@n1creator/openacp-cli 2026.713.1 → 2026.713.2

package/dist/index.js

@@ -458,22 +458,22 @@ __export(config_registry_exports, {
   resolveOptions: () => resolveOptions,
   setFieldValueAsync: () => setFieldValueAsync
 });
-function getFieldDef(path39) {
-  return CONFIG_REGISTRY.find((f) => f.path === path39);
+function getFieldDef(path42) {
+  return CONFIG_REGISTRY.find((f) => f.path === path42);
 }
 function getSafeFields() {
   return CONFIG_REGISTRY.filter((f) => f.scope === "safe");
 }
-function isHotReloadable(path39) {
-  const def = getFieldDef(path39);
+function isHotReloadable(path42) {
+  const def = getFieldDef(path42);
   return def?.hotReload ?? false;
 }
 function resolveOptions(def, config) {
   if (!def.options) return void 0;
   return typeof def.options === "function" ? def.options(config) : def.options;
 }
-function getConfigValue(config, path39) {
-  const parts = path39.split(".");
+function getConfigValue(config, path42) {
+  const parts = path42.split(".");
   let current = config;
   for (const part of parts) {
     if (current && typeof current === "object" && part in current) {
@@ -1624,27 +1624,27 @@ function validateExtractedPaths(destDir) {
   }
 }
 async function extractTarGz(buffer, destDir) {
-  const { execFileSync: execFileSync8 } = await import("child_process");
+  const { execFileSync: execFileSync9 } = await import("child_process");
   const tmpFile = path10.join(destDir, "_archive.tar.gz");
   fs11.writeFileSync(tmpFile, buffer);
   try {
-    const listing = execFileSync8("tar", ["tf", tmpFile], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
+    const listing = execFileSync9("tar", ["tf", tmpFile], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
     validateArchiveContents(listing, destDir);
-    execFileSync8("tar", ["xzf", tmpFile, "-C", destDir], { stdio: "pipe" });
+    execFileSync9("tar", ["xzf", tmpFile, "-C", destDir], { stdio: "pipe" });
   } finally {
     fs11.unlinkSync(tmpFile);
   }
   validateExtractedPaths(destDir);
 }
 async function extractZip(buffer, destDir) {
-  const { execFileSync: execFileSync8 } = await import("child_process");
+  const { execFileSync: execFileSync9 } = await import("child_process");
   const tmpFile = path10.join(destDir, "_archive.zip");
   fs11.writeFileSync(tmpFile, buffer);
   try {
-    const listing = execFileSync8("unzip", ["-l", tmpFile], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
+    const listing = execFileSync9("unzip", ["-l", tmpFile], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
     const entries = listing.slice(3, -2).map((line) => line.trim().split(/\s+/).slice(3).join(" ")).filter(Boolean);
     validateArchiveContents(entries, destDir);
-    execFileSync8("unzip", ["-o", tmpFile, "-d", destDir], { stdio: "pipe" });
+    execFileSync9("unzip", ["-o", tmpFile, "-d", destDir], { stdio: "pipe" });
   } finally {
     fs11.unlinkSync(tmpFile);
   }
@@ -2684,25 +2684,50 @@ function mimeToExt(mimeType) {
   };
   return map[mimeType] || ".bin";
 }
-var GROQ_API_URL, GroqSTT;
+var GROQ_API_URL, GROQ_MODELS_URL, GroqSTT;
 var init_groq = __esm({
   "src/plugins/speech/providers/groq.ts"() {
     "use strict";
     GROQ_API_URL = "https://api.groq.com/openai/v1/audio/transcriptions";
+    GROQ_MODELS_URL = "https://api.groq.com/openai/v1/models";
     GroqSTT = class {
-      constructor(apiKey, defaultModel = "whisper-large-v3-turbo", scopedFetch = globalThis.fetch, getScopedFetch, endpoint = GROQ_API_URL) {
+      constructor(apiKey, defaultModel = "whisper-large-v3-turbo", scopedFetch = globalThis.fetch, getScopedFetch, endpoint = GROQ_API_URL, accessEndpoint = GROQ_MODELS_URL) {
         this.apiKey = apiKey;
         this.defaultModel = defaultModel;
         this.scopedFetch = scopedFetch;
         this.getScopedFetch = getScopedFetch;
         this.endpoint = endpoint;
+        this.accessEndpoint = accessEndpoint;
       }
       apiKey;
       defaultModel;
       scopedFetch;
       getScopedFetch;
       endpoint;
+      accessEndpoint;
       name = "groq";
+      /** Validate credentials without sending audio or exposing a provider response body. */
+      async checkAccess(signal) {
+        let response;
+        try {
+          response = await (this.getScopedFetch?.() ?? this.scopedFetch)(this.accessEndpoint, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${this.apiKey}` },
+            signal
+          });
+        } catch {
+          return { ok: false, message: "Could not reach Groq through the configured speech route." };
+        }
+        try {
+          await response.body?.cancel();
+        } catch {
+        }
+        if (response.ok) return { ok: true, status: response.status, message: "Groq accepted the API key." };
+        if (response.status === 401) return { ok: false, status: 401, message: "Groq rejected the API key." };
+        if (response.status === 403) return { ok: false, status: 403, message: "The API key does not have access to Groq transcription." };
+        if (response.status === 429) return { ok: false, status: 429, message: "Groq temporarily rate-limited the access check. Try again later." };
+        return { ok: false, status: response.status, message: `Groq access check failed (HTTP ${response.status}).` };
+      }
       /**
        * Transcribes audio using the Groq Whisper API.
        *
@@ -2724,7 +2749,10 @@ var init_groq = __esm({
           body: form
         });
         if (!resp.ok) {
-          const body = await resp.text();
+          try {
+            await resp.body?.cancel();
+          } catch {
+          }
           if (resp.status === 401) {
             throw new Error("Invalid Groq API key. Check your key at console.groq.com.");
           }
@@ -2734,7 +2762,7 @@ var init_groq = __esm({
           if (resp.status === 429) {
             throw new Error("Groq rate limit exceeded. Free tier: 28,800 seconds/day. Try again later.");
           }
-          throw new Error(`Groq STT error (${resp.status}): ${body}`);
+          throw new Error(`Groq transcription failed (HTTP ${resp.status}). Check Groq status and run /speech \u2192 Check setup.`);
         }
         const data = await resp.json();
         return {
@@ -3202,6 +3230,20 @@ function safeError(error) {
   const message = error instanceof Error ? error.message : "Proxy request failed";
   return new Error(redactNetworkSecrets(message));
 }
+async function approvedTargetPreflight(fetcher) {
+  let response;
+  try {
+    response = await fetcher(PROXY_CONNECTIVITY_TEST_URL, {
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) throw new Error(`Connectivity check returned HTTP ${response.status}`);
+  } finally {
+    try {
+      if (response?.body) await response.arrayBuffer();
+    } catch {
+    }
+  }
+}
 function normalizeResponse(response) {
   if (response instanceof Response) return response;
   const body = response.body ? Readable.toWeb(response.body) : null;
@@ -3234,7 +3276,7 @@ function copyResponse(response, body) {
   }
   return copy;
 }
-var enabledDebug, PROXY_ENV_KEYS, ProxyValidationError, ProxyUnknownScopeError, ProxyProfileInUseError, ProxyProfileNotFoundError, ProxyProfileExistsError, ProxyRouteTestError, ProxyProfileTestError, ProxyService;
+var enabledDebug, PROXY_ENV_KEYS, PROXY_CONNECTIVITY_TEST_URL, ProxyValidationError, ProxyUnknownScopeError, ProxyProfileInUseError, ProxyProfileNotFoundError, ProxyProfileExistsError, ProxyRouteTestError, ProxyProfileTestError, ProxyService;
 var init_proxy_service = __esm({
   "src/core/network/proxy-service.ts"() {
     "use strict";
@@ -3255,6 +3297,7 @@ var init_proxy_service = __esm({
       "no_proxy",
       "NODE_USE_ENV_PROXY"
     ];
+    PROXY_CONNECTIVITY_TEST_URL = "https://api.ipify.org?format=json";
     ProxyValidationError = class extends Error {
       constructor(message, code = "PROXY_VALIDATION_ERROR") {
         super(message);
@@ -3300,9 +3343,10 @@ var init_proxy_service = __esm({
       }
     };
     ProxyService = class {
-      constructor(instanceRoot, retiredLeaseTimeoutMs = 5 * 6e4, allowedNodeEnvironmentFlags = process.allowedNodeEnvironmentFlags) {
+      constructor(instanceRoot, retiredLeaseTimeoutMs = 5 * 6e4, allowedNodeEnvironmentFlags = process.allowedNodeEnvironmentFlags, connectivityPreflight = approvedTargetPreflight) {
         this.retiredLeaseTimeoutMs = retiredLeaseTimeoutMs;
         this.allowedNodeEnvironmentFlags = allowedNodeEnvironmentFlags;
+        this.connectivityPreflight = connectivityPreflight;
         this.store = new ProxyStore(instanceRoot);
         try {
           const config = this.store.load();
@@ -3312,6 +3356,7 @@ var init_proxy_service = __esm({
       }
       retiredLeaseTimeoutMs;
       allowedNodeEnvironmentFlags;
+      connectivityPreflight;
       store;
       scopes = /* @__PURE__ */ new Set([
         "channels.default",
@@ -3492,16 +3537,15 @@ var init_proxy_service = __esm({
           const { profile: candidate, nextSecrets } = this.buildProfile(input2, config, secrets);
           const affectedScopes = this.scopesUsingProfile(config, input2.id);
           const candidateSecret = nextSecrets[input2.id];
-          for (const [scope, tester] of this.testers) {
-            if (this.resolve(scope).profile?.id === input2.id) {
-              const fetcher = this.createProfileFetch(candidate, candidateSecret);
-              try {
-                await tester(fetcher);
-              } catch (error) {
-                throw new ProxyProfileTestError(input2.id, error);
-              } finally {
-                fetcher.destroy?.();
-              }
+          if (affectedScopes.length) {
+            const fetcher = this.createProfileFetch(candidate, candidateSecret);
+            try {
+              await this.connectivityPreflight(fetcher);
+              for (const scope of affectedScopes) await this.testers.get(scope)?.(fetcher);
+            } catch (error) {
+              throw new ProxyProfileTestError(input2.id, error);
+            } finally {
+              fetcher.destroy?.();
             }
           }
           this.invalidatePolicyBeforeCommit(config, input2.id);
@@ -3785,7 +3829,7 @@ var init_proxy_service = __esm({
         env.NO_PROXY = env.no_proxy = noProxy;
         return env;
       }
-      async test(scope, targetUrl = "https://api.ipify.org?format=json") {
+      async test(scope, targetUrl = PROXY_CONNECTIVITY_TEST_URL) {
         if (!this.getKnownScopes().includes(scope)) throw new ProxyUnknownScopeError(scope);
         let response;
         try {
@@ -3806,7 +3850,7 @@ var init_proxy_service = __esm({
         let response;
         try {
           fetcher = this.createTransport("services.proxyTest", `profile:${id}`);
-          response = await fetcher(targetUrl ?? "https://api.ipify.org?format=json", {
+          response = await fetcher(targetUrl ?? PROXY_CONNECTIVITY_TEST_URL, {
             signal: AbortSignal.timeout(1e4)
           });
           return { ok: response.ok, status: response.status };
@@ -3828,7 +3872,7 @@ var init_proxy_service = __esm({
         const fetcher = this.createProfileFetch(profile, nextSecrets[profile.id]);
         let response;
         try {
-          response = await fetcher(targetUrl ?? "https://api.ipify.org?format=json", {
+          response = await fetcher(targetUrl ?? PROXY_CONNECTIVITY_TEST_URL, {
             signal: AbortSignal.timeout(1e4)
           });
           return { ok: response.ok, status: response.status };
@@ -3880,19 +3924,26 @@ var init_proxy_service = __esm({
         if (!id || !this.getProfile(id)) throw new ProxyValidationError(`Proxy profile "${id ?? route}" does not exist`);
       }
       async testCandidateRoutes(current, candidate) {
-        for (const [scope, tester] of this.testers) {
-          const before = this.resolveFromConfig(scope, current);
+        const groups = /* @__PURE__ */ new Map();
+        for (const scope of this.changedResolutionScopes(current, candidate)) {
           const after = this.resolveFromConfig(scope, candidate);
-          if (before.route !== after.route || before.profile?.id !== after.profile?.id) {
-            const fetcher = this.createTransport(scope, after.route);
-            try {
-              await tester(fetcher);
-            } finally {
-              fetcher.destroy?.();
-            }
+          const transportKey = this.candidateTransportIdentity(after);
+          groups.set(transportKey, [...groups.get(transportKey) ?? [], { scope, route: after.route }]);
+        }
+        for (const group of groups.values()) {
+          const first = group[0];
+          const fetcher = this.createTransport(first.scope, first.route);
+          try {
+            await this.connectivityPreflight(fetcher);
+            for (const { scope } of group) await this.testers.get(scope)?.(fetcher);
+          } finally {
+            fetcher.destroy?.();
           }
         }
       }
+      candidateTransportIdentity(resolution) {
+        return JSON.stringify({ route: resolution.route, profile: resolution.profile });
+      }
       createProfileFetch(profile, secret) {
         const url = proxyUrl(profile, secret);
         const agent = new ProxyAgent({
@@ -4180,11 +4231,13 @@ var init_telegram_command_scopes = __esm({
 // src/core/plugin/settings-manager.ts
 var settings_manager_exports = {};
 __export(settings_manager_exports, {
+  SettingsConflictError: () => SettingsConflictError,
   SettingsManager: () => SettingsManager
 });
 import fs21 from "fs";
 import path20 from "path";
-import { randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID4 } from "crypto";
+import { execFileSync as execFileSync4 } from "child_process";
 function secureSettingsDirectory(directory) {
   fs21.mkdirSync(directory, { recursive: true, mode: 448 });
   fs21.chmodSync(directory, 448);
@@ -4205,13 +4258,67 @@ function repairSettingsPermissions(settingsPath, basePath) {
   secureSettingsTree(basePath, settingsPath, false);
   fs21.chmodSync(settingsPath, 384);
 }
-function atomicSettingsWrite(settingsPath, basePath, data) {
+function settingsRevision(raw) {
+  return createHash4("sha256").update(raw === null ? "missing\0" : `present\0${raw}`).digest("hex");
+}
+function parseSettings(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function readSettingsSnapshot(settingsPath, basePath) {
+  secureSettingsDirectory(basePath);
+  if (!fs21.existsSync(settingsPath)) return { data: {}, raw: null, revision: settingsRevision(null) };
+  repairSettingsPermissions(settingsPath, basePath);
+  let raw;
+  try {
+    raw = fs21.readFileSync(settingsPath, "utf-8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { data: {}, raw: null, revision: settingsRevision(null) };
+    }
+    throw error;
+  }
+  return { data: parseSettings(raw), raw, revision: settingsRevision(raw) };
+}
+function assertSettingsRevision(settingsPath, basePath, expectedRevision) {
+  const actual = readSettingsSnapshot(settingsPath, basePath).revision;
+  if (actual !== expectedRevision) throw new SettingsConflictError();
+}
+function fsyncDirectory2(directory) {
+  try {
+    const directoryFd = fs21.openSync(directory, "r");
+    try {
+      fs21.fsyncSync(directoryFd);
+    } finally {
+      fs21.closeSync(directoryFd);
+    }
+  } catch {
+  }
+}
+function atomicSettingsContentWrite(settingsPath, basePath, content, expectedRevision) {
   const directory = path20.dirname(settingsPath);
   secureSettingsTree(basePath, settingsPath, true);
+  if (content === null) {
+    assertSettingsRevision(settingsPath, basePath, expectedRevision);
+    if (!fs21.existsSync(settingsPath)) return settingsRevision(null);
+    let replaced2 = false;
+    try {
+      fs21.unlinkSync(settingsPath);
+      replaced2 = true;
+      fsyncDirectory2(directory);
+      return settingsRevision(null);
+    } catch (error) {
+      throw new AtomicSettingsWriteError(error, replaced2);
+    }
+  }
   const temporary = `${settingsPath}.${process.pid}.${randomUUID4()}.tmp`;
+  let replaced = false;
   try {
-    fs21.writeFileSync(temporary, `${JSON.stringify(data, null, 2)}
-`, { mode: 384, flag: "wx" });
+    fs21.writeFileSync(temporary, content, { mode: 384, flag: "wx" });
     fs21.chmodSync(temporary, 384);
     const fd = fs21.openSync(temporary, "r");
     try {
@@ -4219,55 +4326,274 @@ function atomicSettingsWrite(settingsPath, basePath, data) {
     } finally {
       fs21.closeSync(fd);
     }
+    assertSettingsRevision(settingsPath, basePath, expectedRevision);
     fs21.renameSync(temporary, settingsPath);
+    replaced = true;
     fs21.chmodSync(settingsPath, 384);
+    fsyncDirectory2(directory);
+    return settingsRevision(content);
+  } catch (error) {
+    if (error instanceof SettingsConflictError) throw error;
+    throw new AtomicSettingsWriteError(error, replaced);
+  } finally {
     try {
-      const directoryFd = fs21.openSync(directory, "r");
-      try {
-        fs21.fsyncSync(directoryFd);
-      } finally {
-        fs21.closeSync(directoryFd);
-      }
+      if (fs21.existsSync(temporary)) fs21.unlinkSync(temporary);
     } catch {
     }
-  } finally {
+  }
+}
+function serializeSettings(data) {
+  return `${JSON.stringify(data, null, 2)}
+`;
+}
+function processLiveness(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return "dead";
+  try {
+    process.kill(pid, 0);
+    return "alive";
+  } catch (error) {
+    return error.code === "ESRCH" ? "dead" : "inaccessible";
+  }
+}
+function readProcessStartIdentity(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  if (process.platform === "linux") {
     try {
-      if (fs21.existsSync(temporary)) fs21.unlinkSync(temporary);
+      const stat = fs21.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const endOfCommand = stat.lastIndexOf(") ");
+      if (endOfCommand < 0) return null;
+      const ticks = stat.slice(endOfCommand + 2).trim().split(/\s+/)[19];
+      return /^\d+$/.test(ticks ?? "") ? `linux:${ticks}` : null;
     } catch {
+      return null;
+    }
+  }
+  if (process.platform === "win32") return null;
+  try {
+    const started = execFileSync4("ps", ["-o", "lstart=", "-p", String(pid)], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 500
+    }).trim();
+    return started ? `${process.platform}:${started}` : null;
+  } catch {
+    return null;
+  }
+}
+function readLockMetadata(lockPath) {
+  try {
+    const lockStat = fs21.lstatSync(lockPath);
+    if (!lockStat.isDirectory() || lockStat.isSymbolicLink()) return void 0;
+    const noFollow = fs21.constants.O_NOFOLLOW ?? 0;
+    const directoryOnly = fs21.constants.O_DIRECTORY ?? 0;
+    const lockFd = fs21.openSync(lockPath, fs21.constants.O_RDONLY | directoryOnly | noFollow);
+    try {
+      const opened = fs21.fstatSync(lockFd);
+      if (!opened.isDirectory() || opened.dev !== lockStat.dev || opened.ino !== lockStat.ino) return void 0;
+      fs21.fchmodSync(lockFd, 448);
+    } finally {
+      fs21.closeSync(lockFd);
+    }
+    const ownerPath = path20.join(lockPath, "owner.json");
+    const ownerStat = fs21.lstatSync(ownerPath);
+    if (!ownerStat.isFile() || ownerStat.isSymbolicLink()) return void 0;
+    const fd = fs21.openSync(ownerPath, fs21.constants.O_RDONLY | noFollow);
+    let raw;
+    try {
+      const opened = fs21.fstatSync(fd);
+      if (!opened.isFile() || opened.dev !== ownerStat.dev || opened.ino !== ownerStat.ino) return void 0;
+      fs21.fchmodSync(fd, 384);
+      raw = fs21.readFileSync(fd, "utf-8");
+    } finally {
+      fs21.closeSync(fd);
+    }
+    const parsed = JSON.parse(raw);
+    if (!Number.isSafeInteger(parsed.pid) || typeof parsed.owner !== "string" || !Number.isFinite(parsed.acquiredAt)) return void 0;
+    if (parsed.processStartIdentity !== void 0 && parsed.processStartIdentity !== null && typeof parsed.processStartIdentity !== "string") return void 0;
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+function inspectSettingsLock(lockPath, now, previousObservation) {
+  let stat;
+  try {
+    stat = fs21.lstatSync(lockPath);
+  } catch {
+    return { reclaim: false };
+  }
+  if (stat.isSymbolicLink()) return { reclaim: true, stat };
+  const metadata = readLockMetadata(lockPath);
+  if (metadata) {
+    const liveness = processLiveness(metadata.pid);
+    if (liveness === "dead") return { reclaim: true, stat };
+    const actualIdentity = readProcessStartIdentity(metadata.pid);
+    if (metadata.processStartIdentity && actualIdentity) {
+      return { reclaim: metadata.processStartIdentity !== actualIdentity, stat };
+    }
+    const acquiredAt = metadata.acquiredAt > now ? stat.mtimeMs : metadata.acquiredAt;
+    const lastOwnerActivity = Math.max(acquiredAt, stat.mtimeMs);
+    return { reclaim: now - lastOwnerActivity >= SETTINGS_UNVERIFIED_OWNER_STALE_MS, stat };
+  }
+  const sameEntry = previousObservation?.dev === stat.dev && previousObservation.ino === stat.ino;
+  const observation = sameEntry ? previousObservation : { dev: stat.dev, ino: stat.ino, firstSeenAt: now };
+  const oldOnDisk = now - stat.mtimeMs >= SETTINGS_UNKNOWN_LOCK_GRACE_MS;
+  return {
+    reclaim: oldOnDisk || now - observation.firstSeenAt >= SETTINGS_UNKNOWN_LOCK_GRACE_MS,
+    stat,
+    observation
+  };
+}
+function reclaimStaleLock(lockPath, expected) {
+  const reclaimed = `${lockPath}.stale.${process.pid}.${randomUUID4()}`;
+  try {
+    const current = fs21.lstatSync(lockPath);
+    if (current.dev !== expected.dev || current.ino !== expected.ino) return false;
+    fs21.renameSync(lockPath, reclaimed);
+  } catch (error) {
+    if (["ENOENT", "EEXIST"].includes(error.code ?? "")) return false;
+    throw error;
+  }
+  try {
+    fs21.rmSync(reclaimed, { recursive: true, force: true });
+  } catch {
+  }
+  return true;
+}
+function delay(ms) {
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
+}
+async function acquireSettingsLock(settingsPath, basePath) {
+  secureSettingsTree(basePath, settingsPath, true);
+  const lockPath = `${settingsPath}.lock`;
+  const startedAt = Date.now();
+  let unknownObservation;
+  while (true) {
+    try {
+      fs21.mkdirSync(lockPath, { mode: 448 });
+      fs21.chmodSync(lockPath, 448);
+      const owner = randomUUID4();
+      const metadata = {
+        version: 1,
+        pid: process.pid,
+        owner,
+        acquiredAt: Date.now(),
+        processStartIdentity: readProcessStartIdentity(process.pid)
+      };
+      const ownerPath = path20.join(lockPath, "owner.json");
+      try {
+        const noFollow = fs21.constants.O_NOFOLLOW ?? 0;
+        const ownerFd = fs21.openSync(
+          ownerPath,
+          fs21.constants.O_WRONLY | fs21.constants.O_CREAT | fs21.constants.O_EXCL | noFollow,
+          384
+        );
+        try {
+          fs21.writeFileSync(ownerFd, `${JSON.stringify(metadata)}
+`);
+          fs21.fchmodSync(ownerFd, 384);
+          fs21.fsyncSync(ownerFd);
+        } finally {
+          fs21.closeSync(ownerFd);
+        }
+      } catch (error) {
+        try {
+          fs21.rmSync(lockPath, { recursive: true, force: true });
+        } catch {
+        }
+        throw error;
+      }
+      let released = false;
+      return {
+        release: () => {
+          if (released) return;
+          released = true;
+          const current = readLockMetadata(lockPath);
+          if (current?.owner !== owner || current.pid !== process.pid || current.processStartIdentity !== metadata.processStartIdentity) return;
+          const releasedPath = `${lockPath}.released.${process.pid}.${randomUUID4()}`;
+          try {
+            fs21.renameSync(lockPath, releasedPath);
+            fs21.rmSync(releasedPath, { recursive: true, force: true });
+          } catch (error) {
+            if (error.code !== "ENOENT") throw error;
+          }
+        }
+      };
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      const inspection = inspectSettingsLock(lockPath, Date.now(), unknownObservation);
+      unknownObservation = inspection.observation;
+      if (!inspection.stat) {
+        if (Date.now() - startedAt >= SETTINGS_LOCK_WAIT_MS) {
+          throw new Error(`Timed out waiting for plugin settings lock: ${path20.basename(path20.dirname(settingsPath))}`);
+        }
+        await delay(10 + Math.floor(Math.random() * 20));
+        continue;
+      }
+      if (inspection.reclaim && reclaimStaleLock(lockPath, inspection.stat)) {
+        unknownObservation = void 0;
+        continue;
+      }
+      if (Date.now() - startedAt >= SETTINGS_LOCK_WAIT_MS) {
+        throw new Error(`Timed out waiting for plugin settings lock: ${path20.basename(path20.dirname(settingsPath))}`);
+      }
+      await delay(10 + Math.floor(Math.random() * 20));
     }
   }
 }
-var SettingsManager, SettingsAPIImpl;
+function cloneSettings(settings) {
+  return JSON.parse(JSON.stringify(settings));
+}
+var SETTINGS_LOCK_WAIT_MS, SETTINGS_UNKNOWN_LOCK_GRACE_MS, SETTINGS_UNVERIFIED_OWNER_STALE_MS, SETTINGS_CONFLICT_RETRIES, AtomicSettingsWriteError, RetriableSettingsConflictError, SettingsConflictError, SettingsManager, SettingsAPIImpl;
 var init_settings_manager = __esm({
   "src/core/plugin/settings-manager.ts"() {
     "use strict";
-    SettingsManager = class {
+    SETTINGS_LOCK_WAIT_MS = 3e4;
+    SETTINGS_UNKNOWN_LOCK_GRACE_MS = 750;
+    SETTINGS_UNVERIFIED_OWNER_STALE_MS = 2 * 6e4;
+    SETTINGS_CONFLICT_RETRIES = 3;
+    AtomicSettingsWriteError = class extends Error {
+      constructor(original, replaced) {
+        super(original instanceof Error ? original.message : "Settings write failed", { cause: original });
+        this.original = original;
+        this.replaced = replaced;
+        this.name = "AtomicSettingsWriteError";
+      }
+      original;
+      replaced;
+    };
+    RetriableSettingsConflictError = class extends Error {
+      constructor(conflict) {
+        super(conflict.message, { cause: conflict });
+        this.conflict = conflict;
+        this.name = "RetriableSettingsConflictError";
+      }
+      conflict;
+    };
+    SettingsConflictError = class extends Error {
+      constructor() {
+        super("Plugin settings changed concurrently; the attempted write was not applied");
+        this.name = "SettingsConflictError";
+      }
+    };
+    SettingsManager = class _SettingsManager {
       constructor(basePath) {
         this.basePath = basePath;
         secureSettingsDirectory(basePath);
       }
       basePath;
+      static mutationTails = /* @__PURE__ */ new Map();
       /** Returns the base path for all plugin settings directories. */
       getBasePath() {
         return this.basePath;
       }
       /** Create a SettingsAPI instance scoped to a specific plugin. */
       createAPI(pluginName) {
-        const settingsPath = this.getSettingsPath(pluginName);
-        return new SettingsAPIImpl(settingsPath, this.basePath);
+        return new SettingsAPIImpl(this, pluginName);
       }
-      /** Load a plugin's settings from disk. Returns empty object if file doesn't exist. */
+      /** Load a fresh plugin settings snapshot. Returns empty object if the file doesn't exist. */
       async loadSettings(pluginName) {
-        const settingsPath = this.getSettingsPath(pluginName);
-        secureSettingsDirectory(this.basePath);
-        if (!fs21.existsSync(settingsPath)) return {};
-        repairSettingsPermissions(settingsPath, this.basePath);
-        try {
-          const content = fs21.readFileSync(settingsPath, "utf-8");
-          return JSON.parse(content);
-        } catch {
-          return {};
-        }
+        return cloneSettings(readSettingsSnapshot(this.getSettingsPath(pluginName), this.basePath).data);
       }
       /** Validate settings against a Zod schema. Returns valid if no schema is provided. */
       validateSettings(_pluginName, settings, schema) {
@@ -4288,63 +4614,136 @@ var init_settings_manager = __esm({
       async getPluginSettings(pluginName) {
         return this.loadSettings(pluginName);
       }
+      /**
+       * Serialize a read/prepare/persist/apply transaction for one plugin.
+       *
+       * The transaction holds both an in-process queue and a filesystem lock. Its
+       * prepare callback receives a fresh disk snapshot. Persistence uses a content
+       * revision CAS; a pre-commit conflict is retried from a new snapshot, while an
+       * exhausted conflict aborts without applying the runtime side effect. Apply
+       * failures restore the exact previous file content and invoke runtime rollback
+       * before releasing the cross-process lock.
+       */
+      async transactPluginSettings(pluginName, prepare) {
+        const settingsPath = this.getSettingsPath(pluginName);
+        return _SettingsManager.serialize(path20.resolve(settingsPath), async () => {
+          let lastConflict;
+          for (let attempt = 0; attempt < SETTINGS_CONFLICT_RETRIES; attempt += 1) {
+            try {
+              return await this.transactOnce(settingsPath, prepare);
+            } catch (error) {
+              if (!(error instanceof RetriableSettingsConflictError)) throw error;
+              lastConflict = error.conflict;
+            }
+          }
+          throw lastConflict ?? new SettingsConflictError();
+        });
+      }
       /** Merge updates into existing settings (shallow merge). */
       async updatePluginSettings(pluginName, updates) {
-        const api = this.createAPI(pluginName);
-        const current = await api.getAll();
-        await api.setAll({ ...current, ...updates });
+        await this.transactPluginSettings(pluginName, (current) => ({
+          settings: { ...current, ...updates },
+          result: void 0
+        }));
       }
-    };
-    SettingsAPIImpl = class {
-      constructor(settingsPath, basePath) {
-        this.settingsPath = settingsPath;
-        this.basePath = basePath;
+      async transactOnce(settingsPath, prepare) {
+        const lock = await acquireSettingsLock(settingsPath, this.basePath);
+        try {
+          const previous = readSettingsSnapshot(settingsPath, this.basePath);
+          const plan = await prepare(cloneSettings(previous.data));
+          const next = cloneSettings(plan.settings);
+          const nextContent = serializeSettings(next);
+          const nextRevision = settingsRevision(nextContent);
+          try {
+            atomicSettingsContentWrite(settingsPath, this.basePath, nextContent, previous.revision);
+          } catch (error) {
+            if (error instanceof SettingsConflictError) throw new RetriableSettingsConflictError(error);
+            if (error instanceof AtomicSettingsWriteError && error.replaced) {
+              try {
+                atomicSettingsContentWrite(settingsPath, this.basePath, previous.raw, nextRevision);
+              } catch (restoreError) {
+                throw new AggregateError([error.original, restoreError], "Settings persistence failed and the previous snapshot could not be restored");
+              }
+            }
+            throw error instanceof AtomicSettingsWriteError ? error.original : error;
+          }
+          try {
+            await plan.apply?.();
+          } catch (error) {
+            const rollbackErrors = [error];
+            try {
+              await plan.rollback?.();
+            } catch (rollbackError) {
+              rollbackErrors.push(rollbackError);
+            }
+            try {
+              atomicSettingsContentWrite(settingsPath, this.basePath, previous.raw, nextRevision);
+            } catch (restoreError) {
+              rollbackErrors.push(restoreError instanceof AtomicSettingsWriteError ? restoreError.original : restoreError);
+            }
+            if (rollbackErrors.length > 1) throw new AggregateError(rollbackErrors, "Settings runtime apply failed and rollback was incomplete");
+            throw error;
+          }
+          return plan.result;
+        } finally {
+          lock.release();
+        }
       }
-      settingsPath;
-      basePath;
-      cache = null;
-      readFile() {
-        if (this.cache !== null) return this.cache;
-        secureSettingsDirectory(this.basePath);
-        if (fs21.existsSync(this.settingsPath)) repairSettingsPermissions(this.settingsPath, this.basePath);
+      static async serialize(key, operation) {
+        const previous = this.mutationTails.get(key) ?? Promise.resolve();
+        let release;
+        const gate = new Promise((resolve8) => {
+          release = resolve8;
+        });
+        const tail = previous.catch(() => void 0).then(() => gate);
+        this.mutationTails.set(key, tail);
+        await previous.catch(() => void 0);
         try {
-          const content = fs21.readFileSync(this.settingsPath, "utf-8");
-          this.cache = JSON.parse(content);
-          return this.cache;
-        } catch {
-          this.cache = {};
-          return this.cache;
+          return await operation();
+        } finally {
+          release();
+          if (this.mutationTails.get(key) === tail) this.mutationTails.delete(key);
         }
       }
-      writeFile(data) {
-        atomicSettingsWrite(this.settingsPath, this.basePath, data);
-        this.cache = data;
+    };
+    SettingsAPIImpl = class {
+      constructor(manager, pluginName) {
+        this.manager = manager;
+        this.pluginName = pluginName;
       }
+      manager;
+      pluginName;
       async get(key) {
-        const data = this.readFile();
+        const data = await this.manager.loadSettings(this.pluginName);
         return data[key];
       }
       async set(key, value) {
-        const data = this.readFile();
-        data[key] = value;
-        this.writeFile(data);
+        await this.manager.transactPluginSettings(this.pluginName, (current) => ({
+          settings: { ...current, [key]: value },
+          result: void 0
+        }));
       }
       async getAll() {
-        return { ...this.readFile() };
+        return this.manager.loadSettings(this.pluginName);
       }
       async setAll(settings) {
-        this.writeFile({ ...settings });
+        await this.manager.transactPluginSettings(this.pluginName, () => ({
+          settings: { ...settings },
+          result: void 0
+        }));
       }
       async delete(key) {
-        const data = this.readFile();
-        delete data[key];
-        this.writeFile(data);
+        await this.manager.transactPluginSettings(this.pluginName, (current) => {
+          const next = { ...current };
+          delete next[key];
+          return { settings: next, result: void 0 };
+        });
       }
       async clear() {
-        this.writeFile({});
+        await this.manager.transactPluginSettings(this.pluginName, () => ({ settings: {}, result: void 0 }));
       }
       async has(key) {
-        const data = this.readFile();
+        const data = await this.manager.loadSettings(this.pluginName);
         return key in data;
       }
     };
@@ -4362,17 +4761,17 @@ __export(command_ownership_store_exports, {
 import fs22 from "fs";
 import path21 from "path";
 import os5 from "os";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function telegramCommandHostId() {
   let source = `${os5.hostname()}|${typeof process.getuid === "function" ? process.getuid() : "unknown"}`;
   try {
     source = fs22.readFileSync("/etc/machine-id", "utf8").trim() || source;
   } catch {
   }
-  return createHash4("sha256").update(source).digest("hex");
+  return createHash5("sha256").update(source).digest("hex");
 }
 function telegramCommandInstanceKey(instanceRoot) {
-  return createHash4("sha256").update(path21.resolve(instanceRoot)).digest("hex");
+  return createHash5("sha256").update(path21.resolve(instanceRoot)).digest("hex");
 }
 function emptyLedger() {
   return { version: STORE_VERSION, bots: {} };
@@ -5171,7 +5570,7 @@ import fs28 from "fs";
 import path26 from "path";
 import https from "https";
 import os7 from "os";
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 function downloadFile(url, dest, maxRedirects = 10) {
   return new Promise((resolve8, reject) => {
     const file = fs28.createWriteStream(dest);
@@ -5260,9 +5659,9 @@ async function ensureBinary(spec, binDir) {
   const downloadDest = isArchive ? path26.join(resolvedBinDir, `${spec.name}.tgz`) : binPath;
   await downloadFile(url, downloadDest);
   if (isArchive) {
-    const listing = execFileSync4("tar", ["-tf", downloadDest], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
+    const listing = execFileSync5("tar", ["-tf", downloadDest], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
     validateTarContents(listing, resolvedBinDir);
-    execFileSync4("tar", ["-xzf", downloadDest, "-C", resolvedBinDir], { stdio: "pipe" });
+    execFileSync5("tar", ["-xzf", downloadDest, "-C", resolvedBinDir], { stdio: "pipe" });
     try {
       fs28.unlinkSync(downloadDest);
     } catch {
@@ -5329,7 +5728,7 @@ var init_install_cloudflared = __esm({
 import * as fs29 from "fs";
 import * as path27 from "path";
 import * as os8 from "os";
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 var tunnelCheck;
 var init_tunnel = __esm({
   "src/core/doctor/checks/tunnel.ts"() {
@@ -5362,7 +5761,7 @@ var init_tunnel = __esm({
             found = true;
           } else {
             try {
-              execFileSync5("which", ["cloudflared"], { stdio: "pipe" });
+              execFileSync6("which", ["cloudflared"], { stdio: "pipe" });
               found = true;
             } catch {
             }
@@ -5392,48 +5791,393 @@ var init_tunnel = __esm({
         } else {
           results.push({ status: "pass", message: `Tunnel port: ${tunnelPort}` });
         }
-        return results;
+        return results;
+      }
+    };
+  }
+});
+
+// src/core/instance/instance-registry.ts
+import fs30 from "fs";
+import path28 from "path";
+import { randomUUID as randomUUID5 } from "crypto";
+function readIdFromConfig(instanceRoot) {
+  try {
+    const raw = JSON.parse(fs30.readFileSync(path28.join(instanceRoot, "config.json"), "utf-8"));
+    return typeof raw.id === "string" && raw.id ? raw.id : null;
+  } catch {
+    return null;
+  }
+}
+var InstanceRegistry;
+var init_instance_registry = __esm({
+  "src/core/instance/instance-registry.ts"() {
+    "use strict";
+    InstanceRegistry = class {
+      constructor(registryPath) {
+        this.registryPath = registryPath;
+      }
+      registryPath;
+      data = { version: 1, instances: {} };
+      /** Load the registry from disk. If the file is missing or corrupt, starts fresh. */
+      load() {
+        try {
+          const raw = fs30.readFileSync(this.registryPath, "utf-8");
+          const parsed = JSON.parse(raw);
+          if (parsed.version === 1 && parsed.instances) {
+            this.data = parsed;
+            this.deduplicate();
+          }
+        } catch {
+        }
+      }
+      /** Remove duplicate entries that point to the same root, keeping the first one */
+      deduplicate() {
+        const seen = /* @__PURE__ */ new Set();
+        const toRemove = [];
+        for (const [id, entry] of Object.entries(this.data.instances)) {
+          if (seen.has(entry.root)) {
+            toRemove.push(id);
+          } else {
+            seen.add(entry.root);
+          }
+        }
+        if (toRemove.length > 0) {
+          for (const id of toRemove) delete this.data.instances[id];
+          this.save();
+        }
+      }
+      /** Persist the registry to disk, creating parent directories if needed. */
+      save() {
+        const dir = path28.dirname(this.registryPath);
+        fs30.mkdirSync(dir, { recursive: true });
+        fs30.writeFileSync(this.registryPath, JSON.stringify(this.data, null, 2));
+      }
+      /** Add or update an instance entry in the registry. Does not persist — call save() after. */
+      register(id, root) {
+        this.data.instances[id] = { id, root };
+      }
+      /** Remove an instance entry. Does not persist — call save() after. */
+      remove(id) {
+        delete this.data.instances[id];
+      }
+      /** Look up an instance by its ID. */
+      get(id) {
+        return this.data.instances[id];
+      }
+      /** Look up an instance by its root directory path. */
+      getByRoot(root) {
+        return Object.values(this.data.instances).find((e) => e.root === root);
+      }
+      /** Returns all registered instances. */
+      list() {
+        return Object.values(this.data.instances);
+      }
+      /** Returns `baseId` if available, otherwise appends `-2`, `-3`, etc. until unique. */
+      uniqueId(baseId) {
+        if (!this.data.instances[baseId]) return baseId;
+        let n = 2;
+        while (this.data.instances[`${baseId}-${n}`]) n++;
+        return `${baseId}-${n}`;
+      }
+      /**
+       * Resolve the authoritative id for an instance root.
+       *
+       * config.json is the source of truth. If the registry entry disagrees with
+       * config.json, the registry is updated to match. If neither exists, a fresh
+       * UUID is generated and registered (but NOT written to config.json — the
+       * caller must call initInstanceFiles to persist it).
+       *
+       * Returns the resolved id and whether the registry was mutated (so callers
+       * can decide whether to persist with save()).
+       */
+      resolveId(instanceRoot) {
+        const configId = readIdFromConfig(instanceRoot);
+        const entry = this.getByRoot(instanceRoot);
+        if (entry && configId && entry.id !== configId) {
+          this.remove(entry.id);
+          this.register(configId, instanceRoot);
+          return { id: configId, registryUpdated: true };
+        }
+        const id = configId ?? entry?.id ?? randomUUID5();
+        if (!this.getByRoot(instanceRoot)) {
+          this.register(id, instanceRoot);
+          return { id, registryUpdated: true };
+        }
+        return { id, registryUpdated: false };
       }
     };
   }
 });
 
+// src/core/instance/daemon-identity.ts
+import fs31 from "fs";
+import path29 from "path";
+function daemonIdentityPath(pidPath) {
+  return `${pidPath}.identity`;
+}
+function processStartTicks(pid) {
+  if (process.platform !== "linux") return null;
+  try {
+    const stat = fs31.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const endOfCommand = stat.lastIndexOf(") ");
+    if (endOfCommand < 0) return null;
+    const value = stat.slice(endOfCommand + 2).trim().split(/\s+/)[19];
+    return /^\d+$/.test(value ?? "") ? value : null;
+  } catch {
+    return null;
+  }
+}
+function writeDaemonIdentity(pidPath, pid) {
+  const instanceRoot = path29.resolve(path29.dirname(pidPath));
+  const marker = {
+    version: 1,
+    pid,
+    instanceRoot,
+    instanceId: readIdFromConfig(instanceRoot),
+    processStartTicks: processStartTicks(pid)
+  };
+  fs31.writeFileSync(daemonIdentityPath(pidPath), JSON.stringify(marker), { mode: 384 });
+}
+function removeDaemonIdentity(pidPath) {
+  try {
+    fs31.unlinkSync(daemonIdentityPath(pidPath));
+  } catch {
+  }
+}
+function verifyDaemonIdentity(pidPath, pid, expectedInstanceRoot) {
+  try {
+    const marker = JSON.parse(fs31.readFileSync(daemonIdentityPath(pidPath), "utf8"));
+    const expectedRoot = path29.resolve(expectedInstanceRoot);
+    if (marker.version !== 1 || marker.pid !== pid || marker.instanceRoot !== expectedRoot) return false;
+    const expectedId = readIdFromConfig(expectedRoot);
+    if (expectedId && marker.instanceId !== expectedId) return false;
+    const currentStartTicks = processStartTicks(pid);
+    if (process.platform === "linux") {
+      if (!marker.processStartTicks || !currentStartTicks || marker.processStartTicks !== currentStartTicks) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+var init_daemon_identity = __esm({
+  "src/core/instance/daemon-identity.ts"() {
+    "use strict";
+    init_instance_registry();
+  }
+});
+
 // src/core/doctor/checks/proxy.ts
-var proxyCheck;
+import fs32 from "fs";
+import path30 from "path";
+function activeCallerProxyVariables() {
+  return [...ROUTING_PROXY_KEYS].filter((key) => process.env[key] !== void 0 && process.env[key] !== "");
+}
+function isProcessAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function inspectDaemonProxyEnvironment(pidPath, expectedInstanceRoot = path30.dirname(pidPath)) {
+  let pid;
+  try {
+    pid = Number(fs32.readFileSync(pidPath, "utf8").trim());
+  } catch {
+    return { state: "not-running", variableNames: [], source: "none" };
+  }
+  if (!Number.isSafeInteger(pid) || pid <= 0 || !isProcessAlive2(pid)) {
+    return { state: "not-running", variableNames: [], source: "none" };
+  }
+  if (!verifyDaemonIdentity(pidPath, pid, expectedInstanceRoot)) {
+    return { state: "unavailable", variableNames: [], source: "none" };
+  }
+  if (pid === process.pid) {
+    return { state: "known", variableNames: activeCallerProxyVariables(), source: "current-process" };
+  }
+  if (process.platform !== "linux") {
+    return { state: "unavailable", variableNames: [], source: "none" };
+  }
+  try {
+    const names = fs32.readFileSync(`/proc/${pid}/environ`).toString("utf8").split("\0").filter((entry) => entry.includes("=")).map((entry) => entry.slice(0, entry.indexOf("="))).filter((key) => ROUTING_PROXY_KEYS.has(key));
+    return { state: "known", variableNames: [...new Set(names)].sort(), source: "proc" };
+  } catch {
+    return { state: "unavailable", variableNames: [], source: "none" };
+  }
+}
+var ROUTING_PROXY_KEYS, proxyCheck;
 var init_proxy = __esm({
   "src/core/doctor/checks/proxy.ts"() {
     "use strict";
     init_proxy_service();
     init_proxy_store();
+    init_daemon_identity();
+    ROUTING_PROXY_KEYS = new Set(PROXY_ENV_KEYS.filter((key) => !["NO_PROXY", "no_proxy", "NODE_USE_ENV_PROXY"].includes(key)));
     proxyCheck = {
-      name: "Proxy routing",
+      name: "Network proxy",
       order: 85,
       async run(ctx) {
         try {
           if (ctx.dataDir) new ProxyStore(ctx.dataDir).load();
         } catch (error) {
-          if (error instanceof ProxyStoreCorruptError) return [{ status: "fail", message: `${error.message}. Network consumers are fail-closed; inspect quarantine/LKG before recovery.` }];
+          if (error instanceof ProxyStoreCorruptError) return [{ status: "fail", message: `${error.message}. Network traffic is blocked for safety. Inspect the quarantined file and last known-good copy before recovery.` }];
           throw error;
         }
-        const variables = PROXY_ENV_KEYS.filter((key) => {
-          const value = process.env[key];
-          return !["NO_PROXY", "no_proxy", "NODE_USE_ENV_PROXY"].includes(key) && value !== void 0 && value !== "";
-        });
-        if (!variables.length) {
-          return [{ status: "pass", message: "No daemon-wide proxy environment; native scoped routing is authoritative" }];
+        const callerVariables = activeCallerProxyVariables();
+        const daemon = ctx.daemonProxyEnvironment ?? inspectDaemonProxyEnvironment(ctx.pidPath ?? "", ctx.dataDir);
+        if (daemon.state === "known" && daemon.variableNames.length) {
+          return [{
+            status: "warn",
+            message: `Compatibility mode: the running OpenACP daemon has proxy variables (${daemon.variableNames.join(", ")}). Scoped routes still apply, but \u201CUse host proxy settings\u201D can use these variables. Remove only the OpenACP wrapper or service override when migration is complete.`
+          }];
+        }
+        if (daemon.state === "known") {
+          const shellNote = callerVariables.length && daemon.source !== "current-process" ? ` Current command shell has proxy variables (${callerVariables.join(", ")}), but they are not present in the running daemon.` : "";
+          return [{ status: "pass", message: `Scoped routing is active; the running daemon has no proxy variables.${shellNote}` }];
+        }
+        if (callerVariables.length) {
+          const daemonState = daemon.state === "not-running" ? "No running daemon was available to inspect" : "The running daemon environment could not be inspected on this platform";
+          return [{
+            status: "warn",
+            message: `Current command shell has proxy variables (${callerVariables.join(", ")}). ${daemonState}, so daemon compatibility mode was not inferred. A daemon started from this shell may inherit them.`
+          }];
         }
         return [{
-          status: "warn",
-          message: `Daemon-wide proxy environment active (${variables.join(", ")}); scoped routing is in compatibility mode until legacy wrapper/drop-in injection is removed`
+          status: "pass",
+          message: daemon.state === "not-running" ? "Current command shell has no proxy variables; no running daemon environment was available" : "Current command shell has no proxy variables; the running daemon environment could not be inspected, so compatibility mode was not inferred"
         }];
       }
     };
   }
 });
 
+// src/plugins/speech/local-readiness.ts
+import { statSync } from "fs";
+function getLocalWhisperReadiness(settings, options = {}) {
+  const env = options.env ?? process.env;
+  const envScriptPath = env[LOCAL_WHISPER_SCRIPT_PATH_ENV]?.trim();
+  const effectiveSettings = envScriptPath ? { ...settings, localWhisperScriptPath: envScriptPath } : settings;
+  const scriptPath = readLocalWhisperSettings(effectiveSettings).scriptPath;
+  const commandAvailable = options.commandAvailable ?? commandExists;
+  let script;
+  try {
+    const stat = statSync(scriptPath);
+    script = !stat.isFile() ? "not-file" : (stat.mode & 73) === 0 ? "not-executable" : "ready";
+  } catch {
+    script = "missing";
+  }
+  const runtimeReady = commandAvailable("uv") || commandAvailable("python3");
+  return { ready: script === "ready" && runtimeReady, script, runtimeReady };
+}
+var LOCAL_WHISPER_SCRIPT_PATH_ENV;
+var init_local_readiness = __esm({
+  "src/plugins/speech/local-readiness.ts"() {
+    "use strict";
+    init_agent_dependencies();
+    init_native_stt();
+    LOCAL_WHISPER_SCRIPT_PATH_ENV = "OPENACP_SPEECH_LOCAL_WHISPER_SCRIPT_PATH";
+  }
+});
+
+// src/core/network/proxy-labels.ts
+function humanizeIdentifier(value) {
+  const words = value.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[._-]+/g, " ").trim();
+  return words ? `${words[0].toUpperCase()}${words.slice(1)}` : "Unknown traffic";
+}
+function proxyCategoryLabel(category) {
+  return CATEGORY_LABELS[category] ?? humanizeIdentifier(category);
+}
+function proxyScopeLabel(scope) {
+  if (SCOPE_LABELS[scope]) return SCOPE_LABELS[scope];
+  const [category, ...rest] = scope.split(".");
+  const detail = humanizeIdentifier(rest.join("."));
+  return rest.length ? `${proxyCategoryLabel(category)} \xB7 ${detail}` : humanizeIdentifier(scope);
+}
+var CATEGORY_LABELS, SCOPE_LABELS;
+var init_proxy_labels = __esm({
+  "src/core/network/proxy-labels.ts"() {
+    "use strict";
+    CATEGORY_LABELS = {
+      channels: "Messaging connectors",
+      agents: "Coding agents",
+      services: "OpenACP services",
+      plugins: "Plugins"
+    };
+    SCOPE_LABELS = {
+      global: "Default for all traffic",
+      "channels.default": "Other messaging connectors",
+      "channels.telegram": "Telegram",
+      "agents.default": "Other coding agents",
+      "agents.codex": "Codex",
+      "agents.cursor": "Cursor",
+      "services.default": "Other OpenACP services",
+      "services.npmUpdate": "OpenACP updates",
+      "services.agentRegistry": "Agent catalog",
+      "services.pluginInstaller": "Plugin installation",
+      "services.speech": "Groq transcription",
+      "services.speechDownloads": "Local speech model downloads",
+      "plugins.default": "Plugin network traffic"
+    };
+  }
+});
+
+// src/core/doctor/checks/speech.ts
+import path31 from "path";
+var groqRoute, modelDownloadRoute, speechCheck;
+var init_speech = __esm({
+  "src/core/doctor/checks/speech.ts"() {
+    "use strict";
+    init_settings_manager();
+    init_native_stt();
+    init_local_readiness();
+    init_groq();
+    init_proxy_labels();
+    groqRoute = proxyScopeLabel("services.speech");
+    modelDownloadRoute = proxyScopeLabel("services.speechDownloads");
+    speechCheck = {
+      name: "Speech-to-text",
+      order: 84,
+      async run(ctx) {
+        const settings = await new SettingsManager(path31.join(ctx.pluginsDir, "data")).loadSettings("@openacp/speech");
+        const legacyGroqKey = typeof settings.groqApiKey === "string" && settings.groqApiKey.trim().length > 0;
+        const method = Object.prototype.hasOwnProperty.call(settings, "sttProvider") ? settings.sttProvider : legacyGroqKey ? "groq" : void 0;
+        if (method !== LOCAL_WHISPER_PROVIDER && method !== "groq") {
+          return [{ status: "pass", message: "Off (optional); no voice messages are sent for transcription" }];
+        }
+        if (method === LOCAL_WHISPER_PROVIDER) {
+          const readiness = getLocalWhisperReadiness(settings);
+          if (readiness.ready) {
+            return [{ status: "pass", message: `Local transcription selected; runtime ready. The model downloads on first use using the ${modelDownloadRoute} route` }];
+          }
+          const issue = readiness.script === "missing" ? "configured transcription executable missing" : readiness.script === "not-file" ? "configured transcription executable is not a file" : readiness.script === "not-executable" ? "configured transcription file is not executable" : "Python 3 or uv not found";
+          return [{
+            status: "warn",
+            message: `Local transcription selected but setup is not ready (${issue}). Restore or authorize the configured executable, or install Python 3/uv; model downloads use the ${modelDownloadRoute} route`
+          }];
+        }
+        const key = typeof settings.groqApiKey === "string" ? settings.groqApiKey.trim() : "";
+        if (!key) return [{ status: "warn", message: "Groq cloud transcription selected; API key not set. Add it securely in Settings \u2192 Speech-to-text" }];
+        try {
+          const provider = new GroqSTT(key, void 0, ctx.fetchForScope("services.speech"));
+          const result = await provider.checkAccess(AbortSignal.timeout(8e3));
+          return [{
+            status: result.ok ? "pass" : "warn",
+            message: result.ok ? `Groq cloud transcription selected; API key saved (hidden) and access verified using the ${groqRoute} route` : `Groq cloud transcription selected; API key saved (hidden), but access is not ready: ${result.message} Route: ${groqRoute}`
+          }];
+        } catch {
+          return [{ status: "warn", message: `Groq cloud transcription selected; API key saved (hidden), but the ${groqRoute} route could not start an access check` }];
+        }
+      }
+    };
+  }
+});
+
 // src/core/doctor/index.ts
-import * as fs30 from "fs";
-import * as path28 from "path";
+import * as fs33 from "fs";
+import * as path32 from "path";
 var ALL_CHECKS, CHECK_TIMEOUT_MS, DoctorEngine;
 var init_doctor = __esm({
   "src/core/doctor/index.ts"() {
@@ -5449,6 +6193,7 @@ var init_doctor = __esm({
     init_daemon();
     init_tunnel();
     init_proxy();
+    init_speech();
     ALL_CHECKS = [
       configCheck,
       agentsCheck,
@@ -5458,6 +6203,7 @@ var init_doctor = __esm({
       pluginsCheck,
       daemonCheck,
       tunnelCheck,
+      speechCheck,
       proxyCheck
     ];
     CHECK_TIMEOUT_MS = 1e4;
@@ -5526,28 +6272,29 @@ var init_doctor = __esm({
       /** Constructs the shared context used by all checks — loads config if available. */
       async buildContext() {
         const dataDir = this.dataDir;
-        const configPath = process.env.OPENACP_CONFIG_PATH || path28.join(dataDir, "config.json");
+        const configPath = process.env.OPENACP_CONFIG_PATH || path32.join(dataDir, "config.json");
         let config = null;
         let rawConfig = null;
         try {
-          const content = fs30.readFileSync(configPath, "utf-8");
+          const content = fs33.readFileSync(configPath, "utf-8");
           rawConfig = JSON.parse(content);
           const cm = new ConfigManager(configPath);
           await cm.load();
           config = cm.get();
         } catch {
         }
-        const logsDir = config ? expandHome2(config.logging.logDir) : path28.join(dataDir, "logs");
+        const logsDir = config ? expandHome2(config.logging.logDir) : path32.join(dataDir, "logs");
         return {
           config,
           rawConfig,
           configPath,
           dataDir,
-          sessionsPath: path28.join(dataDir, "sessions.json"),
-          pidPath: path28.join(dataDir, "openacp.pid"),
-          portFilePath: path28.join(dataDir, "api.port"),
-          pluginsDir: path28.join(dataDir, "plugins"),
+          sessionsPath: path32.join(dataDir, "sessions.json"),
+          pidPath: path32.join(dataDir, "openacp.pid"),
+          portFilePath: path32.join(dataDir, "api.port"),
+          pluginsDir: path32.join(dataDir, "plugins"),
           logsDir,
+          daemonProxyEnvironment: inspectDaemonProxyEnvironment(path32.join(dataDir, "openacp.pid"), dataDir),
           fetchForScope: (scope) => this.proxyService.createFetch(scope)
         };
       }
@@ -5555,119 +6302,6 @@ var init_doctor = __esm({
   }
 });
 
-// src/core/instance/instance-registry.ts
-import fs32 from "fs";
-import path30 from "path";
-import { randomUUID as randomUUID5 } from "crypto";
-function readIdFromConfig(instanceRoot) {
-  try {
-    const raw = JSON.parse(fs32.readFileSync(path30.join(instanceRoot, "config.json"), "utf-8"));
-    return typeof raw.id === "string" && raw.id ? raw.id : null;
-  } catch {
-    return null;
-  }
-}
-var InstanceRegistry;
-var init_instance_registry = __esm({
-  "src/core/instance/instance-registry.ts"() {
-    "use strict";
-    InstanceRegistry = class {
-      constructor(registryPath) {
-        this.registryPath = registryPath;
-      }
-      registryPath;
-      data = { version: 1, instances: {} };
-      /** Load the registry from disk. If the file is missing or corrupt, starts fresh. */
-      load() {
-        try {
-          const raw = fs32.readFileSync(this.registryPath, "utf-8");
-          const parsed = JSON.parse(raw);
-          if (parsed.version === 1 && parsed.instances) {
-            this.data = parsed;
-            this.deduplicate();
-          }
-        } catch {
-        }
-      }
-      /** Remove duplicate entries that point to the same root, keeping the first one */
-      deduplicate() {
-        const seen = /* @__PURE__ */ new Set();
-        const toRemove = [];
-        for (const [id, entry] of Object.entries(this.data.instances)) {
-          if (seen.has(entry.root)) {
-            toRemove.push(id);
-          } else {
-            seen.add(entry.root);
-          }
-        }
-        if (toRemove.length > 0) {
-          for (const id of toRemove) delete this.data.instances[id];
-          this.save();
-        }
-      }
-      /** Persist the registry to disk, creating parent directories if needed. */
-      save() {
-        const dir = path30.dirname(this.registryPath);
-        fs32.mkdirSync(dir, { recursive: true });
-        fs32.writeFileSync(this.registryPath, JSON.stringify(this.data, null, 2));
-      }
-      /** Add or update an instance entry in the registry. Does not persist — call save() after. */
-      register(id, root) {
-        this.data.instances[id] = { id, root };
-      }
-      /** Remove an instance entry. Does not persist — call save() after. */
-      remove(id) {
-        delete this.data.instances[id];
-      }
-      /** Look up an instance by its ID. */
-      get(id) {
-        return this.data.instances[id];
-      }
-      /** Look up an instance by its root directory path. */
-      getByRoot(root) {
-        return Object.values(this.data.instances).find((e) => e.root === root);
-      }
-      /** Returns all registered instances. */
-      list() {
-        return Object.values(this.data.instances);
-      }
-      /** Returns `baseId` if available, otherwise appends `-2`, `-3`, etc. until unique. */
-      uniqueId(baseId) {
-        if (!this.data.instances[baseId]) return baseId;
-        let n = 2;
-        while (this.data.instances[`${baseId}-${n}`]) n++;
-        return `${baseId}-${n}`;
-      }
-      /**
-       * Resolve the authoritative id for an instance root.
-       *
-       * config.json is the source of truth. If the registry entry disagrees with
-       * config.json, the registry is updated to match. If neither exists, a fresh
-       * UUID is generated and registered (but NOT written to config.json — the
-       * caller must call initInstanceFiles to persist it).
-       *
-       * Returns the resolved id and whether the registry was mutated (so callers
-       * can decide whether to persist with save()).
-       */
-      resolveId(instanceRoot) {
-        const configId = readIdFromConfig(instanceRoot);
-        const entry = this.getByRoot(instanceRoot);
-        if (entry && configId && entry.id !== configId) {
-          this.remove(entry.id);
-          this.register(configId, instanceRoot);
-          return { id: configId, registryUpdated: true };
-        }
-        const id = configId ?? entry?.id ?? randomUUID5();
-        if (!this.getByRoot(instanceRoot)) {
-          this.register(id, instanceRoot);
-          return { id, registryUpdated: true };
-        }
-        return { id, registryUpdated: false };
-      }
-    };
-  }
-});
-
 // src/core/plugin/terminal-io.ts
 import * as clack from "@clack/prompts";
 function isCancel(value) {
@@ -5731,17 +6365,18 @@ var install_context_exports = {};
 __export(install_context_exports, {
   createInstallContext: () => createInstallContext
 });
-import path32 from "path";
+import path35 from "path";
 function createInstallContext(opts) {
   const { pluginName, settingsManager, basePath, instanceRoot } = opts;
-  const dataDir = path32.join(basePath, pluginName, "data");
+  const dataDir = path35.join(basePath, pluginName, "data");
   return {
     pluginName,
     terminal: createTerminalIO(),
     settings: settingsManager.createAPI(pluginName),
     dataDir,
     log: log.child({ plugin: pluginName }),
-    instanceRoot
+    instanceRoot,
+    transactSettings: (prepare) => settingsManager.transactPluginSettings(pluginName, prepare)
   };
 }
 var init_install_context = __esm({
@@ -5762,14 +6397,14 @@ __export(api_client_exports, {
   waitForApiReady: () => waitForApiReady,
   waitForPortFile: () => waitForPortFile
 });
-import * as fs34 from "fs";
-import * as path33 from "path";
+import * as fs36 from "fs";
+import * as path36 from "path";
 import { setTimeout as sleep } from "timers/promises";
 function defaultPortFile(root) {
-  return path33.join(root, "api.port");
+  return path36.join(root, "api.port");
 }
 function defaultSecretFile(root) {
-  return path33.join(root, "api-secret");
+  return path36.join(root, "api-secret");
 }
 async function waitForPortFile(portFilePath, timeoutMs = 5e3, intervalMs = 100) {
   const deadline = Date.now() + timeoutMs;
@@ -5803,7 +6438,7 @@ async function waitForApiReady(instanceRoot, expectedInstanceId, timeoutMs = 1e4
 function readApiPort(portFilePath, instanceRoot) {
   const filePath = portFilePath ?? defaultPortFile(instanceRoot);
   try {
-    const content = fs34.readFileSync(filePath, "utf-8").trim();
+    const content = fs36.readFileSync(filePath, "utf-8").trim();
     const port = parseInt(content, 10);
     return isNaN(port) ? null : port;
   } catch {
@@ -5813,7 +6448,7 @@ function readApiPort(portFilePath, instanceRoot) {
 function readApiSecret(secretFilePath, instanceRoot) {
   const filePath = secretFilePath ?? defaultSecretFile(instanceRoot);
   try {
-    const content = fs34.readFileSync(filePath, "utf-8").trim();
+    const content = fs36.readFileSync(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -5822,7 +6457,7 @@ function readApiSecret(secretFilePath, instanceRoot) {
 function removeStalePortFile(portFilePath, instanceRoot) {
   const filePath = portFilePath ?? defaultPortFile(instanceRoot);
   try {
-    fs34.unlinkSync(filePath);
+    fs36.unlinkSync(filePath);
   } catch {
   }
 }
@@ -5959,8 +6594,8 @@ var init_notification = __esm({
 });
 
 // src/plugins/file-service/file-service.ts
-import fs36 from "fs";
-import path36 from "path";
+import fs38 from "fs";
+import path39 from "path";
 import { OggOpusDecoder } from "ogg-opus-decoder";
 import wav from "node-wav";
 function classifyMime(mimeType) {
@@ -6017,14 +6652,14 @@ var init_file_service = __esm({
         const cutoff = Date.now() - maxAgeDays * 24 * 60 * 60 * 1e3;
         let removed = 0;
         try {
-          const entries = await fs36.promises.readdir(this.baseDir, { withFileTypes: true });
+          const entries = await fs38.promises.readdir(this.baseDir, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory()) continue;
-            const dirPath = path36.join(this.baseDir, entry.name);
+            const dirPath = path39.join(this.baseDir, entry.name);
             try {
-              const stat = await fs36.promises.stat(dirPath);
+              const stat = await fs38.promises.stat(dirPath);
               if (stat.mtimeMs < cutoff) {
-                await fs36.promises.rm(dirPath, { recursive: true, force: true });
+                await fs38.promises.rm(dirPath, { recursive: true, force: true });
                 removed++;
               }
             } catch {
@@ -6043,11 +6678,11 @@ var init_file_service = __esm({
        * so the user-facing name is not lost.
        */
       async saveFile(sessionId, fileName, data, mimeType) {
-        const sessionDir = path36.join(this.baseDir, sessionId);
-        await fs36.promises.mkdir(sessionDir, { recursive: true });
+        const sessionDir = path39.join(this.baseDir, sessionId);
+        await fs38.promises.mkdir(sessionDir, { recursive: true });
         const safeName = `${Date.now()}-${fileName.replace(/[^a-zA-Z0-9._-]/g, "_")}`;
-        const filePath = path36.join(sessionDir, safeName);
-        await fs36.promises.writeFile(filePath, data);
+        const filePath = path39.join(sessionDir, safeName);
+        await fs38.promises.writeFile(filePath, data);
         return {
           type: classifyMime(mimeType),
           filePath,
@@ -6062,14 +6697,14 @@ var init_file_service = __esm({
        */
       async resolveFile(filePath) {
         try {
-          const stat = await fs36.promises.stat(filePath);
+          const stat = await fs38.promises.stat(filePath);
           if (!stat.isFile()) return null;
-          const ext = path36.extname(filePath).toLowerCase();
+          const ext = path39.extname(filePath).toLowerCase();
           const mimeType = EXT_TO_MIME[ext] || "application/octet-stream";
           return {
             type: classifyMime(mimeType),
             filePath,
-            fileName: path36.basename(filePath),
+            fileName: path39.basename(filePath),
             mimeType,
             size: stat.size
           };
@@ -6408,6 +7043,9 @@ import fastifyRateLimit from "@fastify/rate-limit";
 import { serializerCompiler, validatorCompiler } from "fastify-type-provider-zod";
 async function createApiServer(options) {
   const app = Fastify({ logger: options.logger ?? false, forceCloseConnections: true });
+  app.addHook("onClose", async () => {
+    if (options.tokenStore) await options.tokenStore.close();
+  });
   app.setValidatorCompiler(validatorCompiler);
   app.setSerializerCompiler(serializerCompiler);
   app.addHook("onRequest", async (request, reply) => {
@@ -6712,8 +7350,8 @@ data: ${JSON.stringify(data)}
 });
 
 // src/plugins/api-server/static-server.ts
-import * as fs37 from "fs";
-import * as path37 from "path";
+import * as fs39 from "fs";
+import * as path40 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var MIME_TYPES, StaticServer;
 var init_static_server = __esm({
@@ -6737,16 +7375,16 @@ var init_static_server = __esm({
         this.uiDir = uiDir;
         if (!this.uiDir) {
           const __filename = fileURLToPath2(import.meta.url);
-          const candidate = path37.resolve(path37.dirname(__filename), "../../ui/dist");
-          if (fs37.existsSync(path37.join(candidate, "index.html"))) {
+          const candidate = path40.resolve(path40.dirname(__filename), "../../ui/dist");
+          if (fs39.existsSync(path40.join(candidate, "index.html"))) {
             this.uiDir = candidate;
           }
           if (!this.uiDir) {
-            const publishCandidate = path37.resolve(
-              path37.dirname(__filename),
+            const publishCandidate = path40.resolve(
+              path40.dirname(__filename),
               "../ui"
             );
-            if (fs37.existsSync(path37.join(publishCandidate, "index.html"))) {
+            if (fs39.existsSync(path40.join(publishCandidate, "index.html"))) {
               this.uiDir = publishCandidate;
             }
           }
@@ -6764,23 +7402,23 @@ var init_static_server = __esm({
       serve(req, res) {
         if (!this.uiDir) return false;
         const urlPath = (req.url || "/").split("?")[0];
-        const safePath = path37.normalize(urlPath);
-        const filePath = path37.join(this.uiDir, safePath);
-        if (!filePath.startsWith(this.uiDir + path37.sep) && filePath !== this.uiDir)
+        const safePath = path40.normalize(urlPath);
+        const filePath = path40.join(this.uiDir, safePath);
+        if (!filePath.startsWith(this.uiDir + path40.sep) && filePath !== this.uiDir)
           return false;
         let realFilePath;
         try {
-          realFilePath = fs37.realpathSync(filePath);
+          realFilePath = fs39.realpathSync(filePath);
         } catch {
           realFilePath = null;
         }
         if (realFilePath !== null) {
-          const realUiDir = fs37.realpathSync(this.uiDir);
-          if (!realFilePath.startsWith(realUiDir + path37.sep) && realFilePath !== realUiDir)
+          const realUiDir = fs39.realpathSync(this.uiDir);
+          if (!realFilePath.startsWith(realUiDir + path40.sep) && realFilePath !== realUiDir)
             return false;
         }
-        if (realFilePath !== null && fs37.existsSync(realFilePath) && fs37.statSync(realFilePath).isFile()) {
-          const ext = path37.extname(filePath);
+        if (realFilePath !== null && fs39.existsSync(realFilePath) && fs39.statSync(realFilePath).isFile()) {
+          const ext = path40.extname(filePath);
           const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
           const isHashed = /\.[a-zA-Z0-9]{8,}\.(js|css)$/.test(filePath);
           const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "no-cache";
@@ -6788,16 +7426,16 @@ var init_static_server = __esm({
             "Content-Type": contentType,
             "Cache-Control": cacheControl
           });
-          fs37.createReadStream(realFilePath).pipe(res);
+          fs39.createReadStream(realFilePath).pipe(res);
           return true;
         }
-        const indexPath = path37.join(this.uiDir, "index.html");
-        if (fs37.existsSync(indexPath)) {
+        const indexPath = path40.join(this.uiDir, "index.html");
+        if (fs39.existsSync(indexPath)) {
           res.writeHead(200, {
             "Content-Type": "text/html; charset=utf-8",
             "Cache-Control": "no-cache"
           });
-          fs37.createReadStream(indexPath).pipe(res);
+          fs39.createReadStream(indexPath).pipe(res);
           return true;
         }
         return false;
@@ -6821,23 +7459,28 @@ var init_speech_service = __esm({
       providerFactory;
       factoryOwnedSTT = /* @__PURE__ */ new Set();
       factoryOwnedTTS = /* @__PURE__ */ new Set();
+      runtimeRevision = 0;
       /** Set a factory function that can recreate providers from config (for hot-reload) */
       setProviderFactory(factory) {
         this.providerFactory = factory;
+        this.runtimeRevision += 1;
       }
       /** Register an STT provider by name. Overwrites any existing provider with the same name. */
       registerSTTProvider(name, provider) {
         this.sttProviders.set(name, provider);
         this.factoryOwnedSTT.delete(name);
+        this.runtimeRevision += 1;
       }
       /** Register a TTS provider by name. Called by external TTS plugins (e.g. msedge-tts-plugin). */
       registerTTSProvider(name, provider) {
         this.ttsProviders.set(name, provider);
         this.factoryOwnedTTS.delete(name);
+        this.runtimeRevision += 1;
       }
       /** Remove a TTS provider — called by external plugins on teardown. */
       unregisterTTSProvider(name) {
         this.ttsProviders.delete(name);
+        this.runtimeRevision += 1;
       }
       /** Returns true if an STT provider is configured and has credentials. */
       isSTTAvailable() {
@@ -6862,7 +7505,7 @@ var init_speech_service = __esm({
       async transcribe(audioBuffer, mimeType, options) {
         const providerName = this.config.stt.provider;
         if (!providerName || !this.config.stt.providers[providerName]?.apiKey) {
-          throw new Error("STT not configured. Set speech.stt.provider and API key in config.");
+          throw new Error("Speech-to-text is off or not ready. Open Settings \u2192 Speech-to-text or run /speech.");
         }
         const provider = this.sttProviders.get(providerName);
         if (!provider) {
@@ -6889,6 +7532,77 @@ var init_speech_service = __esm({
       /** Replace the active config without rebuilding providers. Use `refreshProviders` to also rebuild. */
       updateConfig(config) {
         this.config = config;
+        this.runtimeRevision += 1;
+      }
+      /**
+       * Build and validate a complete factory-owned provider replacement without
+       * changing the active runtime. The returned commit is revision-checked and
+       * preserves providers registered by external plugins. Rollback restores the
+       * exact config, maps, ownership sets, and provider object references captured
+       * immediately before commit.
+       */
+      prepareProviderRefresh(newConfig) {
+        if (!this.providerFactory) {
+          const baseRevision2 = this.runtimeRevision;
+          let previousConfig;
+          let committed2 = false;
+          return {
+            commit: () => {
+              if (committed2 || this.runtimeRevision !== baseRevision2) throw new Error("Speech runtime changed while provider refresh was being prepared");
+              previousConfig = this.config;
+              this.config = newConfig;
+              this.runtimeRevision = baseRevision2 + 1;
+              committed2 = true;
+            },
+            rollback: () => {
+              if (!committed2 || previousConfig === void 0) return;
+              if (this.runtimeRevision !== baseRevision2 + 1) throw new Error("Speech runtime changed before provider refresh rollback");
+              this.config = previousConfig;
+              this.runtimeRevision = baseRevision2;
+              committed2 = false;
+            }
+          };
+        }
+        const baseRevision = this.runtimeRevision;
+        const built = this.providerFactory(newConfig);
+        let previous;
+        let committed = false;
+        return {
+          commit: () => {
+            if (committed || this.runtimeRevision !== baseRevision) throw new Error("Speech runtime changed while provider refresh was being prepared");
+            previous = {
+              config: this.config,
+              sttProviders: this.sttProviders,
+              ttsProviders: this.ttsProviders,
+              factoryOwnedSTT: this.factoryOwnedSTT,
+              factoryOwnedTTS: this.factoryOwnedTTS
+            };
+            const nextSTT = new Map(this.sttProviders);
+            const nextTTS = new Map(this.ttsProviders);
+            for (const name of this.factoryOwnedSTT) nextSTT.delete(name);
+            for (const name of this.factoryOwnedTTS) nextTTS.delete(name);
+            for (const [name, provider] of built.stt) nextSTT.set(name, provider);
+            for (const [name, provider] of built.tts) nextTTS.set(name, provider);
+            this.config = newConfig;
+            this.sttProviders = nextSTT;
+            this.ttsProviders = nextTTS;
+            this.factoryOwnedSTT = new Set(built.stt.keys());
+            this.factoryOwnedTTS = new Set(built.tts.keys());
+            this.runtimeRevision = baseRevision + 1;
+            committed = true;
+          },
+          rollback: () => {
+            if (!committed || !previous) return;
+            if (this.runtimeRevision !== baseRevision + 1) throw new Error("Speech runtime changed before provider refresh rollback");
+            this.config = previous.config;
+            this.sttProviders = previous.sttProviders;
+            this.ttsProviders = previous.ttsProviders;
+            this.factoryOwnedSTT = previous.factoryOwnedSTT;
+            this.factoryOwnedTTS = previous.factoryOwnedTTS;
+            this.runtimeRevision = baseRevision;
+            committed = false;
+          }
+        };
       }
       /**
        * Reloads TTS and STT providers from a new config snapshot.
@@ -6898,22 +7612,7 @@ var init_speech_service = __esm({
        * (e.g. from `@openacp/msedge-tts-plugin`) are preserved rather than discarded.
        */
       refreshProviders(newConfig) {
-        if (!this.providerFactory) {
-          this.config = newConfig;
-          return;
-        }
-        const built = this.providerFactory(newConfig);
-        const nextSTT = new Map(this.sttProviders);
-        const nextTTS = new Map(this.ttsProviders);
-        for (const name of this.factoryOwnedSTT) nextSTT.delete(name);
-        for (const name of this.factoryOwnedTTS) nextTTS.delete(name);
-        for (const [name, provider] of built.stt) nextSTT.set(name, provider);
-        for (const [name, provider] of built.tts) nextTTS.set(name, provider);
-        this.config = newConfig;
-        this.sttProviders = nextSTT;
-        this.ttsProviders = nextTTS;
-        this.factoryOwnedSTT = new Set(built.stt.keys());
-        this.factoryOwnedTTS = new Set(built.tts.keys());
+        this.prepareProviderRefresh(newConfig).commit();
       }
     };
   }
@@ -6930,8 +7629,8 @@ var init_exports = __esm({
 });
 
 // src/plugins/context/context-cache.ts
-import * as fs38 from "fs";
-import * as path38 from "path";
+import * as fs40 from "fs";
+import * as path41 from "path";
 import * as crypto2 from "crypto";
 var DEFAULT_TTL_MS, ContextCache;
 var init_context_cache = __esm({
@@ -6942,7 +7641,7 @@ var init_context_cache = __esm({
       constructor(cacheDir, ttlMs = DEFAULT_TTL_MS) {
         this.cacheDir = cacheDir;
         this.ttlMs = ttlMs;
-        fs38.mkdirSync(cacheDir, { recursive: true });
+        fs40.mkdirSync(cacheDir, { recursive: true });
       }
       cacheDir;
       ttlMs;
@@ -6950,23 +7649,23 @@ var init_context_cache = __esm({
         return crypto2.createHash("sha256").update(`${repoPath}:${queryKey}`).digest("hex").slice(0, 16);
       }
       filePath(repoPath, queryKey) {
-        return path38.join(this.cacheDir, `${this.keyHash(repoPath, queryKey)}.json`);
+        return path41.join(this.cacheDir, `${this.keyHash(repoPath, queryKey)}.json`);
       }
       get(repoPath, queryKey) {
         const fp = this.filePath(repoPath, queryKey);
         try {
-          const stat = fs38.statSync(fp);
+          const stat = fs40.statSync(fp);
           if (Date.now() - stat.mtimeMs > this.ttlMs) {
-            fs38.unlinkSync(fp);
+            fs40.unlinkSync(fp);
             return null;
           }
-          return JSON.parse(fs38.readFileSync(fp, "utf-8"));
+          return JSON.parse(fs40.readFileSync(fp, "utf-8"));
         } catch {
           return null;
         }
       }
       set(repoPath, queryKey, result) {
-        fs38.writeFileSync(this.filePath(repoPath, queryKey), JSON.stringify(result));
+        fs40.writeFileSync(this.filePath(repoPath, queryKey), JSON.stringify(result));
       }
     };
   }
@@ -7092,7 +7791,7 @@ var init_context_provider = __esm({
 });
 
 // src/plugins/context/entire/checkpoint-reader.ts
-import { execFileSync as execFileSync7 } from "child_process";
+import { execFileSync as execFileSync8 } from "child_process";
 var ENTIRE_BRANCH, CHECKPOINT_ID_RE, SESSION_ID_RE, CheckpointReader;
 var init_checkpoint_reader = __esm({
   "src/plugins/context/entire/checkpoint-reader.ts"() {
@@ -7112,7 +7811,7 @@ var init_checkpoint_reader = __esm({
        */
       git(...args) {
         try {
-          return execFileSync7("git", ["-C", this.repoPath, ...args], {
+          return execFileSync8("git", ["-C", this.repoPath, ...args], {
             encoding: "utf-8"
           }).trim();
         } catch {
@@ -7940,8 +8639,8 @@ function formatToolSummary(name, rawInput, displaySummary) {
   }
   if (lowerName === "grep") {
     const pattern = args.pattern ?? "";
-    const path39 = args.path ?? "";
-    return pattern ? `\u{1F50D} Grep "${pattern}"${path39 ? ` in ${path39}` : ""}` : `\u{1F527} ${name}`;
+    const path42 = args.path ?? "";
+    return pattern ? `\u{1F50D} Grep "${pattern}"${path42 ? ` in ${path42}` : ""}` : `\u{1F527} ${name}`;
   }
   if (lowerName === "glob") {
     const pattern = args.pattern ?? "";
@@ -7977,8 +8676,8 @@ function formatToolTitle(name, rawInput, displayTitle) {
   }
   if (lowerName === "grep") {
     const pattern = args.pattern ?? "";
-    const path39 = args.path ?? "";
-    return pattern ? `"${pattern}"${path39 ? ` in ${path39}` : ""}` : name;
+    const path42 = args.path ?? "";
+    return pattern ? `"${pattern}"${path42 ? ` in ${path42}` : ""}` : name;
   }
   if (lowerName === "glob") {
     return String(args.pattern ?? name);
@@ -8456,9 +9155,9 @@ var init_send_queue = __esm({
         const interval = this.getInterval(item.category);
         const lastExec = item.category ? this.lastCategoryExec.get(item.category) ?? 0 : this.lastExec;
         const elapsed = Date.now() - lastExec;
-        const delay = Math.max(0, interval - elapsed);
+        const delay2 = Math.max(0, interval - elapsed);
         this.processing = true;
-        setTimeout(() => void this.processNext(), delay);
+        setTimeout(() => void this.processNext(), delay2);
       }
       getInterval(category) {
         if (category && this.config.categoryIntervals?.[category] != null) {
@@ -11157,6 +11856,8 @@ import { InlineKeyboard as InlineKeyboard7 } from "grammy";
 async function buildSettingsKeyboard(core) {
   const fields = getSafeFields();
   const kb = new InlineKeyboard7();
+  kb.text("\u{1F399} Speech-to-text", settingsCommandCallback("/speech")).row();
+  kb.text("\u{1F310} Network proxy", settingsCommandCallback("/proxy")).row();
   for (const field of fields) {
     const value = getConfigValue(core.configManager.get(), field.path);
     const label = formatFieldLabel(field, value);
@@ -11168,8 +11869,6 @@ async function buildSettingsKeyboard(core) {
       kb.text(`${label}`, `s:input:${field.path}`).row();
     }
   }
-  kb.text("\u{1F310} Proxy Management", settingsCommandCallback("/proxy")).row();
-  kb.text("\u{1F399} Speech-to-Text", settingsCommandCallback("/speech")).row();
   kb.text("\u25C0\uFE0F Back to Menu", "s:back");
   return kb;
 }
@@ -11193,7 +11892,7 @@ function formatFieldLabel(field, value) {
 async function handleSettings(ctx, core) {
   const kb = await buildSettingsKeyboard(core);
   await ctx.reply(`<b>\u2699\uFE0F Settings</b>
-Tap to change:`, {
+Choose a section. Changes that need a restart are marked.`, {
     parse_mode: "HTML",
     reply_markup: kb
   });
@@ -11264,7 +11963,7 @@ Select a value:`, {
       }
       try {
         await ctx.editMessageText(`<b>\u2699\uFE0F Settings</b>
-Tap to change:`, {
+Choose a section. Changes that need a restart are marked.`, {
           parse_mode: "HTML",
           reply_markup: await buildSettingsKeyboard(core)
         });
@@ -11321,7 +12020,7 @@ Choose an action:`, {
     }
     try {
       await ctx.editMessageText(`<b>\u2699\uFE0F Settings</b>
-Tap to change:`, {
+Choose a section. Changes that need a restart are marked.`, {
         parse_mode: "HTML",
         reply_markup: await buildSettingsKeyboard(core)
       });
@@ -11340,30 +12039,107 @@ var init_settings = __esm({
   }
 });
 
+// src/core/doctor/format.ts
+function countNoun(count, singular, plural) {
+  return `${count} ${count === 1 ? singular : plural}`;
+}
+function doctorHeadline(summary) {
+  if (summary.failed === 1) return "1 failure needs attention";
+  if (summary.failed > 1) return `${summary.failed} failures need attention`;
+  if (summary.warnings > 0) return `${countNoun(summary.warnings, "warning", "warnings")} to review`;
+  return "All checks passed";
+}
+function doctorSummary(summary, separator = ", ") {
+  const counts = [
+    `${summary.passed} passed`,
+    countNoun(summary.warnings, "warning", "warnings"),
+    countNoun(summary.failed, "failure", "failures")
+  ];
+  if (summary.fixed) counts.push(countNoun(summary.fixed, "fix", "fixes"));
+  return counts.join(separator);
+}
+var init_format = __esm({
+  "src/core/doctor/format.ts"() {
+    "use strict";
+  }
+});
+
 // src/plugins/telegram/commands/doctor.ts
 import { InlineKeyboard as InlineKeyboard8 } from "grammy";
+function escapeHtmlToLimit(text3, limit) {
+  if (limit <= 0) return "";
+  const chunks = [];
+  let length = 0;
+  let shortened = false;
+  for (const character of text3) {
+    const escaped = escapeHtml2(character);
+    if (length + escaped.length > limit) {
+      shortened = true;
+      break;
+    }
+    chunks.push(escaped);
+    length += escaped.length;
+  }
+  if (!shortened) return chunks.join("");
+  while (chunks.length && length + 1 > limit) length -= chunks.pop().length;
+  return limit > 0 ? `${chunks.join("")}\u2026` : "";
+}
+function renderTruncatedReport(report, header2) {
+  const icons = { pass: "\u2705", warn: "\u26A0\uFE0F", fail: "\u274C" };
+  const footer = `
+
+${SHORTENED_FOOTER}`;
+  const budget = TELEGRAM_REPORT_LIMIT - footer.length;
+  const lines = [...header2];
+  let length = lines.join("\n").length;
+  const append = (line) => {
+    const added = (lines.length ? 1 : 0) + line.length;
+    if (length + added > budget) return false;
+    lines.push(line);
+    length += added;
+    return true;
+  };
+  outer: for (const category of report.categories.filter((item) => item.results.some((result) => result.status !== "pass"))) {
+    const remainingForCategory = budget - length - 1;
+    const categoryText = escapeHtmlToLimit(category.name, Math.max(0, remainingForCategory - 7));
+    if (!categoryText || !append(`<b>${categoryText}</b>`)) break;
+    for (const result of category.results.filter((item) => item.status !== "pass")) {
+      const prefix = `  ${icons[result.status]} `;
+      const remaining = budget - length - 1 - prefix.length;
+      if (remaining <= 0) break outer;
+      const message = escapeHtmlToLimit(result.message, remaining);
+      if (!append(`${prefix}${message}`)) break outer;
+      if (message !== escapeHtml2(result.message)) break outer;
+    }
+    if (!append("")) break;
+  }
+  return `${lines.join("\n")}${footer}`;
+}
 function renderReport(report) {
   const icons = { pass: "\u2705", warn: "\u26A0\uFE0F", fail: "\u274C" };
-  const lines = ["\u{1FA7A} <b>OpenACP Doctor</b>\n"];
-  for (const category of report.categories) {
-    lines.push(`<b>${category.name}</b>`);
-    for (const result of category.results) {
+  const { passed } = report.summary;
+  const header2 = ["\u{1FA7A} <b>OpenACP Doctor</b>", `<b>${doctorHeadline(report.summary)}</b>`, doctorSummary(report.summary, " \xB7 "), ""];
+  const lines = [...header2];
+  for (const category of report.categories.filter((item) => item.results.some((result) => result.status !== "pass"))) {
+    lines.push(`<b>${escapeHtml2(category.name)}</b>`);
+    for (const result of category.results.filter((item) => item.status !== "pass")) {
       lines.push(`  ${icons[result.status]} ${escapeHtml2(result.message)}`);
     }
     lines.push("");
   }
-  const { passed, warnings, failed, fixed } = report.summary;
-  const fixedStr = fixed > 0 ? `, ${fixed} fixed` : "";
-  lines.push(`<b>Result:</b> ${passed} passed, ${warnings} warnings, ${failed} failed${fixedStr}`);
-  let keyboard;
+  if (passed) lines.push(`\u2705 ${passed} passed`);
+  const keyboard = new InlineKeyboard8();
   if (report.pendingFixes.length > 0) {
-    keyboard = new InlineKeyboard8();
     for (let i = 0; i < report.pendingFixes.length; i++) {
       const label = `\u{1F527} Fix: ${report.pendingFixes[i].message.slice(0, 30)}`;
       keyboard.text(label, `m:doctor:fix:${i}`).row();
     }
   }
-  return { text: lines.join("\n"), keyboard };
+  keyboard.text("Run again", "m:doctor").row();
+  keyboard.text("Speech-to-text settings", settingsCommandCallback("/speech")).row();
+  keyboard.text("Network proxy settings", settingsCommandCallback("/proxy"));
+  const text3 = lines.join("\n");
+  return { text: text3.length <= TELEGRAM_REPORT_LIMIT ? text3 : renderTruncatedReport(report, header2), keyboard };
 }
 function escapeHtml2(text3) {
   return text3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -11387,8 +12163,8 @@ async function handleDoctor(ctx, core) {
     await ctx.api.editMessageText(
       ctx.chat.id,
       statusMsg.message_id,
-      `\u274C Doctor failed: ${err instanceof Error ? err.message : String(err)}`,
-      { parse_mode: "HTML" }
+      `\u274C Diagnostics could not finish. Check the OpenACP logs, then run the checks again.`,
+      { parse_mode: "HTML", reply_markup: new InlineKeyboard8().text("Run again", "m:doctor") }
     );
   }
 }
@@ -11443,14 +12219,18 @@ function setupDoctorCallbacks(bot, core) {
     await handleDoctor(ctx, core);
   });
 }
-var log30, pendingFixesStore;
+var log30, pendingFixesStore, TELEGRAM_REPORT_LIMIT, SHORTENED_FOOTER;
 var init_doctor2 = __esm({
   "src/plugins/telegram/commands/doctor.ts"() {
     "use strict";
     init_doctor();
     init_log();
+    init_callback_navigation();
+    init_format();
     log30 = createChildLogger({ module: "telegram-cmd-doctor" });
     pendingFixesStore = /* @__PURE__ */ new Map();
+    TELEGRAM_REPORT_LIMIT = 3900;
+    SHORTENED_FOOTER = "\u2026Output shortened. Run openacp doctor on the host for full details.";
   }
 });
 
@@ -11932,8 +12712,8 @@ var init_commands = __esm({
       { command: "handoff", description: "Continue this session in your terminal" },
       { command: "restart", description: "Restart OpenACP" },
       { command: "update", description: "Update to latest version and restart" },
-      { command: "doctor", description: "Run system diagnostics" },
-      { command: "proxy", description: "Manage scoped proxy routing" },
+      { command: "doctor", description: "Check OpenACP health" },
+      { command: "proxy", description: "Configure network proxy" },
       { command: "retry", description: "Re-check setup prerequisites (use if bot is stuck on startup)" },
       { command: "tunnel", description: "Create/stop tunnel for a local port" },
       { command: "tunnels", description: "List active tunnels" },
@@ -12953,7 +13733,7 @@ var init_types = __esm({
 });
 
 // src/core/commands/proxy.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID6 } from "crypto";
 function clearProxyDraftsForChannel(channelId) {
   const prefix = `${channelId}:`;
   for (const [id, draft] of drafts) if (draft.owner.startsWith(prefix)) drafts.delete(id);
@@ -12966,13 +13746,14 @@ var init_proxy2 = __esm({
     init_types();
     init_proxy_store();
     init_proxy_service();
+    init_proxy_labels();
     DRAFT_TTL_MS = 10 * 6e4;
     drafts = /* @__PURE__ */ new Map();
   }
 });
 
 // src/plugins/telegram/command-sync.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function validDescription(description) {
   if (typeof description !== "string") return false;
   const trimmed = description.trim();
@@ -13041,7 +13822,7 @@ function localeLabel(locale) {
 async function synchronizeTelegramCommands(api, chatId, desired, options) {
   if (!/^\d{1,20}$/.test(options.botId)) throw new Error("Telegram bot identity is invalid");
   assertTelegramCommandBoundary(desired);
-  const chatKey = createHash6("sha256").update(String(chatId)).digest("hex").slice(0, 16);
+  const chatKey = createHash8("sha256").update(String(chatId)).digest("hex").slice(0, 16);
   const scopes = [
     { name: "default", scope: { type: "default" }, ledgerName: "default" },
     { name: "chat", scope: { type: "chat", chat_id: chatId }, ledgerName: `chat:${chatKey}` },
@@ -13940,12 +14721,12 @@ ${p}` : p;
             return await fn();
           } catch (err) {
             if (attempt === maxRetries) throw err;
-            const delay = baseDelayMs * Math.pow(2, attempt - 1);
+            const delay2 = baseDelayMs * Math.pow(2, attempt - 1);
             log38.warn(
-              { err, attempt, maxRetries, delayMs: delay, operation: label },
-              `${label} failed, retrying in ${delay}ms`
+              { err, attempt, maxRetries, delayMs: delay2, operation: label },
+              `${label} failed, retrying in ${delay2}ms`
             );
-            await new Promise((r) => setTimeout(r, delay));
+            await new Promise((r) => setTimeout(r, delay2));
           }
         }
         throw new Error("unreachable");
@@ -14320,16 +15101,16 @@ System topics have been created. Tap${assistantTopicLink} to get started.`,
               );
             } catch (err) {
               log38.error({ err }, "Failed to complete initialization after prerequisites met \u2014 will retry");
-              const delay2 = schedule[Math.min(attempt, schedule.length - 1)];
+              const delay3 = schedule[Math.min(attempt, schedule.length - 1)];
               attempt++;
-              this._prerequisiteWatcher = setTimeout(retry, delay2);
+              this._prerequisiteWatcher = setTimeout(retry, delay3);
             }
             return;
           }
           log38.debug({ issues: result.issues }, "Prerequisites not yet met, retrying");
-          const delay = schedule[Math.min(attempt, schedule.length - 1)];
+          const delay2 = schedule[Math.min(attempt, schedule.length - 1)];
           attempt++;
-          this._prerequisiteWatcher = setTimeout(retry, delay);
+          this._prerequisiteWatcher = setTimeout(retry, delay2);
         };
         this._prerequisiteWatcher = setTimeout(retry, schedule[0]);
       }
@@ -19098,12 +19879,12 @@ var SessionBridge = class {
         break;
       case "image_content": {
         if (this.deps.fileService) {
-          const fs39 = this.deps.fileService;
+          const fs41 = this.deps.fileService;
           const sid = this.session.id;
           const { data, mimeType } = event;
           const buffer = Buffer.from(data, "base64");
-          const ext = fs39.extensionFromMime(mimeType);
-          fs39.saveFile(sid, `agent-image${ext}`, buffer, mimeType).then((att) => {
+          const ext = fs41.extensionFromMime(mimeType);
+          fs41.saveFile(sid, `agent-image${ext}`, buffer, mimeType).then((att) => {
             this.sendMessage(sid, {
               type: "attachment",
               text: "",
@@ -19115,12 +19896,12 @@ var SessionBridge = class {
       }
       case "audio_content": {
         if (this.deps.fileService) {
-          const fs39 = this.deps.fileService;
+          const fs41 = this.deps.fileService;
           const sid = this.session.id;
           const { data, mimeType } = event;
           const buffer = Buffer.from(data, "base64");
-          const ext = fs39.extensionFromMime(mimeType);
-          fs39.saveFile(sid, `agent-audio${ext}`, buffer, mimeType).then((att) => {
+          const ext = fs41.extensionFromMime(mimeType);
+          fs41.saveFile(sid, `agent-audio${ext}`, buffer, mimeType).then((att) => {
             this.sendMessage(sid, {
               type: "attachment",
               text: "",
@@ -22931,36 +23712,36 @@ init_doctor();
 init_config_registry();
 
 // src/core/config/config-editor.ts
-import * as path34 from "path";
+import * as path37 from "path";
 import * as clack2 from "@clack/prompts";
 
 // src/cli/autostart.ts
 init_log();
-import { execFileSync as execFileSync6 } from "child_process";
-import * as fs31 from "fs";
-import * as path29 from "path";
+import { execFileSync as execFileSync7 } from "child_process";
+import * as fs34 from "fs";
+import * as path33 from "path";
 import * as os9 from "os";
 var log20 = createChildLogger({ module: "autostart" });
-var LEGACY_LAUNCHD_PLIST_PATH = path29.join(os9.homedir(), "Library", "LaunchAgents", "com.openacp.daemon.plist");
-var LEGACY_SYSTEMD_SERVICE_PATH = path29.join(os9.homedir(), ".config", "systemd", "user", "openacp.service");
+var LEGACY_LAUNCHD_PLIST_PATH = path33.join(os9.homedir(), "Library", "LaunchAgents", "com.openacp.daemon.plist");
+var LEGACY_SYSTEMD_SERVICE_PATH = path33.join(os9.homedir(), ".config", "systemd", "user", "openacp.service");
 function getLaunchdLabel(instanceId) {
   return `com.openacp.daemon.${instanceId}`;
 }
 function getLaunchdPlistPath(instanceId) {
-  return path29.join(os9.homedir(), "Library", "LaunchAgents", `${getLaunchdLabel(instanceId)}.plist`);
+  return path33.join(os9.homedir(), "Library", "LaunchAgents", `${getLaunchdLabel(instanceId)}.plist`);
 }
 function getSystemdServiceName(instanceId) {
   return `openacp-${instanceId}`;
 }
 function getSystemdServicePath(instanceId) {
-  return path29.join(os9.homedir(), ".config", "systemd", "user", `${getSystemdServiceName(instanceId)}.service`);
+  return path33.join(os9.homedir(), ".config", "systemd", "user", `${getSystemdServiceName(instanceId)}.service`);
 }
 function getAutoStartState(instanceId) {
   if (process.platform === "linux") {
-    const installed = fs31.existsSync(getSystemdServicePath(instanceId));
+    const installed = fs34.existsSync(getSystemdServicePath(instanceId));
     if (!installed) return { installed: false, manager: null, active: false };
     try {
-      const output = execFileSync6("systemctl", [
+      const output = execFileSync7("systemctl", [
         "--user",
         "show",
         getSystemdServiceName(instanceId),
@@ -22979,11 +23760,11 @@ function getAutoStartState(instanceId) {
     }
   }
   if (process.platform === "darwin") {
-    const installed = fs31.existsSync(getLaunchdPlistPath(instanceId));
+    const installed = fs34.existsSync(getLaunchdPlistPath(instanceId));
     if (!installed) return { installed: false, manager: null, active: false };
     try {
       const uid = process.getuid();
-      const output = execFileSync6("launchctl", ["print", `gui/${uid}/${getLaunchdLabel(instanceId)}`], {
+      const output = execFileSync7("launchctl", ["print", `gui/${uid}/${getLaunchdLabel(instanceId)}`], {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -23009,7 +23790,7 @@ function escapeSystemdValue(str) {
 }
 function generateLaunchdPlist(nodePath, cliPath, logDir2, instanceRoot, instanceId) {
   const label = getLaunchdLabel(instanceId);
-  const logFile = path29.join(logDir2, "openacp.log");
+  const logFile = path33.join(logDir2, "openacp.log");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -23061,29 +23842,29 @@ WantedBy=default.target
 `;
 }
 function migrateLegacy() {
-  if (process.platform === "darwin" && fs31.existsSync(LEGACY_LAUNCHD_PLIST_PATH)) {
+  if (process.platform === "darwin" && fs34.existsSync(LEGACY_LAUNCHD_PLIST_PATH)) {
     try {
       const uid = process.getuid();
-      execFileSync6("launchctl", ["bootout", `gui/${uid}`, "com.openacp.daemon"], { stdio: "pipe" });
+      execFileSync7("launchctl", ["bootout", `gui/${uid}`, "com.openacp.daemon"], { stdio: "pipe" });
     } catch {
     }
     try {
-      fs31.unlinkSync(LEGACY_LAUNCHD_PLIST_PATH);
+      fs34.unlinkSync(LEGACY_LAUNCHD_PLIST_PATH);
     } catch {
     }
     log20.info("Removed legacy single-instance LaunchAgent");
   }
-  if (process.platform === "linux" && fs31.existsSync(LEGACY_SYSTEMD_SERVICE_PATH)) {
+  if (process.platform === "linux" && fs34.existsSync(LEGACY_SYSTEMD_SERVICE_PATH)) {
     try {
-      execFileSync6("systemctl", ["--user", "disable", "openacp"], { stdio: "pipe" });
+      execFileSync7("systemctl", ["--user", "disable", "openacp"], { stdio: "pipe" });
     } catch {
     }
     try {
-      fs31.unlinkSync(LEGACY_SYSTEMD_SERVICE_PATH);
+      fs34.unlinkSync(LEGACY_SYSTEMD_SERVICE_PATH);
     } catch {
     }
     try {
-      execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+      execFileSync7("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
     } catch {
     }
     log20.info("Removed legacy single-instance systemd service");
@@ -23094,50 +23875,50 @@ function installAutoStart(logDir2, instanceRoot, instanceId) {
     return { success: false, error: "Auto-start not supported on this platform" };
   }
   const nodePath = process.execPath;
-  const cliPath = path29.resolve(process.argv[1]);
-  const resolvedLogDir = logDir2.startsWith("~") ? path29.join(os9.homedir(), logDir2.slice(1)) : logDir2;
+  const cliPath = path33.resolve(process.argv[1]);
+  const resolvedLogDir = logDir2.startsWith("~") ? path33.join(os9.homedir(), logDir2.slice(1)) : logDir2;
   try {
     migrateLegacy();
     if (process.platform === "darwin") {
       const plistPath = getLaunchdPlistPath(instanceId);
       const plist = generateLaunchdPlist(nodePath, cliPath, resolvedLogDir, instanceRoot, instanceId);
-      const dir = path29.dirname(plistPath);
-      fs31.mkdirSync(dir, { recursive: true });
+      const dir = path33.dirname(plistPath);
+      fs34.mkdirSync(dir, { recursive: true });
       const uid = process.getuid();
       const domain = `gui/${uid}`;
-      const previous = fs31.existsSync(plistPath) ? fs31.readFileSync(plistPath, "utf8") : void 0;
+      const previous = fs34.existsSync(plistPath) ? fs34.readFileSync(plistPath, "utf8") : void 0;
       const previousState = getAutoStartState(instanceId);
       const tmp = `${plistPath}.${process.pid}.tmp`;
       let replaced = false;
       let bootedOut = false;
       try {
-        fs31.writeFileSync(tmp, plist, { mode: 384 });
-        execFileSync6("plutil", ["-lint", tmp], { stdio: "pipe" });
-        fs31.renameSync(tmp, plistPath);
+        fs34.writeFileSync(tmp, plist, { mode: 384 });
+        execFileSync7("plutil", ["-lint", tmp], { stdio: "pipe" });
+        fs34.renameSync(tmp, plistPath);
         replaced = true;
         if (previousState.active) {
-          execFileSync6("launchctl", ["bootout", domain, plistPath], { stdio: "pipe" });
+          execFileSync7("launchctl", ["bootout", domain, plistPath], { stdio: "pipe" });
           bootedOut = true;
         }
-        execFileSync6("launchctl", ["bootstrap", domain, plistPath], { stdio: "pipe" });
+        execFileSync7("launchctl", ["bootstrap", domain, plistPath], { stdio: "pipe" });
       } catch (error) {
         try {
-          fs31.rmSync(tmp, { force: true });
+          fs34.rmSync(tmp, { force: true });
         } catch {
         }
         if (replaced) {
           let rollbackBootedOut = false;
           try {
-            execFileSync6("launchctl", ["bootout", domain, plistPath], { stdio: "pipe" });
+            execFileSync7("launchctl", ["bootout", domain, plistPath], { stdio: "pipe" });
             rollbackBootedOut = true;
           } catch {
           }
-          if (previous === void 0) fs31.rmSync(plistPath, { force: true });
+          if (previous === void 0) fs34.rmSync(plistPath, { force: true });
           else {
             const rollbackTmp = `${plistPath}.${process.pid}.rollback.tmp`;
-            fs31.writeFileSync(rollbackTmp, previous, { mode: 384 });
-            fs31.renameSync(rollbackTmp, plistPath);
-            if (previousState.active || bootedOut || rollbackBootedOut) execFileSync6("launchctl", ["bootstrap", domain, plistPath], { stdio: "pipe" });
+            fs34.writeFileSync(rollbackTmp, previous, { mode: 384 });
+            fs34.renameSync(rollbackTmp, plistPath);
+            if (previousState.active || bootedOut || rollbackBootedOut) execFileSync7("launchctl", ["bootstrap", domain, plistPath], { stdio: "pipe" });
           }
         }
         throw error;
@@ -23149,20 +23930,20 @@ function installAutoStart(logDir2, instanceRoot, instanceId) {
       const servicePath = getSystemdServicePath(instanceId);
       const serviceName = getSystemdServiceName(instanceId);
       const unit = generateSystemdUnit(nodePath, cliPath, instanceRoot, instanceId);
-      const dir = path29.dirname(servicePath);
-      fs31.mkdirSync(dir, { recursive: true });
-      const previous = fs31.existsSync(servicePath) ? fs31.readFileSync(servicePath, "utf8") : void 0;
+      const dir = path33.dirname(servicePath);
+      fs34.mkdirSync(dir, { recursive: true });
+      const previous = fs34.existsSync(servicePath) ? fs34.readFileSync(servicePath, "utf8") : void 0;
       const tmp = `${servicePath}.${process.pid}.tmp`;
-      fs31.writeFileSync(tmp, unit, { mode: 384 });
-      fs31.renameSync(tmp, servicePath);
+      fs34.writeFileSync(tmp, unit, { mode: 384 });
+      fs34.renameSync(tmp, servicePath);
       try {
-        execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
-        execFileSync6("systemctl", ["--user", "enable", serviceName], { stdio: "pipe" });
+        execFileSync7("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+        execFileSync7("systemctl", ["--user", "enable", serviceName], { stdio: "pipe" });
       } catch (error) {
-        if (previous === void 0) fs31.unlinkSync(servicePath);
-        else fs31.writeFileSync(servicePath, previous);
+        if (previous === void 0) fs34.unlinkSync(servicePath);
+        else fs34.writeFileSync(servicePath, previous);
         try {
-          execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+          execFileSync7("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
         } catch {
         }
         throw error;
@@ -23184,13 +23965,13 @@ function uninstallAutoStart(instanceId) {
   try {
     if (process.platform === "darwin") {
       const plistPath = getLaunchdPlistPath(instanceId);
-      if (fs31.existsSync(plistPath)) {
+      if (fs34.existsSync(plistPath)) {
         const uid = process.getuid();
         try {
-          execFileSync6("launchctl", ["bootout", `gui/${uid}`, plistPath], { stdio: "pipe" });
+          execFileSync7("launchctl", ["bootout", `gui/${uid}`, plistPath], { stdio: "pipe" });
         } catch {
         }
-        fs31.unlinkSync(plistPath);
+        fs34.unlinkSync(plistPath);
         log20.info({ instanceId }, "LaunchAgent removed");
       }
       return { success: true };
@@ -23198,13 +23979,13 @@ function uninstallAutoStart(instanceId) {
     if (process.platform === "linux") {
       const servicePath = getSystemdServicePath(instanceId);
       const serviceName = getSystemdServiceName(instanceId);
-      if (fs31.existsSync(servicePath)) {
+      if (fs34.existsSync(servicePath)) {
         try {
-          execFileSync6("systemctl", ["--user", "disable", serviceName], { stdio: "pipe" });
+          execFileSync7("systemctl", ["--user", "disable", serviceName], { stdio: "pipe" });
         } catch {
         }
-        fs31.unlinkSync(servicePath);
-        execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+        fs34.unlinkSync(servicePath);
+        execFileSync7("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
         log20.info({ instanceId }, "systemd user service removed");
       }
       return { success: true };
@@ -23218,10 +23999,10 @@ function uninstallAutoStart(instanceId) {
 }
 function isAutoStartInstalled(instanceId) {
   if (process.platform === "darwin") {
-    return fs31.existsSync(getLaunchdPlistPath(instanceId));
+    return fs34.existsSync(getLaunchdPlistPath(instanceId));
   }
   if (process.platform === "linux") {
-    return fs31.existsSync(getSystemdServicePath(instanceId));
+    return fs34.existsSync(getSystemdServicePath(instanceId));
   }
   return false;
 }
@@ -23230,25 +24011,25 @@ function isAutoStartInstalled(instanceId) {
 init_instance_context();
 init_instance_registry();
 init_log();
-import fs33 from "fs";
-import path31 from "path";
+import fs35 from "fs";
+import path34 from "path";
 var log21 = createChildLogger({ module: "resolve-instance-id" });
 function resolveInstanceId(instanceRoot) {
   try {
-    const configPath = path31.join(instanceRoot, "config.json");
-    const raw = JSON.parse(fs33.readFileSync(configPath, "utf-8"));
+    const configPath = path34.join(instanceRoot, "config.json");
+    const raw = JSON.parse(fs35.readFileSync(configPath, "utf-8"));
     if (raw.id && typeof raw.id === "string") return raw.id;
   } catch {
   }
   try {
-    const reg = new InstanceRegistry(path31.join(getGlobalRoot(), "instances.json"));
+    const reg = new InstanceRegistry(path34.join(getGlobalRoot(), "instances.json"));
     reg.load();
     const entry = reg.getByRoot(instanceRoot);
     if (entry?.id) return entry.id;
   } catch (err) {
     log21.debug({ err: err.message, instanceRoot }, "Could not read instance registry, using fallback id");
   }
-  return path31.basename(path31.dirname(instanceRoot)).replace(/[^a-zA-Z0-9-]/g, "-") || "default";
+  return path34.basename(path34.dirname(instanceRoot)).replace(/[^a-zA-Z0-9-]/g, "-") || "default";
 }
 
 // src/core/config/config-editor.ts
@@ -23820,7 +24601,7 @@ async function runConfigEditor(configManager, mode = "file", apiPort, settingsMa
   await configManager.load();
   const config = configManager.get();
   const updates = {};
-  const instanceRoot = path34.dirname(configManager.getConfigPath());
+  const instanceRoot = path37.dirname(configManager.getConfigPath());
   console.log(`
 ${c.cyan}${c.bold}OpenACP Config Editor${c.reset}`);
   console.log(dim(`Config: ${configManager.getConfigPath()}`));
@@ -23877,17 +24658,17 @@ ${c.cyan}${c.bold}OpenACP Config Editor${c.reset}`);
 async function sendConfigViaApi(port, updates) {
   const { apiCall: call } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
   const paths = flattenToPaths(updates);
-  for (const { path: path39, value } of paths) {
+  for (const { path: path42, value } of paths) {
     const res = await call(port, "/api/config", {
       method: "PATCH",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ path: path39, value })
+      body: JSON.stringify({ path: path42, value })
     });
     const data = await res.json();
     if (!res.ok) {
-      console.log(warn(`Failed to update ${path39}: ${data.error}`));
+      console.log(warn(`Failed to update ${path42}: ${data.error}`));
     } else if (data.needsRestart) {
-      console.log(warn(`${path39} updated \u2014 restart required`));
+      console.log(warn(`${path42} updated \u2014 restart required`));
     }
   }
 }
@@ -23906,26 +24687,28 @@ function flattenToPaths(obj, prefix = "") {
 
 // src/cli/daemon.ts
 init_config();
+init_daemon_identity();
 import { spawn as spawn3 } from "child_process";
-import * as fs35 from "fs";
-import * as path35 from "path";
+import * as fs37 from "fs";
+import * as path38 from "path";
 function getPidPath(root) {
-  return path35.join(root, "openacp.pid");
+  return path38.join(root, "openacp.pid");
 }
 function getLogDir(root) {
-  return path35.join(root, "logs");
+  return path38.join(root, "logs");
 }
 function getRunningMarker(root) {
-  return path35.join(root, "running");
+  return path38.join(root, "running");
 }
 function writePidFile(pidPath, pid) {
-  const dir = path35.dirname(pidPath);
-  fs35.mkdirSync(dir, { recursive: true });
-  fs35.writeFileSync(pidPath, String(pid));
+  const dir = path38.dirname(pidPath);
+  fs37.mkdirSync(dir, { recursive: true });
+  fs37.writeFileSync(pidPath, String(pid));
+  writeDaemonIdentity(pidPath, pid);
 }
 function readPidFile(pidPath) {
   try {
-    const content = fs35.readFileSync(pidPath, "utf-8").trim();
+    const content = fs37.readFileSync(pidPath, "utf-8").trim();
     const pid = parseInt(content, 10);
     return isNaN(pid) ? null : pid;
   } catch {
@@ -23934,9 +24717,10 @@ function readPidFile(pidPath) {
 }
 function removePidFile(pidPath) {
   try {
-    fs35.unlinkSync(pidPath);
+    fs37.unlinkSync(pidPath);
   } catch {
   }
+  removeDaemonIdentity(pidPath);
 }
 function isProcessRunning(pidPath) {
   const pid = readPidFile(pidPath);
@@ -23967,12 +24751,12 @@ function startDaemon(pidPath, logDir2, instanceRoot) {
     return { error: `Already running (PID ${pid})` };
   }
   const resolvedLogDir = logDir2 ? expandHome2(logDir2) : getLogDir(instanceRoot);
-  fs35.mkdirSync(resolvedLogDir, { recursive: true });
-  const logFile = path35.join(resolvedLogDir, "openacp.log");
-  const cliPath = path35.resolve(process.argv[1]);
+  fs37.mkdirSync(resolvedLogDir, { recursive: true });
+  const logFile = path38.join(resolvedLogDir, "openacp.log");
+  const cliPath = path38.resolve(process.argv[1]);
   const nodePath = process.execPath;
-  const out = fs35.openSync(logFile, "a");
-  const err = fs35.openSync(logFile, "a");
+  const out = fs37.openSync(logFile, "a");
+  const err = fs37.openSync(logFile, "a");
   const child = spawn3(nodePath, [cliPath, "--daemon-child"], {
     detached: true,
     stdio: ["ignore", out, err],
@@ -23981,8 +24765,8 @@ function startDaemon(pidPath, logDir2, instanceRoot) {
       ...instanceRoot ? { OPENACP_INSTANCE_ROOT: instanceRoot } : {}
     }
   });
-  fs35.closeSync(out);
-  fs35.closeSync(err);
+  fs37.closeSync(out);
+  fs37.closeSync(err);
   if (!child.pid) {
     return { error: "Failed to spawn daemon process" };
   }
@@ -23993,7 +24777,7 @@ function startDaemon(pidPath, logDir2, instanceRoot) {
 function sleep2(ms) {
   return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
-function isProcessAlive2(pid) {
+function isProcessAlive3(pid) {
   try {
     process.kill(pid, 0);
     return "alive";
@@ -24006,7 +24790,7 @@ function isProcessAlive2(pid) {
 async function stopDaemon(pidPath, instanceRoot) {
   const pid = readPidFile(pidPath);
   if (pid === null) return { stopped: false, error: "Not running (no PID file)" };
-  const status = isProcessAlive2(pid);
+  const status = isProcessAlive3(pid);
   if (status === "dead") {
     removePidFile(pidPath);
     return { stopped: false, error: "Not running (stale PID file removed)" };
@@ -24026,7 +24810,7 @@ async function stopDaemon(pidPath, instanceRoot) {
   const start = Date.now();
   while (Date.now() - start < TIMEOUT) {
     await sleep2(POLL_INTERVAL);
-    const s = isProcessAlive2(pid);
+    const s = isProcessAlive3(pid);
     if (s === "dead" || s === "eperm") {
       removePidFile(pidPath);
       return { stopped: true, pid };
@@ -24043,7 +24827,7 @@ async function stopDaemon(pidPath, instanceRoot) {
   const killStart = Date.now();
   while (Date.now() - killStart < 1e3) {
     await sleep2(POLL_INTERVAL);
-    const s = isProcessAlive2(pid);
+    const s = isProcessAlive3(pid);
     if (s === "dead" || s === "eperm") {
       removePidFile(pidPath);
       return { stopped: true, pid };
@@ -24053,12 +24837,12 @@ async function stopDaemon(pidPath, instanceRoot) {
 }
 function markRunning(root) {
   const marker = getRunningMarker(root);
-  fs35.mkdirSync(path35.dirname(marker), { recursive: true });
-  fs35.writeFileSync(marker, "");
+  fs37.mkdirSync(path38.dirname(marker), { recursive: true });
+  fs37.writeFileSync(marker, "");
 }
 function clearRunning(root) {
   try {
-    fs35.unlinkSync(getRunningMarker(root));
+    fs37.unlinkSync(getRunningMarker(root));
   } catch {
   }
 }