@openacp/cli 2026.402.5 → 2026.403.2

package/dist/cli.js

@@ -1634,21 +1634,23 @@ var init_security_guard = __esm({
   "src/plugins/security/security-guard.ts"() {
     "use strict";
     SecurityGuard = class {
-      constructor(configManager, sessionManager) {
-        this.configManager = configManager;
+      constructor(getSecurityConfig, sessionManager) {
+        this.getSecurityConfig = getSecurityConfig;
         this.sessionManager = sessionManager;
       }
-      checkAccess(message) {
-        const config = this.configManager.get();
-        if (config.security.allowedUserIds.length > 0) {
+      async checkAccess(message) {
+        const config = await this.getSecurityConfig();
+        const allowedIds = config.allowedUserIds ?? [];
+        const maxSessions = config.maxConcurrentSessions ?? 20;
+        if (allowedIds.length > 0) {
           const userId = String(message.userId);
-          if (!config.security.allowedUserIds.includes(userId)) {
+          if (!allowedIds.includes(userId)) {
             return { allowed: false, reason: "Unauthorized user" };
           }
         }
         const active = this.sessionManager.listSessions().filter((s) => s.status === "active" || s.status === "initializing");
-        if (active.length >= config.security.maxConcurrentSessions) {
-          return { allowed: false, reason: `Session limit reached (${config.security.maxConcurrentSessions})` };
+        if (active.length >= maxSessions) {
+          return { allowed: false, reason: `Session limit reached (${maxSessions})` };
         }
         return { allowed: true };
       }
@@ -1668,7 +1670,7 @@ function createSecurityPlugin() {
     description: "User access control and session limits",
     essential: false,
     permissions: ["services:register", "middleware:register", "kernel:access", "commands:register"],
-    inheritableKeys: ["allowedUsers", "maxSessionsPerUser", "rateLimits"],
+    inheritableKeys: ["allowedUserIds", "maxConcurrentSessions", "sessionTimeoutMinutes"],
     async install(ctx) {
       const { settings, legacyConfig, terminal } = ctx;
       if (legacyConfig) {
@@ -1745,10 +1747,28 @@ function createSecurityPlugin() {
     },
     async setup(ctx) {
       const core = ctx.core;
-      const guard = new SecurityGuard(core.configManager, core.sessionManager);
+      const settingsManager = core.lifecycleManager?.settingsManager;
+      const pluginName = ctx.pluginName;
+      const getSecurityConfig = async () => {
+        if (settingsManager) {
+          const settings = await settingsManager.loadSettings(pluginName);
+          if (Object.keys(settings).length > 0) {
+            return {
+              allowedUserIds: settings.allowedUserIds ?? [],
+              maxConcurrentSessions: settings.maxConcurrentSessions ?? 20
+            };
+          }
+        }
+        const cfg = ctx.pluginConfig;
+        return {
+          allowedUserIds: cfg.allowedUserIds ?? [],
+          maxConcurrentSessions: cfg.maxConcurrentSessions ?? 20
+        };
+      };
+      const guard = new SecurityGuard(getSecurityConfig, core.sessionManager);
       ctx.registerMiddleware("message:incoming", {
         handler: async (payload, next) => {
-          const access2 = guard.checkAccess(payload);
+          const access2 = await guard.checkAccess(payload);
           if (!access2.allowed) {
             ctx.log.info(`Access denied: ${access2.reason}`);
             return null;
@@ -3869,7 +3889,7 @@ var init_speech = __esm({
       essential: false,
       optionalPluginDependencies: { "@openacp/file-service": "^1.0.0" },
       permissions: ["services:register", "commands:register", "kernel:access"],
-      inheritableKeys: ["tts"],
+      inheritableKeys: ["ttsProvider", "ttsVoice"],
       async install(ctx) {
         const { terminal, settings, legacyConfig } = ctx;
         const pluginsDir = ctx.instanceRoot ? path13.join(ctx.instanceRoot, "plugins") : void 0;
@@ -6826,6 +6846,289 @@ var init_token_store = __esm({
   }
 });
 
+// src/core/instance/instance-context.ts
+var instance_context_exports = {};
+__export(instance_context_exports, {
+  createInstanceContext: () => createInstanceContext,
+  generateSlug: () => generateSlug,
+  getGlobalRoot: () => getGlobalRoot,
+  resolveInstanceRoot: () => resolveInstanceRoot
+});
+import path21 from "path";
+import fs17 from "fs";
+import os10 from "os";
+function createInstanceContext(opts) {
+  const { id, root, isGlobal } = opts;
+  return {
+    id,
+    root,
+    isGlobal,
+    paths: {
+      config: path21.join(root, "config.json"),
+      sessions: path21.join(root, "sessions.json"),
+      agents: path21.join(root, "agents.json"),
+      registryCache: path21.join(root, "registry-cache.json"),
+      plugins: path21.join(root, "plugins"),
+      pluginsData: path21.join(root, "plugins", "data"),
+      pluginRegistry: path21.join(root, "plugins.json"),
+      logs: path21.join(root, "logs"),
+      pid: path21.join(root, "openacp.pid"),
+      running: path21.join(root, "running"),
+      apiPort: path21.join(root, "api.port"),
+      apiSecret: path21.join(root, "api-secret"),
+      bin: path21.join(root, "bin"),
+      cache: path21.join(root, "cache"),
+      tunnels: path21.join(root, "tunnels.json"),
+      agentsDir: path21.join(root, "agents")
+    }
+  };
+}
+function generateSlug(name) {
+  const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  return slug || "openacp";
+}
+function expandHome2(p2) {
+  if (p2.startsWith("~")) return path21.join(os10.homedir(), p2.slice(1));
+  return p2;
+}
+function resolveInstanceRoot(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (opts.dir) return path21.join(expandHome2(opts.dir), ".openacp");
+  if (opts.local) return path21.join(cwd, ".openacp");
+  if (opts.global) return path21.join(os10.homedir(), ".openacp");
+  const localRoot = path21.join(cwd, ".openacp");
+  if (fs17.existsSync(localRoot)) return localRoot;
+  if (process.env.OPENACP_INSTANCE_ROOT) return process.env.OPENACP_INSTANCE_ROOT;
+  return null;
+}
+function getGlobalRoot() {
+  return path21.join(os10.homedir(), ".openacp");
+}
+var init_instance_context = __esm({
+  "src/core/instance/instance-context.ts"() {
+    "use strict";
+  }
+});
+
+// src/core/config/config-registry.ts
+var config_registry_exports = {};
+__export(config_registry_exports, {
+  CONFIG_REGISTRY: () => CONFIG_REGISTRY,
+  ConfigValidationError: () => ConfigValidationError,
+  getConfigValue: () => getConfigValue,
+  getFieldDef: () => getFieldDef,
+  getFieldValueAsync: () => getFieldValueAsync,
+  getSafeFields: () => getSafeFields,
+  isHotReloadable: () => isHotReloadable,
+  resolveOptions: () => resolveOptions,
+  setFieldValueAsync: () => setFieldValueAsync
+});
+import * as fs18 from "fs";
+import * as path22 from "path";
+function getFieldDef(path69) {
+  return CONFIG_REGISTRY.find((f) => f.path === path69);
+}
+function getSafeFields() {
+  return CONFIG_REGISTRY.filter((f) => f.scope === "safe");
+}
+function isHotReloadable(path69) {
+  const def = getFieldDef(path69);
+  return def?.hotReload ?? false;
+}
+function resolveOptions(def, config) {
+  if (!def.options) return void 0;
+  return typeof def.options === "function" ? def.options(config) : def.options;
+}
+function getConfigValue(config, path69) {
+  const parts = path69.split(".");
+  let current = config;
+  for (const part of parts) {
+    if (current && typeof current === "object" && part in current) {
+      current = current[part];
+    } else {
+      return void 0;
+    }
+  }
+  return current;
+}
+async function getFieldValueAsync(field, configManager, settingsManager) {
+  if (field.plugin && settingsManager) {
+    const settings = await settingsManager.loadSettings(field.plugin.name);
+    return settings[field.plugin.key];
+  }
+  return getConfigValue(configManager.get(), field.path);
+}
+function validateFieldValue(field, value) {
+  switch (field.type) {
+    case "number":
+      if (typeof value !== "number" || Number.isNaN(value)) {
+        throw new ConfigValidationError(`"${field.path}" expects a number, got ${typeof value}`);
+      }
+      break;
+    case "toggle":
+      if (typeof value !== "boolean") {
+        throw new ConfigValidationError(`"${field.path}" expects a boolean, got ${typeof value}`);
+      }
+      break;
+    case "string":
+      if (typeof value !== "string") {
+        throw new ConfigValidationError(`"${field.path}" expects a string, got ${typeof value}`);
+      }
+      break;
+    case "select": {
+      if (typeof value !== "string") {
+        throw new ConfigValidationError(`"${field.path}" expects a string, got ${typeof value}`);
+      }
+      break;
+    }
+  }
+}
+async function setFieldValueAsync(field, value, configManager, settingsManager) {
+  validateFieldValue(field, value);
+  if (field.plugin && settingsManager) {
+    await settingsManager.updatePluginSettings(field.plugin.name, {
+      [field.plugin.key]: value
+    });
+    if (configManager.emit) {
+      configManager.emit("config:changed", { path: field.path, value, oldValue: void 0 });
+    }
+    return { needsRestart: !field.hotReload };
+  }
+  await configManager.setPath(field.path, value);
+  return { needsRestart: !field.hotReload };
+}
+var CONFIG_REGISTRY, ConfigValidationError;
+var init_config_registry = __esm({
+  "src/core/config/config-registry.ts"() {
+    "use strict";
+    init_instance_context();
+    CONFIG_REGISTRY = [
+      {
+        path: "defaultAgent",
+        displayName: "Default Agent",
+        group: "agent",
+        type: "select",
+        options: (config) => {
+          try {
+            const agentsPath = path22.join(getGlobalRoot(), "agents.json");
+            if (fs18.existsSync(agentsPath)) {
+              const data = JSON.parse(fs18.readFileSync(agentsPath, "utf-8"));
+              return Object.keys(data.installed ?? {});
+            }
+          } catch {
+          }
+          return Object.keys(config.agents ?? {});
+        },
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "channels.telegram.outputMode",
+        displayName: "Telegram Output Mode",
+        group: "display",
+        type: "select",
+        options: ["low", "medium", "high"],
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "channels.discord.outputMode",
+        displayName: "Discord Output Mode",
+        group: "display",
+        type: "select",
+        options: ["low", "medium", "high"],
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "logging.level",
+        displayName: "Log Level",
+        group: "logging",
+        type: "select",
+        options: ["silent", "debug", "info", "warn", "error", "fatal"],
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "tunnel.enabled",
+        displayName: "Tunnel",
+        group: "tunnel",
+        type: "toggle",
+        scope: "safe",
+        hotReload: false,
+        plugin: { name: "@openacp/tunnel", key: "enabled" }
+      },
+      {
+        path: "security.maxConcurrentSessions",
+        displayName: "Max Concurrent Sessions",
+        group: "security",
+        type: "number",
+        scope: "safe",
+        hotReload: true,
+        plugin: { name: "@openacp/security", key: "maxConcurrentSessions" }
+      },
+      {
+        path: "security.sessionTimeoutMinutes",
+        displayName: "Session Timeout (min)",
+        group: "security",
+        type: "number",
+        scope: "safe",
+        hotReload: true,
+        plugin: { name: "@openacp/security", key: "sessionTimeoutMinutes" }
+      },
+      {
+        path: "workspace.baseDir",
+        displayName: "Workspace Directory",
+        group: "workspace",
+        type: "string",
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "sessionStore.ttlDays",
+        displayName: "Session Store TTL (days)",
+        group: "storage",
+        type: "number",
+        scope: "safe",
+        hotReload: true
+      },
+      {
+        path: "speech.stt.provider",
+        displayName: "Speech to Text",
+        group: "speech",
+        type: "select",
+        options: ["groq"],
+        scope: "safe",
+        hotReload: true,
+        plugin: { name: "@openacp/speech", key: "sttProvider" }
+      },
+      {
+        path: "speech.stt.apiKey",
+        displayName: "STT API Key",
+        group: "speech",
+        type: "string",
+        scope: "sensitive",
+        hotReload: true,
+        plugin: { name: "@openacp/speech", key: "groqApiKey" }
+      },
+      {
+        path: "agentSwitch.labelHistory",
+        displayName: "Label Agent in History",
+        group: "agent",
+        type: "toggle",
+        scope: "safe",
+        hotReload: true
+      }
+    ];
+    ConfigValidationError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ConfigValidationError";
+      }
+    };
+  }
+});
+
 // src/plugins/api-server/middleware/error-handler.ts
 var error_handler_exports = {};
 __export(error_handler_exports, {
@@ -6848,6 +7151,16 @@ function globalErrorHandler(error, _request, reply) {
     });
     return;
   }
+  if (error instanceof ConfigValidationError) {
+    reply.status(400).send({
+      error: {
+        code: "VALIDATION_ERROR",
+        message: error.message,
+        statusCode: 400
+      }
+    });
+    return;
+  }
   if (error instanceof BadRequestError) {
     reply.status(400).send({
       error: {
@@ -6900,6 +7213,7 @@ var NotFoundError, BadRequestError, ServiceUnavailableError, AuthError;
 var init_error_handler = __esm({
   "src/plugins/api-server/middleware/error-handler.ts"() {
     "use strict";
+    init_config_registry();
     NotFoundError = class extends Error {
       constructor(code, message) {
         super(message);
@@ -7204,7 +7518,7 @@ var init_sse_manager = __esm({
       handleRequest(req, res) {
         const parsedUrl = new URL(req.url || "", "http://localhost");
         const sessionFilter = parsedUrl.searchParams.get("sessionId");
-        console.log(`[sse] new connection from origin=${req.headers.origin ?? "none"} filter=${sessionFilter ?? "none"} total=${this.sseConnections.size + 1}`);
+        console.log(`[sse] +connection total=${this.sseConnections.size + 1}`);
         const origin = req.headers.origin;
         const corsHeaders = {
           "Content-Type": "text/event-stream",
@@ -7226,7 +7540,7 @@ var init_sse_manager = __esm({
         const cleanup = () => {
           this.sseConnections.delete(res);
           this.sseCleanupHandlers.delete(res);
-          console.log(`[sse] connection closed, remaining=${this.sseConnections.size}`);
+          console.log(`[sse] -connection remaining=${this.sseConnections.size}`);
         };
         this.sseCleanupHandlers.set(res, cleanup);
         req.on("close", cleanup);
@@ -7286,8 +7600,8 @@ var static_server_exports = {};
 __export(static_server_exports, {
   StaticServer: () => StaticServer
 });
-import * as fs17 from "fs";
-import * as path21 from "path";
+import * as fs19 from "fs";
+import * as path23 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var MIME_TYPES, StaticServer;
 var init_static_server = __esm({
@@ -7311,16 +7625,16 @@ var init_static_server = __esm({
         this.uiDir = uiDir;
         if (!this.uiDir) {
           const __filename = fileURLToPath2(import.meta.url);
-          const candidate = path21.resolve(path21.dirname(__filename), "../../ui/dist");
-          if (fs17.existsSync(path21.join(candidate, "index.html"))) {
+          const candidate = path23.resolve(path23.dirname(__filename), "../../ui/dist");
+          if (fs19.existsSync(path23.join(candidate, "index.html"))) {
             this.uiDir = candidate;
           }
           if (!this.uiDir) {
-            const publishCandidate = path21.resolve(
-              path21.dirname(__filename),
+            const publishCandidate = path23.resolve(
+              path23.dirname(__filename),
               "../ui"
             );
-            if (fs17.existsSync(path21.join(publishCandidate, "index.html"))) {
+            if (fs19.existsSync(path23.join(publishCandidate, "index.html"))) {
               this.uiDir = publishCandidate;
             }
           }
@@ -7332,12 +7646,12 @@ var init_static_server = __esm({
       serve(req, res) {
         if (!this.uiDir) return false;
         const urlPath = (req.url || "/").split("?")[0];
-        const safePath = path21.normalize(urlPath);
-        const filePath = path21.join(this.uiDir, safePath);
-        if (!filePath.startsWith(this.uiDir + path21.sep) && filePath !== this.uiDir)
+        const safePath = path23.normalize(urlPath);
+        const filePath = path23.join(this.uiDir, safePath);
+        if (!filePath.startsWith(this.uiDir + path23.sep) && filePath !== this.uiDir)
           return false;
-        if (fs17.existsSync(filePath) && fs17.statSync(filePath).isFile()) {
-          const ext = path21.extname(filePath);
+        if (fs19.existsSync(filePath) && fs19.statSync(filePath).isFile()) {
+          const ext = path23.extname(filePath);
           const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
           const isHashed = /\.[a-zA-Z0-9]{8,}\.(js|css)$/.test(filePath);
           const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "no-cache";
@@ -7345,16 +7659,16 @@ var init_static_server = __esm({
             "Content-Type": contentType,
             "Cache-Control": cacheControl
           });
-          fs17.createReadStream(filePath).pipe(res);
+          fs19.createReadStream(filePath).pipe(res);
           return true;
         }
-        const indexPath = path21.join(this.uiDir, "index.html");
-        if (fs17.existsSync(indexPath)) {
+        const indexPath = path23.join(this.uiDir, "index.html");
+        if (fs19.existsSync(indexPath)) {
           res.writeHead(200, {
             "Content-Type": "text/html; charset=utf-8",
             "Cache-Control": "no-cache"
           });
-          fs17.createReadStream(indexPath).pipe(res);
+          fs19.createReadStream(indexPath).pipe(res);
           return true;
         }
         return false;
@@ -7906,240 +8220,17 @@ var init_config = __esm({
   }
 });
 
-// src/core/instance/instance-context.ts
-var instance_context_exports = {};
-__export(instance_context_exports, {
-  createInstanceContext: () => createInstanceContext,
-  generateSlug: () => generateSlug,
-  getGlobalRoot: () => getGlobalRoot,
-  resolveInstanceRoot: () => resolveInstanceRoot
-});
-import path22 from "path";
-import fs18 from "fs";
-import os10 from "os";
-function createInstanceContext(opts) {
-  const { id, root, isGlobal } = opts;
-  return {
-    id,
-    root,
-    isGlobal,
-    paths: {
-      config: path22.join(root, "config.json"),
-      sessions: path22.join(root, "sessions.json"),
-      agents: path22.join(root, "agents.json"),
-      registryCache: path22.join(root, "registry-cache.json"),
-      plugins: path22.join(root, "plugins"),
-      pluginsData: path22.join(root, "plugins", "data"),
-      pluginRegistry: path22.join(root, "plugins.json"),
-      logs: path22.join(root, "logs"),
-      pid: path22.join(root, "openacp.pid"),
-      running: path22.join(root, "running"),
-      apiPort: path22.join(root, "api.port"),
-      apiSecret: path22.join(root, "api-secret"),
-      bin: path22.join(root, "bin"),
-      cache: path22.join(root, "cache"),
-      tunnels: path22.join(root, "tunnels.json"),
-      agentsDir: path22.join(root, "agents")
+// src/core/config/config-migrations.ts
+import * as fs20 from "fs";
+import * as path24 from "path";
+function applyMigrations(raw, migrationList = migrations, ctx) {
+  let changed = false;
+  for (const migration of migrationList) {
+    if (migration.apply(raw, ctx)) {
+      changed = true;
     }
-  };
-}
-function generateSlug(name) {
-  const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-  return slug || "openacp";
-}
-function expandHome2(p2) {
-  if (p2.startsWith("~")) return path22.join(os10.homedir(), p2.slice(1));
-  return p2;
-}
-function resolveInstanceRoot(opts) {
-  const cwd = opts.cwd ?? process.cwd();
-  if (opts.dir) return path22.join(expandHome2(opts.dir), ".openacp");
-  if (opts.local) return path22.join(cwd, ".openacp");
-  if (opts.global) return path22.join(os10.homedir(), ".openacp");
-  const localRoot = path22.join(cwd, ".openacp");
-  if (fs18.existsSync(localRoot)) return localRoot;
-  if (process.env.OPENACP_INSTANCE_ROOT) return process.env.OPENACP_INSTANCE_ROOT;
-  return null;
-}
-function getGlobalRoot() {
-  return path22.join(os10.homedir(), ".openacp");
-}
-var init_instance_context = __esm({
-  "src/core/instance/instance-context.ts"() {
-    "use strict";
-  }
-});
-
-// src/core/config/config-registry.ts
-var config_registry_exports = {};
-__export(config_registry_exports, {
-  CONFIG_REGISTRY: () => CONFIG_REGISTRY,
-  getConfigValue: () => getConfigValue,
-  getFieldDef: () => getFieldDef,
-  getSafeFields: () => getSafeFields,
-  isHotReloadable: () => isHotReloadable,
-  resolveOptions: () => resolveOptions
-});
-import * as fs19 from "fs";
-import * as path23 from "path";
-function getFieldDef(path67) {
-  return CONFIG_REGISTRY.find((f) => f.path === path67);
-}
-function getSafeFields() {
-  return CONFIG_REGISTRY.filter((f) => f.scope === "safe");
-}
-function isHotReloadable(path67) {
-  const def = getFieldDef(path67);
-  return def?.hotReload ?? false;
-}
-function resolveOptions(def, config) {
-  if (!def.options) return void 0;
-  return typeof def.options === "function" ? def.options(config) : def.options;
-}
-function getConfigValue(config, path67) {
-  const parts = path67.split(".");
-  let current = config;
-  for (const part of parts) {
-    if (current && typeof current === "object" && part in current) {
-      current = current[part];
-    } else {
-      return void 0;
-    }
-  }
-  return current;
-}
-var CONFIG_REGISTRY;
-var init_config_registry = __esm({
-  "src/core/config/config-registry.ts"() {
-    "use strict";
-    init_instance_context();
-    CONFIG_REGISTRY = [
-      {
-        path: "defaultAgent",
-        displayName: "Default Agent",
-        group: "agent",
-        type: "select",
-        options: (config) => {
-          try {
-            const agentsPath = path23.join(getGlobalRoot(), "agents.json");
-            if (fs19.existsSync(agentsPath)) {
-              const data = JSON.parse(fs19.readFileSync(agentsPath, "utf-8"));
-              return Object.keys(data.installed ?? {});
-            }
-          } catch {
-          }
-          return Object.keys(config.agents ?? {});
-        },
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "channels.telegram.outputMode",
-        displayName: "Telegram Output Mode",
-        group: "display",
-        type: "select",
-        options: ["low", "medium", "high"],
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "channels.discord.outputMode",
-        displayName: "Discord Output Mode",
-        group: "display",
-        type: "select",
-        options: ["low", "medium", "high"],
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "logging.level",
-        displayName: "Log Level",
-        group: "logging",
-        type: "select",
-        options: ["silent", "debug", "info", "warn", "error", "fatal"],
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "tunnel.enabled",
-        displayName: "Tunnel",
-        group: "tunnel",
-        type: "toggle",
-        scope: "safe",
-        hotReload: false
-      },
-      {
-        path: "security.maxConcurrentSessions",
-        displayName: "Max Concurrent Sessions",
-        group: "security",
-        type: "number",
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "security.sessionTimeoutMinutes",
-        displayName: "Session Timeout (min)",
-        group: "security",
-        type: "number",
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "workspace.baseDir",
-        displayName: "Workspace Directory",
-        group: "workspace",
-        type: "string",
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "sessionStore.ttlDays",
-        displayName: "Session Store TTL (days)",
-        group: "storage",
-        type: "number",
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "speech.stt.provider",
-        displayName: "Speech to Text",
-        group: "speech",
-        type: "select",
-        options: ["groq"],
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "speech.stt.apiKey",
-        displayName: "STT API Key",
-        group: "speech",
-        type: "string",
-        scope: "sensitive",
-        hotReload: true
-      },
-      {
-        path: "agentSwitch.labelHistory",
-        displayName: "Label Agent in History",
-        group: "agent",
-        type: "toggle",
-        scope: "safe",
-        hotReload: true
-      }
-    ];
-  }
-});
-
-// src/core/config/config-migrations.ts
-import * as fs20 from "fs";
-import * as path24 from "path";
-function applyMigrations(raw, migrationList = migrations, ctx) {
-  let changed = false;
-  for (const migration of migrationList) {
-    if (migration.apply(raw, ctx)) {
-      changed = true;
-    }
-  }
-  return { changed };
+  }
+  return { changed };
 }
 var log11, migrations;
 var init_config_migrations = __esm({
@@ -8533,6 +8624,26 @@ var init_config2 = __esm({
         fs21.mkdirSync(dir, { recursive: true });
         fs21.writeFileSync(this.configPath, JSON.stringify(config, null, 2));
       }
+      async applyEnvToPluginSettings(settingsManager) {
+        const pluginOverrides = [
+          { envVar: "OPENACP_TUNNEL_ENABLED", pluginName: "@openacp/tunnel", key: "enabled", transform: (v) => v === "true" },
+          { envVar: "OPENACP_TUNNEL_PORT", pluginName: "@openacp/tunnel", key: "port", transform: (v) => Number(v) },
+          { envVar: "OPENACP_TUNNEL_PROVIDER", pluginName: "@openacp/tunnel", key: "provider" },
+          { envVar: "OPENACP_API_PORT", pluginName: "@openacp/api-server", key: "port", transform: (v) => Number(v) },
+          { envVar: "OPENACP_SPEECH_STT_PROVIDER", pluginName: "@openacp/speech", key: "sttProvider" },
+          { envVar: "OPENACP_SPEECH_GROQ_API_KEY", pluginName: "@openacp/speech", key: "groqApiKey" },
+          { envVar: "OPENACP_TELEGRAM_BOT_TOKEN", pluginName: "@openacp/telegram", key: "botToken" },
+          { envVar: "OPENACP_TELEGRAM_CHAT_ID", pluginName: "@openacp/telegram", key: "chatId", transform: (v) => Number(v) }
+        ];
+        for (const { envVar, pluginName, key, transform } of pluginOverrides) {
+          const value = process.env[envVar];
+          if (value !== void 0) {
+            const resolved = transform ? transform(value) : value;
+            await settingsManager.updatePluginSettings(pluginName, { [key]: resolved });
+            log12.debug({ envVar, pluginName, key }, "Env var override applied to plugin settings");
+          }
+        }
+      }
       applyEnvOverrides(raw) {
         const overrides = [
           ["OPENACP_TELEGRAM_BOT_TOKEN", ["channels", "telegram", "botToken"]],
@@ -8645,18 +8756,19 @@ function redactDeep(obj) {
 }
 async function configRoutes(app, deps) {
   app.get("/editable", { preHandler: requireScopes("config:read") }, async () => {
-    const { getSafeFields: getSafeFields2, resolveOptions: resolveOptions2, getConfigValue: getConfigValue2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
+    const { getSafeFields: getSafeFields2, resolveOptions: resolveOptions2, getFieldValueAsync: getFieldValueAsync2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
     const config = deps.core.configManager.get();
+    const settingsManager = deps.core.settingsManager;
     const safeFields = getSafeFields2();
-    const fields = safeFields.map((def) => ({
+    const fields = await Promise.all(safeFields.map(async (def) => ({
       path: def.path,
       displayName: def.displayName,
       group: def.group,
       type: def.type,
       options: resolveOptions2(def, config),
-      value: getConfigValue2(config, def.path),
+      value: await getFieldValueAsync2(def, deps.core.configManager, settingsManager),
       hotReload: def.hotReload
-    }));
+    })));
     return { fields };
   });
   app.get("/schema", { preHandler: requireScopes("config:read") }, async () => {
@@ -8676,16 +8788,20 @@ async function configRoutes(app, deps) {
     if (configPath.split(".").some((p2) => BLOCKED_KEYS.has(p2))) {
       return reply.status(400).send({ error: "Invalid config path" });
     }
-    const { getFieldDef: getFieldDef2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
+    const { getFieldDef: getFieldDef2, setFieldValueAsync: setFieldValueAsync2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
     const fieldDef = getFieldDef2(configPath);
     if (!fieldDef || fieldDef.scope !== "safe") {
       return reply.status(403).send({
         error: "This config field cannot be modified via the API"
       });
     }
-    await deps.core.configManager.setPath(configPath, value);
-    const { isHotReloadable: isHotReloadable2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
-    const needsRestart = !isHotReloadable2(configPath);
+    const settingsManager = deps.core.settingsManager;
+    const { needsRestart } = await setFieldValueAsync2(
+      fieldDef,
+      value,
+      deps.core.configManager,
+      settingsManager
+    );
     return {
       ok: true,
       needsRestart,
@@ -9196,13 +9312,152 @@ var init_workspace = __esm({
   }
 });
 
+// src/plugins/api-server/routes/plugins.ts
+var plugins_exports = {};
+__export(plugins_exports, {
+  pluginRoutes: () => pluginRoutes
+});
+import path26 from "path";
+import os12 from "os";
+async function pluginRoutes(app, deps) {
+  const { lifecycleManager } = deps;
+  const admin = [requireScopes("system:admin")];
+  app.get("/", { preHandler: admin }, async () => {
+    if (!lifecycleManager?.registry) return { plugins: [] };
+    const registry = lifecycleManager.registry;
+    const loadedSet = new Set(lifecycleManager.loadedPlugins);
+    const failedSet = new Set(lifecycleManager.failedPlugins);
+    const loadOrderMap = new Map(lifecycleManager.plugins.map((p2) => [p2.name, p2]));
+    const coreMap = new Map(corePlugins.map((p2) => [p2.name, p2]));
+    const plugins = Array.from(registry.list().entries()).map(([name, entry]) => {
+      const def = loadOrderMap.get(name) ?? coreMap.get(name);
+      return {
+        name,
+        version: entry.version,
+        description: entry.description,
+        source: entry.source,
+        enabled: entry.enabled,
+        loaded: loadedSet.has(name),
+        failed: failedSet.has(name),
+        essential: def?.essential ?? false,
+        hasConfigure: typeof def?.configure === "function"
+      };
+    });
+    return { plugins };
+  });
+  app.get("/marketplace", { preHandler: admin }, async (_req, reply) => {
+    try {
+      const data = await registryClient.getRegistry();
+      const installedNames = new Set(
+        lifecycleManager?.registry ? Array.from(lifecycleManager.registry.list().keys()) : []
+      );
+      const plugins = data.plugins.map((p2) => ({
+        ...p2,
+        installed: installedNames.has(p2.name) || installedNames.has(p2.npm)
+      }));
+      return { plugins, categories: data.categories };
+    } catch {
+      return reply.status(503).send({ error: "Marketplace unavailable" });
+    }
+  });
+  app.post("/:name/enable", { preHandler: admin }, async (req, reply) => {
+    if (!lifecycleManager?.registry) {
+      return reply.status(503).send({ error: "Plugin manager unavailable" });
+    }
+    const name = req.params.name;
+    const registry = lifecycleManager.registry;
+    const entry = registry.get(name);
+    if (!entry) {
+      return reply.status(404).send({ error: `Plugin "${name}" not found` });
+    }
+    if (lifecycleManager.loadedPlugins.includes(name)) {
+      registry.setEnabled(name, true);
+      await registry.save();
+      return { ok: true };
+    }
+    let pluginDef = lifecycleManager.plugins.find((p2) => p2.name === name);
+    if (!pluginDef) {
+      if (entry.source === "builtin") {
+        pluginDef = corePlugins.find((p2) => p2.name === name);
+      } else {
+        const { importFromDir: importFromDir2 } = await Promise.resolve().then(() => (init_plugin_installer(), plugin_installer_exports));
+        const instanceRoot = lifecycleManager.instanceRoot ?? path26.join(os12.homedir(), ".openacp");
+        const pluginsDir = path26.join(instanceRoot, "plugins");
+        try {
+          const mod = await importFromDir2(name, pluginsDir);
+          pluginDef = mod.default ?? mod;
+        } catch {
+          return reply.status(500).send({ error: "Plugin module could not be loaded. Try restarting the server." });
+        }
+      }
+    }
+    if (!pluginDef) {
+      return reply.status(500).send({ error: `Plugin definition not found for "${name}"` });
+    }
+    registry.setEnabled(name, true);
+    await registry.save();
+    await lifecycleManager.boot([pluginDef]);
+    if (lifecycleManager.failedPlugins.includes(name)) {
+      return reply.status(500).send({ error: `Plugin "${name}" failed to start` });
+    }
+    return { ok: true };
+  });
+  app.post("/:name/disable", { preHandler: admin }, async (req, reply) => {
+    if (!lifecycleManager?.registry) {
+      return reply.status(503).send({ error: "Plugin manager unavailable" });
+    }
+    const name = req.params.name;
+    const registry = lifecycleManager.registry;
+    const entry = registry.get(name);
+    if (!entry) {
+      return reply.status(404).send({ error: `Plugin "${name}" not found` });
+    }
+    const def = lifecycleManager.plugins.find((p2) => p2.name === name) ?? corePlugins.find((p2) => p2.name === name);
+    if (def?.essential) {
+      return reply.status(409).send({ error: "Essential plugins cannot be disabled" });
+    }
+    await lifecycleManager.unloadPlugin(name);
+    registry.setEnabled(name, false);
+    await registry.save();
+    return { ok: true };
+  });
+  app.delete("/:name", { preHandler: admin }, async (req, reply) => {
+    if (!lifecycleManager?.registry) {
+      return reply.status(503).send({ error: "Plugin manager unavailable" });
+    }
+    const name = req.params.name;
+    const registry = lifecycleManager.registry;
+    const entry = registry.get(name);
+    if (!entry) {
+      return reply.status(404).send({ error: `Plugin "${name}" not found` });
+    }
+    if (entry.source === "builtin") {
+      return reply.status(400).send({ error: "Builtin plugins cannot be uninstalled. Use disable instead." });
+    }
+    await lifecycleManager.unloadPlugin(name);
+    registry.remove(name);
+    await registry.save();
+    return { ok: true };
+  });
+}
+var registryClient;
+var init_plugins = __esm({
+  "src/plugins/api-server/routes/plugins.ts"() {
+    "use strict";
+    init_auth();
+    init_core_plugins();
+    init_registry_client();
+    registryClient = new RegistryClient();
+  }
+});
+
 // src/core/instance/instance-registry.ts
 var instance_registry_exports = {};
 __export(instance_registry_exports, {
   InstanceRegistry: () => InstanceRegistry
 });
 import fs22 from "fs";
-import path26 from "path";
+import path27 from "path";
 var InstanceRegistry;
 var init_instance_registry = __esm({
   "src/core/instance/instance-registry.ts"() {
@@ -9240,7 +9495,7 @@ var init_instance_registry = __esm({
         }
       }
       save() {
-        const dir = path26.dirname(this.registryPath);
+        const dir = path27.dirname(this.registryPath);
         fs22.mkdirSync(dir, { recursive: true });
         fs22.writeFileSync(this.registryPath, JSON.stringify(this.data, null, 2));
       }
@@ -9276,13 +9531,13 @@ __export(api_server_exports, {
 });
 import * as fs23 from "fs";
 import * as crypto2 from "crypto";
-import * as path27 from "path";
+import * as path28 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   try {
     const __filename = fileURLToPath3(import.meta.url);
-    const pkgPath = path27.resolve(path27.dirname(__filename), "../../../package.json");
+    const pkgPath = path28.resolve(path28.dirname(__filename), "../../../package.json");
     const pkg = JSON.parse(fs23.readFileSync(pkgPath, "utf-8"));
     cachedVersion = pkg.version ?? "0.0.0-dev";
   } catch {
@@ -9291,7 +9546,7 @@ function getVersion() {
   return cachedVersion;
 }
 function loadOrCreateSecret(secretFilePath) {
-  const dir = path27.dirname(secretFilePath);
+  const dir = path28.dirname(secretFilePath);
   fs23.mkdirSync(dir, { recursive: true });
   try {
     const existing = fs23.readFileSync(secretFilePath, "utf-8").trim();
@@ -9317,7 +9572,7 @@ function loadOrCreateSecret(secretFilePath) {
   return secret;
 }
 function writePortFile(portFilePath, port) {
-  const dir = path27.dirname(portFilePath);
+  const dir = path28.dirname(portFilePath);
   fs23.mkdirSync(dir, { recursive: true });
   fs23.writeFileSync(portFilePath, String(port));
 }
@@ -9409,10 +9664,10 @@ function createApiServerPlugin() {
         { port: apiConfig.port, host: apiConfig.host, instanceRoot },
         "API server plugin setup \u2014 config loaded"
       );
-      portFilePath = path27.join(instanceRoot, "api.port");
-      const secretFilePath = path27.join(instanceRoot, "api-secret");
-      const jwtSecretFilePath = path27.join(instanceRoot, "jwt-secret");
-      const tokensFilePath = path27.join(instanceRoot, "tokens.json");
+      portFilePath = path28.join(instanceRoot, "api.port");
+      const secretFilePath = path28.join(instanceRoot, "api-secret");
+      const jwtSecretFilePath = path28.join(instanceRoot, "jwt-secret");
+      const tokensFilePath = path28.join(instanceRoot, "tokens.json");
       const startedAt = Date.now();
       const secret = loadOrCreateSecret(secretFilePath);
       const jwtSecret = loadOrCreateSecret(jwtSecretFilePath);
@@ -9435,6 +9690,7 @@ function createApiServerPlugin() {
       const { commandRoutes: commandRoutes2 } = await Promise.resolve().then(() => (init_commands2(), commands_exports));
       const { authRoutes: authRoutes2 } = await Promise.resolve().then(() => (init_auth3(), auth_exports3));
       const { workspaceRoute: workspaceRoute2 } = await Promise.resolve().then(() => (init_workspace(), workspace_exports));
+      const { pluginRoutes: pluginRoutes2 } = await Promise.resolve().then(() => (init_plugins(), plugins_exports));
       server = await createApiServer2({
         port: apiConfig.port,
         host: apiConfig.host,
@@ -9453,7 +9709,8 @@ function createApiServerPlugin() {
         getVersion,
         commandRegistry,
         authPreHandler: routeAuthPreHandler,
-        contextManager
+        contextManager,
+        lifecycleManager: core.lifecycleManager
       };
       server.registerPlugin("/api/v1/sessions", async (app) => sessionRoutes2(app, deps));
       server.registerPlugin("/api/v1/agents", async (app) => agentRoutes2(app, deps));
@@ -9464,16 +9721,17 @@ function createApiServerPlugin() {
       server.registerPlugin("/api/v1/notify", async (app) => notifyRoutes2(app, deps));
       server.registerPlugin("/api/v1/commands", async (app) => commandRoutes2(app, deps));
       server.registerPlugin("/api/v1/auth", async (app) => authRoutes2(app, { tokenStore, getJwtSecret: () => jwtSecret }));
+      server.registerPlugin("/api/v1/plugins", async (app) => pluginRoutes2(app, deps));
       const { InstanceRegistry: InstanceRegistry2 } = await Promise.resolve().then(() => (init_instance_registry(), instance_registry_exports));
       const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
       const globalRoot = getGlobalRoot2();
-      const instanceReg = new InstanceRegistry2(path27.join(globalRoot, "instances.json"));
+      const instanceReg = new InstanceRegistry2(path28.join(globalRoot, "instances.json"));
       instanceReg.load();
       const instanceEntry = instanceReg.getByRoot(instanceRoot);
       const workspaceId = instanceEntry?.id ?? "main";
       const appConfig = core.configManager.get();
       const workspaceName = appConfig.instanceName ?? "Main";
-      const workspaceDir = path27.dirname(instanceRoot);
+      const workspaceDir = path28.dirname(instanceRoot);
       server.registerPlugin("/api/v1", async (app) => {
         await app.register(workspaceRoute2, {
           id: workspaceId,
@@ -10408,8 +10666,8 @@ function formatToolSummary(name, rawInput, displaySummary) {
   }
   if (lowerName === "grep") {
     const pattern = args2.pattern ?? "";
-    const path67 = args2.path ?? "";
-    return pattern ? `\u{1F50D} Grep "${pattern}"${path67 ? ` in ${path67}` : ""}` : `\u{1F527} ${name}`;
+    const path69 = args2.path ?? "";
+    return pattern ? `\u{1F50D} Grep "${pattern}"${path69 ? ` in ${path69}` : ""}` : `\u{1F527} ${name}`;
   }
   if (lowerName === "glob") {
     const pattern = args2.pattern ?? "";
@@ -10445,8 +10703,8 @@ function formatToolTitle(name, rawInput, displayTitle) {
   }
   if (lowerName === "grep") {
     const pattern = args2.pattern ?? "";
-    const path67 = args2.path ?? "";
-    return pattern ? `"${pattern}"${path67 ? ` in ${path67}` : ""}` : name;
+    const path69 = args2.path ?? "";
+    return pattern ? `"${pattern}"${path69 ? ` in ${path69}` : ""}` : name;
   }
   if (lowerName === "glob") {
     return String(args2.pattern ?? name);
@@ -12254,12 +12512,11 @@ var init_menu = __esm({
 
 // src/plugins/telegram/commands/settings.ts
 import { InlineKeyboard as InlineKeyboard6 } from "grammy";
-function buildSettingsKeyboard(core) {
-  const config = core.configManager.get();
+async function buildSettingsKeyboard(core) {
   const fields = getSafeFields();
   const kb = new InlineKeyboard6();
   for (const field of fields) {
-    const value = getConfigValue(config, field.path);
+    const value = await getFieldValueAsync(field, core.configManager, core.settingsManager);
     const label = formatFieldLabel(field, value);
     if (field.type === "toggle") {
       kb.text(`${label}`, `s:toggle:${field.path}`).row();
@@ -12290,7 +12547,7 @@ function formatFieldLabel(field, value) {
   return `${icon} ${field.displayName}: ${displayValue}`;
 }
 async function handleSettings(ctx, core) {
-  const kb = buildSettingsKeyboard(core);
+  const kb = await buildSettingsKeyboard(core);
   await ctx.reply(`<b>\u2699\uFE0F Settings</b>
 Tap to change:`, {
     parse_mode: "HTML",
@@ -12300,19 +12557,20 @@ Tap to change:`, {
 function setupSettingsCallbacks(bot, core, getAssistantSession) {
   bot.callbackQuery(/^s:toggle:/, async (ctx) => {
     const fieldPath = ctx.callbackQuery.data.replace("s:toggle:", "");
-    const config = core.configManager.get();
-    const currentValue = getConfigValue(config, fieldPath);
+    const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
+    if (!fieldDef) return;
+    const settingsManager = core.settingsManager;
+    const currentValue = await getFieldValueAsync(fieldDef, core.configManager, settingsManager);
     const newValue = !currentValue;
     try {
-      const updates = buildNestedUpdate(fieldPath, newValue);
-      await core.configManager.save(updates, fieldPath);
+      await setFieldValueAsync(fieldDef, newValue, core.configManager, settingsManager);
       const toast = isHotReloadable(fieldPath) ? `\u2705 ${fieldPath} = ${newValue}` : `\u2705 ${fieldPath} = ${newValue} (restart needed)`;
       try {
         await ctx.answerCallbackQuery({ text: toast });
       } catch {
       }
       try {
-        await ctx.editMessageReplyMarkup({ reply_markup: buildSettingsKeyboard(core) });
+        await ctx.editMessageReplyMarkup({ reply_markup: await buildSettingsKeyboard(core) });
       } catch {
       }
     } catch (err) {
@@ -12329,7 +12587,7 @@ function setupSettingsCallbacks(bot, core, getAssistantSession) {
     const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
     if (!fieldDef) return;
     const options = resolveOptions(fieldDef, config) ?? [];
-    const currentValue = getConfigValue(config, fieldPath);
+    const currentValue = await getFieldValueAsync(fieldDef, core.configManager, core.settingsManager);
     const kb = new InlineKeyboard6();
     for (const opt of options) {
       const marker = opt === String(currentValue) ? " \u2713" : "";
@@ -12353,11 +12611,21 @@ Select a value:`, {
     const parts = ctx.callbackQuery.data.replace("s:pick:", "").split(":");
     const fieldPath = parts.slice(0, -1).join(":");
     const newValue = parts[parts.length - 1];
+    const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
+    if (!fieldDef) return;
     try {
       if (fieldPath === "speech.stt.provider") {
-        const config = core.configManager.get();
-        const providerConfig = config.speech?.stt?.providers?.[newValue];
-        if (!providerConfig?.apiKey) {
+        const sm = core.settingsManager;
+        let hasApiKey = false;
+        if (sm) {
+          const speechSettings = await sm.loadSettings("@openacp/speech");
+          hasApiKey = !!speechSettings.groqApiKey;
+        } else {
+          const config = core.configManager.get();
+          const providerConfig = config.speech?.stt?.providers?.[newValue];
+          hasApiKey = !!providerConfig?.apiKey;
+        }
+        if (!hasApiKey) {
           const assistant = getAssistantSession();
           if (assistant) {
             try {
@@ -12375,8 +12643,7 @@ Select a value:`, {
           return;
         }
       }
-      const updates = buildNestedUpdate(fieldPath, newValue);
-      await core.configManager.save(updates, fieldPath);
+      await setFieldValueAsync(fieldDef, newValue, core.configManager, core.settingsManager);
       try {
         await ctx.answerCallbackQuery({ text: `\u2705 ${fieldPath} = ${newValue}` });
       } catch {
@@ -12385,7 +12652,7 @@ Select a value:`, {
         await ctx.editMessageText(`<b>\u2699\uFE0F Settings</b>
 Tap to change:`, {
           parse_mode: "HTML",
-          reply_markup: buildSettingsKeyboard(core)
+          reply_markup: await buildSettingsKeyboard(core)
         });
       } catch {
       }
@@ -12399,10 +12666,9 @@ Tap to change:`, {
   });
   bot.callbackQuery(/^s:input:/, async (ctx) => {
     const fieldPath = ctx.callbackQuery.data.replace("s:input:", "");
-    const config = core.configManager.get();
     const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
     if (!fieldDef) return;
-    const currentValue = getConfigValue(config, fieldPath);
+    const currentValue = await getFieldValueAsync(fieldDef, core.configManager, core.settingsManager);
     const assistant = getAssistantSession();
     if (!assistant) {
       try {
@@ -12443,23 +12709,12 @@ Choose an action:`, {
       await ctx.editMessageText(`<b>\u2699\uFE0F Settings</b>
 Tap to change:`, {
         parse_mode: "HTML",
-        reply_markup: buildSettingsKeyboard(core)
+        reply_markup: await buildSettingsKeyboard(core)
       });
     } catch {
     }
   });
 }
-function buildNestedUpdate(dotPath, value) {
-  const parts = dotPath.split(".");
-  const result = {};
-  let target = result;
-  for (let i = 0; i < parts.length - 1; i++) {
-    target[parts[i]] = {};
-    target = target[parts[i]];
-  }
-  target[parts[parts.length - 1]] = value;
-  return result;
-}
 var log18;
 var init_settings = __esm({
   "src/plugins/telegram/commands/settings.ts"() {
@@ -12534,7 +12789,7 @@ var init_config4 = __esm({
 // src/core/doctor/checks/agents.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import * as fs25 from "fs";
-import * as path28 from "path";
+import * as path29 from "path";
 function commandExists2(cmd) {
   try {
     execFileSync3("which", [cmd], { stdio: "pipe" });
@@ -12543,9 +12798,9 @@ function commandExists2(cmd) {
   }
   let dir = process.cwd();
   while (true) {
-    const binPath = path28.join(dir, "node_modules", ".bin", cmd);
+    const binPath = path29.join(dir, "node_modules", ".bin", cmd);
     if (fs25.existsSync(binPath)) return true;
-    const parent = path28.dirname(dir);
+    const parent = path29.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -12592,7 +12847,115 @@ var init_agents3 = __esm({
   }
 });
 
+// src/core/plugin/settings-manager.ts
+var settings_manager_exports = {};
+__export(settings_manager_exports, {
+  SettingsManager: () => SettingsManager
+});
+import fs26 from "fs";
+import path30 from "path";
+var SettingsManager, SettingsAPIImpl;
+var init_settings_manager = __esm({
+  "src/core/plugin/settings-manager.ts"() {
+    "use strict";
+    SettingsManager = class {
+      constructor(basePath) {
+        this.basePath = basePath;
+      }
+      getBasePath() {
+        return this.basePath;
+      }
+      createAPI(pluginName) {
+        const settingsPath = this.getSettingsPath(pluginName);
+        return new SettingsAPIImpl(settingsPath);
+      }
+      async loadSettings(pluginName) {
+        const settingsPath = this.getSettingsPath(pluginName);
+        try {
+          const content = fs26.readFileSync(settingsPath, "utf-8");
+          return JSON.parse(content);
+        } catch {
+          return {};
+        }
+      }
+      validateSettings(_pluginName, settings, schema) {
+        if (!schema) return { valid: true };
+        const result = schema.safeParse(settings);
+        if (result.success) return { valid: true };
+        return {
+          valid: false,
+          errors: result.error.errors.map(
+            (e) => `${e.path.join(".")}: ${e.message}`
+          )
+        };
+      }
+      getSettingsPath(pluginName) {
+        return path30.join(this.basePath, pluginName, "settings.json");
+      }
+      async getPluginSettings(pluginName) {
+        return this.loadSettings(pluginName);
+      }
+      async updatePluginSettings(pluginName, updates) {
+        const api = this.createAPI(pluginName);
+        const current = await api.getAll();
+        await api.setAll({ ...current, ...updates });
+      }
+    };
+    SettingsAPIImpl = class {
+      constructor(settingsPath) {
+        this.settingsPath = settingsPath;
+      }
+      cache = null;
+      readFile() {
+        if (this.cache !== null) return this.cache;
+        try {
+          const content = fs26.readFileSync(this.settingsPath, "utf-8");
+          this.cache = JSON.parse(content);
+          return this.cache;
+        } catch {
+          this.cache = {};
+          return this.cache;
+        }
+      }
+      writeFile(data) {
+        const dir = path30.dirname(this.settingsPath);
+        fs26.mkdirSync(dir, { recursive: true });
+        fs26.writeFileSync(this.settingsPath, JSON.stringify(data, null, 2));
+        this.cache = data;
+      }
+      async get(key) {
+        const data = this.readFile();
+        return data[key];
+      }
+      async set(key, value) {
+        const data = this.readFile();
+        data[key] = value;
+        this.writeFile(data);
+      }
+      async getAll() {
+        return { ...this.readFile() };
+      }
+      async setAll(settings) {
+        this.writeFile({ ...settings });
+      }
+      async delete(key) {
+        const data = this.readFile();
+        delete data[key];
+        this.writeFile(data);
+      }
+      async clear() {
+        this.writeFile({});
+      }
+      async has(key) {
+        const data = this.readFile();
+        return key in data;
+      }
+    };
+  }
+});
+
 // src/core/doctor/checks/telegram.ts
+import * as path31 from "path";
 var BOT_TOKEN_REGEX, telegramCheck;
 var init_telegram = __esm({
   "src/core/doctor/checks/telegram.ts"() {
@@ -12607,13 +12970,16 @@ var init_telegram = __esm({
           results.push({ status: "fail", message: "Cannot check Telegram \u2014 config not loaded" });
           return results;
         }
-        const tgConfig = ctx.config.channels.telegram;
-        if (!tgConfig || !tgConfig.enabled) {
-          results.push({ status: "pass", message: "Telegram not enabled (skipped)" });
+        const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
+        const sm = new SettingsManager2(path31.join(ctx.pluginsDir, "data"));
+        const ps = await sm.loadSettings("@openacp/telegram");
+        const legacyCh = ctx.config.channels.telegram;
+        const botToken = ps.botToken ?? legacyCh?.botToken;
+        const chatId = ps.chatId ?? legacyCh?.chatId;
+        if (!botToken && !chatId) {
+          results.push({ status: "pass", message: "Telegram not configured (skipped)" });
           return results;
         }
-        const botToken = tgConfig.botToken;
-        const chatId = tgConfig.chatId;
         if (!botToken || !BOT_TOKEN_REGEX.test(botToken)) {
           results.push({ status: "fail", message: "Bot token format invalid" });
           return results;
@@ -12689,7 +13055,7 @@ var init_telegram = __esm({
 });
 
 // src/core/doctor/checks/storage.ts
-import * as fs26 from "fs";
+import * as fs27 from "fs";
 var storageCheck;
 var init_storage = __esm({
   "src/core/doctor/checks/storage.ts"() {
@@ -12699,28 +13065,28 @@ var init_storage = __esm({
       order: 4,
       async run(ctx) {
         const results = [];
-        if (!fs26.existsSync(ctx.dataDir)) {
+        if (!fs27.existsSync(ctx.dataDir)) {
           results.push({
             status: "fail",
             message: "Data directory ~/.openacp does not exist",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs26.mkdirSync(ctx.dataDir, { recursive: true });
+              fs27.mkdirSync(ctx.dataDir, { recursive: true });
               return { success: true, message: "created directory" };
             }
           });
         } else {
           try {
-            fs26.accessSync(ctx.dataDir, fs26.constants.W_OK);
+            fs27.accessSync(ctx.dataDir, fs27.constants.W_OK);
             results.push({ status: "pass", message: "Data directory exists and writable" });
           } catch {
             results.push({ status: "fail", message: "Data directory not writable" });
           }
         }
-        if (fs26.existsSync(ctx.sessionsPath)) {
+        if (fs27.existsSync(ctx.sessionsPath)) {
           try {
-            const content = fs26.readFileSync(ctx.sessionsPath, "utf-8");
+            const content = fs27.readFileSync(ctx.sessionsPath, "utf-8");
             const data = JSON.parse(content);
             if (typeof data === "object" && data !== null && "sessions" in data) {
               results.push({ status: "pass", message: "Sessions file valid" });
@@ -12731,7 +13097,7 @@ var init_storage = __esm({
                 fixable: true,
                 fixRisk: "risky",
                 fix: async () => {
-                  fs26.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
+                  fs27.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
                   return { success: true, message: "reset sessions file" };
                 }
               });
@@ -12743,7 +13109,7 @@ var init_storage = __esm({
               fixable: true,
               fixRisk: "risky",
               fix: async () => {
-                fs26.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
+                fs27.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
                 return { success: true, message: "reset sessions file" };
               }
             });
@@ -12751,20 +13117,20 @@ var init_storage = __esm({
         } else {
           results.push({ status: "pass", message: "Sessions file not present yet (created on first session)" });
         }
-        if (!fs26.existsSync(ctx.logsDir)) {
+        if (!fs27.existsSync(ctx.logsDir)) {
           results.push({
             status: "warn",
             message: "Log directory does not exist",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs26.mkdirSync(ctx.logsDir, { recursive: true });
+              fs27.mkdirSync(ctx.logsDir, { recursive: true });
               return { success: true, message: "created log directory" };
             }
           });
         } else {
           try {
-            fs26.accessSync(ctx.logsDir, fs26.constants.W_OK);
+            fs27.accessSync(ctx.logsDir, fs27.constants.W_OK);
             results.push({ status: "pass", message: "Log directory exists and writable" });
           } catch {
             results.push({ status: "fail", message: "Log directory not writable" });
@@ -12777,7 +13143,7 @@ var init_storage = __esm({
 });
 
 // src/core/doctor/checks/workspace.ts
-import * as fs27 from "fs";
+import * as fs28 from "fs";
 var workspaceCheck;
 var init_workspace2 = __esm({
   "src/core/doctor/checks/workspace.ts"() {
@@ -12793,20 +13159,20 @@ var init_workspace2 = __esm({
           return results;
         }
         const baseDir = expandHome3(ctx.config.workspace.baseDir);
-        if (!fs27.existsSync(baseDir)) {
+        if (!fs28.existsSync(baseDir)) {
           results.push({
             status: "warn",
             message: `Workspace directory does not exist: ${baseDir}`,
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs27.mkdirSync(baseDir, { recursive: true });
+              fs28.mkdirSync(baseDir, { recursive: true });
               return { success: true, message: "created directory" };
             }
           });
         } else {
           try {
-            fs27.accessSync(baseDir, fs27.constants.W_OK);
+            fs28.accessSync(baseDir, fs28.constants.W_OK);
             results.push({ status: "pass", message: `Workspace directory exists: ${baseDir}` });
           } catch {
             results.push({ status: "fail", message: `Workspace directory not writable: ${baseDir}` });
@@ -12819,10 +13185,10 @@ var init_workspace2 = __esm({
 });
 
 // src/core/doctor/checks/plugins.ts
-import * as fs28 from "fs";
-import * as path29 from "path";
+import * as fs29 from "fs";
+import * as path32 from "path";
 var pluginsCheck;
-var init_plugins = __esm({
+var init_plugins2 = __esm({
   "src/core/doctor/checks/plugins.ts"() {
     "use strict";
     pluginsCheck = {
@@ -12830,16 +13196,16 @@ var init_plugins = __esm({
       order: 6,
       async run(ctx) {
         const results = [];
-        if (!fs28.existsSync(ctx.pluginsDir)) {
+        if (!fs29.existsSync(ctx.pluginsDir)) {
           results.push({
             status: "warn",
             message: "Plugins directory does not exist",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs28.mkdirSync(ctx.pluginsDir, { recursive: true });
-              fs28.writeFileSync(
-                path29.join(ctx.pluginsDir, "package.json"),
+              fs29.mkdirSync(ctx.pluginsDir, { recursive: true });
+              fs29.writeFileSync(
+                path32.join(ctx.pluginsDir, "package.json"),
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
               return { success: true, message: "initialized plugins directory" };
@@ -12848,15 +13214,15 @@ var init_plugins = __esm({
           return results;
         }
         results.push({ status: "pass", message: "Plugins directory exists" });
-        const pkgPath = path29.join(ctx.pluginsDir, "package.json");
-        if (!fs28.existsSync(pkgPath)) {
+        const pkgPath = path32.join(ctx.pluginsDir, "package.json");
+        if (!fs29.existsSync(pkgPath)) {
           results.push({
             status: "warn",
             message: "Plugins package.json missing",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs28.writeFileSync(
+              fs29.writeFileSync(
                 pkgPath,
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
@@ -12866,7 +13232,7 @@ var init_plugins = __esm({
           return results;
         }
         try {
-          const pkg = JSON.parse(fs28.readFileSync(pkgPath, "utf-8"));
+          const pkg = JSON.parse(fs29.readFileSync(pkgPath, "utf-8"));
           const deps = pkg.dependencies || {};
           const count = Object.keys(deps).length;
           results.push({ status: "pass", message: `Plugins package.json valid (${count} plugins)` });
@@ -12877,7 +13243,7 @@ var init_plugins = __esm({
             fixable: true,
             fixRisk: "risky",
             fix: async () => {
-              fs28.writeFileSync(
+              fs29.writeFileSync(
                 pkgPath,
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
@@ -12892,7 +13258,7 @@ var init_plugins = __esm({
 });
 
 // src/core/doctor/checks/daemon.ts
-import * as fs29 from "fs";
+import * as fs30 from "fs";
 import * as net from "net";
 function isProcessAlive(pid) {
   try {
@@ -12922,8 +13288,8 @@ var init_daemon = __esm({
       order: 7,
       async run(ctx) {
         const results = [];
-        if (fs29.existsSync(ctx.pidPath)) {
-          const content = fs29.readFileSync(ctx.pidPath, "utf-8").trim();
+        if (fs30.existsSync(ctx.pidPath)) {
+          const content = fs30.readFileSync(ctx.pidPath, "utf-8").trim();
           const pid = parseInt(content, 10);
           if (isNaN(pid)) {
             results.push({
@@ -12932,7 +13298,7 @@ var init_daemon = __esm({
               fixable: true,
               fixRisk: "safe",
               fix: async () => {
-                fs29.unlinkSync(ctx.pidPath);
+                fs30.unlinkSync(ctx.pidPath);
                 return { success: true, message: "removed invalid PID file" };
               }
             });
@@ -12943,7 +13309,7 @@ var init_daemon = __esm({
               fixable: true,
               fixRisk: "safe",
               fix: async () => {
-                fs29.unlinkSync(ctx.pidPath);
+                fs30.unlinkSync(ctx.pidPath);
                 return { success: true, message: "removed stale PID file" };
               }
             });
@@ -12951,8 +13317,8 @@ var init_daemon = __esm({
             results.push({ status: "pass", message: `Daemon running (PID ${pid})` });
           }
         }
-        if (fs29.existsSync(ctx.portFilePath)) {
-          const content = fs29.readFileSync(ctx.portFilePath, "utf-8").trim();
+        if (fs30.existsSync(ctx.portFilePath)) {
+          const content = fs30.readFileSync(ctx.portFilePath, "utf-8").trim();
           const port = parseInt(content, 10);
           if (isNaN(port)) {
             results.push({
@@ -12961,7 +13327,7 @@ var init_daemon = __esm({
               fixable: true,
               fixRisk: "safe",
               fix: async () => {
-                fs29.unlinkSync(ctx.portFilePath);
+                fs30.unlinkSync(ctx.portFilePath);
                 return { success: true, message: "removed invalid port file" };
               }
             });
@@ -12973,8 +13339,8 @@ var init_daemon = __esm({
           const apiPort = ctx.config.api.port;
           const inUse = await checkPortInUse(apiPort);
           if (inUse) {
-            if (fs29.existsSync(ctx.pidPath)) {
-              const pid = parseInt(fs29.readFileSync(ctx.pidPath, "utf-8").trim(), 10);
+            if (fs30.existsSync(ctx.pidPath)) {
+              const pid = parseInt(fs30.readFileSync(ctx.pidPath, "utf-8").trim(), 10);
               if (!isNaN(pid) && isProcessAlive(pid)) {
                 results.push({ status: "pass", message: `API port ${apiPort} in use by OpenACP daemon` });
               } else {
@@ -12994,9 +13360,9 @@ var init_daemon = __esm({
 });
 
 // src/core/doctor/checks/tunnel.ts
-import * as fs30 from "fs";
-import * as path30 from "path";
-import * as os12 from "os";
+import * as fs31 from "fs";
+import * as path33 from "path";
+import * as os13 from "os";
 import { execFileSync as execFileSync4 } from "child_process";
 var tunnelCheck;
 var init_tunnel3 = __esm({
@@ -13018,10 +13384,10 @@ var init_tunnel3 = __esm({
         const provider = ctx.config.tunnel.provider;
         results.push({ status: "pass", message: `Tunnel provider: ${provider}` });
         if (provider === "cloudflare") {
-          const binName = os12.platform() === "win32" ? "cloudflared.exe" : "cloudflared";
-          const binPath = path30.join(ctx.dataDir, "bin", binName);
+          const binName = os13.platform() === "win32" ? "cloudflared.exe" : "cloudflared";
+          const binPath = path33.join(ctx.dataDir, "bin", binName);
           let found = false;
-          if (fs30.existsSync(binPath)) {
+          if (fs31.existsSync(binPath)) {
             found = true;
           } else {
             try {
@@ -13067,8 +13433,8 @@ var doctor_exports = {};
 __export(doctor_exports, {
   DoctorEngine: () => DoctorEngine
 });
-import * as fs31 from "fs";
-import * as path31 from "path";
+import * as fs32 from "fs";
+import * as path34 from "path";
 var ALL_CHECKS, CHECK_TIMEOUT_MS, DoctorEngine;
 var init_doctor = __esm({
   "src/core/doctor/index.ts"() {
@@ -13080,7 +13446,7 @@ var init_doctor = __esm({
     init_telegram();
     init_storage();
     init_workspace2();
-    init_plugins();
+    init_plugins2();
     init_daemon();
     init_tunnel3();
     ALL_CHECKS = [
@@ -13150,27 +13516,27 @@ var init_doctor = __esm({
       }
       async buildContext() {
         const dataDir = this.dataDir;
-        const configPath = process.env.OPENACP_CONFIG_PATH || path31.join(dataDir, "config.json");
+        const configPath = process.env.OPENACP_CONFIG_PATH || path34.join(dataDir, "config.json");
         let config = null;
         let rawConfig = null;
         try {
-          const content = fs31.readFileSync(configPath, "utf-8");
+          const content = fs32.readFileSync(configPath, "utf-8");
           rawConfig = JSON.parse(content);
           const cm = new ConfigManager(configPath);
           await cm.load();
           config = cm.get();
         } catch {
         }
-        const logsDir = config ? expandHome3(config.logging.logDir) : path31.join(dataDir, "logs");
+        const logsDir = config ? expandHome3(config.logging.logDir) : path34.join(dataDir, "logs");
         return {
           config,
           rawConfig,
           configPath,
           dataDir,
-          sessionsPath: path31.join(dataDir, "sessions.json"),
-          pidPath: path31.join(dataDir, "openacp.pid"),
-          portFilePath: path31.join(dataDir, "api.port"),
-          pluginsDir: path31.join(dataDir, "plugins"),
+          sessionsPath: path34.join(dataDir, "sessions.json"),
+          pidPath: path34.join(dataDir, "openacp.pid"),
+          portFilePath: path34.join(dataDir, "api.port"),
+          pluginsDir: path34.join(dataDir, "plugins"),
           logsDir
         };
       }
@@ -16907,113 +17273,6 @@ var init_core_plugins = __esm({
   }
 });
 
-// src/core/plugin/settings-manager.ts
-var settings_manager_exports = {};
-__export(settings_manager_exports, {
-  SettingsManager: () => SettingsManager
-});
-import fs32 from "fs";
-import path32 from "path";
-var SettingsManager, SettingsAPIImpl;
-var init_settings_manager = __esm({
-  "src/core/plugin/settings-manager.ts"() {
-    "use strict";
-    SettingsManager = class {
-      constructor(basePath) {
-        this.basePath = basePath;
-      }
-      getBasePath() {
-        return this.basePath;
-      }
-      createAPI(pluginName) {
-        const settingsPath = this.getSettingsPath(pluginName);
-        return new SettingsAPIImpl(settingsPath);
-      }
-      async loadSettings(pluginName) {
-        const settingsPath = this.getSettingsPath(pluginName);
-        try {
-          const content = fs32.readFileSync(settingsPath, "utf-8");
-          return JSON.parse(content);
-        } catch {
-          return {};
-        }
-      }
-      validateSettings(_pluginName, settings, schema) {
-        if (!schema) return { valid: true };
-        const result = schema.safeParse(settings);
-        if (result.success) return { valid: true };
-        return {
-          valid: false,
-          errors: result.error.errors.map(
-            (e) => `${e.path.join(".")}: ${e.message}`
-          )
-        };
-      }
-      getSettingsPath(pluginName) {
-        return path32.join(this.basePath, pluginName, "settings.json");
-      }
-      async getPluginSettings(pluginName) {
-        return this.loadSettings(pluginName);
-      }
-      async updatePluginSettings(pluginName, updates) {
-        const api = this.createAPI(pluginName);
-        const current = await api.getAll();
-        await api.setAll({ ...current, ...updates });
-      }
-    };
-    SettingsAPIImpl = class {
-      constructor(settingsPath) {
-        this.settingsPath = settingsPath;
-      }
-      cache = null;
-      readFile() {
-        if (this.cache !== null) return this.cache;
-        try {
-          const content = fs32.readFileSync(this.settingsPath, "utf-8");
-          this.cache = JSON.parse(content);
-          return this.cache;
-        } catch {
-          this.cache = {};
-          return this.cache;
-        }
-      }
-      writeFile(data) {
-        const dir = path32.dirname(this.settingsPath);
-        fs32.mkdirSync(dir, { recursive: true });
-        fs32.writeFileSync(this.settingsPath, JSON.stringify(data, null, 2));
-        this.cache = data;
-      }
-      async get(key) {
-        const data = this.readFile();
-        return data[key];
-      }
-      async set(key, value) {
-        const data = this.readFile();
-        data[key] = value;
-        this.writeFile(data);
-      }
-      async getAll() {
-        return { ...this.readFile() };
-      }
-      async setAll(settings) {
-        this.writeFile({ ...settings });
-      }
-      async delete(key) {
-        const data = this.readFile();
-        delete data[key];
-        this.writeFile(data);
-      }
-      async clear() {
-        this.writeFile({});
-      }
-      async has(key) {
-        const data = this.readFile();
-        return key in data;
-      }
-    };
-  }
-});
-
 // src/core/plugin/terminal-io.ts
 import * as clack from "@clack/prompts";
 function isCancel(value) {
@@ -17077,10 +17336,10 @@ var install_context_exports = {};
 __export(install_context_exports, {
   createInstallContext: () => createInstallContext
 });
-import path33 from "path";
+import path35 from "path";
 function createInstallContext(opts) {
   const { pluginName, settingsManager, basePath, legacyConfig, instanceRoot } = opts;
-  const dataDir = path33.join(basePath, pluginName, "data");
+  const dataDir = path35.join(basePath, pluginName, "data");
   return {
     pluginName,
     terminal: createTerminalIO(),
@@ -17108,13 +17367,13 @@ __export(api_client_exports, {
   removeStalePortFile: () => removeStalePortFile
 });
 import * as fs33 from "fs";
-import * as path34 from "path";
-import * as os13 from "os";
+import * as path36 from "path";
+import * as os14 from "os";
 function defaultPortFile(root) {
-  return path34.join(root ?? DEFAULT_ROOT, "api.port");
+  return path36.join(root ?? DEFAULT_ROOT, "api.port");
 }
 function defaultSecretFile(root) {
-  return path34.join(root ?? DEFAULT_ROOT, "api-secret");
+  return path36.join(root ?? DEFAULT_ROOT, "api-secret");
 }
 function readApiPort(portFilePath, instanceRoot) {
   const filePath = portFilePath ?? defaultPortFile(instanceRoot);
@@ -17154,7 +17413,7 @@ var DEFAULT_ROOT;
 var init_api_client = __esm({
   "src/cli/api-client.ts"() {
     "use strict";
-    DEFAULT_ROOT = path34.join(os13.homedir(), ".openacp");
+    DEFAULT_ROOT = path36.join(os14.homedir(), ".openacp");
   }
 });
 
@@ -17202,16 +17461,16 @@ var init_suggest = __esm({
 
 // src/cli/instance-hint.ts
 import fs34 from "fs";
-import path35 from "path";
-import os14 from "os";
+import path37 from "path";
+import os15 from "os";
 function printInstanceHint(root) {
   const globalRoot = getGlobalRoot();
   const isGlobal = root === globalRoot;
-  const displayPath = root.replace(os14.homedir(), "~");
+  const displayPath = root.replace(os15.homedir(), "~");
   const label = isGlobal ? "global" : "local";
   console.log(`  Workspace: ${label} \u2014 ${displayPath}`);
   if (isGlobal) {
-    const localRoot = path35.join(process.cwd(), ".openacp");
+    const localRoot = path37.join(process.cwd(), ".openacp");
     if (fs34.existsSync(localRoot)) {
       console.log(`  \x1B[2mhint: local workspace exists in current directory \u2014 use --local to use it\x1B[0m`);
     }
@@ -17243,22 +17502,22 @@ __export(daemon_exports, {
 });
 import { spawn as spawn6 } from "child_process";
 import * as fs35 from "fs";
-import * as path36 from "path";
-import * as os15 from "os";
+import * as path38 from "path";
+import * as os16 from "os";
 function getPidPath(root) {
   const base = root ?? DEFAULT_ROOT2;
-  return path36.join(base, "openacp.pid");
+  return path38.join(base, "openacp.pid");
 }
 function getLogDir(root) {
   const base = root ?? DEFAULT_ROOT2;
-  return path36.join(base, "logs");
+  return path38.join(base, "logs");
 }
 function getRunningMarker(root) {
   const base = root ?? DEFAULT_ROOT2;
-  return path36.join(base, "running");
+  return path38.join(base, "running");
 }
 function writePidFile(pidPath, pid) {
-  const dir = path36.dirname(pidPath);
+  const dir = path38.dirname(pidPath);
   fs35.mkdirSync(dir, { recursive: true });
   fs35.writeFileSync(pidPath, String(pid));
 }
@@ -17307,8 +17566,8 @@ function startDaemon(pidPath = getPidPath(), logDir2, instanceRoot) {
   }
   const resolvedLogDir = logDir2 ? expandHome3(logDir2) : getLogDir(instanceRoot);
   fs35.mkdirSync(resolvedLogDir, { recursive: true });
-  const logFile = path36.join(resolvedLogDir, "openacp.log");
-  const cliPath = path36.resolve(process.argv[1]);
+  const logFile = path38.join(resolvedLogDir, "openacp.log");
+  const cliPath = path38.resolve(process.argv[1]);
   const nodePath = process.execPath;
   const out = fs35.openSync(logFile, "a");
   const err = fs35.openSync(logFile, "a");
@@ -17392,7 +17651,7 @@ async function stopDaemon(pidPath = getPidPath(), instanceRoot) {
 }
 function markRunning(root) {
   const marker = getRunningMarker(root);
-  fs35.mkdirSync(path36.dirname(marker), { recursive: true });
+  fs35.mkdirSync(path38.dirname(marker), { recursive: true });
   fs35.writeFileSync(marker, "");
 }
 function clearRunning(root) {
@@ -17409,7 +17668,7 @@ var init_daemon2 = __esm({
   "src/cli/daemon.ts"() {
     "use strict";
     init_config2();
-    DEFAULT_ROOT2 = path36.join(os15.homedir(), ".openacp");
+    DEFAULT_ROOT2 = path38.join(os16.homedir(), ".openacp");
   }
 });
 
@@ -17418,12 +17677,12 @@ var stop_exports = {};
 __export(stop_exports, {
   cmdStop: () => cmdStop
 });
-import path38 from "path";
-import os17 from "os";
+import path40 from "path";
+import os18 from "os";
 async function cmdStop(args2 = [], instanceRoot) {
   const json = isJsonMode(args2);
   if (json) await muteForJson();
-  const root = instanceRoot ?? path38.join(os17.homedir(), ".openacp");
+  const root = instanceRoot ?? path40.join(os18.homedir(), ".openacp");
   if (!json && wantsHelp(args2)) {
     console.log(`
 \x1B[1mopenacp stop\x1B[0m \u2014 Stop the background daemon
@@ -17765,7 +18024,7 @@ var init_mcp_manager = __esm({
 
 // src/core/utils/debug-tracer.ts
 import fs37 from "fs";
-import path39 from "path";
+import path41 from "path";
 function createDebugTracer(sessionId, workingDirectory) {
   if (!DEBUG_ENABLED) return null;
   return new DebugTracer(sessionId, workingDirectory);
@@ -17779,7 +18038,7 @@ var init_debug_tracer = __esm({
       constructor(sessionId, workingDirectory) {
         this.sessionId = sessionId;
         this.workingDirectory = workingDirectory;
-        this.logDir = path39.join(workingDirectory, ".log");
+        this.logDir = path41.join(workingDirectory, ".log");
       }
       dirCreated = false;
       logDir;
@@ -17789,7 +18048,7 @@ var init_debug_tracer = __esm({
             fs37.mkdirSync(this.logDir, { recursive: true });
             this.dirCreated = true;
           }
-          const filePath = path39.join(this.logDir, `${this.sessionId}_${layer}.jsonl`);
+          const filePath = path41.join(this.logDir, `${this.sessionId}_${layer}.jsonl`);
           const seen = /* @__PURE__ */ new WeakSet();
           const line = JSON.stringify({ ts: Date.now(), ...data }, (_key, value) => {
             if (typeof value === "object" && value !== null) {
@@ -17813,16 +18072,16 @@ var init_debug_tracer = __esm({
 import { spawn as spawn8, execFileSync as execFileSync5 } from "child_process";
 import { Transform } from "stream";
 import fs38 from "fs";
-import path40 from "path";
+import path42 from "path";
 import { ClientSideConnection, ndJsonStream } from "@agentclientprotocol/sdk";
 import { PROTOCOL_VERSION } from "@agentclientprotocol/sdk";
 function findPackageRoot(startDir) {
   let dir = startDir;
-  while (dir !== path40.dirname(dir)) {
-    if (fs38.existsSync(path40.join(dir, "package.json"))) {
+  while (dir !== path42.dirname(dir)) {
+    if (fs38.existsSync(path42.join(dir, "package.json"))) {
       return dir;
     }
-    dir = path40.dirname(dir);
+    dir = path42.dirname(dir);
   }
   return startDir;
 }
@@ -17834,8 +18093,8 @@ function resolveAgentCommand(cmd) {
   }
   for (const root of searchRoots) {
     const packageDirs = [
-      path40.resolve(root, "node_modules", "@zed-industries", cmd, "dist", "index.js"),
-      path40.resolve(root, "node_modules", cmd, "dist", "index.js")
+      path42.resolve(root, "node_modules", "@zed-industries", cmd, "dist", "index.js"),
+      path42.resolve(root, "node_modules", cmd, "dist", "index.js")
     ];
     for (const jsPath of packageDirs) {
       if (fs38.existsSync(jsPath)) {
@@ -17844,7 +18103,7 @@ function resolveAgentCommand(cmd) {
     }
   }
   for (const root of searchRoots) {
-    const localBin = path40.resolve(root, "node_modules", ".bin", cmd);
+    const localBin = path42.resolve(root, "node_modules", ".bin", cmd);
     if (fs38.existsSync(localBin)) {
       const content = fs38.readFileSync(localBin, "utf-8");
       if (content.startsWith("#!/usr/bin/env node")) {
@@ -17852,7 +18111,7 @@ function resolveAgentCommand(cmd) {
       }
       const match = content.match(/"([^"]+\.js)"/);
       if (match) {
-        const target = path40.resolve(path40.dirname(localBin), match[1]);
+        const target = path42.resolve(path42.dirname(localBin), match[1]);
         if (fs38.existsSync(target)) {
           return { command: process.execPath, args: [target] };
         }
@@ -18253,7 +18512,7 @@ ${stderr}`
               writePath = result.path;
               writeContent = result.content;
             }
-            await fs38.promises.mkdir(path40.dirname(writePath), { recursive: true });
+            await fs38.promises.mkdir(path42.dirname(writePath), { recursive: true });
             await fs38.promises.writeFile(writePath, writeContent, "utf-8");
             return {};
           },
@@ -19865,7 +20124,7 @@ var init_message_transformer = __esm({
 
 // src/core/sessions/session-store.ts
 import fs40 from "fs";
-import path41 from "path";
+import path43 from "path";
 var log30, DEBOUNCE_MS2, JsonFileSessionStore;
 var init_session_store = __esm({
   "src/core/sessions/session-store.ts"() {
@@ -19941,7 +20200,7 @@ var init_session_store = __esm({
           version: 1,
           sessions: Object.fromEntries(this.records)
         };
-        const dir = path41.dirname(this.filePath);
+        const dir = path43.dirname(this.filePath);
         if (!fs40.existsSync(dir)) fs40.mkdirSync(dir, { recursive: true });
         fs40.writeFileSync(this.filePath, JSON.stringify(data, null, 2));
       }
@@ -20516,8 +20775,8 @@ __export(agent_store_exports, {
   AgentStore: () => AgentStore
 });
 import * as fs41 from "fs";
-import * as path42 from "path";
-import * as os18 from "os";
+import * as path44 from "path";
+import * as os19 from "os";
 import { z as z7 } from "zod";
 var log33, InstalledAgentSchema, AgentStoreSchema, AgentStore;
 var init_agent_store = __esm({
@@ -20545,7 +20804,7 @@ var init_agent_store = __esm({
       data = { version: 1, installed: {} };
       filePath;
       constructor(filePath) {
-        this.filePath = filePath ?? path42.join(os18.homedir(), ".openacp", "agents.json");
+        this.filePath = filePath ?? path44.join(os19.homedir(), ".openacp", "agents.json");
       }
       load() {
         if (!fs41.existsSync(this.filePath)) {
@@ -20587,7 +20846,7 @@ var init_agent_store = __esm({
         return key in this.data.installed;
       }
       save() {
-        fs41.mkdirSync(path42.dirname(this.filePath), { recursive: true });
+        fs41.mkdirSync(path44.dirname(this.filePath), { recursive: true });
         const tmpPath = this.filePath + ".tmp";
         fs41.writeFileSync(tmpPath, JSON.stringify(this.data, null, 2));
         fs41.renameSync(tmpPath, this.filePath);
@@ -20598,8 +20857,8 @@ var init_agent_store = __esm({
 
 // src/core/agents/agent-installer.ts
 import * as fs42 from "fs";
-import * as path43 from "path";
-import * as os19 from "os";
+import * as path45 from "path";
+import * as os20 from "os";
 function getPlatformKey() {
   const platform2 = PLATFORM_MAP[process.platform] ?? process.platform;
   const arch = ARCH_MAP[process.arch] ?? process.arch;
@@ -20650,7 +20909,7 @@ function buildInstalledAgent(registryId, name, version, dist, binaryPath) {
       binaryPath: null
     };
   }
-  const absCmd = path43.resolve(binaryPath, dist.cmd);
+  const absCmd = path45.resolve(binaryPath, dist.cmd);
   return {
     registryId,
     name,
@@ -20723,7 +20982,7 @@ Install it with: pip install uv`;
   return { ok: true, agentKey, setupSteps: setup?.setupSteps };
 }
 async function downloadAndExtract(agentId, archiveUrl, progress, agentsDir) {
-  const destDir = path43.join(agentsDir ?? DEFAULT_AGENTS_DIR, agentId);
+  const destDir = path45.join(agentsDir ?? DEFAULT_AGENTS_DIR, agentId);
   fs42.mkdirSync(destDir, { recursive: true });
   await progress?.onStep("Downloading...");
   log34.info({ agentId, url: archiveUrl }, "Downloading agent binary");
@@ -20767,15 +21026,15 @@ function validateExtractedPaths(destDir) {
   for (const entry of entries) {
     const dirent = entry;
     const parentPath = dirent.parentPath ?? dirent.path ?? destDir;
-    const fullPath = path43.join(parentPath, entry.name);
+    const fullPath = path45.join(parentPath, entry.name);
     let realPath;
     try {
       realPath = fs42.realpathSync(fullPath);
     } catch {
       const linkTarget = fs42.readlinkSync(fullPath);
-      realPath = path43.resolve(path43.dirname(fullPath), linkTarget);
+      realPath = path45.resolve(path45.dirname(fullPath), linkTarget);
     }
-    if (!realPath.startsWith(realDest + path43.sep) && realPath !== realDest) {
+    if (!realPath.startsWith(realDest + path45.sep) && realPath !== realDest) {
       fs42.rmSync(destDir, { recursive: true, force: true });
       throw new Error(`Archive contains unsafe path: ${entry.name}`);
     }
@@ -20783,7 +21042,7 @@ function validateExtractedPaths(destDir) {
 }
 async function extractTarGz(buffer, destDir) {
   const { execFileSync: execFileSync8 } = await import("child_process");
-  const tmpFile = path43.join(destDir, "_archive.tar.gz");
+  const tmpFile = path45.join(destDir, "_archive.tar.gz");
   fs42.writeFileSync(tmpFile, buffer);
   try {
     execFileSync8("tar", ["xzf", tmpFile, "-C", destDir], { stdio: "pipe" });
@@ -20794,7 +21053,7 @@ async function extractTarGz(buffer, destDir) {
 }
 async function extractZip(buffer, destDir) {
   const { execFileSync: execFileSync8 } = await import("child_process");
-  const tmpFile = path43.join(destDir, "_archive.zip");
+  const tmpFile = path45.join(destDir, "_archive.zip");
   fs42.writeFileSync(tmpFile, buffer);
   try {
     execFileSync8("unzip", ["-o", tmpFile, "-d", destDir], { stdio: "pipe" });
@@ -20819,7 +21078,7 @@ var init_agent_installer = __esm({
     init_log();
     init_agent_dependencies();
     log34 = createChildLogger({ module: "agent-installer" });
-    DEFAULT_AGENTS_DIR = path43.join(os19.homedir(), ".openacp", "agents");
+    DEFAULT_AGENTS_DIR = path45.join(os20.homedir(), ".openacp", "agents");
     ARCH_MAP = {
       arm64: "aarch64",
       x64: "x86_64"
@@ -20838,8 +21097,8 @@ __export(agent_catalog_exports, {
   AgentCatalog: () => AgentCatalog
 });
 import * as fs43 from "fs";
-import * as path44 from "path";
-import * as os20 from "os";
+import * as path46 from "path";
+import * as os21 from "os";
 var log35, REGISTRY_URL2, DEFAULT_TTL_HOURS, AgentCatalog;
 var init_agent_catalog = __esm({
   "src/core/agents/agent-catalog.ts"() {
@@ -20858,7 +21117,7 @@ var init_agent_catalog = __esm({
       agentsDir;
       constructor(store, cachePath, agentsDir) {
         this.store = store ?? new AgentStore();
-        this.cachePath = cachePath ?? path44.join(os20.homedir(), ".openacp", "registry-cache.json");
+        this.cachePath = cachePath ?? path46.join(os21.homedir(), ".openacp", "registry-cache.json");
         this.agentsDir = agentsDir;
       }
       load() {
@@ -20879,7 +21138,7 @@ var init_agent_catalog = __esm({
             ttlHours: DEFAULT_TTL_HOURS,
             data
           };
-          fs43.mkdirSync(path44.dirname(this.cachePath), { recursive: true });
+          fs43.mkdirSync(path46.dirname(this.cachePath), { recursive: true });
           fs43.writeFileSync(this.cachePath, JSON.stringify(cache, null, 2));
           log35.info({ count: this.registryAgents.length }, "Registry updated");
         } catch (err) {
@@ -21065,9 +21324,9 @@ var init_agent_catalog = __esm({
         }
         try {
           const candidates = [
-            path44.join(import.meta.dirname, "data", "registry-snapshot.json"),
-            path44.join(import.meta.dirname, "..", "data", "registry-snapshot.json"),
-            path44.join(import.meta.dirname, "..", "..", "data", "registry-snapshot.json")
+            path46.join(import.meta.dirname, "data", "registry-snapshot.json"),
+            path46.join(import.meta.dirname, "..", "data", "registry-snapshot.json"),
+            path46.join(import.meta.dirname, "..", "..", "data", "registry-snapshot.json")
           ];
           for (const candidate of candidates) {
             if (fs43.existsSync(candidate)) {
@@ -21365,7 +21624,7 @@ var init_error_tracker = __esm({
 
 // src/core/plugin/plugin-storage.ts
 import fs44 from "fs";
-import path45 from "path";
+import path47 from "path";
 var PluginStorageImpl;
 var init_plugin_storage = __esm({
   "src/core/plugin/plugin-storage.ts"() {
@@ -21375,8 +21634,8 @@ var init_plugin_storage = __esm({
       dataDir;
       writeChain = Promise.resolve();
       constructor(baseDir) {
-        this.dataDir = path45.join(baseDir, "data");
-        this.kvPath = path45.join(baseDir, "kv.json");
+        this.dataDir = path47.join(baseDir, "data");
+        this.kvPath = path47.join(baseDir, "kv.json");
         fs44.mkdirSync(baseDir, { recursive: true });
       }
       readKv() {
@@ -21422,8 +21681,8 @@ var init_plugin_storage = __esm({
 });
 
 // src/core/plugin/plugin-context.ts
-import path46 from "path";
-import os21 from "os";
+import path48 from "path";
+import os22 from "os";
 function requirePermission(permissions, required, action) {
   if (!permissions.includes(required)) {
     throw new Error(`Plugin does not have '${required}' permission required for ${action}`);
@@ -21442,7 +21701,7 @@ function createPluginContext(opts) {
     config,
     core
   } = opts;
-  const instanceRoot = opts.instanceRoot ?? path46.join(os21.homedir(), ".openacp");
+  const instanceRoot = opts.instanceRoot ?? path48.join(os22.homedir(), ".openacp");
   const registeredListeners = [];
   const registeredCommands = [];
   const noopLog = {
@@ -21665,7 +21924,7 @@ var init_lifecycle_manager = __esm({
       log;
       settingsManager;
       pluginRegistry;
-      instanceRoot;
+      _instanceRoot;
       contexts = /* @__PURE__ */ new Map();
       loadOrder = [];
       _loaded = /* @__PURE__ */ new Set();
@@ -21679,6 +21938,14 @@ var init_lifecycle_manager = __esm({
       get registry() {
         return this.pluginRegistry;
       }
+      /** Plugin definitions currently in load order (loaded + failed). */
+      get plugins() {
+        return [...this.loadOrder];
+      }
+      /** Root directory of this OpenACP instance (e.g. ~/.openacp). */
+      get instanceRoot() {
+        return this._instanceRoot;
+      }
       constructor(opts) {
         this.serviceRegistry = opts?.serviceRegistry ?? new ServiceRegistry();
         this.middlewareChain = opts?.middlewareChain ?? new MiddlewareChain();
@@ -21698,7 +21965,7 @@ var init_lifecycle_manager = __esm({
         this.log = opts?.log;
         this.settingsManager = opts?.settingsManager;
         this.pluginRegistry = opts?.pluginRegistry;
-        this.instanceRoot = opts?.instanceRoot;
+        this._instanceRoot = opts?.instanceRoot;
       }
       getPluginLogger(pluginName) {
         if (this.log && typeof this.log.child === "function") {
@@ -21809,7 +22076,7 @@ var init_lifecycle_manager = __esm({
             config: this.config,
             core: this.core,
             log: this.log,
-            instanceRoot: this.instanceRoot
+            instanceRoot: this._instanceRoot
           });
           try {
             await withTimeout(plugin2.setup(ctx), SETUP_TIMEOUT_MS, `${plugin2.name}.setup()`);
@@ -22285,8 +22552,8 @@ var init_core_items = __esm({
 });
 
 // src/core/core.ts
-import path47 from "path";
-import os22 from "os";
+import path49 from "path";
+import os23 from "os";
 var log39, OpenACPCore;
 var init_core = __esm({
   "src/core/core.ts"() {
@@ -22354,6 +22621,9 @@ var init_core = __esm({
       get contextManager() {
         return this.getService("context");
       }
+      get settingsManager() {
+        return this.lifecycleManager.settingsManager;
+      }
       constructor(configManager, ctx) {
         this.configManager = configManager;
         this.instanceContext = ctx;
@@ -22365,7 +22635,7 @@ var init_core = __esm({
         );
         this.agentCatalog.load();
         this.agentManager = new AgentManager(this.agentCatalog);
-        const storePath = ctx?.paths.sessions ?? path47.join(os22.homedir(), ".openacp", "sessions.json");
+        const storePath = ctx?.paths.sessions ?? path49.join(os23.homedir(), ".openacp", "sessions.json");
         this.sessionStore = new JsonFileSessionStore(
           storePath,
           config.sessionStore.ttlDays
@@ -22389,7 +22659,7 @@ var init_core = __esm({
           sessions: this.sessionManager,
           config: this.configManager,
           core: this,
-          storagePath: ctx?.paths.pluginsData ?? path47.join(os22.homedir(), ".openacp", "plugins", "data"),
+          storagePath: ctx?.paths.pluginsData ?? path49.join(os23.homedir(), ".openacp", "plugins", "data"),
           instanceRoot: ctx?.root,
           log: createChildLogger({ module: "plugin" })
         });
@@ -22421,22 +22691,36 @@ var init_core = __esm({
               log39.info({ level: value }, "Log level changed at runtime");
             }
             if (configPath.startsWith("speech.")) {
-              const speechSvc = this.speechService;
+              const speechSvc = this.lifecycleManager.serviceRegistry.get("speech");
               if (speechSvc) {
-                const newConfig = this.configManager.get();
-                const newSpeechConfig = newConfig.speech ?? {
-                  stt: { provider: null, providers: {} },
-                  tts: { provider: null, providers: {} }
-                };
-                speechSvc.refreshProviders(newSpeechConfig);
-                log39.info("Speech service config updated at runtime");
+                const settingsMgr = this.settingsManager;
+                if (settingsMgr) {
+                  const pluginCfg = await settingsMgr.loadSettings("@openacp/speech");
+                  const groqApiKey = pluginCfg.groqApiKey;
+                  const sttProviders = {};
+                  if (groqApiKey) {
+                    sttProviders.groq = { apiKey: groqApiKey };
+                  }
+                  const newSpeechConfig = {
+                    stt: {
+                      provider: groqApiKey ? "groq" : null,
+                      providers: sttProviders
+                    },
+                    tts: {
+                      provider: pluginCfg.ttsProvider ?? null,
+                      providers: {}
+                    }
+                  };
+                  speechSvc.refreshProviders(newSpeechConfig);
+                  log39.info("Speech service config updated at runtime (from plugin settings)");
+                }
               }
             }
           }
         );
         registerCoreMenuItems(this.menuRegistry);
         if (ctx?.root) {
-          this.assistantRegistry.setInstanceRoot(path47.dirname(ctx.root));
+          this.assistantRegistry.setInstanceRoot(path49.dirname(ctx.root));
         }
         this.assistantRegistry.register(createSessionsSection(this));
         this.assistantRegistry.register(createAgentsSection(this));
@@ -22530,7 +22814,7 @@ var init_core = __esm({
           if (!result) return;
           message = result;
         }
-        const access2 = this.securityGuard.checkAccess(message);
+        const access2 = await this.securityGuard.checkAccess(message);
         if (!access2.allowed) {
           log39.warn({ userId: message.userId, reason: access2.reason }, "Access denied");
           if (access2.reason.includes("Session limit")) {
@@ -23762,21 +24046,25 @@ async function printStartBanner() {
   console.log(`${c.dim}              AI coding agents, anywhere.  v${version}${c.reset}
 `);
 }
-function summarizeConfig(config) {
+async function summarizeConfig(config, settingsManager) {
   const lines = [];
+  const channelDefs = [
+    { id: "telegram", label: "Telegram", pluginName: "@openacp/telegram", keys: ["botToken", "chatId"] },
+    { id: "discord", label: "Discord", pluginName: "@openacp/adapter-discord", keys: ["guildId", "token"] }
+  ];
   const channelStatuses = [];
-  for (const [id, meta] of Object.entries({
-    telegram: "Telegram",
-    discord: "Discord"
-  })) {
-    const ch = config.channels[id];
-    if (ch?.enabled) {
-      channelStatuses.push(`${meta} (enabled)`);
-    } else if (ch && Object.keys(ch).length > 1) {
-      channelStatuses.push(`${meta} (disabled)`);
-    } else {
-      channelStatuses.push(`${meta} (not configured)`);
+  for (const def of channelDefs) {
+    const legacyCh = config.channels[def.id];
+    let configured = !!legacyCh && Object.keys(legacyCh).length > 1;
+    let enabled = legacyCh?.enabled === true;
+    if (settingsManager) {
+      const ps = await settingsManager.loadSettings(def.pluginName);
+      if (def.keys.some((k) => ps[k])) {
+        configured = true;
+        enabled = ps.enabled !== false;
+      }
     }
+    channelStatuses.push(`${def.label} (${enabled ? "enabled" : configured ? "disabled" : "not configured"})`);
   }
   lines.push(`Channels: ${channelStatuses.join(", ")}`);
   lines.push(`Default agent: ${config.defaultAgent}`);
@@ -23853,9 +24141,8 @@ async function setupAgents() {
   await catalog.refreshRegistryIfStale();
   if (!catalog.getInstalledAgent("claude")) {
     const claudeRegistry = catalog.findRegistryAgent("claude-acp");
-    if (claudeRegistry) {
-      await catalog.install("claude-acp");
-    } else {
+    const installed2 = claudeRegistry ? await catalog.install("claude-acp") : null;
+    if (!installed2?.ok) {
       const { AgentStore: AgentStore2 } = await Promise.resolve().then(() => (init_agent_store(), agent_store_exports));
       const store = new AgentStore2();
       store.load();
@@ -23993,8 +24280,8 @@ __export(autostart_exports, {
 });
 import { execFileSync as execFileSync7 } from "child_process";
 import * as fs45 from "fs";
-import * as path48 from "path";
-import * as os23 from "os";
+import * as path50 from "path";
+import * as os24 from "os";
 function isAutoStartSupported() {
   return process.platform === "darwin" || process.platform === "linux";
 }
@@ -24006,7 +24293,7 @@ function escapeSystemdValue(str) {
   return `"${escaped}"`;
 }
 function generateLaunchdPlist(nodePath, cliPath, logDir2) {
-  const logFile = path48.join(logDir2, "openacp.log");
+  const logFile = path50.join(logDir2, "openacp.log");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -24051,12 +24338,12 @@ function installAutoStart(logDir2) {
     return { success: false, error: "Auto-start not supported on this platform" };
   }
   const nodePath = process.execPath;
-  const cliPath = path48.resolve(process.argv[1]);
-  const resolvedLogDir = logDir2.startsWith("~") ? path48.join(os23.homedir(), logDir2.slice(1)) : logDir2;
+  const cliPath = path50.resolve(process.argv[1]);
+  const resolvedLogDir = logDir2.startsWith("~") ? path50.join(os24.homedir(), logDir2.slice(1)) : logDir2;
   try {
     if (process.platform === "darwin") {
       const plist = generateLaunchdPlist(nodePath, cliPath, resolvedLogDir);
-      const dir = path48.dirname(LAUNCHD_PLIST_PATH);
+      const dir = path50.dirname(LAUNCHD_PLIST_PATH);
       fs45.mkdirSync(dir, { recursive: true });
       fs45.writeFileSync(LAUNCHD_PLIST_PATH, plist);
       execFileSync7("launchctl", ["load", LAUNCHD_PLIST_PATH], { stdio: "pipe" });
@@ -24065,7 +24352,7 @@ function installAutoStart(logDir2) {
     }
     if (process.platform === "linux") {
       const unit = generateSystemdUnit(nodePath, cliPath);
-      const dir = path48.dirname(SYSTEMD_SERVICE_PATH);
+      const dir = path50.dirname(SYSTEMD_SERVICE_PATH);
       fs45.mkdirSync(dir, { recursive: true });
       fs45.writeFileSync(SYSTEMD_SERVICE_PATH, unit);
       execFileSync7("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
@@ -24131,8 +24418,8 @@ var init_autostart = __esm({
     init_log();
     log40 = createChildLogger({ module: "autostart" });
     LAUNCHD_LABEL = "com.openacp.daemon";
-    LAUNCHD_PLIST_PATH = path48.join(os23.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-    SYSTEMD_SERVICE_PATH = path48.join(os23.homedir(), ".config", "systemd", "user", "openacp.service");
+    LAUNCHD_PLIST_PATH = path50.join(os24.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    SYSTEMD_SERVICE_PATH = path50.join(os24.homedir(), ".config", "systemd", "user", "openacp.service");
   }
 });
 
@@ -24251,27 +24538,44 @@ var init_setup_integrations = __esm({
 });
 
 // src/core/setup/setup-channels.ts
-import * as path49 from "path";
+import * as path51 from "path";
 import * as clack7 from "@clack/prompts";
-function getChannelStatuses(config) {
+async function getChannelStatuses(config, settingsManager) {
   const statuses = [];
   for (const [id, meta] of Object.entries(CHANNEL_META)) {
     const ch = config.channels[id];
-    const enabled = ch?.enabled === true;
-    const configured = !!ch && Object.keys(ch).length > 1;
+    let configured = !!ch && Object.keys(ch).length > 1;
+    let enabled = ch?.enabled === true;
     let hint;
-    if (id === "telegram" && ch?.botToken && typeof ch.botToken === "string" && ch.botToken !== "YOUR_BOT_TOKEN_HERE") {
-      hint = `Chat ID: ${ch.chatId}`;
+    if (settingsManager && id === "telegram") {
+      const ps = await settingsManager.loadSettings("@openacp/telegram");
+      if (ps.botToken && ps.chatId) {
+        configured = true;
+        enabled = ps.enabled !== false;
+        hint = `Chat ID: ${ps.chatId}`;
+      }
+    } else if (settingsManager && id === "discord") {
+      const ps = await settingsManager.loadSettings("@openacp/adapter-discord");
+      if (ps.guildId || ps.token) {
+        configured = true;
+        enabled = ps.enabled !== false;
+        hint = ps.guildId ? `Guild: ${ps.guildId}` : void 0;
+      }
     }
-    if (id === "discord" && ch?.guildId) {
-      hint = `Guild: ${ch.guildId}`;
+    if (!hint) {
+      if (id === "telegram" && ch?.botToken && typeof ch.botToken === "string" && ch.botToken !== "YOUR_BOT_TOKEN_HERE") {
+        hint = `Chat ID: ${ch.chatId}`;
+      }
+      if (id === "discord" && ch?.guildId) {
+        hint = `Guild: ${ch.guildId}`;
+      }
     }
     statuses.push({ id, label: meta.label, configured, enabled, hint });
   }
   return statuses;
 }
-function noteChannelStatus(config) {
-  const statuses = getChannelStatuses(config);
+async function noteChannelStatus(config, settingsManager) {
+  const statuses = await getChannelStatuses(config, settingsManager);
   const lines = statuses.map((s) => {
     const status = s.enabled ? "enabled" : s.configured ? "disabled" : "not configured";
     const hintStr = s.hint ? ` \u2014 ${s.hint}` : "";
@@ -24296,7 +24600,7 @@ async function promptConfiguredAction(label) {
     })
   );
 }
-async function configureViaPlugin(channelId) {
+async function configureViaPlugin(channelId, settingsManager) {
   const pluginMap = {
     telegram: { importPath: "../../plugins/telegram/index.js", name: "@openacp/telegram" }
   };
@@ -24315,24 +24619,27 @@ async function configureViaPlugin(channelId) {
     }
   }
   if (plugin2?.configure) {
-    const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
     const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
-    const basePath = path49.join(getGlobalRoot(), "plugins", "data");
-    const settingsManager = new SettingsManager2(basePath);
+    let sm = settingsManager;
+    if (!sm) {
+      const { SettingsManager: SM } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
+      const basePath = path51.join(getGlobalRoot(), "plugins", "data");
+      sm = new SM(basePath);
+    }
     const ctx = createInstallContext2({
       pluginName: plugin2.name,
-      settingsManager,
-      basePath
+      settingsManager: sm,
+      basePath: sm.getBasePath()
     });
     await plugin2.configure(ctx);
   }
 }
-async function configureChannels(config) {
+async function configureChannels(config, settingsManager) {
   const next = structuredClone(config);
   let changed = false;
-  noteChannelStatus(next);
+  await noteChannelStatus(next, settingsManager);
   while (true) {
-    const statuses = getChannelStatuses(next);
+    const statuses = await getChannelStatuses(next, settingsManager);
     const options = statuses.map((s) => {
       const status = s.enabled ? "enabled" : s.configured ? "disabled" : "not configured";
       return {
@@ -24353,8 +24660,8 @@ async function configureChannels(config) {
     if (choice === "__done__") break;
     const channelId = choice;
     const meta = CHANNEL_META[channelId];
-    const existing = next.channels[channelId];
-    const isConfigured = !!existing && Object.keys(existing).length > 1;
+    const statuses2 = await getChannelStatuses(next, settingsManager);
+    const isConfigured = statuses2.find((s) => s.id === channelId)?.configured ?? false;
     if (isConfigured) {
       const action = await promptConfiguredAction(meta.label);
       if (action === "skip") continue;
@@ -24379,7 +24686,7 @@ async function configureChannels(config) {
         continue;
       }
     }
-    await configureViaPlugin(channelId);
+    await configureViaPlugin(channelId, settingsManager);
     changed = true;
   }
   return { config: next, changed };
@@ -24399,55 +24706,70 @@ __export(instance_copy_exports, {
   copyInstance: () => copyInstance
 });
 import fs46 from "fs";
-import path50 from "path";
+import path52 from "path";
 async function copyInstance(src, dst, opts) {
   const { inheritableKeys = {}, onProgress } = opts;
   fs46.mkdirSync(dst, { recursive: true });
-  const configSrc = path50.join(src, "config.json");
+  const configSrc = path52.join(src, "config.json");
   if (fs46.existsSync(configSrc)) {
     onProgress?.("Configuration", "start");
     const config = JSON.parse(fs46.readFileSync(configSrc, "utf-8"));
     delete config.instanceName;
-    if (config.api) delete config.api.port;
-    if (config.tunnel) delete config.tunnel.port;
-    fs46.writeFileSync(path50.join(dst, "config.json"), JSON.stringify(config, null, 2));
+    delete config.security;
+    delete config.tunnel;
+    delete config.api;
+    delete config.speech;
+    delete config.usage;
+    if (config.channels && typeof config.channels === "object") {
+      const CORE_CHANNEL_KEYS = /* @__PURE__ */ new Set(["enabled", "outputMode", "adapter", "displayVerbosity"]);
+      for (const ch of Object.values(config.channels)) {
+        if (ch && typeof ch === "object") {
+          for (const key of Object.keys(ch)) {
+            if (!CORE_CHANNEL_KEYS.has(key)) {
+              delete ch[key];
+            }
+          }
+        }
+      }
+    }
+    fs46.writeFileSync(path52.join(dst, "config.json"), JSON.stringify(config, null, 2));
     onProgress?.("Configuration", "done");
   }
-  const pluginsSrc = path50.join(src, "plugins.json");
+  const pluginsSrc = path52.join(src, "plugins.json");
   if (fs46.existsSync(pluginsSrc)) {
     onProgress?.("Plugin list", "start");
-    fs46.copyFileSync(pluginsSrc, path50.join(dst, "plugins.json"));
+    fs46.copyFileSync(pluginsSrc, path52.join(dst, "plugins.json"));
     onProgress?.("Plugin list", "done");
   }
-  const pluginsDir = path50.join(src, "plugins");
+  const pluginsDir = path52.join(src, "plugins");
   if (fs46.existsSync(pluginsDir)) {
     onProgress?.("Plugins", "start");
-    const dstPlugins = path50.join(dst, "plugins");
+    const dstPlugins = path52.join(dst, "plugins");
     fs46.mkdirSync(dstPlugins, { recursive: true });
-    const pkgJson = path50.join(pluginsDir, "package.json");
-    if (fs46.existsSync(pkgJson)) fs46.copyFileSync(pkgJson, path50.join(dstPlugins, "package.json"));
-    const nodeModules = path50.join(pluginsDir, "node_modules");
-    if (fs46.existsSync(nodeModules)) fs46.cpSync(nodeModules, path50.join(dstPlugins, "node_modules"), { recursive: true });
+    const pkgJson = path52.join(pluginsDir, "package.json");
+    if (fs46.existsSync(pkgJson)) fs46.copyFileSync(pkgJson, path52.join(dstPlugins, "package.json"));
+    const nodeModules = path52.join(pluginsDir, "node_modules");
+    if (fs46.existsSync(nodeModules)) fs46.cpSync(nodeModules, path52.join(dstPlugins, "node_modules"), { recursive: true });
     onProgress?.("Plugins", "done");
   }
-  const agentsJson = path50.join(src, "agents.json");
+  const agentsJson = path52.join(src, "agents.json");
   if (fs46.existsSync(agentsJson)) {
     onProgress?.("Agents", "start");
-    fs46.copyFileSync(agentsJson, path50.join(dst, "agents.json"));
-    const agentsDir = path50.join(src, "agents");
-    if (fs46.existsSync(agentsDir)) fs46.cpSync(agentsDir, path50.join(dst, "agents"), { recursive: true });
+    fs46.copyFileSync(agentsJson, path52.join(dst, "agents.json"));
+    const agentsDir = path52.join(src, "agents");
+    if (fs46.existsSync(agentsDir)) fs46.cpSync(agentsDir, path52.join(dst, "agents"), { recursive: true });
     onProgress?.("Agents", "done");
   }
-  const binDir = path50.join(src, "bin");
+  const binDir = path52.join(src, "bin");
   if (fs46.existsSync(binDir)) {
     onProgress?.("Tools", "start");
-    fs46.cpSync(binDir, path50.join(dst, "bin"), { recursive: true });
+    fs46.cpSync(binDir, path52.join(dst, "bin"), { recursive: true });
     onProgress?.("Tools", "done");
   }
-  const pluginDataSrc = path50.join(src, "plugins", "data");
+  const pluginDataSrc = path52.join(src, "plugins", "data");
   if (fs46.existsSync(pluginDataSrc)) {
     onProgress?.("Preferences", "start");
-    copyPluginSettings(pluginDataSrc, path50.join(dst, "plugins", "data"), inheritableKeys);
+    copyPluginSettings(pluginDataSrc, path52.join(dst, "plugins", "data"), inheritableKeys);
     onProgress?.("Preferences", "done");
   }
 }
@@ -24462,10 +24784,10 @@ function copyPluginSettings(srcData, dstData, inheritableKeys) {
         if (key in settings) filtered[key] = settings[key];
       }
       if (Object.keys(filtered).length > 0) {
-        const relative = path50.relative(srcData, path50.dirname(settingsPath));
-        const dstDir = path50.join(dstData, relative);
+        const relative = path52.relative(srcData, path52.dirname(settingsPath));
+        const dstDir = path52.join(dstData, relative);
         fs46.mkdirSync(dstDir, { recursive: true });
-        fs46.writeFileSync(path50.join(dstDir, "settings.json"), JSON.stringify(filtered, null, 2));
+        fs46.writeFileSync(path52.join(dstDir, "settings.json"), JSON.stringify(filtered, null, 2));
       }
     } catch {
     }
@@ -24476,15 +24798,15 @@ function walkPluginDirs(base, cb) {
   for (const entry of fs46.readdirSync(base, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith("@")) {
-      const scopeDir = path50.join(base, entry.name);
+      const scopeDir = path52.join(base, entry.name);
       for (const sub of fs46.readdirSync(scopeDir, { withFileTypes: true })) {
         if (!sub.isDirectory()) continue;
         const pluginName = `${entry.name}/${sub.name}`;
-        const settingsPath = path50.join(scopeDir, sub.name, "settings.json");
+        const settingsPath = path52.join(scopeDir, sub.name, "settings.json");
         if (fs46.existsSync(settingsPath)) cb(pluginName, settingsPath);
       }
     } else {
-      const settingsPath = path50.join(base, entry.name, "settings.json");
+      const settingsPath = path52.join(base, entry.name, "settings.json");
       if (fs46.existsSync(settingsPath)) cb(entry.name, settingsPath);
     }
   }
@@ -24497,14 +24819,14 @@ var init_instance_copy = __esm({
 
 // src/core/setup/git-protect.ts
 import fs47 from "fs";
-import path51 from "path";
+import path53 from "path";
 function protectLocalInstance(projectDir) {
   ensureGitignore(projectDir);
   ensureClaudeMd(projectDir);
   printSecurityWarning();
 }
 function ensureGitignore(projectDir) {
-  const gitignorePath = path51.join(projectDir, ".gitignore");
+  const gitignorePath = path53.join(projectDir, ".gitignore");
   const entry = ".openacp";
   if (fs47.existsSync(gitignorePath)) {
     const content = fs47.readFileSync(gitignorePath, "utf-8");
@@ -24524,7 +24846,7 @@ ${entry}
   }
 }
 function ensureClaudeMd(projectDir) {
-  const claudeMdPath = path51.join(projectDir, "CLAUDE.md");
+  const claudeMdPath = path53.join(projectDir, "CLAUDE.md");
   const marker = "## Local OpenACP Workspace";
   if (fs47.existsSync(claudeMdPath)) {
     const content = fs47.readFileSync(claudeMdPath, "utf-8");
@@ -24567,9 +24889,9 @@ var init_git_protect = __esm({
 });
 
 // src/core/setup/wizard.ts
-import * as path52 from "path";
+import * as path54 from "path";
 import * as fs48 from "fs";
-import * as os24 from "os";
+import * as os25 from "os";
 import * as clack8 from "@clack/prompts";
 import { randomUUID as randomUUID2 } from "crypto";
 async function fetchCommunityAdapters() {
@@ -24591,7 +24913,7 @@ function checkDesktopAppInstalled() {
   const platform2 = process.platform;
   if (platform2 === "darwin") {
     candidates.push("/Applications/OpenACP.app");
-    candidates.push(`${os24.homedir()}/Applications/OpenACP.app`);
+    candidates.push(`${os25.homedir()}/Applications/OpenACP.app`);
   } else if (platform2 === "win32") {
     const localAppData = process.env["LOCALAPPDATA"] ?? "";
     candidates.push(`${localAppData}\\Programs\\OpenACP\\OpenACP.exe`);
@@ -24599,7 +24921,7 @@ function checkDesktopAppInstalled() {
   } else {
     candidates.push("/usr/bin/openacp-desktop");
     candidates.push("/usr/local/bin/openacp-desktop");
-    candidates.push(`${os24.homedir()}/.local/bin/openacp-desktop`);
+    candidates.push(`${os25.homedir()}/.local/bin/openacp-desktop`);
   }
   return candidates.some((p2) => fs48.existsSync(p2));
 }
@@ -24616,8 +24938,8 @@ async function runSetup(configManager, opts) {
     const isGlobal = instanceRoot === getGlobalRoot();
     let instanceName = opts?.instanceName;
     if (!instanceName) {
-      const defaultName = isGlobal ? "Global workspace" : path52.basename(path52.dirname(instanceRoot));
-      const locationHint = isGlobal ? "global (~/.openacp)" : `local (${instanceRoot.replace(/\/.openacp$/, "").replace(os24.homedir(), "~")})`;
+      const defaultName = isGlobal ? "Global workspace" : path54.basename(path54.dirname(instanceRoot));
+      const locationHint = isGlobal ? "global (~/.openacp)" : `local (${instanceRoot.replace(/\/.openacp$/, "").replace(os25.homedir(), "~")})`;
       const nameResult = await clack8.text({
         message: `Name for this workspace (${locationHint})`,
         initialValue: defaultName,
@@ -24627,13 +24949,13 @@ async function runSetup(configManager, opts) {
       instanceName = nameResult.trim();
     }
     const globalRoot = getGlobalRoot();
-    const registryPath = path52.join(globalRoot, "instances.json");
+    const registryPath = path54.join(globalRoot, "instances.json");
     const instanceRegistry = new InstanceRegistry(registryPath);
     await instanceRegistry.load();
     let didCopy = false;
     if (opts?.from) {
-      const fromRoot = path52.join(opts.from, ".openacp");
-      if (fs48.existsSync(path52.join(fromRoot, "config.json"))) {
+      const fromRoot = path54.join(opts.from, ".openacp");
+      if (fs48.existsSync(path54.join(fromRoot, "config.json"))) {
         const inheritableMap = buildInheritableKeysMap();
         await copyInstance(fromRoot, instanceRoot, { inheritableKeys: inheritableMap });
         didCopy = true;
@@ -24644,7 +24966,7 @@ async function runSetup(configManager, opts) {
     }
     if (!didCopy) {
       const existingInstances = instanceRegistry.list().filter(
-        (e) => fs48.existsSync(path52.join(e.root, "config.json")) && e.root !== instanceRoot
+        (e) => fs48.existsSync(path54.join(e.root, "config.json")) && e.root !== instanceRoot
       );
       if (existingInstances.length > 0) {
         let singleLabel;
@@ -24652,12 +24974,12 @@ async function runSetup(configManager, opts) {
           const e = existingInstances[0];
           let name = e.id;
           try {
-            const cfg = JSON.parse(fs48.readFileSync(path52.join(e.root, "config.json"), "utf-8"));
+            const cfg = JSON.parse(fs48.readFileSync(path54.join(e.root, "config.json"), "utf-8"));
             if (cfg.instanceName) name = cfg.instanceName;
           } catch {
           }
           const isGlobalEntry = e.root === getGlobalRoot();
-          const displayPath = e.root.replace(os24.homedir(), "~");
+          const displayPath = e.root.replace(os25.homedir(), "~");
           const type = isGlobalEntry ? "global" : "local";
           singleLabel = `${name} workspace (${type} \u2014 ${displayPath})`;
         }
@@ -24677,12 +24999,12 @@ async function runSetup(configManager, opts) {
               options: existingInstances.map((e) => {
                 let name = e.id;
                 try {
-                  const cfg = JSON.parse(fs48.readFileSync(path52.join(e.root, "config.json"), "utf-8"));
+                  const cfg = JSON.parse(fs48.readFileSync(path54.join(e.root, "config.json"), "utf-8"));
                   if (cfg.instanceName) name = cfg.instanceName;
                 } catch {
                 }
                 const isGlobalEntry = e.root === getGlobalRoot();
-                const displayPath = e.root.replace(os24.homedir(), "~");
+                const displayPath = e.root.replace(os25.homedir(), "~");
                 const type = isGlobalEntry ? "global" : "local";
                 return { value: e.root, label: `${name} workspace (${type} \u2014 ${displayPath})` };
               })
@@ -24774,9 +25096,9 @@ async function runSetup(configManager, opts) {
       if (channelId.startsWith("official:")) {
         const npmPackage = channelId.slice("official:".length);
         const { execFileSync: execFileSync8 } = await import("child_process");
-        const pluginsDir = path52.join(instanceRoot, "plugins");
-        const nodeModulesDir = path52.join(pluginsDir, "node_modules");
-        const installedPath = path52.join(nodeModulesDir, npmPackage);
+        const pluginsDir = path54.join(instanceRoot, "plugins");
+        const nodeModulesDir = path54.join(pluginsDir, "node_modules");
+        const installedPath = path54.join(nodeModulesDir, npmPackage);
         if (!fs48.existsSync(installedPath)) {
           try {
             clack8.log.step(`Installing ${npmPackage}...`);
@@ -24790,9 +25112,9 @@ async function runSetup(configManager, opts) {
           }
         }
         try {
-          const installedPkgPath = path52.join(nodeModulesDir, npmPackage, "package.json");
+          const installedPkgPath = path54.join(nodeModulesDir, npmPackage, "package.json");
           const installedPkg = JSON.parse(fs48.readFileSync(installedPkgPath, "utf-8"));
-          const pluginModule = await import(path52.join(nodeModulesDir, npmPackage, installedPkg.main ?? "dist/index.js"));
+          const pluginModule = await import(path54.join(nodeModulesDir, npmPackage, installedPkg.main ?? "dist/index.js"));
           const plugin2 = pluginModule.default;
           if (plugin2?.install) {
             const installCtx = createInstallContext2({
@@ -24822,8 +25144,8 @@ async function runSetup(configManager, opts) {
       if (channelId.startsWith("community:")) {
         const npmPackage = channelId.slice("community:".length);
         const { execFileSync: execFileSync8 } = await import("child_process");
-        const pluginsDir = path52.join(instanceRoot, "plugins");
-        const nodeModulesDir = path52.join(pluginsDir, "node_modules");
+        const pluginsDir = path54.join(instanceRoot, "plugins");
+        const nodeModulesDir = path54.join(pluginsDir, "node_modules");
         try {
           execFileSync8("npm", ["install", npmPackage, "--prefix", pluginsDir, "--save"], {
             stdio: "inherit",
@@ -24835,9 +25157,9 @@ async function runSetup(configManager, opts) {
         }
         try {
           const { readFileSync: readFileSync19 } = await import("fs");
-          const installedPkgPath = path52.join(nodeModulesDir, npmPackage, "package.json");
+          const installedPkgPath = path54.join(nodeModulesDir, npmPackage, "package.json");
           const installedPkg = JSON.parse(readFileSync19(installedPkgPath, "utf-8"));
-          const pluginModule = await import(path52.join(nodeModulesDir, npmPackage, installedPkg.main ?? "dist/index.js"));
+          const pluginModule = await import(path54.join(nodeModulesDir, npmPackage, installedPkg.main ?? "dist/index.js"));
           const plugin2 = pluginModule.default;
           if (plugin2?.install) {
             const installCtx = createInstallContext2({
@@ -24892,7 +25214,7 @@ async function runSetup(configManager, opts) {
       security,
       logging: {
         level: "info",
-        logDir: path52.join(instanceRoot, "logs"),
+        logDir: path54.join(instanceRoot, "logs"),
         maxFileSize: "10m",
         maxFiles: 7,
         sessionLogRetentionDays: 30
@@ -24944,9 +25266,9 @@ async function runSetup(configManager, opts) {
       instanceRegistry.register(id, instanceRoot);
       await instanceRegistry.save();
     }
-    const isLocal = instanceRoot !== path52.join(getGlobalRoot());
+    const isLocal = instanceRoot !== path54.join(getGlobalRoot());
     if (isLocal) {
-      const projectDir = path52.dirname(instanceRoot);
+      const projectDir = path54.dirname(instanceRoot);
       protectLocalInstance(projectDir);
     }
     clack8.outro(`Config saved to ${configManager.getConfigPath()}`);
@@ -25010,20 +25332,20 @@ async function selectSection(hasSelection) {
     })
   );
 }
-async function runReconfigure(configManager) {
+async function runReconfigure(configManager, settingsManager) {
   await printStartBanner();
   clack8.intro("OpenACP \u2014 Reconfigure");
   try {
     await configManager.load();
     let config = configManager.get();
-    clack8.note(summarizeConfig(config), "Current configuration");
+    clack8.note(await summarizeConfig(config, settingsManager), "Current configuration");
     let ranSection = false;
     while (true) {
       const choice = await selectSection(ranSection);
       if (choice === "__continue") break;
       ranSection = true;
       if (choice === "channels") {
-        const result = await configureChannels(config);
+        const result = await configureChannels(config, settingsManager);
         if (result.changed) {
           config = { ...config, channels: result.config.channels };
           await configManager.writeNew(config);
@@ -25234,7 +25556,7 @@ __export(dev_loader_exports, {
   DevPluginLoader: () => DevPluginLoader
 });
 import fs49 from "fs";
-import path53 from "path";
+import path55 from "path";
 var loadCounter, DevPluginLoader;
 var init_dev_loader = __esm({
   "src/core/plugin/dev-loader.ts"() {
@@ -25243,11 +25565,11 @@ var init_dev_loader = __esm({
     DevPluginLoader = class {
       pluginPath;
       constructor(pluginPath) {
-        this.pluginPath = path53.resolve(pluginPath);
+        this.pluginPath = path55.resolve(pluginPath);
       }
       async load() {
-        const distIndex = path53.join(this.pluginPath, "dist", "index.js");
-        const srcIndex = path53.join(this.pluginPath, "src", "index.ts");
+        const distIndex = path55.join(this.pluginPath, "dist", "index.js");
+        const srcIndex = path55.join(this.pluginPath, "src", "index.ts");
         if (!fs49.existsSync(distIndex) && !fs49.existsSync(srcIndex)) {
           throw new Error(`Plugin not found at ${this.pluginPath}. Expected dist/index.js or src/index.ts`);
         }
@@ -25266,7 +25588,7 @@ var init_dev_loader = __esm({
         return this.pluginPath;
       }
       getDistPath() {
-        return path53.join(this.pluginPath, "dist");
+        return path55.join(this.pluginPath, "dist");
       }
     };
   }
@@ -25278,13 +25600,13 @@ __export(main_exports, {
   RESTART_EXIT_CODE: () => RESTART_EXIT_CODE,
   startServer: () => startServer
 });
-import path54 from "path";
+import path56 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 import fs50 from "fs";
 async function startServer(opts) {
   const globalRoot = getGlobalRoot();
   if (!opts?.instanceContext) {
-    const reg = new InstanceRegistry(path54.join(globalRoot, "instances.json"));
+    const reg = new InstanceRegistry(path56.join(globalRoot, "instances.json"));
     reg.load();
     const entry = reg.getByRoot(globalRoot);
     opts = { ...opts, instanceContext: createInstanceContext({ id: entry?.id ?? randomUUID3(), root: globalRoot, isGlobal: true }) };
@@ -25325,6 +25647,7 @@ async function startServer(opts) {
   const config = configManager.get();
   initLogger(config.logging);
   log.debug({ configPath: configManager.getConfigPath() }, "Config loaded");
+  await configManager.applyEnvToPluginSettings(settingsManager);
   if (pluginRegistry.list().size === 0) {
     await autoRegisterBuiltinPlugins(settingsManager, pluginRegistry, configManager);
   }
@@ -25368,22 +25691,22 @@ async function startServer(opts) {
         try {
           let modulePath;
           if (name.startsWith("/") || name.startsWith(".")) {
-            const resolved = path54.resolve(name);
-            const pkgPath = path54.join(resolved, "package.json");
+            const resolved = path56.resolve(name);
+            const pkgPath = path56.join(resolved, "package.json");
             const pkg = JSON.parse(await fs50.promises.readFile(pkgPath, "utf-8"));
-            modulePath = path54.join(resolved, pkg.main || "dist/index.js");
+            modulePath = path56.join(resolved, pkg.main || "dist/index.js");
           } else {
-            const nodeModulesDir = path54.join(ctx.paths.plugins, "node_modules");
-            let pkgDir = path54.join(nodeModulesDir, name);
-            if (!fs50.existsSync(path54.join(pkgDir, "package.json"))) {
+            const nodeModulesDir = path56.join(ctx.paths.plugins, "node_modules");
+            let pkgDir = path56.join(nodeModulesDir, name);
+            if (!fs50.existsSync(path56.join(pkgDir, "package.json"))) {
               let found = false;
               const scopes = fs50.existsSync(nodeModulesDir) ? fs50.readdirSync(nodeModulesDir).filter((d) => d.startsWith("@")) : [];
               for (const scope of scopes) {
-                const scopeDir = path54.join(nodeModulesDir, scope);
+                const scopeDir = path56.join(nodeModulesDir, scope);
                 const pkgs = fs50.readdirSync(scopeDir);
                 for (const pkg2 of pkgs) {
-                  const candidateDir = path54.join(scopeDir, pkg2);
-                  const candidatePkgPath = path54.join(candidateDir, "package.json");
+                  const candidateDir = path56.join(scopeDir, pkg2);
+                  const candidatePkgPath = path56.join(candidateDir, "package.json");
                   if (fs50.existsSync(candidatePkgPath)) {
                     try {
                       const candidatePkg = JSON.parse(fs50.readFileSync(candidatePkgPath, "utf-8"));
@@ -25400,9 +25723,9 @@ async function startServer(opts) {
                 if (found) break;
               }
             }
-            const pkgJsonPath = path54.join(pkgDir, "package.json");
+            const pkgJsonPath = path56.join(pkgDir, "package.json");
             const pkg = JSON.parse(await fs50.promises.readFile(pkgJsonPath, "utf-8"));
-            modulePath = path54.join(pkgDir, pkg.main || "dist/index.js");
+            modulePath = path56.join(pkgDir, pkg.main || "dist/index.js");
           }
           log.debug({ plugin: name, modulePath }, "Loading community plugin");
           const mod = await import(modulePath);
@@ -25565,7 +25888,7 @@ async function startServer(opts) {
   await core.start();
   try {
     const globalRoot2 = getGlobalRoot();
-    const registryPath = path54.join(globalRoot2, "instances.json");
+    const registryPath = path56.join(globalRoot2, "instances.json");
     const instanceReg = new InstanceRegistry(registryPath);
     await instanceReg.load();
     if (!instanceReg.getByRoot(ctx.root)) {
@@ -25728,13 +26051,13 @@ var restart_exports = {};
 __export(restart_exports, {
   cmdRestart: () => cmdRestart
 });
-import path55 from "path";
-import os25 from "os";
+import path57 from "path";
+import os26 from "os";
 import { randomUUID as randomUUID4 } from "crypto";
 async function cmdRestart(args2 = [], instanceRoot) {
   const json = isJsonMode(args2);
   if (json) await muteForJson();
-  const root = instanceRoot ?? path55.join(os25.homedir(), ".openacp");
+  const root = instanceRoot ?? path57.join(os26.homedir(), ".openacp");
   if (!json && wantsHelp(args2)) {
     console.log(`
 \x1B[1mopenacp restart\x1B[0m \u2014 Restart the background daemon
@@ -25782,7 +26105,7 @@ Stops the running daemon (if any) and starts a new one.
     printInstanceHint(root);
     console.log("Starting in foreground mode...");
     const { startServer: startServer2 } = await Promise.resolve().then(() => (init_main(), main_exports));
-    const reg = new InstanceRegistry(path55.join(getGlobalRoot(), "instances.json"));
+    const reg = new InstanceRegistry(path57.join(getGlobalRoot(), "instances.json"));
     reg.load();
     const existingEntry = reg.getByRoot(root);
     const ctx = createInstanceContext({
@@ -25798,7 +26121,7 @@ Stops the running daemon (if any) and starts a new one.
       console.error(result.error);
       process.exit(1);
     }
-    if (json) jsonSuccess({ pid: result.pid, instanceId: path55.basename(root), dir: root });
+    if (json) jsonSuccess({ pid: result.pid, instanceId: path57.basename(root), dir: root });
     printInstanceHint(root);
     console.log(`OpenACP daemon started (PID ${result.pid})`);
   }
@@ -25822,8 +26145,8 @@ __export(status_exports, {
   readInstanceInfo: () => readInstanceInfo
 });
 import fs51 from "fs";
-import path56 from "path";
-import os26 from "os";
+import path58 from "path";
+import os27 from "os";
 async function cmdStatus(args2 = [], instanceRoot) {
   const json = isJsonMode(args2);
   if (json) await muteForJson();
@@ -25840,7 +26163,7 @@ async function cmdStatus(args2 = [], instanceRoot) {
   await showSingleInstance(root, json);
 }
 async function showAllInstances(json = false) {
-  const registryPath = path56.join(getGlobalRoot(), "instances.json");
+  const registryPath = path58.join(getGlobalRoot(), "instances.json");
   const registry = new InstanceRegistry(registryPath);
   await registry.load();
   const instances = registry.list();
@@ -25875,7 +26198,7 @@ async function showAllInstances(json = false) {
     const mode = info.pid ? info.runMode === "daemon" ? "daemon" : "fg" : "\u2014";
     const api = info.apiPort ? String(info.apiPort) : "\u2014";
     const tunnel = info.tunnelPort ? String(info.tunnelPort) : "\u2014";
-    const dir = entry.root.replace(/\/.openacp$/, "").replace(os26.homedir(), "~");
+    const dir = entry.root.replace(/\/.openacp$/, "").replace(os27.homedir(), "~");
     const channels = info.channels.join(", ") || "\u2014";
     const name = info.name ?? entry.id;
     console.log(`  ${status.padEnd(10)} ${entry.id.padEnd(16)} ${name.padEnd(16)} ${dir.padEnd(20)} ${mode.padEnd(8)} ${channels.padEnd(10)} ${api.padEnd(6)} ${tunnel}`);
@@ -25883,7 +26206,7 @@ async function showAllInstances(json = false) {
   console.log("");
 }
 async function showInstanceById(id, json = false) {
-  const registryPath = path56.join(getGlobalRoot(), "instances.json");
+  const registryPath = path58.join(getGlobalRoot(), "instances.json");
   const registry = new InstanceRegistry(registryPath);
   await registry.load();
   const entry = registry.get(id);
@@ -25898,7 +26221,7 @@ async function showSingleInstance(root, json = false) {
   const info = readInstanceInfo(root);
   if (json) {
     jsonSuccess({
-      id: path56.basename(root),
+      id: path58.basename(root),
       name: info.name,
       status: info.pid ? "online" : "offline",
       pid: info.pid,
@@ -25929,13 +26252,13 @@ function readInstanceInfo(root) {
     channels: []
   };
   try {
-    const config = JSON.parse(fs51.readFileSync(path56.join(root, "config.json"), "utf-8"));
+    const config = JSON.parse(fs51.readFileSync(path58.join(root, "config.json"), "utf-8"));
     result.name = config.instanceName ?? null;
     result.runMode = config.runMode ?? null;
   } catch {
   }
   try {
-    const pid = parseInt(fs51.readFileSync(path56.join(root, "openacp.pid"), "utf-8").trim());
+    const pid = parseInt(fs51.readFileSync(path58.join(root, "openacp.pid"), "utf-8").trim());
     if (!isNaN(pid)) {
       process.kill(pid, 0);
       result.pid = pid;
@@ -25943,19 +26266,19 @@ function readInstanceInfo(root) {
   } catch {
   }
   try {
-    const port = parseInt(fs51.readFileSync(path56.join(root, "api.port"), "utf-8").trim());
+    const port = parseInt(fs51.readFileSync(path58.join(root, "api.port"), "utf-8").trim());
     if (!isNaN(port)) result.apiPort = port;
   } catch {
   }
   try {
-    const tunnels = JSON.parse(fs51.readFileSync(path56.join(root, "tunnels.json"), "utf-8"));
+    const tunnels = JSON.parse(fs51.readFileSync(path58.join(root, "tunnels.json"), "utf-8"));
     const entries = Object.values(tunnels);
     const systemEntry = entries.find((t) => t.type === "system");
     if (systemEntry?.port) result.tunnelPort = systemEntry.port;
   } catch {
   }
   try {
-    const plugins = JSON.parse(fs51.readFileSync(path56.join(root, "plugins.json"), "utf-8"));
+    const plugins = JSON.parse(fs51.readFileSync(path58.join(root, "plugins.json"), "utf-8"));
     const adapters = ["@openacp/telegram", "@openacp/discord", "@openacp/slack"];
     for (const name of adapters) {
       if (plugins.installed?.[name] && plugins.installed[name].enabled !== false) {
@@ -25970,7 +26293,7 @@ function formatInstanceStatus(root) {
   const info = readInstanceInfo(root);
   if (!info.pid) return null;
   const isGlobal = root === getGlobalRoot();
-  const displayPath = root.replace(os26.homedir(), "~");
+  const displayPath = root.replace(os27.homedir(), "~");
   const label = isGlobal ? "global" : "local";
   const lines = [];
   lines.push(`  PID:       ${info.pid}`);
@@ -26039,7 +26362,7 @@ var config_editor_exports = {};
 __export(config_editor_exports, {
   runConfigEditor: () => runConfigEditor
 });
-import * as path57 from "path";
+import * as path59 from "path";
 import * as clack9 from "@clack/prompts";
 async function select8(opts) {
   const result = await clack9.select({
@@ -26070,11 +26393,19 @@ async function input(opts) {
   }
   return result;
 }
-async function editTelegram(config, updates) {
+async function editTelegram(config, updates, settingsManager) {
   const tg = config.channels?.telegram ?? {};
-  const currentToken = tg.botToken ?? "";
-  const currentChatId = tg.chatId ?? 0;
-  const currentEnabled = tg.enabled ?? false;
+  let currentToken = tg.botToken ?? "";
+  let currentChatId = tg.chatId ?? 0;
+  let currentEnabled = tg.enabled ?? false;
+  if (settingsManager) {
+    const ps = await settingsManager.loadSettings("@openacp/telegram");
+    if (Object.keys(ps).length > 0) {
+      currentToken = ps.botToken ?? currentToken;
+      currentChatId = ps.chatId ?? currentChatId;
+      currentEnabled = ps.enabled ?? currentEnabled;
+    }
+  }
   console.log(header("Telegram"));
   console.log(`  Enabled   : ${currentEnabled ? ok2("yes") : dim2("no")}`);
   const tokenDisplay = currentToken.length > 12 ? currentToken.slice(0, 6) + "..." + currentToken.slice(-6) : currentToken || dim2("(not set)");
@@ -26089,7 +26420,11 @@ async function editTelegram(config, updates) {
     return updates.channels.telegram;
   };
   while (true) {
-    const isEnabled = (() => {
+    const isEnabled = await (async () => {
+      if (settingsManager) {
+        const ps = await settingsManager.loadSettings("@openacp/telegram");
+        if ("enabled" in ps) return ps.enabled;
+      }
       const ch = updates.channels;
       const tgUp = ch?.telegram;
       if (tgUp && "enabled" in tgUp) return tgUp.enabled;
@@ -26106,8 +26441,12 @@ async function editTelegram(config, updates) {
     });
     if (choice === "back") break;
     if (choice === "toggle") {
-      const tgUp = ensureTelegramUpdates();
-      tgUp.enabled = !isEnabled;
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/telegram", { enabled: !isEnabled });
+      } else {
+        const tgUp = ensureTelegramUpdates();
+        tgUp.enabled = !isEnabled;
+      }
       console.log(!isEnabled ? ok2("Telegram enabled") : ok2("Telegram disabled"));
     }
     if (choice === "token") {
@@ -26127,9 +26466,13 @@ async function editTelegram(config, updates) {
       } catch {
         console.log(warn2("Telegram validator not available \u2014 skipping validation"));
       }
-      const tgUp = ensureTelegramUpdates();
-      tgUp.botToken = token.trim();
-      tgUp.enabled = true;
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/telegram", { botToken: token.trim(), enabled: true });
+      } else {
+        const tgUp = ensureTelegramUpdates();
+        tgUp.botToken = token.trim();
+        tgUp.enabled = true;
+      }
     }
     if (choice === "chatid") {
       const chatIdStr = await input({
@@ -26144,8 +26487,8 @@ async function editTelegram(config, updates) {
       const chatId = Number(chatIdStr.trim());
       const tokenForValidation = (() => {
         const ch = updates.channels;
-        const tgUp2 = ch?.telegram;
-        if (typeof tgUp2?.botToken === "string") return tgUp2.botToken;
+        const tgUp = ch?.telegram;
+        if (typeof tgUp?.botToken === "string") return tgUp.botToken;
         return currentToken;
       })();
       try {
@@ -26159,8 +26502,12 @@ async function editTelegram(config, updates) {
       } catch {
         console.log(warn2("Telegram validator not available \u2014 skipping validation"));
       }
-      const tgUp = ensureTelegramUpdates();
-      tgUp.chatId = chatId;
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/telegram", { chatId });
+      } else {
+        const tgUp = ensureTelegramUpdates();
+        tgUp.chatId = chatId;
+      }
     }
   }
 }
@@ -26200,7 +26547,7 @@ async function editDiscord(_config, _updates) {
     const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
     const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
     const root = getGlobalRoot2();
-    const basePath = path57.join(root, "plugins");
+    const basePath = path59.join(root, "plugins", "data");
     const settingsManager = new SettingsManager2(basePath);
     const ctx = createInstallContext2({
       pluginName: plugin2.name,
@@ -26213,12 +26560,18 @@ async function editDiscord(_config, _updates) {
     console.log(warn2("This plugin does not have a configure() method yet."));
   }
 }
-async function editChannels(config, updates) {
-  const tgEnabled = config.channels?.telegram?.enabled !== false && config.channels?.telegram;
-  const dcEnabled = config.channels?.discord?.enabled !== false && config.channels?.discord;
+async function editChannels(config, updates, settingsManager) {
+  let tgConfigured = !!config.channels?.telegram;
+  let dcConfigured = !!config.channels?.discord;
+  if (settingsManager) {
+    const tgPs = await settingsManager.loadSettings("@openacp/telegram");
+    if (tgPs.botToken && tgPs.chatId) tgConfigured = true;
+    const dcPs = await settingsManager.loadSettings("@openacp/adapter-discord");
+    if (dcPs.guildId || dcPs.token) dcConfigured = true;
+  }
   console.log(header("Channels"));
-  console.log(`  Telegram : ${tgEnabled ? ok2("configured") : dim2("not configured")}`);
-  console.log(`  Discord  : ${dcEnabled ? ok2("configured") : dim2("not configured")}`);
+  console.log(`  Telegram : ${tgConfigured ? ok2("configured") : dim2("not configured")}`);
+  console.log(`  Discord  : ${dcConfigured ? ok2("configured") : dim2("not configured")}`);
   console.log("");
   while (true) {
     const choice = await select8({
@@ -26230,7 +26583,7 @@ async function editChannels(config, updates) {
       ]
     });
     if (choice === "back") break;
-    if (choice === "telegram") await editTelegram(config, updates);
+    if (choice === "telegram") await editTelegram(config, updates, settingsManager);
     if (choice === "discord") await editDiscord(config, updates);
   }
 }
@@ -26277,8 +26630,18 @@ async function editWorkspace(config, updates) {
   updates.workspace = { baseDir: newDir.trim() };
   console.log(ok2(`Workspace set to ${newDir.trim()}`));
 }
-async function editSecurity(config, updates) {
-  const sec = config.security ?? { allowedUserIds: [], maxConcurrentSessions: 20, sessionTimeoutMinutes: 60 };
+async function editSecurity(config, updates, settingsManager) {
+  let sec = config.security ?? { allowedUserIds: [], maxConcurrentSessions: 20, sessionTimeoutMinutes: 60 };
+  if (settingsManager) {
+    const ps = await settingsManager.loadSettings("@openacp/security");
+    if (Object.keys(ps).length > 0) {
+      sec = {
+        allowedUserIds: ps.allowedUserIds ?? sec.allowedUserIds,
+        maxConcurrentSessions: ps.maxConcurrentSessions ?? sec.maxConcurrentSessions,
+        sessionTimeoutMinutes: ps.sessionTimeoutMinutes ?? sec.sessionTimeoutMinutes
+      };
+    }
+  }
   console.log(header("Security"));
   console.log(`  Allowed user IDs        : ${sec.allowedUserIds?.length ? sec.allowedUserIds.join(", ") : dim2("(all users allowed)")}`);
   console.log(`  Max concurrent sessions : ${sec.maxConcurrentSessions}`);
@@ -26304,8 +26667,12 @@ async function editSecurity(config, updates) {
           return true;
         }
       });
-      if (!updates.security) updates.security = {};
-      updates.security.maxConcurrentSessions = Number(val.trim());
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/security", { maxConcurrentSessions: Number(val.trim()) });
+      } else {
+        if (!updates.security) updates.security = {};
+        updates.security.maxConcurrentSessions = Number(val.trim());
+      }
       console.log(ok2(`Max concurrent sessions set to ${val.trim()}`));
     }
     if (choice === "timeout") {
@@ -26318,8 +26685,12 @@ async function editSecurity(config, updates) {
           return true;
         }
       });
-      if (!updates.security) updates.security = {};
-      updates.security.sessionTimeoutMinutes = Number(val.trim());
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/security", { sessionTimeoutMinutes: Number(val.trim()) });
+      } else {
+        if (!updates.security) updates.security = {};
+        updates.security.sessionTimeoutMinutes = Number(val.trim());
+      }
       console.log(ok2(`Session timeout set to ${val.trim()} minutes`));
     }
   }
@@ -26444,8 +26815,14 @@ async function editRunMode(config, updates) {
     }
   }
 }
-async function editApi(config, updates) {
-  const api = config.api ?? { port: 21420, host: "127.0.0.1" };
+async function editApi(config, updates, settingsManager) {
+  let api = config.api ?? { port: 21420, host: "127.0.0.1" };
+  if (settingsManager) {
+    const ps = await settingsManager.loadSettings("@openacp/api-server");
+    if (Object.keys(ps).length > 0) {
+      api = { port: ps.port ?? api.port, host: ps.host ?? api.host };
+    }
+  }
   console.log(header("API"));
   console.log(`  Port : ${api.port}`);
   console.log(`  Host : ${api.host} ${dim2("(localhost only)")}`);
@@ -26459,11 +26836,21 @@ async function editApi(config, updates) {
       return true;
     }
   });
-  updates.api = { port: Number(newPort.trim()) };
+  if (settingsManager) {
+    await settingsManager.updatePluginSettings("@openacp/api-server", { port: Number(newPort.trim()) });
+  } else {
+    updates.api = { port: Number(newPort.trim()) };
+  }
   console.log(ok2(`API port set to ${newPort.trim()}`));
 }
-async function editTunnel(config, updates) {
-  const tunnel = config.tunnel ?? { enabled: false, port: 3100, provider: "cloudflare", options: {}, storeTtlMinutes: 60, auth: { enabled: false } };
+async function editTunnel(config, updates, settingsManager) {
+  let tunnel = config.tunnel ?? { enabled: false, port: 3100, provider: "cloudflare", options: {}, storeTtlMinutes: 60, auth: { enabled: false } };
+  if (settingsManager) {
+    const ps = await settingsManager.loadSettings("@openacp/tunnel");
+    if (Object.keys(ps).length > 0) {
+      tunnel = { ...tunnel, ...ps };
+    }
+  }
   const currentUpdates = updates.tunnel ?? {};
   const getVal = (key, fallback) => key in currentUpdates ? currentUpdates[key] : tunnel[key] ?? fallback;
   console.log(header("Tunnel"));
@@ -26490,6 +26877,9 @@ async function editTunnel(config, updates) {
     const tun = updates.tunnel;
     if (choice === "toggle") {
       const current = getVal("enabled", false);
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/tunnel", { enabled: !current });
+      }
       tun.enabled = !current;
       console.log(!current ? ok2("Tunnel enabled") : ok2("Tunnel disabled"));
     }
@@ -26503,6 +26893,9 @@ async function editTunnel(config, updates) {
           { name: "Tailscale Funnel", value: "tailscale" }
         ]
       });
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/tunnel", { provider, options: {} });
+      }
       tun.provider = provider;
       tun.options = {};
       console.log(ok2(`Provider set to ${provider}`));
@@ -26517,6 +26910,9 @@ async function editTunnel(config, updates) {
           return true;
         }
       });
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/tunnel", { port: Number(val.trim()) });
+      }
       tun.port = Number(val.trim());
       console.log(ok2(`Tunnel port set to ${val.trim()}`));
     }
@@ -26524,11 +26920,17 @@ async function editTunnel(config, updates) {
       const provider = getVal("provider", "cloudflare");
       const currentOptions = getVal("options", {});
       await editProviderOptions(provider, currentOptions, tun);
+      if (settingsManager) {
+        await settingsManager.updatePluginSettings("@openacp/tunnel", { options: tun.options });
+      }
     }
     if (choice === "auth") {
       const currentAuth = getVal("auth", { enabled: false });
       if (currentAuth.enabled) {
         tun.auth = { enabled: false };
+        if (settingsManager) {
+          await settingsManager.updatePluginSettings("@openacp/tunnel", { auth: { enabled: false } });
+        }
         console.log(ok2("Tunnel auth disabled"));
       } else {
         const token = await input({
@@ -26536,6 +26938,9 @@ async function editTunnel(config, updates) {
           default: ""
         });
         tun.auth = token.trim() ? { enabled: true, token: token.trim() } : { enabled: true };
+        if (settingsManager) {
+          await settingsManager.updatePluginSettings("@openacp/tunnel", { auth: tun.auth });
+        }
         console.log(ok2("Tunnel auth enabled"));
       }
     }
@@ -26601,7 +27006,7 @@ async function editProviderOptions(provider, currentOptions, tun) {
     console.log(dim2(`No configurable options for provider "${provider}"`));
   }
 }
-async function runConfigEditor(configManager, mode = "file", apiPort) {
+async function runConfigEditor(configManager, mode = "file", apiPort, settingsManager) {
   await configManager.load();
   const config = configManager.get();
   const updates = {};
@@ -26636,14 +27041,14 @@ ${c2.cyan}${c2.bold}OpenACP Config Editor${c2.reset}`);
         break;
       }
       const sectionUpdates = {};
-      if (choice === "channels") await editChannels(config, sectionUpdates);
+      if (choice === "channels") await editChannels(config, sectionUpdates, settingsManager);
       else if (choice === "agent") await editAgent(config, sectionUpdates);
       else if (choice === "workspace") await editWorkspace(config, sectionUpdates);
-      else if (choice === "security") await editSecurity(config, sectionUpdates);
+      else if (choice === "security") await editSecurity(config, sectionUpdates, settingsManager);
       else if (choice === "logging") await editLogging(config, sectionUpdates);
       else if (choice === "runMode") await editRunMode(config, sectionUpdates);
-      else if (choice === "api") await editApi(config, sectionUpdates);
-      else if (choice === "tunnel") await editTunnel(config, sectionUpdates);
+      else if (choice === "api") await editApi(config, sectionUpdates, settingsManager);
+      else if (choice === "tunnel") await editTunnel(config, sectionUpdates, settingsManager);
       if (mode === "api" && Object.keys(sectionUpdates).length > 0) {
         await sendConfigViaApi(apiPort, sectionUpdates);
         await configManager.load();
@@ -26663,17 +27068,17 @@ ${c2.cyan}${c2.bold}OpenACP Config Editor${c2.reset}`);
 async function sendConfigViaApi(port, updates) {
   const { apiCall: call } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
   const paths = flattenToPaths(updates);
-  for (const { path: path67, value } of paths) {
+  for (const { path: path69, value } of paths) {
     const res = await call(port, "/api/config", {
       method: "PATCH",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ path: path67, value })
+      body: JSON.stringify({ path: path69, value })
     });
     const data = await res.json();
     if (!res.ok) {
-      console.log(warn2(`Failed to update ${path67}: ${data.error}`));
+      console.log(warn2(`Failed to update ${path69}: ${data.error}`));
     } else if (data.needsRestart) {
-      console.log(warn2(`${path67} updated \u2014 restart required`));
+      console.log(warn2(`${path69} updated \u2014 restart required`));
     }
   }
 }
@@ -26782,35 +27187,35 @@ __export(instance_prompt_exports, {
   promptForInstance: () => promptForInstance
 });
 import fs56 from "fs";
-import path65 from "path";
-import os31 from "os";
+import path67 from "path";
+import os32 from "os";
 async function promptForInstance(opts) {
   const globalRoot = getGlobalRoot();
-  const globalConfigExists = fs56.existsSync(path65.join(globalRoot, "config.json"));
+  const globalConfigExists = fs56.existsSync(path67.join(globalRoot, "config.json"));
   const cwd = process.cwd();
-  const localRoot = path65.join(cwd, ".openacp");
+  const localRoot = path67.join(cwd, ".openacp");
   if (!globalConfigExists) return globalRoot;
   const isTTY = process.stdin.isTTY && process.stdout.isTTY;
   if (!isTTY) return globalRoot;
-  const registryPath = path65.join(globalRoot, "instances.json");
+  const registryPath = path67.join(globalRoot, "instances.json");
   const registry = new InstanceRegistry(registryPath);
   registry.load();
   const instances = registry.list().filter((e) => fs56.existsSync(e.root));
   const instanceOptions = instances.map((e) => {
     let name = e.id;
     try {
-      const raw = fs56.readFileSync(path65.join(e.root, "config.json"), "utf-8");
+      const raw = fs56.readFileSync(path67.join(e.root, "config.json"), "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed.instanceName) name = parsed.instanceName;
     } catch {
     }
     const isGlobal = e.root === globalRoot;
-    const displayPath = e.root.replace(os31.homedir(), "~");
+    const displayPath = e.root.replace(os32.homedir(), "~");
     const type = isGlobal ? "global" : "local";
     return { value: e.root, label: `${name} workspace (${type} \u2014 ${displayPath})` };
   });
   if (instanceOptions.length === 0) {
-    const globalDisplay = globalRoot.replace(os31.homedir(), "~");
+    const globalDisplay = globalRoot.replace(os32.homedir(), "~");
     instanceOptions.push({ value: globalRoot, label: `Global workspace (${globalDisplay})` });
   }
   if (instanceOptions.length === 1 && !opts.allowCreate) {
@@ -26821,7 +27226,7 @@ async function promptForInstance(opts) {
     label: o.label
   }));
   if (opts.allowCreate) {
-    const localDisplay = localRoot.replace(os31.homedir(), "~");
+    const localDisplay = localRoot.replace(os32.homedir(), "~");
     options.push({ value: localRoot, label: `New local workspace (${localDisplay})` });
   }
   const clack10 = await import("@clack/prompts");
@@ -26847,7 +27252,7 @@ var init_instance_prompt = __esm({
 
 // src/cli.ts
 import { setDefaultAutoSelectFamily } from "net";
-import path66 from "path";
+import path68 from "path";
 
 // src/cli/commands/help.ts
 function printHelp() {
@@ -27086,11 +27491,11 @@ Shows all plugins registered in the plugin registry.
 `);
     return;
   }
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path69 = await import("path");
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
-  const registryPath = path67.join(root, "plugins.json");
+  const root = instanceRoot ?? path69.join(os33.homedir(), ".openacp");
+  const registryPath = path69.join(root, "plugins.json");
   const registry = new PluginRegistry2(registryPath);
   await registry.load();
   const plugins = registry.list();
@@ -27225,11 +27630,11 @@ async function cmdPlugin(args2 = [], instanceRoot) {
 }
 async function setPluginEnabled(name, enabled, instanceRoot, json = false) {
   if (json) await muteForJson();
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path69 = await import("path");
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
-  const registryPath = path67.join(root, "plugins.json");
+  const root = instanceRoot ?? path69.join(os33.homedir(), ".openacp");
+  const registryPath = path69.join(root, "plugins.json");
   const registry = new PluginRegistry2(registryPath);
   await registry.load();
   const entry = registry.get(name);
@@ -27244,8 +27649,8 @@ async function setPluginEnabled(name, enabled, instanceRoot, json = false) {
   console.log(`Plugin ${name} ${enabled ? "enabled" : "disabled"}. Restart to apply.`);
 }
 async function configurePlugin(name, instanceRoot) {
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path69 = await import("path");
   const { corePlugins: corePlugins2 } = await Promise.resolve().then(() => (init_core_plugins(), core_plugins_exports));
   const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
   const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
@@ -27254,8 +27659,8 @@ async function configurePlugin(name, instanceRoot) {
     console.error(`Plugin "${name}" not found.`);
     process.exit(1);
   }
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
-  const basePath = path67.join(root, "plugins", "data");
+  const root = instanceRoot ?? path69.join(os33.homedir(), ".openacp");
+  const basePath = path69.join(root, "plugins", "data");
   const settingsManager = new SettingsManager2(basePath);
   const ctx = createInstallContext2({ pluginName: name, settingsManager, basePath });
   if (plugin2.configure) {
@@ -27268,14 +27673,14 @@ async function configurePlugin(name, instanceRoot) {
 }
 async function installPlugin(input2, instanceRoot, json = false) {
   if (json) await muteForJson();
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path69 = await import("path");
   const { execFileSync: execFileSync8 } = await import("child_process");
   const { getCurrentVersion: getCurrentVersion2 } = await Promise.resolve().then(() => (init_version(), version_exports));
   const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
   const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
+  const root = instanceRoot ?? path69.join(os33.homedir(), ".openacp");
   let pkgName;
   let pkgVersion;
   if (input2.startsWith("@")) {
@@ -27320,9 +27725,9 @@ async function installPlugin(input2, instanceRoot, json = false) {
   if (!json) console.log(`Installing ${installSpec}...`);
   const { corePlugins: corePlugins2 } = await Promise.resolve().then(() => (init_core_plugins(), core_plugins_exports));
   const builtinPlugin = corePlugins2.find((p2) => p2.name === pkgName);
-  const basePath = path67.join(root, "plugins", "data");
+  const basePath = path69.join(root, "plugins", "data");
   const settingsManager = new SettingsManager2(basePath);
-  const registryPath = path67.join(root, "plugins.json");
+  const registryPath = path69.join(root, "plugins.json");
   const pluginRegistry = new PluginRegistry2(registryPath);
   await pluginRegistry.load();
   if (builtinPlugin) {
@@ -27342,8 +27747,8 @@ async function installPlugin(input2, instanceRoot, json = false) {
     console.log(`\u2713 ${builtinPlugin.name} installed! Restart to activate.`);
     return;
   }
-  const pluginsDir = path67.join(root, "plugins");
-  const nodeModulesDir = path67.join(pluginsDir, "node_modules");
+  const pluginsDir = path69.join(root, "plugins");
+  const nodeModulesDir = path69.join(pluginsDir, "node_modules");
   try {
     execFileSync8("npm", ["install", installSpec, "--prefix", pluginsDir, "--save"], {
       stdio: json ? "pipe" : "inherit",
@@ -27357,8 +27762,8 @@ async function installPlugin(input2, instanceRoot, json = false) {
   const cliVersion = getCurrentVersion2();
   const isLocalPath = pkgName.startsWith("/") || pkgName.startsWith(".");
   try {
-    const pluginRoot = isLocalPath ? path67.resolve(pkgName) : path67.join(nodeModulesDir, pkgName);
-    const installedPkgPath = path67.join(pluginRoot, "package.json");
+    const pluginRoot = isLocalPath ? path69.resolve(pkgName) : path69.join(nodeModulesDir, pkgName);
+    const installedPkgPath = path69.join(pluginRoot, "package.json");
     const { readFileSync: readFileSync19 } = await import("fs");
     const installedPkg = JSON.parse(readFileSync19(installedPkgPath, "utf-8"));
     const minVersion = installedPkg.engines?.openacp?.replace(/[>=^~\s]/g, "");
@@ -27373,7 +27778,7 @@ async function installPlugin(input2, instanceRoot, json = false) {
         }
       }
     }
-    const pluginModule = await import(path67.join(pluginRoot, installedPkg.main ?? "dist/index.js"));
+    const pluginModule = await import(path69.join(pluginRoot, installedPkg.main ?? "dist/index.js"));
     const plugin2 = pluginModule.default;
     if (plugin2?.install) {
       const ctx = createInstallContext2({ pluginName: plugin2.name ?? pkgName, settingsManager, basePath });
@@ -27403,12 +27808,12 @@ async function installPlugin(input2, instanceRoot, json = false) {
 }
 async function uninstallPlugin(name, purge, instanceRoot, json = false) {
   if (json) await muteForJson();
-  const os32 = await import("os");
-  const path67 = await import("path");
+  const os33 = await import("os");
+  const path69 = await import("path");
   const fs57 = await import("fs");
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
-  const registryPath = path67.join(root, "plugins.json");
+  const root = instanceRoot ?? path69.join(os33.homedir(), ".openacp");
+  const registryPath = path69.join(root, "plugins.json");
   const registry = new PluginRegistry2(registryPath);
   await registry.load();
   const entry = registry.get(name);
@@ -27428,7 +27833,7 @@ async function uninstallPlugin(name, purge, instanceRoot, json = false) {
     if (plugin2?.uninstall) {
       const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
       const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
-      const basePath = path67.join(root, "plugins", "data");
+      const basePath = path69.join(root, "plugins", "data");
       const settingsManager = new SettingsManager2(basePath);
       const ctx = createInstallContext2({ pluginName: name, settingsManager, basePath });
       await plugin2.uninstall(ctx, { purge });
@@ -27436,7 +27841,7 @@ async function uninstallPlugin(name, purge, instanceRoot, json = false) {
   } catch {
   }
   if (purge) {
-    const pluginDir = path67.join(root, "plugins", name);
+    const pluginDir = path69.join(root, "plugins", name);
     fs57.rmSync(pluginDir, { recursive: true, force: true });
   }
   registry.remove(name);
@@ -28266,13 +28671,13 @@ init_version();
 init_helpers();
 init_output();
 init_instance_hint();
-import path37 from "path";
-import os16 from "os";
+import path39 from "path";
+import os17 from "os";
 import fs36 from "fs";
 async function cmdStart(args2 = [], instanceRoot) {
   const json = isJsonMode(args2);
   if (json) await muteForJson();
-  const root = instanceRoot ?? path37.join(os16.homedir(), ".openacp");
+  const root = instanceRoot ?? path39.join(os17.homedir(), ".openacp");
   if (!json && wantsHelp(args2)) {
     console.log(`
 \x1B[1mopenacp start\x1B[0m \u2014 Start OpenACP as a background daemon
@@ -28298,7 +28703,7 @@ Requires an existing config \u2014 run 'openacp' first to set up.
   await checkAndPromptUpdate();
   const { startDaemon: startDaemon2, getPidPath: getPidPath2 } = await Promise.resolve().then(() => (init_daemon2(), daemon_exports));
   const { ConfigManager: ConfigManager2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
-  const cm = new ConfigManager2(path37.join(root, "config.json"));
+  const cm = new ConfigManager2(path39.join(root, "config.json"));
   if (await cm.exists()) {
     await cm.load();
     const config = cm.get();
@@ -28309,11 +28714,11 @@ Requires an existing config \u2014 run 'openacp' first to set up.
       process.exit(1);
     }
     if (json) {
-      let instanceId = path37.basename(root);
+      let instanceId = path39.basename(root);
       try {
         const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
         const { InstanceRegistry: InstanceRegistry2 } = await Promise.resolve().then(() => (init_instance_registry(), instance_registry_exports));
-        const reg = new InstanceRegistry2(path37.join(getGlobalRoot2(), "instances.json"));
+        const reg = new InstanceRegistry2(path39.join(getGlobalRoot2(), "instances.json"));
         reg.load();
         const entry = reg.getByRoot(root);
         if (entry) instanceId = entry.id;
@@ -28321,7 +28726,7 @@ Requires an existing config \u2014 run 'openacp' first to set up.
       }
       let port = null;
       try {
-        const portStr = fs36.readFileSync(path37.join(root, "api.port"), "utf-8").trim();
+        const portStr = fs36.readFileSync(path39.join(root, "api.port"), "utf-8").trim();
         port = parseInt(portStr) || null;
       } catch {
         port = config.api.port ?? null;
@@ -28330,7 +28735,7 @@ Requires an existing config \u2014 run 'openacp' first to set up.
         pid: result.pid,
         instanceId,
         name: config.instanceName ?? null,
-        directory: path37.dirname(root),
+        directory: path39.dirname(root),
         dir: root,
         port
       });
@@ -28467,16 +28872,20 @@ the API for live updates. When stopped, edits config file directly.
   }
   const { runConfigEditor: runConfigEditor2 } = await Promise.resolve().then(() => (init_config_editor(), config_editor_exports));
   const { ConfigManager: ConfigManager2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
+  const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
+  const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
   const cm = new ConfigManager2(instanceRoot ? pathMod.join(instanceRoot, "config.json") : void 0);
   if (!await cm.exists()) {
     console.error('No config found. Run "openacp" first to set up.');
     process.exit(1);
   }
+  const root = instanceRoot ?? getGlobalRoot2();
+  const settingsManager = new SettingsManager2(pathMod.join(root, "plugins", "data"));
   const port = readApiPort(void 0, instanceRoot);
   if (port !== null) {
-    await runConfigEditor2(cm, "api", port);
+    await runConfigEditor2(cm, "api", port, settingsManager);
   } else {
-    await runConfigEditor2(cm, "file");
+    await runConfigEditor2(cm, "file", void 0, settingsManager);
   }
 }
 
@@ -28497,9 +28906,9 @@ start fresh with the setup wizard. The daemon must be stopped first.
 `);
     return;
   }
-  const os32 = await import("os");
-  const path67 = await import("path");
-  const root = instanceRoot ?? path67.join(os32.homedir(), ".openacp");
+  const os33 = await import("os");
+  const path69 = await import("path");
+  const root = instanceRoot ?? path69.join(os33.homedir(), ".openacp");
   const { getStatus: getStatus2, getPidPath: getPidPath2 } = await Promise.resolve().then(() => (init_daemon2(), daemon_exports));
   const status = getStatus2(getPidPath2(root));
   if (status.running) {
@@ -28657,11 +29066,11 @@ init_instance_context();
 init_status();
 init_output();
 init_helpers();
-import path58 from "path";
-import os27 from "os";
+import path60 from "path";
+import os28 from "os";
 import fs52 from "fs";
 async function buildInstanceListEntries() {
-  const registryPath = path58.join(getGlobalRoot(), "instances.json");
+  const registryPath = path60.join(getGlobalRoot(), "instances.json");
   const registry = new InstanceRegistry(registryPath);
   registry.load();
   return registry.list().map((entry) => {
@@ -28669,7 +29078,7 @@ async function buildInstanceListEntries() {
     return {
       id: entry.id,
       name: info.name,
-      directory: path58.dirname(entry.root),
+      directory: path60.dirname(entry.root),
       root: entry.root,
       status: info.pid ? "running" : "stopped",
       port: info.apiPort
@@ -28719,7 +29128,7 @@ async function cmdInstancesList(args2) {
   for (const e of entries) {
     const status = e.status === "running" ? "\u25CF running" : "\u25CB stopped";
     const port = e.port ? `:${e.port}` : "\u2014";
-    const dir = e.directory.replace(os27.homedir(), "~");
+    const dir = e.directory.replace(os28.homedir(), "~");
     const name = (e.name ?? e.id).padEnd(16);
     console.log(`  ${status.padEnd(10)} ${e.id.padEnd(16)} ${name} ${dir}  ${port}`);
   }
@@ -28742,9 +29151,9 @@ async function cmdInstancesCreate(args2) {
   const agentIdx = args2.indexOf("--agent");
   const agent = agentIdx !== -1 ? args2[agentIdx + 1] : void 0;
   const noInteractive = args2.includes("--no-interactive");
-  const resolvedDir = path58.resolve(rawDir.replace(/^~/, os27.homedir()));
-  const instanceRoot = path58.join(resolvedDir, ".openacp");
-  const registryPath = path58.join(getGlobalRoot(), "instances.json");
+  const resolvedDir = path60.resolve(rawDir.replace(/^~/, os28.homedir()));
+  const instanceRoot = path60.join(resolvedDir, ".openacp");
+  const registryPath = path60.join(getGlobalRoot(), "instances.json");
   const registry = new InstanceRegistry(registryPath);
   registry.load();
   if (fs52.existsSync(instanceRoot)) {
@@ -28754,8 +29163,8 @@ async function cmdInstancesCreate(args2) {
       console.error(`Error: Instance already exists at ${resolvedDir} (id: ${existing.id})`);
       process.exit(1);
     }
-    const configPath = path58.join(instanceRoot, "config.json");
-    let name2 = path58.basename(resolvedDir);
+    const configPath = path60.join(instanceRoot, "config.json");
+    let name2 = path60.basename(resolvedDir);
     try {
       const config = JSON.parse(fs52.readFileSync(configPath, "utf-8"));
       name2 = config.instanceName ?? name2;
@@ -28770,15 +29179,15 @@ async function cmdInstancesCreate(args2) {
   const name = instanceName ?? `openacp-${registry.list().length + 1}`;
   const id = registry.uniqueId(generateSlug(name));
   if (rawFrom) {
-    const fromRoot = path58.join(path58.resolve(rawFrom.replace(/^~/, os27.homedir())), ".openacp");
-    if (!fs52.existsSync(path58.join(fromRoot, "config.json"))) {
+    const fromRoot = path60.join(path60.resolve(rawFrom.replace(/^~/, os28.homedir())), ".openacp");
+    if (!fs52.existsSync(path60.join(fromRoot, "config.json"))) {
       console.error(`Error: No OpenACP instance found at ${rawFrom}`);
       process.exit(1);
     }
     fs52.mkdirSync(instanceRoot, { recursive: true });
     const { copyInstance: copyInstance2 } = await Promise.resolve().then(() => (init_instance_copy(), instance_copy_exports));
     await copyInstance2(fromRoot, instanceRoot, {});
-    const configPath = path58.join(instanceRoot, "config.json");
+    const configPath = path60.join(instanceRoot, "config.json");
     try {
       const config = JSON.parse(fs52.readFileSync(configPath, "utf-8"));
       config.instanceName = name;
@@ -28789,14 +29198,14 @@ async function cmdInstancesCreate(args2) {
     fs52.mkdirSync(instanceRoot, { recursive: true });
     const config = { instanceName: name, runMode: "daemon" };
     if (agent) config.defaultAgent = agent;
-    fs52.writeFileSync(path58.join(instanceRoot, "config.json"), JSON.stringify(config, null, 2));
-    fs52.writeFileSync(path58.join(instanceRoot, "plugins.json"), JSON.stringify({ version: 1, installed: {} }, null, 2));
+    fs52.writeFileSync(path60.join(instanceRoot, "config.json"), JSON.stringify(config, null, 2));
+    fs52.writeFileSync(path60.join(instanceRoot, "plugins.json"), JSON.stringify({ version: 1, installed: {} }, null, 2));
   } else {
     fs52.mkdirSync(instanceRoot, { recursive: true });
     const config = { instanceName: name, runMode: "daemon" };
     if (agent) config.defaultAgent = agent;
-    fs52.writeFileSync(path58.join(instanceRoot, "config.json"), JSON.stringify(config, null, 2));
-    fs52.writeFileSync(path58.join(instanceRoot, "plugins.json"), JSON.stringify({ version: 1, installed: {} }, null, 2));
+    fs52.writeFileSync(path60.join(instanceRoot, "config.json"), JSON.stringify(config, null, 2));
+    fs52.writeFileSync(path60.join(instanceRoot, "plugins.json"), JSON.stringify({ version: 1, installed: {} }, null, 2));
     console.log(`Instance created at ${resolvedDir}. Run 'openacp setup' inside that directory to configure it.`);
   }
   registry.register(id, instanceRoot);
@@ -28808,7 +29217,7 @@ async function outputInstance(json, { id, root }) {
   const entry = {
     id,
     name: info.name,
-    directory: path58.dirname(root),
+    directory: path60.dirname(root),
     root,
     status: info.pid ? "running" : "stopped",
     port: info.apiPort
@@ -28817,7 +29226,7 @@ async function outputInstance(json, { id, root }) {
     jsonSuccess(entry);
     return;
   }
-  console.log(`Instance created: ${info.name ?? id} at ${path58.dirname(root)}`);
+  console.log(`Instance created: ${info.name ?? id} at ${path60.dirname(root)}`);
 }
 
 // src/cli/commands/integrate.ts
@@ -29580,22 +29989,22 @@ Options:
 }
 
 // src/cli/commands/onboard.ts
-import * as path59 from "path";
+import * as path61 from "path";
 async function cmdOnboard(instanceRoot) {
   const { ConfigManager: ConfigManager2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
   const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
   const { PluginRegistry: PluginRegistry2 } = await Promise.resolve().then(() => (init_plugin_registry(), plugin_registry_exports));
   const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
   const OPENACP_DIR = instanceRoot ?? getGlobalRoot2();
-  const PLUGINS_DATA_DIR = path59.join(OPENACP_DIR, "plugins", "data");
-  const REGISTRY_PATH = path59.join(OPENACP_DIR, "plugins.json");
-  const cm = new ConfigManager2(path59.join(OPENACP_DIR, "config.json"));
+  const PLUGINS_DATA_DIR = path61.join(OPENACP_DIR, "plugins", "data");
+  const REGISTRY_PATH = path61.join(OPENACP_DIR, "plugins.json");
+  const cm = new ConfigManager2(path61.join(OPENACP_DIR, "config.json"));
   const settingsManager = new SettingsManager2(PLUGINS_DATA_DIR);
   const pluginRegistry = new PluginRegistry2(REGISTRY_PATH);
   await pluginRegistry.load();
   if (await cm.exists()) {
     const { runReconfigure: runReconfigure2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
-    await runReconfigure2(cm);
+    await runReconfigure2(cm, settingsManager);
   } else {
     const { runSetup: runSetup2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
     await runSetup2(cm, { skipRunMode: true, settingsManager, pluginRegistry, instanceRoot: OPENACP_DIR });
@@ -29608,17 +30017,17 @@ init_instance_context();
 init_instance_registry();
 init_instance_hint();
 init_output();
-import path60 from "path";
-import os28 from "os";
+import path62 from "path";
+import os29 from "os";
 import fs53 from "fs";
 import { randomUUID as randomUUID5 } from "crypto";
 async function cmdDefault(command2, instanceRoot) {
   const args2 = command2 ? [command2] : [];
   const json = isJsonMode(args2);
   if (json) await muteForJson();
-  const root = instanceRoot ?? path60.join(os28.homedir(), ".openacp");
-  const pluginsDataDir = path60.join(root, "plugins", "data");
-  const registryPath = path60.join(root, "plugins.json");
+  const root = instanceRoot ?? path62.join(os29.homedir(), ".openacp");
+  const pluginsDataDir = path62.join(root, "plugins", "data");
+  const registryPath = path62.join(root, "plugins.json");
   const forceForeground = command2 === "--foreground";
   if (command2 && !command2.startsWith("-")) {
     const { suggestMatch: suggestMatch2 } = await Promise.resolve().then(() => (init_suggest(), suggest_exports));
@@ -29650,7 +30059,7 @@ async function cmdDefault(command2, instanceRoot) {
   }
   await checkAndPromptUpdate();
   const { ConfigManager: ConfigManager2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
-  const configPath = path60.join(root, "config.json");
+  const configPath = path62.join(root, "config.json");
   const cm = new ConfigManager2(configPath);
   if (!await cm.exists()) {
     const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
@@ -29678,9 +30087,9 @@ async function cmdDefault(command2, instanceRoot) {
       process.exit(1);
     }
     if (json) {
-      let instanceId2 = path60.basename(root);
+      let instanceId2 = path62.basename(root);
       try {
-        const reg2 = new InstanceRegistry(path60.join(getGlobalRoot(), "instances.json"));
+        const reg2 = new InstanceRegistry(path62.join(getGlobalRoot(), "instances.json"));
         reg2.load();
         const entry = reg2.getByRoot(root);
         if (entry) instanceId2 = entry.id;
@@ -29688,7 +30097,7 @@ async function cmdDefault(command2, instanceRoot) {
       }
       let port = null;
       try {
-        const portStr = fs53.readFileSync(path60.join(root, "api.port"), "utf-8").trim();
+        const portStr = fs53.readFileSync(path62.join(root, "api.port"), "utf-8").trim();
         port = parseInt(portStr) || null;
       } catch {
         port = config.api.port ?? null;
@@ -29697,7 +30106,7 @@ async function cmdDefault(command2, instanceRoot) {
         pid: result.pid,
         instanceId: instanceId2,
         name: config.instanceName ?? null,
-        directory: path60.dirname(root),
+        directory: path62.dirname(root),
         dir: root,
         port
       });
@@ -29710,7 +30119,7 @@ async function cmdDefault(command2, instanceRoot) {
   markRunning2(root);
   printInstanceHint(root);
   const { startServer: startServer2 } = await Promise.resolve().then(() => (init_main(), main_exports));
-  const reg = new InstanceRegistry(path60.join(getGlobalRoot(), "instances.json"));
+  const reg = new InstanceRegistry(path62.join(getGlobalRoot(), "instances.json"));
   reg.load();
   const existingEntry = reg.getByRoot(root);
   const instanceId = existingEntry?.id ?? randomUUID5();
@@ -29722,7 +30131,7 @@ async function cmdDefault(command2, instanceRoot) {
   if (json) {
     let port = null;
     try {
-      const portStr = fs53.readFileSync(path60.join(root, "api.port"), "utf-8").trim();
+      const portStr = fs53.readFileSync(path62.join(root, "api.port"), "utf-8").trim();
       port = parseInt(portStr) || null;
     } catch {
       port = config.api.port ?? null;
@@ -29731,7 +30140,7 @@ async function cmdDefault(command2, instanceRoot) {
       pid: process.pid,
       instanceId,
       name: config.instanceName ?? null,
-      directory: path60.dirname(root),
+      directory: path62.dirname(root),
       dir: root,
       port
     });
@@ -29800,7 +30209,7 @@ async function showAlreadyRunningMenu(root) {
 // src/cli/commands/dev.ts
 init_helpers();
 import fs54 from "fs";
-import path61 from "path";
+import path63 from "path";
 async function cmdDev(args2 = []) {
   if (wantsHelp(args2)) {
     console.log(`
@@ -29827,12 +30236,12 @@ async function cmdDev(args2 = []) {
     console.error("Error: missing plugin path. Usage: openacp dev <plugin-path>");
     process.exit(1);
   }
-  const pluginPath = path61.resolve(pluginPathArg);
+  const pluginPath = path63.resolve(pluginPathArg);
   if (!fs54.existsSync(pluginPath)) {
     console.error(`Error: plugin path does not exist: ${pluginPath}`);
     process.exit(1);
   }
-  const tsconfigPath = path61.join(pluginPath, "tsconfig.json");
+  const tsconfigPath = path63.join(pluginPath, "tsconfig.json");
   const hasTsconfig = fs54.existsSync(tsconfigPath);
   if (hasTsconfig) {
     console.log("Compiling plugin TypeScript...");
@@ -29874,10 +30283,10 @@ async function cmdDev(args2 = []) {
 
 // src/cli/commands/attach.ts
 init_helpers();
-import path62 from "path";
-import os29 from "os";
+import path64 from "path";
+import os30 from "os";
 async function cmdAttach(args2 = [], instanceRoot) {
-  const root = instanceRoot ?? path62.join(os29.homedir(), ".openacp");
+  const root = instanceRoot ?? path64.join(os30.homedir(), ".openacp");
   if (wantsHelp(args2)) {
     console.log(`
 \x1B[1mopenacp attach\x1B[0m \u2014 Attach to a running daemon
@@ -29911,15 +30320,15 @@ Press Ctrl+C to detach.
   console.log("");
   const { spawn: spawn9 } = await import("child_process");
   const { expandHome: expandHome4 } = await Promise.resolve().then(() => (init_config2(), config_exports));
-  let logDir2 = path62.join(root, "logs");
+  let logDir2 = path64.join(root, "logs");
   try {
-    const configPath = path62.join(root, "config.json");
+    const configPath = path64.join(root, "config.json");
     const { readFileSync: readFileSync19 } = await import("fs");
     const config = JSON.parse(readFileSync19(configPath, "utf-8"));
     if (config.logging?.logDir) logDir2 = expandHome4(config.logging.logDir);
   } catch {
   }
-  const logFile = path62.join(logDir2, "openacp.log");
+  const logFile = path64.join(logDir2, "openacp.log");
   const tail = spawn9("tail", ["-f", "-n", "50", logFile], { stdio: "inherit" });
   tail.on("error", (err) => {
     console.error(`Cannot tail log file: ${err.message}`);
@@ -29931,8 +30340,8 @@ Press Ctrl+C to detach.
 init_api_client();
 init_instance_registry();
 init_output();
-import path63 from "path";
-import os30 from "os";
+import path65 from "path";
+import os31 from "os";
 import qrcode from "qrcode-terminal";
 async function cmdRemote(args2, instanceRoot) {
   const json = isJsonMode(args2);
@@ -29947,7 +30356,7 @@ async function cmdRemote(args2, instanceRoot) {
   const scopes = scopesRaw ? scopesRaw.split(",").map((s) => s.trim()) : void 0;
   let resolvedInstanceRoot2 = instanceRoot;
   if (instanceId) {
-    const registryPath = path63.join(os30.homedir(), ".openacp", "instances.json");
+    const registryPath = path65.join(os31.homedir(), ".openacp", "instances.json");
     const registry = new InstanceRegistry(registryPath);
     await registry.load();
     const entry = registry.get(instanceId);
@@ -30085,7 +30494,7 @@ function extractFlag(args2, flag) {
 // src/cli/commands/setup.ts
 init_output();
 import * as fs55 from "fs";
-import * as path64 from "path";
+import * as path66 from "path";
 function parseFlag(args2, flag) {
   const idx = args2.indexOf(flag);
   return idx !== -1 ? args2[idx + 1] : void 0;
@@ -30113,7 +30522,7 @@ async function cmdSetup(args2, instanceRoot) {
   }
   const runMode = rawRunMode;
   const defaultAgent = agentRaw.split(",")[0].trim();
-  const configPath = path64.join(instanceRoot, "config.json");
+  const configPath = path66.join(instanceRoot, "config.json");
   let existing = {};
   if (fs55.existsSync(configPath)) {
     try {
@@ -30221,7 +30630,7 @@ async function main() {
     if (envRoot) {
       const { createInstanceContext: createInstanceContext2, getGlobalRoot: getGlobal } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
       const { InstanceRegistry: InstanceRegistry2 } = await Promise.resolve().then(() => (init_instance_registry(), instance_registry_exports));
-      const registry = new InstanceRegistry2(path66.join(getGlobal(), "instances.json"));
+      const registry = new InstanceRegistry2(path68.join(getGlobal(), "instances.json"));
       await registry.load();
       const entry = registry.getByRoot(envRoot);
       const { randomUUID: randomUUID6 } = await import("crypto");