@openacp/cli 2026.413.1 → 2026.414.2

package/dist/cli.js

@@ -1870,6 +1870,8 @@ var init_events = __esm({
       MESSAGE_QUEUED: "message:queued",
       /** Fired when a queued message starts processing. */
       MESSAGE_PROCESSING: "message:processing",
+      /** Fired when a queued message is rejected (e.g. blocked by middleware). */
+      MESSAGE_FAILED: "message:failed",
       // --- System lifecycle ---
       /** Fired after kernel (core + plugin infrastructure) has booted. */
       KERNEL_BOOTED: "kernel:booted",
@@ -2031,7 +2033,16 @@ function createSecurityPlugin() {
         handler: async (payload, next) => {
           const access2 = await guard.checkAccess(payload);
           if (!access2.allowed) {
-            ctx.log.info(`Access denied: ${access2.reason}`);
+            ctx.log.info(`Access denied for user=${payload.userId} channel=${payload.channelId}: ${access2.reason}`);
+            const adapter = core.adapters?.get?.(payload.channelId);
+            if (adapter?.sendMessage && payload.threadId) {
+              adapter.sendMessage(payload.threadId, {
+                type: "error",
+                message: `Access denied: ${access2.reason ?? "You are not allowed to use this service."}`
+              }).catch((err) => {
+                ctx.log.warn(`Failed to send access-denied message to adapter: ${err}`);
+              });
+            }
             return null;
           }
           return next();
@@ -2622,6 +2633,22 @@ function registerSetupRoutes(app, deps) {
       if (user2) return user2;
     }
     const body = request.body;
+    if (body?.identitySecret) {
+      const oldToken = tokenStore?.getByIdentitySecret(body.identitySecret);
+      if (!oldToken) {
+        return reply.status(401).send({ error: "Invalid identity secret" });
+      }
+      const userId = tokenStore?.getUserId(oldToken.id);
+      if (!userId) {
+        return reply.status(401).send({ error: "No identity linked to this secret" });
+      }
+      await service.createIdentity(userId, {
+        source: "api",
+        platformId: auth.tokenId
+      });
+      tokenStore?.setUserId?.(auth.tokenId, userId);
+      return service.getUser(userId);
+    }
     if (body?.linkCode) {
       const entry = linkCodes.get(body.linkCode);
       if (!entry || entry.expiresAt < Date.now()) {
@@ -2700,23 +2727,30 @@ function createIdentityPlugin() {
       });
       ctx.registerCommand({
         name: "whoami",
-        description: "Set your display name and username",
-        usage: "[name]",
+        description: "Set your username and display name",
+        usage: "@username [Display Name]",
         category: "plugin",
         async handler(args2) {
-          const name = args2.raw.trim();
-          if (!name) {
-            return { type: "text", text: "Usage: /whoami <name>" };
-          }
+          const raw = args2.raw.trim();
+          if (!raw) return { type: "error", message: "Usage: /whoami @username [Display Name]" };
+          const tokens = raw.split(/\s+/);
+          const first = tokens[0];
+          const usernameRaw = first.startsWith("@") ? first.slice(1) : first;
+          if (!/^[a-zA-Z0-9_.-]+$/.test(usernameRaw)) {
+            return { type: "error", message: "Invalid username. Only letters, numbers, _ . - allowed." };
+          }
+          const username = usernameRaw;
+          const displayName = tokens.slice(1).join(" ") || void 0;
           const identityId = formatIdentityId(args2.channelId, args2.userId);
           const user = await service.getUserByIdentity(identityId);
           if (!user) {
-            return { type: "error", message: "User not found \u2014 send a message first." };
+            return { type: "error", message: "Identity not found. Send a message first." };
           }
           try {
-            const username = name.toLowerCase().replace(/[^a-z0-9_]/g, "");
-            await service.updateUser(user.userId, { displayName: name, username });
-            return { type: "text", text: `Display name set to "${name}", username: @${username}` };
+            await service.updateUser(user.userId, { username, ...displayName && { displayName } });
+            const parts = [`@${username}`];
+            if (displayName) parts.push(`"${displayName}"`);
+            return { type: "text", text: `\u2705 Profile updated: ${parts.join(" ")}` };
           } catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             return { type: "error", message };
@@ -8255,9 +8289,15 @@ var init_token_store = __esm({
             return;
           }
           this.tokens.clear();
+          let needsMigration = false;
           for (const token of parsed.tokens) {
+            if (!token.identitySecret) {
+              token.identitySecret = randomBytes2(16).toString("hex");
+              needsMigration = true;
+            }
             this.tokens.set(token.id, token);
           }
+          if (needsMigration) this.scheduleSave();
           this.codes.clear();
           for (const code of parsed.codes ?? []) {
             this.codes.set(code.code, code);
@@ -8303,7 +8343,8 @@ var init_token_store = __esm({
           scopes: opts.scopes,
           createdAt: now.toISOString(),
           refreshDeadline: new Date(now.getTime() + REFRESH_DEADLINE_MS).toISOString(),
-          revoked: false
+          revoked: false,
+          identitySecret: randomBytes2(16).toString("hex")
         };
         this.tokens.set(token.id, token);
         this.scheduleSave();
@@ -8372,6 +8413,19 @@ var init_token_store = __esm({
       getUserId(tokenId) {
         return this.tokens.get(tokenId)?.userId;
       }
+      /**
+       * Looks up a non-revoked token by its identity secret.
+       *
+       * Used by the identity re-link flow: the App sends the old token's identitySecret
+       * to prove continuity of identity when reconnecting with a new JWT.
+       * Returns undefined if no match, or if the matching token is revoked.
+       */
+      getByIdentitySecret(secret) {
+        for (const token of this.tokens.values()) {
+          if (!token.revoked && token.identitySecret === secret) return token;
+        }
+        return void 0;
+      }
       /**
        * Generates a one-time authorization code that can be exchanged for a JWT.
        *
@@ -8987,7 +9041,8 @@ var init_sse_manager = __esm({
           BusEvent.PERMISSION_REQUEST,
           BusEvent.PERMISSION_RESOLVED,
           BusEvent.MESSAGE_QUEUED,
-          BusEvent.MESSAGE_PROCESSING
+          BusEvent.MESSAGE_PROCESSING,
+          BusEvent.MESSAGE_FAILED
         ];
         for (const eventName of events) {
           const handler = (data) => {
@@ -9069,7 +9124,8 @@ data: ${JSON.stringify(data)}
           BusEvent.PERMISSION_RESOLVED,
           BusEvent.SESSION_UPDATED,
           BusEvent.MESSAGE_QUEUED,
-          BusEvent.MESSAGE_PROCESSING
+          BusEvent.MESSAGE_PROCESSING,
+          BusEvent.MESSAGE_FAILED
         ];
         for (const res of this.sseConnections) {
           const filter = res.sessionFilter;
@@ -9339,7 +9395,6 @@ var sessions_exports = {};
 __export(sessions_exports, {
   sessionRoutes: () => sessionRoutes
 });
-import { nanoid as nanoid3 } from "nanoid";
 async function sessionRoutes(app, deps) {
   app.get("/", { preHandler: requireScopes("sessions:read") }, async () => {
     const summaries = deps.core.sessionManager.listAllSessions();
@@ -9515,34 +9570,36 @@ async function sessionRoutes(app, deps) {
         attachments = await resolveAttachments(fileService, sessionId, body.attachments);
       }
       const sourceAdapterId = body.sourceAdapterId ?? "sse";
-      const turnId = body.turnId ?? nanoid3(8);
       const userId = request.auth?.tokenId ?? "api";
-      const meta = { turnId, channelUser: { channelId: "sse", userId } };
-      if (deps.lifecycleManager?.middlewareChain) {
-        await deps.lifecycleManager.middlewareChain.execute(
-          Hook.MESSAGE_INCOMING,
-          { channelId: sourceAdapterId, threadId: session.id, userId, text: body.prompt, attachments, meta },
-          async (p2) => p2
+      const result = await deps.core.handleMessageInSession(
+        session,
+        { channelId: sourceAdapterId, userId, text: body.prompt, attachments },
+        { channelUser: { channelId: "sse", userId } },
+        { externalTurnId: body.turnId, responseAdapterId: body.responseAdapterId }
+      );
+      if (!result) {
+        throw new AuthError("MESSAGE_BLOCKED", "Message was blocked by a middleware plugin.", 403);
+      }
+      return { ok: true, sessionId, queueDepth: result.queueDepth, turnId: result.turnId };
+    }
+  );
+  app.get(
+    "/:sessionId/queue",
+    { preHandler: requireScopes("sessions:read") },
+    async (request) => {
+      const { sessionId: rawId } = SessionIdParamSchema.parse(request.params);
+      const sessionId = decodeURIComponent(rawId);
+      const session = await deps.core.getOrResumeSessionById(sessionId);
+      if (!session) {
+        throw new NotFoundError(
+          "SESSION_NOT_FOUND",
+          `Session "${sessionId}" not found`
         );
       }
-      deps.core.eventBus.emit(BusEvent.MESSAGE_QUEUED, {
-        sessionId,
-        turnId,
-        text: body.prompt,
-        sourceAdapterId,
-        attachments,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        queueDepth: session.queueDepth
-      });
-      await session.enqueuePrompt(body.prompt, attachments, {
-        sourceAdapterId,
-        responseAdapterId: body.responseAdapterId
-      }, turnId, meta);
       return {
-        ok: true,
-        sessionId,
-        queueDepth: session.queueDepth,
-        turnId
+        pending: session.queueItems,
+        processing: session.promptRunning,
+        queueDepth: session.queueDepth
       };
     }
   );
@@ -9810,7 +9867,6 @@ var init_sessions2 = __esm({
     init_error_handler();
     init_auth();
     init_attachment_utils();
-    init_events();
     init_sessions();
   }
 });
@@ -10792,7 +10848,8 @@ async function authRoutes(app, deps) {
       tokenId: stored.id,
       accessToken,
       expiresAt,
-      refreshDeadline: stored.refreshDeadline
+      refreshDeadline: stored.refreshDeadline,
+      identitySecret: stored.identitySecret
     };
   });
   app.get("/tokens", {
@@ -11552,7 +11609,8 @@ function createApiServerPlugin() {
             accessToken,
             tokenId: token.id,
             expiresAt: new Date(Date.now() + parseDuration2(code.expire)).toISOString(),
-            refreshDeadline: token.refreshDeadline
+            refreshDeadline: token.refreshDeadline,
+            identitySecret: token.identitySecret
           });
         });
       }, { auth: false });
@@ -12139,14 +12197,13 @@ async function sseRoutes(app, deps) {
         }
         attachments = await resolveAttachments(fileService, sessionId, body.attachments);
       }
-      const queueDepth = session.queueDepth + 1;
       const userId = request.auth?.tokenId ?? "api";
-      await deps.core.handleMessageInSession(
+      const { turnId, queueDepth } = await deps.core.handleMessageInSession(
         session,
         { channelId: "sse", userId, text: body.prompt, attachments },
         { channelUser: { channelId: "sse", userId } }
       );
-      return { ok: true, sessionId, queueDepth };
+      return { ok: true, sessionId, queueDepth, turnId };
     }
   );
   app.post(
@@ -16363,7 +16420,7 @@ var init_commands3 = __esm({
 
 // src/plugins/telegram/permissions.ts
 import { InlineKeyboard as InlineKeyboard11 } from "grammy";
-import { nanoid as nanoid4 } from "nanoid";
+import { nanoid as nanoid3 } from "nanoid";
 var log26, PermissionHandler;
 var init_permissions = __esm({
   "src/plugins/telegram/permissions.ts"() {
@@ -16390,7 +16447,7 @@ var init_permissions = __esm({
        */
       async sendPermissionRequest(session, request) {
         const threadId = Number(session.threadId);
-        const callbackKey = nanoid4(8);
+        const callbackKey = nanoid3(8);
         this.pending.set(callbackKey, {
           sessionId: session.id,
           requestId: request.id,
@@ -18401,7 +18458,11 @@ var init_adapter2 = __esm({
           }
           return prev(method, payload, signal);
         });
-        this.registerCommandsWithRetry();
+        const onCommandsReady = ({ commands }) => {
+          this.core.eventBus.off(BusEvent.SYSTEM_COMMANDS_READY, onCommandsReady);
+          this.syncCommandsWithRetry(commands);
+        };
+        this.core.eventBus.on(BusEvent.SYSTEM_COMMANDS_READY, onCommandsReady);
         this.bot.use((ctx, next) => {
           const chatId = ctx.chat?.id ?? ctx.callbackQuery?.message?.chat?.id;
           if (chatId !== this.telegramConfig.chatId) return;
@@ -18627,12 +18688,16 @@ ${p2}` : p2;
         throw new Error("unreachable");
       }
       /**
-       * Register Telegram commands in the background with retries.
-       * Non-critical — bot works fine without autocomplete commands.
+       * Sync Telegram autocomplete commands after all plugins are ready.
+       * Merges STATIC_COMMANDS (hardcoded system commands) with plugin commands
+       * from the registry, deduplicating by command name. Non-critical.
        */
-      registerCommandsWithRetry() {
+      syncCommandsWithRetry(registryCommands) {
+        const staticNames = new Set(STATIC_COMMANDS.map((c3) => c3.command));
+        const pluginCommands = registryCommands.filter((c3) => c3.category === "plugin" && !staticNames.has(c3.name) && /^[a-z0-9_]+$/.test(c3.name)).map((c3) => ({ command: c3.name, description: c3.description.slice(0, 256) }));
+        const allCommands = [...STATIC_COMMANDS, ...pluginCommands].slice(0, 100);
         this.retryWithBackoff(
-          () => this.bot.api.setMyCommands(STATIC_COMMANDS, {
+          () => this.bot.api.setMyCommands(allCommands, {
             scope: { type: "chat", chat_id: this.telegramConfig.chatId }
           }),
           "setMyCommands"
@@ -22161,16 +22226,16 @@ var init_prompt_queue = __esm({
        * immediately. Otherwise, it's buffered and the returned promise resolves
        * only after the prompt finishes processing.
        */
-      async enqueue(text5, attachments, routing, turnId, meta) {
+      async enqueue(text5, userPrompt, attachments, routing, turnId, meta) {
         if (this.processing) {
           return new Promise((resolve9) => {
-            this.queue.push({ text: text5, attachments, routing, turnId, meta, resolve: resolve9 });
+            this.queue.push({ text: text5, userPrompt, attachments, routing, turnId, meta, resolve: resolve9 });
           });
         }
-        await this.process(text5, attachments, routing, turnId, meta);
+        await this.process(text5, userPrompt, attachments, routing, turnId, meta);
       }
       /** Run a single prompt through the processor, then drain the next queued item. */
-      async process(text5, attachments, routing, turnId, meta) {
+      async process(text5, userPrompt, attachments, routing, turnId, meta) {
         this.processing = true;
         this.abortController = new AbortController();
         const { signal } = this.abortController;
@@ -22180,7 +22245,7 @@ var init_prompt_queue = __esm({
         });
         try {
           await Promise.race([
-            this.processor(text5, attachments, routing, turnId, meta),
+            this.processor(text5, userPrompt, attachments, routing, turnId, meta),
             new Promise((_, reject) => {
               signal.addEventListener("abort", () => reject(new Error("Prompt aborted")), { once: true });
             })
@@ -22201,7 +22266,7 @@ var init_prompt_queue = __esm({
       drainNext() {
         const next = this.queue.shift();
         if (next) {
-          this.process(next.text, next.attachments, next.routing, next.turnId, next.meta).then(next.resolve);
+          this.process(next.text, next.userPrompt, next.attachments, next.routing, next.turnId, next.meta).then(next.resolve);
         }
       }
       /**
@@ -22223,6 +22288,13 @@ var init_prompt_queue = __esm({
       get isProcessing() {
         return this.processing;
       }
+      /** Snapshot of queued (not yet processing) items — used for queue inspection by callers. */
+      get pendingItems() {
+        return this.queue.map((item) => ({
+          userPrompt: item.userPrompt,
+          turnId: item.turnId
+        }));
+      }
     };
   }
 });
@@ -22307,18 +22379,32 @@ var init_permission_gate = __esm({
 });
 
 // src/core/sessions/turn-context.ts
-import { nanoid as nanoid5 } from "nanoid";
-function createTurnContext(sourceAdapterId, responseAdapterId, turnId) {
+import { nanoid as nanoid4 } from "nanoid";
+function extractSender(meta) {
+  const identity = meta?.identity;
+  if (!identity || !identity.userId || !identity.identityId) return null;
   return {
-    turnId: turnId ?? nanoid5(8),
-    sourceAdapterId,
-    responseAdapterId
+    userId: identity.userId,
+    identityId: identity.identityId,
+    displayName: identity.displayName,
+    username: identity.username
   };
 }
 function getEffectiveTarget(ctx) {
   if (ctx.responseAdapterId === null) return null;
   return ctx.responseAdapterId ?? ctx.sourceAdapterId;
 }
+function createTurnContext(sourceAdapterId, responseAdapterId, turnId, userPrompt, finalPrompt, attachments, meta) {
+  return {
+    turnId: turnId ?? nanoid4(8),
+    sourceAdapterId,
+    responseAdapterId,
+    userPrompt,
+    finalPrompt,
+    attachments,
+    meta
+  };
+}
 function isSystemEvent(event) {
   return SYSTEM_EVENT_TYPES.has(event.type);
 }
@@ -22338,7 +22424,7 @@ var init_turn_context = __esm({
 });
 
 // src/core/sessions/session.ts
-import { nanoid as nanoid6 } from "nanoid";
+import { nanoid as nanoid5 } from "nanoid";
 import * as fs41 from "fs";
 var moduleLog, TTS_PROMPT_INSTRUCTION, TTS_BLOCK_REGEX, TTS_MAX_LENGTH, TTS_TIMEOUT_MS, VALID_TRANSITIONS, Session;
 var init_session2 = __esm({
@@ -22418,7 +22504,7 @@ Additionally, include a [TTS]...[/TTS] block with a spoken-friendly summary of y
       pendingContext = null;
       constructor(opts) {
         super();
-        this.id = opts.id || nanoid6(12);
+        this.id = opts.id || nanoid5(12);
         this.channelId = opts.channelId;
         this.attachedAdapters = [opts.channelId];
         this.agentName = opts.agentName;
@@ -22430,7 +22516,7 @@ Additionally, include a [TTS]...[/TTS] block with a spoken-friendly summary of y
         this.log = createSessionLogger(this.id, moduleLog);
         this.log.info({ agentName: this.agentName }, "Session created");
         this.queue = new PromptQueue(
-          (text5, attachments, routing, turnId, meta) => this.processPrompt(text5, attachments, routing, turnId, meta),
+          (text5, userPrompt, attachments, routing, turnId, meta) => this.processPrompt(text5, userPrompt, attachments, routing, turnId, meta),
           (err) => {
             this.log.error({ err }, "Prompt execution failed");
             const message = err instanceof Error ? err.message : String(err);
@@ -22510,6 +22596,10 @@ Additionally, include a [TTS]...[/TTS] block with a spoken-friendly summary of y
       get promptRunning() {
         return this.queue.isProcessing;
       }
+      /** Snapshot of queued (not yet processing) items — for inspection by API consumers. */
+      get queueItems() {
+        return this.queue.pendingItems;
+      }
       // --- Context Injection ---
       /** Store context markdown to be prepended to the next prompt (used for session resume with history). */
       setContext(markdown) {
@@ -22530,24 +22620,30 @@ Additionally, include a [TTS]...[/TTS] block with a spoken-friendly summary of y
        * queued/processing events before the prompt actually runs.
        */
       async enqueuePrompt(text5, attachments, routing, externalTurnId, meta) {
-        const turnId = externalTurnId ?? nanoid6(8);
+        const turnId = externalTurnId ?? nanoid5(8);
         const turnMeta = meta ?? { turnId };
+        const userPrompt = text5;
         if (this.middlewareChain) {
           const payload = { text: text5, attachments, sessionId: this.id, sourceAdapterId: routing?.sourceAdapterId, meta: turnMeta };
           const result = await this.middlewareChain.execute(Hook.AGENT_BEFORE_PROMPT, payload, async (p2) => p2);
-          if (!result) return turnId;
+          if (!result) throw new Error("PROMPT_BLOCKED");
           text5 = result.text;
           attachments = result.attachments;
         }
-        await this.queue.enqueue(text5, attachments, routing, turnId, turnMeta);
+        await this.queue.enqueue(text5, userPrompt, attachments, routing, turnId, turnMeta);
         return turnId;
       }
-      async processPrompt(text5, attachments, routing, turnId, meta) {
+      async processPrompt(text5, userPrompt, attachments, routing, turnId, meta) {
         if (this._status === "finished") return;
         this.activeTurnContext = createTurnContext(
           routing?.sourceAdapterId ?? this.channelId,
           routing?.responseAdapterId,
-          turnId
+          turnId,
+          userPrompt,
+          text5,
+          // finalPrompt (after middleware transformations)
+          attachments,
+          meta
         );
         this.emit(SessionEv.TURN_STARTED, this.activeTurnContext);
         this.promptCount++;
@@ -22598,7 +22694,16 @@ ${text5}`;
           this.agentInstance.on(SessionEv.AGENT_EVENT, afterEventListener);
         }
         if (this.middlewareChain) {
-          this.middlewareChain.execute(Hook.TURN_START, { sessionId: this.id, promptText: processed.text, promptNumber: this.promptCount, turnId: this.activeTurnContext?.turnId ?? turnId ?? "", meta }, async (p2) => p2).catch(() => {
+          this.middlewareChain.execute(Hook.TURN_START, {
+            sessionId: this.id,
+            promptText: processed.text,
+            promptNumber: this.promptCount,
+            turnId: this.activeTurnContext?.turnId ?? turnId ?? "",
+            meta,
+            userPrompt: this.activeTurnContext?.userPrompt,
+            sourceAdapterId: this.activeTurnContext?.sourceAdapterId,
+            responseAdapterId: this.activeTurnContext?.responseAdapterId
+          }, async (p2) => p2).catch(() => {
           });
         }
         let stopReason = "end_turn";
@@ -23269,7 +23374,7 @@ var init_session_bridge = __esm({
           if (this.shouldForward(event)) {
             this.dispatchAgentEvent(event);
           } else {
-            this.deps.eventBus?.emit(BusEvent.AGENT_EVENT, { sessionId: this.session.id, event });
+            this.deps.eventBus?.emit(BusEvent.AGENT_EVENT, { sessionId: this.session.id, turnId: "", event });
           }
         });
         if (!this.session.agentInstance.onPermissionRequest || this.session.agentInstance.onPermissionRequest.__bridgeId === void 0) {
@@ -23322,14 +23427,16 @@ var init_session_bridge = __esm({
           this.deps.sessionManager.patchRecord(this.session.id, { currentPromptCount: count });
         });
         this.listen(this.session, SessionEv.TURN_STARTED, (ctx) => {
-          if (ctx.sourceAdapterId !== "sse") {
-            this.deps.eventBus?.emit(BusEvent.MESSAGE_PROCESSING, {
-              sessionId: this.session.id,
-              turnId: ctx.turnId,
-              sourceAdapterId: ctx.sourceAdapterId,
-              timestamp: (/* @__PURE__ */ new Date()).toISOString()
-            });
-          }
+          this.deps.eventBus?.emit(BusEvent.MESSAGE_PROCESSING, {
+            sessionId: this.session.id,
+            turnId: ctx.turnId,
+            sourceAdapterId: ctx.sourceAdapterId,
+            userPrompt: ctx.userPrompt,
+            finalPrompt: ctx.finalPrompt,
+            attachments: ctx.attachments,
+            sender: extractSender(ctx.meta),
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          });
         });
         if (this.session.latestCommands !== null) {
           this.session.emit(SessionEv.AGENT_EVENT, { type: "commands_update", commands: this.session.latestCommands });
@@ -23495,6 +23602,7 @@ var init_session_bridge = __esm({
         }
         this.deps.eventBus?.emit(BusEvent.AGENT_EVENT, {
           sessionId: this.session.id,
+          turnId: this.session.activeTurnContext?.turnId ?? "",
           event
         });
         return outgoing;
@@ -24408,6 +24516,7 @@ var init_session_factory = __esm({
           const failedSessionId = createParams.existingSessionId ?? `failed-${Date.now()}`;
           this.eventBus.emit(BusEvent.AGENT_EVENT, {
             sessionId: failedSessionId,
+            turnId: "",
             event: guidance
           });
           throw err;
@@ -24778,7 +24887,7 @@ var init_agent_switch_handler = __esm({
           message: `Switching from ${fromAgent} to ${toAgent}...`
         };
         session.emit(SessionEv.AGENT_EVENT, startEvent);
-        eventBus.emit(BusEvent.AGENT_EVENT, { sessionId, event: startEvent });
+        eventBus.emit(BusEvent.AGENT_EVENT, { sessionId, turnId: "", event: startEvent });
         eventBus.emit(BusEvent.SESSION_AGENT_SWITCH, {
           sessionId,
           fromAgent,
@@ -24841,7 +24950,7 @@ var init_agent_switch_handler = __esm({
             message: resumed ? `Switched to ${toAgent} (resumed previous session).` : `Switched to ${toAgent} (new session).`
           };
           session.emit(SessionEv.AGENT_EVENT, successEvent);
-          eventBus.emit(BusEvent.AGENT_EVENT, { sessionId, event: successEvent });
+          eventBus.emit(BusEvent.AGENT_EVENT, { sessionId, turnId: "", event: successEvent });
           eventBus.emit(BusEvent.SESSION_AGENT_SWITCH, {
             sessionId,
             fromAgent,
@@ -24856,7 +24965,7 @@ var init_agent_switch_handler = __esm({
             message: `Failed to switch to ${toAgent}: ${errorMessage}`
           };
           session.emit(SessionEv.AGENT_EVENT, failedEvent);
-          eventBus.emit(BusEvent.AGENT_EVENT, { sessionId, event: failedEvent });
+          eventBus.emit(BusEvent.AGENT_EVENT, { sessionId, turnId: "", event: failedEvent });
           eventBus.emit(BusEvent.SESSION_AGENT_SWITCH, {
             sessionId,
             fromAgent,
@@ -26769,7 +26878,7 @@ var init_core_items = __esm({
 
 // src/core/core.ts
 import path51 from "path";
-import { nanoid as nanoid7 } from "nanoid";
+import { nanoid as nanoid6 } from "nanoid";
 var log44, OpenACPCore;
 var init_core = __esm({
   "src/core/core.ts"() {
@@ -26795,6 +26904,7 @@ var init_core = __esm({
     init_error_tracker();
     init_log();
     init_events();
+    init_turn_context();
     log44 = createChildLogger({ module: "core" });
     OpenACPCore = class {
       configManager;
@@ -27080,7 +27190,7 @@ var init_core = __esm({
           },
           "Incoming message"
         );
-        const turnId = nanoid7(8);
+        const turnId = nanoid6(8);
         const meta = { turnId, ...initialMeta };
         if (this.lifecycleManager?.middlewareChain) {
           const result = await this.lifecycleManager.middlewareChain.execute(
@@ -27120,9 +27230,6 @@ var init_core = __esm({
           }
           return;
         }
-        this.sessionManager.patchRecord(session.id, {
-          lastActiveAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
         let text5 = message.text;
         if (this.assistantManager?.isAssistant(session.id)) {
           const pending = this.assistantManager.consumePendingSystemPrompt(message.channelId);
@@ -27135,38 +27242,56 @@ User message:
 ${text5}`;
           }
         }
-        const sourceAdapterId = message.routing?.sourceAdapterId ?? message.channelId;
-        const routing = sourceAdapterId !== message.routing?.sourceAdapterId ? { ...message.routing, sourceAdapterId } : message.routing;
         const enrichedMeta = message.meta ?? meta;
-        if (sourceAdapterId && sourceAdapterId !== "sse" && sourceAdapterId !== "api") {
-          this.eventBus.emit(BusEvent.MESSAGE_QUEUED, {
+        await this._dispatchToSession(session, text5, message.attachments, {
+          sourceAdapterId: message.routing?.sourceAdapterId ?? message.channelId,
+          responseAdapterId: message.routing?.responseAdapterId
+        }, turnId, enrichedMeta);
+      }
+      /**
+       * Shared dispatch path for sending a prompt to a session.
+       * Called by both handleMessage (Telegram) and handleMessageInSession (SSE/API)
+       * after their respective middleware/enrichment steps.
+       */
+      async _dispatchToSession(session, text5, attachments, routing, turnId, meta) {
+        this.sessionManager.patchRecord(session.id, {
+          lastActiveAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        this.eventBus.emit(BusEvent.MESSAGE_QUEUED, {
+          sessionId: session.id,
+          turnId,
+          text: text5,
+          sourceAdapterId: routing.sourceAdapterId,
+          attachments,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          queueDepth: session.queueDepth + 1,
+          sender: extractSender(meta)
+        });
+        session.enqueuePrompt(text5, attachments, routing, turnId, meta).catch((err) => {
+          const reason = err instanceof Error ? err.message : String(err);
+          log44.warn({ err, sessionId: session.id, turnId, reason }, "enqueuePrompt failed \u2014 emitting message:failed");
+          this.eventBus.emit(BusEvent.MESSAGE_FAILED, {
             sessionId: session.id,
             turnId,
-            text: text5,
-            sourceAdapterId,
-            attachments: message.attachments,
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            queueDepth: session.queueDepth
+            reason
           });
-          await session.enqueuePrompt(text5, message.attachments, routing, turnId, enrichedMeta);
-        } else {
-          await session.enqueuePrompt(text5, message.attachments, routing, turnId, enrichedMeta);
-        }
+        });
       }
       /**
        * Send a message to a known session, running the full message:incoming → agent:beforePrompt
        * middleware chain (same as handleMessage) but without the threadId-based session lookup.
        *
-       * Used by channels that already hold a direct session reference (e.g. SSE adapter), where
-       * looking up by channelId+threadId is unreliable (API sessions may have no threadId).
+       * Used by channels that already hold a direct session reference (e.g. SSE adapter, api-server),
+       * where looking up by channelId+threadId is unreliable (API sessions may have no threadId).
        *
        * @param session  The target session — caller is responsible for validating its status.
        * @param message  Sender context and message content.
        * @param initialMeta  Optional adapter-specific context to seed the TurnMeta bag
        *                     (e.g. channelUser with display name/username).
+       * @param options  Optional turnId override and response routing.
        */
-      async handleMessageInSession(session, message, initialMeta) {
-        const turnId = nanoid7(8);
+      async handleMessageInSession(session, message, initialMeta, options) {
+        const turnId = options?.externalTurnId ?? nanoid6(8);
         const meta = { turnId, ...initialMeta };
         let text5 = message.text;
         let { attachments } = message;
@@ -27185,13 +27310,17 @@ ${text5}`;
             payload,
             async (p2) => p2
           );
-          if (!result) return;
+          if (!result) return { turnId, queueDepth: session.queueDepth };
           text5 = result.text;
           attachments = result.attachments;
           enrichedMeta = result.meta ?? meta;
         }
-        const routing = { sourceAdapterId: message.channelId };
-        await session.enqueuePrompt(text5, attachments, routing, turnId, enrichedMeta);
+        const routing = {
+          sourceAdapterId: message.channelId,
+          responseAdapterId: options?.responseAdapterId
+        };
+        await this._dispatchToSession(session, text5, attachments, routing, turnId, enrichedMeta);
+        return { turnId, queueDepth: session.queueDepth };
       }
       // --- Unified Session Creation Pipeline ---
       /**
@@ -27303,7 +27432,7 @@ ${text5}`;
             } else if (processedEvent.type === "error") {
               session.fail(processedEvent.message);
             }
-            this.eventBus.emit(BusEvent.AGENT_EVENT, { sessionId: session.id, event: processedEvent });
+            this.eventBus.emit(BusEvent.AGENT_EVENT, { sessionId: session.id, turnId: session.activeTurnContext?.turnId ?? "", event: processedEvent });
           });
           session.on(SessionEv.STATUS_CHANGE, (_from, to) => {
             this.sessionManager.patchRecord(session.id, {
@@ -27315,6 +27444,18 @@ ${text5}`;
           session.on(SessionEv.PROMPT_COUNT_CHANGED, (count) => {
             this.sessionManager.patchRecord(session.id, { currentPromptCount: count });
           });
+          session.on(SessionEv.TURN_STARTED, (ctx) => {
+            this.eventBus.emit(BusEvent.MESSAGE_PROCESSING, {
+              sessionId: session.id,
+              turnId: ctx.turnId,
+              sourceAdapterId: ctx.sourceAdapterId,
+              userPrompt: ctx.userPrompt,
+              finalPrompt: ctx.finalPrompt,
+              attachments: ctx.attachments,
+              sender: extractSender(ctx.meta),
+              timestamp: (/* @__PURE__ */ new Date()).toISOString()
+            });
+          });
         }
         this.sessionFactory.wireSideEffects(session, {
           eventBus: this.eventBus,