@openacp/cli 2026.402.5 → 2026.403.1

package/dist/cli.js

@@ -1634,21 +1634,23 @@ var init_security_guard = __esm({
   "src/plugins/security/security-guard.ts"() {
     "use strict";
     SecurityGuard = class {
-      constructor(configManager, sessionManager) {
-        this.configManager = configManager;
+      constructor(getSecurityConfig, sessionManager) {
+        this.getSecurityConfig = getSecurityConfig;
         this.sessionManager = sessionManager;
       }
-      checkAccess(message) {
-        const config = this.configManager.get();
-        if (config.security.allowedUserIds.length > 0) {
+      async checkAccess(message) {
+        const config = await this.getSecurityConfig();
+        const allowedIds = config.allowedUserIds ?? [];
+        const maxSessions = config.maxConcurrentSessions ?? 20;
+        if (allowedIds.length > 0) {
           const userId = String(message.userId);
-          if (!config.security.allowedUserIds.includes(userId)) {
+          if (!allowedIds.includes(userId)) {
             return { allowed: false, reason: "Unauthorized user" };
           }
         }
         const active = this.sessionManager.listSessions().filter((s) => s.status === "active" || s.status === "initializing");
-        if (active.length >= config.security.maxConcurrentSessions) {
-          return { allowed: false, reason: `Session limit reached (${config.security.maxConcurrentSessions})` };
+        if (active.length >= maxSessions) {
+          return { allowed: false, reason: `Session limit reached (${maxSessions})` };
         }
         return { allowed: true };
       }
@@ -1668,7 +1670,7 @@ function createSecurityPlugin() {
     description: "User access control and session limits",
     essential: false,
     permissions: ["services:register", "middleware:register", "kernel:access", "commands:register"],
-    inheritableKeys: ["allowedUsers", "maxSessionsPerUser", "rateLimits"],
+    inheritableKeys: ["allowedUserIds", "maxConcurrentSessions", "sessionTimeoutMinutes"],
     async install(ctx) {
       const { settings, legacyConfig, terminal } = ctx;
       if (legacyConfig) {
@@ -1745,10 +1747,28 @@ function createSecurityPlugin() {
     },
     async setup(ctx) {
       const core = ctx.core;
-      const guard = new SecurityGuard(core.configManager, core.sessionManager);
+      const settingsManager = core.lifecycleManager?.settingsManager;
+      const pluginName = ctx.pluginName;
+      const getSecurityConfig = async () => {
+        if (settingsManager) {
+          const settings = await settingsManager.loadSettings(pluginName);
+          if (Object.keys(settings).length > 0) {
+            return {
+              allowedUserIds: settings.allowedUserIds ?? [],
+              maxConcurrentSessions: settings.maxConcurrentSessions ?? 20
+            };
+          }
+        }
+        const cfg = ctx.pluginConfig;
+        return {
+          allowedUserIds: cfg.allowedUserIds ?? [],
+          maxConcurrentSessions: cfg.maxConcurrentSessions ?? 20
+        };
+      };
+      const guard = new SecurityGuard(getSecurityConfig, core.sessionManager);
       ctx.registerMiddleware("message:incoming", {
         handler: async (payload, next) => {
-          const access2 = guard.checkAccess(payload);
+          const access2 = await guard.checkAccess(payload);
           if (!access2.allowed) {
             ctx.log.info(`Access denied: ${access2.reason}`);
             return null;
@@ -3869,7 +3889,7 @@ var init_speech = __esm({
       essential: false,
       optionalPluginDependencies: { "@openacp/file-service": "^1.0.0" },
       permissions: ["services:register", "commands:register", "kernel:access"],
-      inheritableKeys: ["tts"],
+      inheritableKeys: ["ttsProvider", "ttsVoice"],
       async install(ctx) {
         const { terminal, settings, legacyConfig } = ctx;
         const pluginsDir = ctx.instanceRoot ? path13.join(ctx.instanceRoot, "plugins") : void 0;
@@ -6826,6 +6846,289 @@ var init_token_store = __esm({
   }
 });
 
+// src/core/instance/instance-context.ts
+var instance_context_exports = {};
+__export(instance_context_exports, {
+  createInstanceContext: () => createInstanceContext,
+  generateSlug: () => generateSlug,
+  getGlobalRoot: () => getGlobalRoot,
+  resolveInstanceRoot: () => resolveInstanceRoot
+});
+import path21 from "path";
+import fs17 from "fs";
+import os10 from "os";
+function createInstanceContext(opts) {
+  const { id, root, isGlobal } = opts;
+  return {
+    id,
+    root,
+    isGlobal,
+    paths: {
+      config: path21.join(root, "config.json"),
+      sessions: path21.join(root, "sessions.json"),
+      agents: path21.join(root, "agents.json"),
+      registryCache: path21.join(root, "registry-cache.json"),
+      plugins: path21.join(root, "plugins"),
+      pluginsData: path21.join(root, "plugins", "data"),
+      pluginRegistry: path21.join(root, "plugins.json"),
+      logs: path21.join(root, "logs"),
+      pid: path21.join(root, "openacp.pid"),
+      running: path21.join(root, "running"),
+      apiPort: path21.join(root, "api.port"),
+      apiSecret: path21.join(root, "api-secret"),
+      bin: path21.join(root, "bin"),
+      cache: path21.join(root, "cache"),
+      tunnels: path21.join(root, "tunnels.json"),
+      agentsDir: path21.join(root, "agents")
+    }
+  };
+}
+function generateSlug(name) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return slug || "openacp";
+}
+function expandHome2(p2) {
+  if (p2.startsWith("~")) return path21.join(os10.homedir(), p2.slice(1));
+  return p2;
+}
+function resolveInstanceRoot(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (opts.dir) return path21.join(expandHome2(opts.dir), ".openacp");
+  if (opts.local) return path21.join(cwd, ".openacp");
+  if (opts.global) return path21.join(os10.homedir(), ".openacp");
+  const localRoot = path21.join(cwd, ".openacp");
+  if (fs17.existsSync(localRoot)) return localRoot;
+  if (process.env.OPENACP_INSTANCE_ROOT) return process.env.OPENACP_INSTANCE_ROOT;
+  return null;
+}
+function getGlobalRoot() {
+  return path21.join(os10.homedir(), ".openacp");
+}
+var init_instance_context = __esm({
+  "src/core/instance/instance-context.ts"() {
+    "use strict";
+  }
+});
+
+// src/core/config/config-registry.ts
+var config_registry_exports = {};
+__export(config_registry_exports, {
+  CONFIG_REGISTRY: () => CONFIG_REGISTRY,
+  ConfigValidationError: () => ConfigValidationError,
+  getConfigValue: () => getConfigValue,
+  getFieldDef: () => getFieldDef,
+  getFieldValueAsync: () => getFieldValueAsync,
+  getSafeFields: () => getSafeFields,
+  isHotReloadable: () => isHotReloadable,
+  resolveOptions: () => resolveOptions,
+  setFieldValueAsync: () => setFieldValueAsync
+});
+import * as fs18 from "fs";
+import * as path22 from "path";
+function getFieldDef(path68) {
+  return CONFIG_REGISTRY.find((f) => f.path === path68);
+}
+function getSafeFields() {
+  return CONFIG_REGISTRY.filter((f) => f.scope === "safe");
+}
+function isHotReloadable(path68) {
+  const def = getFieldDef(path68);
+  return def?.hotReload ?? false;
+}
+function resolveOptions(def, config) {
+  if (!def.options) return void 0;
+  return typeof def.options === "function" ? def.options(config) : def.options;
+}
+function getConfigValue(config, path68) {
+  const parts = path68.split(".");
+  let current = config;
+  for (const part of parts) {
+    if (current && typeof current === "object" && part in current) {
+      current = current[part];
+    } else {
+      return void 0;
+    }
+  }
+  return current;
+}
+async function getFieldValueAsync(field, configManager, settingsManager) {
+  if (field.plugin && settingsManager) {
+    const settings = await settingsManager.loadSettings(field.plugin.name);
+    return settings[field.plugin.key];
+  }
+  return getConfigValue(configManager.get(), field.path);
+}
+function validateFieldValue(field, value) {
+  switch (field.type) {
+    case "number":
+      if (typeof value !== "number" || Number.isNaN(value)) {
+        throw new ConfigValidationError(`"${field.path}" expects a number, got ${typeof value}`);
+      }
+      break;
+    case "toggle":
+      if (typeof value !== "boolean") {
+        throw new ConfigValidationError(`"${field.path}" expects a boolean, got ${typeof value}`);
+      }
+      break;
+    case "string":
+      if (typeof value !== "string") {
+        throw new ConfigValidationError(`"${field.path}" expects a string, got ${typeof value}`);
+      }
+      break;
+    case "select": {
+      if (typeof value !== "string") {
+        throw new ConfigValidationError(`"${field.path}" expects a string, got ${typeof value}`);
+      }
+      break;
+    }
+  }
+}
+async function setFieldValueAsync(field, value, configManager, settingsManager) {
+  validateFieldValue(field, value);
+  if (field.plugin && settingsManager) {
+    await settingsManager.updatePluginSettings(field.plugin.name, {
+      [field.plugin.key]: value
+    });
+    if (configManager.emit) {
+      configManager.emit("config:changed", { path: field.path, value, oldValue: void 0 });
+    }
+    return { needsRestart: !field.hotReload };
+  }
+  await configManager.setPath(field.path, value);
+  return { needsRestart: !field.hotReload };
+}
+var CONFIG_REGISTRY, ConfigValidationError;
+var init_config_registry = __esm({
+  "src/core/config/config-registry.ts"() {
+    "use strict";
+    init_instance_context();
+    CONFIG_REGISTRY = [
+      {
+        path: "defaultAgent",
+        displayName: "Default Agent",
+        group: "agent",
+        type: "select",
+        options: (config) => {
+          try {
+            const agentsPath = path22.join(getGlobalRoot(), "agents.json");
+            if (fs18.existsSync(agentsPath)) {
+              const data = JSON.parse(fs18.readFileSync(agentsPath, "utf-8"));
+              return Object.keys(data.installed ?? {});
+            }
+          } catch {
+          }
+          return Object.keys(config.agents ?? {});
+        },
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "channels.telegram.outputMode",
+        displayName: "Telegram Output Mode",
+        group: "display",
+        type: "select",
+        options: ["low", "medium", "high"],
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "channels.discord.outputMode",
+        displayName: "Discord Output Mode",
+        group: "display",
+        type: "select",
+        options: ["low", "medium", "high"],
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "logging.level",
+        displayName: "Log Level",
+        group: "logging",
+        type: "select",
+        options: ["silent", "debug", "info", "warn", "error", "fatal"],
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "tunnel.enabled",
+        displayName: "Tunnel",
+        group: "tunnel",
+        type: "toggle",
+        scope: "safe",
+        hotReload: false,
+        plugin: { name: "@openacp/tunnel", key: "enabled" }
+      },
+      {
+        path: "security.maxConcurrentSessions",
+        displayName: "Max Concurrent Sessions",
+        group: "security",
+        type: "number",
+        scope: "safe",
+        hotReload: true,
+        plugin: { name: "@openacp/security", key: "maxConcurrentSessions" }
+      },
+      {
+        path: "security.sessionTimeoutMinutes",
+        displayName: "Session Timeout (min)",
+        group: "security",
+        type: "number",
+        scope: "safe",
+        hotReload: true,
+        plugin: { name: "@openacp/security", key: "sessionTimeoutMinutes" }
+      },
+      {
+        path: "workspace.baseDir",
+        displayName: "Workspace Directory",
+        group: "workspace",
+        type: "string",
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "sessionStore.ttlDays",
+        displayName: "Session Store TTL (days)",
+        group: "storage",
+        type: "number",
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "speech.stt.provider",
+        displayName: "Speech to Text",
+        group: "speech",
+        type: "select",
+        options: ["groq"],
+        scope: "safe",
+        hotReload: true,
+        plugin: { name: "@openacp/speech", key: "sttProvider" }
+      },
+      {
+        path: "speech.stt.apiKey",
+        displayName: "STT API Key",
+        group: "speech",
+        type: "string",
+        scope: "sensitive",
+        hotReload: true,
+        plugin: { name: "@openacp/speech", key: "groqApiKey" }
+      },
+      {
+        path: "agentSwitch.labelHistory",
+        displayName: "Label Agent in History",
+        group: "agent",
+        type: "toggle",
+        scope: "safe",
+        hotReload: true
+      }
+    ];
+    ConfigValidationError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ConfigValidationError";
+      }
+    };
+  }
+});
+
 // src/plugins/api-server/middleware/error-handler.ts
 var error_handler_exports = {};
 __export(error_handler_exports, {
@@ -6848,6 +7151,16 @@ function globalErrorHandler(error, _request, reply) {
     });
     return;
   }
+  if (error instanceof ConfigValidationError) {
+    reply.status(400).send({
+      error: {
+        code: "VALIDATION_ERROR",
+        message: error.message,
+        statusCode: 400
+      }
+    });
+    return;
+  }
   if (error instanceof BadRequestError) {
     reply.status(400).send({
       error: {
@@ -6900,6 +7213,7 @@ var NotFoundError, BadRequestError, ServiceUnavailableError, AuthError;
 var init_error_handler = __esm({
   "src/plugins/api-server/middleware/error-handler.ts"() {
     "use strict";
+    init_config_registry();
     NotFoundError = class extends Error {
       constructor(code, message) {
         super(message);
@@ -7204,7 +7518,7 @@ var init_sse_manager = __esm({
       handleRequest(req, res) {
         const parsedUrl = new URL(req.url || "", "http://localhost");
         const sessionFilter = parsedUrl.searchParams.get("sessionId");
-        console.log(`[sse] new connection from origin=${req.headers.origin ?? "none"} filter=${sessionFilter ?? "none"} total=${this.sseConnections.size + 1}`);
+        console.log(`[sse] +connection total=${this.sseConnections.size + 1}`);
         const origin = req.headers.origin;
         const corsHeaders = {
           "Content-Type": "text/event-stream",
@@ -7226,7 +7540,7 @@ var init_sse_manager = __esm({
         const cleanup = () => {
           this.sseConnections.delete(res);
           this.sseCleanupHandlers.delete(res);
-          console.log(`[sse] connection closed, remaining=${this.sseConnections.size}`);
+          console.log(`[sse] -connection remaining=${this.sseConnections.size}`);
         };
         this.sseCleanupHandlers.set(res, cleanup);
         req.on("close", cleanup);
@@ -7286,8 +7600,8 @@ var static_server_exports = {};
 __export(static_server_exports, {
   StaticServer: () => StaticServer
 });
-import * as fs17 from "fs";
-import * as path21 from "path";
+import * as fs19 from "fs";
+import * as path23 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var MIME_TYPES, StaticServer;
 var init_static_server = __esm({
@@ -7311,16 +7625,16 @@ var init_static_server = __esm({
         this.uiDir = uiDir;
         if (!this.uiDir) {
           const __filename = fileURLToPath2(import.meta.url);
-          const candidate = path21.resolve(path21.dirname(__filename), "../../ui/dist");
-          if (fs17.existsSync(path21.join(candidate, "index.html"))) {
+          const candidate = path23.resolve(path23.dirname(__filename), "../../ui/dist");
+          if (fs19.existsSync(path23.join(candidate, "index.html"))) {
             this.uiDir = candidate;
           }
           if (!this.uiDir) {
-            const publishCandidate = path21.resolve(
-              path21.dirname(__filename),
+            const publishCandidate = path23.resolve(
+              path23.dirname(__filename),
               "../ui"
             );
-            if (fs17.existsSync(path21.join(publishCandidate, "index.html"))) {
+            if (fs19.existsSync(path23.join(publishCandidate, "index.html"))) {
               this.uiDir = publishCandidate;
             }
           }
@@ -7332,12 +7646,12 @@ var init_static_server = __esm({
       serve(req, res) {
         if (!this.uiDir) return false;
         const urlPath = (req.url || "/").split("?")[0];
-        const safePath = path21.normalize(urlPath);
-        const filePath = path21.join(this.uiDir, safePath);
-        if (!filePath.startsWith(this.uiDir + path21.sep) && filePath !== this.uiDir)
+        const safePath = path23.normalize(urlPath);
+        const filePath = path23.join(this.uiDir, safePath);
+        if (!filePath.startsWith(this.uiDir + path23.sep) && filePath !== this.uiDir)
           return false;
-        if (fs17.existsSync(filePath) && fs17.statSync(filePath).isFile()) {
-          const ext = path21.extname(filePath);
+        if (fs19.existsSync(filePath) && fs19.statSync(filePath).isFile()) {
+          const ext = path23.extname(filePath);
           const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
           const isHashed = /\.[a-zA-Z0-9]{8,}\.(js|css)$/.test(filePath);
           const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "no-cache";
@@ -7345,16 +7659,16 @@ var init_static_server = __esm({
             "Content-Type": contentType,
             "Cache-Control": cacheControl
           });
-          fs17.createReadStream(filePath).pipe(res);
+          fs19.createReadStream(filePath).pipe(res);
           return true;
         }
-        const indexPath = path21.join(this.uiDir, "index.html");
-        if (fs17.existsSync(indexPath)) {
+        const indexPath = path23.join(this.uiDir, "index.html");
+        if (fs19.existsSync(indexPath)) {
           res.writeHead(200, {
             "Content-Type": "text/html; charset=utf-8",
             "Cache-Control": "no-cache"
           });
-          fs17.createReadStream(indexPath).pipe(res);
+          fs19.createReadStream(indexPath).pipe(res);
           return true;
         }
         return false;
@@ -7841,291 +8155,68 @@ var init_common = __esm({
       })
     });
   }
-});
-
-// src/core/agents/agent-registry.ts
-var agent_registry_exports = {};
-__export(agent_registry_exports, {
-  getAgentCapabilities: () => getAgentCapabilities
-});
-var init_agent_registry = __esm({
-  "src/core/agents/agent-registry.ts"() {
-    "use strict";
-    init_agent_dependencies();
-  }
-});
-
-// src/plugins/api-server/routes/agents.ts
-var agents_exports = {};
-__export(agents_exports, {
-  agentRoutes: () => agentRoutes
-});
-async function agentRoutes(app, deps) {
-  app.get("/", { preHandler: requireScopes("agents:read") }, async () => {
-    const agents = deps.core.agentManager.getAvailableAgents();
-    const defaultAgent = deps.core.configManager.get().defaultAgent;
-    const agentsWithCaps = agents.map((a) => ({
-      ...a,
-      capabilities: getAgentCapabilities(a.name)
-    }));
-    return { agents: agentsWithCaps, default: defaultAgent };
-  });
-  app.get("/:name", { preHandler: requireScopes("agents:read") }, async (request) => {
-    const { name } = NameParamSchema.parse(request.params);
-    const agent = deps.core.agentCatalog.getInstalledAgent(name);
-    if (!agent) {
-      throw new NotFoundError("AGENT_NOT_FOUND", `Agent "${name}" not found`);
-    }
-    return {
-      ...agent,
-      key: name,
-      capabilities: getAgentCapabilities(name)
-    };
-  });
-}
-var init_agents = __esm({
-  "src/plugins/api-server/routes/agents.ts"() {
-    "use strict";
-    init_common();
-    init_error_handler();
-    init_auth();
-    init_agent_registry();
-  }
-});
-
-// src/plugins/api-server/schemas/config.ts
-import { z as z3 } from "zod";
-var UpdateConfigBodySchema;
-var init_config = __esm({
-  "src/plugins/api-server/schemas/config.ts"() {
-    "use strict";
-    UpdateConfigBodySchema = z3.object({
-      path: z3.string().min(1),
-      value: z3.unknown()
-    });
-  }
-});
-
-// src/core/instance/instance-context.ts
-var instance_context_exports = {};
-__export(instance_context_exports, {
-  createInstanceContext: () => createInstanceContext,
-  generateSlug: () => generateSlug,
-  getGlobalRoot: () => getGlobalRoot,
-  resolveInstanceRoot: () => resolveInstanceRoot
-});
-import path22 from "path";
-import fs18 from "fs";
-import os10 from "os";
-function createInstanceContext(opts) {
-  const { id, root, isGlobal } = opts;
-  return {
-    id,
-    root,
-    isGlobal,
-    paths: {
-      config: path22.join(root, "config.json"),
-      sessions: path22.join(root, "sessions.json"),
-      agents: path22.join(root, "agents.json"),
-      registryCache: path22.join(root, "registry-cache.json"),
-      plugins: path22.join(root, "plugins"),
-      pluginsData: path22.join(root, "plugins", "data"),
-      pluginRegistry: path22.join(root, "plugins.json"),
-      logs: path22.join(root, "logs"),
-      pid: path22.join(root, "openacp.pid"),
-      running: path22.join(root, "running"),
-      apiPort: path22.join(root, "api.port"),
-      apiSecret: path22.join(root, "api-secret"),
-      bin: path22.join(root, "bin"),
-      cache: path22.join(root, "cache"),
-      tunnels: path22.join(root, "tunnels.json"),
-      agentsDir: path22.join(root, "agents")
-    }
-  };
-}
-function generateSlug(name) {
-  const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-  return slug || "openacp";
-}
-function expandHome2(p2) {
-  if (p2.startsWith("~")) return path22.join(os10.homedir(), p2.slice(1));
-  return p2;
-}
-function resolveInstanceRoot(opts) {
-  const cwd = opts.cwd ?? process.cwd();
-  if (opts.dir) return path22.join(expandHome2(opts.dir), ".openacp");
-  if (opts.local) return path22.join(cwd, ".openacp");
-  if (opts.global) return path22.join(os10.homedir(), ".openacp");
-  const localRoot = path22.join(cwd, ".openacp");
-  if (fs18.existsSync(localRoot)) return localRoot;
-  if (process.env.OPENACP_INSTANCE_ROOT) return process.env.OPENACP_INSTANCE_ROOT;
-  return null;
-}
-function getGlobalRoot() {
-  return path22.join(os10.homedir(), ".openacp");
-}
-var init_instance_context = __esm({
-  "src/core/instance/instance-context.ts"() {
-    "use strict";
-  }
-});
-
-// src/core/config/config-registry.ts
-var config_registry_exports = {};
-__export(config_registry_exports, {
-  CONFIG_REGISTRY: () => CONFIG_REGISTRY,
-  getConfigValue: () => getConfigValue,
-  getFieldDef: () => getFieldDef,
-  getSafeFields: () => getSafeFields,
-  isHotReloadable: () => isHotReloadable,
-  resolveOptions: () => resolveOptions
-});
-import * as fs19 from "fs";
-import * as path23 from "path";
-function getFieldDef(path67) {
-  return CONFIG_REGISTRY.find((f) => f.path === path67);
-}
-function getSafeFields() {
-  return CONFIG_REGISTRY.filter((f) => f.scope === "safe");
-}
-function isHotReloadable(path67) {
-  const def = getFieldDef(path67);
-  return def?.hotReload ?? false;
-}
-function resolveOptions(def, config) {
-  if (!def.options) return void 0;
-  return typeof def.options === "function" ? def.options(config) : def.options;
-}
-function getConfigValue(config, path67) {
-  const parts = path67.split(".");
-  let current = config;
-  for (const part of parts) {
-    if (current && typeof current === "object" && part in current) {
-      current = current[part];
-    } else {
-      return void 0;
-    }
-  }
-  return current;
-}
-var CONFIG_REGISTRY;
-var init_config_registry = __esm({
-  "src/core/config/config-registry.ts"() {
-    "use strict";
-    init_instance_context();
-    CONFIG_REGISTRY = [
-      {
-        path: "defaultAgent",
-        displayName: "Default Agent",
-        group: "agent",
-        type: "select",
-        options: (config) => {
-          try {
-            const agentsPath = path23.join(getGlobalRoot(), "agents.json");
-            if (fs19.existsSync(agentsPath)) {
-              const data = JSON.parse(fs19.readFileSync(agentsPath, "utf-8"));
-              return Object.keys(data.installed ?? {});
-            }
-          } catch {
-          }
-          return Object.keys(config.agents ?? {});
-        },
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "channels.telegram.outputMode",
-        displayName: "Telegram Output Mode",
-        group: "display",
-        type: "select",
-        options: ["low", "medium", "high"],
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "channels.discord.outputMode",
-        displayName: "Discord Output Mode",
-        group: "display",
-        type: "select",
-        options: ["low", "medium", "high"],
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "logging.level",
-        displayName: "Log Level",
-        group: "logging",
-        type: "select",
-        options: ["silent", "debug", "info", "warn", "error", "fatal"],
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "tunnel.enabled",
-        displayName: "Tunnel",
-        group: "tunnel",
-        type: "toggle",
-        scope: "safe",
-        hotReload: false
-      },
-      {
-        path: "security.maxConcurrentSessions",
-        displayName: "Max Concurrent Sessions",
-        group: "security",
-        type: "number",
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "security.sessionTimeoutMinutes",
-        displayName: "Session Timeout (min)",
-        group: "security",
-        type: "number",
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "workspace.baseDir",
-        displayName: "Workspace Directory",
-        group: "workspace",
-        type: "string",
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "sessionStore.ttlDays",
-        displayName: "Session Store TTL (days)",
-        group: "storage",
-        type: "number",
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "speech.stt.provider",
-        displayName: "Speech to Text",
-        group: "speech",
-        type: "select",
-        options: ["groq"],
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "speech.stt.apiKey",
-        displayName: "STT API Key",
-        group: "speech",
-        type: "string",
-        scope: "sensitive",
-        hotReload: true
-      },
-      {
-        path: "agentSwitch.labelHistory",
-        displayName: "Label Agent in History",
-        group: "agent",
-        type: "toggle",
-        scope: "safe",
-        hotReload: true
-      }
-    ];
+});
+
+// src/core/agents/agent-registry.ts
+var agent_registry_exports = {};
+__export(agent_registry_exports, {
+  getAgentCapabilities: () => getAgentCapabilities
+});
+var init_agent_registry = __esm({
+  "src/core/agents/agent-registry.ts"() {
+    "use strict";
+    init_agent_dependencies();
+  }
+});
+
+// src/plugins/api-server/routes/agents.ts
+var agents_exports = {};
+__export(agents_exports, {
+  agentRoutes: () => agentRoutes
+});
+async function agentRoutes(app, deps) {
+  app.get("/", { preHandler: requireScopes("agents:read") }, async () => {
+    const agents = deps.core.agentManager.getAvailableAgents();
+    const defaultAgent = deps.core.configManager.get().defaultAgent;
+    const agentsWithCaps = agents.map((a) => ({
+      ...a,
+      capabilities: getAgentCapabilities(a.name)
+    }));
+    return { agents: agentsWithCaps, default: defaultAgent };
+  });
+  app.get("/:name", { preHandler: requireScopes("agents:read") }, async (request) => {
+    const { name } = NameParamSchema.parse(request.params);
+    const agent = deps.core.agentCatalog.getInstalledAgent(name);
+    if (!agent) {
+      throw new NotFoundError("AGENT_NOT_FOUND", `Agent "${name}" not found`);
+    }
+    return {
+      ...agent,
+      key: name,
+      capabilities: getAgentCapabilities(name)
+    };
+  });
+}
+var init_agents = __esm({
+  "src/plugins/api-server/routes/agents.ts"() {
+    "use strict";
+    init_common();
+    init_error_handler();
+    init_auth();
+    init_agent_registry();
+  }
+});
+
+// src/plugins/api-server/schemas/config.ts
+import { z as z3 } from "zod";
+var UpdateConfigBodySchema;
+var init_config = __esm({
+  "src/plugins/api-server/schemas/config.ts"() {
+    "use strict";
+    UpdateConfigBodySchema = z3.object({
+      path: z3.string().min(1),
+      value: z3.unknown()
+    });
   }
 });
 
@@ -8533,6 +8624,26 @@ var init_config2 = __esm({
         fs21.mkdirSync(dir, { recursive: true });
         fs21.writeFileSync(this.configPath, JSON.stringify(config, null, 2));
       }
+      async applyEnvToPluginSettings(settingsManager) {
+        const pluginOverrides = [
+          { envVar: "OPENACP_TUNNEL_ENABLED", pluginName: "@openacp/tunnel", key: "enabled", transform: (v) => v === "true" },
+          { envVar: "OPENACP_TUNNEL_PORT", pluginName: "@openacp/tunnel", key: "port", transform: (v) => Number(v) },
+          { envVar: "OPENACP_TUNNEL_PROVIDER", pluginName: "@openacp/tunnel", key: "provider" },
+          { envVar: "OPENACP_API_PORT", pluginName: "@openacp/api-server", key: "port", transform: (v) => Number(v) },
+          { envVar: "OPENACP_SPEECH_STT_PROVIDER", pluginName: "@openacp/speech", key: "sttProvider" },
+          { envVar: "OPENACP_SPEECH_GROQ_API_KEY", pluginName: "@openacp/speech", key: "groqApiKey" },
+          { envVar: "OPENACP_TELEGRAM_BOT_TOKEN", pluginName: "@openacp/telegram", key: "botToken" },
+          { envVar: "OPENACP_TELEGRAM_CHAT_ID", pluginName: "@openacp/telegram", key: "chatId", transform: (v) => Number(v) }
+        ];
+        for (const { envVar, pluginName, key, transform } of pluginOverrides) {
+          const value = process.env[envVar];
+          if (value !== void 0) {
+            const resolved = transform ? transform(value) : value;
+            await settingsManager.updatePluginSettings(pluginName, { [key]: resolved });
+            log12.debug({ envVar, pluginName, key }, "Env var override applied to plugin settings");
+          }
+        }
+      }
       applyEnvOverrides(raw) {
         const overrides = [
           ["OPENACP_TELEGRAM_BOT_TOKEN", ["channels", "telegram", "botToken"]],
@@ -8645,18 +8756,19 @@ function redactDeep(obj) {
 }
 async function configRoutes(app, deps) {
   app.get("/editable", { preHandler: requireScopes("config:read") }, async () => {
-    const { getSafeFields: getSafeFields2, resolveOptions: resolveOptions2, getConfigValue: getConfigValue2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
+    const { getSafeFields: getSafeFields2, resolveOptions: resolveOptions2, getFieldValueAsync: getFieldValueAsync2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
     const config = deps.core.configManager.get();
+    const settingsManager = deps.core.settingsManager;
     const safeFields = getSafeFields2();
-    const fields = safeFields.map((def) => ({
+    const fields = await Promise.all(safeFields.map(async (def) => ({
       path: def.path,
       displayName: def.displayName,
       group: def.group,
       type: def.type,
       options: resolveOptions2(def, config),
-      value: getConfigValue2(config, def.path),
+      value: await getFieldValueAsync2(def, deps.core.configManager, settingsManager),
       hotReload: def.hotReload
-    }));
+    })));
     return { fields };
   });
   app.get("/schema", { preHandler: requireScopes("config:read") }, async () => {
@@ -8676,16 +8788,20 @@ async function configRoutes(app, deps) {
     if (configPath.split(".").some((p2) => BLOCKED_KEYS.has(p2))) {
       return reply.status(400).send({ error: "Invalid config path" });
     }
-    const { getFieldDef: getFieldDef2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
+    const { getFieldDef: getFieldDef2, setFieldValueAsync: setFieldValueAsync2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
     const fieldDef = getFieldDef2(configPath);
     if (!fieldDef || fieldDef.scope !== "safe") {
       return reply.status(403).send({
         error: "This config field cannot be modified via the API"
       });
     }
-    await deps.core.configManager.setPath(configPath, value);
-    const { isHotReloadable: isHotReloadable2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
-    const needsRestart = !isHotReloadable2(configPath);
+    const settingsManager = deps.core.settingsManager;
+    const { needsRestart } = await setFieldValueAsync2(
+      fieldDef,
+      value,
+      deps.core.configManager,
+      settingsManager
+    );
     return {
       ok: true,
       needsRestart,
@@ -9196,13 +9312,152 @@ var init_workspace = __esm({
   }
 });
 
+// src/plugins/api-server/routes/plugins.ts
+var plugins_exports = {};
+__export(plugins_exports, {
+  pluginRoutes: () => pluginRoutes
+});
+import path26 from "path";
+import os12 from "os";
+async function pluginRoutes(app, deps) {
+  const { lifecycleManager } = deps;
+  const admin = [requireScopes("system:admin")];
+  app.get("/", { preHandler: admin }, async () => {
+    if (!lifecycleManager?.registry) return { plugins: [] };
+    const registry = lifecycleManager.registry;
+    const loadedSet = new Set(lifecycleManager.loadedPlugins);
+    const failedSet = new Set(lifecycleManager.failedPlugins);
+    const loadOrderMap = new Map(lifecycleManager.plugins.map((p2) => [p2.name, p2]));
+    const coreMap = new Map(corePlugins.map((p2) => [p2.name, p2]));
+    const plugins = Array.from(registry.list().entries()).map(([name, entry]) => {
+      const def = loadOrderMap.get(name) ?? coreMap.get(name);
+      return {
+        name,
+        version: entry.version,
+        description: entry.description,
+        source: entry.source,
+        enabled: entry.enabled,
+        loaded: loadedSet.has(name),
+        failed: failedSet.has(name),
+        essential: def?.essential ?? false,
+        hasConfigure: typeof def?.configure === "function"
+      };
+    });
+    return { plugins };
+  });
+  app.get("/marketplace", { preHandler: admin }, async (_req, reply) => {
+    try {
+      const data = await registryClient.getRegistry();
+      const installedNames = new Set(
+        lifecycleManager?.registry ? Array.from(lifecycleManager.registry.list().keys()) : []
+      );
+      const plugins = data.plugins.map((p2) => ({
+        ...p2,
+        installed: installedNames.has(p2.name) || installedNames.has(p2.npm)
+      }));
+      return { plugins, categories: data.categories };
+    } catch {
+      return reply.status(503).send({ error: "Marketplace unavailable" });
+    }
+  });
+  app.post("/:name/enable", { preHandler: admin }, async (req, reply) => {
+    if (!lifecycleManager?.registry) {
+      return reply.status(503).send({ error: "Plugin manager unavailable" });
+    }
+    const name = req.params.name;
+    const registry = lifecycleManager.registry;
+    const entry = registry.get(name);
+    if (!entry) {
+      return reply.status(404).send({ error: `Plugin "${name}" not found` });
+    }
+    if (lifecycleManager.loadedPlugins.includes(name)) {
+      registry.setEnabled(name, true);
+      await registry.save();
+      return { ok: true };
+    }
+    let pluginDef = lifecycleManager.plugins.find((p2) => p2.name === name);
+    if (!pluginDef) {
+      if (entry.source === "builtin") {
+        pluginDef = corePlugins.find((p2) => p2.name === name);
+      } else {
+        const { importFromDir: importFromDir2 } = await Promise.resolve().then(() => (init_plugin_installer(), plugin_installer_exports));
+        const instanceRoot = lifecycleManager.instanceRoot ?? path26.join(os12.homedir(), ".openacp");
+        const pluginsDir = path26.join(instanceRoot, "plugins");
+        try {
+          const mod = await importFromDir2(name, pluginsDir);
+          pluginDef = mod.default ?? mod;
+        } catch {
+          return reply.status(500).send({ error: "Plugin module could not be loaded. Try restarting the server." });
+        }
+      }
+    }
+    if (!pluginDef) {
+      return reply.status(500).send({ error: `Plugin definition not found for "${name}"` });
+    }
+    registry.setEnabled(name, true);
+    await registry.save();
+    await lifecycleManager.boot([pluginDef]);
+    if (lifecycleManager.failedPlugins.includes(name)) {
+      return reply.status(500).send({ error: `Plugin "${name}" failed to start` });
+    }
+    return { ok: true };
+  });
+  app.post("/:name/disable", { preHandler: admin }, async (req, reply) => {
+    if (!lifecycleManager?.registry) {
+      return reply.status(503).send({ error: "Plugin manager unavailable" });
+    }
+    const name = req.params.name;
+    const registry = lifecycleManager.registry;
+    const entry = registry.get(name);
+    if (!entry) {
+      return reply.status(404).send({ error: `Plugin "${name}" not found` });
+    }
+    const def = lifecycleManager.plugins.find((p2) => p2.name === name) ?? corePlugins.find((p2) => p2.name === name);
+    if (def?.essential) {
+      return reply.status(409).send({ error: "Essential plugins cannot be disabled" });
+    }
+    await lifecycleManager.unloadPlugin(name);
+    registry.setEnabled(name, false);
+    await registry.save();
+    return { ok: true };
+  });
+  app.delete("/:name", { preHandler: admin }, async (req, reply) => {
+    if (!lifecycleManager?.registry) {
+      return reply.status(503).send({ error: "Plugin manager unavailable" });
+    }
+    const name = req.params.name;
+    const registry = lifecycleManager.registry;
+    const entry = registry.get(name);
+    if (!entry) {
+      return reply.status(404).send({ error: `Plugin "${name}" not found` });
+    }
+    if (entry.source === "builtin") {
+      return reply.status(400).send({ error: "Builtin plugins cannot be uninstalled. Use disable instead." });
+    }
+    await lifecycleManager.unloadPlugin(name);
+    registry.remove(name);
+    await registry.save();
+    return { ok: true };
+  });
+}
+var registryClient;
+var init_plugins = __esm({
+  "src/plugins/api-server/routes/plugins.ts"() {
+    "use strict";
+    init_auth();
+    init_core_plugins();
+    init_registry_client();
+    registryClient = new RegistryClient();
+  }
+});
+
 // src/core/instance/instance-registry.ts
 var instance_registry_exports = {};
 __export(instance_registry_exports, {
   InstanceRegistry: () => InstanceRegistry
 });
 import fs22 from "fs";
-import path26 from "path";
+import path27 from "path";
 var InstanceRegistry;
 var init_instance_registry = __esm({
   "src/core/instance/instance-registry.ts"() {
@@ -9240,7 +9495,7 @@ var init_instance_registry = __esm({
         }
       }
       save() {
-        const dir = path26.dirname(this.registryPath);
+        const dir = path27.dirname(this.registryPath);
         fs22.mkdirSync(dir, { recursive: true });
         fs22.writeFileSync(this.registryPath, JSON.stringify(this.data, null, 2));
       }
@@ -9276,13 +9531,13 @@ __export(api_server_exports, {
 });
 import * as fs23 from "fs";
 import * as crypto2 from "crypto";
-import * as path27 from "path";
+import * as path28 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   try {
     const __filename = fileURLToPath3(import.meta.url);
-    const pkgPath = path27.resolve(path27.dirname(__filename), "../../../package.json");
+    const pkgPath = path28.resolve(path28.dirname(__filename), "../../../package.json");
     const pkg = JSON.parse(fs23.readFileSync(pkgPath, "utf-8"));
     cachedVersion = pkg.version ?? "0.0.0-dev";
   } catch {
@@ -9291,7 +9546,7 @@ function getVersion() {
   return cachedVersion;
 }
 function loadOrCreateSecret(secretFilePath) {
-  const dir = path27.dirname(secretFilePath);
+  const dir = path28.dirname(secretFilePath);
   fs23.mkdirSync(dir, { recursive: true });
   try {
     const existing = fs23.readFileSync(secretFilePath, "utf-8").trim();
@@ -9317,7 +9572,7 @@ function loadOrCreateSecret(secretFilePath) {
   return secret;
 }
 function writePortFile(portFilePath, port) {
-  const dir = path27.dirname(portFilePath);
+  const dir = path28.dirname(portFilePath);
   fs23.mkdirSync(dir, { recursive: true });
   fs23.writeFileSync(portFilePath, String(port));
 }
@@ -9409,10 +9664,10 @@ function createApiServerPlugin() {
         { port: apiConfig.port, host: apiConfig.host, instanceRoot },
         "API server plugin setup \u2014 config loaded"
       );
-      portFilePath = path27.join(instanceRoot, "api.port");
-      const secretFilePath = path27.join(instanceRoot, "api-secret");
-      const jwtSecretFilePath = path27.join(instanceRoot, "jwt-secret");
-      const tokensFilePath = path27.join(instanceRoot, "tokens.json");
+      portFilePath = path28.join(instanceRoot, "api.port");
+      const secretFilePath = path28.join(instanceRoot, "api-secret");
+      const jwtSecretFilePath = path28.join(instanceRoot, "jwt-secret");
+      const tokensFilePath = path28.join(instanceRoot, "tokens.json");
       const startedAt = Date.now();
       const secret = loadOrCreateSecret(secretFilePath);
       const jwtSecret = loadOrCreateSecret(jwtSecretFilePath);
@@ -9435,6 +9690,7 @@ function createApiServerPlugin() {
       const { commandRoutes: commandRoutes2 } = await Promise.resolve().then(() => (init_commands2(), commands_exports));
       const { authRoutes: authRoutes2 } = await Promise.resolve().then(() => (init_auth3(), auth_exports3));
       const { workspaceRoute: workspaceRoute2 } = await Promise.resolve().then(() => (init_workspace(), workspace_exports));
+      const { pluginRoutes: pluginRoutes2 } = await Promise.resolve().then(() => (init_plugins(), plugins_exports));
       server = await createApiServer2({
         port: apiConfig.port,
         host: apiConfig.host,
@@ -9453,7 +9709,8 @@ function createApiServerPlugin() {
         getVersion,
         commandRegistry,
         authPreHandler: routeAuthPreHandler,
-        contextManager
+        contextManager,
+        lifecycleManager: core.lifecycleManager
       };
       server.registerPlugin("/api/v1/sessions", async (app) => sessionRoutes2(app, deps));
       server.registerPlugin("/api/v1/agents", async (app) => agentRoutes2(app, deps));
@@ -9464,16 +9721,17 @@ function createApiServerPlugin() {
       server.registerPlugin("/api/v1/notify", async (app) => notifyRoutes2(app, deps));
       server.registerPlugin("/api/v1/commands", async (app) => commandRoutes2(app, deps));
       server.registerPlugin("/api/v1/auth", async (app) => authRoutes2(app, { tokenStore, getJwtSecret: () => jwtSecret }));
+      server.registerPlugin("/api/v1/plugins", async (app) => pluginRoutes2(app, deps));
       const { InstanceRegistry: InstanceRegistry2 } = await Promise.resolve().then(() => (init_instance_registry(), instance_registry_exports));
       const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
       const globalRoot = getGlobalRoot2();
-      const instanceReg = new InstanceRegistry2(path27.join(globalRoot, "instances.json"));
+      const instanceReg = new InstanceRegistry2(path28.join(globalRoot, "instances.json"));
       instanceReg.load();
       const instanceEntry = instanceReg.getByRoot(instanceRoot);
       const workspaceId = instanceEntry?.id ?? "main";
       const appConfig = core.configManager.get();
       const workspaceName = appConfig.instanceName ?? "Main";
-      const workspaceDir = path27.dirname(instanceRoot);
+      const workspaceDir = path28.dirname(instanceRoot);
       server.registerPlugin("/api/v1", async (app) => {
         await app.register(workspaceRoute2, {
           id: workspaceId,
@@ -10408,8 +10666,8 @@ function formatToolSummary(name, rawInput, displaySummary) {
   }
   if (lowerName === "grep") {
     const pattern = args2.pattern ?? "";
-    const path67 = args2.path ?? "";
-    return pattern ? `\u{1F50D} Grep "${pattern}"${path67 ? ` in ${path67}` : ""}` : `\u{1F527} ${name}`;
+    const path68 = args2.path ?? "";
+    return pattern ? `\u{1F50D} Grep "${pattern}"${path68 ? ` in ${path68}` : ""}` : `\u{1F527} ${name}`;
   }
   if (lowerName === "glob") {
     const pattern = args2.pattern ?? "";
@@ -10445,8 +10703,8 @@ function formatToolTitle(name, rawInput, displayTitle) {
   }
   if (lowerName === "grep") {
     const pattern = args2.pattern ?? "";
-    const path67 = args2.path ?? "";
-    return pattern ? `"${pattern}"${path67 ? ` in ${path67}` : ""}` : name;
+    const path68 = args2.path ?? "";
+    return pattern ? `"${pattern}"${path68 ? ` in ${path68}` : ""}` : name;
   }
   if (lowerName === "glob") {
     return String(args2.pattern ?? name);
@@ -12254,12 +12512,11 @@ var init_menu = __esm({
 
 // src/plugins/telegram/commands/settings.ts
 import { InlineKeyboard as InlineKeyboard6 } from "grammy";
-function buildSettingsKeyboard(core) {
-  const config = core.configManager.get();
+async function buildSettingsKeyboard(core) {
   const fields = getSafeFields();
   const kb = new InlineKeyboard6();
   for (const field of fields) {
-    const value = getConfigValue(config, field.path);
+    const value = await getFieldValueAsync(field, core.configManager, core.settingsManager);
     const label = formatFieldLabel(field, value);
     if (field.type === "toggle") {
       kb.text(`${label}`, `s:toggle:${field.path}`).row();
@@ -12290,7 +12547,7 @@ function formatFieldLabel(field, value) {
   return `${icon} ${field.displayName}: ${displayValue}`;
 }
 async function handleSettings(ctx, core) {
-  const kb = buildSettingsKeyboard(core);
+  const kb = await buildSettingsKeyboard(core);
   await ctx.reply(`<b>\u2699\uFE0F Settings</b>
 Tap to change:`, {
     parse_mode: "HTML",
@@ -12300,19 +12557,20 @@ Tap to change:`, {
 function setupSettingsCallbacks(bot, core, getAssistantSession) {
   bot.callbackQuery(/^s:toggle:/, async (ctx) => {
     const fieldPath = ctx.callbackQuery.data.replace("s:toggle:", "");
-    const config = core.configManager.get();
-    const currentValue = getConfigValue(config, fieldPath);
+    const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
+    if (!fieldDef) return;
+    const settingsManager = core.settingsManager;
+    const currentValue = await getFieldValueAsync(fieldDef, core.configManager, settingsManager);
     const newValue = !currentValue;
     try {
-      const updates = buildNestedUpdate(fieldPath, newValue);
-      await core.configManager.save(updates, fieldPath);
+      await setFieldValueAsync(fieldDef, newValue, core.configManager, settingsManager);
       const toast = isHotReloadable(fieldPath) ? `\u2705 ${fieldPath} = ${newValue}` : `\u2705 ${fieldPath} = ${newValue} (restart needed)`;
       try {
         await ctx.answerCallbackQuery({ text: toast });
       } catch {
       }
       try {
-        await ctx.editMessageReplyMarkup({ reply_markup: buildSettingsKeyboard(core) });
+        await ctx.editMessageReplyMarkup({ reply_markup: await buildSettingsKeyboard(core) });
       } catch {
       }
     } catch (err) {
@@ -12329,7 +12587,7 @@ function setupSettingsCallbacks(bot, core, getAssistantSession) {
     const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
     if (!fieldDef) return;
     const options = resolveOptions(fieldDef, config) ?? [];
-    const currentValue = getConfigValue(config, fieldPath);
+    const currentValue = await getFieldValueAsync(fieldDef, core.configManager, core.settingsManager);
     const kb = new InlineKeyboard6();
     for (const opt of options) {
       const marker = opt === String(currentValue) ? " \u2713" : "";
@@ -12353,11 +12611,21 @@ Select a value:`, {
     const parts = ctx.callbackQuery.data.replace("s:pick:", "").split(":");
     const fieldPath = parts.slice(0, -1).join(":");
     const newValue = parts[parts.length - 1];
+    const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
+    if (!fieldDef) return;
     try {
       if (fieldPath === "speech.stt.provider") {
-        const config = core.configManager.get();
-        const providerConfig = config.speech?.stt?.providers?.[newValue];
-        if (!providerConfig?.apiKey) {
+        const sm = core.settingsManager;
+        let hasApiKey = false;
+        if (sm) {
+          const speechSettings = await sm.loadSettings("@openacp/speech");
+          hasApiKey = !!speechSettings.groqApiKey;
+        } else {
+          const config = core.configManager.get();
+          const providerConfig = config.speech?.stt?.providers?.[newValue];
+          hasApiKey = !!providerConfig?.apiKey;
+        }
+        if (!hasApiKey) {
           const assistant = getAssistantSession();
           if (assistant) {
             try {
@@ -12375,8 +12643,7 @@ Select a value:`, {
           return;
         }
       }
-      const updates = buildNestedUpdate(fieldPath, newValue);
-      await core.configManager.save(updates, fieldPath);
+      await setFieldValueAsync(fieldDef, newValue, core.configManager, core.settingsManager);
       try {
         await ctx.answerCallbackQuery({ text: `\u2705 ${fieldPath} = ${newValue}` });
       } catch {
@@ -12385,7 +12652,7 @@ Select a value:`, {
         await ctx.editMessageText(`<b>\u2699\uFE0F Settings</b>
 Tap to change:`, {
           parse_mode: "HTML",
-          reply_markup: buildSettingsKeyboard(core)
+          reply_markup: await buildSettingsKeyboard(core)
         });
       } catch {
       }
@@ -12399,10 +12666,9 @@ Tap to change:`, {
   });
   bot.callbackQuery(/^s:input:/, async (ctx) => {
     const fieldPath = ctx.callbackQuery.data.replace("s:input:", "");
-    const config = core.configManager.get();
     const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
     if (!fieldDef) return;
-    const currentValue = getConfigValue(config, fieldPath);
+    const currentValue = await getFieldValueAsync(fieldDef, core.configManager, core.settingsManager);
     const assistant = getAssistantSession();
     if (!assistant) {
       try {
@@ -12443,23 +12709,12 @@ Choose an action:`, {
       await ctx.editMessageText(`<b>\u2699\uFE0F Settings</b>
 Tap to change:`, {
         parse_mode: "HTML",
-        reply_markup: buildSettingsKeyboard(core)
+        reply_markup: await buildSettingsKeyboard(core)
       });
     } catch {
     }
   });
 }
-function buildNestedUpdate(dotPath, value) {
-  const parts = dotPath.split(".");
-  const result = {};
-  let target = result;
-  for (let i = 0; i < parts.length - 1; i++) {
-    target[parts[i]] = {};
-    target = target[parts[i]];
-  }
-  target[parts[parts.length - 1]] = value;
-  return result;
-}
 var log18;
 var init_settings = __esm({
   "src/plugins/telegram/commands/settings.ts"() {
@@ -12534,7 +12789,7 @@ var init_config4 = __esm({
 // src/core/doctor/checks/agents.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import * as fs25 from "fs";
-import * as path28 from "path";
+import * as path29 from "path";
 function commandExists2(cmd) {
   try {
     execFileSync3("which", [cmd], { stdio: "pipe" });
@@ -12543,9 +12798,9 @@ function commandExists2(cmd) {
   }
   let dir = process.cwd();
   while (true) {
-    const binPath = path28.join(dir, "node_modules", ".bin", cmd);
+    const binPath = path29.join(dir, "node_modules", ".bin", cmd);
     if (fs25.existsSync(binPath)) return true;
-    const parent = path28.dirname(dir);
+    const parent = path29.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -12820,9 +13075,9 @@ var init_workspace2 = __esm({
 
 // src/core/doctor/checks/plugins.ts
 import * as fs28 from "fs";
-import * as path29 from "path";
+import * as path30 from "path";
 var pluginsCheck;
-var init_plugins = __esm({
+var init_plugins2 = __esm({
   "src/core/doctor/checks/plugins.ts"() {
     "use strict";
     pluginsCheck = {
@@ -12839,7 +13094,7 @@ var init_plugins = __esm({
             fix: async () => {
               fs28.mkdirSync(ctx.pluginsDir, { recursive: true });
               fs28.writeFileSync(
-                path29.join(ctx.pluginsDir, "package.json"),
+                path30.join(ctx.pluginsDir, "package.json"),
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
               return { success: true, message: "initialized plugins directory" };
@@ -12848,7 +13103,7 @@ var init_plugins = __esm({
           return results;
         }
         results.push({ status: "pass", message: "Plugins directory exists" });
-        const pkgPath = path29.join(ctx.pluginsDir, "package.json");
+        const pkgPath = path30.join(ctx.pluginsDir, "package.json");
         if (!fs28.existsSync(pkgPath)) {
           results.push({
             status: "warn",
@@ -12995,8 +13250,8 @@ var init_daemon = __esm({
 
 // src/core/doctor/checks/tunnel.ts
 import * as fs30 from "fs";
-import * as path30 from "path";
-import * as os12 from "os";
+import * as path31 from "path";
+import * as os13 from "os";
 import { execFileSync as execFileSync4 } from "child_process";
 var tunnelCheck;
 var init_tunnel3 = __esm({
@@ -13018,8 +13273,8 @@ var init_tunnel3 = __esm({
         const provider = ctx.config.tunnel.provider;
         results.push({ status: "pass", message: `Tunnel provider: ${provider}` });
         if (provider === "cloudflare") {
-          const binName = os12.platform() === "win32" ? "cloudflared.exe" : "cloudflared";
-          const binPath = path30.join(ctx.dataDir, "bin", binName);
+          const binName = os13.platform() === "win32" ? "cloudflared.exe" : "cloudflared";
+          const binPath = path31.join(ctx.dataDir, "bin", binName);
           let found = false;
           if (fs30.existsSync(binPath)) {
             found = true;
@@ -13068,7 +13323,7 @@ __export(doctor_exports, {
   DoctorEngine: () => DoctorEngine
 });
 import * as fs31 from "fs";
-import * as path31 from "path";
+import * as path32 from "path";
 var ALL_CHECKS, CHECK_TIMEOUT_MS, DoctorEngine;
 var init_doctor = __esm({
   "src/core/doctor/index.ts"() {
@@ -13080,7 +13335,7 @@ var init_doctor = __esm({
     init_telegram();
     init_storage();
     init_workspace2();
-    init_plugins();
+    init_plugins2();
     init_daemon();
     init_tunnel3();
     ALL_CHECKS = [
@@ -13150,7 +13405,7 @@ var init_doctor = __esm({
       }
       async buildContext() {
         const dataDir = this.dataDir;
-        const configPath = process.env.OPENACP_CONFIG_PATH || path31.join(dataDir, "config.json");
+        const configPath = process.env.OPENACP_CONFIG_PATH || path32.join(dataDir, "config.json");
         let config = null;
         let rawConfig = null;
         try {
@@ -13161,16 +13416,16 @@ var init_doctor = __esm({
           config = cm.get();
         } catch {
         }
-        const logsDir = config ? expandHome3(config.logging.logDir) : path31.join(dataDir, "logs");
+        const logsDir = config ? expandHome3(config.logging.logDir) : path32.join(dataDir, "logs");
         return {
           config,
           rawConfig,
           configPath,
           dataDir,
-          sessionsPath: path31.join(dataDir, "sessions.json"),
-          pidPath: path31.join(dataDir, "openacp.pid"),
-          portFilePath: path31.join(dataDir, "api.port"),
-          pluginsDir: path31.join(dataDir, "plugins"),
+          sessionsPath: path32.join(dataDir, "sessions.json"),
+          pidPath: path32.join(dataDir, "openacp.pid"),
+          portFilePath: path32.join(dataDir, "api.port"),
+          pluginsDir: path32.join(dataDir, "plugins"),
           logsDir
         };
       }
@@ -16913,7 +17168,7 @@ __export(settings_manager_exports, {
   SettingsManager: () => SettingsManager
 });
 import fs32 from "fs";
-import path32 from "path";
+import path33 from "path";
 var SettingsManager, SettingsAPIImpl;
 var init_settings_manager = __esm({
   "src/core/plugin/settings-manager.ts"() {
@@ -16950,7 +17205,7 @@ var init_settings_manager = __esm({
         };
       }
       getSettingsPath(pluginName) {
-        return path32.join(this.basePath, pluginName, "settings.json");
+        return path33.join(this.basePath, pluginName, "settings.json");
       }
       async getPluginSettings(pluginName) {
         return this.loadSettings(pluginName);
@@ -16978,7 +17233,7 @@ var init_settings_manager = __esm({
         }
       }
       writeFile(data) {
-        const dir = path32.dirname(this.settingsPath);
+        const dir = path33.dirname(this.settingsPath);
         fs32.mkdirSync(dir, { recursive: true });
         fs32.writeFileSync(this.settingsPath, JSON.stringify(data, null, 2));
         this.cache = data;
@@ -17077,10 +17332,10 @@ var install_context_exports = {};
 __export(install_context_exports, {
   createInstallContext: () => createInstallContext
 });
-import path33 from "path";
+import path34 from "path";
 function createInstallContext(opts) {
   const { pluginName, settingsManager, basePath, legacyConfig, instanceRoot } = opts;
-  const dataDir = path33.join(basePath, pluginName, "data");
+  const dataDir = path34.join(basePath, pluginName, "data");
   return {
     pluginName,
     terminal: createTerminalIO(),
@@ -17108,13 +17363,13 @@ __export(api_client_exports, {
   removeStalePortFile: () => removeStalePortFile
 });
 import * as fs33 from "fs";
-import * as path34 from "path";
-import * as os13 from "os";
+import * as path35 from "path";
+import * as os14 from "os";
 function defaultPortFile(root) {
-  return path34.join(root ?? DEFAULT_ROOT, "api.port");
+  return path35.join(root ?? DEFAULT_ROOT, "api.port");
 }
 function defaultSecretFile(root) {
-  return path34.join(root ?? DEFAULT_ROOT, "api-secret");
+  return path35.join(root ?? DEFAULT_ROOT, "api-secret");
 }
 function readApiPort(portFilePath, instanceRoot) {
   const filePath = portFilePath ?? defaultPortFile(instanceRoot);
@@ -17154,7 +17409,7 @@ var DEFAULT_ROOT;
 var init_api_client = __esm({
   "src/cli/api-client.ts"() {
     "use strict";
-    DEFAULT_ROOT = path34.join(os13.homedir(), ".openacp");
+    DEFAULT_ROOT = path35.join(os14.homedir(), ".openacp");
   }
 });
 
@@ -17202,16 +17457,16 @@ var init_suggest = __esm({
 
 // src/cli/instance-hint.ts
 import fs34 from "fs";
-import path35 from "path";
-import os14 from "os";
+import path36 from "path";
+import os15 from "os";
 function printInstanceHint(root) {
   const globalRoot = getGlobalRoot();
   const isGlobal = root === globalRoot;
-  const displayPath = root.replace(os14.homedir(), "~");
+  const displayPath = root.replace(os15.homedir(), "~");
   const label = isGlobal ? "global" : "local";
   console.log(`  Workspace: ${label} \u2014 ${displayPath}`);
   if (isGlobal) {
-    const localRoot = path35.join(process.cwd(), ".openacp");
+    const localRoot = path36.join(process.cwd(), ".openacp");
     if (fs34.existsSync(localRoot)) {
       console.log(`  \x1B[2mhint: local workspace exists in current directory \u2014 use --local to use it\x1B[0m`);
     }
@@ -17243,22 +17498,22 @@ __export(daemon_exports, {
 });
 import { spawn as spawn6 } from "child_process";
 import * as fs35 from "fs";
-import * as path36 from "path";
-import * as os15 from "os";
+import * as path37 from "path";
+import * as os16 from "os";
 function getPidPath(root) {
   const base = root ?? DEFAULT_ROOT2;
-  return path36.join(base, "openacp.pid");
+  return path37.join(base, "openacp.pid");
 }
 function getLogDir(root) {
   const base = root ?? DEFAULT_ROOT2;
-  return path36.join(base, "logs");
+  return path37.join(base, "logs");
 }
 function getRunningMarker(root) {
   const base = root ?? DEFAULT_ROOT2;
-  return path36.join(base, "running");
+  return path37.join(base, "running");
 }
 function writePidFile(pidPath, pid) {
-  const dir = path36.dirname(pidPath);
+  const dir = path37.dirname(pidPath);
   fs35.mkdirSync(dir, { recursive: true });
   fs35.writeFileSync(pidPath, String(pid));
 }
@@ -17307,8 +17562,8 @@ function startDaemon(pidPath = getPidPath(), logDir2, instanceRoot) {
   }
   const resolvedLogDir = logDir2 ? expandHome3(logDir2) : getLogDir(instanceRoot);
   fs35.mkdirSync(resolvedLogDir, { recursive: true });
-  const logFile = path36.join(resolvedLogDir, "openacp.log");
-  const cliPath = path36.resolve(process.argv[1]);
+  const logFile = path37.join(resolvedLogDir, "openacp.log");
+  const cliPath = path37.resolve(process.argv[1]);
   const nodePath = process.execPath;
   const out = fs35.openSync(logFile, "a");
   const err = fs35.openSync(logFile, "a");
@@ -17392,7 +17647,7 @@ async function stopDaemon(pidPath = getPidPath(), instanceRoot) {
 }
 function markRunning(root) {
   const marker = getRunningMarker(root);
-  fs35.mkdirSync(path36.dirname(marker), { recursive: true });
+  fs35.mkdirSync(path37.dirname(marker), { recursive: true });
   fs35.writeFileSync(marker, "");
 }
 function clearRunning(root) {
@@ -17409,7 +17664,7 @@ var init_daemon2 = __esm({
   "src/cli/daemon.ts"() {
     "use strict";
     init_config2();
-    DEFAULT_ROOT2 = path36.join(os15.homedir(), ".openacp");
+    DEFAULT_ROOT2 = path37.join(os16.homedir(), ".openacp");
   }
 });
 
@@ -17418,12 +17673,12 @@ var stop_exports = {};
 __export(stop_exports, {
   cmdStop: () => cmdStop
 });
-import path38 from "path";
-import os17 from "os";
+import path39 from "path";
+import os18 from "os";
 async function cmdStop(args2 = [], instanceRoot) {
   const json = isJsonMode(args2);
   if (json) await muteForJson();
-  const root = instanceRoot ?? path38.join(os17.homedir(), ".openacp");
+  const root = instanceRoot ?? path39.join(os18.homedir(), ".openacp");
   if (!json && wantsHelp(args2)) {
     console.log(`
 \x1B[1mopenacp stop\x1B[0m \u2014 Stop the background daemon
@@ -17765,7 +18020,7 @@ var init_mcp_manager = __esm({
 
 // src/core/utils/debug-tracer.ts
 import fs37 from "fs";
-import path39 from "path";
+import path40 from "path";
 function createDebugTracer(sessionId, workingDirectory) {
   if (!DEBUG_ENABLED) return null;
   return new DebugTracer(sessionId, workingDirectory);
@@ -17779,7 +18034,7 @@ var init_debug_tracer = __esm({
       constructor(sessionId, workingDirectory) {
         this.sessionId = sessionId;
         this.workingDirectory = workingDirectory;
-        this.logDir = path39.join(workingDirectory, ".log");
+        this.logDir = path40.join(workingDirectory, ".log");
       }
       dirCreated = false;
       logDir;
@@ -17789,7 +18044,7 @@ var init_debug_tracer = __esm({
             fs37.mkdirSync(this.logDir, { recursive: true });
             this.dirCreated = true;
           }
-          const filePath = path39.join(this.logDir, `${this.sessionId}_${layer}.jsonl`);
+          const filePath = path40.join(this.logDir, `${this.sessionId}_${layer}.jsonl`);
           const seen = /* @__PURE__ */ new WeakSet();
           const line = JSON.stringify({ ts: Date.now(), ...data }, (_key, value) => {
             if (typeof value === "object" && value !== null) {
@@ -17813,16 +18068,16 @@ var init_debug_tracer = __esm({
 import { spawn as spawn8, execFileSync as execFileSync5 } from "child_process";
 import { Transform } from "stream";
 import fs38 from "fs";
-import path40 from "path";
+import path41 from "path";
 import { ClientSideConnection, ndJsonStream } from "@agentclientprotocol/sdk";
 import { PROTOCOL_VERSION } from "@agentclientprotocol/sdk";
 function findPackageRoot(startDir) {
   let dir = startDir;
-  while (dir !== path40.dirname(dir)) {
-    if (fs38.existsSync(path40.join(dir, "package.json"))) {
+  while (dir !== path41.dirname(dir)) {
+    if (fs38.existsSync(path41.join(dir, "package.json"))) {
       return dir;
     }
-    dir = path40.dirname(dir);
+    dir = path41.dirname(dir);
   }
   return startDir;
 }
@@ -17834,8 +18089,8 @@ function resolveAgentCommand(cmd) {
   }
   for (const root of searchRoots) {
     const packageDirs = [
-      path40.resolve(root, "node_modules", "@zed-industries", cmd, "dist", "index.js"),
-      path40.resolve(root, "node_modules", cmd, "dist", "index.js")
+      path41.resolve(root, "node_modules", "@zed-industries", cmd, "dist", "index.js"),
+      path41.resolve(root, "node_modules", cmd, "dist", "index.js")
     ];
     for (const jsPath of packageDirs) {
       if (fs38.existsSync(jsPath)) {
@@ -17844,7 +18099,7 @@ function resolveAgentCommand(cmd) {
     }
   }
   for (const root of searchRoots) {
-    const localBin = path40.resolve(root, "node_modules", ".bin", cmd);
+    const localBin = path41.resolve(root, "node_modules", ".bin", cmd);
     if (fs38.existsSync(localBin)) {
       const content = fs38.readFileSync(localBin, "utf-8");
       if (content.startsWith("#!/usr/bin/env node")) {
@@ -17852,7 +18107,7 @@ function resolveAgentCommand(cmd) {
       }
       const match = content.match(/"([^"]+\.js)"/);
       if (match) {
-        const target = path40.resolve(path40.dirname(localBin), match[1]);
+        const target = path41.resolve(path41.dirname(localBin), match[1]);
         if (fs38.existsSync(target)) {
           return { command: process.execPath, args: [target] };
         }
@@ -18253,7 +18508,7 @@ ${stderr}`
               writePath = result.path;
               writeContent = result.content;
             }
-            await fs38.promises.mkdir(path40.dirname(writePath), { recursive: true });
+            await fs38.promises.mkdir(path41.dirname(writePath), { recursive: true });
             await fs38.promises.writeFile(writePath, writeContent, "utf-8");
             return {};
           },
@@ -19865,7 +20120,7 @@ var init_message_transformer = __esm({
 
 // src/core/sessions/session-store.ts
 import fs40 from "fs";
-import path41 from "path";
+import path42 from "path";
 var log30, DEBOUNCE_MS2, JsonFileSessionStore;
 var init_session_store = __esm({
   "src/core/sessions/session-store.ts"() {
@@ -19941,7 +20196,7 @@ var init_session_store = __esm({
           version: 1,
           sessions: Object.fromEntries(this.records)
         };
-        const dir = path41.dirname(this.filePath);
+        const dir = path42.dirname(this.filePath);
         if (!fs40.existsSync(dir)) fs40.mkdirSync(dir, { recursive: true });
         fs40.writeFileSync(this.filePath, JSON.stringify(data, null, 2));
       }
@@ -20516,8 +20771,8 @@ __export(agent_store_exports, {
   AgentStore: () => AgentStore
 });
 import * as fs41 from "fs";
-import * as path42 from "path";
-import * as os18 from "os";
+import * as path43 from "path";
+import * as os19 from "os";
 import { z as z7 } from "zod";
 var log33, InstalledAgentSchema, AgentStoreSchema, AgentStore;
 var init_agent_store = __esm({
@@ -20545,7 +20800,7 @@ var init_agent_store = __esm({
       data = { version: 1, installed: {} };
       filePath;
       constructor(filePath) {
-        this.filePath = filePath ?? path42.join(os18.homedir(), ".openacp", "agents.json");
+        this.filePath = filePath ?? path43.join(os19.homedir(), ".openacp", "agents.json");
       }
       load() {
         if (!fs41.existsSync(this.filePath)) {
@@ -20587,7 +20842,7 @@ var init_agent_store = __esm({
         return key in this.data.installed;
       }
       save() {
-        fs41.mkdirSync(path42.dirname(this.filePath), { recursive: true });
+        fs41.mkdirSync(path43.dirname(this.filePath), { recursive: true });
         const tmpPath = this.filePath + ".tmp";
         fs41.writeFileSync(tmpPath, JSON.stringify(this.data, null, 2));
         fs41.renameSync(tmpPath, this.filePath);
@@ -20598,8 +20853,8 @@ var init_agent_store = __esm({
 
 // src/core/agents/agent-installer.ts
 import * as fs42 from "fs";
-import * as path43 from "path";
-import * as os19 from "os";
+import * as path44 from "path";
+import * as os20 from "os";
 function getPlatformKey() {
   const platform2 = PLATFORM_MAP[process.platform] ?? process.platform;
   const arch = ARCH_MAP[process.arch] ?? process.arch;
@@ -20650,7 +20905,7 @@ function buildInstalledAgent(registryId, name, version, dist, binaryPath) {
       binaryPath: null
     };
   }
-  const absCmd = path43.resolve(binaryPath, dist.cmd);
+  const absCmd = path44.resolve(binaryPath, dist.cmd);
   return {
     registryId,
     name,
@@ -20723,7 +20978,7 @@ Install it with: pip install uv`;
   return { ok: true, agentKey, setupSteps: setup?.setupSteps };
 }
 async function downloadAndExtract(agentId, archiveUrl, progress, agentsDir) {
-  const destDir = path43.join(agentsDir ?? DEFAULT_AGENTS_DIR, agentId);
+  const destDir = path44.join(agentsDir ?? DEFAULT_AGENTS_DIR, agentId);
   fs42.mkdirSync(destDir, { recursive: true });
   await progress?.onStep("Downloading...");
   log34.info({ agentId, url: archiveUrl }, "Downloading agent binary");
@@ -20767,15 +21022,15 @@ function validateExtractedPaths(destDir) {
   for (const entry of entries) {
     const dirent = entry;
     const parentPath = dirent.parentPath ?? dirent.path ?? destDir;
-    const fullPath = path43.join(parentPath, entry.name);
+    const fullPath = path44.join(parentPath, entry.name);
     let realPath;
     try {
       realPath = fs42.realpathSync(fullPath);
     } catch {
       const linkTarget = fs42.readlinkSync(fullPath);
-      realPath = path43.resolve(path43.dirname(fullPath), linkTarget);
+      realPath = path44.resolve(path44.dirname(fullPath), linkTarget);
     }
-    if (!realPath.startsWith(realDest + path43.sep) && realPath !== realDest) {
+    if (!realPath.startsWith(realDest + path44.sep) && realPath !== realDest) {
       fs42.rmSync(destDir, { recursive: true, force: true });
       throw new Error(`Archive contains unsafe path: ${entry.name}`);
     }
@@ -20783,7 +21038,7 @@ function validateExtractedPaths(destDir) {
 }
 async function extractTarGz(buffer, destDir) {
   const { execFileSync: execFileSync8 } = await import("child_process");
-  const tmpFile = path43.join(destDir, "_archive.tar.gz");
+  const tmpFile = path44.join(destDir, "_archive.tar.gz");
   fs42.writeFileSync(tmpFile, buffer);
   try {
     execFileSync8("tar", ["xzf", tmpFile, "-C", destDir], { stdio: "pipe" });
@@ -20794,7 +21049,7 @@ async function extractTarGz(buffer, destDir) {
 }
 async function extractZip(buffer, destDir) {
   const { execFileSync: execFileSync8 } = await import("child_process");
-  const tmpFile = path43.join(destDir, "_archive.zip");
+  const tmpFile = path44.join(destDir, "_archive.zip");
   fs42.writeFileSync(tmpFile, buffer);
   try {
     execFileSync8("unzip", ["-o", tmpFile, "-d", destDir], { stdio: "pipe" });
@@ -20819,7 +21074,7 @@ var init_agent_installer = __esm({
     init_log();
     init_agent_dependencies();
     log34 = createChildLogger({ module: "agent-installer" });
-    DEFAULT_AGENTS_DIR = path43.join(os19.homedir(), ".openacp", "agents");
+    DEFAULT_AGENTS_DIR = path44.join(os20.homedir(), ".openacp", "agents");
     ARCH_MAP = {
       arm64: "aarch64",
       x64: "x86_64"
@@ -20838,8 +21093,8 @@ __export(agent_catalog_exports, {
   AgentCatalog: () => AgentCatalog
 });
 import * as fs43 from "fs";
-import * as path44 from "path";
-import * as os20 from "os";
+import * as path45 from "path";
+import * as os21 from "os";
 var log35, REGISTRY_URL2, DEFAULT_TTL_HOURS, AgentCatalog;
 var init_agent_catalog = __esm({
   "src/core/agents/agent-catalog.ts"() {
@@ -20858,7 +21113,7 @@ var init_agent_catalog = __esm({
       agentsDir;
       constructor(store, cachePath, agentsDir) {
         this.store = store ?? new AgentStore();
-        this.cachePath = cachePath ?? path44.join(os20.homedir(), ".openacp", "registry-cache.json");
+        this.cachePath = cachePath ?? path45.join(os21.homedir(), ".openacp", "registry-cache.json");
         this.agentsDir = agentsDir;
       }
       load() {
@@ -20879,7 +21134,7 @@ var init_agent_catalog = __esm({
             ttlHours: DEFAULT_TTL_HOURS,
             data
           };
-          fs43.mkdirSync(path44.dirname(this.cachePath), { recursive: true });
+          fs43.mkdirSync(path45.dirname(this.cachePath), { recursive: true });
           fs43.writeFileSync(this.cachePath, JSON.stringify(cache, null, 2));
           log35.info({ count: this.registryAgents.length }, "Registry updated");
         } catch (err) {
@@ -21065,9 +21320,9 @@ var init_agent_catalog = __esm({
         }
         try {
           const candidates = [
-            path44.join(import.meta.dirname, "data", "registry-snapshot.json"),
-            path44.join(import.meta.dirname, "..", "data", "registry-snapshot.json"),
-            path44.join(import.meta.dirname, "..", "..", "data", "registry-snapshot.json")
+            path45.join(import.meta.dirname, "data", "registry-snapshot.json"),
+            path45.join(import.meta.dirname, "..", "data", "registry-snapshot.json"),
+            path45.join(import.meta.dirname, "..", "..", "data", "registry-snapshot.json")
           ];
           for (const candidate of candidates) {
             if (fs43.existsSync(candidate)) {
@@ -21365,7 +21620,7 @@ var init_error_tracker = __esm({
 
 // src/core/plugin/plugin-storage.ts
 import fs44 from "fs";
-import path45 from "path";
+import path46 from "path";
 var PluginStorageImpl;
 var init_plugin_storage = __esm({
   "src/core/plugin/plugin-storage.ts"() {
@@ -21375,8 +21630,8 @@ var init_plugin_storage = __esm({
       dataDir;
       writeChain = Promise.resolve();
       constructor(baseDir) {
-        this.dataDir = path45.join(baseDir, "data");
-        this.kvPath = path45.join(baseDir, "kv.json");
+        this.dataDir = path46.join(baseDir, "data");
+        this.kvPath = path46.join(baseDir, "kv.json");
         fs44.mkdirSync(baseDir, { recursive: true });
       }
       readKv() {
@@ -21422,8 +21677,8 @@ var init_plugin_storage = __esm({
 });
 
 // src/core/plugin/plugin-context.ts
-import path46 from "path";
-import os21 from "os";
+import path47 from "path";
+import os22 from "os";
 function requirePermission(permissions, required, action) {
   if (!permissions.includes(required)) {
     throw new Error(`Plugin does not have '${required}' permission required for ${action}`);
@@ -21442,7 +21697,7 @@ function createPluginContext(opts) {
     config,
     core
   } = opts;
-  const instanceRoot = opts.instanceRoot ?? path46.join(os21.homedir(), ".openacp");
+  const instanceRoot = opts.instanceRoot ?? path47.join(os22.homedir(), ".openacp");
   const registeredListeners = [];
   const registeredCommands = [];
   const noopLog = {
@@ -21665,7 +21920,7 @@ var init_lifecycle_manager = __esm({
       log;
       settingsManager;
       pluginRegistry;
-      instanceRoot;
+      _instanceRoot;
       contexts = /* @__PURE__ */ new Map();
       loadOrder = [];
       _loaded = /* @__PURE__ */ new Set();
@@ -21679,6 +21934,14 @@ var init_lifecycle_manager = __esm({
       get registry() {
         return this.pluginRegistry;
       }
+      /** Plugin definitions currently in load order (loaded + failed). */
+      get plugins() {
+        return [...this.loadOrder];
+      }
+      /** Root directory of this OpenACP instance (e.g. ~/.openacp). */
+      get instanceRoot() {
+        return this._instanceRoot;
+      }
       constructor(opts) {
         this.serviceRegistry = opts?.serviceRegistry ?? new ServiceRegistry();
         this.middlewareChain = opts?.middlewareChain ?? new MiddlewareChain();
@@ -21698,7 +21961,7 @@ var init_lifecycle_manager = __esm({
         this.log = opts?.log;
         this.settingsManager = opts?.settingsManager;
         this.pluginRegistry = opts?.pluginRegistry;
-        this.instanceRoot = opts?.instanceRoot;
+        this._instanceRoot = opts?.instanceRoot;
       }
       getPluginLogger(pluginName) {
         if (this.log && typeof this.log.child === "function") {
@@ -21809,7 +22072,7 @@ var init_lifecycle_manager = __esm({
             config: this.config,
             core: this.core,
             log: this.log,
-            instanceRoot: this.instanceRoot
+            instanceRoot: this._instanceRoot
           });
           try {
             await withTimeout(plugin2.setup(ctx), SETUP_TIMEOUT_MS, `${plugin2.name}.setup()`);
@@ -22285,8 +22548,8 @@ var init_core_items = __esm({
 });
 
 // src/core/core.ts
-import path47 from "path";
-import os22 from "os";
+import path48 from "path";
+import os23 from "os";
 var log39, OpenACPCore;
 var init_core = __esm({
   "src/core/core.ts"() {
@@ -22354,6 +22617,9 @@ var init_core = __esm({
       get contextManager() {
         return this.getService("context");
       }
+      get settingsManager() {
+        return this.lifecycleManager.settingsManager;
+      }
       constructor(configManager, ctx) {
         this.configManager = configManager;
         this.instanceContext = ctx;
@@ -22365,7 +22631,7 @@ var init_core = __esm({
         );
         this.agentCatalog.load();
         this.agentManager = new AgentManager(this.agentCatalog);
-        const storePath = ctx?.paths.sessions ?? path47.join(os22.homedir(), ".openacp", "sessions.json");
+        const storePath = ctx?.paths.sessions ?? path48.join(os23.homedir(), ".openacp", "sessions.json");
         this.sessionStore = new JsonFileSessionStore(
           storePath,
           config.sessionStore.ttlDays
@@ -22389,7 +22655,7 @@ var init_core = __esm({
           sessions: this.sessionManager,
           config: this.configManager,
           core: this,
-          storagePath: ctx?.paths.pluginsData ?? path47.join(os22.homedir(), ".openacp", "plugins", "data"),
+          storagePath: ctx?.paths.pluginsData ?? path48.join(os23.homedir(), ".openacp", "plugins", "data"),
           instanceRoot: ctx?.root,
           log: createChildLogger({ module: "plugin" })
         });
@@ -22421,22 +22687,36 @@ var init_core = __esm({
               log39.info({ level: value }, "Log level changed at runtime");
             }
             if (configPath.startsWith("speech.")) {
-              const speechSvc = this.speechService;
+              const speechSvc = this.lifecycleManager.serviceRegistry.get("speech");
               if (speechSvc) {
-                const newConfig = this.configManager.get();
-                const newSpeechConfig = newConfig.speech ?? {
-                  stt: { provider: null, providers: {} },
-                  tts: { provider: null, providers: {} }
-                };
-                speechSvc.refreshProviders(newSpeechConfig);
-                log39.info("Speech service config updated at runtime");
+                const settingsMgr = this.settingsManager;
+                if (settingsMgr) {
+                  const pluginCfg = await settingsMgr.loadSettings("@openacp/speech");
+                  const groqApiKey = pluginCfg.groqApiKey;
+                  const sttProviders = {};
+                  if (groqApiKey) {
+                    sttProviders.groq = { apiKey: groqApiKey };
+                  }
+                  const newSpeechConfig = {
+                    stt: {
+                      provider: groqApiKey ? "groq" : null,
+                      providers: sttProviders
+                    },
+                    tts: {
+                      provider: pluginCfg.ttsProvider ?? null,
+                      providers: {}
+                    }
+                  };
+                  speechSvc.refreshProviders(newSpeechConfig);
+                  log39.info("Speech service config updated at runtime (from plugin settings)");
+                }
               }
             }
           }
         );
         registerCoreMenuItems(this.menuRegistry);
         if (ctx?.root) {
-          this.assistantRegistry.setInstanceRoot(path47.dirname(ctx.root));
+          this.assistantRegistry.setInstanceRoot(path48.dirname(ctx.root));
         }
         this.assistantRegistry.register(createSessionsSection(this));
         this.assistantRegistry.register(createAgentsSection(this));
@@ -22530,7 +22810,7 @@ var init_core = __esm({
           if (!result) return;
           message = result;
         }
-        const access2 = this.securityGuard.checkAccess(message);
+        const access2 = await this.securityGuard.checkAccess(message);
         if (!access2.allowed) {
           log39.warn({ userId: message.userId, reason: access2.reason }, "Access denied");
           if (access2.reason.includes("Session limit")) {
@@ -23993,8 +24273,8 @@ __export(autostart_exports, {
 });
 import { execFileSync as execFileSync7 } from "child_process";
 import * as fs45 from "fs";
-import * as path48 from "path";
-import * as os23 from "os";
+import * as path49 from "path";
+import * as os24 from "os";
 function isAutoStartSupported() {
   return process.platform === "darwin" || process.platform === "linux";
 }
@@ -24006,7 +24286,7 @@ function escapeSystemdValue(str) {
   return `"${escaped}"`;
 }
 function generateLaunchdPlist(nodePath, cliPath, logDir2) {
-  const logFile = path48.join(logDir2, "openacp.log");
+  const logFile = path49.join(logDir2, "openacp.log");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -24051,12 +24331,12 @@ function installAutoStart(logDir2) {
     return { success: false, error: "Auto-start not supported on this platform" };
   }
   const nodePath = process.execPath;
-  const cliPath = path48.resolve(process.argv[1]);
-  const resolvedLogDir = logDir2.startsWith("~") ? path48.join(os23.homedir(), logDir2.slice(1)) : logDir2;
+  const cliPath = path49.resolve(process.argv[1]);
+  const resolvedLogDir = logDir2.startsWith("~") ? path49.join(os24.homedir(), logDir2.slice(1)) : logDir2;
   try {
     if (process.platform === "darwin") {
       const plist = generateLaunchdPlist(nodePath, cliPath, resolvedLogDir);
-      const dir = path48.dirname(LAUNCHD_PLIST_PATH);
+      const dir = path49.dirname(LAUNCHD_PLIST_PATH);
       fs45.mkdirSync(dir, { recursive: true });
       fs45.writeFileSync(LAUNCHD_PLIST_PATH, plist);
       execFileSync7("launchctl", ["load", LAUNCHD_PLIST_PATH], { stdio: "pipe" });
@@ -24065,7 +24345,7 @@ function installAutoStart(logDir2) {
     }
     if (process.platform === "linux") {
       const unit = generateSystemdUnit(nodePath, cliPath);
-      const dir = path48.dirname(SYSTEMD_SERVICE_PATH);
+      const dir = path49.dirname(SYSTEMD_SERVICE_PATH);
       fs45.mkdirSync(dir, { recursive: true });
       fs45.writeFileSync(SYSTEMD_SERVICE_PATH, unit);
       execFileSync7("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
@@ -24131,8 +24411,8 @@ var init_autostart = __esm({
     init_log();
     log40 = createChildLogger({ module: "autostart" });
     LAUNCHD_LABEL = "com.openacp.daemon";
-    LAUNCHD_PLIST_PATH = path48.join(os23.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-    SYSTEMD_SERVICE_PATH = path48.join(os23.homedir(), ".config", "systemd", "user", "openacp.service");
+    LAUNCHD_PLIST_PATH = path49.join(os24.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    SYSTEMD_SERVICE_PATH = path49.join(os24.homedir(), ".config", "systemd", "user", "openacp.service");
   }
 });
 
@@ -24251,7 +24531,7 @@ var init_setup_integrations = __esm({
 });
 
 // src/core/setup/setup-channels.ts
-import * as path49 from "path";
+import * as path50 from "path";
 import * as clack7 from "@clack/prompts";
 function getChannelStatuses(config) {
   const statuses = [];
@@ -24317,7 +24597,7 @@ async function configureViaPlugin(channelId) {
   if (plugin2?.configure) {
     const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
     const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
-    const basePath = path49.join(getGlobalRoot(), "plugins", "data");
+    const basePath = path50.join(getGlobalRoot(), "plugins", "data");
     const settingsManager = new SettingsManager2(basePath);
     const ctx = createInstallContext2({
       pluginName: plugin2.name,
@@ -24399,55 +24679,70 @@ __export(instance_copy_exports, {
   copyInstance: () => copyInstance
 });
 import fs46 from "fs";
-import path50 from "path";
+import path51 from "path";
 async function copyInstance(src, dst, opts) {
   const { inheritableKeys = {}, onProgress } = opts;
   fs46.mkdirSync(dst, { recursive: true });
-  const configSrc = path50.join(src, "config.json");
+  const configSrc = path51.join(src, "config.json");
   if (fs46.existsSync(configSrc)) {
     onProgress?.("Configuration", "start");
     const config = JSON.parse(fs46.readFileSync(configSrc, "utf-8"));
     delete config.instanceName;
-    if (config.api) delete config.api.port;
-    if (config.tunnel) delete config.tunnel.port;
-    fs46.writeFileSync(path50.join(dst, "config.json"), JSON.stringify(config, null, 2));
+    delete config.security;
+    delete config.tunnel;
+    delete config.api;
+    delete config.speech;
+    delete config.usage;
+    if (config.channels && typeof config.channels === "object") {
+      const CORE_CHANNEL_KEYS = /* @__PURE__ */ new Set(["enabled", "outputMode", "adapter", "displayVerbosity"]);
+      for (const ch of Object.values(config.channels)) {
+        if (ch && typeof ch === "object") {
+          for (const key of Object.keys(ch)) {
+            if (!CORE_CHANNEL_KEYS.has(key)) {
+              delete ch[key];
+            }
+          }
+        }
+      }
+    }
+    fs46.writeFileSync(path51.join(dst, "config.json"), JSON.stringify(config, null, 2));
     onProgress?.("Configuration", "done");
   }
-  const pluginsSrc = path50.join(src, "plugins.json");
+  const pluginsSrc = path51.join(src, "plugins.json");
   if (fs46.existsSync(pluginsSrc)) {
     onProgress?.("Plugin list", "start");
-    fs46.copyFileSync(pluginsSrc, path50.join(dst, "plugins.json"));
+    fs46.copyFileSync(pluginsSrc, path51.join(dst, "plugins.json"));
     onProgress?.("Plugin list", "done");
   }
-  const pluginsDir = path50.join(src, "plugins");
+  const pluginsDir = path51.join(src, "plugins");
   if (fs46.existsSync(pluginsDir)) {
     onProgress?.("Plugins", "start");
-    const dstPlugins = path50.join(dst, "plugins");
+    const dstPlugins = path51.join(dst, "plugins");
     fs46.mkdirSync(dstPlugins, { recursive: true });
-    const pkgJson = path50.join(pluginsDir, "package.json");
-    if (fs46.existsSync(pkgJson)) fs46.copyFileSync(pkgJson, path50.join(dstPlugins, "package.json"));
-    const nodeModules = path50.join(pluginsDir, "node_modules");
-    if (fs46.existsSync(nodeModules)) fs46.cpSync(nodeModules, path50.join(dstPlugins, "node_modules"), { recursive: true });
+    const pkgJson = path51.join(pluginsDir, "package.json");
+    if (fs46.existsSync(pkgJson)) fs46.copyFileSync(pkgJson, path51.join(dstPlugins, "package.json"));
+    const nodeModules = path51.join(pluginsDir, "node_modules");
+    if (fs46.existsSync(nodeModules)) fs46.cpSync(nodeModules, path51.join(dstPlugins, "node_modules"), { recursive: true });
     onProgress?.("Plugins", "done");
   }
-  const agentsJson = path50.join(src, "agents.json");
+  const agentsJson = path51.join(src, "agents.json");
   if (fs46.existsSync(agentsJson)) {
     onProgress?.("Agents", "start");
-    fs46.copyFileSync(agentsJson, path50.join(dst, "agents.json"));
-    const agentsDir = path50.join(src, "agents");
-    if (fs46.existsSync(agentsDir)) fs46.cpSync(agentsDir, path50.join(dst, "agents"), { recursive: true });
+    fs46.copyFileSync(agentsJson, path51.join(dst, "agents.json"));
+    const agentsDir = path51.join(src, "agents");
+    if (fs46.existsSync(agentsDir)) fs46.cpSync(agentsDir, path51.join(dst, "agents"), { recursive: true });
     onProgress?.("Agents", "done");
   }
-  const binDir = path50.join(src, "bin");
+  const binDir = path51.join(src, "bin");
   if (fs46.existsSync(binDir)) {
     onProgress?.("Tools", "start");
-    fs46.cpSync(binDir, path50.join(dst, "bin"), { recursive: true });
+    fs46.cpSync(binDir, path51.join(dst, "bin"), { recursive: true });
     onProgress?.("Tools", "done");
   }
-  const pluginDataSrc = path50.join(src, "plugins", "data");
+  const pluginDataSrc = path51.join(src, "plugins", "data");
   if (fs46.existsSync(pluginDataSrc)) {
     onProgress?.("Preferences", "start");
-    copyPluginSettings(pluginDataSrc, path50.join(dst, "plugins", "data"), inheritableKeys);
+    copyPluginSettings(pluginDataSrc, path51.join(dst, "plugins", "data"), inheritableKeys);
     onProgress?.("Preferences", "done");
   }
 }
@@ -24462,10 +24757,10 @@ function copyPluginSettings(srcData, dstData, inheritableKeys) {
         if (key in settings) filtered[key] = settings[key];
       }
       if (Object.keys(filtered).length > 0) {
-        const relative = path50.relative(srcData, path50.dirname(settingsPath));
-        const dstDir = path50.join(dstData, relative);
+        const relative = path51.relative(srcData, path51.dirname(settingsPath));
+        const dstDir = path51.join(dstData, relative);
         fs46.mkdirSync(dstDir, { recursive: true });
-        fs46.writeFileSync(path50.join(dstDir, "settings.json"), JSON.stringify(filtered, null, 2));
+        fs46.writeFileSync(path51.join(dstDir, "settings.json"), JSON.stringify(filtered, null, 2));
       }
     } catch {
     }
@@ -24476,15 +24771,15 @@ function walkPluginDirs(base, cb) {
   for (const entry of fs46.readdirSync(base, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith("@")) {
-      const scopeDir = path50.join(base, entry.name);
+      const scopeDir = path51.join(base, entry.name);
       for (const sub of fs46.readdirSync(scopeDir, { withFileTypes: true })) {
         if (!sub.isDirectory()) continue;
         const pluginName = `${entry.name}/${sub.name}`;
-        const settingsPath = path50.join(scopeDir, sub.name, "settings.json");
+        const settingsPath = path51.join(scopeDir, sub.name, "settings.json");
         if (fs46.existsSync(settingsPath)) cb(pluginName, settingsPath);
       }
     } else {
-      const settingsPath = path50.join(base, entry.name, "settings.json");
+      const settingsPath = path51.join(base, entry.name, "settings.json");
       if (fs46.existsSync(settingsPath)) cb(entry.name, settingsPath);
     }
   }
@@ -24497,14 +24792,14 @@ var init_instance_copy = __esm({
 
 // src/core/setup/git-protect.ts
 import fs47 from "fs";
-import path51 from "path";
+import path52 from "path";
 function protectLocalInstance(projectDir) {
   ensureGitignore(projectDir);
   ensureClaudeMd(projectDir);
   printSecurityWarning();
 }
 function ensureGitignore(projectDir) {
-  const gitignorePath = path51.join(projectDir, ".gitignore");
+  const gitignorePath = path52.join(projectDir, ".gitignore");
   const entry = ".openacp";
   if (fs47.existsSync(gitignorePath)) {
     const content = fs47.readFileSync(gitignorePath, "utf-8");
@@ -24524,7 +24819,7 @@ ${entry}
   }
 }
 function ensureClaudeMd(projectDir) {
-  const claudeMdPath = path51.join(projectDir, "CLAUDE.md");
+  const claudeMdPath = path52.join(projectDir, "CLAUDE.md");
   const marker = "## Local OpenACP Workspace";
   if (fs47.existsSync(claudeMdPath)) {
     const content = fs47.readFileSync(claudeMdPath, "utf-8");
@@ -24567,9 +24862,9 @@ var init_git_protect = __esm({
 });
 
 // src/core/setup/wizard.ts
-import * as path52 from "path";
+import * as path53 from "path";
 import * as fs48 from "fs";
-import * as os24 from "os";
+import * as os25 from "os";
 import * as clack8 from "@clack/prompts";
 import { randomUUID as randomUUID2 } from "crypto";
 async function fetchCommunityAdapters() {
@@ -24591,7 +24886,7 @@ function checkDesktopAppInstalled() {
   const platform2 = process.platform;
   if (platform2 === "darwin") {
     candidates.push("/Applications/OpenACP.app");
-    candidates.push(`${os24.homedir()}/Applications/OpenACP.app`);
+    candidates.push(`${os25.homedir()}/Applications/OpenACP.app`);
   } else if (platform2 === "win32") {
     const localAppData = process.env["LOCALAPPDATA"] ?? "";
     candidates.push(`${localAppData}\\Programs\\OpenACP\\OpenACP.exe`);
@@ -24599,7 +24894,7 @@ function checkDesktopAppInstalled() {
   } else {
     candidates.push("/usr/bin/openacp-desktop");
     candidates.push("/usr/local/bin/openacp-desktop");
-    candidates.push(`${os24.homedir()}/.local/bin/openacp-desktop`);
+    candidates.push(`${os25.homedir()}/.local/bin/openacp-desktop`);
   }
   return candidates.some((p2) => fs48.existsSync(p2));
 }
@@ -24616,8 +24911,8 @@ async function runSetup(configManager, opts) {
     const isGlobal = instanceRoot === getGlobalRoot();
     let instanceName = opts?.instanceName;
     if (!instanceName) {
-      const defaultName = isGlobal ? "Global workspace" : path52.basename(path52.dirname(instanceRoot));
-      const locationHint = isGlobal ? "global (~/.openacp)" : `local (${instanceRoot.replace(/\/.openacp$/, "").replace(os24.homedir(), "~")})`;
+      const defaultName = isGlobal ? "Global workspace" : path53.basename(path53.dirname(instanceRoot));
+      const locationHint = isGlobal ? "global (~/.openacp)" : `local (${instanceRoot.replace(/\/.openacp$/, "").replace(os25.homedir(), "~")})`;
       const nameResult = await clack8.text({
         message: `Name for this workspace (${locationHint})`,
         initialValue: defaultName,
@@ -24627,13 +24922,13 @@ async function runSetup(configManager, opts) {
       instanceName = nameResult.trim();
     }
     const globalRoot = getGlobalRoot();
-    const registryPath = path52.join(globalRoot, "instances.json");
+    const registryPath = path53.join(globalRoot, "instances.json");
     const instanceRegistry = new InstanceRegistry(registryPath);
     await instanceRegistry.load();
     let didCopy = false;
     if (opts?.from) {
-      const fromRoot = path52.join(opts.from, ".openacp");
-      if (fs48.existsSync(path52.join(fromRoot, "config.json"))) {
+      const fromRoot = path53.join(opts.from, ".openacp");
+      if (fs48.existsSync(path53.join(fromRoot, "config.json"))) {
         const inheritableMap = buildInheritableKeysMap();
         await copyInstance(fromRoot, instanceRoot, { inheritableKeys: inheritableMap });
         didCopy = true;
@@ -24644,7 +24939,7 @@ async function runSetup(configManager, opts) {
     }
     if (!didCopy) {
       const existingInstances = instanceRegistry.list().filter(
-        (e) => fs48.existsSync(path52.join(e.root, "config.json")) && e.root !== instanceRoot
+        (e) => fs48.existsSync(path53.join(e.root, "config.json")) && e.root !== instanceRoot
       );
       if (existingInstances.length > 0) {
         let singleLabel;
@@ -24652,12 +24947,12 @@ async function runSetup(configManager, opts) {
           const e = existingInstances[0];
           let name = e.id;
           try {
-            const cfg = JSON.parse(fs48.readFileSync(path52.join(e.root, "config.json"), "utf-8"));
+            const cfg = JSON.parse(fs48.readFileSync(path53.join(e.root, "config.json"), "utf-8"));
             if (cfg.instanceName) name = cfg.instanceName;
           } catch {
           }
           const isGlobalEntry = e.root === getGlobalRoot();
-          const displayPath = e.root.replace(os24.homedir(), "~");
+          const displayPath = e.root.replace(os25.homedir(), "~");
           const type = isGlobalEntry ? "global" : "local";
           singleLabel = `${name} workspace (${type} \u2014 ${displayPath})`;
         }
@@ -24677,12 +24972,12 @@ async function runSetup(configManager, opts) {
               options: existingInstances.map((e) => {
                 let name = e.id;
                 try {
-                  const cfg = JSON.parse(fs48.readFileSync(path52.join(e.root, "config.json"), "utf-8"));
+                  const cfg = JSON.parse(fs48.readFileSync(path53.join(e.root, "config.json"), "utf-8"));
                   if (cfg.instanceName) name = cfg.instanceName;
                 } catch {
                 }
                 const isGlobalEntry = e.root === getGlobalRoot();
-                const displayPath = e.root.replace(os24.homedir(), "~");
+                const displayPath = e.root.replace(os25.homedir(), "~");
                 const type = isGlobalEntry ? "global" : "local";
                 return { value: e.root, label: `${name} workspace (${type} \u2014 ${displayPath})` };
               })
@@ -24774,9 +25069,9 @@ async function runSetup(configManager, opts) {
       if (channelId.startsWith("official:")) {
         const npmPackage = channelId.slice("official:".length);
         const { execFileSync: execFileSync8 } = await import("child_process");
-        const pluginsDir = path52.join(instanceRoot, "plugins");
-        const nodeModulesDir = path52.join(pluginsDir, "node_modules");
-        const installedPath = path52.join(nodeModulesDir, npmPackage);
+        const pluginsDir = path53.join(instanceRoot, "plugins");
+        const nodeModulesDir = path53.join(pluginsDir, "node_modules");
+        const installedPath = path53.join(nodeModulesDir, npmPackage);
         if (!fs48.existsSync(installedPath)) {
           try {
             clack8.log.step(`Installing ${npmPackage}...`);
@@ -24790,9 +25085,9 @@ async function runSetup(configManager, opts) {
           }
         }
         try {
-          const installedPkgPath = path52.join(nodeModulesDir, npmPackage, "package.json");
+          const installedPkgPath = path53.join(nodeModulesDir, npmPackage, "package.json");
           const installedPkg = JSON.parse(fs48.readFileSync(installedPkgPath, "utf-8"));
-          const pluginModule = await import(path52.join(nodeModulesDir, npmPackage, installedPkg.main ?? "dist/index.js"));
+          const pluginModule = await import(path53.join(nodeModulesDir, npmPackage, installedPkg.main ?? "dist/index.js"));
           const plugin2 = pluginModule.default;
           if (plugin2?.install) {
             const installCtx = createInstallContext2({
@@ -24822,8 +25117,8 @@ async function runSetup(configManager, opts) {
       if (channelId.startsWith("community:")) {
         const npmPackage = channelId.slice("community:".length);
         const { execFileSync: execFileSync8 } = await import("child_process");
-        const pluginsDir = path52.join(instanceRoot, "plugins");
-        const nodeModulesDir = path52.join(pluginsDir, "node_modules");
+        const pluginsDir = path53.join(instanceRoot, "plugins");
+        const nodeModulesDir = path53.join(pluginsDir, "node_modules");
         try {
           execFileSync8("npm", ["install", npmPackage, "--prefix", pluginsDir, "--save"], {
             stdio: "inherit",
@@ -24835,9 +25130,9 @@ async function runSetup(configManager, opts) {
         }
         try {
           const { readFileSync: readFileSync19 } = await import("fs");
-          const installedPkgPath = path52.join(nodeModulesDir, npmPackage, "package.json");
+          const installedPkgPath = path53.join(nodeModulesDir, npmPackage, "package.json");
           const installedPkg = JSON.parse(readFileSync19(installedPkgPath, "utf-8"));
-          const pluginModule = await import(path52.join(nodeModulesDir, npmPackage, installedPkg.main ?? "dist/index.js"));
+          const pluginModule = await import(path53.join(nodeModulesDir, npmPackage, installedPkg.main ?? "dist/index.js"));
           const plugin2 = pluginModule.default;
           if (plugin2?.install) {
             const installCtx = createInstallContext2({
@@ -24892,7 +25187,7 @@ async function runSetup(configManager, opts) {
       security,
       logging: {
         level: "info",
-        logDir: path52.join(instanceRoot, "logs"),
+        logDir: path53.join(instanceRoot, "logs"),
         maxFileSize: "10m",
         maxFiles: 7,
         sessionLogRetentionDays: 30
@@ -24944,9 +25239,9 @@ async function runSetup(configManager, opts) {
       instanceRegistry.register(id, instanceRoot);
       await instanceRegistry.save();
     }
-    const isLocal = instanceRoot !== path52.join(getGlobalRoot());
+    const isLocal = instanceRoot !== path53.join(getGlobalRoot());
     if (isLocal) {
-      const projectDir = path52.dirname(instanceRoot);
+      const projectDir = path53.dirname(instanceRoot);
       protectLocalInstance(projectDir);
     }
     clack8.outro(`Config saved to ${configManager.getConfigPath()}`);
@@ -25234,7 +25529,7 @@ __export(dev_loader_exports, {
   DevPluginLoader: () => DevPluginLoader
 });
 import fs49 from "fs";
-import path53 from "path";
+import path54 from "path";
 var loadCounter, DevPluginLoader;
 var init_dev_loader = __esm({
   "src/core/plugin/dev-loader.ts"() {
@@ -25243,11 +25538,11 @@ var init_dev_loader = __esm({
     DevPluginLoader = class {
       pluginPath;
       constructor(pluginPath) {
-        this.pluginPath = path53.resolve(pluginPath);
+        this.pluginPath = path54.resolve(pluginPath);
       }
       async load() {
-        const distIndex = path53.join(this.pluginPath, "dist", "index.js");
-        const srcIndex = path53.join(this.pluginPath, "src", "index.ts");
+        const distIndex = path54.join(this.pluginPath, "dist", "index.js");
+        const srcIndex = path54.join(this.pluginPath, "src", "index.ts");
         if (!fs49.existsSync(distIndex) && !fs49.existsSync(srcIndex)) {
           throw new Error(`Plugin not found at ${this.pluginPath}. Expected dist/index.js or src/index.ts`);
         }
@@ -25266,7 +25561,7 @@ var init_dev_loader = __esm({
         return this.pluginPath;
       }
       getDistPath() {
-        return path53.join(this.pluginPath, "dist");
+        return path54.join(this.pluginPath, "dist");
       }
     };
   }
@@ -25278,13 +25573,13 @@ __export(main_exports, {
   RESTART_EXIT_CODE: () => RESTART_EXIT_CODE,
   startServer: () => startServer
 });
-import path54 from "path";
+import path55 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 import fs50 from "fs";
 async function startServer(opts) {
   const globalRoot = getGlobalRoot();
   if (!opts?.instanceContext) {
-    const reg = new InstanceRegistry(path54.join(globalRoot, "instances.json"));
+    const reg = new InstanceRegistry(path55.join(globalRoot, "instances.json"));
     reg.load();
     const entry = reg.getByRoot(globalRoot);
     opts = { ...opts, instanceContext: createInstanceContext({ id: entry?.id ?? randomUUID3(), root: globalRoot, isGlobal: true }) };
@@ -25325,6 +25620,7 @@ async function startServer(opts) {
   const config = configManager.get();
   initLogger(config.logging);
   log.debug({ configPath: configManager.getConfigPath() }, "Config loaded");
+  await configManager.applyEnvToPluginSettings(settingsManager);
   if (pluginRegistry.list().size === 0) {
     await autoRegisterBuiltinPlugins(settingsManager, pluginRegistry, configManager);
   }
@@ -25368,22 +25664,22 @@ async function startServer(opts) {
         try {
           let modulePath;
           if (name.startsWith("/") || name.startsWith(".")) {
-            const resolved = path54.resolve(name);
-            const pkgPath = path54.join(resolved, "package.json");
+            const resolved = path55.resolve(name);
+            const pkgPath = path55.join(resolved, "package.json");
             const pkg = JSON.parse(await fs50.promises.readFile(pkgPath, "utf-8"));
-            modulePath = path54.join(resolved, pkg.main || "dist/index.js");
+            modulePath = path55.join(resolved, pkg.main || "dist/index.js");
           } else {
-            const nodeModulesDir = path54.join(ctx.paths.plugins, "node_modules");
-            let pkgDir = path54.join(nodeModulesDir, name);
-            if (!fs50.existsSync(path54.join(pkgDir, "package.json"))) {
+            const nodeModulesDir = path55.join(ctx.paths.plugins, "node_modules");
+            let pkgDir = path55.join(nodeModulesDir, name);
+            if (!fs50.existsSync(path55.join(pkgDir, "package.json"))) {
               let found = false;
               const scopes = fs50.existsSync(nodeModulesDir) ? fs50.readdirSync(nodeModulesDir).filter((d) => d.startsWith("@")) : [];
               for (const scope of scopes) {
-                const scopeDir = path54.join(nodeModulesDir, scope);
+                const scopeDir = path55.join(nodeModulesDir, scope);
                 const pkgs = fs50.readdirSync(scopeDir);
                 for (const pkg2 of pkgs) {
-                  const candidateDir = path54.join(scopeDir, pkg2);
-                  const candidatePkgPath = path54.join(candidateDir, "package.json");
+                  const candidateDir = path55.join(scopeDir, pkg2);
+                  const candidatePkgPath = path55.join(candidateDir, "package.json");
                   if (fs50.existsSync(candidatePkgPath)) {
                     try {
                       const candidatePkg = JSON.parse(fs50.readFileSync(candidatePkgPath, "utf-8"));
@@ -25400,9 +25696,9 @@ async function startServer(opts) {
                 if (found) break;
               }
             }
-            const pkgJsonPath = path54.join(pkgDir, "package.json");
+            const pkgJsonPath = path55.join(pkgDir, "package.json");
             const pkg = JSON.parse(await fs50.promises.readFile(pkgJsonPath, "utf-8"));
-            modulePath = path54.join(pkgDir, pkg.main || "dist/index.js");
+            modulePath = path55.join(pkgDir, pkg.main || "dist/index.js");
           }
           log.debug({ plugin: name, modulePath }, "Loading community plugin");
           const mod = await import(modulePath);
@@ -25565,7 +25861,7 @@ async function startServer(opts) {
   await core.start();
   try {
     const globalRoot2 = getGlobalRoot();
-    const registryPath = path54.join(globalRoot2, "instances.json");
+    const registryPath = path55.join(globalRoot2, "instances.json");
     const instanceReg = new InstanceRegistry(registryPath);
     await instanceReg.load();
     if (!instanceReg.getByRoot(ctx.root)) {
@@ -25728,13 +26024,13 @@ var restart_exports = {};
 __export(restart_exports, {
   cmdRestart: () => cmdRestart
 });
-import path55 from "path";
-import os25 from "os";
+import path56 from "path";
+import os26 from "os";
 import { randomUUID as randomUUID4 } from "crypto";
 async function cmdRestart(args2 = [], instanceRoot) {
   const json = isJsonMode(args2);
   if (json) await muteForJson();
-  const root = instanceRoot ?? path55.join(os25.homedir(), ".openacp");
+  const root = instanceRoot ?? path56.join(os26.homedir(), ".openacp");
   if (!json && wantsHelp(args2)) {
     console.log(`
 \x1B[1mopenacp restart\x1B[0m \u2014 Restart the background daemon
@@ -25782,7 +26078,7 @@ Stops the running daemon (if any) and starts a new one.
     printInstanceHint(root);
     console.log("Starting in foreground mode...");
     const { startServer: startServer2 } = await Promise.resolve().then(() => (init_main(), main_exports));
-    const reg = new InstanceRegistry(path55.join(getGlobalRoot(), "instances.json"));
+    const reg = new InstanceRegistry(path56.join(getGlobalRoot(), "instances.json"));
     reg.load();
     const existingEntry = reg.getByRoot(root);
     const ctx = createInstanceContext({
@@ -25798,7 +26094,7 @@ Stops the running daemon (if any) and starts a new one.
       console.error(result.error);
       process.exit(1);
     }
-    if (json) jsonSuccess({ pid: result.pid, instanceId: path55.basename(root), dir: root });
+    if (json) jsonSuccess({ pid: result.pid, instanceId: path56.basename(root), dir: root });
     printInstanceHint(root);
     console.log(`OpenACP daemon started (PID ${result.pid})`);
   }
@@ -25822,8 +26118,8 @@ __export(status_exports, {
   readInstanceInfo: () => readInstanceInfo
 });
 import fs51 from "fs";
-import path56 from "path";
-import os26 from "os";
+import path57 from "path";
+import os27 from "os";
 async function cmdStatus(args2 = [], instanceRoot) {
   const json = isJsonMode(args2);
   if (json) await muteForJson();
@@ -25840,7 +26136,7 @@ async function cmdStatus(args2 = [], instanceRoot) {
   await showSingleInstance(root, json);
 }
 async function showAllInstances(json = false) {
-  const registryPath = path56.join(getGlobalRoot(), "instances.json");
+  const registryPath = path57.join(getGlobalRoot(), "instances.json");
   const registry = new InstanceRegistry(registryPath);
   await registry.load();
   const instances = registry.list();
@@ -25875,7 +26171,7 @@ async function showAllInstances(json = false) {
     const mode = info.pid ? info.runMode === "daemon" ? "daemon" : "fg" : "\u2014";
     const api = info.apiPort ? String(info.apiPort) : "\u2014";
     const tunnel = info.tunnelPort ? String(info.tunnelPort) : "\u2014";
-    const dir = entry.root.replace(/\/.openacp$/, "").replace(os26.homedir(), "~");
+    const dir = entry.root.replace(/\/.openacp$/, "").replace(os27.homedir(), "~");
     const channels = info.channels.join(", ") || "\u2014";
     const name = info.name ?? entry.id;
     console.log(`  ${status.padEnd(10)} ${entry.id.padEnd(16)} ${name.padEnd(16)} ${dir.padEnd(20)} ${mode.padEnd(8)} ${channels.padEnd(10)} ${api.padEnd(6)} ${tunnel}`);
@@ -25883,7 +26179,7 @@ async function showAllInstances(json = false) {
   console.log("");
 }
 async function showInstanceById(id, json = false) {
-  const registryPath = path56.join(getGlobalRoot(), "instances.json");
+  const registryPath = path57.join(getGlobalRoot(), "instances.json");
   const registry = new InstanceRegistry(registryPath);
   await registry.load();
   const entry = registry.get(id);
@@ -25898,7 +26194,7 @@ async function showSingleInstance(root, json = false) {
   const info = readInstanceInfo(root);
   if (json) {
     jsonSuccess({
-      id: path56.basename(root),
+      id: path57.basename(root),
       name: info.name,
       status: info.pid ? "online" : "offline",
       pid: info.pid,
@@ -25929,13 +26225,13 @@ function readInstanceInfo(root) {
     channels: []
   };
   try {
-    const config = JSON.parse(fs51.readFileSync(path56.join(root, "config.json"), "utf-8"));
+    const config = JSON.parse(fs51.readFileSync(path57.join(root, "config.json"), "utf-8"));
     result.name = config.instanceName ?? null;
     result.runMode = config.runMode ?? null;
   } catch {
   }
   try {
-    const pid = parseInt(fs51.readFileSync(path56.join(root, "openacp.pid"), "utf-8").trim());
+    const pid = parseInt(fs51.readFileSync(path57.join(root, "openacp.pid"), "utf-8").trim());
     if (!isNaN(pid)) {
       process.kill(pid, 0);
       result.pid = pid;
@@ -25943,19 +26239,19 @@ function readInstanceInfo(root) {
   } catch {
   }
   try {
-    const port = parseInt(fs51.readFileSync(path56.join(root, "api.port"), "utf-8").trim());
+    const port = parseInt(fs51.readFileSync(path57.join(root, "api.port"), "utf-8").trim());
     if (!isNaN(port)) result.apiPort = port;
   } catch {
   }
   try {
-    const tunnels = JSON.parse(fs51.readFileSync(path56.join(root, "tunnels.json"), "utf-8"));
+    const tunnels = JSON.parse(fs51.readFileSync(path57.join(root, "tunnels.json"), "utf-8"));
     const entries = Object.values(tunnels);
     const systemEntry = entries.find((t) => t.type === "system");
     if (systemEntry?.port) result.tunnelPort = systemEntry.port;
   } catch {
   }
   try {
-    const plugins = JSON.parse(fs51.readFileSync(path56.join(root, "plugins.json"), "utf-8"));
+    const plugins = JSON.parse(fs51.readFileSync(path57.join(root, "plugins.json"), "utf-8"));
     const adapters = ["@openacp/telegram", "@openacp/discord", "@openacp/slack"];
     for (const name of adapters) {
       if (plugins.installed?.[name] && plugins.installed[name].enabled !== false) {
@@ -25970,7 +26266,7 @@ function formatInstanceStatus(root) {
   const info = readInstanceInfo(root);
   if (!info.pid) return null;
   const isGlobal = root === getGlobalRoot();
-  const displayPath = root.replace(os26.homedir(), "~");
+  const displayPath = root.replace(os27.homedir(), "~");
   const label = isGlobal ? "global" : "local";
   const lines = [];
   lines.push(`  PID:       ${info.pid}`);
@@ -26039,7 +26335,7 @@ var config_editor_exports = {};
 __export(config_editor_exports, {
   runConfigEditor: () => runConfigEditor
 });
-import * as path57 from "path";
+import * as path58 from "path";
 import * as clack9 from "@clack/prompts";
 async function select8(opts) {
   const result = await clack9.select({
@@ -26070,11 +26366,19 @@ async function input(opts) {
   }
   return result;
 }
-async function editTelegram(config, updates) {
+async function editTelegram(config, updates, settingsManager) {
   const tg = config.channels?.telegram ?? {};
-  const currentToken = tg.botToken ?? "";
-  const currentChatId = tg.chatId ?? 0;
-  const currentEnabled = tg.enabled ?? false;
+  let currentToken = tg.botToken ?? "";
+  let currentChatId = tg.chatId ?? 0;
+  let currentEnabled = tg.enabled ?? false;
+  if (settingsManager) {
+    const ps = await settingsManager.loadSettings("@openacp/telegram");
+    if (Object.keys(ps).length > 0) {
+      currentToken = ps.botToken ?? currentToken;
+      currentChatId = ps.chatId ?? currentChatId;
+      currentEnabled = ps.enabled ?? currentEnabled;
+    }
+  }
   console.log(header("Telegram"));
   console.log(`  Enabled   : ${currentEnabled ? ok2("yes") : dim2("no")}`);
   const tokenDisplay = currentToken.length > 12 ? currentToken.slice(0, 6) + "..." + currentToken.slice(-6) : currentToken || dim2("(not set)");
@@ -26089,7 +26393,11 @@ async function editTelegram(config, updates) {
     return updates.channels.telegram;
   };
   while (true) {
-    const isEnabled = (() => {
+    const isEnabled = await (async () => {
+      if (settingsManager) {
+        const ps = await settingsManager.loadSettings("@openacp/telegram");
+        if ("enabled" in ps) return ps.enabled;
+      }
       const ch = updates.channels;
       const tgUp = ch?.telegram;
       if (tgUp && "enabled" in tgUp) return tgUp.enabled;
@@ -26106,8 +26414,12 @@ async function editTelegram(config, updates) {
     });
     if (choice === "back") break;
     if (choice === "toggle") {
-      const tgUp = ensureTelegramUpdates();
-      tgUp.enabled = !isEnabled;
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/telegram", { enabled: !isEnabled });
+      } else {
+        const tgUp = ensureTelegramUpdates();
+        tgUp.enabled = !isEnabled;
+      }
       console.log(!isEnabled ? ok2("Telegram enabled") : ok2("Telegram disabled"));
     }
     if (choice === "token") {
@@ -26127,9 +26439,13 @@ async function editTelegram(config, updates) {
       } catch {
         console.log(warn2("Telegram validator not available \u2014 skipping validation"));
       }
-      const tgUp = ensureTelegramUpdates();
-      tgUp.botToken = token.trim();
-      tgUp.enabled = true;
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/telegram", { botToken: token.trim(), enabled: true });
+      } else {
+        const tgUp = ensureTelegramUpdates();
+        tgUp.botToken = token.trim();
+        tgUp.enabled = true;
+      }
     }
     if (choice === "chatid") {
       const chatIdStr = await input({
@@ -26144,8 +26460,8 @@ async function editTelegram(config, updates) {
       const chatId = Number(chatIdStr.trim());
       const tokenForValidation = (() => {
         const ch = updates.channels;
-        const tgUp2 = ch?.telegram;
-        if (typeof tgUp2?.botToken === "string") return tgUp2.botToken;
+        const tgUp = ch?.telegram;
+        if (typeof tgUp?.botToken === "string") return tgUp.botToken;
         return currentToken;
       })();
       try {
@@ -26159,8 +26475,12 @@ async function editTelegram(config, updates) {
       } catch {
         console.log(warn2("Telegram validator not available \u2014 skipping validation"));
       }
-      const tgUp = ensureTelegramUpdates();
-      tgUp.chatId = chatId;
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/telegram", { chatId });
+      } else {
+        const tgUp = ensureTelegramUpdates();
+        tgUp.chatId = chatId;
+      }
     }
   }
 }
@@ -26200,7 +26520,7 @@ async function editDiscord(_config, _updates) {
     const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
     const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
     const root = getGlobalRoot2();
-    const basePath = path57.join(root, "plugins");
+    const basePath = path58.join(root, "plugins");
     const settingsManager = new SettingsManager2(basePath);
     const ctx = createInstallContext2({
       pluginName: plugin2.name,
@@ -26213,7 +26533,7 @@ async function editDiscord(_config, _updates) {
     console.log(warn2("This plugin does not have a configure() method yet."));
   }
 }
-async function editChannels(config, updates) {
+async function editChannels(config, updates, settingsManager) {
   const tgEnabled = config.channels?.telegram?.enabled !== false && config.channels?.telegram;
   const dcEnabled = config.channels?.discord?.enabled !== false && config.channels?.discord;
   console.log(header("Channels"));
@@ -26230,7 +26550,7 @@ async function editChannels(config, updates) {
       ]
     });
     if (choice === "back") break;
-    if (choice === "telegram") await editTelegram(config, updates);
+    if (choice === "telegram") await editTelegram(config, updates, settingsManager);
     if (choice === "discord") await editDiscord(config, updates);
   }
 }
@@ -26277,8 +26597,18 @@ async function editWorkspace(config, updates) {
   updates.workspace = { baseDir: newDir.trim() };
   console.log(ok2(`Workspace set to ${newDir.trim()}`));
 }
-async function editSecurity(config, updates) {
-  const sec = config.security ?? { allowedUserIds: [], maxConcurrentSessions: 20, sessionTimeoutMinutes: 60 };
+async function editSecurity(config, updates, settingsManager) {
+  let sec = config.security ?? { allowedUserIds: [], maxConcurrentSessions: 20, sessionTimeoutMinutes: 60 };
+  if (settingsManager) {
+    const ps = await settingsManager.loadSettings("@openacp/security");
+    if (Object.keys(ps).length > 0) {
+      sec = {
+        allowedUserIds: ps.allowedUserIds ?? sec.allowedUserIds,
+        maxConcurrentSessions: ps.maxConcurrentSessions ?? sec.maxConcurrentSessions,
+        sessionTimeoutMinutes: ps.sessionTimeoutMinutes ?? sec.sessionTimeoutMinutes
+      };
+    }
+  }
   console.log(header("Security"));
   console.log(`  Allowed user IDs        : ${sec.allowedUserIds?.length ? sec.allowedUserIds.join(", ") : dim2("(all users allowed)")}`);
   console.log(`  Max concurrent sessions : ${sec.maxConcurrentSessions}`);
@@ -26304,8 +26634,12 @@ async function editSecurity(config, updates) {
           return true;
         }
       });
-      if (!updates.security) updates.security = {};
-      updates.security.maxConcurrentSessions = Number(val.trim());
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/security", { maxConcurrentSessions: Number(val.trim()) });
+      } else {
+        if (!updates.security) updates.security = {};
+        updates.security.maxConcurrentSessions = Number(val.trim());
+      }
       console.log(ok2(`Max concurrent sessions set to ${val.trim()}`));
     }
     if (choice === "timeout") {
@@ -26318,8 +26652,12 @@ async function editSecurity(config, updates) {
           return true;
         }
       });
-      if (!updates.security) updates.security = {};
-      updates.security.sessionTimeoutMinutes = Number(val.trim());
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/security", { sessionTimeoutMinutes: Number(val.trim()) });
+      } else {
+        if (!updates.security) updates.security = {};
+        updates.security.sessionTimeoutMinutes = Number(val.trim());
+      }
       console.log(ok2(`Session timeout set to ${val.trim()} minutes`));
     }
   }
@@ -26444,8 +26782,14 @@ async function editRunMode(config, updates) {
     }
   }
 }
-async function editApi(config, updates) {
-  const api = config.api ?? { port: 21420, host: "127.0.0.1" };
+async function editApi(config, updates, settingsManager) {
+  let api = config.api ?? { port: 21420, host: "127.0.0.1" };
+  if (settingsManager) {
+    const ps = await settingsManager.loadSettings("@openacp/api-server");
+    if (Object.keys(ps).length > 0) {
+      api = { port: ps.port ?? api.port, host: ps.host ?? api.host };
+    }
+  }
   console.log(header("API"));
   console.log(`  Port : ${api.port}`);
   console.log(`  Host : ${api.host} ${dim2("(localhost only)")}`);
@@ -26459,11 +26803,21 @@ async function editApi(config, updates) {
       return true;
     }
   });
-  updates.api = { port: Number(newPort.trim()) };
+  if (settingsManager) {
+    await settingsManager.updatePluginSettings("@openacp/api-server", { port: Number(newPort.trim()) });
+  } else {
+    updates.api = { port: Number(newPort.trim()) };
+  }
   console.log(ok2(`API port set to ${newPort.trim()}`));
 }
-async function editTunnel(config, updates) {
-  const tunnel = config.tunnel ?? { enabled: false, port: 3100, provider: "cloudflare", options: {}, storeTtlMinutes: 60, auth: { enabled: false } };
+async function editTunnel(config, updates, settingsManager) {
+  let tunnel = config.tunnel ?? { enabled: false, port: 3100, provider: "cloudflare", options: {}, storeTtlMinutes: 60, auth: { enabled: false } };
+  if (settingsManager) {
+    const ps = await settingsManager.loadSettings("@openacp/tunnel");
+    if (Object.keys(ps).length > 0) {
+      tunnel = { ...tunnel, ...ps };
+    }
+  }
   const currentUpdates = updates.tunnel ?? {};
   const getVal = (key, fallback) => key in currentUpdates ? currentUpdates[key] : tunnel[key] ?? fallback;
   console.log(header("Tunnel"));
@@ -26490,6 +26844,9 @@ async function editTunnel(config, updates) {
     const tun = updates.tunnel;
     if (choice === "toggle") {
       const current = getVal("enabled", false);
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/tunnel", { enabled: !current });
+      }
       tun.enabled = !current;
       console.log(!current ? ok2("Tunnel enabled") : ok2("Tunnel disabled"));
     }
@@ -26503,6 +26860,9 @@ async function editTunnel(config, updates) {
           { name: "Tailscale Funnel", value: "tailscale" }
         ]
       });
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/tunnel", { provider, options: {} });
+      }
       tun.provider = provider;
       tun.options = {};
       console.log(ok2(`Provider set to ${provider}`));
@@ -26517,6 +26877,9 @@ async function editTunnel(config, updates) {
           return true;
         }
       });
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/tunnel", { port: Number(val.trim()) });
+      }
       tun.port = Number(val.trim());
       console.log(ok2(`Tunnel port set to ${val.trim()}`));
     }
@@ -26524,11 +26887,17 @@ async function editTunnel(config, updates) {
       const provider = getVal("provider", "cloudflare");
       const currentOptions = getVal("options", {});
       await editProviderOptions(provider, currentOptions, tun);
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/tunnel", { options: tun.options });
+      }
     }
     if (choice === "auth") {
       const currentAuth = getVal("auth", { enabled: false });
       if (currentAuth.enabled) {
         tun.auth = { enabled: false };
+        if (settingsManager) {
+          await settingsManager.updatePluginSettings("@openacp/tunnel", { auth: { enabled: false } });
+        }
         console.log(ok2("Tunnel auth disabled"));
       } else {
         const token = await input({
@@ -26536,6 +26905,9 @@ async function editTunnel(config, updates) {
           default: ""
         });
         tun.auth = token.trim() ? { enabled: true, token: token.trim() } : { enabled: true };
+        if (settingsManager) {
+          await settingsManager.updatePluginSettings("@openacp/tunnel", { auth: tun.auth });
+        }
         console.log(ok2("Tunnel auth enabled"));
       }
     }
@@ -26601,7 +26973,7 @@ async function editProviderOptions(provider, currentOptions, tun) {
     console.log(dim2(`No configurable options for provider "${provider}"`));
   }
 }
-async function runConfigEditor(configManager, mode = "file", apiPort) {
+async function runConfigEditor(configManager, mode = "file", apiPort, settingsManager) {
   await configManager.load();
   const config = configManager.get();
   const updates = {};
@@ -26636,14 +27008,14 @@ ${c2.cyan}${c2.bold}OpenACP Config Editor${c2.reset}`);
         break;
       }
       const sectionUpdates = {};
-      if (choice === "channels") await editChannels(config, sectionUpdates);
+      if (choice === "channels") await editChannels(config, sectionUpdates, settingsManager);
       else if (choice === "agent") await editAgent(config, sectionUpdates);
       else if (choice === "workspace") await editWorkspace(config, sectionUpdates);
-      else if (choice === "security") await editSecurity(config, sectionUpdates);
+      else if (choice === "security") await editSecurity(config, sectionUpdates, settingsManager);
       else if (choice === "logging") await editLogging(config, sectionUpdates);
       else if (choice === "runMode") await editRunMode(config, sectionUpdates);
-      else if (choice === "api") await editApi(config, sectionUpdates);
-      else if (choice === "tunnel") await editTunnel(config, sectionUpdates);
+      else if (choice === "api") await editApi(config, sectionUpdates, settingsManager);
+      else if (choice === "tunnel") await editTunnel(config, sectionUpdates, settingsManager);
       if (mode === "api" && Object.keys(sectionUpdates).length > 0) {
         await sendConfigViaApi(apiPort, sectionUpdates);
         await configManager.load();
@@ -26663,17 +27035,17 @@ ${c2.cyan}${c2.bold}OpenACP Config Editor${c2.reset}`);
 async function sendConfigViaApi(port, updates) {
   const { apiCall: call } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
   const paths = flattenToPaths(updates);
-  for (const { path: path67, value } of paths) {
+  for (const { path: path68, value } of paths) {
     const res = await call(port, "/api/config", {
       method: "PATCH",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ path: path67, value })
+      body: JSON.stringify({ path: path68, value })
     });
     const data = await res.json();
     if (!res.ok) {
-      console.log(warn2(`Failed to update ${path67}: ${data.error}`));
+      console.log(warn2(`Failed to update ${path68}: ${data.error}`));
     } else if (data.needsRestart) {
-      console.log(warn2(`${path67} updated \u2014 restart required`));
+      console.log(warn2(`${path68} updated \u2014 restart required`));
     }
   }
 }
@@ -26782,35 +27154,35 @@ __export(instance_prompt_exports, {
   promptForInstance: () => promptForInstance
 });
 import fs56 from "fs";
-import path65 from "path";
-import os31 from "os";
+import path66 from "path";
+import os32 from "os";
 async function promptForInstance(opts) {
   const globalRoot = getGlobalRoot();
-  const globalConfigExists = fs56.existsSync(path65.join(globalRoot, "config.json"));
+  const globalConfigExists = fs56.existsSync(path66.join(globalRoot, "config.json"));
   const cwd = process.cwd();
-  const localRoot = path65.join(cwd, ".openacp");
+  const localRoot = path66.join(cwd, ".openacp");
   if (!globalConfigExists) return globalRoot;
   const isTTY = process.stdin.isTTY && process.stdout.isTTY;
   if (!isTTY) return globalRoot;
-  const registryPath = path65.join(globalRoot, "instances.json");
+  const registryPath = path66.join(globalRoot, "instances.json");
   const registry = new InstanceRegistry(registryPath);
   registry.load();
   const instances = registry.list().filter((e) => fs56.existsSync(e.root));
   const instanceOptions = instances.map((e) => {
     let name = e.id;
     try {
-      const raw = fs56.readFileSync(path65.join(e.root, "config.json"), "utf-8");
+      const raw = fs56.readFileSync(path66.join(e.root, "config.json"), "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.instanceName) name = parsed.instanceName;
     } catch {
     }
     const isGlobal = e.root === globalRoot;
-    const displayPath = e.root.replace(os31.homedir(), "~");
+    const displayPath = e.root.replace(os32.homedir(), "~");
     const type = isGlobal ? "global" : "local";
     return { value: e.root, label: `${name} workspace (${type} \u2014 ${displayPath})` };
   });
   if (instanceOptions.length === 0) {
-    const globalDisplay = globalRoot.replace(os31.homedir(), "~");
+    const globalDisplay = globalRoot.replace(os32.homedir(), "~");
     instanceOptions.push({ value: globalRoot, label: `Global workspace (${globalDisplay})` });
   }
   if (instanceOptions.length === 1 && !opts.allowCreate) {
@@ -26821,7 +27193,7 @@ async function promptForInstance(opts) {
     label: o.label
   }));
   if (opts.allowCreate) {
-    const localDisplay = localRoot.replace(os31.homedir(), "~");
+    const localDisplay = localRoot.replace(os32.homedir(), "~");
     options.push({ value: localRoot, label: `New local workspace (${localDisplay})` });
   }
   const clack10 = await import("@clack/prompts");
@@ -26847,7 +27219,7 @@ var init_instance_prompt = __esm({
 
 // src/cli.ts
 import { setDefaultAutoSelectFamily } from "net";
-import path66 from "path";
+import path67 from "path";
 
 // src/cli/commands/help.ts
 function printHelp() {
@@ -27086,11 +27458,11 @@ Shows all plugins registered in the plugin registry.
 `);
     return;
   }
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path68 = await import("path");
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
-  const registryPath = path67.join(root, "plugins.json");
+  const root = instanceRoot ?? path68.join(os33.homedir(), ".openacp");
+  const registryPath = path68.join(root, "plugins.json");
   const registry = new PluginRegistry2(registryPath);
   await registry.load();
   const plugins = registry.list();
@@ -27225,11 +27597,11 @@ async function cmdPlugin(args2 = [], instanceRoot) {
 }
 async function setPluginEnabled(name, enabled, instanceRoot, json = false) {
   if (json) await muteForJson();
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path68 = await import("path");
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
-  const registryPath = path67.join(root, "plugins.json");
+  const root = instanceRoot ?? path68.join(os33.homedir(), ".openacp");
+  const registryPath = path68.join(root, "plugins.json");
   const registry = new PluginRegistry2(registryPath);
   await registry.load();
   const entry = registry.get(name);
@@ -27244,8 +27616,8 @@ async function setPluginEnabled(name, enabled, instanceRoot, json = false) {
   console.log(`Plugin ${name} ${enabled ? "enabled" : "disabled"}. Restart to apply.`);
 }
 async function configurePlugin(name, instanceRoot) {
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path68 = await import("path");
   const { corePlugins: corePlugins2 } = await Promise.resolve().then(() => (init_core_plugins(), core_plugins_exports));
   const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
   const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
@@ -27254,8 +27626,8 @@ async function configurePlugin(name, instanceRoot) {
     console.error(`Plugin "${name}" not found.`);
     process.exit(1);
   }
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
-  const basePath = path67.join(root, "plugins", "data");
+  const root = instanceRoot ?? path68.join(os33.homedir(), ".openacp");
+  const basePath = path68.join(root, "plugins", "data");
   const settingsManager = new SettingsManager2(basePath);
   const ctx = createInstallContext2({ pluginName: name, settingsManager, basePath });
   if (plugin2.configure) {
@@ -27268,14 +27640,14 @@ async function configurePlugin(name, instanceRoot) {
 }
 async function installPlugin(input2, instanceRoot, json = false) {
   if (json) await muteForJson();
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path68 = await import("path");
   const { execFileSync: execFileSync8 } = await import("child_process");
   const { getCurrentVersion: getCurrentVersion2 } = await Promise.resolve().then(() => (init_version(), version_exports));
   const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
   const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
+  const root = instanceRoot ?? path68.join(os33.homedir(), ".openacp");
   let pkgName;
   let pkgVersion;
   if (input2.startsWith("@")) {
@@ -27320,9 +27692,9 @@ async function installPlugin(input2, instanceRoot, json = false) {
   if (!json) console.log(`Installing ${installSpec}...`);
   const { corePlugins: corePlugins2 } = await Promise.resolve().then(() => (init_core_plugins(), core_plugins_exports));
   const builtinPlugin = corePlugins2.find((p2) => p2.name === pkgName);
-  const basePath = path67.join(root, "plugins", "data");
+  const basePath = path68.join(root, "plugins", "data");
   const settingsManager = new SettingsManager2(basePath);
-  const registryPath = path67.join(root, "plugins.json");
+  const registryPath = path68.join(root, "plugins.json");
   const pluginRegistry = new PluginRegistry2(registryPath);
   await pluginRegistry.load();
   if (builtinPlugin) {
@@ -27342,8 +27714,8 @@ async function installPlugin(input2, instanceRoot, json = false) {
     console.log(`\u2713 ${builtinPlugin.name} installed! Restart to activate.`);
     return;
   }
-  const pluginsDir = path67.join(root, "plugins");
-  const nodeModulesDir = path67.join(pluginsDir, "node_modules");
+  const pluginsDir = path68.join(root, "plugins");
+  const nodeModulesDir = path68.join(pluginsDir, "node_modules");
   try {
     execFileSync8("npm", ["install", installSpec, "--prefix", pluginsDir, "--save"], {
       stdio: json ? "pipe" : "inherit",
@@ -27357,8 +27729,8 @@ async function installPlugin(input2, instanceRoot, json = false) {
   const cliVersion = getCurrentVersion2();
   const isLocalPath = pkgName.startsWith("/") || pkgName.startsWith(".");
   try {
-    const pluginRoot = isLocalPath ? path67.resolve(pkgName) : path67.join(nodeModulesDir, pkgName);
-    const installedPkgPath = path67.join(pluginRoot, "package.json");
+    const pluginRoot = isLocalPath ? path68.resolve(pkgName) : path68.join(nodeModulesDir, pkgName);
+    const installedPkgPath = path68.join(pluginRoot, "package.json");
     const { readFileSync: readFileSync19 } = await import("fs");
     const installedPkg = JSON.parse(readFileSync19(installedPkgPath, "utf-8"));
     const minVersion = installedPkg.engines?.openacp?.replace(/[>=^~\s]/g, "");
@@ -27373,7 +27745,7 @@ async function installPlugin(input2, instanceRoot, json = false) {
         }
       }
     }
-    const pluginModule = await import(path67.join(pluginRoot, installedPkg.main ?? "dist/index.js"));
+    const pluginModule = await import(path68.join(pluginRoot, installedPkg.main ?? "dist/index.js"));
     const plugin2 = pluginModule.default;
     if (plugin2?.install) {
       const ctx = createInstallContext2({ pluginName: plugin2.name ?? pkgName, settingsManager, basePath });
@@ -27403,12 +27775,12 @@ async function installPlugin(input2, instanceRoot, json = false) {
 }
 async function uninstallPlugin(name, purge, instanceRoot, json = false) {
   if (json) await muteForJson();
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path68 = await import("path");
   const fs57 = await import("fs");
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
-  const registryPath = path67.join(root, "plugins.json");
+  const root = instanceRoot ?? path68.join(os33.homedir(), ".openacp");
+  const registryPath = path68.join(root, "plugins.json");
   const registry = new PluginRegistry2(registryPath);
   await registry.load();
   const entry = registry.get(name);
@@ -27428,7 +27800,7 @@ async function uninstallPlugin(name, purge, instanceRoot, json = false) {
     if (plugin2?.uninstall) {
       const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
       const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
-      const basePath = path67.join(root, "plugins", "data");
+      const basePath = path68.join(root, "plugins", "data");
       const settingsManager = new SettingsManager2(basePath);
       const ctx = createInstallContext2({ pluginName: name, settingsManager, basePath });
       await plugin2.uninstall(ctx, { purge });
@@ -27436,7 +27808,7 @@ async function uninstallPlugin(name, purge, instanceRoot, json = false) {
   } catch {
   }
   if (purge) {
-    const pluginDir = path67.join(root, "plugins", name);
+    const pluginDir = path68.join(root, "plugins", name);
     fs57.rmSync(pluginDir, { recursive: true, force: true });
   }
   registry.remove(name);
@@ -28266,13 +28638,13 @@ init_version();
 init_helpers();
 init_output();
 init_instance_hint();
-import path37 from "path";
-import os16 from "os";
+import path38 from "path";
+import os17 from "os";
 import fs36 from "fs";
 async function cmdStart(args2 = [], instanceRoot) {
   const json = isJsonMode(args2);
   if (json) await muteForJson();
-  const root = instanceRoot ?? path37.join(os16.homedir(), ".openacp");
+  const root = instanceRoot ?? path38.join(os17.homedir(), ".openacp");
   if (!json && wantsHelp(args2)) {
     console.log(`
 \x1B[1mopenacp start\x1B[0m \u2014 Start OpenACP as a background daemon
@@ -28298,7 +28670,7 @@ Requires an existing config \u2014 run 'openacp' first to set up.
   await checkAndPromptUpdate();
   const { startDaemon: startDaemon2, getPidPath: getPidPath2 } = await Promise.resolve().then(() => (init_daemon2(), daemon_exports));
   const { ConfigManager: ConfigManager2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
-  const cm = new ConfigManager2(path37.join(root, "config.json"));
+  const cm = new ConfigManager2(path38.join(root, "config.json"));
   if (await cm.exists()) {
     await cm.load();
     const config = cm.get();
@@ -28309,11 +28681,11 @@ Requires an existing config \u2014 run 'openacp' first to set up.
       process.exit(1);
     }
     if (json) {
-      let instanceId = path37.basename(root);
+      let instanceId = path38.basename(root);
       try {
         const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
         const { InstanceRegistry: InstanceRegistry2 } = await Promise.resolve().then(() => (init_instance_registry(), instance_registry_exports));
-        const reg = new InstanceRegistry2(path37.join(getGlobalRoot2(), "instances.json"));
+        const reg = new InstanceRegistry2(path38.join(getGlobalRoot2(), "instances.json"));
         reg.load();
         const entry = reg.getByRoot(root);
         if (entry) instanceId = entry.id;
@@ -28321,7 +28693,7 @@ Requires an existing config \u2014 run 'openacp' first to set up.
       }
       let port = null;
       try {
-        const portStr = fs36.readFileSync(path37.join(root, "api.port"), "utf-8").trim();
+        const portStr = fs36.readFileSync(path38.join(root, "api.port"), "utf-8").trim();
         port = parseInt(portStr) || null;
       } catch {
         port = config.api.port ?? null;
@@ -28330,7 +28702,7 @@ Requires an existing config \u2014 run 'openacp' first to set up.
         pid: result.pid,
         instanceId,
         name: config.instanceName ?? null,
-        directory: path37.dirname(root),
+        directory: path38.dirname(root),
         dir: root,
         port
       });
@@ -28467,16 +28839,20 @@ the API for live updates. When stopped, edits config file directly.
   }
   const { runConfigEditor: runConfigEditor2 } = await Promise.resolve().then(() => (init_config_editor(), config_editor_exports));
   const { ConfigManager: ConfigManager2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
+  const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
+  const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
   const cm = new ConfigManager2(instanceRoot ? pathMod.join(instanceRoot, "config.json") : void 0);
   if (!await cm.exists()) {
     console.error('No config found. Run "openacp" first to set up.');
     process.exit(1);
   }
+  const root = instanceRoot ?? getGlobalRoot2();
+  const settingsManager = new SettingsManager2(pathMod.join(root, "plugins"));
   const port = readApiPort(void 0, instanceRoot);
   if (port !== null) {
-    await runConfigEditor2(cm, "api", port);
+    await runConfigEditor2(cm, "api", port, settingsManager);
   } else {
-    await runConfigEditor2(cm, "file");
+    await runConfigEditor2(cm, "file", void 0, settingsManager);
   }
 }
 
@@ -28497,9 +28873,9 @@ start fresh with the setup wizard. The daemon must be stopped first.
 `);
     return;
   }
-  const os32 = await import("os");
-  const path67 = await import("path");
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
+  const os33 = await import("os");
+  const path68 = await import("path");
+  const root = instanceRoot ?? path68.join(os33.homedir(), ".openacp");
   const { getStatus: getStatus2, getPidPath: getPidPath2 } = await Promise.resolve().then(() => (init_daemon2(), daemon_exports));
   const status = getStatus2(getPidPath2(root));
   if (status.running) {
@@ -28657,11 +29033,11 @@ init_instance_context();
 init_status();
 init_output();
 init_helpers();
-import path58 from "path";
-import os27 from "os";
+import path59 from "path";
+import os28 from "os";
 import fs52 from "fs";
 async function buildInstanceListEntries() {
-  const registryPath = path58.join(getGlobalRoot(), "instances.json");
+  const registryPath = path59.join(getGlobalRoot(), "instances.json");
   const registry = new InstanceRegistry(registryPath);
   registry.load();
   return registry.list().map((entry) => {
@@ -28669,7 +29045,7 @@ async function buildInstanceListEntries() {
     return {
       id: entry.id,
       name: info.name,
-      directory: path58.dirname(entry.root),
+      directory: path59.dirname(entry.root),
       root: entry.root,
       status: info.pid ? "running" : "stopped",
       port: info.apiPort
@@ -28719,7 +29095,7 @@ async function cmdInstancesList(args2) {
   for (const e of entries) {
     const status = e.status === "running" ? "\u25CF running" : "\u25CB stopped";
     const port = e.port ? `:${e.port}` : "\u2014";
-    const dir = e.directory.replace(os27.homedir(), "~");
+    const dir = e.directory.replace(os28.homedir(), "~");
     const name = (e.name ?? e.id).padEnd(16);
     console.log(`  ${status.padEnd(10)} ${e.id.padEnd(16)} ${name} ${dir}  ${port}`);
   }
@@ -28742,9 +29118,9 @@ async function cmdInstancesCreate(args2) {
   const agentIdx = args2.indexOf("--agent");
   const agent = agentIdx !== -1 ? args2[agentIdx + 1] : void 0;
   const noInteractive = args2.includes("--no-interactive");
-  const resolvedDir = path58.resolve(rawDir.replace(/^~/, os27.homedir()));
-  const instanceRoot = path58.join(resolvedDir, ".openacp");
-  const registryPath = path58.join(getGlobalRoot(), "instances.json");
+  const resolvedDir = path59.resolve(rawDir.replace(/^~/, os28.homedir()));
+  const instanceRoot = path59.join(resolvedDir, ".openacp");
+  const registryPath = path59.join(getGlobalRoot(), "instances.json");
   const registry = new InstanceRegistry(registryPath);
   registry.load();
   if (fs52.existsSync(instanceRoot)) {
@@ -28754,8 +29130,8 @@ async function cmdInstancesCreate(args2) {
       console.error(`Error: Instance already exists at ${resolvedDir} (id: ${existing.id})`);
       process.exit(1);
     }
-    const configPath = path58.join(instanceRoot, "config.json");
-    let name2 = path58.basename(resolvedDir);
+    const configPath = path59.join(instanceRoot, "config.json");
+    let name2 = path59.basename(resolvedDir);
     try {
       const config = JSON.parse(fs52.readFileSync(configPath, "utf-8"));
       name2 = config.instanceName ?? name2;
@@ -28770,15 +29146,15 @@ async function cmdInstancesCreate(args2) {
   const name = instanceName ?? `openacp-${registry.list().length + 1}`;
   const id = registry.uniqueId(generateSlug(name));
   if (rawFrom) {
-    const fromRoot = path58.join(path58.resolve(rawFrom.replace(/^~/, os27.homedir())), ".openacp");
-    if (!fs52.existsSync(path58.join(fromRoot, "config.json"))) {
+    const fromRoot = path59.join(path59.resolve(rawFrom.replace(/^~/, os28.homedir())), ".openacp");
+    if (!fs52.existsSync(path59.join(fromRoot, "config.json"))) {
       console.error(`Error: No OpenACP instance found at ${rawFrom}`);
       process.exit(1);
     }
     fs52.mkdirSync(instanceRoot, { recursive: true });
     const { copyInstance: copyInstance2 } = await Promise.resolve().then(() => (init_instance_copy(), instance_copy_exports));
     await copyInstance2(fromRoot, instanceRoot, {});
-    const configPath = path58.join(instanceRoot, "config.json");
+    const configPath = path59.join(instanceRoot, "config.json");
     try {
       const config = JSON.parse(fs52.readFileSync(configPath, "utf-8"));
       config.instanceName = name;
@@ -28789,14 +29165,14 @@ async function cmdInstancesCreate(args2) {
     fs52.mkdirSync(instanceRoot, { recursive: true });
     const config = { instanceName: name, runMode: "daemon" };
     if (agent) config.defaultAgent = agent;
-    fs52.writeFileSync(path58.join(instanceRoot, "config.json"), JSON.stringify(config, null, 2));
-    fs52.writeFileSync(path58.join(instanceRoot, "plugins.json"), JSON.stringify({ version: 1, installed: {} }, null, 2));
+    fs52.writeFileSync(path59.join(instanceRoot, "config.json"), JSON.stringify(config, null, 2));
+    fs52.writeFileSync(path59.join(instanceRoot, "plugins.json"), JSON.stringify({ version: 1, installed: {} }, null, 2));
   } else {
     fs52.mkdirSync(instanceRoot, { recursive: true });
     const config = { instanceName: name, runMode: "daemon" };
     if (agent) config.defaultAgent = agent;
-    fs52.writeFileSync(path58.join(instanceRoot, "config.json"), JSON.stringify(config, null, 2));
-    fs52.writeFileSync(path58.join(instanceRoot, "plugins.json"), JSON.stringify({ version: 1, installed: {} }, null, 2));
+    fs52.writeFileSync(path59.join(instanceRoot, "config.json"), JSON.stringify(config, null, 2));
+    fs52.writeFileSync(path59.join(instanceRoot, "plugins.json"), JSON.stringify({ version: 1, installed: {} }, null, 2));
     console.log(`Instance created at ${resolvedDir}. Run 'openacp setup' inside that directory to configure it.`);
   }
   registry.register(id, instanceRoot);
@@ -28808,7 +29184,7 @@ async function outputInstance(json, { id, root }) {
   const entry = {
     id,
     name: info.name,
-    directory: path58.dirname(root),
+    directory: path59.dirname(root),
     root,
     status: info.pid ? "running" : "stopped",
     port: info.apiPort
@@ -28817,7 +29193,7 @@ async function outputInstance(json, { id, root }) {
     jsonSuccess(entry);
     return;
   }
-  console.log(`Instance created: ${info.name ?? id} at ${path58.dirname(root)}`);
+  console.log(`Instance created: ${info.name ?? id} at ${path59.dirname(root)}`);
 }
 
 // src/cli/commands/integrate.ts
@@ -29580,16 +29956,16 @@ Options:
 }
 
 // src/cli/commands/onboard.ts
-import * as path59 from "path";
+import * as path60 from "path";
 async function cmdOnboard(instanceRoot) {
   const { ConfigManager: ConfigManager2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
   const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
   const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
   const OPENACP_DIR = instanceRoot ?? getGlobalRoot2();
-  const PLUGINS_DATA_DIR = path59.join(OPENACP_DIR, "plugins", "data");
-  const REGISTRY_PATH = path59.join(OPENACP_DIR, "plugins.json");
-  const cm = new ConfigManager2(path59.join(OPENACP_DIR, "config.json"));
+  const PLUGINS_DATA_DIR = path60.join(OPENACP_DIR, "plugins", "data");
+  const REGISTRY_PATH = path60.join(OPENACP_DIR, "plugins.json");
+  const cm = new ConfigManager2(path60.join(OPENACP_DIR, "config.json"));
   const settingsManager = new SettingsManager2(PLUGINS_DATA_DIR);
   const pluginRegistry = new PluginRegistry2(REGISTRY_PATH);
   await pluginRegistry.load();
@@ -29608,17 +29984,17 @@ init_instance_context();
 init_instance_registry();
 init_instance_hint();
 init_output();
-import path60 from "path";
-import os28 from "os";
+import path61 from "path";
+import os29 from "os";
 import fs53 from "fs";
 import { randomUUID as randomUUID5 } from "crypto";
 async function cmdDefault(command2, instanceRoot) {
   const args2 = command2 ? [command2] : [];
   const json = isJsonMode(args2);
   if (json) await muteForJson();
-  const root = instanceRoot ?? path60.join(os28.homedir(), ".openacp");
-  const pluginsDataDir = path60.join(root, "plugins", "data");
-  const registryPath = path60.join(root, "plugins.json");
+  const root = instanceRoot ?? path61.join(os29.homedir(), ".openacp");
+  const pluginsDataDir = path61.join(root, "plugins", "data");
+  const registryPath = path61.join(root, "plugins.json");
   const forceForeground = command2 === "--foreground";
   if (command2 && !command2.startsWith("-")) {
     const { suggestMatch: suggestMatch2 } = await Promise.resolve().then(() => (init_suggest(), suggest_exports));
@@ -29650,7 +30026,7 @@ async function cmdDefault(command2, instanceRoot) {
   }
   await checkAndPromptUpdate();
   const { ConfigManager: ConfigManager2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
-  const configPath = path60.join(root, "config.json");
+  const configPath = path61.join(root, "config.json");
   const cm = new ConfigManager2(configPath);
   if (!await cm.exists()) {
     const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
@@ -29678,9 +30054,9 @@ async function cmdDefault(command2, instanceRoot) {
       process.exit(1);
     }
     if (json) {
-      let instanceId2 = path60.basename(root);
+      let instanceId2 = path61.basename(root);
       try {
-        const reg2 = new InstanceRegistry(path60.join(getGlobalRoot(), "instances.json"));
+        const reg2 = new InstanceRegistry(path61.join(getGlobalRoot(), "instances.json"));
         reg2.load();
         const entry = reg2.getByRoot(root);
         if (entry) instanceId2 = entry.id;
@@ -29688,7 +30064,7 @@ async function cmdDefault(command2, instanceRoot) {
       }
       let port = null;
       try {
-        const portStr = fs53.readFileSync(path60.join(root, "api.port"), "utf-8").trim();
+        const portStr = fs53.readFileSync(path61.join(root, "api.port"), "utf-8").trim();
         port = parseInt(portStr) || null;
       } catch {
         port = config.api.port ?? null;
@@ -29697,7 +30073,7 @@ async function cmdDefault(command2, instanceRoot) {
         pid: result.pid,
         instanceId: instanceId2,
         name: config.instanceName ?? null,
-        directory: path60.dirname(root),
+        directory: path61.dirname(root),
         dir: root,
         port
       });
@@ -29710,7 +30086,7 @@ async function cmdDefault(command2, instanceRoot) {
   markRunning2(root);
   printInstanceHint(root);
   const { startServer: startServer2 } = await Promise.resolve().then(() => (init_main(), main_exports));
-  const reg = new InstanceRegistry(path60.join(getGlobalRoot(), "instances.json"));
+  const reg = new InstanceRegistry(path61.join(getGlobalRoot(), "instances.json"));
   reg.load();
   const existingEntry = reg.getByRoot(root);
   const instanceId = existingEntry?.id ?? randomUUID5();
@@ -29722,7 +30098,7 @@ async function cmdDefault(command2, instanceRoot) {
   if (json) {
     let port = null;
     try {
-      const portStr = fs53.readFileSync(path60.join(root, "api.port"), "utf-8").trim();
+      const portStr = fs53.readFileSync(path61.join(root, "api.port"), "utf-8").trim();
       port = parseInt(portStr) || null;
     } catch {
       port = config.api.port ?? null;
@@ -29731,7 +30107,7 @@ async function cmdDefault(command2, instanceRoot) {
       pid: process.pid,
       instanceId,
       name: config.instanceName ?? null,
-      directory: path60.dirname(root),
+      directory: path61.dirname(root),
       dir: root,
       port
     });
@@ -29800,7 +30176,7 @@ async function showAlreadyRunningMenu(root) {
 // src/cli/commands/dev.ts
 init_helpers();
 import fs54 from "fs";
-import path61 from "path";
+import path62 from "path";
 async function cmdDev(args2 = []) {
   if (wantsHelp(args2)) {
     console.log(`
@@ -29827,12 +30203,12 @@ async function cmdDev(args2 = []) {
     console.error("Error: missing plugin path. Usage: openacp dev <plugin-path>");
     process.exit(1);
   }
-  const pluginPath = path61.resolve(pluginPathArg);
+  const pluginPath = path62.resolve(pluginPathArg);
   if (!fs54.existsSync(pluginPath)) {
     console.error(`Error: plugin path does not exist: ${pluginPath}`);
     process.exit(1);
   }
-  const tsconfigPath = path61.join(pluginPath, "tsconfig.json");
+  const tsconfigPath = path62.join(pluginPath, "tsconfig.json");
   const hasTsconfig = fs54.existsSync(tsconfigPath);
   if (hasTsconfig) {
     console.log("Compiling plugin TypeScript...");
@@ -29874,10 +30250,10 @@ async function cmdDev(args2 = []) {
 
 // src/cli/commands/attach.ts
 init_helpers();
-import path62 from "path";
-import os29 from "os";
+import path63 from "path";
+import os30 from "os";
 async function cmdAttach(args2 = [], instanceRoot) {
-  const root = instanceRoot ?? path62.join(os29.homedir(), ".openacp");
+  const root = instanceRoot ?? path63.join(os30.homedir(), ".openacp");
   if (wantsHelp(args2)) {
     console.log(`
 \x1B[1mopenacp attach\x1B[0m \u2014 Attach to a running daemon
@@ -29911,15 +30287,15 @@ Press Ctrl+C to detach.
   console.log("");
   const { spawn: spawn9 } = await import("child_process");
   const { expandHome: expandHome4 } = await Promise.resolve().then(() => (init_config2(), config_exports));
-  let logDir2 = path62.join(root, "logs");
+  let logDir2 = path63.join(root, "logs");
   try {
-    const configPath = path62.join(root, "config.json");
+    const configPath = path63.join(root, "config.json");
     const { readFileSync: readFileSync19 } = await import("fs");
     const config = JSON.parse(readFileSync19(configPath, "utf-8"));
     if (config.logging?.logDir) logDir2 = expandHome4(config.logging.logDir);
   } catch {
   }
-  const logFile = path62.join(logDir2, "openacp.log");
+  const logFile = path63.join(logDir2, "openacp.log");
   const tail = spawn9("tail", ["-f", "-n", "50", logFile], { stdio: "inherit" });
   tail.on("error", (err) => {
     console.error(`Cannot tail log file: ${err.message}`);
@@ -29931,8 +30307,8 @@ Press Ctrl+C to detach.
 init_api_client();
 init_instance_registry();
 init_output();
-import path63 from "path";
-import os30 from "os";
+import path64 from "path";
+import os31 from "os";
 import qrcode from "qrcode-terminal";
 async function cmdRemote(args2, instanceRoot) {
   const json = isJsonMode(args2);
@@ -29947,7 +30323,7 @@ async function cmdRemote(args2, instanceRoot) {
   const scopes = scopesRaw ? scopesRaw.split(",").map((s) => s.trim()) : void 0;
   let resolvedInstanceRoot2 = instanceRoot;
   if (instanceId) {
-    const registryPath = path63.join(os30.homedir(), ".openacp", "instances.json");
+    const registryPath = path64.join(os31.homedir(), ".openacp", "instances.json");
     const registry = new InstanceRegistry(registryPath);
     await registry.load();
     const entry = registry.get(instanceId);
@@ -30085,7 +30461,7 @@ function extractFlag(args2, flag) {
 // src/cli/commands/setup.ts
 init_output();
 import * as fs55 from "fs";
-import * as path64 from "path";
+import * as path65 from "path";
 function parseFlag(args2, flag) {
   const idx = args2.indexOf(flag);
   return idx !== -1 ? args2[idx + 1] : void 0;
@@ -30113,7 +30489,7 @@ async function cmdSetup(args2, instanceRoot) {
   }
   const runMode = rawRunMode;
   const defaultAgent = agentRaw.split(",")[0].trim();
-  const configPath = path64.join(instanceRoot, "config.json");
+  const configPath = path65.join(instanceRoot, "config.json");
   let existing = {};
   if (fs55.existsSync(configPath)) {
     try {
@@ -30221,7 +30597,7 @@ async function main() {
     if (envRoot) {
       const { createInstanceContext: createInstanceContext2, getGlobalRoot: getGlobal } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
       const { InstanceRegistry: InstanceRegistry2 } = await Promise.resolve().then(() => (init_instance_registry(), instance_registry_exports));
-      const registry = new InstanceRegistry2(path66.join(getGlobal(), "instances.json"));
+      const registry = new InstanceRegistry2(path67.join(getGlobal(), "instances.json"));
       await registry.load();
       const entry = registry.getByRoot(envRoot);
       const { randomUUID: randomUUID6 } = await import("crypto");