@openparachute/agent 0.1.0

package/src/session-manager.ts

@@ -0,0 +1,433 @@
+/**
+ * Session lifecycle: folders, DBs, messages, container status.
+ *
+ * Two-DB split — inbound.db (host writes) + outbound.db (container writes).
+ * Three cross-mount invariants are load-bearing:
+ *   1. journal_mode=DELETE — WAL's mmapped -shm doesn't refresh host→guest;
+ *      the container would silently miss every new message.
+ *   2. Host opens-writes-CLOSES per op — close invalidates the container's
+ *      page cache; a long-lived connection freezes its view at first read.
+ *   3. One writer per file — DELETE-mode journal-unlink isn't atomic across
+ *      the mount; concurrent writers corrupt the DB.
+ */
+import type { Database } from './db/connection.js';
+import fs from 'fs';
+import path from 'path';
+
+import type { OutboundFile } from './channels/adapter.js';
+import { DATA_DIR } from './config.js';
+import { getMessagingGroup } from './db/messaging-groups.js';
+import {
+  createSession,
+  findSession,
+  findSessionByAgentGroup,
+  findSessionForAgent,
+  getSession,
+  updateSession,
+} from './db/sessions.js';
+import {
+  ensureSchema,
+  openInboundDb as openInboundDbRaw,
+  openOutboundDb as openOutboundDbRaw,
+  upsertSessionRouting,
+  insertMessage,
+  migrateMessagesInTable,
+} from './db/session-db.js';
+import { log } from './log.js';
+import type { Session } from './types.js';
+
+/** Root directory for all session data. */
+export function sessionsBaseDir(): string {
+  return path.join(DATA_DIR, 'sessions');
+}
+
+/** Legacy location, pre-rename. Kept only so `migrateSessionsDir` can find it. */
+export function legacySessionsBaseDir(): string {
+  return path.join(DATA_DIR, 'v2-sessions');
+}
+
+/**
+ * One-shot rename: `data/v2-sessions/` → `data/sessions/`. Idempotent — noop
+ * if the legacy directory doesn't exist or the new directory already does.
+ *
+ * Called from `src/index.ts` at startup, before any session DB is opened.
+ * Same-filesystem rename is atomic, so partial-migration recovery is not a
+ * concern (unlike the central-DB copy in `migrateCentralDbLocation`).
+ *
+ * Path overrides exist for tests; production callers pass no args.
+ */
+export function migrateSessionsDir(
+  legacy: string = legacySessionsBaseDir(),
+  current: string = sessionsBaseDir(),
+): void {
+  if (fs.existsSync(current)) return;
+  if (!fs.existsSync(legacy)) return;
+  fs.renameSync(legacy, current);
+  log.info('Sessions directory renamed', { from: legacy, to: current });
+}
+
+/** Directory for a specific session: sessions/{agent_group_id}/{session_id}/ */
+export function sessionDir(agentGroupId: string, sessionId: string): string {
+  return path.join(sessionsBaseDir(), agentGroupId, sessionId);
+}
+
+/** Path to the host-owned inbound DB (messages_in + delivered). */
+export function inboundDbPath(agentGroupId: string, sessionId: string): string {
+  return path.join(sessionDir(agentGroupId, sessionId), 'inbound.db');
+}
+
+/** Path to the container-owned outbound DB (messages_out + processing_ack). */
+export function outboundDbPath(agentGroupId: string, sessionId: string): string {
+  return path.join(sessionDir(agentGroupId, sessionId), 'outbound.db');
+}
+
+/** Path to the container heartbeat file (touched instead of DB writes). */
+export function heartbeatPath(agentGroupId: string, sessionId: string): string {
+  return path.join(sessionDir(agentGroupId, sessionId), '.heartbeat');
+}
+
+/**
+ * @deprecated Use inboundDbPath / outboundDbPath instead.
+ * Kept temporarily for test compatibility during migration.
+ */
+export function sessionDbPath(agentGroupId: string, sessionId: string): string {
+  return inboundDbPath(agentGroupId, sessionId);
+}
+
+function generateId(): string {
+  return `sess-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+
+/**
+ * Find or create a session for a messaging group + thread.
+ *
+ * Session modes:
+ * - 'shared': one session per messaging group (ignores threadId)
+ * - 'per-thread': one session per (messaging group, thread)
+ * - 'agent-shared': one session per agent group — all messaging groups
+ *   wired with this mode share a single session (e.g. GitHub + Slack)
+ */
+export function resolveSession(
+  agentGroupId: string,
+  messagingGroupId: string | null,
+  threadId: string | null,
+  sessionMode: 'shared' | 'per-thread' | 'agent-shared',
+): { session: Session; created: boolean } {
+  // agent-shared: single session per agent group, regardless of messaging group
+  if (sessionMode === 'agent-shared') {
+    const existing = findSessionByAgentGroup(agentGroupId);
+    if (existing) {
+      return { session: existing, created: false };
+    }
+  } else if (messagingGroupId) {
+    const lookupThreadId = sessionMode === 'shared' ? null : threadId;
+    // Scope lookup by agent_group_id so fan-out to multiple agents in the
+    // same chat doesn't accidentally deliver to the wrong agent's session.
+    const existing = findSessionForAgent(agentGroupId, messagingGroupId, lookupThreadId);
+    if (existing) {
+      return { session: existing, created: false };
+    }
+  }
+
+  const id = generateId();
+  const lookupThreadId = sessionMode === 'per-thread' ? threadId : null;
+  const session: Session = {
+    id,
+    agent_group_id: agentGroupId,
+    messaging_group_id: messagingGroupId,
+    thread_id: lookupThreadId,
+    agent_provider: null,
+    status: 'active',
+    container_status: 'stopped',
+    last_active: null,
+    created_at: new Date().toISOString(),
+  };
+
+  createSession(session);
+  initSessionFolder(agentGroupId, id);
+  log.info('Session created', { id, agentGroupId, messagingGroupId, threadId: lookupThreadId, sessionMode });
+
+  return { session, created: true };
+}
+
+/** Create the session folder and initialize both DBs. */
+export function initSessionFolder(agentGroupId: string, sessionId: string): void {
+  const dir = sessionDir(agentGroupId, sessionId);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.mkdirSync(path.join(dir, 'outbox'), { recursive: true });
+
+  ensureSchema(inboundDbPath(agentGroupId, sessionId), 'inbound');
+  ensureSchema(outboundDbPath(agentGroupId, sessionId), 'outbound');
+}
+
+/**
+ * Write the default reply routing for a session into its inbound.db.
+ *
+ * The container reads this as the default (channel_type, platform_id, thread_id)
+ * for outbound messages when the agent doesn't specify an explicit destination.
+ * Derived from session.messaging_group_id → messaging_groups row + session.thread_id.
+ *
+ * Called on every container wake alongside the agent-to-agent module's
+ * writeDestinations() (when installed) so the latest routing is always in
+ * place, including after admin rewiring.
+ */
+export function writeSessionRouting(agentGroupId: string, sessionId: string): void {
+  const dbPath = inboundDbPath(agentGroupId, sessionId);
+  if (!fs.existsSync(dbPath)) return;
+
+  const session = getSession(sessionId);
+  if (!session) return;
+
+  let channelType: string | null = null;
+  let platformId: string | null = null;
+  if (session.messaging_group_id) {
+    const mg = getMessagingGroup(session.messaging_group_id);
+    if (mg) {
+      channelType = mg.channel_type;
+      platformId = mg.platform_id;
+    }
+  }
+
+  const db = openInboundDb(agentGroupId, sessionId);
+  try {
+    upsertSessionRouting(db, {
+      channel_type: channelType,
+      platform_id: platformId,
+      thread_id: session.thread_id,
+    });
+  } finally {
+    db.close();
+  }
+  log.debug('Session routing written', { sessionId, channelType, platformId, threadId: session.thread_id });
+}
+
+/**
+ * Write a message to a session's inbound DB (messages_in). Host-only.
+ *
+ * ⚠ Opens and closes the DB on every call. Do not refactor to reuse a
+ * long-lived connection — see the "Cross-mount visibility invariants" note
+ * at the top of this file.
+ */
+export function writeSessionMessage(
+  agentGroupId: string,
+  sessionId: string,
+  message: {
+    id: string;
+    kind: string;
+    timestamp: string;
+    platformId?: string | null;
+    channelType?: string | null;
+    threadId?: string | null;
+    content: string;
+    processAfter?: string | null;
+    recurrence?: string | null;
+    /**
+     * 1 = this message should wake the agent (the default); 0 = accumulate
+     * as context only, don't wake. Host's countDueMessages gates on this
+     * column; the container still reads all prior messages as context when
+     * a trigger-1 message does arrive.
+     */
+    trigger?: 0 | 1;
+  },
+): void {
+  // Extract base64 attachment data, save to inbox, replace with file paths
+  const content = extractAttachmentFiles(agentGroupId, sessionId, message.id, message.content);
+
+  const db = openInboundDb(agentGroupId, sessionId);
+  let inserted: boolean;
+  try {
+    ({ inserted } = insertMessage(db, {
+      id: message.id,
+      kind: message.kind,
+      timestamp: message.timestamp,
+      platformId: message.platformId ?? null,
+      channelType: message.channelType ?? null,
+      threadId: message.threadId ?? null,
+      content,
+      processAfter: message.processAfter ?? null,
+      recurrence: message.recurrence ?? null,
+      trigger: message.trigger ?? 1,
+    }));
+  } finally {
+    db.close();
+  }
+
+  if (!inserted) {
+    log.debug('messages_in id already present — duplicate dispatch, skipping', {
+      agentGroupId,
+      sessionId,
+      messageId: message.id,
+    });
+    return;
+  }
+
+  updateSession(sessionId, { last_active: new Date().toISOString() });
+}
+
+/**
+ * If message content has attachments with base64 `data`, save them to
+ * the session's inbox directory and replace with `localPath`.
+ */
+function extractAttachmentFiles(
+  agentGroupId: string,
+  sessionId: string,
+  messageId: string,
+  contentStr: string,
+): string {
+  let parsed: Record<string, unknown>;
+  try {
+    parsed = JSON.parse(contentStr);
+  } catch {
+    return contentStr;
+  }
+
+  const attachments = parsed.attachments as Array<Record<string, unknown>> | undefined;
+  if (!Array.isArray(attachments)) return contentStr;
+
+  let changed = false;
+  for (const att of attachments) {
+    if (typeof att.data === 'string') {
+      const inboxDir = path.join(sessionDir(agentGroupId, sessionId), 'inbox', messageId);
+      fs.mkdirSync(inboxDir, { recursive: true });
+      const filename = (att.name as string) || `attachment-${Date.now()}`;
+      const filePath = path.join(inboxDir, filename);
+      fs.writeFileSync(filePath, Buffer.from(att.data as string, 'base64'));
+      att.localPath = `inbox/${messageId}/${filename}`;
+      delete att.data;
+      changed = true;
+      log.debug('Saved attachment to inbox', { messageId, filename, size: att.size });
+    }
+  }
+
+  return changed ? JSON.stringify(parsed) : contentStr;
+}
+
+/** Open the inbound DB for a session (host reads/writes). */
+export function openInboundDb(agentGroupId: string, sessionId: string): Database {
+  const db = openInboundDbRaw(inboundDbPath(agentGroupId, sessionId));
+  migrateMessagesInTable(db);
+  return db;
+}
+
+/** Open the outbound DB for a session (host reads only). */
+export function openOutboundDb(agentGroupId: string, sessionId: string): Database {
+  return openOutboundDbRaw(outboundDbPath(agentGroupId, sessionId));
+}
+
+/**
+ * Write a message directly to a session's outbound DB so the host delivery
+ * loop picks it up. Used by the command gate to send denial responses
+ * without waking a container.
+ */
+export function writeOutboundDirect(
+  agentGroupId: string,
+  sessionId: string,
+  message: {
+    id: string;
+    kind: string;
+    platformId: string | null;
+    channelType: string | null;
+    threadId: string | null;
+    content: string;
+  },
+): void {
+  const db = openOutboundDb(agentGroupId, sessionId);
+  try {
+    db.prepare(
+      `INSERT OR IGNORE INTO messages_out (id, seq, timestamp, kind, platform_id, channel_type, thread_id, content)
+       VALUES (?, (SELECT COALESCE(MAX(seq), 0) + 2 FROM messages_out), datetime('now'), ?, ?, ?, ?, ?)`,
+    ).run(message.id, message.kind, message.platformId, message.channelType, message.threadId, message.content);
+  } finally {
+    db.close();
+  }
+}
+
+/**
+ * @deprecated Use openInboundDb / openOutboundDb instead.
+ */
+export function openSessionDb(agentGroupId: string, sessionId: string): Database {
+  return openInboundDb(agentGroupId, sessionId);
+}
+
+/** Write a system response to a session's inbound.db so the container's findQuestionResponse() picks it up. */
+export function writeSystemResponse(
+  agentGroupId: string,
+  sessionId: string,
+  requestId: string,
+  status: string,
+  result: Record<string, unknown>,
+): void {
+  writeSessionMessage(agentGroupId, sessionId, {
+    id: `sys-resp-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+    kind: 'system',
+    timestamp: new Date().toISOString(),
+    content: JSON.stringify({
+      type: 'question_response',
+      questionId: requestId,
+      status,
+      result,
+    }),
+  });
+}
+
+/**
+ * Load outbox attachments for a delivered message.
+ *
+ * Symmetric with `extractAttachmentFiles` on the inbound side: the container
+ * writes files into the session's `outbox/<messageId>/` directory alongside
+ * its `messages_out` row, and the host reads them back at delivery time.
+ *
+ * Returns undefined when the outbox dir is missing or no declared file was
+ * actually on disk — delivery continues without attachments rather than
+ * failing the whole message.
+ */
+export function readOutboxFiles(
+  agentGroupId: string,
+  sessionId: string,
+  messageId: string,
+  filenames: string[],
+): OutboundFile[] | undefined {
+  const outboxDir = path.join(sessionDir(agentGroupId, sessionId), 'outbox', messageId);
+  if (!fs.existsSync(outboxDir)) return undefined;
+  const files: OutboundFile[] = [];
+  for (const filename of filenames) {
+    const filePath = path.join(outboxDir, filename);
+    if (fs.existsSync(filePath)) {
+      files.push({ filename, data: fs.readFileSync(filePath) });
+    } else {
+      log.warn('Outbox file not found', { messageId, filename });
+    }
+  }
+  return files.length > 0 ? files : undefined;
+}
+
+/**
+ * Remove a message's outbox directory after successful delivery. Best-effort:
+ * failures log and swallow. A cleanup failure must NOT propagate to the
+ * delivery caller — the message is already on the user's screen, and a
+ * thrown error would trigger the delivery retry path and deliver twice.
+ */
+export function clearOutbox(agentGroupId: string, sessionId: string, messageId: string): void {
+  const outboxDir = path.join(sessionDir(agentGroupId, sessionId), 'outbox', messageId);
+  if (!fs.existsSync(outboxDir)) return;
+  try {
+    fs.rmSync(outboxDir, { recursive: true, force: true });
+  } catch (err) {
+    log.warn('Outbox cleanup failed (message already delivered)', { messageId, err });
+  }
+}
+
+/** Mark a container as running for a session. */
+export function markContainerRunning(sessionId: string): void {
+  updateSession(sessionId, { container_status: 'running', last_active: new Date().toISOString() });
+}
+
+/** Mark a container as idle for a session. */
+export function markContainerIdle(sessionId: string): void {
+  updateSession(sessionId, { container_status: 'idle' });
+}
+
+/** Mark a container as stopped for a session. */
+export function markContainerStopped(sessionId: string): void {
+  updateSession(sessionId, { container_status: 'stopped' });
+}

package/src/startup-bootstrap.test.ts

@@ -0,0 +1,226 @@
+/**
+ * Tests for the startup bootstrap (`.env` token copy + messaging_groups
+ * v1→v2 backfill). The bootstrap reads from the registry's getActiveAdapters
+ * + readEnvFile, so each test stands up a real central DB plus a fake
+ * adapter and a stubbed env source.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { _resetActiveAdaptersForTest, _setActiveAdapterForTest } from './channels/channel-registry.js';
+import type { ChannelAdapter } from './channels/adapter.js';
+import { createMessagingGroup, getMessagingGroup } from './db/messaging-groups.js';
+import { closeDb, initTestDb } from './db/connection.js';
+import { runMigrations } from './db/migrations/index.js';
+import { getSecret, putSecret } from './secrets/index.js';
+import {
+  backfillMessagingGroupsToV2,
+  bootstrapChannelTokensToSecrets,
+  channelTokenSecretName,
+} from './startup-bootstrap.js';
+
+let envDir: string | null = null;
+let envCwd: string | null = null;
+
+function fakeAdapter(channelType: string, botId: string | null): ChannelAdapter {
+  return {
+    name: channelType,
+    channelType,
+    botId,
+    supportsThreads: false,
+    setup: async () => {},
+    teardown: async () => {},
+    isConnected: () => true,
+    deliver: async () => undefined,
+  };
+}
+
+function writeEnvFile(contents: string): void {
+  envDir = fs.mkdtempSync(path.join(os.tmpdir(), 'paraclaw-bootstrap-test-'));
+  fs.writeFileSync(path.join(envDir, '.env'), contents);
+  envCwd = process.cwd();
+  process.chdir(envDir);
+}
+
+beforeEach(() => {
+  // master.key for AES-GCM lives next to the central DB; use HOME override
+  // (master-key.ts reads ~/.parachute/...) by routing HOME at the top of
+  // each test.
+  process.env.HOME = fs.mkdtempSync(path.join(os.tmpdir(), 'paraclaw-bootstrap-home-'));
+  const db = initTestDb();
+  runMigrations(db);
+});
+
+afterEach(() => {
+  _resetActiveAdaptersForTest();
+  closeDb();
+  if (envCwd) {
+    process.chdir(envCwd);
+    envCwd = null;
+  }
+  if (envDir) {
+    fs.rmSync(envDir, { recursive: true, force: true });
+    envDir = null;
+  }
+  vi.unstubAllEnvs();
+});
+
+describe('backfillMessagingGroupsToV2', () => {
+  it('rewrites legacy telegram:<chatId> → telegram:<botId>:<chatId>', () => {
+    _setActiveAdapterForTest(fakeAdapter('telegram', '8792496425'));
+    createMessagingGroup({
+      id: 'mg-1',
+      channel_type: 'telegram',
+      platform_id: 'telegram:1190596288',
+      name: 'Aaron DM',
+      is_group: 0,
+      unknown_sender_policy: 'strict',
+      created_at: new Date().toISOString(),
+    });
+    const upgraded = backfillMessagingGroupsToV2();
+    expect(upgraded).toBe(1);
+    expect(getMessagingGroup('mg-1')!.platform_id).toBe('telegram:8792496425:1190596288');
+  });
+
+  it('rewrites legacy discord:<guildId>:<channelId> → discord:<botId>:<guildId>:<channelId>', () => {
+    _setActiveAdapterForTest(fakeAdapter('discord', 'app-1'));
+    createMessagingGroup({
+      id: 'mg-2',
+      channel_type: 'discord',
+      platform_id: 'discord:guild999:chan111',
+      name: 'guild',
+      is_group: 1,
+      unknown_sender_policy: 'strict',
+      created_at: new Date().toISOString(),
+    });
+    backfillMessagingGroupsToV2();
+    expect(getMessagingGroup('mg-2')!.platform_id).toBe('discord:app-1:guild999:chan111');
+  });
+
+  it('preserves an @me DM segment intact under the new bot dim', () => {
+    _setActiveAdapterForTest(fakeAdapter('discord', 'app-1'));
+    createMessagingGroup({
+      id: 'mg-3',
+      channel_type: 'discord',
+      platform_id: 'discord:@me:user456',
+      name: 'DM',
+      is_group: 0,
+      unknown_sender_policy: 'strict',
+      created_at: new Date().toISOString(),
+    });
+    backfillMessagingGroupsToV2();
+    expect(getMessagingGroup('mg-3')!.platform_id).toBe('discord:app-1:@me:user456');
+  });
+
+  it('is idempotent — already-v2 rows are not double-prefixed', () => {
+    _setActiveAdapterForTest(fakeAdapter('telegram', 'bot1'));
+    createMessagingGroup({
+      id: 'mg-4',
+      channel_type: 'telegram',
+      platform_id: 'telegram:bot1:1190596288',
+      name: null,
+      is_group: 0,
+      unknown_sender_policy: 'strict',
+      created_at: new Date().toISOString(),
+    });
+    expect(backfillMessagingGroupsToV2()).toBe(0);
+    expect(getMessagingGroup('mg-4')!.platform_id).toBe('telegram:bot1:1190596288');
+    // Second run must also be a no-op.
+    expect(backfillMessagingGroupsToV2()).toBe(0);
+    expect(getMessagingGroup('mg-4')!.platform_id).toBe('telegram:bot1:1190596288');
+  });
+
+  it('does not re-prefix already-v2 rows that belong to a registered-but-not-yet-active secondary bot', () => {
+    // Reproduces the live regression that corrupted TechneRobot's rows on
+    // reboot: only the .env primary adapter is active at boot, but the
+    // secondary bot's CHANNEL_BOT_TOKEN secret is already in the table
+    // (Proposal A: register-bot persists the token before adapter spawn).
+    // The backfill iterates over the primary; if it forgets the secondary's
+    // botId, it sees the secondary's already-v2 row, treats it as v1, and
+    // re-prefixes it under the primary → 4-segment garbage id.
+    _setActiveAdapterForTest(fakeAdapter('telegram', 'primary-bot'));
+    putSecret(channelTokenSecretName('telegram', 'secondary-bot'), 'tg-token-2', {
+      kind: 'channel-token',
+      agent_group_id: null,
+    });
+    createMessagingGroup({
+      id: 'mg-primary',
+      channel_type: 'telegram',
+      platform_id: 'telegram:primary-bot:1190596288',
+      name: null,
+      is_group: 0,
+      unknown_sender_policy: 'strict',
+      created_at: new Date().toISOString(),
+    });
+    createMessagingGroup({
+      id: 'mg-secondary',
+      channel_type: 'telegram',
+      platform_id: 'telegram:secondary-bot:-1002245300962',
+      name: null,
+      is_group: 1,
+      unknown_sender_policy: 'strict',
+      created_at: new Date().toISOString(),
+    });
+
+    expect(backfillMessagingGroupsToV2()).toBe(0);
+    expect(getMessagingGroup('mg-primary')!.platform_id).toBe('telegram:primary-bot:1190596288');
+    expect(getMessagingGroup('mg-secondary')!.platform_id).toBe('telegram:secondary-bot:-1002245300962');
+
+    // Second pass must remain a no-op even with mixed-bot rows present.
+    expect(backfillMessagingGroupsToV2()).toBe(0);
+    expect(getMessagingGroup('mg-primary')!.platform_id).toBe('telegram:primary-bot:1190596288');
+    expect(getMessagingGroup('mg-secondary')!.platform_id).toBe('telegram:secondary-bot:-1002245300962');
+  });
+
+  it('skips channels with no active adapter (e.g. install with only Telegram running)', () => {
+    _setActiveAdapterForTest(fakeAdapter('telegram', 'bot1'));
+    // Discord row with no Discord adapter — must be left untouched until
+    // its adapter comes up on a future restart.
+    createMessagingGroup({
+      id: 'mg-5',
+      channel_type: 'discord',
+      platform_id: 'discord:guild:chan',
+      name: null,
+      is_group: 1,
+      unknown_sender_policy: 'strict',
+      created_at: new Date().toISOString(),
+    });
+    backfillMessagingGroupsToV2();
+    expect(getMessagingGroup('mg-5')!.platform_id).toBe('discord:guild:chan');
+  });
+});
+
+describe('bootstrapChannelTokensToSecrets', () => {
+  it('copies TELEGRAM_BOT_TOKEN into a per-bot secret row keyed by botId', () => {
+    writeEnvFile('TELEGRAM_BOT_TOKEN=tg-secret-token\n');
+    _setActiveAdapterForTest(fakeAdapter('telegram', '8792496425'));
+    bootstrapChannelTokensToSecrets();
+    const name = channelTokenSecretName('telegram', '8792496425');
+    expect(getSecret(name)).toBe('tg-secret-token');
+  });
+
+  it('is idempotent — re-running with the same value does not duplicate', () => {
+    writeEnvFile('TELEGRAM_BOT_TOKEN=tg-secret-token\n');
+    _setActiveAdapterForTest(fakeAdapter('telegram', 'bot1'));
+    bootstrapChannelTokensToSecrets();
+    bootstrapChannelTokensToSecrets();
+    expect(getSecret(channelTokenSecretName('telegram', 'bot1'))).toBe('tg-secret-token');
+  });
+
+  it('skips adapters without a botId (e.g. CLI admin transport)', () => {
+    writeEnvFile('TELEGRAM_BOT_TOKEN=tg-secret-token\n');
+    _setActiveAdapterForTest(fakeAdapter('cli', null));
+    bootstrapChannelTokensToSecrets();
+    expect(getSecret('CHANNEL_BOT_TOKEN:cli:')).toBeUndefined();
+  });
+
+  it('skips channels with no env var mapping (no-op for unknown channels)', () => {
+    writeEnvFile('SOMETHING_ELSE=x\n');
+    _setActiveAdapterForTest(fakeAdapter('whatsapp', 'wa-bot'));
+    bootstrapChannelTokensToSecrets();
+    expect(getSecret(channelTokenSecretName('whatsapp', 'wa-bot'))).toBeUndefined();
+  });
+});