@openacp/cli 2026.404.1 → 2026.405.1

package/dist/index.js

@@ -244,6 +244,45 @@ var init_log = __esm({
   }
 });
 
+// src/core/config/config-migrations.ts
+function applyMigrations(raw, migrationList = migrations, ctx) {
+  let changed = false;
+  for (const migration of migrationList) {
+    if (migration.apply(raw, ctx)) {
+      changed = true;
+    }
+  }
+  return { changed };
+}
+var log2, migrations;
+var init_config_migrations = __esm({
+  "src/core/config/config-migrations.ts"() {
+    "use strict";
+    init_log();
+    log2 = createChildLogger({ module: "config-migrations" });
+    migrations = [
+      {
+        name: "add-instance-name",
+        apply(raw) {
+          if (raw.instanceName) return false;
+          raw.instanceName = "Main";
+          log2.info("Added instanceName to config");
+          return true;
+        }
+      },
+      {
+        name: "delete-display-verbosity",
+        apply(raw) {
+          if (!("displayVerbosity" in raw)) return false;
+          delete raw.displayVerbosity;
+          log2.info("Removed legacy displayVerbosity key from config");
+          return true;
+        }
+      }
+    ];
+  }
+});
+
 // src/core/instance/instance-context.ts
 var instance_context_exports = {};
 __export(instance_context_exports, {
@@ -308,145 +347,6 @@ var init_instance_context = __esm({
   }
 });
 
-// src/core/config/config-migrations.ts
-import * as fs3 from "fs";
-import * as path3 from "path";
-function applyMigrations(raw, migrationList = migrations, ctx) {
-  let changed = false;
-  for (const migration of migrationList) {
-    if (migration.apply(raw, ctx)) {
-      changed = true;
-    }
-  }
-  return { changed };
-}
-var log2, migrations;
-var init_config_migrations = __esm({
-  "src/core/config/config-migrations.ts"() {
-    "use strict";
-    init_log();
-    init_instance_context();
-    log2 = createChildLogger({ module: "config-migrations" });
-    migrations = [
-      {
-        name: "add-tunnel-section",
-        apply(raw) {
-          if (raw.tunnel) return false;
-          raw.tunnel = {
-            enabled: true,
-            port: 3100,
-            provider: "cloudflare",
-            options: {},
-            storeTtlMinutes: 60,
-            auth: { enabled: false }
-          };
-          log2.info("Added tunnel section to config (enabled by default with cloudflare)");
-          return true;
-        }
-      },
-      {
-        name: "fix-agent-commands",
-        apply(raw) {
-          const COMMAND_MIGRATIONS = {
-            "claude-agent-acp": ["claude", "claude-code"]
-          };
-          const agents = raw.agents;
-          if (!agents || typeof agents !== "object") return false;
-          let changed = false;
-          for (const [agentName, agentDef] of Object.entries(agents)) {
-            if (!agentDef || typeof agentDef !== "object" || !("command" in agentDef)) continue;
-            const def = agentDef;
-            if (typeof def.command !== "string") continue;
-            for (const [correctCmd, legacyCmds] of Object.entries(COMMAND_MIGRATIONS)) {
-              if (legacyCmds.includes(def.command)) {
-                log2.warn(
-                  { agent: agentName, oldCommand: def.command, newCommand: correctCmd },
-                  `Auto-migrating agent command: "${def.command}" \u2192 "${correctCmd}"`
-                );
-                def.command = correctCmd;
-                changed = true;
-              }
-            }
-          }
-          return changed;
-        }
-      },
-      {
-        name: "migrate-agents-to-store",
-        apply(raw, ctx) {
-          const agentsJsonPath = path3.join(ctx?.configDir ?? getGlobalRoot(), "agents.json");
-          if (fs3.existsSync(agentsJsonPath)) return false;
-          const agents = raw.agents;
-          if (!agents || Object.keys(agents).length === 0) return false;
-          const COMMAND_TO_REGISTRY = {
-            "claude-agent-acp": "claude-acp",
-            "codex": "codex-acp"
-          };
-          const installed = {};
-          for (const [key, val] of Object.entries(agents)) {
-            const cfg = val;
-            const command = typeof cfg.command === "string" ? cfg.command : "";
-            const registryId = COMMAND_TO_REGISTRY[command] ?? null;
-            installed[key] = {
-              registryId,
-              name: key.charAt(0).toUpperCase() + key.slice(1),
-              version: "unknown",
-              distribution: "custom",
-              command: cfg.command,
-              args: cfg.args ?? [],
-              env: cfg.env ?? {},
-              workingDirectory: cfg.workingDirectory ?? void 0,
-              installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-              binaryPath: null
-            };
-          }
-          fs3.mkdirSync(path3.dirname(agentsJsonPath), { recursive: true });
-          fs3.writeFileSync(agentsJsonPath, JSON.stringify({ version: 1, installed }, null, 2));
-          raw.agents = {};
-          return true;
-        }
-      },
-      {
-        name: "add-instance-name",
-        apply(raw) {
-          if (raw.instanceName) return false;
-          raw.instanceName = "Main";
-          log2.info("Added instanceName to config");
-          return true;
-        }
-      },
-      {
-        name: "migrate-display-verbosity-to-output-mode",
-        apply(raw) {
-          const channels = raw.channels;
-          if (!channels) return false;
-          let changed = false;
-          for (const [, channelCfg] of Object.entries(channels)) {
-            if (!channelCfg || typeof channelCfg !== "object") continue;
-            const cfg = channelCfg;
-            if (cfg.displayVerbosity && !cfg.outputMode) {
-              cfg.outputMode = cfg.displayVerbosity;
-              changed = true;
-            }
-          }
-          return changed;
-        }
-      },
-      {
-        name: "migrate-tunnel-provider-to-openacp",
-        apply(raw) {
-          const tunnel = raw.tunnel;
-          if (!tunnel) return false;
-          if (tunnel.provider !== "cloudflare") return false;
-          tunnel.provider = "openacp";
-          log2.info("Migrated tunnel provider: cloudflare \u2192 openacp (OpenACP managed tunnel)");
-          return true;
-        }
-      }
-    ];
-  }
-});
-
 // src/core/config/config-registry.ts
 var config_registry_exports = {};
 __export(config_registry_exports, {
@@ -454,30 +354,29 @@ __export(config_registry_exports, {
   ConfigValidationError: () => ConfigValidationError,
   getConfigValue: () => getConfigValue,
   getFieldDef: () => getFieldDef,
-  getFieldValueAsync: () => getFieldValueAsync,
   getSafeFields: () => getSafeFields,
   isHotReloadable: () => isHotReloadable,
   resolveOptions: () => resolveOptions,
   setFieldValueAsync: () => setFieldValueAsync
 });
-import * as fs4 from "fs";
-import * as path4 from "path";
-function getFieldDef(path35) {
-  return CONFIG_REGISTRY.find((f) => f.path === path35);
+import * as fs3 from "fs";
+import * as path3 from "path";
+function getFieldDef(path34) {
+  return CONFIG_REGISTRY.find((f) => f.path === path34);
 }
 function getSafeFields() {
   return CONFIG_REGISTRY.filter((f) => f.scope === "safe");
 }
-function isHotReloadable(path35) {
-  const def = getFieldDef(path35);
+function isHotReloadable(path34) {
+  const def = getFieldDef(path34);
   return def?.hotReload ?? false;
 }
 function resolveOptions(def, config) {
   if (!def.options) return void 0;
   return typeof def.options === "function" ? def.options(config) : def.options;
 }
-function getConfigValue(config, path35) {
-  const parts = path35.split(".");
+function getConfigValue(config, path34) {
+  const parts = path34.split(".");
   let current = config;
   for (const part of parts) {
     if (current && typeof current === "object" && part in current) {
@@ -488,13 +387,6 @@ function getConfigValue(config, path35) {
   }
   return current;
 }
-async function getFieldValueAsync(field, configManager, settingsManager) {
-  if (field.plugin && settingsManager) {
-    const settings = await settingsManager.loadSettings(field.plugin.name);
-    return settings[field.plugin.key];
-  }
-  return getConfigValue(configManager.get(), field.path);
-}
 function validateFieldValue(field, value) {
   switch (field.type) {
     case "number":
@@ -520,17 +412,8 @@ function validateFieldValue(field, value) {
     }
   }
 }
-async function setFieldValueAsync(field, value, configManager, settingsManager) {
+async function setFieldValueAsync(field, value, configManager) {
   validateFieldValue(field, value);
-  if (field.plugin && settingsManager) {
-    await settingsManager.updatePluginSettings(field.plugin.name, {
-      [field.plugin.key]: value
-    });
-    if (configManager.emit) {
-      configManager.emit("config:changed", { path: field.path, value, oldValue: void 0 });
-    }
-    return { needsRestart: !field.hotReload };
-  }
   await configManager.setPath(field.path, value);
   return { needsRestart: !field.hotReload };
 }
@@ -545,38 +428,20 @@ var init_config_registry = __esm({
         displayName: "Default Agent",
         group: "agent",
         type: "select",
-        options: (config) => {
+        options: () => {
           try {
-            const agentsPath = path4.join(getGlobalRoot(), "agents.json");
-            if (fs4.existsSync(agentsPath)) {
-              const data = JSON.parse(fs4.readFileSync(agentsPath, "utf-8"));
+            const agentsPath = path3.join(getGlobalRoot(), "agents.json");
+            if (fs3.existsSync(agentsPath)) {
+              const data = JSON.parse(fs3.readFileSync(agentsPath, "utf-8"));
               return Object.keys(data.installed ?? {});
             }
           } catch {
           }
-          return Object.keys(config.agents ?? {});
+          return [];
         },
         scope: "safe",
         hotReload: true
       },
-      {
-        path: "channels.telegram.outputMode",
-        displayName: "Telegram Output Mode",
-        group: "display",
-        type: "select",
-        options: ["low", "medium", "high"],
-        scope: "safe",
-        hotReload: true
-      },
-      {
-        path: "channels.discord.outputMode",
-        displayName: "Discord Output Mode",
-        group: "display",
-        type: "select",
-        options: ["low", "medium", "high"],
-        scope: "safe",
-        hotReload: true
-      },
       {
         path: "logging.level",
         displayName: "Log Level",
@@ -586,33 +451,6 @@ var init_config_registry = __esm({
         scope: "safe",
         hotReload: true
       },
-      {
-        path: "tunnel.enabled",
-        displayName: "Tunnel",
-        group: "tunnel",
-        type: "toggle",
-        scope: "safe",
-        hotReload: false,
-        plugin: { name: "@openacp/tunnel", key: "enabled" }
-      },
-      {
-        path: "security.maxConcurrentSessions",
-        displayName: "Max Concurrent Sessions",
-        group: "security",
-        type: "number",
-        scope: "safe",
-        hotReload: true,
-        plugin: { name: "@openacp/security", key: "maxConcurrentSessions" }
-      },
-      {
-        path: "security.sessionTimeoutMinutes",
-        displayName: "Session Timeout (min)",
-        group: "security",
-        type: "number",
-        scope: "safe",
-        hotReload: true,
-        plugin: { name: "@openacp/security", key: "sessionTimeoutMinutes" }
-      },
       {
         path: "workspace.baseDir",
         displayName: "Workspace Directory",
@@ -629,25 +467,6 @@ var init_config_registry = __esm({
         scope: "safe",
         hotReload: true
       },
-      {
-        path: "speech.stt.provider",
-        displayName: "Speech to Text",
-        group: "speech",
-        type: "select",
-        options: ["groq"],
-        scope: "safe",
-        hotReload: true,
-        plugin: { name: "@openacp/speech", key: "sttProvider" }
-      },
-      {
-        path: "speech.stt.apiKey",
-        displayName: "STT API Key",
-        group: "speech",
-        type: "string",
-        scope: "sensitive",
-        hotReload: true,
-        plugin: { name: "@openacp/speech", key: "groqApiKey" }
-      },
       {
         path: "agentSwitch.labelHistory",
         displayName: "Label Agent in History",
@@ -668,36 +487,24 @@ var init_config_registry = __esm({
 
 // src/core/config/config.ts
 import { z } from "zod";
-import * as fs5 from "fs";
-import * as path5 from "path";
+import * as fs4 from "fs";
+import * as path4 from "path";
 import * as os3 from "os";
+import { randomBytes } from "crypto";
 import { EventEmitter } from "events";
 function expandHome3(p) {
   if (p.startsWith("~")) {
-    return path5.join(os3.homedir(), p.slice(1));
+    return path4.join(os3.homedir(), p.slice(1));
   }
   return p;
 }
-var log3, BaseChannelSchema, AgentSchema, LoggingSchema, TunnelAuthSchema, TunnelSchema, UsageSchema, SpeechProviderSchema, SpeechSchema, ConfigSchema, DEFAULT_CONFIG, ConfigManager;
+var log3, LoggingSchema, ConfigSchema, DEFAULT_CONFIG, ConfigManager;
 var init_config = __esm({
   "src/core/config/config.ts"() {
     "use strict";
     init_config_migrations();
     init_log();
     log3 = createChildLogger({ module: "config" });
-    BaseChannelSchema = z.object({
-      enabled: z.boolean().default(false),
-      adapter: z.string().optional(),
-      // package name for plugin adapters
-      displayVerbosity: z.enum(["low", "medium", "high"]).optional(),
-      outputMode: z.enum(["low", "medium", "high"]).optional()
-    }).passthrough();
-    AgentSchema = z.object({
-      command: z.string(),
-      args: z.array(z.string()).default([]),
-      workingDirectory: z.string().optional(),
-      env: z.record(z.string(), z.string()).default({})
-    });
     LoggingSchema = z.object({
       level: z.enum(["silent", "debug", "info", "warn", "error", "fatal"]).default("info"),
       logDir: z.string().default("~/.openacp/logs"),
@@ -705,44 +512,8 @@ var init_config = __esm({
       maxFiles: z.number().default(7),
       sessionLogRetentionDays: z.number().default(30)
     }).default({});
-    TunnelAuthSchema = z.object({
-      enabled: z.boolean().default(false),
-      token: z.string().optional()
-    }).default({});
-    TunnelSchema = z.object({
-      enabled: z.boolean().default(false),
-      port: z.number().default(3100),
-      provider: z.enum(["openacp", "cloudflare", "ngrok", "bore", "tailscale"]).default("openacp"),
-      options: z.record(z.string(), z.unknown()).default({}),
-      maxUserTunnels: z.number().default(5),
-      storeTtlMinutes: z.number().default(60),
-      auth: TunnelAuthSchema
-    }).default({});
-    UsageSchema = z.object({
-      enabled: z.boolean().default(true),
-      monthlyBudget: z.number().optional(),
-      warningThreshold: z.number().default(0.8),
-      currency: z.string().default("USD"),
-      retentionDays: z.number().default(90)
-    }).default({});
-    SpeechProviderSchema = z.object({
-      apiKey: z.string().min(1).optional(),
-      model: z.string().optional()
-    }).passthrough();
-    SpeechSchema = z.object({
-      stt: z.object({
-        provider: z.string().nullable().default(null),
-        providers: z.record(SpeechProviderSchema).default({})
-      }).default({}),
-      tts: z.object({
-        provider: z.string().nullable().default(null),
-        providers: z.record(SpeechProviderSchema).default({})
-      }).default({})
-    }).optional().default({});
     ConfigSchema = z.object({
       instanceName: z.string().optional(),
-      channels: z.object({}).catchall(BaseChannelSchema).default({}),
-      agents: z.record(z.string(), AgentSchema).optional().default({}),
       defaultAgent: z.string(),
       workspace: z.object({
         baseDir: z.string().default("~/openacp-workspace"),
@@ -751,23 +522,12 @@ var init_config = __esm({
           envWhitelist: z.array(z.string()).default([])
         }).default({})
       }).default({}),
-      security: z.object({
-        allowedUserIds: z.array(z.string()).default([]),
-        maxConcurrentSessions: z.number().default(20),
-        sessionTimeoutMinutes: z.number().default(60)
-      }).default({}),
       logging: LoggingSchema,
       runMode: z.enum(["foreground", "daemon"]).default("foreground"),
       autoStart: z.boolean().default(false),
-      api: z.object({
-        port: z.number().default(21420),
-        host: z.string().default("127.0.0.1")
-      }).default({}),
       sessionStore: z.object({
         ttlDays: z.number().default(30)
       }).default({}),
-      tunnel: TunnelSchema,
-      usage: UsageSchema,
       integrations: z.record(
         z.string(),
         z.object({
@@ -775,51 +535,15 @@ var init_config = __esm({
           installedAt: z.string().optional()
         })
       ).default({}),
-      speech: SpeechSchema,
       outputMode: z.enum(["low", "medium", "high"]).default("medium").optional(),
       agentSwitch: z.object({
         labelHistory: z.boolean().default(true)
       }).default({})
     });
     DEFAULT_CONFIG = {
-      channels: {
-        telegram: {
-          enabled: false,
-          botToken: "YOUR_BOT_TOKEN_HERE",
-          chatId: 0,
-          notificationTopicId: null,
-          assistantTopicId: null
-        },
-        discord: {
-          enabled: false,
-          botToken: "YOUR_DISCORD_BOT_TOKEN_HERE",
-          guildId: "",
-          forumChannelId: null,
-          notificationChannelId: null,
-          assistantThreadId: null
-        }
-      },
-      agents: {
-        claude: { command: "claude-agent-acp", args: [], env: {} },
-        codex: { command: "codex", args: ["--acp"], env: {} }
-      },
       defaultAgent: "claude",
       workspace: { baseDir: "~/openacp-workspace" },
-      security: {
-        allowedUserIds: [],
-        maxConcurrentSessions: 20,
-        sessionTimeoutMinutes: 60
-      },
-      sessionStore: { ttlDays: 30 },
-      tunnel: {
-        enabled: true,
-        port: 3100,
-        provider: "openacp",
-        options: {},
-        storeTtlMinutes: 60,
-        auth: { enabled: false }
-      },
-      usage: {}
+      sessionStore: { ttlDays: 30 }
     };
     ConfigManager = class extends EventEmitter {
       config;
@@ -829,23 +553,23 @@ var init_config = __esm({
         this.configPath = process.env.OPENACP_CONFIG_PATH || configPath || expandHome3("~/.openacp/config.json");
       }
       async load() {
-        const dir = path5.dirname(this.configPath);
-        fs5.mkdirSync(dir, { recursive: true });
-        if (!fs5.existsSync(this.configPath)) {
-          fs5.writeFileSync(
+        const dir = path4.dirname(this.configPath);
+        fs4.mkdirSync(dir, { recursive: true });
+        if (!fs4.existsSync(this.configPath)) {
+          fs4.writeFileSync(
             this.configPath,
             JSON.stringify(DEFAULT_CONFIG, null, 2)
           );
           log3.info({ configPath: this.configPath }, "Config created");
           log3.info(
-            "Please edit it with your channel credentials (Telegram bot token, Discord bot token, etc.), then restart."
+            "Run 'openacp setup' to configure channels and agents, then restart."
           );
           process.exit(1);
         }
-        const raw = JSON.parse(fs5.readFileSync(this.configPath, "utf-8"));
-        const { changed: configUpdated } = applyMigrations(raw, void 0, { configDir: path5.dirname(this.configPath) });
+        const raw = JSON.parse(fs4.readFileSync(this.configPath, "utf-8"));
+        const { changed: configUpdated } = applyMigrations(raw, void 0, { configDir: path4.dirname(this.configPath) });
         if (configUpdated) {
-          fs5.writeFileSync(this.configPath, JSON.stringify(raw, null, 2));
+          fs4.writeFileSync(this.configPath, JSON.stringify(raw, null, 2));
         }
         this.applyEnvOverrides(raw);
         const result = ConfigSchema.safeParse(raw);
@@ -866,14 +590,16 @@ var init_config = __esm({
       }
       async save(updates, changePath) {
         const oldConfig = this.config ? structuredClone(this.config) : void 0;
-        const raw = JSON.parse(fs5.readFileSync(this.configPath, "utf-8"));
+        const raw = JSON.parse(fs4.readFileSync(this.configPath, "utf-8"));
         this.deepMerge(raw, updates);
         const result = ConfigSchema.safeParse(raw);
         if (!result.success) {
           log3.error({ errors: result.error.issues }, "Config validation failed, not saving");
           return;
         }
-        fs5.writeFileSync(this.configPath, JSON.stringify(raw, null, 2));
+        const tmpPath = this.configPath + `.tmp.${randomBytes(4).toString("hex")}`;
+        fs4.writeFileSync(tmpPath, JSON.stringify(raw, null, 2), "utf-8");
+        fs4.renameSync(tmpPath, this.configPath);
         this.config = result.data;
         if (changePath) {
           const { getConfigValue: getConfigValue2 } = await Promise.resolve().then(() => (init_config_registry(), config_registry_exports));
@@ -883,7 +609,7 @@ var init_config = __esm({
         }
       }
       /**
-       * Set a single config value by dot-path (e.g. "security.maxConcurrentSessions").
+       * Set a single config value by dot-path (e.g. "logging.level").
        * Builds the nested update object, validates, and saves.
        * Throws if the path contains blocked keys or the value fails Zod validation.
        */
@@ -905,14 +631,14 @@ var init_config = __esm({
       resolveWorkspace(input2) {
         if (!input2) {
           const resolved2 = expandHome3(this.config.workspace.baseDir);
-          fs5.mkdirSync(resolved2, { recursive: true });
+          fs4.mkdirSync(resolved2, { recursive: true });
           return resolved2;
         }
         if (input2.startsWith("/") || input2.startsWith("~")) {
           const resolved2 = expandHome3(input2);
           const base = expandHome3(this.config.workspace.baseDir);
-          if (resolved2 === base || resolved2.startsWith(base + path5.sep)) {
-            fs5.mkdirSync(resolved2, { recursive: true });
+          if (resolved2 === base || resolved2.startsWith(base + path4.sep)) {
+            fs4.mkdirSync(resolved2, { recursive: true });
             return resolved2;
           }
           throw new Error(
@@ -925,23 +651,23 @@ var init_config = __esm({
             `Invalid workspace name: "${input2}". Only alphanumeric characters, hyphens, and underscores are allowed.`
           );
         }
-        const resolved = path5.join(
+        const resolved = path4.join(
           expandHome3(this.config.workspace.baseDir),
           name.toLowerCase()
         );
-        fs5.mkdirSync(resolved, { recursive: true });
+        fs4.mkdirSync(resolved, { recursive: true });
         return resolved;
       }
       async exists() {
-        return fs5.existsSync(this.configPath);
+        return fs4.existsSync(this.configPath);
       }
       getConfigPath() {
         return this.configPath;
       }
       async writeNew(config) {
-        const dir = path5.dirname(this.configPath);
-        fs5.mkdirSync(dir, { recursive: true });
-        fs5.writeFileSync(this.configPath, JSON.stringify(config, null, 2));
+        const dir = path4.dirname(this.configPath);
+        fs4.mkdirSync(dir, { recursive: true });
+        fs4.writeFileSync(this.configPath, JSON.stringify(config, null, 2));
       }
       async applyEnvToPluginSettings(settingsManager) {
         const pluginOverrides = [
@@ -952,7 +678,13 @@ var init_config = __esm({
           { envVar: "OPENACP_SPEECH_STT_PROVIDER", pluginName: "@openacp/speech", key: "sttProvider" },
           { envVar: "OPENACP_SPEECH_GROQ_API_KEY", pluginName: "@openacp/speech", key: "groqApiKey" },
           { envVar: "OPENACP_TELEGRAM_BOT_TOKEN", pluginName: "@openacp/telegram", key: "botToken" },
-          { envVar: "OPENACP_TELEGRAM_CHAT_ID", pluginName: "@openacp/telegram", key: "chatId", transform: (v) => Number(v) }
+          { envVar: "OPENACP_TELEGRAM_CHAT_ID", pluginName: "@openacp/telegram", key: "chatId", transform: (v) => Number(v) },
+          // Future adapters — no-ops if plugin settings don't exist
+          { envVar: "OPENACP_DISCORD_BOT_TOKEN", pluginName: "@openacp/discord-adapter", key: "botToken" },
+          { envVar: "OPENACP_DISCORD_GUILD_ID", pluginName: "@openacp/discord-adapter", key: "guildId" },
+          { envVar: "OPENACP_SLACK_BOT_TOKEN", pluginName: "@openacp/slack-adapter", key: "botToken" },
+          { envVar: "OPENACP_SLACK_APP_TOKEN", pluginName: "@openacp/slack-adapter", key: "appToken" },
+          { envVar: "OPENACP_SLACK_SIGNING_SECRET", pluginName: "@openacp/slack-adapter", key: "signingSecret" }
         ];
         for (const { envVar, pluginName, key, transform } of pluginOverrides) {
           const value = process.env[envVar];
@@ -965,16 +697,8 @@ var init_config = __esm({
       }
       applyEnvOverrides(raw) {
         const overrides = [
-          ["OPENACP_TELEGRAM_BOT_TOKEN", ["channels", "telegram", "botToken"]],
-          ["OPENACP_TELEGRAM_CHAT_ID", ["channels", "telegram", "chatId"]],
-          ["OPENACP_DISCORD_BOT_TOKEN", ["channels", "discord", "botToken"]],
-          ["OPENACP_DISCORD_GUILD_ID", ["channels", "discord", "guildId"]],
-          ["OPENACP_SLACK_BOT_TOKEN", ["channels", "slack", "botToken"]],
-          ["OPENACP_SLACK_APP_TOKEN", ["channels", "slack", "appToken"]],
-          ["OPENACP_SLACK_SIGNING_SECRET", ["channels", "slack", "signingSecret"]],
           ["OPENACP_DEFAULT_AGENT", ["defaultAgent"]],
-          ["OPENACP_RUN_MODE", ["runMode"]],
-          ["OPENACP_API_PORT", ["api", "port"]]
+          ["OPENACP_RUN_MODE", ["runMode"]]
         ];
         for (const [envVar, configPath] of overrides) {
           const value = process.env[envVar];
@@ -985,7 +709,7 @@ var init_config = __esm({
               target = target[configPath[i]];
             }
             const key = configPath[configPath.length - 1];
-            target[key] = key === "chatId" || key === "port" ? Number(value) : value;
+            target[key] = value;
           }
         }
         if (process.env.OPENACP_LOG_LEVEL) {
@@ -1000,39 +724,11 @@ var init_config = __esm({
           raw.logging = raw.logging || {};
           raw.logging.level = "debug";
         }
-        if (process.env.OPENACP_TUNNEL_ENABLED) {
-          raw.tunnel = raw.tunnel || {};
-          raw.tunnel.enabled = process.env.OPENACP_TUNNEL_ENABLED === "true";
-        }
-        if (process.env.OPENACP_TUNNEL_PORT) {
-          raw.tunnel = raw.tunnel || {};
-          raw.tunnel.port = Number(
-            process.env.OPENACP_TUNNEL_PORT
-          );
-        }
-        if (process.env.OPENACP_TUNNEL_PROVIDER) {
-          raw.tunnel = raw.tunnel || {};
-          raw.tunnel.provider = process.env.OPENACP_TUNNEL_PROVIDER;
-        }
-        if (process.env.OPENACP_SPEECH_STT_PROVIDER) {
-          raw.speech = raw.speech || {};
-          const speech = raw.speech;
-          speech.stt = speech.stt || {};
-          speech.stt.provider = process.env.OPENACP_SPEECH_STT_PROVIDER;
-        }
-        if (process.env.OPENACP_SPEECH_GROQ_API_KEY) {
-          raw.speech = raw.speech || {};
-          const speech = raw.speech;
-          speech.stt = speech.stt || {};
-          const stt = speech.stt;
-          stt.providers = stt.providers || {};
-          const providers = stt.providers;
-          providers.groq = providers.groq || {};
-          providers.groq.apiKey = process.env.OPENACP_SPEECH_GROQ_API_KEY;
-        }
       }
       deepMerge(target, source) {
+        const DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
         for (const key of Object.keys(source)) {
+          if (DANGEROUS_KEYS.has(key)) continue;
           const val = source[key];
           if (val && typeof val === "object" && !Array.isArray(val)) {
             if (!target[key]) target[key] = {};
@@ -1054,9 +750,9 @@ var read_text_file_exports = {};
 __export(read_text_file_exports, {
   readTextFileWithRange: () => readTextFileWithRange
 });
-import fs7 from "fs";
+import fs6 from "fs";
 async function readTextFileWithRange(filePath, options) {
-  const content = await fs7.promises.readFile(filePath, "utf-8");
+  const content = await fs6.promises.readFile(filePath, "utf-8");
   if (!options?.line && !options?.limit) return content;
   const lines = content.split("\n");
   const start = Math.max(0, (options.line ?? 1) - 1);
@@ -1096,8 +792,8 @@ __export(agent_dependencies_exports, {
   listAgentsWithIntegration: () => listAgentsWithIntegration
 });
 import { execFileSync as execFileSync2 } from "child_process";
-import * as fs12 from "fs";
-import * as path11 from "path";
+import * as fs11 from "fs";
+import * as path10 from "path";
 function getAgentSetup(registryId) {
   return AGENT_SETUP[registryId];
 }
@@ -1121,9 +817,9 @@ function commandExists(cmd) {
   }
   let dir = process.cwd();
   while (true) {
-    const binPath = path11.join(dir, "node_modules", ".bin", cmd);
-    if (fs12.existsSync(binPath)) return true;
-    const parent = path11.dirname(dir);
+    const binPath = path10.join(dir, "node_modules", ".bin", cmd);
+    if (fs11.existsSync(binPath)) return true;
+    const parent = path10.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1291,6 +987,7 @@ var init_agent_dependencies = __esm({
         supportsResume: true,
         resumeCommand: (sid) => `claude --resume ${sid}`,
         integration: {
+          strategy: "hooks",
           hookEvent: "UserPromptSubmit",
           settingsPath: "~/.claude/settings.json",
           settingsFormat: "settings_json",
@@ -1308,6 +1005,7 @@ var init_agent_dependencies = __esm({
         supportsResume: true,
         resumeCommand: (sid) => `cursor --resume ${sid}`,
         integration: {
+          strategy: "hooks",
           hookEvent: "beforeSubmitPrompt",
           settingsPath: "~/.cursor/hooks.json",
           settingsFormat: "hooks_json",
@@ -1323,6 +1021,7 @@ var init_agent_dependencies = __esm({
         supportsResume: true,
         resumeCommand: (sid) => `gemini --resume ${sid}`,
         integration: {
+          strategy: "hooks",
           hookEvent: "BeforeAgent",
           settingsPath: "~/.gemini/settings.json",
           settingsFormat: "settings_json",
@@ -1335,6 +1034,7 @@ var init_agent_dependencies = __esm({
         supportsResume: true,
         resumeCommand: () => `cline --continue`,
         integration: {
+          strategy: "hooks",
           hookEvent: "TaskStart",
           settingsPath: "~/.cline/settings.json",
           settingsFormat: "settings_json",
@@ -1354,6 +1054,19 @@ var init_agent_dependencies = __esm({
       amp: {
         supportsResume: true,
         resumeCommand: (sid) => `amp threads continue ${sid}`
+      },
+      opencode: {
+        supportsResume: true,
+        resumeCommand: (sid) => `opencode --session ${sid}`,
+        integration: {
+          strategy: "plugin",
+          pluginProvider: "opencode",
+          commandsPath: "~/.config/opencode/commands/",
+          pluginsPath: "~/.config/opencode/plugins/",
+          handoffCommandName: "openacp:handoff",
+          handoffCommandFile: "openacp-handoff.md",
+          pluginFileName: "openacp-handoff.js"
+        }
       }
     };
     REGISTRY_AGENT_ALIASES = {
@@ -1379,11 +1092,11 @@ var init_agent_registry = __esm({
 });
 
 // src/core/agents/agent-installer.ts
-import * as fs14 from "fs";
-import * as path13 from "path";
+import * as fs13 from "fs";
+import * as path12 from "path";
 import * as os5 from "os";
 import crypto from "crypto";
-function validateTarContents(entries, destDir) {
+function validateArchiveContents(entries, destDir) {
   for (const entry of entries) {
     const segments = entry.split("/");
     if (segments.includes("..")) {
@@ -1395,9 +1108,9 @@ function validateTarContents(entries, destDir) {
   }
 }
 function validateUninstallPath(binaryPath, agentsDir) {
-  const realPath = path13.resolve(binaryPath);
-  const realAgentsDir = path13.resolve(agentsDir);
-  if (!realPath.startsWith(realAgentsDir + path13.sep) && realPath !== realAgentsDir) {
+  const realPath = path12.resolve(binaryPath);
+  const realAgentsDir = path12.resolve(agentsDir);
+  if (!realPath.startsWith(realAgentsDir + path12.sep) && realPath !== realAgentsDir) {
     throw new Error(`Refusing to delete path outside agents directory: ${realPath}`);
   }
 }
@@ -1451,7 +1164,7 @@ function buildInstalledAgent(registryId, name, version, dist, binaryPath) {
       binaryPath: null
     };
   }
-  const absCmd = path13.resolve(binaryPath, dist.cmd);
+  const absCmd = path12.resolve(binaryPath, dist.cmd);
   return {
     registryId,
     name,
@@ -1524,8 +1237,8 @@ Install it with: pip install uv`;
   return { ok: true, agentKey, setupSteps: setup?.setupSteps };
 }
 async function downloadAndExtract(agentId, archiveUrl, progress, agentsDir) {
-  const destDir = path13.join(agentsDir ?? DEFAULT_AGENTS_DIR, agentId);
-  fs14.mkdirSync(destDir, { recursive: true });
+  const destDir = path12.join(agentsDir ?? DEFAULT_AGENTS_DIR, agentId);
+  fs13.mkdirSync(destDir, { recursive: true });
   await progress?.onStep("Downloading...");
   log11.info({ agentId, url: archiveUrl }, "Downloading agent binary");
   const response = await fetch(archiveUrl);
@@ -1566,68 +1279,72 @@ async function readResponseWithProgress(response, contentLength, progress) {
   return Buffer.concat(chunks);
 }
 function validateExtractedPaths(destDir) {
-  const realDest = fs14.realpathSync(destDir);
-  const entries = fs14.readdirSync(destDir, { recursive: true, withFileTypes: true });
+  const realDest = fs13.realpathSync(destDir);
+  const entries = fs13.readdirSync(destDir, { recursive: true, withFileTypes: true });
   for (const entry of entries) {
     const dirent = entry;
     const parentPath = dirent.parentPath ?? dirent.path ?? destDir;
-    const fullPath = path13.join(parentPath, entry.name);
+    const fullPath = path12.join(parentPath, entry.name);
     let realPath;
     try {
-      realPath = fs14.realpathSync(fullPath);
+      realPath = fs13.realpathSync(fullPath);
     } catch {
-      const linkTarget = fs14.readlinkSync(fullPath);
-      realPath = path13.resolve(path13.dirname(fullPath), linkTarget);
+      const linkTarget = fs13.readlinkSync(fullPath);
+      realPath = path12.resolve(path12.dirname(fullPath), linkTarget);
     }
-    if (!realPath.startsWith(realDest + path13.sep) && realPath !== realDest) {
-      fs14.rmSync(destDir, { recursive: true, force: true });
+    if (!realPath.startsWith(realDest + path12.sep) && realPath !== realDest) {
+      fs13.rmSync(destDir, { recursive: true, force: true });
       throw new Error(`Archive contains unsafe path: ${entry.name}`);
     }
   }
 }
 async function extractTarGz(buffer, destDir) {
-  const { execFileSync: execFileSync7 } = await import("child_process");
-  const tmpFile = path13.join(destDir, "_archive.tar.gz");
-  fs14.writeFileSync(tmpFile, buffer);
+  const { execFileSync: execFileSync8 } = await import("child_process");
+  const tmpFile = path12.join(destDir, "_archive.tar.gz");
+  fs13.writeFileSync(tmpFile, buffer);
   try {
-    const listing = execFileSync7("tar", ["tf", tmpFile], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
-    validateTarContents(listing, destDir);
-    execFileSync7("tar", ["xzf", tmpFile, "-C", destDir], { stdio: "pipe" });
+    const listing = execFileSync8("tar", ["tf", tmpFile], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
+    validateArchiveContents(listing, destDir);
+    execFileSync8("tar", ["xzf", tmpFile, "-C", destDir], { stdio: "pipe" });
   } finally {
-    fs14.unlinkSync(tmpFile);
+    fs13.unlinkSync(tmpFile);
   }
   validateExtractedPaths(destDir);
 }
 async function extractZip(buffer, destDir) {
-  const { execFileSync: execFileSync7 } = await import("child_process");
-  const tmpFile = path13.join(destDir, "_archive.zip");
-  fs14.writeFileSync(tmpFile, buffer);
+  const { execFileSync: execFileSync8 } = await import("child_process");
+  const tmpFile = path12.join(destDir, "_archive.zip");
+  fs13.writeFileSync(tmpFile, buffer);
   try {
-    execFileSync7("unzip", ["-o", tmpFile, "-d", destDir], { stdio: "pipe" });
+    const listing = execFileSync8("unzip", ["-l", tmpFile], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
+    const entries = listing.slice(3, -2).map((line) => line.trim().split(/\s+/).slice(3).join(" ")).filter(Boolean);
+    validateArchiveContents(entries, destDir);
+    execFileSync8("unzip", ["-o", tmpFile, "-d", destDir], { stdio: "pipe" });
   } finally {
-    fs14.unlinkSync(tmpFile);
+    fs13.unlinkSync(tmpFile);
   }
   validateExtractedPaths(destDir);
 }
 async function uninstallAgent(agentKey, store, agentsDir) {
   const agent = store.getAgent(agentKey);
   if (!agent) return;
-  if (agent.binaryPath && fs14.existsSync(agent.binaryPath)) {
+  if (agent.binaryPath && fs13.existsSync(agent.binaryPath)) {
     validateUninstallPath(agent.binaryPath, agentsDir ?? DEFAULT_AGENTS_DIR);
-    fs14.rmSync(agent.binaryPath, { recursive: true, force: true });
+    fs13.rmSync(agent.binaryPath, { recursive: true, force: true });
     log11.info({ agentKey, binaryPath: agent.binaryPath }, "Deleted agent binary");
   }
   store.removeAgent(agentKey);
 }
-var log11, DEFAULT_AGENTS_DIR, MAX_DOWNLOAD_SIZE, ARCH_MAP, PLATFORM_MAP;
+var log11, DEFAULT_AGENTS_DIR, MAX_DOWNLOAD_SIZE, validateTarContents, ARCH_MAP, PLATFORM_MAP;
 var init_agent_installer = __esm({
   "src/core/agents/agent-installer.ts"() {
     "use strict";
     init_log();
     init_agent_dependencies();
     log11 = createChildLogger({ module: "agent-installer" });
-    DEFAULT_AGENTS_DIR = path13.join(os5.homedir(), ".openacp", "agents");
+    DEFAULT_AGENTS_DIR = path12.join(os5.homedir(), ".openacp", "agents");
     MAX_DOWNLOAD_SIZE = 500 * 1024 * 1024;
+    validateTarContents = validateArchiveContents;
     ARCH_MAP = {
       arm64: "aarch64",
       x64: "x86_64"
@@ -1641,7 +1358,7 @@ var init_agent_installer = __esm({
 });
 
 // src/core/doctor/checks/config.ts
-import * as fs17 from "fs";
+import * as fs16 from "fs";
 var configCheck;
 var init_config2 = __esm({
   "src/core/doctor/checks/config.ts"() {
@@ -1653,14 +1370,14 @@ var init_config2 = __esm({
       order: 1,
       async run(ctx) {
         const results = [];
-        if (!fs17.existsSync(ctx.configPath)) {
+        if (!fs16.existsSync(ctx.configPath)) {
           results.push({ status: "fail", message: "Config file not found" });
           return results;
         }
         results.push({ status: "pass", message: "Config file exists" });
         let raw;
         try {
-          raw = JSON.parse(fs17.readFileSync(ctx.configPath, "utf-8"));
+          raw = JSON.parse(fs16.readFileSync(ctx.configPath, "utf-8"));
         } catch (err) {
           results.push({
             status: "fail",
@@ -1679,7 +1396,7 @@ var init_config2 = __esm({
             fixRisk: "safe",
             fix: async () => {
               applyMigrations(raw);
-              fs17.writeFileSync(ctx.configPath, JSON.stringify(raw, null, 2));
+              fs16.writeFileSync(ctx.configPath, JSON.stringify(raw, null, 2));
               return { success: true, message: "applied migrations" };
             }
           });
@@ -1703,8 +1420,8 @@ var init_config2 = __esm({
 
 // src/core/doctor/checks/agents.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import * as fs18 from "fs";
-import * as path18 from "path";
+import * as fs17 from "fs";
+import * as path17 from "path";
 function commandExists2(cmd) {
   try {
     execFileSync3("which", [cmd], { stdio: "pipe" });
@@ -1713,9 +1430,9 @@ function commandExists2(cmd) {
   }
   let dir = process.cwd();
   while (true) {
-    const binPath = path18.join(dir, "node_modules", ".bin", cmd);
-    if (fs18.existsSync(binPath)) return true;
-    const parent = path18.dirname(dir);
+    const binPath = path17.join(dir, "node_modules", ".bin", cmd);
+    if (fs17.existsSync(binPath)) return true;
+    const parent = path17.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1734,8 +1451,16 @@ var init_agents = __esm({
           results.push({ status: "fail", message: "Cannot check agents \u2014 config not loaded" });
           return results;
         }
-        const agents = ctx.config.agents;
         const defaultAgent = ctx.config.defaultAgent;
+        let agents = {};
+        try {
+          const agentsPath = path17.join(ctx.dataDir, "agents.json");
+          if (fs17.existsSync(agentsPath)) {
+            const data = JSON.parse(fs17.readFileSync(agentsPath, "utf-8"));
+            agents = data.installed ?? {};
+          }
+        } catch {
+        }
         if (!agents[defaultAgent]) {
           results.push({
             status: "fail",
@@ -1744,15 +1469,17 @@ var init_agents = __esm({
         }
         for (const [name, agent] of Object.entries(agents)) {
           const isDefault = name === defaultAgent;
-          if (commandExists2(agent.command)) {
+          const agentEntry = agent;
+          const agentCommand = agentEntry.command ?? name;
+          if (commandExists2(agentCommand)) {
             results.push({
               status: "pass",
-              message: `${agent.command} found${isDefault ? " (default)" : ""}`
+              message: `${agentCommand} found${isDefault ? " (default)" : ""}`
             });
           } else {
             results.push({
               status: isDefault ? "fail" : "warn",
-              message: `${agent.command} not found in PATH${isDefault ? " (default agent!)" : ""}`
+              message: `${agentCommand} not found in PATH${isDefault ? " (default agent!)" : ""}`
             });
           }
         }
@@ -1767,8 +1494,8 @@ var settings_manager_exports = {};
 __export(settings_manager_exports, {
   SettingsManager: () => SettingsManager
 });
-import fs19 from "fs";
-import path19 from "path";
+import fs18 from "fs";
+import path18 from "path";
 var SettingsManager, SettingsAPIImpl;
 var init_settings_manager = __esm({
   "src/core/plugin/settings-manager.ts"() {
@@ -1787,7 +1514,7 @@ var init_settings_manager = __esm({
       async loadSettings(pluginName) {
         const settingsPath = this.getSettingsPath(pluginName);
         try {
-          const content = fs19.readFileSync(settingsPath, "utf-8");
+          const content = fs18.readFileSync(settingsPath, "utf-8");
           return JSON.parse(content);
         } catch {
           return {};
@@ -1805,7 +1532,7 @@ var init_settings_manager = __esm({
         };
       }
       getSettingsPath(pluginName) {
-        return path19.join(this.basePath, pluginName, "settings.json");
+        return path18.join(this.basePath, pluginName, "settings.json");
       }
       async getPluginSettings(pluginName) {
         return this.loadSettings(pluginName);
@@ -1824,7 +1551,7 @@ var init_settings_manager = __esm({
       readFile() {
         if (this.cache !== null) return this.cache;
         try {
-          const content = fs19.readFileSync(this.settingsPath, "utf-8");
+          const content = fs18.readFileSync(this.settingsPath, "utf-8");
           this.cache = JSON.parse(content);
           return this.cache;
         } catch {
@@ -1833,9 +1560,9 @@ var init_settings_manager = __esm({
         }
       }
       writeFile(data) {
-        const dir = path19.dirname(this.settingsPath);
-        fs19.mkdirSync(dir, { recursive: true });
-        fs19.writeFileSync(this.settingsPath, JSON.stringify(data, null, 2));
+        const dir = path18.dirname(this.settingsPath);
+        fs18.mkdirSync(dir, { recursive: true });
+        fs18.writeFileSync(this.settingsPath, JSON.stringify(data, null, 2));
         this.cache = data;
       }
       async get(key) {
@@ -1870,7 +1597,7 @@ var init_settings_manager = __esm({
 });
 
 // src/core/doctor/checks/telegram.ts
-import * as path20 from "path";
+import * as path19 from "path";
 var BOT_TOKEN_REGEX, telegramCheck;
 var init_telegram = __esm({
   "src/core/doctor/checks/telegram.ts"() {
@@ -1886,11 +1613,10 @@ var init_telegram = __esm({
           return results;
         }
         const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
-        const sm = new SettingsManager2(path20.join(ctx.pluginsDir, "data"));
+        const sm = new SettingsManager2(path19.join(ctx.pluginsDir, "data"));
         const ps = await sm.loadSettings("@openacp/telegram");
-        const legacyCh = ctx.config.channels.telegram;
-        const botToken = ps.botToken ?? legacyCh?.botToken;
-        const chatId = ps.chatId ?? legacyCh?.chatId;
+        const botToken = ps.botToken;
+        const chatId = ps.chatId;
         if (!botToken && !chatId) {
           results.push({ status: "pass", message: "Telegram not configured (skipped)" });
           return results;
@@ -1970,7 +1696,7 @@ var init_telegram = __esm({
 });
 
 // src/core/doctor/checks/storage.ts
-import * as fs20 from "fs";
+import * as fs19 from "fs";
 var storageCheck;
 var init_storage = __esm({
   "src/core/doctor/checks/storage.ts"() {
@@ -1980,28 +1706,28 @@ var init_storage = __esm({
       order: 4,
       async run(ctx) {
         const results = [];
-        if (!fs20.existsSync(ctx.dataDir)) {
+        if (!fs19.existsSync(ctx.dataDir)) {
           results.push({
             status: "fail",
             message: "Data directory ~/.openacp does not exist",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs20.mkdirSync(ctx.dataDir, { recursive: true });
+              fs19.mkdirSync(ctx.dataDir, { recursive: true });
               return { success: true, message: "created directory" };
             }
           });
         } else {
           try {
-            fs20.accessSync(ctx.dataDir, fs20.constants.W_OK);
+            fs19.accessSync(ctx.dataDir, fs19.constants.W_OK);
             results.push({ status: "pass", message: "Data directory exists and writable" });
           } catch {
             results.push({ status: "fail", message: "Data directory not writable" });
           }
         }
-        if (fs20.existsSync(ctx.sessionsPath)) {
+        if (fs19.existsSync(ctx.sessionsPath)) {
           try {
-            const content = fs20.readFileSync(ctx.sessionsPath, "utf-8");
+            const content = fs19.readFileSync(ctx.sessionsPath, "utf-8");
             const data = JSON.parse(content);
             if (typeof data === "object" && data !== null && "sessions" in data) {
               results.push({ status: "pass", message: "Sessions file valid" });
@@ -2012,7 +1738,7 @@ var init_storage = __esm({
                 fixable: true,
                 fixRisk: "risky",
                 fix: async () => {
-                  fs20.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
+                  fs19.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
                   return { success: true, message: "reset sessions file" };
                 }
               });
@@ -2024,7 +1750,7 @@ var init_storage = __esm({
               fixable: true,
               fixRisk: "risky",
               fix: async () => {
-                fs20.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
+                fs19.writeFileSync(ctx.sessionsPath, JSON.stringify({ version: 1, sessions: {} }, null, 2));
                 return { success: true, message: "reset sessions file" };
               }
             });
@@ -2032,20 +1758,20 @@ var init_storage = __esm({
         } else {
           results.push({ status: "pass", message: "Sessions file not present yet (created on first session)" });
         }
-        if (!fs20.existsSync(ctx.logsDir)) {
+        if (!fs19.existsSync(ctx.logsDir)) {
           results.push({
             status: "warn",
             message: "Log directory does not exist",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs20.mkdirSync(ctx.logsDir, { recursive: true });
+              fs19.mkdirSync(ctx.logsDir, { recursive: true });
               return { success: true, message: "created log directory" };
             }
           });
         } else {
           try {
-            fs20.accessSync(ctx.logsDir, fs20.constants.W_OK);
+            fs19.accessSync(ctx.logsDir, fs19.constants.W_OK);
             results.push({ status: "pass", message: "Log directory exists and writable" });
           } catch {
             results.push({ status: "fail", message: "Log directory not writable" });
@@ -2058,7 +1784,7 @@ var init_storage = __esm({
 });
 
 // src/core/doctor/checks/workspace.ts
-import * as fs21 from "fs";
+import * as fs20 from "fs";
 var workspaceCheck;
 var init_workspace = __esm({
   "src/core/doctor/checks/workspace.ts"() {
@@ -2074,20 +1800,20 @@ var init_workspace = __esm({
           return results;
         }
         const baseDir = expandHome3(ctx.config.workspace.baseDir);
-        if (!fs21.existsSync(baseDir)) {
+        if (!fs20.existsSync(baseDir)) {
           results.push({
             status: "warn",
             message: `Workspace directory does not exist: ${baseDir}`,
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs21.mkdirSync(baseDir, { recursive: true });
+              fs20.mkdirSync(baseDir, { recursive: true });
               return { success: true, message: "created directory" };
             }
           });
         } else {
           try {
-            fs21.accessSync(baseDir, fs21.constants.W_OK);
+            fs20.accessSync(baseDir, fs20.constants.W_OK);
             results.push({ status: "pass", message: `Workspace directory exists: ${baseDir}` });
           } catch {
             results.push({ status: "fail", message: `Workspace directory not writable: ${baseDir}` });
@@ -2100,8 +1826,8 @@ var init_workspace = __esm({
 });
 
 // src/core/doctor/checks/plugins.ts
-import * as fs22 from "fs";
-import * as path21 from "path";
+import * as fs21 from "fs";
+import * as path20 from "path";
 var pluginsCheck;
 var init_plugins = __esm({
   "src/core/doctor/checks/plugins.ts"() {
@@ -2111,16 +1837,16 @@ var init_plugins = __esm({
       order: 6,
       async run(ctx) {
         const results = [];
-        if (!fs22.existsSync(ctx.pluginsDir)) {
+        if (!fs21.existsSync(ctx.pluginsDir)) {
           results.push({
             status: "warn",
             message: "Plugins directory does not exist",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs22.mkdirSync(ctx.pluginsDir, { recursive: true });
-              fs22.writeFileSync(
-                path21.join(ctx.pluginsDir, "package.json"),
+              fs21.mkdirSync(ctx.pluginsDir, { recursive: true });
+              fs21.writeFileSync(
+                path20.join(ctx.pluginsDir, "package.json"),
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
               return { success: true, message: "initialized plugins directory" };
@@ -2129,15 +1855,15 @@ var init_plugins = __esm({
           return results;
         }
         results.push({ status: "pass", message: "Plugins directory exists" });
-        const pkgPath = path21.join(ctx.pluginsDir, "package.json");
-        if (!fs22.existsSync(pkgPath)) {
+        const pkgPath = path20.join(ctx.pluginsDir, "package.json");
+        if (!fs21.existsSync(pkgPath)) {
           results.push({
             status: "warn",
             message: "Plugins package.json missing",
             fixable: true,
             fixRisk: "safe",
             fix: async () => {
-              fs22.writeFileSync(
+              fs21.writeFileSync(
                 pkgPath,
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
@@ -2147,7 +1873,7 @@ var init_plugins = __esm({
           return results;
         }
         try {
-          const pkg = JSON.parse(fs22.readFileSync(pkgPath, "utf-8"));
+          const pkg = JSON.parse(fs21.readFileSync(pkgPath, "utf-8"));
           const deps = pkg.dependencies || {};
           const count = Object.keys(deps).length;
           results.push({ status: "pass", message: `Plugins package.json valid (${count} plugins)` });
@@ -2158,7 +1884,7 @@ var init_plugins = __esm({
             fixable: true,
             fixRisk: "risky",
             fix: async () => {
-              fs22.writeFileSync(
+              fs21.writeFileSync(
                 pkgPath,
                 JSON.stringify({ name: "openacp-plugins", private: true, dependencies: {} }, null, 2)
               );
@@ -2173,7 +1899,7 @@ var init_plugins = __esm({
 });
 
 // src/core/doctor/checks/daemon.ts
-import * as fs23 from "fs";
+import * as fs22 from "fs";
 import * as net from "net";
 function isProcessAlive(pid) {
   try {
@@ -2203,8 +1929,8 @@ var init_daemon = __esm({
       order: 7,
       async run(ctx) {
         const results = [];
-        if (fs23.existsSync(ctx.pidPath)) {
-          const content = fs23.readFileSync(ctx.pidPath, "utf-8").trim();
+        if (fs22.existsSync(ctx.pidPath)) {
+          const content = fs22.readFileSync(ctx.pidPath, "utf-8").trim();
           const pid = parseInt(content, 10);
           if (isNaN(pid)) {
             results.push({
@@ -2213,7 +1939,7 @@ var init_daemon = __esm({
               fixable: true,
               fixRisk: "safe",
               fix: async () => {
-                fs23.unlinkSync(ctx.pidPath);
+                fs22.unlinkSync(ctx.pidPath);
                 return { success: true, message: "removed invalid PID file" };
               }
             });
@@ -2224,7 +1950,7 @@ var init_daemon = __esm({
               fixable: true,
               fixRisk: "safe",
               fix: async () => {
-                fs23.unlinkSync(ctx.pidPath);
+                fs22.unlinkSync(ctx.pidPath);
                 return { success: true, message: "removed stale PID file" };
               }
             });
@@ -2232,8 +1958,8 @@ var init_daemon = __esm({
             results.push({ status: "pass", message: `Daemon running (PID ${pid})` });
           }
         }
-        if (fs23.existsSync(ctx.portFilePath)) {
-          const content = fs23.readFileSync(ctx.portFilePath, "utf-8").trim();
+        if (fs22.existsSync(ctx.portFilePath)) {
+          const content = fs22.readFileSync(ctx.portFilePath, "utf-8").trim();
           const port = parseInt(content, 10);
           if (isNaN(port)) {
             results.push({
@@ -2242,7 +1968,7 @@ var init_daemon = __esm({
               fixable: true,
               fixRisk: "safe",
               fix: async () => {
-                fs23.unlinkSync(ctx.portFilePath);
+                fs22.unlinkSync(ctx.portFilePath);
                 return { success: true, message: "removed invalid port file" };
               }
             });
@@ -2251,11 +1977,11 @@ var init_daemon = __esm({
           }
         }
         if (ctx.config) {
-          const apiPort = ctx.config.api.port;
+          const apiPort = 21420;
           const inUse = await checkPortInUse(apiPort);
           if (inUse) {
-            if (fs23.existsSync(ctx.pidPath)) {
-              const pid = parseInt(fs23.readFileSync(ctx.pidPath, "utf-8").trim(), 10);
+            if (fs22.existsSync(ctx.pidPath)) {
+              const pid = parseInt(fs22.readFileSync(ctx.pidPath, "utf-8").trim(), 10);
               if (!isNaN(pid) && isProcessAlive(pid)) {
                 results.push({ status: "pass", message: `API port ${apiPort} in use by OpenACP daemon` });
               } else {
@@ -2275,25 +2001,32 @@ var init_daemon = __esm({
 });
 
 // src/core/utils/install-binary.ts
-import fs24 from "fs";
-import path22 from "path";
+import fs23 from "fs";
+import path21 from "path";
 import https from "https";
 import os9 from "os";
-import { execSync } from "child_process";
-function downloadFile(url, dest) {
+import { execFileSync as execFileSync4 } from "child_process";
+function downloadFile(url, dest, maxRedirects = 10) {
   return new Promise((resolve6, reject) => {
-    const file = fs24.createWriteStream(dest);
+    const file = fs23.createWriteStream(dest);
     const cleanup = () => {
       try {
-        if (fs24.existsSync(dest)) fs24.unlinkSync(dest);
+        if (fs23.existsSync(dest)) fs23.unlinkSync(dest);
       } catch {
       }
     };
     https.get(url, (response) => {
       if (response.statusCode === 301 || response.statusCode === 302) {
+        if (maxRedirects <= 0) {
+          file.close(() => {
+            cleanup();
+            reject(new Error("Too many redirects"));
+          });
+          return;
+        }
         file.close(() => {
           cleanup();
-          downloadFile(response.headers.location, dest).then(resolve6).catch(reject);
+          downloadFile(response.headers.location, dest, maxRedirects - 1).then(resolve6).catch(reject);
         });
         return;
       }
@@ -2344,36 +2077,36 @@ function getDownloadUrl(spec) {
 async function ensureBinary(spec, binDir) {
   const resolvedBinDir = binDir ?? DEFAULT_BIN_DIR;
   const binName = IS_WINDOWS ? `${spec.name}.exe` : spec.name;
-  const binPath = path22.join(resolvedBinDir, binName);
+  const binPath = path21.join(resolvedBinDir, binName);
   if (commandExists(spec.name)) {
     log17.debug({ name: spec.name }, "Found in PATH");
     return spec.name;
   }
-  if (fs24.existsSync(binPath)) {
-    if (!IS_WINDOWS) fs24.chmodSync(binPath, "755");
+  if (fs23.existsSync(binPath)) {
+    if (!IS_WINDOWS) fs23.chmodSync(binPath, "755");
     log17.debug({ name: spec.name, path: binPath }, "Found in ~/.openacp/bin");
     return binPath;
   }
   log17.info({ name: spec.name }, "Not found, downloading from GitHub...");
-  fs24.mkdirSync(resolvedBinDir, { recursive: true });
+  fs23.mkdirSync(resolvedBinDir, { recursive: true });
   const url = getDownloadUrl(spec);
   const isArchive = spec.isArchive?.(url) ?? false;
-  const downloadDest = isArchive ? path22.join(resolvedBinDir, `${spec.name}.tgz`) : binPath;
+  const downloadDest = isArchive ? path21.join(resolvedBinDir, `${spec.name}.tgz`) : binPath;
   await downloadFile(url, downloadDest);
   if (isArchive) {
-    const listing = execSync(`tar -tf "${downloadDest}"`, { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
+    const listing = execFileSync4("tar", ["-tf", downloadDest], { stdio: "pipe" }).toString().trim().split("\n").filter(Boolean);
     validateTarContents(listing, resolvedBinDir);
-    execSync(`tar -xzf "${downloadDest}" -C "${resolvedBinDir}"`, { stdio: "pipe" });
+    execFileSync4("tar", ["-xzf", downloadDest, "-C", resolvedBinDir], { stdio: "pipe" });
     try {
-      fs24.unlinkSync(downloadDest);
+      fs23.unlinkSync(downloadDest);
     } catch {
     }
   }
-  if (!fs24.existsSync(binPath)) {
+  if (!fs23.existsSync(binPath)) {
     throw new Error(`${spec.name}: binary not found at ${binPath} after download/extraction. The archive structure may have changed.`);
   }
   if (!IS_WINDOWS) {
-    fs24.chmodSync(binPath, "755");
+    fs23.chmodSync(binPath, "755");
   }
   log17.info({ name: spec.name, path: binPath }, "Installed successfully");
   return binPath;
@@ -2386,7 +2119,7 @@ var init_install_binary = __esm({
     init_agent_dependencies();
     init_agent_installer();
     log17 = createChildLogger({ module: "binary-installer" });
-    DEFAULT_BIN_DIR = path22.join(os9.homedir(), ".openacp", "bin");
+    DEFAULT_BIN_DIR = path21.join(os9.homedir(), ".openacp", "bin");
     IS_WINDOWS = os9.platform() === "win32";
   }
 });
@@ -2427,10 +2160,10 @@ var init_install_cloudflared = __esm({
 });
 
 // src/core/doctor/checks/tunnel.ts
-import * as fs25 from "fs";
-import * as path23 from "path";
+import * as fs24 from "fs";
+import * as path22 from "path";
 import * as os10 from "os";
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 var tunnelCheck;
 var init_tunnel = __esm({
   "src/core/doctor/checks/tunnel.ts"() {
@@ -2444,21 +2177,26 @@ var init_tunnel = __esm({
           results.push({ status: "fail", message: "Cannot check tunnel \u2014 config not loaded" });
           return results;
         }
-        if (!ctx.config.tunnel.enabled) {
+        const { SettingsManager: SettingsManager2 } = await Promise.resolve().then(() => (init_settings_manager(), settings_manager_exports));
+        const sm = new SettingsManager2(path22.join(ctx.pluginsDir, "data"));
+        const tunnelSettings = await sm.loadSettings("@openacp/tunnel");
+        const tunnelEnabled = tunnelSettings.enabled ?? false;
+        const provider = tunnelSettings.provider ?? "cloudflare";
+        const tunnelPort = tunnelSettings.port ?? 3100;
+        if (!tunnelEnabled) {
           results.push({ status: "pass", message: "Tunnel not enabled (skipped)" });
           return results;
         }
-        const provider = ctx.config.tunnel.provider;
         results.push({ status: "pass", message: `Tunnel provider: ${provider}` });
         if (provider === "cloudflare") {
           const binName = os10.platform() === "win32" ? "cloudflared.exe" : "cloudflared";
-          const binPath = path23.join(ctx.dataDir, "bin", binName);
+          const binPath = path22.join(ctx.dataDir, "bin", binName);
           let found = false;
-          if (fs25.existsSync(binPath)) {
+          if (fs24.existsSync(binPath)) {
             found = true;
           } else {
             try {
-              execFileSync4("which", ["cloudflared"], { stdio: "pipe" });
+              execFileSync5("which", ["cloudflared"], { stdio: "pipe" });
               found = true;
             } catch {
             }
@@ -2483,7 +2221,6 @@ var init_tunnel = __esm({
             });
           }
         }
-        const tunnelPort = ctx.config.tunnel.port;
         if (tunnelPort < 1 || tunnelPort > 65535) {
           results.push({ status: "fail", message: `Invalid tunnel port: ${tunnelPort}` });
         } else {
@@ -2496,8 +2233,8 @@ var init_tunnel = __esm({
 });
 
 // src/core/doctor/index.ts
-import * as fs26 from "fs";
-import * as path24 from "path";
+import * as fs25 from "fs";
+import * as path23 from "path";
 var ALL_CHECKS, CHECK_TIMEOUT_MS, DoctorEngine;
 var init_doctor = __esm({
   "src/core/doctor/index.ts"() {
@@ -2579,120 +2316,31 @@ var init_doctor = __esm({
       }
       async buildContext() {
         const dataDir = this.dataDir;
-        const configPath = process.env.OPENACP_CONFIG_PATH || path24.join(dataDir, "config.json");
+        const configPath = process.env.OPENACP_CONFIG_PATH || path23.join(dataDir, "config.json");
         let config = null;
         let rawConfig = null;
         try {
-          const content = fs26.readFileSync(configPath, "utf-8");
+          const content = fs25.readFileSync(configPath, "utf-8");
           rawConfig = JSON.parse(content);
           const cm = new ConfigManager(configPath);
           await cm.load();
           config = cm.get();
         } catch {
-        }
-        const logsDir = config ? expandHome3(config.logging.logDir) : path24.join(dataDir, "logs");
-        return {
-          config,
-          rawConfig,
-          configPath,
-          dataDir,
-          sessionsPath: path24.join(dataDir, "sessions.json"),
-          pidPath: path24.join(dataDir, "openacp.pid"),
-          portFilePath: path24.join(dataDir, "api.port"),
-          pluginsDir: path24.join(dataDir, "plugins"),
-          logsDir
-        };
-      }
-    };
-  }
-});
-
-// src/plugins/telegram/validators.ts
-var validators_exports = {};
-__export(validators_exports, {
-  validateBotAdmin: () => validateBotAdmin,
-  validateBotToken: () => validateBotToken,
-  validateChatId: () => validateChatId
-});
-async function validateBotToken(token) {
-  try {
-    const res = await fetch(`https://api.telegram.org/bot${token}/getMe`);
-    const data = await res.json();
-    if (data.ok && data.result) {
-      return {
-        ok: true,
-        botName: data.result.first_name,
-        botUsername: data.result.username
-      };
-    }
-    return { ok: false, error: data.description || "Invalid token" };
-  } catch (err) {
-    return { ok: false, error: err.message };
-  }
-}
-async function validateChatId(token, chatId) {
-  try {
-    const res = await fetch(`https://api.telegram.org/bot${token}/getChat`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ chat_id: chatId })
-    });
-    const data = await res.json();
-    if (!data.ok || !data.result) {
-      return { ok: false, error: data.description || "Invalid chat ID" };
-    }
-    if (data.result.type !== "supergroup") {
-      return {
-        ok: false,
-        error: `Chat is "${data.result.type}", must be a supergroup`
-      };
-    }
-    return {
-      ok: true,
-      title: data.result.title,
-      isForum: data.result.is_forum === true
-    };
-  } catch (err) {
-    return { ok: false, error: err.message };
-  }
-}
-async function validateBotAdmin(token, chatId) {
-  try {
-    const meRes = await fetch(`https://api.telegram.org/bot${token}/getMe`);
-    const meData = await meRes.json();
-    if (!meData.ok || !meData.result) {
-      return { ok: false, error: "Could not retrieve bot info" };
-    }
-    const res = await fetch(
-      `https://api.telegram.org/bot${token}/getChatMember`,
-      {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ chat_id: chatId, user_id: meData.result.id })
+        }
+        const logsDir = config ? expandHome3(config.logging.logDir) : path23.join(dataDir, "logs");
+        return {
+          config,
+          rawConfig,
+          configPath,
+          dataDir,
+          sessionsPath: path23.join(dataDir, "sessions.json"),
+          pidPath: path23.join(dataDir, "openacp.pid"),
+          portFilePath: path23.join(dataDir, "api.port"),
+          pluginsDir: path23.join(dataDir, "plugins"),
+          logsDir
+        };
       }
-    );
-    const data = await res.json();
-    if (!data.ok || !data.result) {
-      return {
-        ok: false,
-        error: data.description || "Could not check bot membership"
-      };
-    }
-    const { status } = data.result;
-    if (status === "administrator" || status === "creator") {
-      return { ok: true };
-    }
-    return {
-      ok: false,
-      error: `Bot is "${status}" in this group. It must be an admin. Please promote the bot to admin in group settings.`
     };
-  } catch (err) {
-    return { ok: false, error: err.message };
-  }
-}
-var init_validators = __esm({
-  "src/plugins/telegram/validators.ts"() {
-    "use strict";
   }
 });
 
@@ -2702,18 +2350,18 @@ __export(plugin_installer_exports, {
   importFromDir: () => importFromDir,
   installNpmPlugin: () => installNpmPlugin
 });
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
-import * as fs28 from "fs/promises";
+import * as fs27 from "fs/promises";
 import * as os12 from "os";
-import * as path26 from "path";
+import * as path25 from "path";
 import { pathToFileURL } from "url";
 async function importFromDir(packageName, dir) {
-  const pkgDir = path26.join(dir, "node_modules", ...packageName.split("/"));
-  const pkgJsonPath = path26.join(pkgDir, "package.json");
+  const pkgDir = path25.join(dir, "node_modules", ...packageName.split("/"));
+  const pkgJsonPath = path25.join(pkgDir, "package.json");
   let pkgJson;
   try {
-    pkgJson = JSON.parse(await fs28.readFile(pkgJsonPath, "utf-8"));
+    pkgJson = JSON.parse(await fs27.readFile(pkgJsonPath, "utf-8"));
   } catch (err) {
     throw new Error(`Cannot read package.json for "${packageName}" at ${pkgJsonPath}: ${err.message}`);
   }
@@ -2726,9 +2374,9 @@ async function importFromDir(packageName, dir) {
   } else {
     entry = pkgJson.main ?? "index.js";
   }
-  const entryPath = path26.join(pkgDir, entry);
+  const entryPath = path25.join(pkgDir, entry);
   try {
-    await fs28.access(entryPath);
+    await fs27.access(entryPath);
   } catch {
     throw new Error(`Entry point "${entry}" not found for "${packageName}" at ${entryPath}`);
   }
@@ -2738,21 +2386,21 @@ async function installNpmPlugin(packageName, pluginsDir) {
   if (!VALID_NPM_NAME.test(packageName)) {
     throw new Error(`Invalid package name: "${packageName}". Must be a valid npm package name.`);
   }
-  const dir = pluginsDir ?? path26.join(os12.homedir(), ".openacp", "plugins");
+  const dir = pluginsDir ?? path25.join(os12.homedir(), ".openacp", "plugins");
   try {
     return await importFromDir(packageName, dir);
   } catch {
   }
-  await execAsync(`npm install ${packageName} --prefix "${dir}" --save --ignore-scripts`, {
+  await execFileAsync("npm", ["install", packageName, "--prefix", dir, "--save", "--ignore-scripts"], {
     timeout: 6e4
   });
   return await importFromDir(packageName, dir);
 }
-var execAsync, VALID_NPM_NAME;
+var execFileAsync, VALID_NPM_NAME;
 var init_plugin_installer = __esm({
   "src/core/plugin/plugin-installer.ts"() {
     "use strict";
-    execAsync = promisify(exec);
+    execFileAsync = promisify(execFile);
     VALID_NPM_NAME = /^(@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*(@[\w.^~>=<|-]+)?$/i;
   }
 });
@@ -2820,15 +2468,14 @@ var install_context_exports = {};
 __export(install_context_exports, {
   createInstallContext: () => createInstallContext
 });
-import path27 from "path";
+import path26 from "path";
 function createInstallContext(opts) {
-  const { pluginName, settingsManager, basePath, legacyConfig, instanceRoot } = opts;
-  const dataDir = path27.join(basePath, pluginName, "data");
+  const { pluginName, settingsManager, basePath, instanceRoot } = opts;
+  const dataDir = path26.join(basePath, pluginName, "data");
   return {
     pluginName,
     terminal: createTerminalIO(),
     settings: settingsManager.createAPI(pluginName),
-    legacyConfig,
     dataDir,
     log: log.child({ plugin: pluginName }),
     instanceRoot
@@ -2850,19 +2497,19 @@ __export(api_client_exports, {
   readApiSecret: () => readApiSecret,
   removeStalePortFile: () => removeStalePortFile
 });
-import * as fs29 from "fs";
-import * as path28 from "path";
+import * as fs28 from "fs";
+import * as path27 from "path";
 import * as os13 from "os";
 function defaultPortFile(root) {
-  return path28.join(root ?? DEFAULT_ROOT, "api.port");
+  return path27.join(root ?? DEFAULT_ROOT, "api.port");
 }
 function defaultSecretFile(root) {
-  return path28.join(root ?? DEFAULT_ROOT, "api-secret");
+  return path27.join(root ?? DEFAULT_ROOT, "api-secret");
 }
 function readApiPort(portFilePath, instanceRoot) {
   const filePath = portFilePath ?? defaultPortFile(instanceRoot);
   try {
-    const content = fs29.readFileSync(filePath, "utf-8").trim();
+    const content = fs28.readFileSync(filePath, "utf-8").trim();
     const port = parseInt(content, 10);
     return isNaN(port) ? null : port;
   } catch {
@@ -2872,7 +2519,7 @@ function readApiPort(portFilePath, instanceRoot) {
 function readApiSecret(secretFilePath, instanceRoot) {
   const filePath = secretFilePath ?? defaultSecretFile(instanceRoot);
   try {
-    const content = fs29.readFileSync(filePath, "utf-8").trim();
+    const content = fs28.readFileSync(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -2881,7 +2528,7 @@ function readApiSecret(secretFilePath, instanceRoot) {
 function removeStalePortFile(portFilePath, instanceRoot) {
   const filePath = portFilePath ?? defaultPortFile(instanceRoot);
   try {
-    fs29.unlinkSync(filePath);
+    fs28.unlinkSync(filePath);
   } catch {
   }
 }
@@ -2897,7 +2544,7 @@ var DEFAULT_ROOT;
 var init_api_client = __esm({
   "src/cli/api-client.ts"() {
     "use strict";
-    DEFAULT_ROOT = path28.join(os13.homedir(), ".openacp");
+    DEFAULT_ROOT = path27.join(os13.homedir(), ".openacp");
   }
 });
 
@@ -2931,8 +2578,8 @@ var init_notification = __esm({
 });
 
 // src/plugins/file-service/file-service.ts
-import fs31 from "fs";
-import path31 from "path";
+import fs30 from "fs";
+import path30 from "path";
 import { OggOpusDecoder } from "ogg-opus-decoder";
 import wav from "node-wav";
 function classifyMime(mimeType) {
@@ -2988,14 +2635,14 @@ var init_file_service = __esm({
         const cutoff = Date.now() - maxAgeDays * 24 * 60 * 60 * 1e3;
         let removed = 0;
         try {
-          const entries = await fs31.promises.readdir(this.baseDir, { withFileTypes: true });
+          const entries = await fs30.promises.readdir(this.baseDir, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory()) continue;
-            const dirPath = path31.join(this.baseDir, entry.name);
+            const dirPath = path30.join(this.baseDir, entry.name);
             try {
-              const stat = await fs31.promises.stat(dirPath);
+              const stat = await fs30.promises.stat(dirPath);
               if (stat.mtimeMs < cutoff) {
-                await fs31.promises.rm(dirPath, { recursive: true, force: true });
+                await fs30.promises.rm(dirPath, { recursive: true, force: true });
                 removed++;
               }
             } catch {
@@ -3006,11 +2653,11 @@ var init_file_service = __esm({
         return removed;
       }
       async saveFile(sessionId, fileName, data, mimeType) {
-        const sessionDir = path31.join(this.baseDir, sessionId);
-        await fs31.promises.mkdir(sessionDir, { recursive: true });
+        const sessionDir = path30.join(this.baseDir, sessionId);
+        await fs30.promises.mkdir(sessionDir, { recursive: true });
         const safeName = `${Date.now()}-${fileName.replace(/[^a-zA-Z0-9._-]/g, "_")}`;
-        const filePath = path31.join(sessionDir, safeName);
-        await fs31.promises.writeFile(filePath, data);
+        const filePath = path30.join(sessionDir, safeName);
+        await fs30.promises.writeFile(filePath, data);
         return {
           type: classifyMime(mimeType),
           filePath,
@@ -3021,14 +2668,14 @@ var init_file_service = __esm({
       }
       async resolveFile(filePath) {
         try {
-          const stat = await fs31.promises.stat(filePath);
+          const stat = await fs30.promises.stat(filePath);
           if (!stat.isFile()) return null;
-          const ext = path31.extname(filePath).toLowerCase();
+          const ext = path30.extname(filePath).toLowerCase();
           const mimeType = EXT_TO_MIME[ext] || "application/octet-stream";
           return {
             type: classifyMime(mimeType),
             filePath,
-            fileName: path31.basename(filePath),
+            fileName: path30.basename(filePath),
             mimeType,
             size: stat.size
           };
@@ -3240,6 +2887,7 @@ var init_roles = __esm({
         "sessions:prompt",
         "sessions:permission",
         "agents:read",
+        "agents:write",
         "commands:execute",
         "system:health",
         "config:read"
@@ -3358,12 +3006,16 @@ async function createApiServer(options) {
     // per-tunnel.  Only the first value in X-Forwarded-For is taken (the client); the
     // rest may be added by intermediate proxies and must not be trusted for limiting.
     keyGenerator: (request) => {
-      const cfIp = request.headers["cf-connecting-ip"];
-      if (cfIp && typeof cfIp === "string") return cfIp;
-      const xff = request.headers["x-forwarded-for"];
-      if (xff) {
-        const first = (Array.isArray(xff) ? xff[0] : xff).split(",")[0]?.trim();
-        if (first) return first;
+      const bindHost = options.host;
+      const isBehindProxy = !bindHost || bindHost === "127.0.0.1" || bindHost === "localhost" || bindHost === "::1";
+      if (isBehindProxy) {
+        const cfIp = request.headers["cf-connecting-ip"];
+        if (cfIp && typeof cfIp === "string") return cfIp;
+        const xff = request.headers["x-forwarded-for"];
+        if (xff) {
+          const first = (Array.isArray(xff) ? xff[0] : xff).split(",")[0]?.trim();
+          if (first) return first;
+        }
       }
       return request.ip;
     }
@@ -3474,7 +3126,10 @@ var init_sse_manager = __esm({
           "session:updated",
           "session:deleted",
           "agent:event",
-          "permission:request"
+          "permission:request",
+          "permission:resolved",
+          "message:queued",
+          "message:processing"
         ];
         for (const eventName of events) {
           const handler = (data) => {
@@ -3539,7 +3194,10 @@ data: ${JSON.stringify(data)}
         const sessionEvents = [
           "agent:event",
           "permission:request",
-          "session:updated"
+          "permission:resolved",
+          "session:updated",
+          "message:queued",
+          "message:processing"
         ];
         for (const res of this.sseConnections) {
           const filter = res.sessionFilter;
@@ -3582,8 +3240,8 @@ data: ${JSON.stringify(data)}
 });
 
 // src/plugins/api-server/static-server.ts
-import * as fs32 from "fs";
-import * as path32 from "path";
+import * as fs31 from "fs";
+import * as path31 from "path";
 import { fileURLToPath } from "url";
 var MIME_TYPES, StaticServer;
 var init_static_server = __esm({
@@ -3607,16 +3265,16 @@ var init_static_server = __esm({
         this.uiDir = uiDir;
         if (!this.uiDir) {
           const __filename = fileURLToPath(import.meta.url);
-          const candidate = path32.resolve(path32.dirname(__filename), "../../ui/dist");
-          if (fs32.existsSync(path32.join(candidate, "index.html"))) {
+          const candidate = path31.resolve(path31.dirname(__filename), "../../ui/dist");
+          if (fs31.existsSync(path31.join(candidate, "index.html"))) {
             this.uiDir = candidate;
           }
           if (!this.uiDir) {
-            const publishCandidate = path32.resolve(
-              path32.dirname(__filename),
+            const publishCandidate = path31.resolve(
+              path31.dirname(__filename),
               "../ui"
             );
-            if (fs32.existsSync(path32.join(publishCandidate, "index.html"))) {
+            if (fs31.existsSync(path31.join(publishCandidate, "index.html"))) {
               this.uiDir = publishCandidate;
             }
           }
@@ -3628,23 +3286,23 @@ var init_static_server = __esm({
       serve(req, res) {
         if (!this.uiDir) return false;
         const urlPath = (req.url || "/").split("?")[0];
-        const safePath = path32.normalize(urlPath);
-        const filePath = path32.join(this.uiDir, safePath);
-        if (!filePath.startsWith(this.uiDir + path32.sep) && filePath !== this.uiDir)
+        const safePath = path31.normalize(urlPath);
+        const filePath = path31.join(this.uiDir, safePath);
+        if (!filePath.startsWith(this.uiDir + path31.sep) && filePath !== this.uiDir)
           return false;
         let realFilePath;
         try {
-          realFilePath = fs32.realpathSync(filePath);
+          realFilePath = fs31.realpathSync(filePath);
         } catch {
           realFilePath = null;
         }
         if (realFilePath !== null) {
-          const realUiDir = fs32.realpathSync(this.uiDir);
-          if (!realFilePath.startsWith(realUiDir + path32.sep) && realFilePath !== realUiDir)
+          const realUiDir = fs31.realpathSync(this.uiDir);
+          if (!realFilePath.startsWith(realUiDir + path31.sep) && realFilePath !== realUiDir)
             return false;
         }
-        if (realFilePath !== null && fs32.existsSync(realFilePath) && fs32.statSync(realFilePath).isFile()) {
-          const ext = path32.extname(filePath);
+        if (realFilePath !== null && fs31.existsSync(realFilePath) && fs31.statSync(realFilePath).isFile()) {
+          const ext = path31.extname(filePath);
           const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
           const isHashed = /\.[a-zA-Z0-9]{8,}\.(js|css)$/.test(filePath);
           const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "no-cache";
@@ -3652,16 +3310,16 @@ var init_static_server = __esm({
             "Content-Type": contentType,
             "Cache-Control": cacheControl
           });
-          fs32.createReadStream(realFilePath).pipe(res);
+          fs31.createReadStream(realFilePath).pipe(res);
           return true;
         }
-        const indexPath = path32.join(this.uiDir, "index.html");
-        if (fs32.existsSync(indexPath)) {
+        const indexPath = path31.join(this.uiDir, "index.html");
+        if (fs31.existsSync(indexPath)) {
           res.writeHead(200, {
             "Content-Type": "text/html; charset=utf-8",
             "Cache-Control": "no-cache"
           });
-          fs32.createReadStream(indexPath).pipe(res);
+          fs31.createReadStream(indexPath).pipe(res);
           return true;
         }
         return false;
@@ -3816,8 +3474,8 @@ var init_exports = __esm({
 });
 
 // src/plugins/context/context-cache.ts
-import * as fs33 from "fs";
-import * as path33 from "path";
+import * as fs32 from "fs";
+import * as path32 from "path";
 import * as crypto2 from "crypto";
 var DEFAULT_TTL_MS, ContextCache;
 var init_context_cache = __esm({
@@ -3828,29 +3486,29 @@ var init_context_cache = __esm({
       constructor(cacheDir, ttlMs = DEFAULT_TTL_MS) {
         this.cacheDir = cacheDir;
         this.ttlMs = ttlMs;
-        fs33.mkdirSync(cacheDir, { recursive: true });
+        fs32.mkdirSync(cacheDir, { recursive: true });
       }
       keyHash(repoPath, queryKey) {
         return crypto2.createHash("sha256").update(`${repoPath}:${queryKey}`).digest("hex").slice(0, 16);
       }
       filePath(repoPath, queryKey) {
-        return path33.join(this.cacheDir, `${this.keyHash(repoPath, queryKey)}.json`);
+        return path32.join(this.cacheDir, `${this.keyHash(repoPath, queryKey)}.json`);
       }
       get(repoPath, queryKey) {
         const fp = this.filePath(repoPath, queryKey);
         try {
-          const stat = fs33.statSync(fp);
+          const stat = fs32.statSync(fp);
           if (Date.now() - stat.mtimeMs > this.ttlMs) {
-            fs33.unlinkSync(fp);
+            fs32.unlinkSync(fp);
             return null;
           }
-          return JSON.parse(fs33.readFileSync(fp, "utf-8"));
+          return JSON.parse(fs32.readFileSync(fp, "utf-8"));
         } catch {
           return null;
         }
       }
       set(repoPath, queryKey, result) {
-        fs33.writeFileSync(this.filePath(repoPath, queryKey), JSON.stringify(result));
+        fs32.writeFileSync(this.filePath(repoPath, queryKey), JSON.stringify(result));
       }
     };
   }
@@ -3858,7 +3516,7 @@ var init_context_cache = __esm({
 
 // src/plugins/context/context-manager.ts
 import * as os15 from "os";
-import * as path34 from "path";
+import * as path33 from "path";
 var ContextManager;
 var init_context_manager = __esm({
   "src/plugins/context/context-manager.ts"() {
@@ -3868,12 +3526,25 @@ var init_context_manager = __esm({
       providers = [];
       cache;
       historyStore;
+      sessionFlusher;
       constructor(cachePath) {
-        this.cache = new ContextCache(cachePath ?? path34.join(os15.homedir(), ".openacp", "cache", "entire"));
+        this.cache = new ContextCache(cachePath ?? path33.join(os15.homedir(), ".openacp", "cache", "entire"));
       }
       setHistoryStore(store) {
         this.historyStore = store;
       }
+      /** Register a callback that flushes in-memory recorder state for a session to disk. */
+      registerFlusher(fn) {
+        this.sessionFlusher = fn;
+      }
+      /**
+       * Flush the recorder state for a session to disk before reading its context.
+       * Call this before buildContext() when switching agents to avoid a race
+       * where the last turn hasn't been persisted yet.
+       */
+      async flushSession(sessionId) {
+        if (this.sessionFlusher) await this.sessionFlusher(sessionId);
+      }
       async getHistory(sessionId) {
         if (!this.historyStore) return null;
         return this.historyStore.read(sessionId);
@@ -3897,13 +3568,17 @@ var init_context_manager = __esm({
       }
       async buildContext(query, options) {
         const queryKey = `${query.type}:${query.value}:${options?.limit ?? ""}:${options?.maxTokens ?? ""}:${options?.labelAgent ?? ""}`;
-        const cached = this.cache.get(query.repoPath, queryKey);
-        if (cached) return cached;
+        if (!options?.noCache) {
+          const cached = this.cache.get(query.repoPath, queryKey);
+          if (cached) return cached;
+        }
         for (const provider of this.providers) {
           if (!await provider.isAvailable(query.repoPath)) continue;
           const result = await provider.buildContext(query, options);
           if (result && result.markdown) {
-            this.cache.set(query.repoPath, queryKey, result);
+            if (!options?.noCache) {
+              this.cache.set(query.repoPath, queryKey, result);
+            }
             return result;
           }
         }
@@ -3924,7 +3599,7 @@ var init_context_provider = __esm({
 });
 
 // src/plugins/context/entire/checkpoint-reader.ts
-import { execFileSync as execFileSync6 } from "child_process";
+import { execFileSync as execFileSync7 } from "child_process";
 var ENTIRE_BRANCH, CHECKPOINT_ID_RE, SESSION_ID_RE, CheckpointReader;
 var init_checkpoint_reader = __esm({
   "src/plugins/context/entire/checkpoint-reader.ts"() {
@@ -3943,7 +3618,7 @@ var init_checkpoint_reader = __esm({
        */
       git(...args) {
         try {
-          return execFileSync6("git", ["-C", this.repoPath, ...args], {
+          return execFileSync7("git", ["-C", this.repoPath, ...args], {
             encoding: "utf-8"
           }).trim();
         } catch {
@@ -4770,8 +4445,8 @@ function formatToolSummary(name, rawInput, displaySummary) {
   }
   if (lowerName === "grep") {
     const pattern = args.pattern ?? "";
-    const path35 = args.path ?? "";
-    return pattern ? `\u{1F50D} Grep "${pattern}"${path35 ? ` in ${path35}` : ""}` : `\u{1F527} ${name}`;
+    const path34 = args.path ?? "";
+    return pattern ? `\u{1F50D} Grep "${pattern}"${path34 ? ` in ${path34}` : ""}` : `\u{1F527} ${name}`;
   }
   if (lowerName === "glob") {
     const pattern = args.pattern ?? "";
@@ -4807,8 +4482,8 @@ function formatToolTitle(name, rawInput, displayTitle) {
   }
   if (lowerName === "grep") {
     const pattern = args.pattern ?? "";
-    const path35 = args.path ?? "";
-    return pattern ? `"${pattern}"${path35 ? ` in ${path35}` : ""}` : name;
+    const path34 = args.path ?? "";
+    return pattern ? `"${pattern}"${path34 ? ` in ${path34}` : ""}` : name;
   }
   if (lowerName === "glob") {
     return String(args.pattern ?? name);
@@ -5486,12 +5161,34 @@ function asRecord(value) {
 function capitalize(s) {
   return s.length === 0 ? s : s[0].toUpperCase() + s.slice(1);
 }
+function getStringField(input2, keys) {
+  for (const key of keys) {
+    const value = input2[key];
+    if (typeof value === "string" && value.trim().length > 0) return value;
+  }
+  return null;
+}
+function parseApplyPatchTargets(patchText) {
+  const targets = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of patchText.split("\n")) {
+    const match = line.match(/^\*\*\*\s+(?:Update|Add|Delete)\s+File:\s+(.+)$/);
+    if (!match) continue;
+    const p = match[1].trim();
+    if (p && !seen.has(p)) {
+      seen.add(p);
+      targets.push(p);
+    }
+  }
+  return targets;
+}
 function buildTitle(entry, kind) {
   if (entry.displayTitle) return entry.displayTitle;
   if (entry.displaySummary) return entry.displaySummary;
   const input2 = asRecord(entry.rawInput);
+  const nameLower = entry.name.toLowerCase();
   if (kind === "read") {
-    const filePath = typeof input2.file_path === "string" ? input2.file_path : null;
+    const filePath = getStringField(input2, ["file_path", "filePath", "path"]);
     if (filePath) {
       const startLine = typeof input2.start_line === "number" ? input2.start_line : null;
       const endLine = typeof input2.end_line === "number" ? input2.end_line : null;
@@ -5506,7 +5203,7 @@ function buildTitle(entry, kind) {
     return capitalize(entry.name);
   }
   if (kind === "edit" || kind === "write" || kind === "delete") {
-    const filePath = typeof input2.file_path === "string" ? input2.file_path : typeof input2.path === "string" ? input2.path : null;
+    const filePath = getStringField(input2, ["file_path", "filePath", "path"]);
     if (filePath) return filePath;
     return capitalize(entry.name);
   }
@@ -5538,6 +5235,36 @@ function buildTitle(entry, kind) {
     }
     return capitalize(entry.name);
   }
+  if (nameLower === "apply_patch") {
+    const patchText = getStringField(input2, ["patchText", "patch_text"]);
+    if (patchText) {
+      const targets = parseApplyPatchTargets(patchText);
+      if (targets.length === 1) return targets[0];
+      if (targets.length > 1) {
+        const shown = targets.slice(0, 2).join(", ");
+        const remaining = targets.length - 2;
+        return remaining > 0 ? `${shown} (+${remaining} more)` : shown;
+      }
+    }
+    return "apply_patch";
+  }
+  if (nameLower === "todowrite") {
+    const todos = Array.isArray(input2.todos) ? input2.todos : [];
+    if (todos.length > 0) {
+      const inProgress = todos.filter((t) => {
+        if (!t || typeof t !== "object") return false;
+        const status = t.status;
+        return status === "in_progress";
+      }).length;
+      const completed = todos.filter((t) => {
+        if (!t || typeof t !== "object") return false;
+        const status = t.status;
+        return status === "completed";
+      }).length;
+      return `Todo list (${completed}/${todos.length} done${inProgress > 0 ? `, ${inProgress} active` : ""})`;
+    }
+    return "Todo list";
+  }
   if (kind === "fetch" || kind === "web") {
     const url = typeof input2.url === "string" ? input2.url : null;
     if (url && url !== "undefined") return url.length > 60 ? url.slice(0, 57) + "..." : url;
@@ -5545,11 +5272,36 @@ function buildTitle(entry, kind) {
     if (query && query !== "undefined") return query.length > 60 ? query.slice(0, 57) + "..." : query;
     return capitalize(entry.name);
   }
-  if (entry.name.toLowerCase() === "skill" && typeof input2.skill === "string" && input2.skill) {
+  if (nameLower === "skill" && typeof input2.skill === "string" && input2.skill) {
     return input2.skill;
   }
+  if (nameLower === "apply_patch") {
+    const patchText = getStringField(input2, ["patchText", "patch_text"]);
+    if (patchText) {
+      const targets = parseApplyPatchTargets(patchText);
+      if (targets.length === 1) return targets[0];
+      if (targets.length > 1) {
+        const shown = targets.slice(0, 2).join(", ");
+        const rest = targets.length - 2;
+        return rest > 0 ? `${shown} (+${rest} more)` : shown;
+      }
+    }
+    return "apply_patch";
+  }
+  if (nameLower === "todowrite") {
+    const todos = Array.isArray(input2.todos) ? input2.todos : [];
+    if (todos.length > 0) {
+      const completed = todos.filter((t) => isRecord(t) && t.status === "completed").length;
+      const active = todos.filter((t) => isRecord(t) && t.status === "in_progress").length;
+      return `Todo list (${completed}/${todos.length} done${active > 0 ? `, ${active} active` : ""})`;
+    }
+    return "Todo list";
+  }
   return entry.name;
 }
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function buildOutputSummary(content) {
   const lines = content.split("\n").length;
   return `${lines} line${lines === 1 ? "" : "s"} of output`;
@@ -5624,6 +5376,7 @@ var init_display_spec_builder = __esm({
           viewerLinks: entry.viewerLinks,
           outputViewerLink,
           outputFallbackContent,
+          workingDirectory: sessionContext?.workingDirectory,
           status: entry.status,
           isNoise: entry.isNoise,
           isHidden
@@ -5854,20 +5607,33 @@ function renderToolCard(snap) {
   }
   return sections.join("\n\n");
 }
-function shortenTitle(title, kind) {
-  if (!FILE_KINDS.has(kind) || !title.includes("/")) return title;
+function normalizePathLike(pathLike) {
+  return pathLike.replace(/\\/g, "/");
+}
+function shortenTitle(title, kind, workingDirectory) {
+  if (!title.includes("/")) return title;
   const parenIdx = title.indexOf(" (");
   const pathPart = parenIdx > 0 ? title.slice(0, parenIdx) : title;
   const rangePart = parenIdx > 0 ? title.slice(parenIdx) : "";
-  const fileName = pathPart.split("/").pop() || pathPart;
-  return fileName + rangePart;
+  if (workingDirectory) {
+    const normalizedPathPart = normalizePathLike(pathPart);
+    const normalizedCwd = normalizePathLike(workingDirectory).replace(/\/+$/, "");
+    const prefix = `${normalizedCwd}/`;
+    const relativized = normalizedPathPart.split(", ").map((segment) => segment.startsWith(prefix) ? segment.slice(prefix.length) : segment).join(", ");
+    if (relativized !== normalizedPathPart) return relativized + rangePart;
+  }
+  if (FILE_KINDS.has(kind)) return basename(pathPart) + rangePart;
+  return title;
+}
+function basename(pathLike) {
+  return pathLike.replace(/\\/g, "/").split("/").pop() || pathLike;
 }
 function renderSpecSection(spec) {
   const lines = [];
   const DONE = /* @__PURE__ */ new Set(["completed", "done", "failed", "error"]);
   const statusPrefix = spec.status === "error" || spec.status === "failed" ? "\u274C " : DONE.has(spec.status) ? "\u2705 " : "\u{1F504} ";
   const kindLabel = KIND_LABELS[spec.kind];
-  const displayTitle = shortenTitle(spec.title, spec.kind);
+  const displayTitle = shortenTitle(spec.title, spec.kind, spec.workingDirectory);
   const hasUniqueTitle = displayTitle && displayTitle.toLowerCase() !== kindLabel?.toLowerCase() && displayTitle.toLowerCase() !== spec.kind;
   let titleLine;
   if (kindLabel) {
@@ -5896,9 +5662,9 @@ function renderSpecSection(spec) {
   }
   if (spec.viewerLinks?.file || spec.viewerLinks?.diff || spec.outputViewerLink) {
     const linkParts = [];
-    const shortName = displayTitle || kindLabel || spec.kind;
+    const linkName = basename(displayTitle || kindLabel || spec.kind);
     if (spec.viewerLinks?.file)
-      linkParts.push(`<a href="${escapeHtml(spec.viewerLinks.file)}">View ${escapeHtml(shortName)}</a>`);
+      linkParts.push(`<a href="${escapeHtml(spec.viewerLinks.file)}">View ${escapeHtml(linkName)}</a>`);
     if (spec.viewerLinks?.diff)
       linkParts.push(`<a href="${escapeHtml(spec.viewerLinks.diff)}">View diff</a>`);
     if (spec.outputViewerLink)
@@ -5949,13 +5715,13 @@ __export(version_exports, {
   runUpdate: () => runUpdate
 });
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname11, join as join21, resolve as resolve5 } from "path";
-import { existsSync as existsSync18, readFileSync as readFileSync14 } from "fs";
+import { dirname as dirname10, join as join20, resolve as resolve5 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
 function findPackageJson() {
-  let dir = dirname11(fileURLToPath2(import.meta.url));
+  let dir = dirname10(fileURLToPath2(import.meta.url));
   for (let i = 0; i < 5; i++) {
-    const candidate = join21(dir, "package.json");
-    if (existsSync18(candidate)) return candidate;
+    const candidate = join20(dir, "package.json");
+    if (existsSync17(candidate)) return candidate;
     const parent = resolve5(dir, "..");
     if (parent === dir) break;
     dir = parent;
@@ -5966,7 +5732,7 @@ function getCurrentVersion() {
   try {
     const pkgPath = findPackageJson();
     if (!pkgPath) return "0.0.0-dev";
-    const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
     return pkg.version;
   } catch {
     return "0.0.0-dev";
@@ -6343,11 +6109,16 @@ async function createSessionDirect(ctx, core, chatId, agentName, workspace, onCo
 }
 function cacheWorkspace(agentKey, workspace) {
   const now = Date.now();
+  for (const [id2, entry] of workspaceCache) {
+    if (now - entry.ts > 5 * 6e4) {
+      workspaceCache.delete(id2);
+    }
+  }
   if (workspaceCache.size > WS_CACHE_MAX) {
-    for (const [id2, entry] of workspaceCache) {
-      if (now - entry.ts > 5 * 6e4 || workspaceCache.size > WS_CACHE_MAX) {
-        workspaceCache.delete(id2);
-      }
+    const sorted = [...workspaceCache.entries()].sort((a, b) => a[1].ts - b[1].ts);
+    const toDelete = sorted.slice(0, workspaceCache.size - WS_CACHE_MAX);
+    for (const [id2] of toDelete) {
+      workspaceCache.delete(id2);
     }
   }
   const id = nextWsId++;
@@ -6789,9 +6560,12 @@ __export(integrate_exports, {
   listIntegrations: () => listIntegrations,
   uninstallIntegration: () => uninstallIntegration
 });
-import { existsSync as existsSync19, mkdirSync as mkdirSync12, readFileSync as readFileSync15, writeFileSync as writeFileSync12, unlinkSync as unlinkSync7, chmodSync, rmdirSync } from "fs";
-import { join as join22, dirname as dirname12 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync11, unlinkSync as unlinkSync7, chmodSync, rmdirSync } from "fs";
+import { join as join21, dirname as dirname11 } from "path";
 import { homedir as homedir10 } from "os";
+function isHooksIntegrationSpec(spec) {
+  return spec.strategy === "hooks";
+}
 function expandPath(p) {
   return p.replace(/^~/, homedir10());
 }
@@ -6909,12 +6683,48 @@ Examples:
   /openacp:handoff telegram
 `;
 }
+function generateOpencodeHandoffCommand(spec) {
+  return `---
+name: ${spec.handoffCommandName}
+description: Transfer current OpenCode session to OpenACP (Telegram/Discord)
+---
+
+Use OPENCODE_SESSION_ID from injected context, then run:
+
+openacp adopt opencode <OPENCODE_SESSION_ID>
+
+If a channel argument is provided, append:
+
+--channel <channel_name>
+
+Usage:
+  /${spec.handoffCommandName}
+  /${spec.handoffCommandName} telegram
+`;
+}
+function generateOpencodePlugin(spec) {
+  return `export const OpenACPHandoffPlugin = async () => {
+  return {
+    "command.execute.before": async (input, output) => {
+      if (input.command !== ${JSON.stringify(spec.handoffCommandName)}) return
+      output.parts.unshift({
+        id: "openacp-session-inject",
+        sessionID: input.sessionID,
+        messageID: "openacp-inject",
+        type: "text",
+        text: \`OPENCODE_SESSION_ID: \${input.sessionID}\\n\`,
+      })
+    },
+  }
+}
+`;
+}
 function mergeSettingsJson(settingsPath, hookEvent, hookScriptPath) {
   const fullPath = expandPath(settingsPath);
   let settings = {};
-  if (existsSync19(fullPath)) {
-    const raw = readFileSync15(fullPath, "utf-8");
-    writeFileSync12(`${fullPath}.bak`, raw);
+  if (existsSync18(fullPath)) {
+    const raw = readFileSync16(fullPath, "utf-8");
+    writeFileSync11(`${fullPath}.bak`, raw);
     settings = JSON.parse(raw);
   }
   const hooks = settings.hooks ?? {};
@@ -6929,15 +6739,15 @@ function mergeSettingsJson(settingsPath, hookEvent, hookScriptPath) {
       hooks: [{ type: "command", command: hookScriptPath }]
     });
   }
-  mkdirSync12(dirname12(fullPath), { recursive: true });
-  writeFileSync12(fullPath, JSON.stringify(settings, null, 2) + "\n");
+  mkdirSync11(dirname11(fullPath), { recursive: true });
+  writeFileSync11(fullPath, JSON.stringify(settings, null, 2) + "\n");
 }
 function mergeHooksJson(settingsPath, hookEvent, hookScriptPath) {
   const fullPath = expandPath(settingsPath);
   let config = { version: 1 };
-  if (existsSync19(fullPath)) {
-    const raw = readFileSync15(fullPath, "utf-8");
-    writeFileSync12(`${fullPath}.bak`, raw);
+  if (existsSync18(fullPath)) {
+    const raw = readFileSync16(fullPath, "utf-8");
+    writeFileSync11(`${fullPath}.bak`, raw);
     config = JSON.parse(raw);
   }
   const hooks = config.hooks ?? {};
@@ -6948,13 +6758,13 @@ function mergeHooksJson(settingsPath, hookEvent, hookScriptPath) {
   if (!alreadyInstalled) {
     eventHooks.push({ command: hookScriptPath });
   }
-  mkdirSync12(dirname12(fullPath), { recursive: true });
-  writeFileSync12(fullPath, JSON.stringify(config, null, 2) + "\n");
+  mkdirSync11(dirname11(fullPath), { recursive: true });
+  writeFileSync11(fullPath, JSON.stringify(config, null, 2) + "\n");
 }
 function removeFromSettingsJson(settingsPath, hookEvent) {
   const fullPath = expandPath(settingsPath);
-  if (!existsSync19(fullPath)) return;
-  const raw = readFileSync15(fullPath, "utf-8");
+  if (!existsSync18(fullPath)) return;
+  const raw = readFileSync16(fullPath, "utf-8");
   const settings = JSON.parse(raw);
   const hooks = settings.hooks;
   if (!hooks?.[hookEvent]) return;
@@ -6964,12 +6774,12 @@ function removeFromSettingsJson(settingsPath, hookEvent) {
   if (hooks[hookEvent].length === 0) {
     delete hooks[hookEvent];
   }
-  writeFileSync12(fullPath, JSON.stringify(settings, null, 2) + "\n");
+  writeFileSync11(fullPath, JSON.stringify(settings, null, 2) + "\n");
 }
 function removeFromHooksJson(settingsPath, hookEvent) {
   const fullPath = expandPath(settingsPath);
-  if (!existsSync19(fullPath)) return;
-  const raw = readFileSync15(fullPath, "utf-8");
+  if (!existsSync18(fullPath)) return;
+  const raw = readFileSync16(fullPath, "utf-8");
   const config = JSON.parse(raw);
   const hooks = config.hooks;
   if (!hooks?.[hookEvent]) return;
@@ -6979,9 +6789,9 @@ function removeFromHooksJson(settingsPath, hookEvent) {
   if (hooks[hookEvent].length === 0) {
     delete hooks[hookEvent];
   }
-  writeFileSync12(fullPath, JSON.stringify(config, null, 2) + "\n");
+  writeFileSync11(fullPath, JSON.stringify(config, null, 2) + "\n");
 }
-async function installIntegration(agentKey, spec) {
+async function installHooksIntegration(agentKey, spec) {
   const logs = [];
   try {
     if (!commandExists("jq")) {
@@ -6991,31 +6801,31 @@ async function installIntegration(agentKey, spec) {
       };
     }
     const hooksDir = expandPath(spec.hooksDirPath);
-    mkdirSync12(hooksDir, { recursive: true });
-    const injectPath = join22(hooksDir, "openacp-inject-session.sh");
-    writeFileSync12(injectPath, generateInjectScript(agentKey, spec));
+    mkdirSync11(hooksDir, { recursive: true });
+    const injectPath = join21(hooksDir, "openacp-inject-session.sh");
+    writeFileSync11(injectPath, generateInjectScript(agentKey, spec));
     chmodSync(injectPath, 493);
     logs.push(`Created ${injectPath}`);
-    const handoffPath = join22(hooksDir, "openacp-handoff.sh");
-    writeFileSync12(handoffPath, generateHandoffScript(agentKey));
+    const handoffPath = join21(hooksDir, "openacp-handoff.sh");
+    writeFileSync11(handoffPath, generateHandoffScript(agentKey));
     chmodSync(handoffPath, 493);
     logs.push(`Created ${handoffPath}`);
     if (spec.commandsPath && spec.handoffCommandName) {
       if (spec.commandFormat === "skill") {
-        const skillDir = expandPath(join22(spec.commandsPath, spec.handoffCommandName));
-        mkdirSync12(skillDir, { recursive: true });
-        const skillPath = join22(skillDir, "SKILL.md");
-        writeFileSync12(skillPath, generateHandoffCommand(agentKey, spec));
+        const skillDir = expandPath(join21(spec.commandsPath, spec.handoffCommandName));
+        mkdirSync11(skillDir, { recursive: true });
+        const skillPath = join21(skillDir, "SKILL.md");
+        writeFileSync11(skillPath, generateHandoffCommand(agentKey, spec));
         logs.push(`Created ${skillPath}`);
       } else {
         const cmdsDir = expandPath(spec.commandsPath);
-        mkdirSync12(cmdsDir, { recursive: true });
-        const cmdPath = join22(cmdsDir, `${spec.handoffCommandName}.md`);
-        writeFileSync12(cmdPath, generateHandoffCommand(agentKey, spec));
+        mkdirSync11(cmdsDir, { recursive: true });
+        const cmdPath = join21(cmdsDir, `${spec.handoffCommandName}.md`);
+        writeFileSync11(cmdPath, generateHandoffCommand(agentKey, spec));
         logs.push(`Created ${cmdPath}`);
       }
     }
-    const injectFullPath = join22(hooksDir, "openacp-inject-session.sh");
+    const injectFullPath = join21(hooksDir, "openacp-inject-session.sh");
     if (spec.settingsFormat === "hooks_json") {
       mergeHooksJson(spec.settingsPath, spec.hookEvent, injectFullPath);
     } else {
@@ -7028,22 +6838,22 @@ async function installIntegration(agentKey, spec) {
     return { success: false, logs };
   }
 }
-async function uninstallIntegration(agentKey, spec) {
+async function uninstallHooksIntegration(agentKey, spec) {
   const logs = [];
   try {
     const hooksDir = expandPath(spec.hooksDirPath);
     for (const filename of ["openacp-inject-session.sh", "openacp-handoff.sh"]) {
-      const filePath = join22(hooksDir, filename);
-      if (existsSync19(filePath)) {
+      const filePath = join21(hooksDir, filename);
+      if (existsSync18(filePath)) {
         unlinkSync7(filePath);
         logs.push(`Removed ${filePath}`);
       }
     }
     if (spec.commandsPath && spec.handoffCommandName) {
       if (spec.commandFormat === "skill") {
-        const skillDir = expandPath(join22(spec.commandsPath, spec.handoffCommandName));
-        const skillPath = join22(skillDir, "SKILL.md");
-        if (existsSync19(skillPath)) {
+        const skillDir = expandPath(join21(spec.commandsPath, spec.handoffCommandName));
+        const skillPath = join21(skillDir, "SKILL.md");
+        if (existsSync18(skillPath)) {
           unlinkSync7(skillPath);
           try {
             rmdirSync(skillDir);
@@ -7052,8 +6862,8 @@ async function uninstallIntegration(agentKey, spec) {
           logs.push(`Removed ${skillPath}`);
         }
       } else {
-        const cmdPath = expandPath(join22(spec.commandsPath, `${spec.handoffCommandName}.md`));
-        if (existsSync19(cmdPath)) {
+        const cmdPath = expandPath(join21(spec.commandsPath, `${spec.handoffCommandName}.md`));
+        if (existsSync18(cmdPath)) {
           unlinkSync7(cmdPath);
           logs.push(`Removed ${cmdPath}`);
         }
@@ -7071,14 +6881,82 @@ async function uninstallIntegration(agentKey, spec) {
     return { success: false, logs };
   }
 }
+async function installPluginIntegration(_agentKey, spec) {
+  const logs = [];
+  try {
+    const commandsDir = expandPath(spec.commandsPath);
+    mkdirSync11(commandsDir, { recursive: true });
+    const commandPath = join21(commandsDir, spec.handoffCommandFile);
+    const pluginsDir = expandPath(spec.pluginsPath);
+    mkdirSync11(pluginsDir, { recursive: true });
+    const pluginPath = join21(pluginsDir, spec.pluginFileName);
+    if (existsSync18(commandPath) && existsSync18(pluginPath)) {
+      logs.push("Already installed, skipping.");
+      return { success: true, logs };
+    }
+    if (existsSync18(commandPath) || existsSync18(pluginPath)) {
+      logs.push("Overwriting existing files.");
+    }
+    writeFileSync11(commandPath, generateOpencodeHandoffCommand(spec));
+    logs.push(`Created ${commandPath}`);
+    writeFileSync11(pluginPath, generateOpencodePlugin(spec));
+    logs.push(`Created ${pluginPath}`);
+    return { success: true, logs };
+  } catch (err) {
+    logs.push(`Error: ${err instanceof Error ? err.message : String(err)}`);
+    return { success: false, logs };
+  }
+}
+async function uninstallPluginIntegration(_agentKey, spec) {
+  const logs = [];
+  try {
+    const commandPath = join21(expandPath(spec.commandsPath), spec.handoffCommandFile);
+    let removedCount = 0;
+    if (existsSync18(commandPath)) {
+      unlinkSync7(commandPath);
+      logs.push(`Removed ${commandPath}`);
+      removedCount += 1;
+    }
+    const pluginPath = join21(expandPath(spec.pluginsPath), spec.pluginFileName);
+    if (existsSync18(pluginPath)) {
+      unlinkSync7(pluginPath);
+      logs.push(`Removed ${pluginPath}`);
+      removedCount += 1;
+    }
+    if (removedCount === 0) {
+      logs.push("Nothing to remove.");
+    }
+    return { success: true, logs };
+  } catch (err) {
+    logs.push(`Error: ${err instanceof Error ? err.message : String(err)}`);
+    return { success: false, logs };
+  }
+}
+async function installIntegration(agentKey, spec) {
+  if (isHooksIntegrationSpec(spec)) {
+    return installHooksIntegration(agentKey, spec);
+  }
+  return installPluginIntegration(agentKey, spec);
+}
+async function uninstallIntegration(agentKey, spec) {
+  if (isHooksIntegrationSpec(spec)) {
+    return uninstallHooksIntegration(agentKey, spec);
+  }
+  return uninstallPluginIntegration(agentKey, spec);
+}
 function buildHandoffItem(agentKey, spec) {
-  const hooksDir = expandPath(spec.hooksDirPath);
   return {
     id: "handoff",
     name: "Handoff",
     description: "Transfer sessions between terminal and messaging platforms",
     isInstalled() {
-      return existsSync19(join22(hooksDir, "openacp-inject-session.sh")) && existsSync19(join22(hooksDir, "openacp-handoff.sh"));
+      if (isHooksIntegrationSpec(spec)) {
+        const hooksDir = expandPath(spec.hooksDirPath);
+        return existsSync18(join21(hooksDir, "openacp-inject-session.sh")) && existsSync18(join21(hooksDir, "openacp-handoff.sh"));
+      }
+      const commandPath = join21(expandPath(spec.commandsPath), spec.handoffCommandFile);
+      const pluginPath = join21(expandPath(spec.pluginsPath), spec.pluginFileName);
+      return existsSync18(commandPath) && existsSync18(pluginPath);
     },
     install: () => installIntegration(agentKey, spec),
     uninstall: () => uninstallIntegration(agentKey, spec)
@@ -7090,23 +6968,24 @@ function getSkillBasePath(spec) {
   return expandPath(skillsBase);
 }
 function buildTunnelItem(spec) {
-  if (!spec.commandsPath) return null;
+  if (!isHooksIntegrationSpec(spec) || !spec.commandsPath) return null;
+  const hooksSpec = spec;
   function getTunnelPath() {
-    return join22(getSkillBasePath(spec), "openacp-tunnel", "SKILL.md");
+    return join21(getSkillBasePath(hooksSpec), "openacp-tunnel", "SKILL.md");
   }
   return {
     id: "tunnel",
     name: "Tunnel",
     description: "Expose local ports to the internet via OpenACP tunnel",
     isInstalled() {
-      return existsSync19(getTunnelPath());
+      return existsSync18(getTunnelPath());
     },
     async install() {
       const logs = [];
       try {
         const skillPath = getTunnelPath();
-        mkdirSync12(dirname12(skillPath), { recursive: true });
-        writeFileSync12(skillPath, generateTunnelCommand());
+        mkdirSync11(dirname11(skillPath), { recursive: true });
+        writeFileSync11(skillPath, generateTunnelCommand());
         logs.push(`Created ${skillPath}`);
         return { success: true, logs };
       } catch (err) {
@@ -7118,10 +6997,10 @@ function buildTunnelItem(spec) {
       const logs = [];
       try {
         const skillPath = getTunnelPath();
-        if (existsSync19(skillPath)) {
+        if (existsSync18(skillPath)) {
           unlinkSync7(skillPath);
           try {
-            rmdirSync(dirname12(skillPath));
+            rmdirSync(dirname11(skillPath));
           } catch {
           }
           logs.push(`Removed ${skillPath}`);
@@ -7557,7 +7436,7 @@ async function buildSettingsKeyboard(core) {
   const fields = getSafeFields();
   const kb = new InlineKeyboard6();
   for (const field of fields) {
-    const value = await getFieldValueAsync(field, core.configManager, core.settingsManager);
+    const value = getConfigValue(core.configManager.get(), field.path);
     const label = formatFieldLabel(field, value);
     if (field.type === "toggle") {
       kb.text(`${label}`, `s:toggle:${field.path}`).row();
@@ -7600,11 +7479,10 @@ function setupSettingsCallbacks(bot, core, getAssistantSession) {
     const fieldPath = ctx.callbackQuery.data.replace("s:toggle:", "");
     const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
     if (!fieldDef) return;
-    const settingsManager = core.settingsManager;
-    const currentValue = await getFieldValueAsync(fieldDef, core.configManager, settingsManager);
+    const currentValue = getConfigValue(core.configManager.get(), fieldDef.path);
     const newValue = !currentValue;
     try {
-      await setFieldValueAsync(fieldDef, newValue, core.configManager, settingsManager);
+      await setFieldValueAsync(fieldDef, newValue, core.configManager);
       const toast = isHotReloadable(fieldPath) ? `\u2705 ${fieldPath} = ${newValue}` : `\u2705 ${fieldPath} = ${newValue} (restart needed)`;
       try {
         await ctx.answerCallbackQuery({ text: toast });
@@ -7628,7 +7506,7 @@ function setupSettingsCallbacks(bot, core, getAssistantSession) {
     const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
     if (!fieldDef) return;
     const options = resolveOptions(fieldDef, config) ?? [];
-    const currentValue = await getFieldValueAsync(fieldDef, core.configManager, core.settingsManager);
+    const currentValue = getConfigValue(core.configManager.get(), fieldDef.path);
     const kb = new InlineKeyboard6();
     for (const opt of options) {
       const marker = opt === String(currentValue) ? " \u2713" : "";
@@ -7662,9 +7540,7 @@ Select a value:`, {
           const speechSettings = await sm.loadSettings("@openacp/speech");
           hasApiKey = !!speechSettings.groqApiKey;
         } else {
-          const config = core.configManager.get();
-          const providerConfig = config.speech?.stt?.providers?.[newValue];
-          hasApiKey = !!providerConfig?.apiKey;
+          hasApiKey = false;
         }
         if (!hasApiKey) {
           const assistant = getAssistantSession();
@@ -7684,7 +7560,7 @@ Select a value:`, {
           return;
         }
       }
-      await setFieldValueAsync(fieldDef, newValue, core.configManager, core.settingsManager);
+      await setFieldValueAsync(fieldDef, newValue, core.configManager);
       try {
         await ctx.answerCallbackQuery({ text: `\u2705 ${fieldPath} = ${newValue}` });
       } catch {
@@ -7709,7 +7585,7 @@ Tap to change:`, {
     const fieldPath = ctx.callbackQuery.data.replace("s:input:", "");
     const fieldDef = getSafeFields().find((f) => f.path === fieldPath);
     if (!fieldDef) return;
-    const currentValue = await getFieldValueAsync(fieldDef, core.configManager, core.settingsManager);
+    const currentValue = getConfigValue(core.configManager.get(), fieldDef.path);
     const assistant = getAssistantSession();
     if (!assistant) {
       try {
@@ -8362,7 +8238,7 @@ var init_commands = __esm({
 
 // src/plugins/telegram/permissions.ts
 import { InlineKeyboard as InlineKeyboard11 } from "grammy";
-import { nanoid as nanoid3 } from "nanoid";
+import { nanoid as nanoid4 } from "nanoid";
 var log30, PermissionHandler;
 var init_permissions = __esm({
   "src/plugins/telegram/permissions.ts"() {
@@ -8381,7 +8257,7 @@ var init_permissions = __esm({
       pending = /* @__PURE__ */ new Map();
       async sendPermissionRequest(session, request) {
         const threadId = Number(session.threadId);
-        const callbackKey = nanoid3(8);
+        const callbackKey = nanoid4(8);
         this.pending.set(callbackKey, {
           sessionId: session.id,
           requestId: request.id,
@@ -9270,6 +9146,130 @@ var init_renderer2 = __esm({
   }
 });
 
+// src/plugins/telegram/validators.ts
+var validators_exports = {};
+__export(validators_exports, {
+  checkTopicsPrerequisites: () => checkTopicsPrerequisites,
+  validateBotAdmin: () => validateBotAdmin,
+  validateBotToken: () => validateBotToken,
+  validateChatId: () => validateChatId
+});
+async function validateBotToken(token) {
+  try {
+    const res = await fetch(`https://api.telegram.org/bot${token}/getMe`);
+    const data = await res.json();
+    if (data.ok && data.result) {
+      return {
+        ok: true,
+        botName: data.result.first_name,
+        botUsername: data.result.username
+      };
+    }
+    return { ok: false, error: data.description || "Invalid token" };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
+async function validateChatId(token, chatId) {
+  try {
+    const res = await fetch(`https://api.telegram.org/bot${token}/getChat`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ chat_id: chatId })
+    });
+    const data = await res.json();
+    if (!data.ok || !data.result) {
+      return { ok: false, error: data.description || "Invalid chat ID" };
+    }
+    if (data.result.type !== "supergroup") {
+      return {
+        ok: false,
+        error: `Chat must be a group (not a channel or private chat). Got: "${data.result.type}"`
+      };
+    }
+    return {
+      ok: true,
+      title: data.result.title,
+      isForum: data.result.is_forum === true
+    };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
+async function validateBotAdmin(token, chatId) {
+  try {
+    const meRes = await fetch(`https://api.telegram.org/bot${token}/getMe`);
+    const meData = await meRes.json();
+    if (!meData.ok || !meData.result) {
+      return { ok: false, error: "Could not retrieve bot info" };
+    }
+    const res = await fetch(
+      `https://api.telegram.org/bot${token}/getChatMember`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ chat_id: chatId, user_id: meData.result.id })
+      }
+    );
+    const data = await res.json();
+    if (!data.ok || !data.result) {
+      return {
+        ok: false,
+        error: data.description || "Could not check bot membership"
+      };
+    }
+    const { status } = data.result;
+    if (status === "creator") {
+      return { ok: true, canManageTopics: true };
+    }
+    if (status === "administrator") {
+      return { ok: true, canManageTopics: data.result.can_manage_topics === true };
+    }
+    return {
+      ok: false,
+      error: `Bot is "${status}" in this group. It must be an admin. Please promote the bot to admin in group settings.`
+    };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
+async function checkTopicsPrerequisites(token, chatId) {
+  const issues = [];
+  try {
+    const res = await fetch(`https://api.telegram.org/bot${token}/getChat`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ chat_id: chatId })
+    });
+    const data = await res.json();
+    if (data.ok && data.result && !data.result.is_forum) {
+      issues.push(
+        '\u274C Topics are not enabled on this group.\n\u2192 Go to Group Settings \u2192 Edit \u2192 enable "Topics"'
+      );
+    }
+  } catch {
+    issues.push("\u274C Could not check if Topics are enabled (network error).");
+  }
+  const adminResult = await validateBotAdmin(token, chatId);
+  if (!adminResult.ok) {
+    issues.push(
+      `\u274C Bot is not an admin.
+\u2192 Go to Group Settings \u2192 Administrators \u2192 add the bot \u2192 save`
+    );
+  } else if (!adminResult.canManageTopics) {
+    issues.push(
+      '\u274C Bot cannot manage topics.\n\u2192 In Admin settings, enable the "Manage Topics" permission'
+    );
+  }
+  if (issues.length > 0) return { ok: false, issues };
+  return { ok: true };
+}
+var init_validators = __esm({
+  "src/plugins/telegram/validators.ts"() {
+    "use strict";
+  }
+});
+
 // src/plugins/telegram/adapter.ts
 import { Bot, InputFile } from "grammy";
 function patchedFetch(input2, init) {
@@ -9339,6 +9339,10 @@ var init_adapter = __esm({
       controlMsgIds = /* @__PURE__ */ new Map();
       _threadReadyHandler;
       _configChangedHandler;
+      /** True once topics are initialized and Phase 2 is complete */
+      _topicsInitialized = false;
+      /** Background watcher timer — cancelled on stop() or when topics succeed */
+      _prerequisiteWatcher = null;
       /** Store control message ID in memory + persist to session record */
       storeControlMsgId(sessionId, msgId) {
         this.controlMsgIds.set(sessionId, msgId);
@@ -9467,25 +9471,6 @@ var init_adapter = __esm({
           if (chatId !== this.telegramConfig.chatId) return;
           return next();
         });
-        const topics = await this.retryWithBackoff(
-          () => ensureTopics(
-            this.bot,
-            this.telegramConfig.chatId,
-            this.telegramConfig,
-            async (updates) => {
-              if (this.saveTopicIds) {
-                await this.saveTopicIds(updates);
-              } else {
-                await this.core.configManager.save({
-                  channels: { telegram: updates }
-                });
-              }
-            }
-          ),
-          "ensureTopics"
-        );
-        this.notificationTopicId = topics.notificationTopicId;
-        this.assistantTopicId = topics.assistantTopicId;
         this.permissionHandler = new PermissionHandler(
           this.bot,
           this.telegramConfig.chatId,
@@ -9495,6 +9480,13 @@ var init_adapter = __esm({
         this.bot.on("message:text", async (ctx, next) => {
           const text3 = ctx.message?.text;
           if (!text3?.startsWith("/")) return next();
+          if (!this._topicsInitialized) {
+            await ctx.reply(
+              "\u23F3 OpenACP is still setting up. Check the General topic for instructions."
+            ).catch(() => {
+            });
+            return;
+          }
           const registry = this.core.lifecycleManager?.serviceRegistry?.get(
             "command-registry"
           );
@@ -9552,6 +9544,11 @@ var init_adapter = __esm({
           }
         });
         this.bot.callbackQuery(/^c\//, async (ctx) => {
+          if (!this._topicsInitialized) {
+            await ctx.answerCallbackQuery().catch(() => {
+            });
+            return;
+          }
           const data = ctx.callbackQuery.data;
           const command = this.fromCallbackData(data);
           const registry = this.core.lifecycleManager?.serviceRegistry?.get(
@@ -9604,10 +9601,84 @@ var init_adapter = __esm({
             await ctx.answerCallbackQuery({ text: "Command failed" });
           }
         });
-        setupDangerousModeCallbacks(this.bot, this.core);
-        setupTTSCallbacks(this.bot, this.core);
-        setupVerbosityCallbacks(this.bot, this.core);
-        setupIntegrateCallbacks(this.bot, this.core);
+        setupDangerousModeCallbacks(this.bot, this.core);
+        setupTTSCallbacks(this.bot, this.core);
+        setupVerbosityCallbacks(this.bot, this.core);
+        setupIntegrateCallbacks(this.bot, this.core);
+        this.permissionHandler.setupCallbackHandler();
+        this.bot.start({
+          allowed_updates: ["message", "callback_query"],
+          onStart: () => log33.info({ chatId: this.telegramConfig.chatId }, "Telegram bot started")
+        });
+        const { checkTopicsPrerequisites: checkTopicsPrerequisites2 } = await Promise.resolve().then(() => (init_validators(), validators_exports));
+        const prereqResult = await checkTopicsPrerequisites2(
+          this.telegramConfig.botToken,
+          this.telegramConfig.chatId
+        );
+        if (prereqResult.ok) {
+          await this.initTopicDependentFeatures();
+        } else {
+          for (const issue of prereqResult.issues) {
+            log33.warn({ issue }, "Telegram prerequisite not met");
+          }
+          this.startPrerequisiteWatcher(prereqResult.issues);
+        }
+      }
+      /**
+       * Retry an async operation with exponential backoff.
+       * Used for Telegram API calls that may fail due to transient network issues.
+       */
+      async retryWithBackoff(fn, label, maxRetries = 5, baseDelayMs = 2e3) {
+        for (let attempt = 1; attempt <= maxRetries; attempt++) {
+          try {
+            return await fn();
+          } catch (err) {
+            if (attempt === maxRetries) throw err;
+            const delay = baseDelayMs * Math.pow(2, attempt - 1);
+            log33.warn(
+              { err, attempt, maxRetries, delayMs: delay, operation: label },
+              `${label} failed, retrying in ${delay}ms`
+            );
+            await new Promise((r) => setTimeout(r, delay));
+          }
+        }
+        throw new Error("unreachable");
+      }
+      /**
+       * Register Telegram commands in the background with retries.
+       * Non-critical — bot works fine without autocomplete commands.
+       */
+      registerCommandsWithRetry() {
+        this.retryWithBackoff(
+          () => this.bot.api.setMyCommands(STATIC_COMMANDS, {
+            scope: { type: "chat", chat_id: this.telegramConfig.chatId }
+          }),
+          "setMyCommands"
+        ).catch((err) => {
+          log33.warn({ err }, "Failed to register Telegram commands after retries (non-critical)");
+        });
+      }
+      async initTopicDependentFeatures() {
+        if (this._topicsInitialized) return;
+        const topics = await this.retryWithBackoff(
+          () => ensureTopics(
+            this.bot,
+            this.telegramConfig.chatId,
+            this.telegramConfig,
+            async (updates) => {
+              if (this.saveTopicIds) {
+                await this.saveTopicIds(updates);
+              } else {
+                await this.core.configManager.save({
+                  channels: { telegram: updates }
+                });
+              }
+            }
+          ),
+          "ensureTopics"
+        );
+        this.notificationTopicId = topics.notificationTopicId;
+        this.assistantTopicId = topics.assistantTopicId;
         setupAllCallbacks(
           this.bot,
           this.core,
@@ -9637,7 +9708,6 @@ ${p}` : p;
             this.storeControlMsgId(sessionId, msgId);
           }
         );
-        this.permissionHandler.setupCallbackHandler();
         this._threadReadyHandler = ({ sessionId, channelId, threadId }) => {
           if (channelId !== "telegram") return;
           const session = this.core.sessionManager.getSession(sessionId);
@@ -9675,13 +9745,6 @@ ${p}` : p;
         };
         this.core.eventBus.on("session:configChanged", this._configChangedHandler);
         this.setupRoutes();
-        this.bot.start({
-          allowed_updates: ["message", "callback_query"],
-          onStart: () => log33.info(
-            { chatId: this.telegramConfig.chatId },
-            "Telegram bot started"
-          )
-        });
         try {
           const config = this.core.configManager.get();
           const agents = this.core.agentManager.getAvailableAgents();
@@ -9711,42 +9774,56 @@ ${p}` : p;
         } catch (err) {
           log33.error({ err }, "Failed to spawn assistant");
         }
+        this._topicsInitialized = true;
+        log33.info("Telegram adapter fully initialized");
       }
-      /**
-       * Retry an async operation with exponential backoff.
-       * Used for Telegram API calls that may fail due to transient network issues.
-       */
-      async retryWithBackoff(fn, label, maxRetries = 5, baseDelayMs = 2e3) {
-        for (let attempt = 1; attempt <= maxRetries; attempt++) {
-          try {
-            return await fn();
-          } catch (err) {
-            if (attempt === maxRetries) throw err;
-            const delay = baseDelayMs * Math.pow(2, attempt - 1);
-            log33.warn(
-              { err, attempt, maxRetries, delayMs: delay, operation: label },
-              `${label} failed, retrying in ${delay}ms`
-            );
-            await new Promise((r) => setTimeout(r, delay));
-          }
-        }
-        throw new Error("unreachable");
-      }
-      /**
-       * Register Telegram commands in the background with retries.
-       * Non-critical — bot works fine without autocomplete commands.
-       */
-      registerCommandsWithRetry() {
-        this.retryWithBackoff(
-          () => this.bot.api.setMyCommands(STATIC_COMMANDS, {
-            scope: { type: "chat", chat_id: this.telegramConfig.chatId }
-          }),
-          "setMyCommands"
-        ).catch((err) => {
-          log33.warn({ err }, "Failed to register Telegram commands after retries (non-critical)");
+      startPrerequisiteWatcher(issues) {
+        const setupMessage = `\u26A0\uFE0F <b>OpenACP needs setup before it can start.</b>
+
+` + issues.join("\n\n") + `
+
+OpenACP will automatically retry until this is resolved.`;
+        this.bot.api.sendMessage(this.telegramConfig.chatId, setupMessage, {
+          parse_mode: "HTML"
+        }).catch((err) => {
+          log33.warn({ err }, "Failed to send setup guidance to General topic");
         });
+        const schedule = [5e3, 1e4, 3e4];
+        let attempt = 1;
+        const retry = async () => {
+          if (this._prerequisiteWatcher === null) return;
+          const { checkTopicsPrerequisites: checkTopicsPrerequisites2 } = await Promise.resolve().then(() => (init_validators(), validators_exports));
+          const result = await checkTopicsPrerequisites2(
+            this.telegramConfig.botToken,
+            this.telegramConfig.chatId
+          );
+          if (result.ok) {
+            this._prerequisiteWatcher = null;
+            log33.info("Prerequisites met \u2014 completing Telegram adapter initialization");
+            try {
+              await this.initTopicDependentFeatures();
+              await this.bot.api.sendMessage(
+                this.telegramConfig.chatId,
+                "\u2705 <b>OpenACP is ready!</b>\n\nSystem topics have been created. Use the \u{1F916} Assistant topic to get started.",
+                { parse_mode: "HTML" }
+              );
+            } catch (err) {
+              log33.error({ err }, "Failed to complete initialization after prerequisites met");
+            }
+            return;
+          }
+          log33.debug({ issues: result.issues }, "Prerequisites not yet met, retrying");
+          const delay = schedule[Math.min(attempt, schedule.length - 1)];
+          attempt++;
+          this._prerequisiteWatcher = setTimeout(retry, delay);
+        };
+        this._prerequisiteWatcher = setTimeout(retry, schedule[0]);
       }
       async stop() {
+        if (this._prerequisiteWatcher !== null) {
+          clearTimeout(this._prerequisiteWatcher);
+          this._prerequisiteWatcher = null;
+        }
         for (const tracker of this.sessionTrackers.values()) {
           tracker.destroy();
         }
@@ -10532,8 +10609,16 @@ function nodeToWebWritable(nodeStream) {
           resolve6();
           return;
         }
-        nodeStream.once("drain", resolve6);
-        nodeStream.once("error", reject);
+        const onDrain = () => {
+          nodeStream.removeListener("error", onError);
+          resolve6();
+        };
+        const onError = (err) => {
+          nodeStream.removeListener("drain", onDrain);
+          reject(err);
+        };
+        nodeStream.once("drain", onDrain);
+        nodeStream.once("error", onError);
       });
     },
     close() {
@@ -10580,13 +10665,13 @@ init_config();
 // src/core/agents/agent-instance.ts
 import { spawn as spawn2, execFileSync } from "child_process";
 import { Transform } from "stream";
-import fs9 from "fs";
-import path8 from "path";
+import fs8 from "fs";
+import path7 from "path";
 import { ClientSideConnection, ndJsonStream } from "@agentclientprotocol/sdk";
 
 // src/core/security/path-guard.ts
-import fs6 from "fs";
-import path6 from "path";
+import fs5 from "fs";
+import path5 from "path";
 import ignore from "ignore";
 var DEFAULT_DENY_PATTERNS = [
   ".env",
@@ -10606,15 +10691,15 @@ var PathGuard = class {
   ig;
   constructor(options) {
     try {
-      this.cwd = fs6.realpathSync(path6.resolve(options.cwd));
+      this.cwd = fs5.realpathSync(path5.resolve(options.cwd));
     } catch {
-      this.cwd = path6.resolve(options.cwd);
+      this.cwd = path5.resolve(options.cwd);
     }
     this.allowedPaths = options.allowedPaths.map((p) => {
       try {
-        return fs6.realpathSync(path6.resolve(p));
+        return fs5.realpathSync(path5.resolve(p));
       } catch {
-        return path6.resolve(p);
+        return path5.resolve(p);
       }
     });
     this.ig = ignore();
@@ -10624,19 +10709,19 @@ var PathGuard = class {
     }
   }
   validatePath(targetPath, operation) {
-    const resolved = path6.resolve(targetPath);
+    const resolved = path5.resolve(targetPath);
     let realPath;
     try {
-      realPath = fs6.realpathSync(resolved);
+      realPath = fs5.realpathSync(resolved);
     } catch {
       realPath = resolved;
     }
-    if (operation === "write" && path6.basename(realPath) === ".openacpignore") {
+    if (operation === "write" && path5.basename(realPath) === ".openacpignore") {
       return { allowed: false, reason: "Cannot write to .openacpignore" };
     }
-    const isWithinCwd = realPath === this.cwd || realPath.startsWith(this.cwd + path6.sep);
+    const isWithinCwd = realPath === this.cwd || realPath.startsWith(this.cwd + path5.sep);
     const isWithinAllowed = this.allowedPaths.some(
-      (ap) => realPath === ap || realPath.startsWith(ap + path6.sep)
+      (ap) => realPath === ap || realPath.startsWith(ap + path5.sep)
     );
     if (!isWithinCwd && !isWithinAllowed) {
       return {
@@ -10645,7 +10730,7 @@ var PathGuard = class {
       };
     }
     if (isWithinCwd && !isWithinAllowed) {
-      const relativePath = path6.relative(this.cwd, realPath);
+      const relativePath = path5.relative(this.cwd, realPath);
       if (relativePath === ".openacpignore") {
         return { allowed: true, reason: "" };
       }
@@ -10660,15 +10745,15 @@ var PathGuard = class {
   }
   addAllowedPath(p) {
     try {
-      this.allowedPaths.push(fs6.realpathSync(path6.resolve(p)));
+      this.allowedPaths.push(fs5.realpathSync(path5.resolve(p)));
     } catch {
-      this.allowedPaths.push(path6.resolve(p));
+      this.allowedPaths.push(path5.resolve(p));
     }
   }
   static loadIgnoreFile(cwd) {
-    const ignorePath = path6.join(cwd, ".openacpignore");
+    const ignorePath = path5.join(cwd, ".openacpignore");
     try {
-      const content = fs6.readFileSync(ignorePath, "utf-8");
+      const content = fs5.readFileSync(ignorePath, "utf-8");
       return content.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
     } catch {
       return [];
@@ -10723,7 +10808,8 @@ function filterEnv(processEnv, agentEnv, whitelist) {
 }
 
 // src/core/utils/typed-emitter.ts
-var TypedEmitter = class {
+var TypedEmitter = class _TypedEmitter {
+  static MAX_BUFFER_SIZE = 1e4;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   listeners = /* @__PURE__ */ new Map();
   paused = false;
@@ -10747,6 +10833,10 @@ var TypedEmitter = class {
         this.deliver(event, args);
       } else {
         this.buffer.push({ event, args });
+        if (this.buffer.length > _TypedEmitter.MAX_BUFFER_SIZE) {
+          console.warn(`[TypedEmitter] Buffer exceeded ${_TypedEmitter.MAX_BUFFER_SIZE} events, dropping oldest`);
+          this.buffer.shift();
+        }
       }
       return;
     }
@@ -10791,7 +10881,11 @@ var TypedEmitter = class {
     const set = this.listeners.get(event);
     if (!set) return;
     for (const listener of set) {
-      listener(...args);
+      try {
+        listener(...args);
+      } catch (err) {
+        console.error(`[EventBus] Listener error on "${String(event)}":`, err);
+      }
     }
   }
 };
@@ -10882,6 +10976,11 @@ var TerminalManager = class {
         }, async (p) => p).catch(() => {
         });
       }
+      setTimeout(() => {
+        if (this.terminals.has(terminalId)) {
+          this.terminals.delete(terminalId);
+        }
+      }, 3e4).unref();
     });
     return { terminalId };
   }
@@ -10914,6 +11013,12 @@ var TerminalManager = class {
       state.process.on("exit", (code, signal) => {
         resolve6({ exitCode: code, signal });
       });
+      if (state.exitStatus !== null) {
+        resolve6({
+          exitCode: state.exitStatus.exitCode,
+          signal: state.exitStatus.signal
+        });
+      }
     });
   }
   kill(terminalId) {
@@ -10951,24 +11056,24 @@ var McpManager = class {
 };
 
 // src/core/utils/debug-tracer.ts
-import fs8 from "fs";
-import path7 from "path";
+import fs7 from "fs";
+import path6 from "path";
 var DEBUG_ENABLED = process.env.OPENACP_DEBUG === "true" || process.env.OPENACP_DEBUG === "1";
 var DebugTracer = class {
   constructor(sessionId, workingDirectory) {
     this.sessionId = sessionId;
     this.workingDirectory = workingDirectory;
-    this.logDir = path7.join(workingDirectory, ".log");
+    this.logDir = path6.join(workingDirectory, ".log");
   }
   dirCreated = false;
   logDir;
   log(layer, data) {
     try {
       if (!this.dirCreated) {
-        fs8.mkdirSync(this.logDir, { recursive: true });
+        fs7.mkdirSync(this.logDir, { recursive: true });
         this.dirCreated = true;
       }
-      const filePath = path7.join(this.logDir, `${this.sessionId}_${layer}.jsonl`);
+      const filePath = path6.join(this.logDir, `${this.sessionId}_${layer}.jsonl`);
       const seen = /* @__PURE__ */ new WeakSet();
       const line = JSON.stringify({ ts: Date.now(), ...data }, (_key, value) => {
         if (typeof value === "object" && value !== null) {
@@ -10977,7 +11082,7 @@ var DebugTracer = class {
         }
         return value;
       }) + "\n";
-      fs8.appendFileSync(filePath, line);
+      fs7.appendFileSync(filePath, line);
     } catch {
     }
   }
@@ -10995,11 +11100,11 @@ init_log();
 var log4 = createChildLogger({ module: "agent-instance" });
 function findPackageRoot(startDir) {
   let dir = startDir;
-  while (dir !== path8.dirname(dir)) {
-    if (fs9.existsSync(path8.join(dir, "package.json"))) {
+  while (dir !== path7.dirname(dir)) {
+    if (fs8.existsSync(path7.join(dir, "package.json"))) {
       return dir;
     }
-    dir = path8.dirname(dir);
+    dir = path7.dirname(dir);
   }
   return startDir;
 }
@@ -11011,26 +11116,26 @@ function resolveAgentCommand(cmd) {
   }
   for (const root of searchRoots) {
     const packageDirs = [
-      path8.resolve(root, "node_modules", "@zed-industries", cmd, "dist", "index.js"),
-      path8.resolve(root, "node_modules", cmd, "dist", "index.js")
+      path7.resolve(root, "node_modules", "@zed-industries", cmd, "dist", "index.js"),
+      path7.resolve(root, "node_modules", cmd, "dist", "index.js")
     ];
     for (const jsPath of packageDirs) {
-      if (fs9.existsSync(jsPath)) {
+      if (fs8.existsSync(jsPath)) {
         return { command: process.execPath, args: [jsPath] };
       }
     }
   }
   for (const root of searchRoots) {
-    const localBin = path8.resolve(root, "node_modules", ".bin", cmd);
-    if (fs9.existsSync(localBin)) {
-      const content = fs9.readFileSync(localBin, "utf-8");
+    const localBin = path7.resolve(root, "node_modules", ".bin", cmd);
+    if (fs8.existsSync(localBin)) {
+      const content = fs8.readFileSync(localBin, "utf-8");
       if (content.startsWith("#!/usr/bin/env node")) {
         return { command: process.execPath, args: [localBin] };
       }
       const match = content.match(/"([^"]+\.js)"/);
       if (match) {
-        const target = path8.resolve(path8.dirname(localBin), match[1]);
-        if (fs9.existsSync(target)) {
+        const target = path7.resolve(path7.dirname(localBin), match[1]);
+        if (fs8.existsSync(target)) {
           return { command: process.execPath, args: [target] };
         }
       }
@@ -11039,7 +11144,7 @@ function resolveAgentCommand(cmd) {
   try {
     const fullPath = execFileSync("which", [cmd], { encoding: "utf-8" }).trim();
     if (fullPath) {
-      const content = fs9.readFileSync(fullPath, "utf-8");
+      const content = fs8.readFileSync(fullPath, "utf-8");
       if (content.startsWith("#!/usr/bin/env node")) {
         return { command: process.execPath, args: [fullPath] };
       }
@@ -11471,8 +11576,8 @@ ${stderr}`
           writePath = result.path;
           writeContent = result.content;
         }
-        await fs9.promises.mkdir(path8.dirname(writePath), { recursive: true });
-        await fs9.promises.writeFile(writePath, writeContent, "utf-8");
+        await fs8.promises.mkdir(path7.dirname(writePath), { recursive: true });
+        await fs8.promises.writeFile(writePath, writeContent, "utf-8");
         return {};
       },
       // ── Terminal operations (delegated to TerminalManager) ─────────────
@@ -11574,7 +11679,7 @@ ${stderr}`
 [Attachment access denied: ${attCheck.reason}]`;
           continue;
         }
-        const data = await fs9.promises.readFile(att.filePath);
+        const data = await fs8.promises.readFile(att.filePath);
         contentBlocks.push({ type: "image", data: data.toString("base64"), mimeType: att.mimeType });
       } else if (att.type === "audio" && this.promptCapabilities?.audio && !tooLarge) {
         const attCheck = this.pathGuard.validatePath(att.filePath, "read");
@@ -11584,7 +11689,7 @@ ${stderr}`
 [Attachment access denied: ${attCheck.reason}]`;
           continue;
         }
-        const data = await fs9.promises.readFile(att.filePath);
+        const data = await fs8.promises.readFile(att.filePath);
         contentBlocks.push({ type: "audio", data: data.toString("base64"), mimeType: att.mimeType });
       } else {
         if ((att.type === "image" || att.type === "audio") && !tooLarge) {
@@ -11669,21 +11774,27 @@ var PromptQueue = class {
   queue = [];
   processing = false;
   abortController = null;
-  async enqueue(text3, attachments, routing) {
+  /** Set when abort is triggered; drainNext waits for the current processor to settle before starting the next item. */
+  processorSettled = null;
+  async enqueue(text3, attachments, routing, turnId) {
     if (this.processing) {
       return new Promise((resolve6) => {
-        this.queue.push({ text: text3, attachments, routing, resolve: resolve6 });
+        this.queue.push({ text: text3, attachments, routing, turnId, resolve: resolve6 });
       });
     }
-    await this.process(text3, attachments, routing);
+    await this.process(text3, attachments, routing, turnId);
   }
-  async process(text3, attachments, routing) {
+  async process(text3, attachments, routing, turnId) {
     this.processing = true;
     this.abortController = new AbortController();
     const { signal } = this.abortController;
+    let settledResolve;
+    this.processorSettled = new Promise((r) => {
+      settledResolve = r;
+    });
     try {
       await Promise.race([
-        this.processor(text3, attachments, routing),
+        this.processor(text3, attachments, routing, turnId),
         new Promise((_, reject) => {
           signal.addEventListener("abort", () => reject(new Error("Prompt aborted")), { once: true });
         })
@@ -11695,13 +11806,15 @@ var PromptQueue = class {
     } finally {
       this.abortController = null;
       this.processing = false;
+      settledResolve();
+      this.processorSettled = null;
       this.drainNext();
     }
   }
   drainNext() {
     const next = this.queue.shift();
     if (next) {
-      this.process(next.text, next.attachments, next.routing).then(next.resolve);
+      this.process(next.text, next.attachments, next.routing, next.turnId).then(next.resolve);
     }
   }
   clear() {
@@ -11790,13 +11903,13 @@ var PermissionGate = class {
 
 // src/core/sessions/session.ts
 init_log();
-import * as fs10 from "fs";
+import * as fs9 from "fs";
 
 // src/core/sessions/turn-context.ts
 import { nanoid } from "nanoid";
-function createTurnContext(sourceAdapterId, responseAdapterId) {
+function createTurnContext(sourceAdapterId, responseAdapterId, turnId) {
   return {
-    turnId: nanoid(8),
+    turnId: turnId ?? nanoid(8),
     sourceAdapterId,
     responseAdapterId
   };
@@ -11870,6 +11983,9 @@ var Session = class extends TypedEmitter {
   threadIds = /* @__PURE__ */ new Map();
   /** Active turn context — sealed on prompt dequeue, cleared on turn end */
   activeTurnContext = null;
+  /** The agentInstance for which the agent→session event relay is wired (prevents duplicate relays from multiple bridges).
+   *  When the agent is swapped, the relay must be re-wired to the new instance. */
+  agentRelaySource = null;
   permissionGate = new PermissionGate();
   queue;
   speechService;
@@ -11888,7 +12004,7 @@ var Session = class extends TypedEmitter {
     this.log = createSessionLogger(this.id, moduleLog);
     this.log.info({ agentName: this.agentName }, "Session created");
     this.queue = new PromptQueue(
-      (text3, attachments, routing) => this.processPrompt(text3, attachments, routing),
+      (text3, attachments, routing, turnId) => this.processPrompt(text3, attachments, routing, turnId),
       (err) => {
         this.log.error({ err }, "Prompt execution failed");
         const message = err instanceof Error ? err.message : String(err);
@@ -11963,22 +12079,26 @@ var Session = class extends TypedEmitter {
     this.log.info({ voiceMode: mode }, "TTS mode changed");
   }
   // --- Public API ---
-  async enqueuePrompt(text3, attachments, routing) {
+  async enqueuePrompt(text3, attachments, routing, externalTurnId) {
+    const turnId = externalTurnId ?? nanoid2(8);
     if (this.middlewareChain) {
       const payload = { text: text3, attachments, sessionId: this.id };
       const result = await this.middlewareChain.execute("agent:beforePrompt", payload, async (p) => p);
-      if (!result) return;
+      if (!result) return turnId;
       text3 = result.text;
       attachments = result.attachments;
     }
-    await this.queue.enqueue(text3, attachments, routing);
+    await this.queue.enqueue(text3, attachments, routing, turnId);
+    return turnId;
   }
-  async processPrompt(text3, attachments, routing) {
+  async processPrompt(text3, attachments, routing, turnId) {
     if (this._status === "finished") return;
     this.activeTurnContext = createTurnContext(
       routing?.sourceAdapterId ?? this.channelId,
-      routing?.responseAdapterId
+      routing?.responseAdapterId,
+      turnId
     );
+    this.emit("turn_started", this.activeTurnContext);
     this.promptCount++;
     this.emit("prompt_count_changed", this.promptCount);
     if (this._status === "initializing" || this._status === "cancelled" || this._status === "error") {
@@ -12016,6 +12136,7 @@ ${text3}`;
       });
     }
     let stopReason = "end_turn";
+    let promptError;
     try {
       const response = await this.agentInstance.prompt(processed.text, processed.attachments);
       if (response && typeof response === "object" && "stopReason" in response) {
@@ -12027,14 +12148,21 @@ ${text3}`;
       if (ttsActive && this.voiceMode === "next") {
         this.voiceMode = "off";
       }
+    } catch (err) {
+      stopReason = "error";
+      promptError = err;
     } finally {
       if (accumulatorListener) {
         this.off("agent_event", accumulatorListener);
       }
+      if (this.middlewareChain) {
+        this.middlewareChain.execute("turn:end", { sessionId: this.id, stopReason, durationMs: Date.now() - promptStart }, async (p) => p).catch(() => {
+        });
+      }
+      this.activeTurnContext = null;
     }
-    if (this.middlewareChain) {
-      this.middlewareChain.execute("turn:end", { sessionId: this.id, stopReason, durationMs: Date.now() - promptStart }, async (p) => p).catch(() => {
-      });
+    if (promptError !== void 0) {
+      throw promptError;
     }
     this.log.info(
       { durationMs: Date.now() - promptStart },
@@ -12045,7 +12173,6 @@ ${text3}`;
         this.log.warn({ err }, "TTS post-processing failed");
       });
     }
-    this.activeTurnContext = null;
     if (!this.name) {
       await this.autoName();
     }
@@ -12071,7 +12198,7 @@ ${text3}`;
       try {
         const audioPath = att.originalFilePath || att.filePath;
         const audioMime = att.originalFilePath ? "audio/ogg" : att.mimeType;
-        const audioBuffer = await fs10.promises.readFile(audioPath);
+        const audioBuffer = await fs9.promises.readFile(audioPath);
         const result = await this.speechService.transcribe(audioBuffer, audioMime);
         this.log.info({ provider: "stt", duration: result.duration }, "Voice transcribed");
         this.emit("agent_event", {
@@ -12303,7 +12430,7 @@ ${result.text}` : result.text;
 };
 
 // src/core/message-transformer.ts
-import * as path9 from "path";
+import * as path8 from "path";
 
 // src/core/utils/extract-file-info.ts
 function extractFileInfo(name, kind, content, rawInput, meta) {
@@ -12613,6 +12740,20 @@ var MessageTransformer = class {
         return { type: "text", text: "" };
     }
   }
+  /** Clear cached entries whose key starts with the given prefix. */
+  clearSessionCaches(prefix) {
+    for (const key of this.toolRawInputCache.keys()) {
+      if (key.startsWith(prefix)) this.toolRawInputCache.delete(key);
+    }
+    for (const key of this.toolViewerCache.keys()) {
+      if (key.startsWith(prefix)) this.toolViewerCache.delete(key);
+    }
+  }
+  /** Clear all caches. */
+  clearCaches() {
+    this.toolRawInputCache.clear();
+    this.toolViewerCache.clear();
+  }
   /** Check if rawInput is a non-empty object (not null, not {}) */
   isNonEmptyInput(input2) {
     return input2 !== null && input2 !== void 0 && typeof input2 === "object" && !Array.isArray(input2) && Object.keys(input2).length > 0;
@@ -12661,7 +12802,7 @@ var MessageTransformer = class {
       );
       return;
     }
-    const fileExt = path9.extname(fileInfo.filePath).toLowerCase();
+    const fileExt = path8.extname(fileInfo.filePath).toLowerCase();
     if (BINARY_VIEWER_EXTENSIONS.has(fileExt)) {
       log5.debug({ kind, filePath: fileInfo.filePath }, "enrichWithViewerLinks: skipping binary file");
       return;
@@ -12807,6 +12948,7 @@ var SessionManager = class {
       } catch {
       }
       session.markCancelled();
+      await session.destroy();
       this.sessions.delete(sessionId);
     }
     if (this.store) {
@@ -13008,9 +13150,12 @@ var SessionBridge = class {
   connect() {
     if (this.connected) return;
     this.connected = true;
-    this.listen(this.session.agentInstance, "agent_event", (event) => {
-      this.session.emit("agent_event", event);
-    });
+    if (this.session.agentRelaySource !== this.session.agentInstance) {
+      this.listen(this.session.agentInstance, "agent_event", (event) => {
+        this.session.emit("agent_event", event);
+      });
+      this.session.agentRelaySource = this.session.agentInstance;
+    }
     this.listen(this.session, "agent_event", (event) => {
       if (this.shouldForward(event)) {
         this.dispatchAgentEvent(event);
@@ -13063,6 +13208,16 @@ var SessionBridge = class {
     this.listen(this.session, "prompt_count_changed", (count) => {
       this.deps.sessionManager.patchRecord(this.session.id, { currentPromptCount: count });
     });
+    this.listen(this.session, "turn_started", (ctx) => {
+      if (ctx.sourceAdapterId !== "sse" && ctx.sourceAdapterId !== "api") {
+        this.deps.eventBus?.emit("message:processing", {
+          sessionId: this.session.id,
+          turnId: ctx.turnId,
+          sourceAdapterId: ctx.sourceAdapterId,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+    });
     if (this.session.latestCommands !== null) {
       this.session.emit("agent_event", { type: "commands_update", commands: this.session.latestCommands });
     }
@@ -13079,6 +13234,7 @@ var SessionBridge = class {
     if (current?.__bridgeId === this.adapterId) {
       this.session.agentInstance.onPermissionRequest = async () => "";
     }
+    this.deps.messageTransformer.clearSessionCaches?.(this.session.id);
   }
   /** Dispatch an agent event through middleware and to the adapter */
   async dispatchAgentEvent(event) {
@@ -13161,12 +13317,12 @@ var SessionBridge = class {
         break;
       case "image_content": {
         if (this.deps.fileService) {
-          const fs34 = this.deps.fileService;
+          const fs33 = this.deps.fileService;
           const sid = this.session.id;
           const { data, mimeType } = event;
           const buffer = Buffer.from(data, "base64");
-          const ext = fs34.extensionFromMime(mimeType);
-          fs34.saveFile(sid, `agent-image${ext}`, buffer, mimeType).then((att) => {
+          const ext = fs33.extensionFromMime(mimeType);
+          fs33.saveFile(sid, `agent-image${ext}`, buffer, mimeType).then((att) => {
             this.sendMessage(sid, {
               type: "attachment",
               text: "",
@@ -13178,12 +13334,12 @@ var SessionBridge = class {
       }
       case "audio_content": {
         if (this.deps.fileService) {
-          const fs34 = this.deps.fileService;
+          const fs33 = this.deps.fileService;
           const sid = this.session.id;
           const { data, mimeType } = event;
           const buffer = Buffer.from(data, "base64");
-          const ext = fs34.extensionFromMime(mimeType);
-          fs34.saveFile(sid, `agent-audio${ext}`, buffer, mimeType).then((att) => {
+          const ext = fs33.extensionFromMime(mimeType);
+          fs33.saveFile(sid, `agent-audio${ext}`, buffer, mimeType).then((att) => {
             this.sendMessage(sid, {
               type: "attachment",
               text: "",
@@ -13369,14 +13525,29 @@ var SessionFactory = class {
     }
     let agentInstance;
     try {
-      agentInstance = createParams.resumeAgentSessionId ? await this.agentManager.resume(
-        createParams.agentName,
-        createParams.workingDirectory,
-        createParams.resumeAgentSessionId
-      ) : await this.agentManager.spawn(
-        createParams.agentName,
-        createParams.workingDirectory
-      );
+      if (createParams.resumeAgentSessionId) {
+        try {
+          agentInstance = await this.agentManager.resume(
+            createParams.agentName,
+            createParams.workingDirectory,
+            createParams.resumeAgentSessionId
+          );
+        } catch (resumeErr) {
+          log7.warn(
+            { agentName: createParams.agentName, resumeErr },
+            "Agent session resume failed, falling back to fresh spawn"
+          );
+          agentInstance = await this.agentManager.spawn(
+            createParams.agentName,
+            createParams.workingDirectory
+          );
+        }
+      } else {
+        agentInstance = await this.agentManager.spawn(
+          createParams.agentName,
+          createParams.workingDirectory
+        );
+      }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       const guidanceLines = [
@@ -13405,31 +13576,9 @@ var SessionFactory = class {
         type: "system_message",
         message: guidanceLines.join("\n")
       };
-      const failedSession = new Session({
-        id: createParams.existingSessionId,
-        channelId: createParams.channelId,
-        agentName: createParams.agentName,
-        workingDirectory: createParams.workingDirectory,
-        // Dummy agent instance — will never be prompted
-        agentInstance: {
-          sessionId: "",
-          prompt: async () => {
-          },
-          cancel: async () => {
-          },
-          destroy: async () => {
-          },
-          on: () => {
-          },
-          off: () => {
-          }
-        },
-        speechService: this.speechService
-      });
-      this.sessionManager.registerSession(failedSession);
-      failedSession.emit("agent_event", guidance);
+      const failedSessionId = createParams.existingSessionId ?? `failed-${Date.now()}`;
       this.eventBus.emit("agent:event", {
-        sessionId: failedSession.id,
+        sessionId: failedSessionId,
         event: guidance
       });
       throw err;
@@ -13590,6 +13739,25 @@ var SessionFactory = class {
             session.setAgentCapabilities(record.acpState.agentCapabilities);
           }
         }
+        const resumeFalledBack = record.agentSessionId && session.agentSessionId !== record.agentSessionId;
+        if (resumeFalledBack) {
+          log7.info({ sessionId: session.id }, "Resume fell back to fresh spawn \u2014 injecting conversation history");
+          const contextManager = this.getContextManager?.();
+          if (contextManager) {
+            try {
+              const config = this.configManager?.get();
+              const labelAgent = config?.agentSwitch?.labelHistory ?? true;
+              const contextResult = await contextManager.buildContext(
+                { type: "session", value: record.sessionId, repoPath: record.workingDir },
+                { labelAgent, noCache: true }
+              );
+              if (contextResult?.markdown) {
+                session.setContext(contextResult.markdown);
+              }
+            } catch {
+            }
+          }
+        }
         log7.info({ sessionId: session.id, threadId }, "Lazy resume successful");
         return session;
       } catch (err) {
@@ -13714,13 +13882,14 @@ var SessionFactory = class {
 };
 
 // src/core/core.ts
-import path17 from "path";
+import path16 from "path";
 import os8 from "os";
+import { nanoid as nanoid3 } from "nanoid";
 
 // src/core/sessions/session-store.ts
 init_log();
-import fs11 from "fs";
-import path10 from "path";
+import fs10 from "fs";
+import path9 from "path";
 var log8 = createChildLogger({ module: "session-store" });
 var DEBOUNCE_MS = 2e3;
 var JsonFileSessionStore = class {
@@ -13794,9 +13963,9 @@ var JsonFileSessionStore = class {
       version: 1,
       sessions: Object.fromEntries(this.records)
     };
-    const dir = path10.dirname(this.filePath);
-    if (!fs11.existsSync(dir)) fs11.mkdirSync(dir, { recursive: true });
-    fs11.writeFileSync(this.filePath, JSON.stringify(data, null, 2));
+    const dir = path9.dirname(this.filePath);
+    if (!fs10.existsSync(dir)) fs10.mkdirSync(dir, { recursive: true });
+    fs10.writeFileSync(this.filePath, JSON.stringify(data, null, 2));
   }
   destroy() {
     if (this.debounceTimer) clearTimeout(this.debounceTimer);
@@ -13809,10 +13978,10 @@ var JsonFileSessionStore = class {
     }
   }
   load() {
-    if (!fs11.existsSync(this.filePath)) return;
+    if (!fs10.existsSync(this.filePath)) return;
     try {
       const raw = JSON.parse(
-        fs11.readFileSync(this.filePath, "utf-8")
+        fs10.readFileSync(this.filePath, "utf-8")
       );
       if (raw.version !== 1) {
         log8.warn(
@@ -13828,7 +13997,7 @@ var JsonFileSessionStore = class {
     } catch (err) {
       log8.error({ err }, "Failed to load session store, backing up corrupt file");
       try {
-        fs11.renameSync(this.filePath, `${this.filePath}.bak`);
+        fs10.renameSync(this.filePath, `${this.filePath}.bak`);
       } catch {
       }
     }
@@ -13852,7 +14021,10 @@ var JsonFileSessionStore = class {
     for (const [id, record] of this.records) {
       if (record.status === "active" || record.status === "initializing")
         continue;
-      const lastActive = new Date(record.lastActiveAt).getTime();
+      const raw = record.lastActiveAt;
+      if (!raw) continue;
+      const lastActive = new Date(raw).getTime();
+      if (isNaN(lastActive)) continue;
       if (lastActive < cutoff) {
         this.records.delete(id);
         removed++;
@@ -13910,8 +14082,8 @@ var AgentSwitchHandler = class {
     if (middlewareChain && !result) throw new Error("Agent switch blocked by middleware");
     const lastEntry = session.findLastSwitchEntry(toAgent);
     const caps = getAgentCapabilities(toAgent);
-    const canResume = !!(lastEntry && caps.supportsResume && lastEntry.promptCount === 0);
-    const resumed = canResume;
+    const canResume = !!(lastEntry && caps.supportsResume);
+    let resumed = false;
     const startEvent = {
       type: "system_message",
       message: `Switching from ${fromAgent} to ${toAgent}...`
@@ -13945,29 +14117,34 @@ var AgentSwitchHandler = class {
     try {
       await session.switchAgent(toAgent, async () => {
         if (canResume) {
-          const instance = await agentManager.resume(toAgent, session.workingDirectory, lastEntry.agentSessionId);
-          if (fileService) instance.addAllowedPath(fileService.baseDir);
-          return instance;
-        } else {
-          const instance = await agentManager.spawn(toAgent, session.workingDirectory);
-          if (fileService) instance.addAllowedPath(fileService.baseDir);
           try {
-            const contextService = this.deps.getService("context");
-            if (contextService) {
-              const config = configManager.get();
-              const labelAgent = config.agentSwitch?.labelHistory ?? true;
-              const contextResult = await contextService.buildContext(
-                { type: "session", value: sessionId, repoPath: session.workingDirectory },
-                { labelAgent }
-              );
-              if (contextResult?.markdown) {
-                session.setContext(contextResult.markdown);
-              }
-            }
+            const instance2 = await agentManager.resume(toAgent, session.workingDirectory, lastEntry.agentSessionId);
+            if (fileService) instance2.addAllowedPath(fileService.baseDir);
+            resumed = true;
+            return instance2;
           } catch {
+            log9.warn({ sessionId, toAgent }, "Resume failed, falling back to new agent with context injection");
+          }
+        }
+        const instance = await agentManager.spawn(toAgent, session.workingDirectory);
+        if (fileService) instance.addAllowedPath(fileService.baseDir);
+        try {
+          const contextService = this.deps.getService("context");
+          if (contextService) {
+            const config = configManager.get();
+            const labelAgent = config.agentSwitch?.labelHistory ?? true;
+            await contextService.flushSession(sessionId);
+            const contextResult = await contextService.buildContext(
+              { type: "session", value: sessionId, repoPath: session.workingDirectory },
+              { labelAgent, noCache: true }
+            );
+            if (contextResult?.markdown) {
+              session.setContext(contextResult.markdown);
+            }
           }
-          return instance;
+        } catch {
         }
+        return instance;
       });
       const successEvent = {
         type: "system_message",
@@ -14051,14 +14228,14 @@ var AgentSwitchHandler = class {
 };
 
 // src/core/agents/agent-catalog.ts
-import * as fs15 from "fs";
-import * as path14 from "path";
+import * as fs14 from "fs";
+import * as path13 from "path";
 import * as os6 from "os";
 
 // src/core/agents/agent-store.ts
 init_log();
-import * as fs13 from "fs";
-import * as path12 from "path";
+import * as fs12 from "fs";
+import * as path11 from "path";
 import * as os4 from "os";
 import { z as z2 } from "zod";
 var log10 = createChildLogger({ module: "agent-store" });
@@ -14082,15 +14259,15 @@ var AgentStore = class {
   data = { version: 1, installed: {} };
   filePath;
   constructor(filePath) {
-    this.filePath = filePath ?? path12.join(os4.homedir(), ".openacp", "agents.json");
+    this.filePath = filePath ?? path11.join(os4.homedir(), ".openacp", "agents.json");
   }
   load() {
-    if (!fs13.existsSync(this.filePath)) {
+    if (!fs12.existsSync(this.filePath)) {
       this.data = { version: 1, installed: {} };
       return;
     }
     try {
-      const raw = JSON.parse(fs13.readFileSync(this.filePath, "utf-8"));
+      const raw = JSON.parse(fs12.readFileSync(this.filePath, "utf-8"));
       const result = AgentStoreSchema.safeParse(raw);
       if (result.success) {
         this.data = result.data;
@@ -14104,7 +14281,7 @@ var AgentStore = class {
     }
   }
   exists() {
-    return fs13.existsSync(this.filePath);
+    return fs12.existsSync(this.filePath);
   }
   getInstalled() {
     return this.data.installed;
@@ -14124,10 +14301,10 @@ var AgentStore = class {
     return key in this.data.installed;
   }
   save() {
-    fs13.mkdirSync(path12.dirname(this.filePath), { recursive: true });
+    fs12.mkdirSync(path11.dirname(this.filePath), { recursive: true });
     const tmpPath = this.filePath + ".tmp";
-    fs13.writeFileSync(tmpPath, JSON.stringify(this.data, null, 2), { mode: 384 });
-    fs13.renameSync(tmpPath, this.filePath);
+    fs12.writeFileSync(tmpPath, JSON.stringify(this.data, null, 2), { mode: 384 });
+    fs12.renameSync(tmpPath, this.filePath);
   }
 };
 
@@ -14145,7 +14322,7 @@ var AgentCatalog = class {
   agentsDir;
   constructor(store, cachePath, agentsDir) {
     this.store = store ?? new AgentStore();
-    this.cachePath = cachePath ?? path14.join(os6.homedir(), ".openacp", "registry-cache.json");
+    this.cachePath = cachePath ?? path13.join(os6.homedir(), ".openacp", "registry-cache.json");
     this.agentsDir = agentsDir;
   }
   load() {
@@ -14166,8 +14343,8 @@ var AgentCatalog = class {
         ttlHours: DEFAULT_TTL_HOURS,
         data
       };
-      fs15.mkdirSync(path14.dirname(this.cachePath), { recursive: true });
-      fs15.writeFileSync(this.cachePath, JSON.stringify(cache, null, 2), { mode: 384 });
+      fs14.mkdirSync(path13.dirname(this.cachePath), { recursive: true });
+      fs14.writeFileSync(this.cachePath, JSON.stringify(cache, null, 2), { mode: 384 });
       log12.info({ count: this.registryAgents.length }, "Registry updated");
     } catch (err) {
       log12.warn({ err }, "Failed to fetch registry, using cached data");
@@ -14335,9 +14512,9 @@ var AgentCatalog = class {
     }
   }
   isCacheStale() {
-    if (!fs15.existsSync(this.cachePath)) return true;
+    if (!fs14.existsSync(this.cachePath)) return true;
     try {
-      const raw = JSON.parse(fs15.readFileSync(this.cachePath, "utf-8"));
+      const raw = JSON.parse(fs14.readFileSync(this.cachePath, "utf-8"));
       const fetchedAt = new Date(raw.fetchedAt).getTime();
       const ttlMs = (raw.ttlHours ?? DEFAULT_TTL_HOURS) * 60 * 60 * 1e3;
       return Date.now() - fetchedAt > ttlMs;
@@ -14346,9 +14523,9 @@ var AgentCatalog = class {
     }
   }
   loadRegistryFromCacheOrSnapshot() {
-    if (fs15.existsSync(this.cachePath)) {
+    if (fs14.existsSync(this.cachePath)) {
       try {
-        const raw = JSON.parse(fs15.readFileSync(this.cachePath, "utf-8"));
+        const raw = JSON.parse(fs14.readFileSync(this.cachePath, "utf-8"));
         if (raw.data?.agents) {
           this.registryAgents = raw.data.agents;
           log12.debug({ count: this.registryAgents.length }, "Loaded registry from cache");
@@ -14360,13 +14537,13 @@ var AgentCatalog = class {
     }
     try {
       const candidates = [
-        path14.join(import.meta.dirname, "data", "registry-snapshot.json"),
-        path14.join(import.meta.dirname, "..", "data", "registry-snapshot.json"),
-        path14.join(import.meta.dirname, "..", "..", "data", "registry-snapshot.json")
+        path13.join(import.meta.dirname, "data", "registry-snapshot.json"),
+        path13.join(import.meta.dirname, "..", "data", "registry-snapshot.json"),
+        path13.join(import.meta.dirname, "..", "..", "data", "registry-snapshot.json")
       ];
       for (const candidate of candidates) {
-        if (fs15.existsSync(candidate)) {
-          const raw = JSON.parse(fs15.readFileSync(candidate, "utf-8"));
+        if (fs14.existsSync(candidate)) {
+          const raw = JSON.parse(fs14.readFileSync(candidate, "utf-8"));
           this.registryAgents = raw.agents ?? [];
           log12.debug({ count: this.registryAgents.length }, "Loaded registry from bundled snapshot");
           return;
@@ -14627,31 +14804,31 @@ var ErrorTracker = class {
 };
 
 // src/core/plugin/plugin-context.ts
-import path16 from "path";
+import path15 from "path";
 import os7 from "os";
 
 // src/core/plugin/plugin-storage.ts
-import fs16 from "fs";
-import path15 from "path";
+import fs15 from "fs";
+import path14 from "path";
 var PluginStorageImpl = class {
   kvPath;
   dataDir;
   writeChain = Promise.resolve();
   constructor(baseDir) {
-    this.dataDir = path15.join(baseDir, "data");
-    this.kvPath = path15.join(baseDir, "kv.json");
-    fs16.mkdirSync(baseDir, { recursive: true });
+    this.dataDir = path14.join(baseDir, "data");
+    this.kvPath = path14.join(baseDir, "kv.json");
+    fs15.mkdirSync(baseDir, { recursive: true });
   }
   readKv() {
     try {
-      const raw = fs16.readFileSync(this.kvPath, "utf-8");
+      const raw = fs15.readFileSync(this.kvPath, "utf-8");
       return JSON.parse(raw);
     } catch {
       return {};
     }
   }
   writeKv(data) {
-    fs16.writeFileSync(this.kvPath, JSON.stringify(data), "utf-8");
+    fs15.writeFileSync(this.kvPath, JSON.stringify(data), "utf-8");
   }
   async get(key) {
     const data = this.readKv();
@@ -14677,7 +14854,7 @@ var PluginStorageImpl = class {
     return Object.keys(this.readKv());
   }
   getDataDir() {
-    fs16.mkdirSync(this.dataDir, { recursive: true });
+    fs15.mkdirSync(this.dataDir, { recursive: true });
     return this.dataDir;
   }
 };
@@ -14701,9 +14878,11 @@ function createPluginContext(opts) {
     config,
     core
   } = opts;
-  const instanceRoot = opts.instanceRoot ?? path16.join(os7.homedir(), ".openacp");
+  const instanceRoot = opts.instanceRoot ?? path15.join(os7.homedir(), ".openacp");
   const registeredListeners = [];
   const registeredCommands = [];
+  const registeredMenuItemIds = [];
+  const registeredAssistantSectionIds = [];
   const noopLog = {
     trace() {
     },
@@ -14798,7 +14977,9 @@ function createPluginContext(opts) {
       requirePermission(permissions, "commands:register", "registerMenuItem()");
       const menuRegistry = serviceRegistry.get("menu-registry");
       if (!menuRegistry) return;
-      menuRegistry.register({ ...item, id: `${pluginName}:${item.id}` });
+      const qualifiedId = `${pluginName}:${item.id}`;
+      menuRegistry.register({ ...item, id: qualifiedId });
+      registeredMenuItemIds.push(qualifiedId);
     },
     unregisterMenuItem(id) {
       requirePermission(permissions, "commands:register", "unregisterMenuItem()");
@@ -14810,7 +14991,9 @@ function createPluginContext(opts) {
       requirePermission(permissions, "commands:register", "registerAssistantSection()");
       const assistantRegistry = serviceRegistry.get("assistant-registry");
       if (!assistantRegistry) return;
-      assistantRegistry.register({ ...section, id: `${pluginName}:${section.id}` });
+      const qualifiedId = `${pluginName}:${section.id}`;
+      assistantRegistry.register({ ...section, id: qualifiedId });
+      registeredAssistantSectionIds.push(qualifiedId);
     },
     unregisterAssistantSection(id) {
       requirePermission(permissions, "commands:register", "unregisterAssistantSection()");
@@ -14818,6 +15001,14 @@ function createPluginContext(opts) {
       if (!assistantRegistry) return;
       assistantRegistry.unregister(`${pluginName}:${id}`);
     },
+    registerEditableFields(fields) {
+      requirePermission(permissions, "commands:register", "registerEditableFields()");
+      const registry = serviceRegistry.get("field-registry");
+      if (registry && typeof registry.register === "function") {
+        registry.register(pluginName, fields);
+        log34.debug(`Registered ${fields.length} editable field(s) for ${pluginName}`);
+      }
+    },
     get sessions() {
       requirePermission(permissions, "kernel:access", "sessions");
       return sessions;
@@ -14846,6 +15037,20 @@ function createPluginContext(opts) {
       if (cmdRegistry && typeof cmdRegistry.unregisterByPlugin === "function") {
         cmdRegistry.unregisterByPlugin(pluginName);
       }
+      const menuRegistry = serviceRegistry.get("menu-registry");
+      if (menuRegistry) {
+        for (const id of registeredMenuItemIds) {
+          menuRegistry.unregister(id);
+        }
+      }
+      registeredMenuItemIds.length = 0;
+      const assistantRegistry = serviceRegistry.get("assistant-registry");
+      if (assistantRegistry) {
+        for (const id of registeredAssistantSectionIds) {
+          assistantRegistry.unregister(id);
+        }
+      }
+      registeredAssistantSectionIds.length = 0;
       registeredCommands.length = 0;
     }
   };
@@ -14880,11 +15085,8 @@ function resolvePluginConfig(pluginName, configManager) {
       "@openacp/file-service": "files",
       "@openacp/api-server": "api",
       "@openacp/telegram": "channels.telegram",
-      "@openacp/discord": "channels.discord",
-      "@openacp/adapter-discord": "channels.discord",
-      "@openacp/plugin-discord": "channels.discord",
-      // alias for old name
-      "@openacp/slack": "channels.slack"
+      "@openacp/discord-adapter": "channels.discord",
+      "@openacp/slack-adapter": "channels.slack"
     };
     const legacyKey = legacyMap[pluginName];
     if (legacyKey) {
@@ -15369,8 +15571,10 @@ function createConfigSection(core) {
     priority: 30,
     buildContext: () => {
       const config = core.configManager.get();
+      const speechSvc = core.lifecycleManager?.serviceRegistry.get("speech");
+      const sttActive = speechSvc ? speechSvc.isSTTAvailable() : false;
       return `Workspace base: ${config.workspace.baseDir}
-STT: ${config.speech?.stt?.provider ? `${config.speech.stt.provider} \u2705` : "Not configured"}`;
+STT: ${sttActive ? "configured \u2705" : "Not configured"}`;
     },
     commands: [
       { command: "openacp config", description: "View config" },
@@ -15531,7 +15735,7 @@ var OpenACPCore = class {
     );
     this.agentCatalog.load();
     this.agentManager = new AgentManager(this.agentCatalog);
-    const storePath = ctx?.paths.sessions ?? path17.join(os8.homedir(), ".openacp", "sessions.json");
+    const storePath = ctx?.paths.sessions ?? path16.join(os8.homedir(), ".openacp", "sessions.json");
     this.sessionStore = new JsonFileSessionStore(
       storePath,
       config.sessionStore.ttlDays
@@ -15555,7 +15759,7 @@ var OpenACPCore = class {
       sessions: this.sessionManager,
       config: this.configManager,
       core: this,
-      storagePath: ctx?.paths.pluginsData ?? path17.join(os8.homedir(), ".openacp", "plugins", "data"),
+      storagePath: ctx?.paths.pluginsData ?? path16.join(os8.homedir(), ".openacp", "plugins", "data"),
       instanceRoot: ctx?.root,
       log: createChildLogger({ module: "plugin" })
     });
@@ -15621,7 +15825,7 @@ var OpenACPCore = class {
     );
     registerCoreMenuItems(this.menuRegistry);
     if (ctx?.root) {
-      this.assistantRegistry.setInstanceRoot(path17.dirname(ctx.root));
+      this.assistantRegistry.setInstanceRoot(path16.dirname(ctx.root));
     }
     this.assistantRegistry.register(createSessionsSection(this));
     this.assistantRegistry.register(createAgentsSection(this));
@@ -15759,7 +15963,22 @@ User message:
 ${text3}`;
       }
     }
-    await session.enqueuePrompt(text3, message.attachments, message.routing);
+    const sourceAdapterId = message.routing?.sourceAdapterId ?? message.channelId;
+    if (sourceAdapterId && sourceAdapterId !== "sse" && sourceAdapterId !== "api") {
+      const turnId = nanoid3(8);
+      this.eventBus.emit("message:queued", {
+        sessionId: session.id,
+        turnId,
+        text: text3,
+        sourceAdapterId,
+        attachments: message.attachments,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        queueDepth: session.queueDepth
+      });
+      await session.enqueuePrompt(text3, message.attachments, message.routing, turnId);
+    } else {
+      await session.enqueuePrompt(text3, message.attachments, message.routing);
+    }
   }
   // --- Unified Session Creation Pipeline ---
   async createSession(params) {
@@ -15873,15 +16092,15 @@ ${text3}`;
         message: `Agent '${agentName}' not found`
       };
     }
-    const { existsSync: existsSync20 } = await import("fs");
-    if (!existsSync20(cwd)) {
+    const { existsSync: existsSync19 } = await import("fs");
+    if (!existsSync19(cwd)) {
       return {
         ok: false,
         error: "invalid_cwd",
         message: `Directory does not exist: ${cwd}`
       };
     }
-    const maxSessions = this.configManager.get().security.maxConcurrentSessions;
+    const maxSessions = 20;
     if (this.sessionManager.listSessions().length >= maxSessions) {
       return {
         ok: false,
@@ -16138,7 +16357,9 @@ var CommandRegistry = class _CommandRegistry {
     this.commands.delete(name);
     if (cmd.scope) {
       this.commands.delete(`${cmd.scope}:${cmd.name}`);
-      this.commands.delete(cmd.name);
+      if (this.commands.get(cmd.name) === cmd) {
+        this.commands.delete(cmd.name);
+      }
     }
   }
   /** Remove all commands registered by a given plugin. */
@@ -16218,19 +16439,19 @@ init_doctor();
 init_config_registry();
 
 // src/core/config/config-editor.ts
-import * as path29 from "path";
+import * as path28 from "path";
 import * as clack2 from "@clack/prompts";
 
 // src/cli/autostart.ts
 init_log();
-import { execFileSync as execFileSync5 } from "child_process";
-import * as fs27 from "fs";
-import * as path25 from "path";
+import { execFileSync as execFileSync6 } from "child_process";
+import * as fs26 from "fs";
+import * as path24 from "path";
 import * as os11 from "os";
 var log18 = createChildLogger({ module: "autostart" });
 var LAUNCHD_LABEL = "com.openacp.daemon";
-var LAUNCHD_PLIST_PATH = path25.join(os11.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
-var SYSTEMD_SERVICE_PATH = path25.join(os11.homedir(), ".config", "systemd", "user", "openacp.service");
+var LAUNCHD_PLIST_PATH = path24.join(os11.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+var SYSTEMD_SERVICE_PATH = path24.join(os11.homedir(), ".config", "systemd", "user", "openacp.service");
 function isAutoStartSupported() {
   return process.platform === "darwin" || process.platform === "linux";
 }
@@ -16242,7 +16463,7 @@ function escapeSystemdValue(str) {
   return `"${escaped}"`;
 }
 function generateLaunchdPlist(nodePath, cliPath, logDir2) {
-  const logFile = path25.join(logDir2, "openacp.log");
+  const logFile = path24.join(logDir2, "openacp.log");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -16287,25 +16508,25 @@ function installAutoStart(logDir2) {
     return { success: false, error: "Auto-start not supported on this platform" };
   }
   const nodePath = process.execPath;
-  const cliPath = path25.resolve(process.argv[1]);
-  const resolvedLogDir = logDir2.startsWith("~") ? path25.join(os11.homedir(), logDir2.slice(1)) : logDir2;
+  const cliPath = path24.resolve(process.argv[1]);
+  const resolvedLogDir = logDir2.startsWith("~") ? path24.join(os11.homedir(), logDir2.slice(1)) : logDir2;
   try {
     if (process.platform === "darwin") {
       const plist = generateLaunchdPlist(nodePath, cliPath, resolvedLogDir);
-      const dir = path25.dirname(LAUNCHD_PLIST_PATH);
-      fs27.mkdirSync(dir, { recursive: true });
-      fs27.writeFileSync(LAUNCHD_PLIST_PATH, plist);
-      execFileSync5("launchctl", ["load", LAUNCHD_PLIST_PATH], { stdio: "pipe" });
+      const dir = path24.dirname(LAUNCHD_PLIST_PATH);
+      fs26.mkdirSync(dir, { recursive: true });
+      fs26.writeFileSync(LAUNCHD_PLIST_PATH, plist);
+      execFileSync6("launchctl", ["load", LAUNCHD_PLIST_PATH], { stdio: "pipe" });
       log18.info("LaunchAgent installed");
       return { success: true };
     }
     if (process.platform === "linux") {
       const unit = generateSystemdUnit(nodePath, cliPath);
-      const dir = path25.dirname(SYSTEMD_SERVICE_PATH);
-      fs27.mkdirSync(dir, { recursive: true });
-      fs27.writeFileSync(SYSTEMD_SERVICE_PATH, unit);
-      execFileSync5("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
-      execFileSync5("systemctl", ["--user", "enable", "openacp"], { stdio: "pipe" });
+      const dir = path24.dirname(SYSTEMD_SERVICE_PATH);
+      fs26.mkdirSync(dir, { recursive: true });
+      fs26.writeFileSync(SYSTEMD_SERVICE_PATH, unit);
+      execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+      execFileSync6("systemctl", ["--user", "enable", "openacp"], { stdio: "pipe" });
       log18.info("systemd user service installed");
       return { success: true };
     }
@@ -16322,24 +16543,24 @@ function uninstallAutoStart() {
   }
   try {
     if (process.platform === "darwin") {
-      if (fs27.existsSync(LAUNCHD_PLIST_PATH)) {
+      if (fs26.existsSync(LAUNCHD_PLIST_PATH)) {
         try {
-          execFileSync5("launchctl", ["unload", LAUNCHD_PLIST_PATH], { stdio: "pipe" });
+          execFileSync6("launchctl", ["unload", LAUNCHD_PLIST_PATH], { stdio: "pipe" });
         } catch {
         }
-        fs27.unlinkSync(LAUNCHD_PLIST_PATH);
+        fs26.unlinkSync(LAUNCHD_PLIST_PATH);
         log18.info("LaunchAgent removed");
       }
       return { success: true };
     }
     if (process.platform === "linux") {
-      if (fs27.existsSync(SYSTEMD_SERVICE_PATH)) {
+      if (fs26.existsSync(SYSTEMD_SERVICE_PATH)) {
         try {
-          execFileSync5("systemctl", ["--user", "disable", "openacp"], { stdio: "pipe" });
+          execFileSync6("systemctl", ["--user", "disable", "openacp"], { stdio: "pipe" });
         } catch {
         }
-        fs27.unlinkSync(SYSTEMD_SERVICE_PATH);
-        execFileSync5("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+        fs26.unlinkSync(SYSTEMD_SERVICE_PATH);
+        execFileSync6("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
         log18.info("systemd user service removed");
       }
       return { success: true };
@@ -16353,10 +16574,10 @@ function uninstallAutoStart() {
 }
 function isAutoStartInstalled() {
   if (process.platform === "darwin") {
-    return fs27.existsSync(LAUNCHD_PLIST_PATH);
+    return fs26.existsSync(LAUNCHD_PLIST_PATH);
   }
   if (process.platform === "linux") {
-    return fs27.existsSync(SYSTEMD_SERVICE_PATH);
+    return fs26.existsSync(SYSTEMD_SERVICE_PATH);
   }
   return false;
 }
@@ -16407,42 +16628,19 @@ var header = (title) => `
 ${c.cyan}${c.bold}[${title}]${c.reset}
 `;
 async function editTelegram(config, updates, settingsManager) {
-  const tg = config.channels?.telegram ?? {};
-  let currentToken = tg.botToken ?? "";
-  let currentChatId = tg.chatId ?? 0;
-  let currentEnabled = tg.enabled ?? false;
-  if (settingsManager) {
-    const ps = await settingsManager.loadSettings("@openacp/telegram");
-    if (Object.keys(ps).length > 0) {
-      currentToken = ps.botToken ?? currentToken;
-      currentChatId = ps.chatId ?? currentChatId;
-      currentEnabled = ps.enabled ?? currentEnabled;
-    }
-  }
+  const ps = settingsManager ? await settingsManager.loadSettings("@openacp/telegram") : {};
+  const currentToken = ps.botToken ?? "";
+  const currentChatId = ps.chatId ?? 0;
+  const currentEnabled = ps.enabled ?? false;
   console.log(header("Telegram"));
-  console.log(`  Enabled   : ${currentEnabled ? ok("yes") : dim("no")}`);
   const tokenDisplay = currentToken.length > 12 ? currentToken.slice(0, 6) + "..." + currentToken.slice(-6) : currentToken || dim("(not set)");
+  console.log(`  Enabled   : ${currentEnabled ? ok("yes") : dim("no")}`);
   console.log(`  Bot Token : ${tokenDisplay}`);
   console.log(`  Chat ID   : ${currentChatId || dim("(not set)")}`);
   console.log("");
-  const ensureTelegramUpdates = () => {
-    if (!updates.channels) updates.channels = {};
-    if (!updates.channels.telegram) {
-      updates.channels.telegram = {};
-    }
-    return updates.channels.telegram;
-  };
   while (true) {
-    const isEnabled = await (async () => {
-      if (settingsManager) {
-        const ps = await settingsManager.loadSettings("@openacp/telegram");
-        if ("enabled" in ps) return ps.enabled;
-      }
-      const ch = updates.channels;
-      const tgUp = ch?.telegram;
-      if (tgUp && "enabled" in tgUp) return tgUp.enabled;
-      return currentEnabled;
-    })();
+    const freshSettings = settingsManager ? await settingsManager.loadSettings("@openacp/telegram") : ps;
+    const isEnabled = freshSettings.enabled ?? currentEnabled;
     const choice = await select3({
       message: "Telegram settings:",
       choices: [
@@ -16456,75 +16654,32 @@ async function editTelegram(config, updates, settingsManager) {
     if (choice === "toggle") {
       if (settingsManager) {
         await settingsManager.updatePluginSettings("@openacp/telegram", { enabled: !isEnabled });
-      } else {
-        const tgUp = ensureTelegramUpdates();
-        tgUp.enabled = !isEnabled;
+        console.log(!isEnabled ? ok("Telegram enabled") : ok("Telegram disabled"));
       }
-      console.log(!isEnabled ? ok("Telegram enabled") : ok("Telegram disabled"));
     }
     if (choice === "token") {
       const token = await input({
         message: "New bot token:",
-        default: currentToken,
         validate: (val) => val.trim().length > 0 || "Token cannot be empty"
       });
-      try {
-        const { validateBotToken: validateBotToken2 } = await Promise.resolve().then(() => (init_validators(), validators_exports));
-        const result = await validateBotToken2(token.trim());
-        if (result.ok) {
-          console.log(ok(`Connected to @${result.botUsername}`));
-        } else {
-          console.log(warn(`Validation failed: ${result.error} \u2014 saving anyway`));
-        }
-      } catch {
-        console.log(warn("Telegram validator not available \u2014 skipping validation"));
-      }
       if (settingsManager) {
-        await settingsManager.updatePluginSettings("@openacp/telegram", { botToken: token.trim(), enabled: true });
-      } else {
-        const tgUp = ensureTelegramUpdates();
-        tgUp.botToken = token.trim();
-        tgUp.enabled = true;
+        await settingsManager.updatePluginSettings("@openacp/telegram", { botToken: token.trim() });
+        console.log(ok("Bot token updated"));
       }
     }
     if (choice === "chatid") {
-      const chatIdStr = await input({
-        message: "New chat ID (e.g. -1001234567890):",
-        default: String(currentChatId),
-        validate: (val) => {
-          const n = Number(val.trim());
-          if (isNaN(n) || !Number.isInteger(n)) return "Chat ID must be an integer";
-          return true;
-        }
+      const chatId = await input({
+        message: "New chat ID:",
+        validate: (val) => !isNaN(Number(val.trim())) || "Must be a number"
       });
-      const chatId = Number(chatIdStr.trim());
-      const tokenForValidation = (() => {
-        const ch = updates.channels;
-        const tgUp = ch?.telegram;
-        if (typeof tgUp?.botToken === "string") return tgUp.botToken;
-        return currentToken;
-      })();
-      try {
-        const { validateChatId: validateChatId2 } = await Promise.resolve().then(() => (init_validators(), validators_exports));
-        const result = await validateChatId2(tokenForValidation, chatId);
-        if (result.ok) {
-          console.log(ok(`Group: ${result.title}${result.isForum ? "" : warn(" (topics not enabled)")}`));
-        } else {
-          console.log(warn(`Validation failed: ${result.error} \u2014 saving anyway`));
-        }
-      } catch {
-        console.log(warn("Telegram validator not available \u2014 skipping validation"));
-      }
       if (settingsManager) {
-        await settingsManager.updatePluginSettings("@openacp/telegram", { chatId });
-      } else {
-        const tgUp = ensureTelegramUpdates();
-        tgUp.chatId = chatId;
+        await settingsManager.updatePluginSettings("@openacp/telegram", { chatId: Number(chatId.trim()) });
+        console.log(ok(`Chat ID set to ${chatId.trim()}`));
       }
     }
   }
 }
-var DISCORD_PACKAGE = "@openacp/adapter-discord";
+var DISCORD_PACKAGE = "@openacp/discord-adapter";
 async function ensureDiscordPlugin() {
   try {
     return await import(DISCORD_PACKAGE);
@@ -16561,7 +16716,7 @@ async function editDiscord(_config, _updates) {
     const { createInstallContext: createInstallContext2 } = await Promise.resolve().then(() => (init_install_context(), install_context_exports));
     const { getGlobalRoot: getGlobalRoot2 } = await Promise.resolve().then(() => (init_instance_context(), instance_context_exports));
     const root = getGlobalRoot2();
-    const basePath = path29.join(root, "plugins", "data");
+    const basePath = path28.join(root, "plugins", "data");
     const settingsManager = new SettingsManager2(basePath);
     const ctx = createInstallContext2({
       pluginName: plugin.name,
@@ -16575,12 +16730,12 @@ async function editDiscord(_config, _updates) {
   }
 }
 async function editChannels(config, updates, settingsManager) {
-  let tgConfigured = !!config.channels?.telegram;
-  let dcConfigured = !!config.channels?.discord;
+  let tgConfigured = false;
+  let dcConfigured = false;
   if (settingsManager) {
     const tgPs = await settingsManager.loadSettings("@openacp/telegram");
     if (tgPs.botToken && tgPs.chatId) tgConfigured = true;
-    const dcPs = await settingsManager.loadSettings("@openacp/adapter-discord");
+    const dcPs = await settingsManager.loadSettings("@openacp/discord-adapter");
     if (dcPs.guildId || dcPs.token) dcConfigured = true;
   }
   console.log(header("Channels"));
@@ -16602,7 +16757,7 @@ async function editChannels(config, updates, settingsManager) {
   }
 }
 async function editAgent(config, updates) {
-  const agentNames = Object.keys(config.agents ?? {});
+  const agentNames = [];
   const currentDefault = config.defaultAgent;
   console.log(header("Agent"));
   console.log(`  Default agent : ${c.bold}${currentDefault}${c.reset}`);
@@ -16645,17 +16800,12 @@ async function editWorkspace(config, updates) {
   console.log(ok(`Workspace set to ${newDir.trim()}`));
 }
 async function editSecurity(config, updates, settingsManager) {
-  let sec = config.security ?? { allowedUserIds: [], maxConcurrentSessions: 20, sessionTimeoutMinutes: 60 };
-  if (settingsManager) {
-    const ps = await settingsManager.loadSettings("@openacp/security");
-    if (Object.keys(ps).length > 0) {
-      sec = {
-        allowedUserIds: ps.allowedUserIds ?? sec.allowedUserIds,
-        maxConcurrentSessions: ps.maxConcurrentSessions ?? sec.maxConcurrentSessions,
-        sessionTimeoutMinutes: ps.sessionTimeoutMinutes ?? sec.sessionTimeoutMinutes
-      };
-    }
-  }
+  const ps = settingsManager ? await settingsManager.loadSettings("@openacp/security") : {};
+  const sec = {
+    allowedUserIds: ps.allowedUserIds ?? [],
+    maxConcurrentSessions: ps.maxConcurrentSessions ?? 20,
+    sessionTimeoutMinutes: ps.sessionTimeoutMinutes ?? 60
+  };
   console.log(header("Security"));
   console.log(`  Allowed user IDs        : ${sec.allowedUserIds?.length ? sec.allowedUserIds.join(", ") : dim("(all users allowed)")}`);
   console.log(`  Max concurrent sessions : ${sec.maxConcurrentSessions}`);
@@ -16683,9 +16833,6 @@ async function editSecurity(config, updates, settingsManager) {
       });
       if (settingsManager) {
         await settingsManager.updatePluginSettings("@openacp/security", { maxConcurrentSessions: Number(val.trim()) });
-      } else {
-        if (!updates.security) updates.security = {};
-        updates.security.maxConcurrentSessions = Number(val.trim());
       }
       console.log(ok(`Max concurrent sessions set to ${val.trim()}`));
     }
@@ -16701,9 +16848,6 @@ async function editSecurity(config, updates, settingsManager) {
       });
       if (settingsManager) {
         await settingsManager.updatePluginSettings("@openacp/security", { sessionTimeoutMinutes: Number(val.trim()) });
-      } else {
-        if (!updates.security) updates.security = {};
-        updates.security.sessionTimeoutMinutes = Number(val.trim());
       }
       console.log(ok(`Session timeout set to ${val.trim()} minutes`));
     }
@@ -16830,20 +16974,16 @@ async function editRunMode(config, updates) {
   }
 }
 async function editApi(config, updates, settingsManager) {
-  let api = config.api ?? { port: 21420, host: "127.0.0.1" };
-  if (settingsManager) {
-    const ps = await settingsManager.loadSettings("@openacp/api-server");
-    if (Object.keys(ps).length > 0) {
-      api = { port: ps.port ?? api.port, host: ps.host ?? api.host };
-    }
-  }
+  const ps = settingsManager ? await settingsManager.loadSettings("@openacp/api-server") : {};
+  const currentPort = ps.port ?? 21420;
+  const currentHost = ps.host ?? "127.0.0.1";
   console.log(header("API"));
-  console.log(`  Port : ${api.port}`);
-  console.log(`  Host : ${api.host} ${dim("(localhost only)")}`);
+  console.log(`  Port : ${currentPort}`);
+  console.log(`  Host : ${currentHost} ${dim("(localhost only)")}`);
   console.log("");
   const newPort = await input({
     message: "API port:",
-    default: String(api.port),
+    default: String(currentPort),
     validate: (v) => {
       const n = Number(v.trim());
       if (!Number.isInteger(n) || n < 1 || n > 65535) return "Must be a valid port (1-65535)";
@@ -16852,24 +16992,24 @@ async function editApi(config, updates, settingsManager) {
   });
   if (settingsManager) {
     await settingsManager.updatePluginSettings("@openacp/api-server", { port: Number(newPort.trim()) });
-  } else {
-    updates.api = { port: Number(newPort.trim()) };
   }
   console.log(ok(`API port set to ${newPort.trim()}`));
 }
 async function editTunnel(config, updates, settingsManager) {
-  let tunnel = config.tunnel ?? { enabled: false, port: 3100, provider: "cloudflare", options: {}, storeTtlMinutes: 60, auth: { enabled: false } };
-  if (settingsManager) {
-    const ps = await settingsManager.loadSettings("@openacp/tunnel");
-    if (Object.keys(ps).length > 0) {
-      tunnel = { ...tunnel, ...ps };
-    }
-  }
-  const currentUpdates = updates.tunnel ?? {};
-  const getVal = (key, fallback) => key in currentUpdates ? currentUpdates[key] : tunnel[key] ?? fallback;
+  const ps = settingsManager ? await settingsManager.loadSettings("@openacp/tunnel") : {};
+  const tunnel = {
+    enabled: ps.enabled ?? false,
+    port: ps.port ?? 3100,
+    provider: ps.provider ?? "openacp",
+    options: ps.options ?? {},
+    storeTtlMinutes: ps.storeTtlMinutes ?? 60,
+    auth: ps.auth ?? { enabled: false }
+  };
+  const tun = { ...tunnel };
+  const getVal = (key, fallback) => key in tun ? tun[key] : tunnel[key] ?? fallback;
   console.log(header("Tunnel"));
   console.log(`  Enabled  : ${getVal("enabled", false) ? ok("yes") : dim("no")}`);
-  console.log(`  Provider : ${c.bold}${getVal("provider", "cloudflare")}${c.reset}`);
+  console.log(`  Provider : ${getVal("provider", "openacp")}`);
   console.log(`  Port     : ${getVal("port", 3100)}`);
   const authEnabled = getVal("auth", { enabled: false }).enabled;
   console.log(`  Auth     : ${authEnabled ? ok("enabled") : dim("disabled")}`);
@@ -16887,8 +17027,6 @@ async function editTunnel(config, updates, settingsManager) {
       ]
     });
     if (choice === "back") break;
-    if (!updates.tunnel) updates.tunnel = { ...tunnel };
-    const tun = updates.tunnel;
     if (choice === "toggle") {
       const current = getVal("enabled", false);
       if (settingsManager) {
@@ -16901,7 +17039,8 @@ async function editTunnel(config, updates, settingsManager) {
       const provider = await select3({
         message: "Select tunnel provider:",
         choices: [
-          { name: "Cloudflare (default)", value: "cloudflare" },
+          { name: "OpenACP (managed)", value: "openacp" },
+          { name: "Cloudflare", value: "cloudflare" },
           { name: "ngrok", value: "ngrok" },
           { name: "bore", value: "bore" },
           { name: "Tailscale Funnel", value: "tailscale" }
@@ -16931,7 +17070,7 @@ async function editTunnel(config, updates, settingsManager) {
       console.log(ok(`Tunnel port set to ${val.trim()}`));
     }
     if (choice === "options") {
-      const provider = getVal("provider", "cloudflare");
+      const provider = getVal("provider", "openacp");
       const currentOptions = getVal("options", {});
       await editProviderOptions(provider, currentOptions, tun);
       if (settingsManager) {
@@ -16941,20 +17080,21 @@ async function editTunnel(config, updates, settingsManager) {
     if (choice === "auth") {
       const currentAuth = getVal("auth", { enabled: false });
       if (currentAuth.enabled) {
-        tun.auth = { enabled: false };
         if (settingsManager) {
           await settingsManager.updatePluginSettings("@openacp/tunnel", { auth: { enabled: false } });
         }
+        tun.auth = { enabled: false };
         console.log(ok("Tunnel auth disabled"));
       } else {
         const token = await input({
           message: "Auth token (leave empty to auto-generate):",
           default: ""
         });
-        tun.auth = token.trim() ? { enabled: true, token: token.trim() } : { enabled: true };
+        const newAuth = token.trim() ? { enabled: true, token: token.trim() } : { enabled: true };
         if (settingsManager) {
-          await settingsManager.updatePluginSettings("@openacp/tunnel", { auth: tun.auth });
+          await settingsManager.updatePluginSettings("@openacp/tunnel", { auth: newAuth });
         }
+        tun.auth = newAuth;
         console.log(ok("Tunnel auth enabled"));
       }
     }
@@ -17082,17 +17222,17 @@ ${c.cyan}${c.bold}OpenACP Config Editor${c.reset}`);
 async function sendConfigViaApi(port, updates) {
   const { apiCall: call } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
   const paths = flattenToPaths(updates);
-  for (const { path: path35, value } of paths) {
+  for (const { path: path34, value } of paths) {
     const res = await call(port, "/api/config", {
       method: "PATCH",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ path: path35, value })
+      body: JSON.stringify({ path: path34, value })
     });
     const data = await res.json();
     if (!res.ok) {
-      console.log(warn(`Failed to update ${path35}: ${data.error}`));
+      console.log(warn(`Failed to update ${path34}: ${data.error}`));
     } else if (data.needsRestart) {
-      console.log(warn(`${path35} updated \u2014 restart required`));
+      console.log(warn(`${path34} updated \u2014 restart required`));
     }
   }
 }
@@ -17112,30 +17252,30 @@ function flattenToPaths(obj, prefix = "") {
 // src/cli/daemon.ts
 init_config();
 import { spawn as spawn3 } from "child_process";
-import * as fs30 from "fs";
-import * as path30 from "path";
+import * as fs29 from "fs";
+import * as path29 from "path";
 import * as os14 from "os";
-var DEFAULT_ROOT2 = path30.join(os14.homedir(), ".openacp");
+var DEFAULT_ROOT2 = path29.join(os14.homedir(), ".openacp");
 function getPidPath(root) {
   const base = root ?? DEFAULT_ROOT2;
-  return path30.join(base, "openacp.pid");
+  return path29.join(base, "openacp.pid");
 }
 function getLogDir(root) {
   const base = root ?? DEFAULT_ROOT2;
-  return path30.join(base, "logs");
+  return path29.join(base, "logs");
 }
 function getRunningMarker(root) {
   const base = root ?? DEFAULT_ROOT2;
-  return path30.join(base, "running");
+  return path29.join(base, "running");
 }
 function writePidFile(pidPath, pid) {
-  const dir = path30.dirname(pidPath);
-  fs30.mkdirSync(dir, { recursive: true });
-  fs30.writeFileSync(pidPath, String(pid));
+  const dir = path29.dirname(pidPath);
+  fs29.mkdirSync(dir, { recursive: true });
+  fs29.writeFileSync(pidPath, String(pid));
 }
 function readPidFile(pidPath) {
   try {
-    const content = fs30.readFileSync(pidPath, "utf-8").trim();
+    const content = fs29.readFileSync(pidPath, "utf-8").trim();
     const pid = parseInt(content, 10);
     return isNaN(pid) ? null : pid;
   } catch {
@@ -17144,7 +17284,7 @@ function readPidFile(pidPath) {
 }
 function removePidFile(pidPath) {
   try {
-    fs30.unlinkSync(pidPath);
+    fs29.unlinkSync(pidPath);
   } catch {
   }
 }
@@ -17177,12 +17317,12 @@ function startDaemon(pidPath = getPidPath(), logDir2, instanceRoot) {
     return { error: `Already running (PID ${pid})` };
   }
   const resolvedLogDir = logDir2 ? expandHome3(logDir2) : getLogDir(instanceRoot);
-  fs30.mkdirSync(resolvedLogDir, { recursive: true });
-  const logFile = path30.join(resolvedLogDir, "openacp.log");
-  const cliPath = path30.resolve(process.argv[1]);
+  fs29.mkdirSync(resolvedLogDir, { recursive: true });
+  const logFile = path29.join(resolvedLogDir, "openacp.log");
+  const cliPath = path29.resolve(process.argv[1]);
   const nodePath = process.execPath;
-  const out = fs30.openSync(logFile, "a");
-  const err = fs30.openSync(logFile, "a");
+  const out = fs29.openSync(logFile, "a");
+  const err = fs29.openSync(logFile, "a");
   const child = spawn3(nodePath, [cliPath, "--daemon-child"], {
     detached: true,
     stdio: ["ignore", out, err],
@@ -17191,8 +17331,8 @@ function startDaemon(pidPath = getPidPath(), logDir2, instanceRoot) {
       ...instanceRoot ? { OPENACP_INSTANCE_ROOT: instanceRoot } : {}
     }
   });
-  fs30.closeSync(out);
-  fs30.closeSync(err);
+  fs29.closeSync(out);
+  fs29.closeSync(err);
   if (!child.pid) {
     return { error: "Failed to spawn daemon process" };
   }
@@ -17263,12 +17403,12 @@ async function stopDaemon(pidPath = getPidPath(), instanceRoot) {
 }
 function markRunning(root) {
   const marker = getRunningMarker(root);
-  fs30.mkdirSync(path30.dirname(marker), { recursive: true });
-  fs30.writeFileSync(marker, "");
+  fs29.mkdirSync(path29.dirname(marker), { recursive: true });
+  fs29.writeFileSync(marker, "");
 }
 function clearRunning(root) {
   try {
-    fs30.unlinkSync(getRunningMarker(root));
+    fs29.unlinkSync(getRunningMarker(root));
   } catch {
   }
 }
@@ -17493,6 +17633,9 @@ var Draft = class {
     } finally {
       this.firstFlushPending = false;
     }
+    if (this.buffer !== snapshot) {
+      return this.flush();
+    }
   }
 };
 var DraftManager = class {
@@ -17770,8 +17913,8 @@ Configure via \`security.sessionTimeoutMinutes\` in config.
 3. Copy and run it in your terminal \u2014 the session continues there with full conversation history
 
 ### Terminal \u2192 Chat
-1. First time: run \`openacp integrate claude\` to install the handoff skill (one-time setup)
-2. In Claude Code, use the /openacp:handoff slash command
+1. First time: run \`openacp integrate <agent>\` to install handoff integration (one-time setup)
+2. In supported agents (for example Claude Code or OpenCode), use /openacp:handoff
 3. The session appears as a new topic/thread and you can continue chatting there
 
 ### How it works