@rubytech/create-maxy-code 0.1.550 → 0.1.551

package/payload/platform/plugins/telegram/mcp/dist/lib/account-write.js

@@ -4,11 +4,28 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
  *  with platform/ui/server/public-host-gate.ts PUBLIC_ALLOWED_PREFIXES — a unit
  *  test asserts they agree. The official plugin's /channels/telegram is NOT this. */
 export const CANONICAL_TELEGRAM_PREFIX = "/api/telegram/";
-/** Persist the bot token + access policy into account.json's telegram block.
+/** Task 2368 — duplicated from platform/ui/app/lib/telegram/bot-registry.ts.
+ *  The plugin cannot import from platform/ui/app, the same boundary that makes
+ *  configDirName and the secret path duplicates; telegram-account-write.test.ts
+ *  asserts the two derivations agree. */
+export function botIdFromToken(token) {
+    const i = token.indexOf(":");
+    if (i <= 0)
+        return null;
+    const id = token.slice(0, i);
+    return /^\d+$/.test(id) ? id : null;
+}
+/** Persist one bot entry into account.json's `telegram.bots` array, replacing
+ *  any entry with the same id and leaving every other entry byte-identical.
+ *
+ *  Task 2368 — registering, re-pointing or removing one bot cannot disturb
+ *  another, which the two-slot shape could not promise: a second admin bot
+ *  overwrote the first's token AND its adminUsers in one write.
+ *
  *  Brand-isolated: account.json lives under the install's data/accounts. Returns
- *  the resolved account.json directory so the caller can log + assert it is under
- *  the brand install (never ~/.claude). */
-export function persistTelegramConfig(platformRoot, accountId, input) {
+ *  the resolved account.json directory so the caller can log + assert it is
+ *  under the brand install (never ~/.claude). */
+export function persistTelegramBot(platformRoot, accountId, entry) {
     const accountsDir = resolve(platformRoot, "..", "data", "accounts");
     const dir = join(accountsDir, accountId);
     const configPath = join(dir, "account.json");
@@ -33,18 +50,13 @@ export function persistTelegramConfig(platformRoot, accountId, input) {
         return { ok: false, error: `account.json parse failed: ${e.message}` };
     }
     const telegram = config.telegram ?? {};
-    if (input.botType === "admin") {
-        telegram.adminBotToken = input.botToken;
-        if (input.adminUsers)
-            telegram.adminUsers = input.adminUsers;
-    }
-    else {
-        telegram.publicBotToken = input.botToken;
-        if (input.dmPolicy)
-            telegram.dmPolicy = input.dmPolicy;
-        if (input.allowFrom)
-            telegram.allowFrom = input.allowFrom;
-    }
+    const bots = Array.isArray(telegram.bots) ? telegram.bots : [];
+    const at = bots.findIndex((b) => b && typeof b === "object" && b.id === entry.id);
+    if (at >= 0)
+        bots[at] = entry;
+    else
+        bots.push(entry);
+    telegram.bots = bots;
     config.telegram = telegram;
     writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
     return { ok: true, dir };

package/payload/platform/plugins/telegram/mcp/dist/lib/account-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-write.js","sourceRoot":"","sources":["../../src/lib/account-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAElE;;qFAEqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAU1D;;;2CAG2C;AAC3C,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,SAAiB,EACjB,KAAmB;IAEnB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,UAAU,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAI,MAAM,CAAC,QAAoC,IAAI,EAAE,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC9B,QAAQ,CAAC,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC;QACxC,IAAI,KAAK,CAAC,UAAU;YAAE,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC;QACzC,IAAI,KAAK,CAAC,QAAQ;YAAE,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACvD,IAAI,KAAK,CAAC,SAAS;YAAE,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAC5D,CAAC;IACD,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"account-write.js","sourceRoot":"","sources":["../../src/lib/account-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAElE;;qFAEqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D;;;yCAGyC;AACzC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAaD;;;;;;;;;iDASiD;AACjD,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,SAAiB,EACjB,KAA4B;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,UAAU,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAI,MAAM,CAAC,QAAoC,IAAI,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;;QACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.d.ts

@@ -0,0 +1,12 @@
+/** The account's own directory under the brand install. */
+export declare function accountDirFor(platformRoot: string, accountId: string): string;
+/** Task 2368 — is `slug` an ACTIVE agent on this account?
+ *
+ *  Duplicated from platform/ui/app/lib/claude-agent/account.ts
+ *  `isActiveAgentSlug`, which the plugin cannot import across the
+ *  plugin/platform boundary. Same predicate: status must be exactly "active",
+ *  and a missing agent dir or config resolves to no status, so this also
+ *  rejects a nonexistent slug. telegram-agent-active.test.ts asserts the two
+ *  agree. A bot may only be paired to an agent that can actually answer. */
+export declare function isActiveAgentSlug(accountDir: string, slug: string): boolean;
+//# sourceMappingURL=agent-active.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-active.d.ts","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAGA,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;;4EAO4E;AAC5E,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ3E"}

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.js

@@ -0,0 +1,26 @@
+import { resolve, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+/** The account's own directory under the brand install. */
+export function accountDirFor(platformRoot, accountId) {
+    return join(resolve(platformRoot, "..", "data", "accounts"), accountId);
+}
+/** Task 2368 — is `slug` an ACTIVE agent on this account?
+ *
+ *  Duplicated from platform/ui/app/lib/claude-agent/account.ts
+ *  `isActiveAgentSlug`, which the plugin cannot import across the
+ *  plugin/platform boundary. Same predicate: status must be exactly "active",
+ *  and a missing agent dir or config resolves to no status, so this also
+ *  rejects a nonexistent slug. telegram-agent-active.test.ts asserts the two
+ *  agree. A bot may only be paired to an agent that can actually answer. */
+export function isActiveAgentSlug(accountDir, slug) {
+    const configPath = join(accountDir, "agents", slug, "config.json");
+    if (!existsSync(configPath))
+        return false;
+    try {
+        return JSON.parse(readFileSync(configPath, "utf-8")).status === "active";
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=agent-active.js.map

package/payload/platform/plugins/telegram/mcp/dist/lib/agent-active.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-active.js","sourceRoot":"","sources":["../../src/lib/agent-active.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,SAAiB;IACnE,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;4EAO4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,IAAY;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA0B,CAAC,MAAM,KAAK,QAAQ,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/secret-path.d.ts

@@ -1,16 +1,19 @@
 export declare function configDirName(): string;
-/** Derive the webhook secret file path. Restricted to two known filename stems
- *  so botType can never contribute a traversal.
+/** The directory holding one secret file per registered bot. Created mode 700
+ *  by the register tool; the secrets themselves are 600. */
+export declare function telegramSecretsDir(): string;
+/** Task 2368 — the webhook secret path, keyed on the bot's own Telegram id.
  *
- *  Task 2365 — the accountId suffix. Before it, one install had one secret file
- *  per bot type, so a second account registering an admin bot overwrote the
- *  first account's secret and broke it with no signal. The reader
- *  (platform/ui/server/routes/telegram.ts secretPath) builds the same string;
- *  the duplication across the plugin/platform boundary is deliberate and
- *  ui/server/__tests__/telegram-secret-path.test.ts asserts the two agree. */
-export declare function resolveSecretFilePath(botType: "public" | "admin", accountId: string): string;
-/** The un-suffixed path this install used before Task 2365. The register tool
- *  deletes it after a successful re-registration so a stale, install-wide
- *  secret cannot outlive the migration. */
-export declare function legacySecretFilePath(botType: "public" | "admin"): string;
+ *  Task 2365 keyed on (account, botType), which cannot express N bots in one
+ *  account: a second admin bot in one account would overwrite the first's
+ *  secret and break it with no signal. The bot id can, and it is the same
+ *  value the registered URL names, so the file and the URL cannot disagree.
+ *  The reader (platform/ui/server/routes/telegram.ts secretPath) builds the
+ *  same string; the duplication across the plugin/platform boundary is
+ *  deliberate and ui/server/__tests__/telegram-secret-path.test.ts asserts the
+ *  two agree.
+ *
+ *  `botId` is digits by construction (botIdFromToken rejects anything else), so
+ *  it cannot contribute a traversal. */
+export declare function resolveSecretFilePath(botId: string): string;
 //# sourceMappingURL=secret-path.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/lib/secret-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-path.d.ts","sourceRoot":"","sources":["../../src/lib/secret-path.ts"],"names":[],"mappings":"AAYA,wBAAgB,aAAa,IAAI,MAAM,CAWtC;AAED;;;;;;;;8EAQ8E;AAC9E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAM5F;AAED;;2CAE2C;AAC3C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAKxE"}
+{"version":3,"file":"secret-path.d.ts","sourceRoot":"","sources":["../../src/lib/secret-path.ts"],"names":[],"mappings":"AAYA,wBAAgB,aAAa,IAAI,MAAM,CAWtC;AAED;4DAC4D;AAC5D,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;;;;;;;wCAYwC;AACxC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/payload/platform/plugins/telegram/mcp/dist/lib/secret-path.js

@@ -22,29 +22,25 @@ export function configDirName() {
     }
     return ".maxy";
 }
-/** Derive the webhook secret file path. Restricted to two known filename stems
- *  so botType can never contribute a traversal.
- *
- *  Task 2365 — the accountId suffix. Before it, one install had one secret file
- *  per bot type, so a second account registering an admin bot overwrote the
- *  first account's secret and broke it with no signal. The reader
- *  (platform/ui/server/routes/telegram.ts secretPath) builds the same string;
- *  the duplication across the plugin/platform boundary is deliberate and
- *  ui/server/__tests__/telegram-secret-path.test.ts asserts the two agree. */
-export function resolveSecretFilePath(botType, accountId) {
-    const maxyDir = resolve(homedir(), configDirName());
-    const stem = botType === "admin"
-        ? ".telegram-admin-webhook-secret"
-        : ".telegram-webhook-secret";
-    return resolve(maxyDir, `${stem}.${accountId}`);
+/** The directory holding one secret file per registered bot. Created mode 700
+ *  by the register tool; the secrets themselves are 600. */
+export function telegramSecretsDir() {
+    return resolve(homedir(), configDirName(), "telegram-secrets");
 }
-/** The un-suffixed path this install used before Task 2365. The register tool
- *  deletes it after a successful re-registration so a stale, install-wide
- *  secret cannot outlive the migration. */
-export function legacySecretFilePath(botType) {
-    const stem = botType === "admin"
-        ? ".telegram-admin-webhook-secret"
-        : ".telegram-webhook-secret";
-    return resolve(homedir(), configDirName(), stem);
+/** Task 2368 — the webhook secret path, keyed on the bot's own Telegram id.
+ *
+ *  Task 2365 keyed on (account, botType), which cannot express N bots in one
+ *  account: a second admin bot in one account would overwrite the first's
+ *  secret and break it with no signal. The bot id can, and it is the same
+ *  value the registered URL names, so the file and the URL cannot disagree.
+ *  The reader (platform/ui/server/routes/telegram.ts secretPath) builds the
+ *  same string; the duplication across the plugin/platform boundary is
+ *  deliberate and ui/server/__tests__/telegram-secret-path.test.ts asserts the
+ *  two agree.
+ *
+ *  `botId` is digits by construction (botIdFromToken rejects anything else), so
+ *  it cannot contribute a traversal. */
+export function resolveSecretFilePath(botId) {
+    return resolve(telegramSecretsDir(), botId);
 }
 //# sourceMappingURL=secret-path.js.map

package/payload/platform/plugins/telegram/mcp/dist/lib/secret-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-path.js","sourceRoot":"","sources":["../../src/lib/secret-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,2EAA2E;AAC3E,uEAAuE;AACvE,mCAAmC;AACnC,EAAE;AACF,wDAAwD;AACxD,6EAA6E;AAC7E,0EAA0E;AAC1E,kEAAkE;AAClE,MAAM,UAAU,aAAa;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;8EAQ8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,OAA2B,EAAE,SAAiB;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,OAAO,KAAK,OAAO;QAC9B,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,0BAA0B,CAAC;IAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;2CAE2C;AAC3C,MAAM,UAAU,oBAAoB,CAAC,OAA2B;IAC9D,MAAM,IAAI,GAAG,OAAO,KAAK,OAAO;QAC9B,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,0BAA0B,CAAC;IAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"secret-path.js","sourceRoot":"","sources":["../../src/lib/secret-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,2EAA2E;AAC3E,uEAAuE;AACvE,mCAAmC;AACnC,EAAE;AACF,wDAAwD;AACxD,6EAA6E;AAC7E,0EAA0E;AAC1E,kEAAkE;AAClE,MAAM,UAAU,aAAa;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4DAC4D;AAC5D,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;wCAYwC;AACxC,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/lib/webhook-url.d.ts

@@ -1,8 +1,10 @@
-/** Task 2365 — stamp the registering spawn's own account onto the webhook URL.
- *  The route requires it and validates it against listValidAccounts(); an
- *  operator transcribing it from a skill file is the failure mode this task
- *  exists to fix, so the tool builds it. An account the caller already supplied
- *  is overwritten: the spawn's ACCOUNT_ID is the only authority on which
- *  account this registration belongs to. */
-export declare function buildWebhookUrl(webhookUrl: string, accountId: string): string;
+/** Task 2368 — stamp the bot's own id onto the webhook URL.
+ *
+ *  It supersedes Task 2365's `account=`: a bot id already determines its
+ *  account, and carrying both would be two authorities for one fact. Any `bot`
+ *  the caller supplied is overwritten and any `account` is removed — the token
+ *  this registration carries is the only authority on which bot it is for, and
+ *  an operator transcribing either from a skill file is the failure mode this
+ *  builder exists to remove. */
+export declare function buildWebhookUrl(webhookUrl: string, botId: string): string;
 //# sourceMappingURL=webhook-url.d.ts.map

package/payload/platform/plugins/telegram/mcp/dist/lib/webhook-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-url.d.ts","sourceRoot":"","sources":["../../src/lib/webhook-url.ts"],"names":[],"mappings":"AAAA;;;;;4CAK4C;AAC5C,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAI7E"}
+{"version":3,"file":"webhook-url.d.ts","sourceRoot":"","sources":["../../src/lib/webhook-url.ts"],"names":[],"mappings":"AAAA;;;;;;;gCAOgC;AAChC,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKzE"}

package/payload/platform/plugins/telegram/mcp/dist/lib/webhook-url.js

@@ -1,12 +1,15 @@
-/** Task 2365 — stamp the registering spawn's own account onto the webhook URL.
- *  The route requires it and validates it against listValidAccounts(); an
- *  operator transcribing it from a skill file is the failure mode this task
- *  exists to fix, so the tool builds it. An account the caller already supplied
- *  is overwritten: the spawn's ACCOUNT_ID is the only authority on which
- *  account this registration belongs to. */
-export function buildWebhookUrl(webhookUrl, accountId) {
+/** Task 2368 — stamp the bot's own id onto the webhook URL.
+ *
+ *  It supersedes Task 2365's `account=`: a bot id already determines its
+ *  account, and carrying both would be two authorities for one fact. Any `bot`
+ *  the caller supplied is overwritten and any `account` is removed — the token
+ *  this registration carries is the only authority on which bot it is for, and
+ *  an operator transcribing either from a skill file is the failure mode this
+ *  builder exists to remove. */
+export function buildWebhookUrl(webhookUrl, botId) {
     const u = new URL(webhookUrl);
-    u.searchParams.set("account", accountId);
+    u.searchParams.delete("account");
+    u.searchParams.set("bot", botId);
     return u.toString();
 }
 //# sourceMappingURL=webhook-url.js.map

package/payload/platform/plugins/telegram/mcp/dist/lib/webhook-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-url.js","sourceRoot":"","sources":["../../src/lib/webhook-url.ts"],"names":[],"mappings":"AAAA;;;;;4CAK4C;AAC5C,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAAiB;IACnE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"webhook-url.js","sourceRoot":"","sources":["../../src/lib/webhook-url.ts"],"names":[],"mappings":"AAAA;;;;;;;gCAOgC;AAChC,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,KAAa;IAC/D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC"}

package/payload/platform/plugins/telegram/mcp/dist/tools/message.d.ts

@@ -1,5 +1,9 @@
 interface MessageParams {
     channel: "telegram";
+    /** Task 2368 — which registered bot to send as. An account holds N bots, each
+     *  with its own token, so "the account's token" is no longer a thing that can
+     *  be resolved without naming one. */
+    botId: string;
     chatId: string | number;
     text: string;
     parseMode?: "HTML" | "Markdown" | "MarkdownV2";

package/payload/platform/plugins/telegram/mcp/dist/tools/message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../src/tools/message.ts"],"names":[],"mappings":"AAGA,UAAU,aAAa;IACrB,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,YAAY,CAAC;IAC/C,cAAc,CAAC,EAAE,KAAK,CACpB,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAC7D,CAAC;CACH;AAED,UAAU,aAAa;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAwC3E"}
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../src/tools/message.ts"],"names":[],"mappings":"AAGA,UAAU,aAAa;IACrB,OAAO,EAAE,UAAU,CAAC;IACpB;;0CAEsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,YAAY,CAAC;IAC/C,cAAc,CAAC,EAAE,KAAK,CACpB,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAC7D,CAAC;CACH;AAED,UAAU,aAAa;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAiD3E"}

package/payload/platform/plugins/telegram/mcp/dist/tools/message.js

@@ -1,14 +1,24 @@
 import { sendMessage } from "../lib/telegram.js";
-import { resolveBotToken } from "../lib/account-token.js";
+import { resolveBotToken, listRegisteredBots } from "../lib/account-token.js";
 export async function message(params) {
     const platformRoot = process.env.PLATFORM_ROOT;
     const accountId = process.env.ACCOUNT_ID;
-    const botToken = platformRoot && accountId ? resolveBotToken(platformRoot, accountId) : null;
+    const botToken = platformRoot && accountId ? resolveBotToken(platformRoot, accountId, params.botId) : null;
     if (!botToken) {
+        // Task 2368 — an account holds N bots and nothing else surfaces their ids to
+        // an agent, so the refusal enumerates them rather than failing opaquely. A
+        // caller that named the wrong bot, or guessed, gets the right answer here and
+        // succeeds on its next call. It never picks one: which bot a message goes out
+        // on is the caller's decision, and choosing would put a stranger's message on
+        // the operator's own bot.
+        const registered = platformRoot && accountId ? listRegisteredBots(platformRoot, accountId) : [];
+        const known = registered.length === 0
+            ? "This account has no Telegram bot registered — run telegram:configure first."
+            : `This account's registered bots: ${registered.map((b) => `${b.id} (${b.role}${b.agent ? `, ${b.agent}` : ""})`).join("; ")}.`;
         return {
             sent: false,
             channel: params.channel,
-            error: "No Telegram bot token in account.json telegram block — run telegram:configure first",
+            error: `No Telegram bot "${params.botId}" is registered on this account. ${known}`,
         };
     }
     let replyMarkup;

package/payload/platform/plugins/telegram/mcp/dist/tools/message.js.map

@@ -1 +1 @@
-{"version":3,"file":"message.js","sourceRoot":"","sources":["../../src/tools/message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAA+B,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAmB1D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAqB;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzC,MAAM,QAAQ,GACZ,YAAY,IAAI,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EACH,qFAAqF;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,WAA+C,CAAC;IACpD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,WAAW,GAAG;YACZ,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,aAAa,EAAE,GAAG,CAAC,YAAY;gBAC/B,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC,CAAC,CACJ;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,EAAE;QACf,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"message.js","sourceRoot":"","sources":["../../src/tools/message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAA+B,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAuB9E,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAqB;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzC,MAAM,QAAQ,GACZ,YAAY,IAAI,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,6EAA6E;QAC7E,2EAA2E;QAC3E,8EAA8E;QAC9E,8EAA8E;QAC9E,8EAA8E;QAC9E,0BAA0B;QAC1B,MAAM,UAAU,GAAG,YAAY,IAAI,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC;YACnC,CAAC,CAAC,6EAA6E;YAC/E,CAAC,CAAC,mCAAmC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAClI,OAAO;YACL,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,oBAAoB,MAAM,CAAC,KAAK,oCAAoC,KAAK,EAAE;SACnF,CAAC;IACJ,CAAC;IAED,IAAI,WAA+C,CAAC;IACpD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,WAAW,GAAG;YACZ,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,aAAa,EAAE,GAAG,CAAC,YAAY;gBAC/B,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC,CAAC,CACJ;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,EAAE;QACf,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/telegram/references/setup-guide.md

@@ -15,22 +15,30 @@ Setup happens entirely in the admin chat — there is no settings page to click
 1. Tell the admin agent: "I want to connect a Telegram bot." The agent runs the `telegram:configure` skill.
 2. Paste the bot token from BotFather when the agent asks.
 3. Tell the agent whether this is an **admin bot** or a **public bot** (see below).
-4. For an admin bot, give the agent the numeric Telegram user IDs that should have admin access. For a public bot, choose a DM policy (who can message it) and, for a whitelist, the allowed numeric IDs.
-5. The agent verifies the token, registers the webhook on the brand's edge path, stores the token under the brand install, and — for a public bot — sets the agent that will respond.
-6. The agent confirms the bot is connected. Message the bot; the reply comes back from the agent.
+4. For an admin bot, give the agent the numeric Telegram user IDs that should have admin access. For a public bot, choose which of your agents answers on it, a DM policy (who can message it), and, for a whitelist, the allowed numeric IDs.
+5. The agent verifies the token, registers the webhook on the brand's edge path, and stores the bot under the brand install.
+6. The agent confirms the bot is connected. Message the bot; the reply comes back from the agent you chose.
 
 The token is stored in your account config under the brand install (never in a shared `~/.claude` directory), and the webhook is registered on the `/api/telegram/` path the brand's edge admits.
 
-The bot belongs to the account you set it up from. The agent stamps that account onto the registered address and gives the bot its own secret, so setting up a bot for one account never disturbs another account's bot. If you connected a bot before this changed, it stops delivering until you run the setup once more; the agent can tell you which one from the standing check.
+## How Many Bots You Can Have
+
+As many as you like. Your account holds a list of bots, and each one is its own thing: its own token, its own role, its own list of who may message it, and — for a public bot — its own agent. Adding, re-pointing or removing one bot never touches another, in your account or anyone else's.
+
+Each bot is identified by its own Telegram id, which is the part of the token before the colon. The agent reads it off the token you paste, puts it on the registered address for you, and gives that bot its own secret file. You never type it.
+
+Two people talking to two of your bots are two separate conversations, and so are one person talking to two of them: each bot keeps its own thread with each person.
+
+If you connected a bot before this changed, it stops delivering until you run the setup once more. The agent can tell you which ones from the standing check.
 
 ## Admin Bot vs Public Bot
 
-Each Telegram bot has an **Admin routing** toggle:
+Every bot is one or the other, and you say which when you set it up. It is not worked out from anything else.
 
-- **Admin bot** (toggle ON): Only users with admin bindings can message this bot. Everyone else is silently denied. Messages route to the admin agent. No DM policy applies — it's admin-only by design.
-- **Public bot** (toggle OFF): DM policy applies to everyone equally, including admins. Messages route to the public agent. Use this for customer-facing bots.
+- **Admin bot**: only the numeric Telegram IDs you listed for THAT bot can message it. Everyone else is silently denied. It answers as your admin agent, with your account's tools.
+- **Public bot**: customer-facing. A DM policy decides who may message it, and it answers as the agent you named when you set it up. That agent has to be one of your account's active agents; if you switch the agent off later, the bot stops answering and says so rather than falling back to another one.
 
-A common setup is two bots: one admin bot for the business owner, one public bot for customers.
+A common setup is two bots: one admin bot for the business owner, one public bot for customers. Nothing stops you having five.
 
 ## Finding Your Telegram User ID
 

package/payload/platform/plugins/telegram/skills/configure/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: configure
-description: Guide the user through connecting a Telegram bot entirely via the admin chat — store the BotFather token under the brand install, register the webhook on the maxy edge-admitted path, set access policy, and select the agent. Complete PTY setup, no UI clicks.
+description: Guide the user through connecting a Telegram bot entirely via the admin chat — store the BotFather token under the brand install, register the webhook on the maxy edge-admitted path, set the bot's role and access policy, and pair a public bot to one of the account's agents. An account may hold any number of bots. Complete PTY setup, no UI clicks.
 ---
 
 # Configure Telegram
@@ -15,11 +15,14 @@ User says anything about connecting, linking, or setting up Telegram, BotFather,
 
 A finished Telegram setup has all of these, and the skill is not done until each is true:
 
-- The bot token from BotFather is stored in `account.json`'s `telegram` block (under the brand install, never `~/.claude/`). The `telegram-webhook-register` tool writes it there and logs `[telegram-setup] op=token-write dir=… brand=…`.
-- The webhook is registered against a URL whose path is `/api/telegram/` (the only path the maxy edge admits). The register tool refuses any other path and logs `op=webhook-register path=… account=… admitted=false` when it does.
-- The registered URL carries `account=<accountId>`, naming the account this bot belongs to. The register tool appends it from the calling account, so you never type it. The receiver requires it and rejects `reason=missing-account-param`; without it, one install's accounts would all read the same bot config.
-- Access policy is set: admin bots carry the operator's numeric Telegram user IDs (`adminUsers`); public bots carry a DM policy (and an allowlist when the policy is `allowlist`).
-- For a public bot, `account.json` `defaultAgent` names an existing public agent. Without it, public inbound is dropped with `op=reject reason=no-default-agent`.
+- The bot is stored as one entry in `account.json`'s `telegram.bots` array (under the brand install, never `~/.claude/`). The `telegram-webhook-register` tool writes it there and logs `[telegram-setup] op=token-write dir=… brand=…`.
+- The webhook is registered against a URL whose path is `/api/telegram/` (the only path the maxy edge admits). The register tool refuses any other path and logs `op=webhook-register path=… botId=… account=… admitted=false` when it does.
+- The registered URL carries `bot=<botId>`, the bot's own Telegram id. The register tool derives it from the token and appends it, so you never type it. The receiver requires it and rejects `reason=unknown-bot`; the bot id is what determines the account, so no `account=` is carried.
+- The bot's `role` is stated, not inferred: `admin` or `public`. It selects the spawn path, so it is a privilege decision.
+- Access policy is set **on that entry**: an admin bot carries the operator's numeric Telegram user IDs (`adminUsers`); a public bot carries a DM policy (and an allowlist when the policy is `allowlist`). Nothing is shared with the account's other bots.
+- A public bot names the `agent` it answers as, and that agent is active. An admin bot names none: it reads `agents/admin` by construction.
+
+An account may hold any number of bots. Registering, re-pointing or removing one never disturbs another, in any account.
 
 ## Flow
 
@@ -29,54 +32,48 @@ Read `references/setup-guide.md` (cited throughout this flow) with the `plugin-r
 
 Follow `references/setup-guide.md` "Creating a Bot": the operator creates the bot via @BotFather and gives you the token (e.g. `123456:ABC-DEF…`). Confirm you have it before continuing.
 
-### Step 2 — Decide admin or public
+### Step 2 — Decide the role, and for a public bot its agent
+
+Ask which role this bot serves (see `references/setup-guide.md` "Admin Bot vs Public Bot"). The role is stated by the operator, never worked out from anything else: it decides which spawn path the bot's messages take.
 
-Ask which role this bot serves (see `references/setup-guide.md` "Admin Bot vs Public Bot"):
+- **Admin bot** — only the numeric Telegram user IDs the operator names for THIS bot may message it; everything else is denied. Collect those IDs (`references/setup-guide.md` "Finding Your Telegram User ID"). It answers as the admin agent.
+- **Public bot** — customer-facing; choose a DM policy (`open`, `allowlist`, or `disabled`), for `allowlist` the allowed numeric IDs, and **which of this account's agents answers on it**. Call `account-manage` to list the account's agents and let the operator pick one. The agent must be active; the register tool refuses an inactive or unknown slug.
 
-- **Admin bot** — only the operator's numeric Telegram user IDs may message it; everything else is denied. Collect those IDs (`references/setup-guide.md` "Finding Your Telegram User ID").
-- **Public bot** — customer-facing; choose a DM policy (`open`, `allowlist`, or `disabled`) and, for `allowlist`, the allowed numeric IDs.
+The account may already hold other bots. This one is added alongside them and shares nothing with them.
 
 ### Step 3 — Build the webhook URL
 
-The path MUST be `/api/telegram/` with `?bot=admin` or `?bot=public`. Use the account's domain for the host — the admin domain for an admin bot, the public domain for a public bot (read them from `brand-settings` / the account config). Example: `https://<admin-domain>/api/telegram/?bot=admin`.
+The path MUST be `/api/telegram/`. Use the account's domain for the host — the admin domain for an admin bot, the public domain for a public bot (read them from `brand-settings` / the account config). Example: `https://<admin-domain>/api/telegram/`.
 
-Do NOT add `?account=`. The register tool appends it from the calling account, which is the only authority on which account the bot belongs to; a value you type could name a different one.
+Do NOT add `?bot=` or `?account=`. The register tool derives the bot id from the token and stamps `?bot=<botId>` on for you; the token is the only authority on which bot it is, and a value typed by hand could name a different one.
 
 The register tool aborts on any other path, so do not invent `/channels/telegram` or similar.
 
-### Step 4 — Register (stores token + policy + webhook + secret in one call)
+### Step 4 — Register (stores the entry + webhook + secret in one call)
 
 Call `telegram-webhook-register` with:
 - `botToken` — the BotFather token
 - `webhookUrl` — the URL from Step 3
-- `botType` — `admin` or `public`
+- `role` — `admin` or `public`
 - admin bot: `adminUsers` — the numeric IDs from Step 2
-- public bot: `dmPolicy` and, for `allowlist`, `allowFrom`
-
-On success the tool has: verified the token, set the webhook with a generated secret (written to the brand configDir), persisted the token + policy into `account.json`'s `telegram` block, and logged `op=token-write` + `op=webhook-register admitted=true`. If it returns an error, read it back to the operator verbatim — the common ones are a wrong path (`admitted=false`) or a token write blocked outside the brand install (`op=token-write-rejected`).
-
-### Step 5 — Select the agent (public bot)
-
-Public inbound routes to the account's `defaultAgent`. Set it and confirm:
-
-1. `account-manage` to list available public agents.
-2. `account-update` with `field: "defaultAgent"`, `value: "<slug>"`.
-3. Re-read by calling `account-manage` (or `account-update` reports the change) and confirm `defaultAgent` is the chosen slug. The post-condition is a non-empty `defaultAgent`, not the intent to set it.
+- public bot: `agent` — the slug from Step 2, plus `dmPolicy` and, for `allowlist`, `allowFrom`
 
-An admin bot does not need `defaultAgent` — admin inbound routes to the admin agent.
+On success the tool has: verified the token, derived the bot id, set the webhook with a generated secret (written to `~/.<brand>/telegram-secrets/<botId>`), persisted the entry into `account.json`'s `telegram.bots` array, and logged `op=token-write` + `op=webhook-register admitted=true`. It replaces only the entry with this bot's id, so the account's other bots are untouched. If it returns an error, read it back to the operator verbatim — the common ones are a wrong path (`admitted=false`), a public bot with no or an inactive `agent` (`op=token-write-rejected reason=no-agent|agent-inactive`), or a token write blocked outside the brand install.
 
-### Step 6 — Confirm
+### Step 5 — Confirm
 
-Tell the operator the bot is connected, which role it has, and that messaging the bot now reaches the agent and a reply returns. For a public bot, name the agent that will respond.
+Tell the operator the bot is connected, which role it has, and that messaging the bot now reaches the agent and a reply returns. For a public bot, name the agent that will respond. If the account holds other bots, say that this one is separate from them: its own people, its own agent, its own conversations.
 
 ## Failure modes (state these loudly, do not paper over)
 
 - **Wrong webhook path** — register returns an error and logs `op=webhook-register admitted=false`. Fix the URL to use `/api/telegram/`.
 - **Token write outside the brand** — `op=token-write-rejected reason=non-brand-path`. The MCP env is misconfigured; do not retry blindly — report it.
-- **`defaultAgent` unset on a public bot** — inbound is dropped with `[telegram-inbound] op=reject reason=no-default-agent`. Complete Step 5.
-- **Bad secret on inbound** — `[telegram-inbound] op=reject reason=bad-secret` means the registered secret and the stored secret diverged; re-run register.
-- **Bot registered before per-account webhooks** — `[telegram-inbound] op=reject reason=missing-account-param`, and `[telegram-audit] … secretFile=absent` names the account. The registered URL predates `account=`; re-run register once for that bot. There is no compatibility branch, so it 401s until you do.
-- **Chat id claimed by two accounts** — a scheduled dispatch logs `[schedule-inject] op=telegram-destination-ambiguous … dispatched=no`. Two accounts list the same numeric ID in their `adminUsers`. Remove it from the one that should not have it; the dispatch refuses rather than guessing.
+- **Paired agent switched off** — `[telegram-inbound] op=agent … active=false` then `op=reject reason=agent-inactive`, and the standing `[telegram-audit] op=entry-agent-inactive` names the bot. Re-activate that agent or re-register the bot against another. There is no fall back to a different agent: answering as an agent the operator switched off is exactly what this refusal prevents.
+- **Bad secret on inbound** — `[telegram-inbound] op=secret … result=mismatch` means the registered secret and the stored secret diverged; re-run register.
+- **Bot registered before the bot registry** — `[telegram-inbound] op=reject reason=unknown-bot`, and `[telegram-audit] op=configured … secretFile=absent` names it. The registered URL predates `?bot=<botId>`; re-run register once for that bot. There is no compatibility branch, so it 401s until you do. The boot converter rewrites the stored config but cannot re-point a registered webhook: that is an outbound call, and the converter makes none.
+- **One bot id claimed by two accounts** — inbound is refused `[telegram-inbound] op=reject reason=duplicate-bot-id`, and the standing `[telegram-audit] op=duplicate-bot-id` names it every tick. Two accounts hold the same token. Remove it from the one that should not have it; nothing picks between them.
+- **Chat id claimed by two bots** — a scheduled dispatch logs `[schedule-inject] op=telegram-destination-ambiguous … dispatched=no`. Two bots, in one account or two, list the same numeric ID in their `adminUsers`. Remove it from the one that should not have it; the dispatch refuses rather than guessing which bot the person should hear from.
+- **A secret file with no bot, or a bot with no secret file** — `[telegram-audit] op=secret-orphan botId=… side=file|entry`. Neither shows up any other way. `side=entry` means that bot cannot receive anything until it re-registers; `side=file` is left-over state from a bot that has been removed.
 
 ## Language
 
@@ -84,3 +81,4 @@ Use plain English:
 - "bot token" not "Bot API credential"
 - "your numeric Telegram ID" not "user_id integer"
 - "the bot is connected" not "webhook registered with secret_token"
+- "which of your agents should answer on this bot" not "the agentSlug for the entry"