.core.lifecycleManager?.serviceRegistry?.get("menu-registry")
             )
           });
-          log37.info("initTopicDependentFeatures: welcome message sent");
+          log38.info("initTopicDependentFeatures: welcome message sent");
         } catch (err) {
-          log37.warn({ err }, "Failed to send welcome message");
+          log38.warn({ err }, "Failed to send welcome message");
         }
         try {
           await this.core.assistantManager.getOrSpawn("telegram", String(this.assistantTopicId));
         } catch (err) {
-          log37.error({ err }, "Failed to spawn assistant");
+          log38.error({ err }, "Failed to spawn assistant");
         }
         this._topicsInitialized = true;
-        log37.info("Telegram adapter fully initialized");
+        log38.info("Telegram adapter fully initialized");
       }
       /**
        * Handle the /retry command — re-runs prerequisite checks immediately.
@@ -12292,7 +13240,7 @@ ${p}` : p;
             ).catch(() => {
             });
           } catch (err) {
-            log37.error({ err }, "handleRetryCommand: init failed after prerequisites met");
+            log38.error({ err }, "handleRetryCommand: init failed after prerequisites met");
             await ctx.reply("\u26A0\uFE0F Prerequisites are met but initialization failed. Check server logs and try /retry again.").catch(() => {
             });
           }
@@ -12318,7 +13266,7 @@ OpenACP will automatically retry every 30 seconds. After fixing the issues above
         this.bot.api.sendMessage(this.telegramConfig.chatId, setupMessage, {
           parse_mode: "HTML"
         }).catch((err) => {
-          log37.warn({ err }, "Failed to send setup guidance to General topic");
+          log38.warn({ err }, "Failed to send setup guidance to General topic");
         });
         const schedule = [5e3, 1e4, 3e4];
         let attempt = 1;
@@ -12331,7 +13279,7 @@ OpenACP will automatically retry every 30 seconds. After fixing the issues above
             this.telegramFetch()
           );
           if (result.ok) {
-            log37.info("Prerequisites met \u2014 completing Telegram adapter initialization");
+            log38.info("Prerequisites met \u2014 completing Telegram adapter initialization");
             try {
               await this.initTopicDependentFeatures();
               this._prerequisiteWatcher = null;
@@ -12344,14 +13292,14 @@ System topics have been created. Tap${assistantTopicLink} to get started.`,
                 { parse_mode: "HTML" }
               );
             } catch (err) {
-              log37.error({ err }, "Failed to complete initialization after prerequisites met \u2014 will retry");
+              log38.error({ err }, "Failed to complete initialization after prerequisites met \u2014 will retry");
               const delay2 = schedule[Math.min(attempt, schedule.length - 1)];
               attempt++;
               this._prerequisiteWatcher = setTimeout(retry, delay2);
             }
             return;
           }
-          log37.debug({ issues: result.issues }, "Prerequisites not yet met, retrying");
+          log38.debug({ issues: result.issues }, "Prerequisites not yet met, retrying");
           const delay = schedule[Math.min(attempt, schedule.length - 1)];
           attempt++;
           this._prerequisiteWatcher = setTimeout(retry, delay);
@@ -12367,6 +13315,14 @@ System topics have been created. Tap${assistantTopicLink} to get started.`,
        */
       async stop() {
         this._stopping = true;
+        this._commandSyncGeneration++;
+        this._commandSyncAbort?.abort();
+        this._commandSyncAbort = void 0;
+        this._pendingCommandSnapshot = void 0;
+        if (this._commandOwnerHeartbeat) {
+          clearInterval(this._commandOwnerHeartbeat);
+          this._commandOwnerHeartbeat = void 0;
+        }
         this.unregisterProxyTester?.();
         this.unregisterProxyTester = void 0;
         if (this._prerequisiteWatcher !== null) {
@@ -12385,12 +13341,36 @@ System topics have been created. Tap${assistantTopicLink} to get started.`,
           this.core.eventBus.off("session:configChanged", this._configChangedHandler);
           this._configChangedHandler = void 0;
         }
+        if (this._commandsReadyHandler) {
+          this.core.eventBus.off(BusEvent.SYSTEM_COMMANDS_READY, this._commandsReadyHandler);
+          this._commandsReadyHandler = void 0;
+        }
+        this._commandApiReady = false;
+        this._initialCommandSyncScheduled = false;
+        this._latestCommandSnapshot = void 0;
         this.sendQueue.clear();
-        await this.bot.stop();
-        log37.info("Telegram bot stopped");
+        this.pendingCommandInputs.clear();
+        this.callbackCache.clear();
+        clearProxyDraftsForChannel("telegram");
+        try {
+          await this.bot.stop();
+        } finally {
+          if (this._commandOwnerClaimed) {
+            try {
+              await this.commandOwnershipStore.releaseOwner(this.commandOwnerBotId, this.commandOwnerIdentity);
+            } catch (error) {
+              log38.warn(
+                { error: redactNetworkSecrets(error instanceof Error ? error.message : String(error)), operation: "telegram-command-owner-release" },
+                "Could not mark Telegram command-sync ownership as stopped; a same-host explicit takeover may be required on restart"
+              );
+            }
+            this._commandOwnerClaimed = false;
+          }
+        }
+        log38.info("Telegram bot stopped");
       }
       // --- CommandRegistry response rendering ---
-      async renderCommandResponse(response, chatId, topicId) {
+      async renderCommandResponse(response, chatId, topicId, userId) {
         switch (response.type) {
           case "text":
             await this.bot.api.sendMessage(chatId, response.text, {
@@ -12458,6 +13438,34 @@ ${lines.join("\n")}`;
             });
             break;
           }
+          case "input": {
+            if (!userId) {
+              await this.bot.api.sendMessage(chatId, response.fallback, { message_thread_id: topicId });
+              break;
+            }
+            const key = `${chatId}:${userId}:${topicId ?? 0}`;
+            for (const [pendingKey, pending] of this.pendingCommandInputs) {
+              if (pending.expiresAt <= Date.now()) this.pendingCommandInputs.delete(pendingKey);
+            }
+            while (this.pendingCommandInputs.size >= 1e3) {
+              const oldest = this.pendingCommandInputs.keys().next().value;
+              if (!oldest) break;
+              this.pendingCommandInputs.delete(oldest);
+            }
+            const warning = response.sensitive ? "\n\n\u{1F510} Your reply will be deleted before the value is processed. If deletion fails, the value will not be used." : "";
+            const promptMessage = await this.bot.api.sendMessage(chatId, `${response.prompt}${warning}`, {
+              message_thread_id: topicId,
+              reply_markup: { force_reply: true, selective: true }
+            });
+            this.pendingCommandInputs.set(key, {
+              command: response.command,
+              sensitive: response.sensitive === true,
+              fallback: response.fallback,
+              expiresAt: Date.now() + (response.expiresInMs ?? 10 * 6e4),
+              promptMessageId: promptMessage.message_id
+            });
+            break;
+          }
           case "silent":
             break;
         }
@@ -12532,7 +13540,7 @@ ${lines.join("\n")}`;
                 username: ctx.from.username
               }
             }
-          ).catch((err) => log37.error({ err }, "handleMessage error"));
+          ).catch((err) => log38.error({ err }, "handleMessage error"));
         });
         this.bot.on("message:photo", async (ctx) => {
           const threadId = ctx.message.message_thread_id;
@@ -12638,7 +13646,7 @@ ${lines.join("\n")}`;
         if (session.archiving) return;
         const threadId = Number(session.threadId);
         if (!threadId || isNaN(threadId)) {
-          log37.warn(
+          log38.warn(
             { sessionId, threadId: session.threadId },
             "Session has no valid threadId, skipping message"
           );
@@ -12654,7 +13662,7 @@ ${lines.join("\n")}`;
             this._sessionThreadIds.delete(sessionId);
           }
         }).catch((err) => {
-          log37.warn({ err, sessionId }, "Dispatch queue error");
+          log38.warn({ err, sessionId }, "Dispatch queue error");
         });
         this._dispatchQueues.set(sessionId, next);
         await next;
@@ -12784,7 +13792,7 @@ ${lines.join("\n")}`;
           usageMsgId = result?.message_id;
           if (usageMsgId) this.usageMsgIds.set(sessionId, usageMsgId);
         } catch (err) {
-          log37.warn({ err, sessionId }, "Failed to send usage message");
+          log38.warn({ err, sessionId }, "Failed to send usage message");
         }
       }
       async handleAttachment(sessionId, content) {
@@ -12793,7 +13801,7 @@ ${lines.join("\n")}`;
         if (!content.attachment) return;
         const { attachment } = content;
         if (attachment.size > 50 * 1024 * 1024) {
-          log37.warn(
+          log38.warn(
             {
               sessionId,
               fileName: attachment.fileName,
@@ -12837,7 +13845,7 @@ ${lines.join("\n")}`;
             );
           }
         } catch (err) {
-          log37.error(
+          log38.error(
             { err, sessionId, fileName: attachment.fileName },
             "Failed to send attachment"
           );
@@ -12962,7 +13970,7 @@ Task completed.
        */
       async sendPermissionRequest(sessionId, request) {
         this.getTracer(sessionId)?.log("telegram", { action: "permission:send", sessionId, requestId: request.id, description: request.description });
-        log37.info({ sessionId, requestId: request.id }, "Permission request sent");
+        log38.info({ sessionId, requestId: request.id }, "Permission request sent");
         const session = this.core.sessionManager.getSession(sessionId);
         if (!session) return;
         await this.sendQueue.enqueue(
@@ -12977,7 +13985,7 @@ Task completed.
       async sendNotification(notification) {
         this.getTracer(notification.sessionId)?.log("telegram", { action: "notification:send", sessionId: notification.sessionId, type: notification.type });
         if (notification.sessionId === this.core.assistantManager?.get("telegram")?.id) return;
-        log37.info(
+        log38.info(
           { sessionId: notification.sessionId, type: notification.type },
           "Notification sent"
         );
@@ -13023,14 +14031,14 @@ Task completed.
        */
       async createSessionThread(sessionId, name) {
         this.getTracer(sessionId)?.log("telegram", { action: "thread:create", sessionId, name });
-        log37.info({ sessionId, name }, "Session topic created");
+        log38.info({ sessionId, name }, "Session topic created");
         const threadId = await createSessionTopic(this.bot, this.telegramConfig.chatId, name);
         this.bot.api.sendMessage(
           this.telegramConfig.chatId,
           "\u23F3 Setting up session, please wait...",
           { message_thread_id: threadId, parse_mode: "HTML" }
         ).catch((err) => {
-          log37.warn({ err, sessionId, threadId }, "Failed to send setup message to new topic");
+          log38.warn({ err, sessionId, threadId }, "Failed to send setup message to new topic");
         });
         return String(threadId);
       }
@@ -13044,7 +14052,7 @@ Task completed.
         if (!session) return;
         const threadId = Number(session.threadId);
         if (!threadId) {
-          log37.debug({ sessionId, newName }, "Cannot rename thread \u2014 threadId not set yet");
+          log38.debug({ sessionId, newName }, "Cannot rename thread \u2014 threadId not set yet");
           return;
         }
         await renameSessionTopic(
@@ -13064,7 +14072,7 @@ Task completed.
         try {
           await this.bot.api.deleteForumTopic(this.telegramConfig.chatId, topicId);
         } catch (err) {
-          log37.warn(
+          log38.warn(
             { err, sessionId, topicId },
             "Failed to delete forum topic (may already be deleted)"
           );
@@ -13113,7 +14121,7 @@ Task completed.
           const buffer = Buffer.from(await response.arrayBuffer());
           return { buffer, filePath: file.file_path };
         } catch (err) {
-          log37.error({ err }, "Failed to download file from Telegram");
+          log38.error({ err }, "Failed to download file from Telegram");
           return null;
         }
       }
@@ -13134,7 +14142,7 @@ Task completed.
           try {
             buffer = await this.fileService.convertOggToWav(buffer);
           } catch (err) {
-            log37.warn({ err }, "OGG\u2192WAV conversion failed, saving original OGG");
+            log38.warn({ err }, "OGG\u2192WAV conversion failed, saving original OGG");
             fileName = "voice.ogg";
             mimeType = "audio/ogg";
             originalFilePath = void 0;
@@ -13169,7 +14177,7 @@ Task completed.
           userId: String(userId),
           text: text3,
           attachments: [att]
-        }).catch((err) => log37.error({ err }, "handleMessage error"));
+        }).catch((err) => log38.error({ err }, "handleMessage error"));
       }
       /**
        * Remove skill slash commands from the Telegram bot command list for a session.
@@ -15275,7 +16283,7 @@ var TTS_BLOCK_REGEX = /\[TTS\]([\s\S]*?)\[\/TTS\]/;
 var TTS_MAX_LENGTH = 5e3;
 var TTS_TIMEOUT_MS = 3e4;
 var VALID_TRANSITIONS = {
-  initializing: /* @__PURE__ */ new Set(["active", "error"]),
+  initializing: /* @__PURE__ */ new Set(["active", "error", "cancelled"]),
   active: /* @__PURE__ */ new Set(["error", "finished", "cancelled"]),
   error: /* @__PURE__ */ new Set(["active", "cancelled"]),
   cancelled: /* @__PURE__ */ new Set(["active"]),
@@ -15337,6 +16345,9 @@ var Session = class extends TypedEmitter {
   _abortedTurnIds = /* @__PURE__ */ new Set();
   /** Last completed turnId — used by abortPrompt() to retroactively mark a just-finished turn as interrupted */
   _lastCompletedTurnId = null;
+  /** Idempotent teardown checkpoints allow cleanup retry after a partial failure. */
+  _destroyedAgent = false;
+  _closedLogger = false;
   _autoApprovedCommands = [];
   get autoApprovedCommands() {
     return this._autoApprovedCommands;
@@ -15415,7 +16426,7 @@ var Session = class extends TypedEmitter {
     this.transition("finished");
     this.emit(SessionEv.SESSION_END, reason ?? "completed");
   }
-  /** Transition to cancelled — from active or error (terminal session cancel) */
+  /** Transition to cancelled — from initializing, active, or error. */
   markCancelled() {
     this.transition("cancelled");
   }
@@ -15932,8 +16943,14 @@ ${result.text}` : result.text;
       this.permissionGate.reject("Session destroyed");
     }
     this.queue.clear();
-    await this.agentInstance.destroy();
-    await closeSessionLogger(this.log);
+    if (!this._destroyedAgent) {
+      await this.agentInstance.destroy();
+      this._destroyedAgent = true;
+    }
+    if (!this._closedLogger) {
+      await closeSessionLogger(this.log);
+      this._closedLogger = true;
+    }
   }
 };
 
@@ -16451,6 +17468,9 @@ var MessageTransformer = class {
 
 // src/core/sessions/session-manager.ts
 init_events();
+init_log();
+init_network_redaction();
+var log7 = createChildLogger({ module: "session-manager" });
 var SessionManager = class {
   sessions = /* @__PURE__ */ new Map();
   store;
@@ -16460,6 +17480,7 @@ var SessionManager = class {
   // Prevents SessionBridge STATUS_CHANGE listeners from overwriting the flushed state
   // with transient error status from in-flight prompts that fail after shutdown.
   _shutdownComplete = false;
+  cancellationOps = /* @__PURE__ */ new Map();
   /**
    * Inject the EventBus after construction. Deferred because EventBus is created
    * after SessionManager during bootstrap, so it cannot be passed to the constructor.
@@ -16560,30 +17581,76 @@ var SessionManager = class {
   getSessionRecord(sessionId) {
     return this.store?.get(sessionId);
   }
-  /** Cancel a session: abort in-flight prompt, transition to cancelled, destroy agent, and persist. */
+  /**
+   * Cancel a session exactly once. Concurrent callers share one operation;
+   * terminal sessions return an idempotent result instead of throwing.
+   */
   async cancelSession(sessionId) {
+    const existing = this.cancellationOps.get(sessionId);
+    if (existing) return existing;
+    const operation = this.performCancelSession(sessionId);
+    this.cancellationOps.set(sessionId, operation);
+    try {
+      return await operation;
+    } finally {
+      if (this.cancellationOps.get(sessionId) === operation) this.cancellationOps.delete(sessionId);
+    }
+  }
+  async performCancelSession(sessionId) {
     const session = this.sessions.get(sessionId);
-    if (session) {
-      try {
-        await session.abortPrompt();
-      } catch {
-      }
-      if (session.status !== "finished" && session.status !== "cancelled") {
-        session.markCancelled();
-      }
-      await session.destroy();
-      this.sessions.delete(sessionId);
+    const recordBefore = this.store?.get(sessionId);
+    const previousStatus = session?.status ?? recordBefore?.status;
+    if (!previousStatus) {
+      const error = new Error(`Session "${sessionId}" not found`);
+      error.code = "SESSION_NOT_FOUND";
+      throw error;
     }
-    if (this.store) {
+    const alreadyTerminal = previousStatus === "cancelled" || previousStatus === "finished";
+    const finalStatus = previousStatus === "finished" ? "finished" : "cancelled";
+    if (this.store && finalStatus === "cancelled") {
       const record = this.store.get(sessionId);
-      if (record && record.status !== "cancelled" && record.status !== "finished") {
+      if (record && record.status !== "cancelled") {
         await this.store.save({ ...record, status: "cancelled" });
+        this.store.flush();
       }
     }
-    if (this.middlewareChain) {
+    let cleanupPending = false;
+    if (session) {
+      if (!alreadyTerminal) {
+        session.markCancelled();
+        try {
+          await session.abortPrompt();
+        } catch (error) {
+          log7.warn(
+            { sessionId, error: redactNetworkSecrets(error instanceof Error ? error.message : String(error)) },
+            "Session prompt abort failed after cancellation became durable; continuing cleanup"
+          );
+        }
+      }
+      try {
+        await session.destroy();
+        this.sessions.delete(sessionId);
+      } catch (error) {
+        cleanupPending = true;
+        log7.warn(
+          { sessionId, error: redactNetworkSecrets(error instanceof Error ? error.message : String(error)) },
+          "Session is durably cancelled but agent/logger cleanup failed; repeat cancellation to retry cleanup"
+        );
+      }
+    }
+    if (!cleanupPending && this.middlewareChain) {
       this.middlewareChain.execute(Hook.SESSION_AFTER_DESTROY, { sessionId }, async (p) => p).catch(() => {
       });
     }
+    return {
+      sessionId,
+      cancelled: !alreadyTerminal,
+      previousStatus,
+      status: finalStatus,
+      alreadyTerminal,
+      cleanupPending,
+      ...cleanupPending ? { warning: "Session state is cancelled and persisted; process cleanup is pending. Repeat cancellation to retry cleanup." } : {}
+    };
   }
   /** List live (in-memory) sessions, optionally filtered by channel. Excludes assistant sessions. */
   listSessions(channelId) {
@@ -16752,7 +17819,7 @@ init_bypass_detection();
 import micromatch from "micromatch";
 init_events();
 var { isMatch } = micromatch;
-var log7 = createChildLogger({ module: "session-bridge" });
+var log8 = createChildLogger({ module: "session-bridge" });
 var SessionBridge = class {
   constructor(session, adapter, deps, adapterId) {
     this.session = session;
@@ -16784,16 +17851,16 @@ var SessionBridge = class {
         if (!result) return;
         this.tracer?.log("core", { step: "dispatch", sessionId, message: result.message });
         this.adapter.sendMessage(sessionId, result.message).catch((err) => {
-          log7.error({ err, sessionId }, "Failed to send message to adapter");
+          log8.error({ err, sessionId }, "Failed to send message to adapter");
         });
       } else {
         this.tracer?.log("core", { step: "dispatch", sessionId, message });
         this.adapter.sendMessage(sessionId, message).catch((err) => {
-          log7.error({ err, sessionId }, "Failed to send message to adapter");
+          log8.error({ err, sessionId }, "Failed to send message to adapter");
         });
       }
     } catch (err) {
-      log7.error({ err, sessionId }, "Error in sendMessage middleware");
+      log8.error({ err, sessionId }, "Error in sendMessage middleware");
     }
   }
   /**
@@ -16839,7 +17906,7 @@ var SessionBridge = class {
       try {
         await this.adapter.sendPermissionRequest(this.session.id, request);
       } catch (err) {
-        log7.error({ err, sessionId: this.session.id, adapterId: this.adapterId }, "Failed to send permission request to adapter");
+        log8.error({ err, sessionId: this.session.id, adapterId: this.adapterId }, "Failed to send permission request to adapter");
       }
     });
     this.listen(this.session, SessionEv.STATUS_CHANGE, (from, to) => {
@@ -16924,14 +17991,14 @@ var SessionBridge = class {
         try {
           this.handleAgentEvent(event);
         } catch (err) {
-          log7.error({ err, sessionId: this.session.id }, "Error handling agent event (middleware fallback)");
+          log8.error({ err, sessionId: this.session.id }, "Error handling agent event (middleware fallback)");
         }
       }
     } else {
       try {
         this.handleAgentEvent(event);
       } catch (err) {
-        log7.error({ err, sessionId: this.session.id }, "Error handling agent event");
+        log8.error({ err, sessionId: this.session.id }, "Error handling agent event");
       }
     }
   }
@@ -16984,40 +18051,40 @@ var SessionBridge = class {
         break;
       case "image_content": {
         if (this.deps.fileService) {
-          const fs37 = this.deps.fileService;
+          const fs38 = this.deps.fileService;
           const sid = this.session.id;
           const { data, mimeType } = event;
           const buffer = Buffer.from(data, "base64");
-          const ext = fs37.extensionFromMime(mimeType);
-          fs37.saveFile(sid, `agent-image${ext}`, buffer, mimeType).then((att) => {
+          const ext = fs38.extensionFromMime(mimeType);
+          fs38.saveFile(sid, `agent-image${ext}`, buffer, mimeType).then((att) => {
             this.sendMessage(sid, {
               type: "attachment",
               text: "",
               attachment: att
             });
-          }).catch((err) => log7.error({ err }, "Failed to save agent image"));
+          }).catch((err) => log8.error({ err }, "Failed to save agent image"));
         }
         break;
       }
       case "audio_content": {
         if (this.deps.fileService) {
-          const fs37 = this.deps.fileService;
+          const fs38 = this.deps.fileService;
           const sid = this.session.id;
           const { data, mimeType } = event;
           const buffer = Buffer.from(data, "base64");
-          const ext = fs37.extensionFromMime(mimeType);
-          fs37.saveFile(sid, `agent-audio${ext}`, buffer, mimeType).then((att) => {
+          const ext = fs38.extensionFromMime(mimeType);
+          fs38.saveFile(sid, `agent-audio${ext}`, buffer, mimeType).then((att) => {
             this.sendMessage(sid, {
               type: "attachment",
               text: "",
               attachment: att
             });
-          }).catch((err) => log7.error({ err }, "Failed to save agent audio"));
+          }).catch((err) => log8.error({ err }, "Failed to save agent audio"));
         }
         break;
       }
       case "commands_update":
-        log7.debug({ commands: event.commands }, "Commands available");
+        log8.debug({ commands: event.commands }, "Commands available");
         this.adapter.sendSkillCommands?.(this.session.id, event.commands);
         break;
       case "system_message":
@@ -17114,7 +18181,7 @@ var SessionBridge = class {
     if (isAgentBypass || isClientBypass) {
       const allowOption = request.options.find((o) => o.isAllow);
       if (allowOption) {
-        log7.info(
+        log8.info(
           { sessionId: this.session.id, requestId: request.id, optionId: allowOption.id, agentBypass: !!isAgentBypass, clientBypass: !!isClientBypass },
           "Bypass mode: auto-approving permission"
         );
@@ -17127,7 +18194,7 @@ var SessionBridge = class {
       if (isMatch(normalized, patterns, { dot: true })) {
         const allowOption = request.options.find((o) => o.isAllow);
         if (allowOption) {
-          log7.info(
+          log8.info(
             { sessionId: this.session.id, requestId: request.id, command: request.description },
             "autoApprovedCommands: auto-approving matching command"
           );
@@ -17155,7 +18222,7 @@ var SessionBridge = class {
 // src/core/sessions/session-factory.ts
 init_log();
 init_events();
-var log8 = createChildLogger({ module: "session-factory" });
+var log9 = createChildLogger({ module: "session-factory" });
 function toSetConfigOptionValue(option) {
   return option.type === "boolean" ? { type: "boolean", value: option.currentValue } : { type: "select", value: option.currentValue };
 }
@@ -17229,7 +18296,7 @@ var SessionFactory = class {
             configAllowedPaths
           );
         } catch (resumeErr) {
-          log8.warn(
+          log9.warn(
             { agentName: createParams.agentName, resumeErr },
             "Agent session resume failed, falling back to fresh spawn"
           );
@@ -17382,10 +18449,10 @@ var SessionFactory = class {
             }
           }
         }
-        log8.info({ sessionId }, "Lazy resume by ID successful");
+        log9.info({ sessionId }, "Lazy resume by ID successful");
         return session;
       } catch (err) {
-        log8.error({ err, sessionId }, "Lazy resume by ID failed");
+        log9.error({ err, sessionId }, "Lazy resume by ID failed");
         return null;
       } finally {
         this.resumeLocks.delete(sessionId);
@@ -17410,19 +18477,19 @@ var SessionFactory = class {
       (p) => String(p.topicId) === threadId || String(p.threadId ?? "") === threadId
     );
     if (!record) {
-      log8.debug({ threadId, channelId }, "No session record found for thread");
+      log9.debug({ threadId, channelId }, "No session record found for thread");
       return null;
     }
     if (record.isAssistant) return null;
     if (record.status === "error" || record.status === "cancelled") {
-      log8.warn(
+      log9.warn(
         { threadId, sessionId: record.sessionId, status: record.status },
         "Session record found but skipped (status: %s) \u2014 use /new to start a fresh session",
         record.status
       );
       return null;
     }
-    log8.info({ threadId, sessionId: record.sessionId, status: record.status }, "Lazy resume: found record, attempting resume");
+    log9.info({ threadId, sessionId: record.sessionId, status: record.status }, "Lazy resume: found record, attempting resume");
     const resumePromise = (async () => {
       try {
         const session = await this.createFullSession({
@@ -17474,7 +18541,7 @@ var SessionFactory = class {
         }
         const resumeFalledBack = record.agentSessionId && session.agentSessionId !== record.agentSessionId;
         if (resumeFalledBack) {
-          log8.info({ sessionId: session.id }, "Resume fell back to fresh spawn \u2014 injecting conversation history");
+          log9.info({ sessionId: session.id }, "Resume fell back to fresh spawn \u2014 injecting conversation history");
           const contextManager = this.getContextManager?.();
           if (contextManager) {
             try {
@@ -17491,10 +18558,10 @@ var SessionFactory = class {
             }
           }
         }
-        log8.info({ sessionId: session.id, threadId }, "Lazy resume successful");
+        log9.info({ sessionId: session.id, threadId }, "Lazy resume successful");
         return session;
       } catch (err) {
-        log8.error({ err, record }, "Lazy resume failed");
+        log9.error({ err, record }, "Lazy resume failed");
         const adapter = this.adapters?.get(channelId);
         if (adapter) {
           try {
@@ -17520,7 +18587,7 @@ var SessionFactory = class {
     }
     const config = this.configManager.get();
     const resolvedAgent = agentName || config.defaultAgent;
-    log8.info({ channelId, agentName: resolvedAgent }, "New session request");
+    log9.info({ channelId, agentName: resolvedAgent }, "New session request");
     const agentDef = this.agentCatalog.resolve(resolvedAgent);
     const resolvedWorkspace = this.configManager.resolveWorkspace(
       workspacePath || agentDef?.workingDirectory
@@ -17570,7 +18637,7 @@ var SessionFactory = class {
           params.contextOptions
         );
       } catch (err) {
-        log8.warn({ err }, "Context building failed, proceeding without context");
+        log9.warn({ err }, "Context building failed, proceeding without context");
       }
     }
     const session = await this.createFullSession({
@@ -17625,7 +18692,7 @@ import { nanoid as nanoid3 } from "nanoid";
 init_log();
 import fs9 from "fs";
 import path8 from "path";
-var log9 = createChildLogger({ module: "session-store" });
+var log10 = createChildLogger({ module: "session-store" });
 var DEBOUNCE_MS = 2e3;
 var JsonFileSessionStore = class {
   records = /* @__PURE__ */ new Map();
@@ -17739,7 +18806,7 @@ var JsonFileSessionStore = class {
         fs9.readFileSync(this.filePath, "utf-8")
       );
       if (raw.version !== 1) {
-        log9.warn(
+        log10.warn(
           { version: raw.version },
           "Unknown session store version, skipping load"
         );
@@ -17748,9 +18815,9 @@ var JsonFileSessionStore = class {
       for (const [id, record] of Object.entries(raw.sessions)) {
         this.records.set(id, this.migrateRecord(record));
       }
-      log9.debug({ count: this.records.size }, "Loaded session records");
+      log10.debug({ count: this.records.size }, "Loaded session records");
     } catch (err) {
-      log9.error({ err }, "Failed to load session store, backing up corrupt file");
+      log10.error({ err }, "Failed to load session store, backing up corrupt file");
       try {
         fs9.renameSync(this.filePath, `${this.filePath}.bak`);
       } catch {
@@ -17793,7 +18860,7 @@ var JsonFileSessionStore = class {
       }
     }
     if (removed > 0) {
-      log9.info({ removed }, "Cleaned up expired session records");
+      log10.info({ removed }, "Cleaned up expired session records");
       this.scheduleDiskWrite();
     }
   }
@@ -17812,7 +18879,7 @@ init_agent_registry();
 init_agent_registry();
 init_log();
 init_events();
-var log10 = createChildLogger({ module: "agent-switch" });
+var log11 = createChildLogger({ module: "agent-switch" });
 var AgentSwitchHandler = class {
   constructor(deps) {
     this.deps = deps;
@@ -17893,7 +18960,7 @@ var AgentSwitchHandler = class {
             resumed = true;
             return instance2;
           } catch {
-            log10.warn({ sessionId, toAgent }, "Resume failed, falling back to new agent with context injection");
+            log11.warn({ sessionId, toAgent }, "Resume failed, falling back to new agent with context injection");
           }
         }
         const instance = await agentManager.spawn(toAgent, session.workingDirectory, configAllowedPaths);
@@ -17962,10 +19029,10 @@ var AgentSwitchHandler = class {
             createBridge(session, adapter, adapterId).connect();
           }
         }
-        log10.warn({ sessionId, fromAgent, toAgent, err }, "Agent switch failed, rolled back to previous agent");
+        log11.warn({ sessionId, fromAgent, toAgent, err }, "Agent switch failed, rolled back to previous agent");
       } catch (rollbackErr) {
         session.fail(`Switch failed and rollback failed: ${rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr)}`);
-        log10.error({ sessionId, fromAgent, toAgent, err, rollbackErr }, "Agent switch failed and rollback also failed");
+        log11.error({ sessionId, fromAgent, toAgent, err, rollbackErr }, "Agent switch failed and rollback also failed");
       }
       throw err;
     }
@@ -17975,7 +19042,7 @@ var AgentSwitchHandler = class {
         if (adapter) {
           createBridge(session, adapter, adapterId).connect();
         } else {
-          log10.warn({ sessionId, adapterId }, "Adapter not available during switch reconnect, skipping bridge");
+          log11.warn({ sessionId, adapterId }, "Adapter not available during switch reconnect, skipping bridge");
         }
       }
     }
@@ -18003,7 +19070,7 @@ init_agent_dependencies();
 init_log();
 import * as fs12 from "fs";
 import * as path11 from "path";
-var log12 = createChildLogger({ module: "agent-catalog" });
+var log13 = createChildLogger({ module: "agent-catalog" });
 var REGISTRY_URL = "https://cdn.agentclientprotocol.com/registry/v1/latest/registry.json";
 var DEFAULT_TTL_HOURS = 24;
 var AgentCatalog = class {
@@ -18037,7 +19104,7 @@ var AgentCatalog = class {
   /** Fetch the latest agent registry from the CDN and update the local cache. */
   async fetchRegistry() {
     try {
-      log12.info("Fetching agent registry from CDN...");
+      log13.info("Fetching agent registry from CDN...");
       const response = await this.scopedFetch(this.registryUrl);
       if (!response.ok) throw new Error(`HTTP ${response.status}`);
       const data = await response.json();
@@ -18050,9 +19117,9 @@ var AgentCatalog = class {
       fs12.mkdirSync(path11.dirname(this.cachePath), { recursive: true });
       fs12.writeFileSync(this.cachePath, JSON.stringify(cache, null, 2), { mode: 384 });
       this.enrichInstalledFromRegistry();
-      log12.info({ count: this.registryAgents.length }, "Registry updated");
+      log13.info({ count: this.registryAgents.length }, "Registry updated");
     } catch (err) {
-      log12.warn({ err }, "Failed to fetch registry, using cached data");
+      log13.warn({ err }, "Failed to fetch registry, using cached data");
     }
   }
   /** Re-fetch registry only if the local cache has expired (24-hour TTL). */
@@ -18260,7 +19327,7 @@ var AgentCatalog = class {
       }
     }
     if (changed) {
-      log12.info("Enriched installed agents with registry data");
+      log13.info("Enriched installed agents with registry data");
     }
   }
   isCacheStale() {
@@ -18280,11 +19347,11 @@ var AgentCatalog = class {
         const raw = JSON.parse(fs12.readFileSync(this.cachePath, "utf-8"));
         if (raw.data?.agents) {
           this.registryAgents = raw.data.agents;
-          log12.debug({ count: this.registryAgents.length }, "Loaded registry from cache");
+          log13.debug({ count: this.registryAgents.length }, "Loaded registry from cache");
           return;
         }
       } catch {
-        log12.warn("Failed to load registry cache");
+        log13.warn("Failed to load registry cache");
       }
     }
     try {
@@ -18297,13 +19364,13 @@ var AgentCatalog = class {
         if (fs12.existsSync(candidate)) {
           const raw = JSON.parse(fs12.readFileSync(candidate, "utf-8"));
           this.registryAgents = raw.agents ?? [];
-          log12.debug({ count: this.registryAgents.length }, "Loaded registry from bundled snapshot");
+          log13.debug({ count: this.registryAgents.length }, "Loaded registry from bundled snapshot");
           return;
         }
       }
-      log12.warn("No registry data available (no cache, no snapshot)");
+      log13.warn("No registry data available (no cache, no snapshot)");
     } catch {
-      log12.warn("Failed to load bundled registry snapshot");
+      log13.warn("Failed to load bundled registry snapshot");
     }
   }
 };
@@ -18332,7 +19399,7 @@ init_log();
 import * as fs13 from "fs";
 import * as path12 from "path";
 import { z as z2 } from "zod";
-var log13 = createChildLogger({ module: "agent-store" });
+var log14 = createChildLogger({ module: "agent-store" });
 var InstalledAgentSchema = z2.object({
   registryId: z2.string().nullable(),
   name: z2.string(),
@@ -18368,11 +19435,11 @@ var AgentStore = class {
       if (result.success) {
         this.data = result.data;
       } else {
-        log13.warn({ errors: result.error.issues }, "Invalid agents.json, starting fresh");
+        log14.warn({ errors: result.error.issues }, "Invalid agents.json, starting fresh");
         this.data = { version: 1, installed: {} };
       }
     } catch (err) {
-      log13.warn({ err }, "Failed to read agents.json, starting fresh");
+      log14.warn({ err }, "Failed to read agents.json, starting fresh");
       this.data = { version: 1, installed: {} };
     }
   }
@@ -18827,7 +19894,7 @@ function createPluginContext(opts) {
     }
   };
   const baseLog = opts.log ?? noopLog;
-  const log38 = typeof baseLog.child === "function" ? baseLog.child({ plugin: pluginName }) : baseLog;
+  const log39 = typeof baseLog.child === "function" ? baseLog.child({ plugin: pluginName }) : baseLog;
   const storageImpl = new PluginStorageImpl(storagePath);
   const storage = {
     async get(key) {
@@ -18897,7 +19964,7 @@ function createPluginContext(opts) {
   const ctx = {
     pluginName,
     pluginConfig,
-    log: log38,
+    log: log39,
     storage,
     on(event, handler) {
       requirePermission(permissions, "events:read", "on()");
@@ -18932,7 +19999,7 @@ function createPluginContext(opts) {
       const registry = serviceRegistry.get("command-registry");
       if (registry && typeof registry.register === "function") {
         registry.register(def, pluginName);
-        log38.debug(`Command '/${def.name}' registered`);
+        log39.debug(`Command '/${def.name}' registered`);
       }
     },
     async sendMessage(_sessionId, _content) {
@@ -18995,7 +20062,7 @@ function createPluginContext(opts) {
       const registry = serviceRegistry.get("field-registry");
       if (registry && typeof registry.register === "function") {
         registry.register(pluginName, fields);
-        log38.debug(`Registered ${fields.length} editable field(s) for ${pluginName}`);
+        log39.debug(`Registered ${fields.length} editable field(s) for ${pluginName}`);
       }
     },
     get sessions() {
@@ -19335,7 +20402,7 @@ var LifecycleManager = class {
 
 // src/core/menu-registry.ts
 init_log();
-var log14 = createChildLogger({ module: "menu-registry" });
+var log15 = createChildLogger({ module: "menu-registry" });
 var MenuRegistry = class {
   items = /* @__PURE__ */ new Map();
   /** Register or replace a menu item by its unique ID. */
@@ -19357,7 +20424,7 @@ var MenuRegistry = class {
       try {
         return item.visible();
       } catch (err) {
-        log14.warn({ err, id: item.id }, "MenuItem visible() threw, hiding item");
+        log15.warn({ err, id: item.id }, "MenuItem visible() threw, hiding item");
         return false;
       }
     }).sort((a, b) => a.priority - b.priority);
@@ -19425,7 +20492,7 @@ openacp api new claude ~/project
 }
 
 // src/core/assistant/assistant-registry.ts
-var log15 = createChildLogger({ module: "assistant-registry" });
+var log16 = createChildLogger({ module: "assistant-registry" });
 var AssistantRegistry = class {
   sections = /* @__PURE__ */ new Map();
   _instanceRoot = "";
@@ -19436,7 +20503,7 @@ var AssistantRegistry = class {
   /** Register a prompt section. Overwrites any existing section with the same id. */
   register(section) {
     if (this.sections.has(section.id)) {
-      log15.warn({ id: section.id }, "Assistant section overwritten");
+      log16.warn({ id: section.id }, "Assistant section overwritten");
     }
     this.sections.set(section.id, section);
   }
@@ -19472,7 +20539,7 @@ ${context}`);
           parts.push("```bash\n" + cmds + "\n```");
         }
       } catch (err) {
-        log15.warn({ err, sectionId: section.id }, "Assistant section buildContext() failed, skipping");
+        log16.warn({ err, sectionId: section.id }, "Assistant section buildContext() failed, skipping");
       }
     }
     parts.push(buildAssistantGuidelines(this._instanceRoot));
@@ -19482,7 +20549,7 @@ ${context}`);
 
 // src/core/assistant/assistant-manager.ts
 init_log();
-var log16 = createChildLogger({ module: "assistant-manager" });
+var log17 = createChildLogger({ module: "assistant-manager" });
 var AssistantManager = class {
   constructor(core, registry) {
     this.core = core;
@@ -19513,7 +20580,7 @@ var AssistantManager = class {
     this.sessions.set(channelId, session);
     const systemPrompt = this.registry.buildSystemPrompt(channelId);
     this.pendingSystemPrompts.set(channelId, systemPrompt);
-    log16.info(
+    log17.info(
       { sessionId: session.id, channelId, reused: !!existing },
       existing ? "Assistant session reused (system prompt deferred)" : "Assistant spawned (system prompt deferred)"
     );
@@ -19704,6 +20771,13 @@ function registerCoreMenuItems(registry) {
     group: "config",
     action: { type: "command", command: "/integrate" }
   });
+  registry.register({
+    id: "core:proxy",
+    label: "\u{1F310} Proxy Routing",
+    priority: 32,
+    group: "config",
+    action: { type: "command", command: "/proxy" }
+  });
   registry.register({
     id: "core:restart",
     label: "\u{1F504} Restart",
@@ -19739,7 +20813,7 @@ init_log();
 init_native_stt();
 init_events();
 init_proxy_service();
-var log17 = createChildLogger({ module: "core" });
+var log18 = createChildLogger({ module: "core" });
 var OpenACPCore = class {
   configManager;
   agentCatalog;
@@ -19822,7 +20896,7 @@ var OpenACPCore = class {
     this.proxyService.onRouteChanged(async (scope) => {
       if (scope === "global" || scope === "agents.default" || scope.startsWith("agents.")) {
         await this.agentManager.destroyWarm();
-        log17.info({ scope }, "Proxy route changed; idle agent warm pool invalidated");
+        log18.info({ scope }, "Proxy route changed; idle agent warm pool invalidated");
       }
     });
     const storePath = ctx.paths.sessions;
@@ -19884,7 +20958,7 @@ var OpenACPCore = class {
         if (configPath === "logging.level" && typeof value === "string") {
           const { setLogLevel: setLogLevel2 } = await Promise.resolve().then(() => (init_log(), log_exports));
           setLogLevel2(value);
-          log17.info({ level: value }, "Log level changed at runtime");
+          log18.info({ level: value }, "Log level changed at runtime");
         }
         if (configPath.startsWith("speech.")) {
           const speechSvc = this.lifecycleManager.serviceRegistry.get("speech");
@@ -19894,7 +20968,7 @@ var OpenACPCore = class {
               const pluginCfg = await settingsMgr.loadSettings("@openacp/speech");
               const newSpeechConfig = buildSpeechServiceConfig(pluginCfg);
               speechSvc.refreshProviders(newSpeechConfig);
-              log17.info("Speech service config updated at runtime (from plugin settings)");
+              log18.info("Speech service config updated at runtime (from plugin settings)");
             }
           }
         }
@@ -19935,14 +21009,14 @@ var OpenACPCore = class {
    */
   async start() {
     this.agentCatalog.refreshRegistryIfStale().catch((err) => {
-      log17.warn({ err }, "Background registry refresh failed");
+      log18.warn({ err }, "Background registry refresh failed");
     });
     const failures = [];
     for (const [name, adapter] of this.adapters.entries()) {
       try {
         await adapter.start();
       } catch (err) {
-        log17.error({ err, adapter: name }, `Adapter "${name}" failed to start`);
+        log18.error({ err, adapter: name }, `Adapter "${name}" failed to start`);
         failures.push({ name, error: err });
       }
     }
@@ -20023,7 +21097,7 @@ var OpenACPCore = class {
    * If no session is found, the user is told to start one with /new.
    */
   async handleMessage(message, initialMeta) {
-    log17.debug(
+    log18.debug(
       {
         channelId: message.channelId,
         threadId: message.threadId,
@@ -20044,7 +21118,7 @@ var OpenACPCore = class {
     }
     const access2 = await this.securityGuard.checkAccess(message);
     if (!access2.allowed) {
-      log17.warn({ userId: message.userId, reason: access2.reason }, "Access denied");
+      log18.warn({ userId: message.userId, reason: access2.reason }, "Access denied");
       if (access2.reason.includes("Session limit")) {
         const adapter = this.adapters.get(message.channelId);
         if (adapter) {
@@ -20058,7 +21132,7 @@ var OpenACPCore = class {
     }
     let session = await this.sessionFactory.getOrResume(message.channelId, message.threadId);
     if (!session) {
-      log17.warn(
+      log18.warn(
         { channelId: message.channelId, threadId: message.threadId },
         "No session found for thread (in-memory miss + lazy resume returned null)"
       );
@@ -20110,7 +21184,7 @@ ${text3}`;
     });
     session.enqueuePrompt(text3, attachments, routing, turnId, meta).catch((err) => {
       const reason = err instanceof Error ? err.message : String(err);
-      log17.warn({ err, sessionId: session.id, turnId, reason }, "enqueuePrompt failed \u2014 emitting message:failed");
+      log18.warn({ err, sessionId: session.id, turnId, reason }, "enqueuePrompt failed \u2014 emitting message:failed");
       this.eventBus.emit(BusEvent.MESSAGE_FAILED, {
         sessionId: session.id,
         turnId,
@@ -20227,7 +21301,7 @@ ${text3}`;
       const bridge = this.createBridge(session, adapter, session.channelId);
       bridge.connect();
       adapter.flushPendingSkillCommands?.(session.id).catch((err) => {
-        log17.warn({ err, sessionId: session.id }, "Failed to flush pending skill commands");
+        log18.warn({ err, sessionId: session.id }, "Failed to flush pending skill commands");
       });
       if (params.createThread && session.threadId) {
         this.eventBus.emit(BusEvent.SESSION_THREAD_READY, {
@@ -20241,14 +21315,14 @@ ${text3}`;
       session.agentInstance.onPermissionRequest = async (permRequest) => {
         const allowOption = permRequest.options.find((o) => o.isAllow);
         if (!allowOption) {
-          log17.warn(
+          log18.warn(
             { sessionId: session.id, permissionId: permRequest.id, description: permRequest.description },
             "Headless session has no allow option for permission request \u2014 skipping auto-approve, will time out"
           );
           return new Promise(() => {
           });
         }
-        log17.warn(
+        log18.warn(
           { sessionId: session.id, permissionId: permRequest.id, option: allowOption.id },
           `Auto-approving permission "${permRequest.description}" for headless session \u2014 no adapter connected`
         );
@@ -20302,7 +21376,7 @@ ${text3}`;
       notificationManager: this.notificationManager,
       tunnelService: this._tunnelService
     });
-    log17.info(
+    log18.info(
       { sessionId: session.id, agentName: params.agentName },
       "Session created via pipeline"
     );
@@ -20721,33 +21795,33 @@ init_doctor();
 init_config_registry();
 
 // src/core/config/config-editor.ts
-import * as path32 from "path";
+import * as path33 from "path";
 import * as clack2 from "@clack/prompts";
 
 // src/cli/autostart.ts
 init_log();
 import { execFileSync as execFileSync6 } from "child_process";
-import * as fs27 from "fs";
-import * as path25 from "path";
-import * as os7 from "os";
-var log19 = createChildLogger({ module: "autostart" });
-var LEGACY_LAUNCHD_PLIST_PATH = path25.join(os7.homedir(), "Library", "LaunchAgents", "com.openacp.daemon.plist");
-var LEGACY_SYSTEMD_SERVICE_PATH = path25.join(os7.homedir(), ".config", "systemd", "user", "openacp.service");
+import * as fs29 from "fs";
+import * as path27 from "path";
+import * as os9 from "os";
+var log20 = createChildLogger({ module: "autostart" });
+var LEGACY_LAUNCHD_PLIST_PATH = path27.join(os9.homedir(), "Library", "LaunchAgents", "com.openacp.daemon.plist");
+var LEGACY_SYSTEMD_SERVICE_PATH = path27.join(os9.homedir(), ".config", "systemd", "user", "openacp.service");
 function getLaunchdLabel(instanceId) {
   return `com.openacp.daemon.${instanceId}`;
 }
 function getLaunchdPlistPath(instanceId) {
-  return path25.join(os7.homedir(), "Library", "LaunchAgents", `${getLaunchdLabel(instanceId)}.plist`);
+  return path27.join(os9.homedir(), "Library", "LaunchAgents", `${getLaunchdLabel(instanceId)}.plist`);
 }
 function getSystemdServiceName(instanceId) {
   return `openacp-${instanceId}`;
 }
 function getSystemdServicePath(instanceId) {
-  return path25.join(os7.homedir(), ".config", "systemd", "user", `${getSystemdServiceName(instanceId)}.service`);
+  return path27.join(os9.homedir(), ".config", "systemd", "user", `${getSystemdServiceName(instanceId)}.service`);
 }
 function getAutoStartState(instanceId) {
   if (process.platform === "linux") {
-    const installed = fs27.existsSync(getSystemdServicePath(instanceId));
+    const installed = fs29.existsSync(getSystemdServicePath(instanceId));
     if (!installed) return { installed: false, manager: null, active: false };
     try {
       const output = execFileSync6("systemctl", [
@@ -20769,7 +21843,7 @@ function getAutoStartState(instanceId) {
     }
   }
   if (process.platform === "darwin") {
-    const installed = fs27.existsSync(getLaunchdPlistPath(instanceId));
+    const installed = fs29.existsSync(getLaunchdPlistPath(instanceId));
     if (!installed) return { installed: false, manager: null, active: false };
     try {
       const uid = process.getuid();
@@ -20799,7 +21873,7 @@ function escapeSystemdValue(str) {
 }
 function generateLaunchdPlist(nodePath, cliPath, logDir2, instanceRoot, instanceId) {
   const label = getLaunchdLabel(instanceId);
-  const logFile = path25.join(logDir2, "openacp.log");
+  const logFile = path27.join(logDir2, "openacp.log");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -20851,32 +21925,32 @@ WantedBy=default.target
 `;
 }
 function migrateLegacy() {
-  if (process.platform === "darwin" && fs27.existsSync(LEGACY_LAUNCHD_PLIST_PATH)) {
+  if (process.platform === "darwin" && fs29.existsSync(LEGACY_LAUNCHD_PLIST_PATH)) {
     try {
       const uid = process.getuid();
       execFileSync6("launchctl", ["bootout", `gui/${uid}`, "com.openacp.daemon"], { stdio: "pipe" });
     } catch {
     }
     try {
-      fs27.unlinkSync(LEGACY_LAUNCHD_PLIST_PATH);
+      fs29.unlinkSync(LEGACY_LAUNCHD_PLIST_PATH);
     } catch {
     }
-    log19.info("Removed legacy single-instance LaunchAgent");
+    log20.info("Removed legacy single-instance LaunchAgent");
   }
-  if (process.platform === "linux" && fs27.existsSync(LEGACY_SYSTEMD_SERVICE_PATH)) {
+  if (process.platform === "linux" && fs29.existsSync(LEGACY_SYSTEMD_SERVICE_PATH)) {
     try {
       execFileSync6("systemctl", ["--user", "disable", "openacp"], { stdio: "pipe" });
     } catch {
     }
     try {
-      fs27.unlinkSync(LEGACY_SYSTEMD_SERVICE_PATH);
+      fs29.unlinkSync(LEGACY_SYSTEMD_SERVICE_PATH);
     } catch {
     }
     try {
       execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
     } catch {
     }
-    log19.info("Removed legacy single-instance systemd service");
+    log20.info("Removed legacy single-instance systemd service");
   }
 }
 function installAutoStart(logDir2, instanceRoot, instanceId) {
@@ -20884,26 +21958,26 @@ function installAutoStart(logDir2, instanceRoot, instanceId) {
     return { success: false, error: "Auto-start not supported on this platform" };
   }
   const nodePath = process.execPath;
-  const cliPath = path25.resolve(process.argv[1]);
-  const resolvedLogDir = logDir2.startsWith("~") ? path25.join(os7.homedir(), logDir2.slice(1)) : logDir2;
+  const cliPath = path27.resolve(process.argv[1]);
+  const resolvedLogDir = logDir2.startsWith("~") ? path27.join(os9.homedir(), logDir2.slice(1)) : logDir2;
   try {
     migrateLegacy();
     if (process.platform === "darwin") {
       const plistPath = getLaunchdPlistPath(instanceId);
       const plist = generateLaunchdPlist(nodePath, cliPath, resolvedLogDir, instanceRoot, instanceId);
-      const dir = path25.dirname(plistPath);
-      fs27.mkdirSync(dir, { recursive: true });
+      const dir = path27.dirname(plistPath);
+      fs29.mkdirSync(dir, { recursive: true });
       const uid = process.getuid();
       const domain = `gui/${uid}`;
-      const previous = fs27.existsSync(plistPath) ? fs27.readFileSync(plistPath, "utf8") : void 0;
+      const previous = fs29.existsSync(plistPath) ? fs29.readFileSync(plistPath, "utf8") : void 0;
       const previousState = getAutoStartState(instanceId);
       const tmp = `${plistPath}.${process.pid}.tmp`;
       let replaced = false;
       let bootedOut = false;
       try {
-        fs27.writeFileSync(tmp, plist, { mode: 384 });
+        fs29.writeFileSync(tmp, plist, { mode: 384 });
         execFileSync6("plutil", ["-lint", tmp], { stdio: "pipe" });
-        fs27.renameSync(tmp, plistPath);
+        fs29.renameSync(tmp, plistPath);
         replaced = true;
         if (previousState.active) {
           execFileSync6("launchctl", ["bootout", domain, plistPath], { stdio: "pipe" });
@@ -20912,7 +21986,7 @@ function installAutoStart(logDir2, instanceRoot, instanceId) {
         execFileSync6("launchctl", ["bootstrap", domain, plistPath], { stdio: "pipe" });
       } catch (error) {
         try {
-          fs27.rmSync(tmp, { force: true });
+          fs29.rmSync(tmp, { force: true });
         } catch {
         }
         if (replaced) {
@@ -20922,48 +21996,48 @@ function installAutoStart(logDir2, instanceRoot, instanceId) {
             rollbackBootedOut = true;
           } catch {
           }
-          if (previous === void 0) fs27.rmSync(plistPath, { force: true });
+          if (previous === void 0) fs29.rmSync(plistPath, { force: true });
           else {
             const rollbackTmp = `${plistPath}.${process.pid}.rollback.tmp`;
-            fs27.writeFileSync(rollbackTmp, previous, { mode: 384 });
-            fs27.renameSync(rollbackTmp, plistPath);
+            fs29.writeFileSync(rollbackTmp, previous, { mode: 384 });
+            fs29.renameSync(rollbackTmp, plistPath);
             if (previousState.active || bootedOut || rollbackBootedOut) execFileSync6("launchctl", ["bootstrap", domain, plistPath], { stdio: "pipe" });
           }
         }
         throw error;
       }
-      log19.info({ instanceId }, "LaunchAgent installed");
+      log20.info({ instanceId }, "LaunchAgent installed");
       return { success: true };
     }
     if (process.platform === "linux") {
       const servicePath = getSystemdServicePath(instanceId);
       const serviceName = getSystemdServiceName(instanceId);
       const unit = generateSystemdUnit(nodePath, cliPath, instanceRoot, instanceId);
-      const dir = path25.dirname(servicePath);
-      fs27.mkdirSync(dir, { recursive: true });
-      const previous = fs27.existsSync(servicePath) ? fs27.readFileSync(servicePath, "utf8") : void 0;
+      const dir = path27.dirname(servicePath);
+      fs29.mkdirSync(dir, { recursive: true });
+      const previous = fs29.existsSync(servicePath) ? fs29.readFileSync(servicePath, "utf8") : void 0;
       const tmp = `${servicePath}.${process.pid}.tmp`;
-      fs27.writeFileSync(tmp, unit, { mode: 384 });
-      fs27.renameSync(tmp, servicePath);
+      fs29.writeFileSync(tmp, unit, { mode: 384 });
+      fs29.renameSync(tmp, servicePath);
       try {
         execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
         execFileSync6("systemctl", ["--user", "enable", serviceName], { stdio: "pipe" });
       } catch (error) {
-        if (previous === void 0) fs27.unlinkSync(servicePath);
-        else fs27.writeFileSync(servicePath, previous);
+        if (previous === void 0) fs29.unlinkSync(servicePath);
+        else fs29.writeFileSync(servicePath, previous);
         try {
           execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
         } catch {
         }
         throw error;
       }
-      log19.info({ instanceId }, "systemd user service installed");
+      log20.info({ instanceId }, "systemd user service installed");
       return { success: true };
     }
     return { success: false, error: "Unsupported platform" };
   } catch (e) {
     const msg = e.message;
-    log19.error({ err: msg }, "Failed to install auto-start");
+    log20.error({ err: msg }, "Failed to install auto-start");
     return { success: false, error: msg };
   }
 }
@@ -20974,44 +22048,44 @@ function uninstallAutoStart(instanceId) {
   try {
     if (process.platform === "darwin") {
       const plistPath = getLaunchdPlistPath(instanceId);
-      if (fs27.existsSync(plistPath)) {
+      if (fs29.existsSync(plistPath)) {
         const uid = process.getuid();
         try {
           execFileSync6("launchctl", ["bootout", `gui/${uid}`, plistPath], { stdio: "pipe" });
         } catch {
         }
-        fs27.unlinkSync(plistPath);
-        log19.info({ instanceId }, "LaunchAgent removed");
+        fs29.unlinkSync(plistPath);
+        log20.info({ instanceId }, "LaunchAgent removed");
       }
       return { success: true };
     }
     if (process.platform === "linux") {
       const servicePath = getSystemdServicePath(instanceId);
       const serviceName = getSystemdServiceName(instanceId);
-      if (fs27.existsSync(servicePath)) {
+      if (fs29.existsSync(servicePath)) {
         try {
           execFileSync6("systemctl", ["--user", "disable", serviceName], { stdio: "pipe" });
         } catch {
         }
-        fs27.unlinkSync(servicePath);
+        fs29.unlinkSync(servicePath);
         execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
-        log19.info({ instanceId }, "systemd user service removed");
+        log20.info({ instanceId }, "systemd user service removed");
       }
       return { success: true };
     }
     return { success: false, error: "Unsupported platform" };
   } catch (e) {
     const msg = e.message;
-    log19.error({ err: msg }, "Failed to uninstall auto-start");
+    log20.error({ err: msg }, "Failed to uninstall auto-start");
     return { success: false, error: msg };
   }
 }
 function isAutoStartInstalled(instanceId) {
   if (process.platform === "darwin") {
-    return fs27.existsSync(getLaunchdPlistPath(instanceId));
+    return fs29.existsSync(getLaunchdPlistPath(instanceId));
   }
   if (process.platform === "linux") {
-    return fs27.existsSync(getSystemdServicePath(instanceId));
+    return fs29.existsSync(getSystemdServicePath(instanceId));
   }
   return false;
 }
@@ -21020,25 +22094,25 @@ function isAutoStartInstalled(instanceId) {
 init_instance_context();
 init_instance_registry();
 init_log();
-import fs30 from "fs";
-import path28 from "path";
-var log20 = createChildLogger({ module: "resolve-instance-id" });
+import fs31 from "fs";
+import path29 from "path";
+var log21 = createChildLogger({ module: "resolve-instance-id" });
 function resolveInstanceId(instanceRoot) {
   try {
-    const configPath = path28.join(instanceRoot, "config.json");
-    const raw = JSON.parse(fs30.readFileSync(configPath, "utf-8"));
+    const configPath = path29.join(instanceRoot, "config.json");
+    const raw = JSON.parse(fs31.readFileSync(configPath, "utf-8"));
     if (raw.id && typeof raw.id === "string") return raw.id;
   } catch {
   }
   try {
-    const reg = new InstanceRegistry(path28.join(getGlobalRoot(), "instances.json"));
+    const reg = new InstanceRegistry(path29.join(getGlobalRoot(), "instances.json"));
     reg.load();
     const entry = reg.getByRoot(instanceRoot);
     if (entry?.id) return entry.id;
   } catch (err) {
-    log20.debug({ err: err.message, instanceRoot }, "Could not read instance registry, using fallback id");
+    log21.debug({ err: err.message, instanceRoot }, "Could not read instance registry, using fallback id");
   }
-  return path28.basename(path28.dirname(instanceRoot)).replace(/[^a-zA-Z0-9-]/g, "-") || "default";
+  return path29.basename(path29.dirname(instanceRoot)).replace(/[^a-zA-Z0-9-]/g, "-") || "default";
 }
 
 // src/core/config/config-editor.ts
@@ -21610,7 +22684,7 @@ async function runConfigEditor(configManager, mode = "file", apiPort, settingsMa
   await configManager.load();
   const config = configManager.get();
   const updates = {};
-  const instanceRoot = path32.dirname(configManager.getConfigPath());
+  const instanceRoot = path33.dirname(configManager.getConfigPath());
   console.log(`
 ${c.cyan}${c.bold}OpenACP Config Editor${c.reset}`);
   console.log(dim(`Config: ${configManager.getConfigPath()}`));
@@ -21667,17 +22741,17 @@ ${c.cyan}${c.bold}OpenACP Config Editor${c.reset}`);
 async function sendConfigViaApi(port, updates) {
   const { apiCall: call } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
   const paths = flattenToPaths(updates);
-  for (const { path: path37, value } of paths) {
+  for (const { path: path38, value } of paths) {
     const res = await call(port, "/api/config", {
       method: "PATCH",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ path: path37, value })
+      body: JSON.stringify({ path: path38, value })
     });
     const data = await res.json();
     if (!res.ok) {
-      console.log(warn(`Failed to update ${path37}: ${data.error}`));
+      console.log(warn(`Failed to update ${path38}: ${data.error}`));
     } else if (data.needsRestart) {
-      console.log(warn(`${path37} updated \u2014 restart required`));
+      console.log(warn(`${path38} updated \u2014 restart required`));
     }
   }
 }
@@ -21697,25 +22771,25 @@ function flattenToPaths(obj, prefix = "") {
 // src/cli/daemon.ts
 init_config();
 import { spawn as spawn3 } from "child_process";
-import * as fs33 from "fs";
-import * as path33 from "path";
+import * as fs34 from "fs";
+import * as path34 from "path";
 function getPidPath(root) {
-  return path33.join(root, "openacp.pid");
+  return path34.join(root, "openacp.pid");
 }
 function getLogDir(root) {
-  return path33.join(root, "logs");
+  return path34.join(root, "logs");
 }
 function getRunningMarker(root) {
-  return path33.join(root, "running");
+  return path34.join(root, "running");
 }
 function writePidFile(pidPath, pid) {
-  const dir = path33.dirname(pidPath);
-  fs33.mkdirSync(dir, { recursive: true });
-  fs33.writeFileSync(pidPath, String(pid));
+  const dir = path34.dirname(pidPath);
+  fs34.mkdirSync(dir, { recursive: true });
+  fs34.writeFileSync(pidPath, String(pid));
 }
 function readPidFile(pidPath) {
   try {
-    const content = fs33.readFileSync(pidPath, "utf-8").trim();
+    const content = fs34.readFileSync(pidPath, "utf-8").trim();
     const pid = parseInt(content, 10);
     return isNaN(pid) ? null : pid;
   } catch {
@@ -21724,7 +22798,7 @@ function readPidFile(pidPath) {
 }
 function removePidFile(pidPath) {
   try {
-    fs33.unlinkSync(pidPath);
+    fs34.unlinkSync(pidPath);
   } catch {
   }
 }
@@ -21757,12 +22831,12 @@ function startDaemon(pidPath, logDir2, instanceRoot) {
     return { error: `Already running (PID ${pid})` };
   }
   const resolvedLogDir = logDir2 ? expandHome2(logDir2) : getLogDir(instanceRoot);
-  fs33.mkdirSync(resolvedLogDir, { recursive: true });
-  const logFile = path33.join(resolvedLogDir, "openacp.log");
-  const cliPath = path33.resolve(process.argv[1]);
+  fs34.mkdirSync(resolvedLogDir, { recursive: true });
+  const logFile = path34.join(resolvedLogDir, "openacp.log");
+  const cliPath = path34.resolve(process.argv[1]);
   const nodePath = process.execPath;
-  const out = fs33.openSync(logFile, "a");
-  const err = fs33.openSync(logFile, "a");
+  const out = fs34.openSync(logFile, "a");
+  const err = fs34.openSync(logFile, "a");
   const child = spawn3(nodePath, [cliPath, "--daemon-child"], {
     detached: true,
     stdio: ["ignore", out, err],
@@ -21771,8 +22845,8 @@ function startDaemon(pidPath, logDir2, instanceRoot) {
       ...instanceRoot ? { OPENACP_INSTANCE_ROOT: instanceRoot } : {}
     }
   });
-  fs33.closeSync(out);
-  fs33.closeSync(err);
+  fs34.closeSync(out);
+  fs34.closeSync(err);
   if (!child.pid) {
     return { error: "Failed to spawn daemon process" };
   }
@@ -21843,12 +22917,12 @@ async function stopDaemon(pidPath, instanceRoot) {
 }
 function markRunning(root) {
   const marker = getRunningMarker(root);
-  fs33.mkdirSync(path33.dirname(marker), { recursive: true });
-  fs33.writeFileSync(marker, "");
+  fs34.mkdirSync(path34.dirname(marker), { recursive: true });
+  fs34.writeFileSync(marker, "");
 }
 function clearRunning(root) {
   try {
-    fs33.unlinkSync(getRunningMarker(root));
+    fs34.unlinkSync(getRunningMarker(root));
   } catch {
   }
 }
@@ -21864,7 +22938,7 @@ init_static_server();
 
 // src/plugins/telegram/topic-manager.ts
 init_log();
-var log23 = createChildLogger({ module: "topic-manager" });
+var log24 = createChildLogger({ module: "topic-manager" });
 var TopicManager = class {
   constructor(sessionManager, adapter, systemTopicIds) {
     this.sessionManager = sessionManager;
@@ -21916,7 +22990,7 @@ var TopicManager = class {
       try {
         await this.adapter.deleteSessionThread?.(sessionId);
       } catch (err) {
-        log23.warn({ err, sessionId, topicId }, "Failed to delete platform thread, removing record anyway");
+        log24.warn({ err, sessionId, topicId }, "Failed to delete platform thread, removing record anyway");
       }
     }
     await this.sessionManager.removeRecord(sessionId);
@@ -21943,7 +23017,7 @@ var TopicManager = class {
           try {
             await this.adapter.deleteSessionThread?.(record.sessionId);
           } catch (err) {
-            log23.warn({ err, sessionId: record.sessionId }, "Failed to delete platform thread during cleanup");
+            log24.warn({ err, sessionId: record.sessionId }, "Failed to delete platform thread during cleanup");
           }
         }
         await this.sessionManager.removeRecord(record.sessionId);