@spacebar_ai/moldclaw-core 2026.3.41 → 2026.3.44

package/dist/channel-DUtyN7BX.js

@@ -1,4681 +0,0 @@
-import { t as formatDocsLink } from "./links-BcahUP5U.js";
-import { Ah as createScopedPairingAccess, Ew as applySetupAccountConfigPatch, HC as createAccountListHelpers, Is as formatInboundFromLabel$1, KC as buildComputedAccountStatusSnapshot, LT as collectAllowlistProviderRestrictSendersWarnings, Nd as resolveDmGroupAccessWithLists, Od as DM_GROUP_ACCESS_REASON, Pd as resolveEffectiveAllowFromLists, Qg as buildPendingHistoryContextFromMap, Tw as applyAccountNameToChannelSection, UT as deleteAccountFromConfigSection, Ug as logInboundDrop, Uw as resolveControlCommandGate, Vs as buildModelsProviderData, WS as createDedupeCache, WT as setAccountEnabledInConfigSection, Wg as logTypingFailure, Za as resolveStoredModelOverride, ag as createTypingCallbacks, bS as readRequestBodyWithLimit, dT as createScopedAccountConfigAccessors, e_ as clearHistoryEntriesIfEnabled, ec as listSkillCommandsForAgents, ig as buildSecretInputSchema, jh as buildAgentMediaPayload, kT as buildAccountScopedDmSecurityPolicy, kd as readStoreAllowFromForDmPolicy, kw as migrateBaseNameToDefaultAccount, nT as resolveAllowlistMatchSimple, nh as resolveChannelMediaMaxBytes, ow as resolveChannelGroupRequireMention, qy as getAgentScopedMediaLocalRoots, rC as loadSessionStore, r_ as recordPendingHistoryEntryIfEnabled, sg as createReplyPrefixOptions, tC as isDangerousNameMatchingEnabled, vS as isRequestBodyLimitError, xs as registerPluginHttpRoute } from "./auth-profiles-1kPLbBwI.js";
-import { w as normalizeProviderId } from "./model-selection-hL8i1Jbs.js";
-import { d as resolveThreadSessionKeys$1 } from "./session-key-UoG7Kfw5.js";
-import { n as normalizeAccountId, t as DEFAULT_ACCOUNT_ID } from "./account-id-BuyZMNja.js";
-import { a as hasConfiguredSecretInput, c as normalizeResolvedSecretInputString, l as normalizeSecretInputString } from "./types.secrets-Ca-9L8vU.js";
-import { F as requireOpenAllowFrom, a as DmPolicySchema, c as GroupPolicySchema, m as MarkdownConfigSchema, n as BlockStreamingCoalesceSchema } from "./zod-schema.core-DvwgNmpd.js";
-import { a as isTrustedProxyAddress, l as resolveClientIp } from "./net-K181nxTH.js";
-import { t as rawDataToString } from "./ws-Bd4lOIoI.js";
-import { c as resolveAllowlistProviderRuntimeGroupPolicy, f as warnMissingProviderGroupPolicyFallbackOnce, i as evaluateSenderGroupAccessForPolicy, l as resolveDefaultGroupPolicy } from "./group-access-UAqUyJod.js";
-import { r as buildChannelConfigSchema } from "./config-schema-BNU4GQh_.js";
-import { i as parseStrictPositiveInteger } from "./parse-finite-number-U5TetQpk.js";
-import { l as resolveStorePath } from "./paths-ApLcu1Uu.js";
-import { n as formatNormalizedAllowFromEntries } from "./allow-from-Brz0jyla.js";
-import { t as createPluginRuntimeStore } from "./runtime-store-DTqHvPYo.js";
-import { t as createAccountStatusSink } from "./channel-lifecycle-DA5pCpey.js";
-import { t as loadOutboundMediaFromUrl } from "./outbound-media-DYRO2vTD.js";
-import { n as buildPassiveProbedChannelStatusSummary } from "./channel-status-summary-DfvQV-Ir.js";
-import { t as requireChannelOpenAllowFrom } from "./config-schema-helpers-D4ZGZ7dA.js";
-import { createHash, createHmac, timingSafeEqual } from "node:crypto";
-import { z } from "zod";
-import WebSocket$1 from "ws";
-//#region extensions/mattermost/src/config-schema.ts
-const MattermostSlashCommandsSchema = z.object({
-	native: z.union([z.boolean(), z.literal("auto")]).optional(),
-	nativeSkills: z.union([z.boolean(), z.literal("auto")]).optional(),
-	callbackPath: z.string().optional(),
-	callbackUrl: z.string().optional()
-}).strict().optional();
-const MattermostAccountSchemaBase = z.object({
-	name: z.string().optional(),
-	capabilities: z.array(z.string()).optional(),
-	dangerouslyAllowNameMatching: z.boolean().optional(),
-	markdown: MarkdownConfigSchema,
-	enabled: z.boolean().optional(),
-	configWrites: z.boolean().optional(),
-	botToken: buildSecretInputSchema().optional(),
-	baseUrl: z.string().optional(),
-	chatmode: z.enum([
-		"oncall",
-		"onmessage",
-		"onchar"
-	]).optional(),
-	oncharPrefixes: z.array(z.string()).optional(),
-	requireMention: z.boolean().optional(),
-	dmPolicy: DmPolicySchema.optional().default("pairing"),
-	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
-	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
-	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
-	textChunkLimit: z.number().int().positive().optional(),
-	chunkMode: z.enum(["length", "newline"]).optional(),
-	blockStreaming: z.boolean().optional(),
-	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
-	replyToMode: z.enum([
-		"off",
-		"first",
-		"all"
-	]).optional(),
-	responsePrefix: z.string().optional(),
-	actions: z.object({ reactions: z.boolean().optional() }).optional(),
-	commands: MattermostSlashCommandsSchema,
-	interactions: z.object({
-		callbackBaseUrl: z.string().optional(),
-		allowedSourceIps: z.array(z.string()).optional()
-	}).optional()
-}).strict();
-const MattermostAccountSchema = MattermostAccountSchemaBase.superRefine((value, ctx) => {
-	requireChannelOpenAllowFrom({
-		channel: "mattermost",
-		policy: value.dmPolicy,
-		allowFrom: value.allowFrom,
-		ctx,
-		requireOpenAllowFrom
-	});
-});
-const MattermostConfigSchema = MattermostAccountSchemaBase.extend({
-	accounts: z.record(z.string(), MattermostAccountSchema.optional()).optional(),
-	defaultAccount: z.string().optional()
-}).superRefine((value, ctx) => {
-	requireChannelOpenAllowFrom({
-		channel: "mattermost",
-		policy: value.dmPolicy,
-		allowFrom: value.allowFrom,
-		ctx,
-		requireOpenAllowFrom
-	});
-});
-//#endregion
-//#region extensions/mattermost/src/mattermost/client.ts
-function normalizeMattermostBaseUrl(raw) {
-	const trimmed = raw?.trim();
-	if (!trimmed) return;
-	return trimmed.replace(/\/+$/, "").replace(/\/api\/v4$/i, "");
-}
-function buildMattermostApiUrl(baseUrl, path) {
-	const normalized = normalizeMattermostBaseUrl(baseUrl);
-	if (!normalized) throw new Error("Mattermost baseUrl is required");
-	return `${normalized}/api/v4${path.startsWith("/") ? path : `/${path}`}`;
-}
-async function readMattermostError(res) {
-	if ((res.headers.get("content-type") ?? "").includes("application/json")) {
-		const data = await res.json();
-		if (data?.message) return data.message;
-		return JSON.stringify(data);
-	}
-	return await res.text();
-}
-function createMattermostClient(params) {
-	const baseUrl = normalizeMattermostBaseUrl(params.baseUrl);
-	if (!baseUrl) throw new Error("Mattermost baseUrl is required");
-	const apiBaseUrl = `${baseUrl}/api/v4`;
-	const token = params.botToken.trim();
-	const fetchImpl = params.fetchImpl ?? fetch;
-	const request = async (path, init) => {
-		const url = buildMattermostApiUrl(baseUrl, path);
-		const headers = new Headers(init?.headers);
-		headers.set("Authorization", `Bearer ${token}`);
-		if (typeof init?.body === "string" && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-		const res = await fetchImpl(url, {
-			...init,
-			headers
-		});
-		if (!res.ok) {
-			const detail = await readMattermostError(res);
-			throw new Error(`Mattermost API ${res.status} ${res.statusText}: ${detail || "unknown error"}`);
-		}
-		if (res.status === 204) return;
-		if ((res.headers.get("content-type") ?? "").includes("application/json")) return await res.json();
-		return await res.text();
-	};
-	return {
-		baseUrl,
-		apiBaseUrl,
-		token,
-		request
-	};
-}
-async function fetchMattermostMe(client) {
-	return await client.request("/users/me");
-}
-async function fetchMattermostUser(client, userId) {
-	return await client.request(`/users/${userId}`);
-}
-async function fetchMattermostUserByUsername(client, username) {
-	return await client.request(`/users/username/${encodeURIComponent(username)}`);
-}
-async function fetchMattermostChannel(client, channelId) {
-	return await client.request(`/channels/${channelId}`);
-}
-async function fetchMattermostChannelByName(client, teamId, channelName) {
-	return await client.request(`/teams/${teamId}/channels/name/${encodeURIComponent(channelName)}`);
-}
-async function sendMattermostTyping(client, params) {
-	const payload = { channel_id: params.channelId };
-	const parentId = params.parentId?.trim();
-	if (parentId) payload.parent_id = parentId;
-	await client.request("/users/me/typing", {
-		method: "POST",
-		body: JSON.stringify(payload)
-	});
-}
-async function createMattermostDirectChannel(client, userIds) {
-	return await client.request("/channels/direct", {
-		method: "POST",
-		body: JSON.stringify(userIds)
-	});
-}
-async function createMattermostPost(client, params) {
-	const payload = {
-		channel_id: params.channelId,
-		message: params.message
-	};
-	if (params.rootId) payload.root_id = params.rootId;
-	if (params.fileIds?.length) payload.file_ids = params.fileIds;
-	if (params.props) payload.props = params.props;
-	return await client.request("/posts", {
-		method: "POST",
-		body: JSON.stringify(payload)
-	});
-}
-async function fetchMattermostUserTeams(client, userId) {
-	return await client.request(`/users/${userId}/teams`);
-}
-async function updateMattermostPost(client, postId, params) {
-	const payload = { id: postId };
-	if (params.message !== void 0) payload.message = params.message;
-	if (params.props !== void 0) payload.props = params.props;
-	return await client.request(`/posts/${postId}`, {
-		method: "PUT",
-		body: JSON.stringify(payload)
-	});
-}
-async function uploadMattermostFile(client, params) {
-	const form = new FormData();
-	const fileName = params.fileName?.trim() || "upload";
-	const bytes = Uint8Array.from(params.buffer);
-	const blob = params.contentType ? new Blob([bytes], { type: params.contentType }) : new Blob([bytes]);
-	form.append("files", blob, fileName);
-	form.append("channel_id", params.channelId);
-	const res = await fetch(`${client.apiBaseUrl}/files`, {
-		method: "POST",
-		headers: { Authorization: `Bearer ${client.token}` },
-		body: form
-	});
-	if (!res.ok) {
-		const detail = await readMattermostError(res);
-		throw new Error(`Mattermost API ${res.status} ${res.statusText}: ${detail || "unknown error"}`);
-	}
-	const info = (await res.json()).file_infos?.[0];
-	if (!info?.id) throw new Error("Mattermost file upload failed");
-	return info;
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/accounts.ts
-const { listAccountIds: listMattermostAccountIds, resolveDefaultAccountId: resolveDefaultMattermostAccountId } = createAccountListHelpers("mattermost");
-function resolveAccountConfig(cfg, accountId) {
-	const accounts = cfg.channels?.mattermost?.accounts;
-	if (!accounts || typeof accounts !== "object") return;
-	return accounts[accountId];
-}
-function mergeMattermostAccountConfig(cfg, accountId) {
-	const { accounts: _ignored, defaultAccount: _ignoredDefaultAccount, ...base } = cfg.channels?.mattermost ?? {};
-	const account = resolveAccountConfig(cfg, accountId) ?? {};
-	const mergedCommands = {
-		...base.commands ?? {},
-		...account.commands ?? {}
-	};
-	const merged = {
-		...base,
-		...account
-	};
-	if (Object.keys(mergedCommands).length > 0) merged.commands = mergedCommands;
-	return merged;
-}
-function resolveMattermostRequireMention(config) {
-	if (config.chatmode === "oncall") return true;
-	if (config.chatmode === "onmessage") return false;
-	if (config.chatmode === "onchar") return true;
-	return config.requireMention;
-}
-function resolveMattermostAccount(params) {
-	const accountId = normalizeAccountId(params.accountId);
-	const baseEnabled = params.cfg.channels?.mattermost?.enabled !== false;
-	const merged = mergeMattermostAccountConfig(params.cfg, accountId);
-	const accountEnabled = merged.enabled !== false;
-	const enabled = baseEnabled && accountEnabled;
-	const allowEnv = accountId === DEFAULT_ACCOUNT_ID;
-	const envToken = allowEnv ? process.env.MATTERMOST_BOT_TOKEN?.trim() : void 0;
-	const envUrl = allowEnv ? process.env.MATTERMOST_URL?.trim() : void 0;
-	const configToken = params.allowUnresolvedSecretRef ? normalizeSecretInputString(merged.botToken) : normalizeResolvedSecretInputString({
-		value: merged.botToken,
-		path: `channels.mattermost.accounts.${accountId}.botToken`
-	});
-	const configUrl = merged.baseUrl?.trim();
-	const botToken = configToken || envToken;
-	const baseUrl = normalizeMattermostBaseUrl(configUrl || envUrl);
-	const requireMention = resolveMattermostRequireMention(merged);
-	const botTokenSource = configToken ? "config" : envToken ? "env" : "none";
-	const baseUrlSource = configUrl ? "config" : envUrl ? "env" : "none";
-	return {
-		accountId,
-		enabled,
-		name: merged.name?.trim() || void 0,
-		botToken,
-		baseUrl,
-		botTokenSource,
-		baseUrlSource,
-		config: merged,
-		chatmode: merged.chatmode,
-		oncharPrefixes: merged.oncharPrefixes,
-		requireMention,
-		textChunkLimit: merged.textChunkLimit,
-		blockStreaming: merged.blockStreaming,
-		blockStreamingCoalesce: merged.blockStreamingCoalesce
-	};
-}
-/**
-* Resolve the effective replyToMode for a given chat type.
-* Mattermost auto-threading only applies to channel and group messages.
-*/
-function resolveMattermostReplyToMode(account, kind) {
-	if (kind === "direct") return "off";
-	return account.config.replyToMode ?? "off";
-}
-//#endregion
-//#region extensions/mattermost/src/group-mentions.ts
-function resolveMattermostGroupRequireMention(params) {
-	const account = resolveMattermostAccount({
-		cfg: params.cfg,
-		accountId: params.accountId
-	});
-	const requireMentionOverride = typeof params.requireMentionOverride === "boolean" ? params.requireMentionOverride : account.requireMention;
-	return resolveChannelGroupRequireMention({
-		cfg: params.cfg,
-		channel: "mattermost",
-		groupId: params.groupId,
-		accountId: params.accountId,
-		requireMentionOverride
-	});
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/directory.ts
-function buildClient(params) {
-	const account = resolveMattermostAccount({
-		cfg: params.cfg,
-		accountId: params.accountId
-	});
-	if (!account.enabled || !account.botToken || !account.baseUrl) return null;
-	return createMattermostClient({
-		baseUrl: account.baseUrl,
-		botToken: account.botToken
-	});
-}
-/**
-* Build clients from ALL enabled accounts (deduplicated by token).
-*
-* We always scan every account because:
-* - Private channels are only visible to bots that are members
-* - The requesting agent's account may have an expired/invalid token
-*
-* This means a single healthy bot token is enough for directory discovery.
-*/
-function buildClients(params) {
-	const accountIds = listMattermostAccountIds(params.cfg);
-	const seen = /* @__PURE__ */ new Set();
-	const clients = [];
-	for (const id of accountIds) {
-		const client = buildClient({
-			cfg: params.cfg,
-			accountId: id
-		});
-		if (client && !seen.has(client.token)) {
-			seen.add(client.token);
-			clients.push(client);
-		}
-	}
-	return clients;
-}
-/**
-* List channels (public + private) visible to any configured bot account.
-*
-* NOTE: Uses per_page=200 which covers most instances. Mattermost does not
-* return a "has more" indicator, so very large instances (200+ channels per bot)
-* may see incomplete results. Pagination can be added if needed.
-*/
-async function listMattermostDirectoryGroups(params) {
-	const clients = buildClients(params);
-	if (!clients.length) return [];
-	const q = params.query?.trim().toLowerCase() || "";
-	const seenIds = /* @__PURE__ */ new Set();
-	const entries = [];
-	for (const client of clients) try {
-		const me = await fetchMattermostMe(client);
-		const channels = await client.request(`/users/${me.id}/channels?per_page=200`);
-		for (const ch of channels) {
-			if (ch.type !== "O" && ch.type !== "P") continue;
-			if (seenIds.has(ch.id)) continue;
-			if (q) {
-				const name = (ch.name ?? "").toLowerCase();
-				const display = (ch.display_name ?? "").toLowerCase();
-				if (!name.includes(q) && !display.includes(q)) continue;
-			}
-			seenIds.add(ch.id);
-			entries.push({
-				kind: "group",
-				id: `channel:${ch.id}`,
-				name: ch.name ?? void 0,
-				handle: ch.display_name ?? void 0
-			});
-		}
-	} catch (err) {
-		console.debug?.("[mattermost-directory] listGroups: skipping account:", err?.message);
-		continue;
-	}
-	return params.limit && params.limit > 0 ? entries.slice(0, params.limit) : entries;
-}
-/**
-* List team members as peer directory entries.
-*
-* Uses only the first available client since all bots in a team see the same
-* user list (unlike channels where membership varies). Uses the first team
-* returned — multi-team setups will only see members from that team.
-*
-* NOTE: per_page=200 for member listing; same pagination caveat as groups.
-*/
-async function listMattermostDirectoryPeers(params) {
-	const clients = buildClients(params);
-	if (!clients.length) return [];
-	const client = clients[0];
-	try {
-		const me = await fetchMattermostMe(client);
-		const teams = await client.request("/users/me/teams");
-		if (!teams.length) return [];
-		const teamId = teams[0].id;
-		const q = params.query?.trim().toLowerCase() || "";
-		let users;
-		if (q) users = await client.request("/users/search", {
-			method: "POST",
-			body: JSON.stringify({
-				term: q,
-				team_id: teamId
-			})
-		});
-		else {
-			const userIds = (await client.request(`/teams/${teamId}/members?per_page=200`)).map((m) => m.user_id).filter((id) => id !== me.id);
-			if (!userIds.length) return [];
-			users = await client.request("/users/ids", {
-				method: "POST",
-				body: JSON.stringify(userIds)
-			});
-		}
-		const entries = users.filter((u) => u.id !== me.id).map((u) => ({
-			kind: "user",
-			id: `user:${u.id}`,
-			name: u.username ?? void 0,
-			handle: [u.first_name, u.last_name].filter(Boolean).join(" ").trim() || u.nickname || void 0
-		}));
-		return params.limit && params.limit > 0 ? entries.slice(0, params.limit) : entries;
-	} catch (err) {
-		console.debug?.("[mattermost-directory] listPeers failed:", err?.message);
-		return [];
-	}
-}
-//#endregion
-//#region extensions/mattermost/src/runtime.ts
-const { setRuntime: setMattermostRuntime, getRuntime: getMattermostRuntime } = createPluginRuntimeStore("Mattermost runtime not initialized");
-//#endregion
-//#region extensions/mattermost/src/mattermost/interactions.ts
-const INTERACTION_MAX_BODY_BYTES = 64 * 1024;
-const INTERACTION_BODY_TIMEOUT_MS = 1e4;
-const SIGNED_CHANNEL_ID_CONTEXT_KEY = "__moldclaw_channel_id";
-const callbackUrls = /* @__PURE__ */ new Map();
-function setInteractionCallbackUrl(accountId, url) {
-	callbackUrls.set(accountId, url);
-}
-function resolveInteractionCallbackPath(accountId) {
-	return `/mattermost/interactions/${accountId}`;
-}
-function isWildcardBindHost(rawHost) {
-	const trimmed = rawHost.trim();
-	if (!trimmed) return false;
-	const host = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
-	return host === "0.0.0.0" || host === "::" || host === "0:0:0:0:0:0:0:0" || host === "::0";
-}
-function normalizeCallbackBaseUrl(baseUrl) {
-	return baseUrl.trim().replace(/\/+$/, "");
-}
-function headerValue(value) {
-	if (Array.isArray(value)) return value[0]?.trim() || void 0;
-	return value?.trim() || void 0;
-}
-function isAllowedInteractionSource(params) {
-	const { allowedSourceIps } = params;
-	if (!allowedSourceIps?.length) return true;
-	return isTrustedProxyAddress(resolveClientIp({
-		remoteAddr: params.req.socket?.remoteAddress,
-		forwardedFor: headerValue(params.req.headers["x-forwarded-for"]),
-		realIp: headerValue(params.req.headers["x-real-ip"]),
-		trustedProxies: params.trustedProxies,
-		allowRealIpFallback: params.allowRealIpFallback
-	}), allowedSourceIps);
-}
-/**
-* Resolve the interaction callback URL for an account.
-* Falls back to computing it from interactions.callbackBaseUrl or gateway host config.
-*/
-function computeInteractionCallbackUrl(accountId, cfg) {
-	const path = resolveInteractionCallbackPath(accountId);
-	const callbackBaseUrl = cfg?.interactions?.callbackBaseUrl?.trim() ?? cfg?.channels?.mattermost?.interactions?.callbackBaseUrl?.trim();
-	if (callbackBaseUrl) return `${normalizeCallbackBaseUrl(callbackBaseUrl)}${path}`;
-	const port = typeof cfg?.gateway?.port === "number" ? cfg.gateway.port : 18789;
-	let host = cfg?.gateway?.customBindHost && !isWildcardBindHost(cfg.gateway.customBindHost) ? cfg.gateway.customBindHost.trim() : "localhost";
-	if (host.includes(":") && !(host.startsWith("[") && host.endsWith("]"))) host = `[${host}]`;
-	return `http://${host}:${port}${path}`;
-}
-/**
-* Resolve the interaction callback URL for an account.
-* Prefers the in-memory registered URL (set by the gateway monitor) so callers outside the
-* monitor lifecycle can reuse the runtime-validated callback destination.
-*/
-function resolveInteractionCallbackUrl(accountId, cfg) {
-	const cached = callbackUrls.get(accountId);
-	if (cached) return cached;
-	return computeInteractionCallbackUrl(accountId, cfg);
-}
-const interactionSecrets = /* @__PURE__ */ new Map();
-let defaultInteractionSecret;
-function deriveInteractionSecret(botToken) {
-	return createHmac("sha256", "moldclaw-mattermost-interactions").update(botToken).digest("hex");
-}
-function setInteractionSecret(accountIdOrBotToken, botToken) {
-	if (typeof botToken === "string") {
-		interactionSecrets.set(accountIdOrBotToken, deriveInteractionSecret(botToken));
-		return;
-	}
-	defaultInteractionSecret = deriveInteractionSecret(accountIdOrBotToken);
-}
-function getInteractionSecret(accountId) {
-	const scoped = accountId ? interactionSecrets.get(accountId) : void 0;
-	if (scoped) return scoped;
-	if (defaultInteractionSecret) return defaultInteractionSecret;
-	if (interactionSecrets.size === 1) {
-		const first = interactionSecrets.values().next().value;
-		if (typeof first === "string") return first;
-	}
-	throw new Error("Interaction secret not initialized — call setInteractionSecret(accountId, botToken) first");
-}
-function canonicalizeInteractionContext(value) {
-	if (Array.isArray(value)) return value.map((item) => canonicalizeInteractionContext(item));
-	if (value && typeof value === "object") {
-		const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entryValue]) => [key, canonicalizeInteractionContext(entryValue)]);
-		return Object.fromEntries(entries);
-	}
-	return value;
-}
-function generateInteractionToken(context, accountId) {
-	const secret = getInteractionSecret(accountId);
-	const payload = JSON.stringify(canonicalizeInteractionContext(context));
-	return createHmac("sha256", secret).update(payload).digest("hex");
-}
-function verifyInteractionToken(context, token, accountId) {
-	const expected = generateInteractionToken(context, accountId);
-	if (expected.length !== token.length) return false;
-	return timingSafeEqual(Buffer.from(expected), Buffer.from(token));
-}
-/**
-* Build Mattermost `props.attachments` with interactive buttons.
-*
-* Each button includes an HMAC token in its integration context so the
-* callback handler can verify the request originated from a legitimate
-* button click (Mattermost's recommended security pattern).
-*/
-/**
-* Sanitize a button ID so Mattermost's action router can match it.
-* Mattermost uses the action ID in the URL path `/api/v4/posts/{id}/actions/{actionId}`
-* and IDs containing hyphens or underscores break the server-side routing.
-* See: https://github.com/mattermost/mattermost/issues/25747
-*/
-function sanitizeActionId(id) {
-	return id.replace(/[-_]/g, "");
-}
-function buildButtonAttachments(params) {
-	const actions = params.buttons.map((btn) => {
-		const safeId = sanitizeActionId(btn.id);
-		const context = {
-			action_id: safeId,
-			...btn.context
-		};
-		const token = generateInteractionToken(context, params.accountId);
-		return {
-			id: safeId,
-			type: "button",
-			name: btn.name,
-			style: btn.style,
-			integration: {
-				url: params.callbackUrl,
-				context: {
-					...context,
-					_token: token
-				}
-			}
-		};
-	});
-	return [{
-		text: params.text ?? "",
-		actions
-	}];
-}
-function buildButtonProps(params) {
-	const buttons = params.buttons.flatMap((item) => Array.isArray(item) ? item : [item]).map((btn) => ({
-		id: String(btn.id ?? btn.callback_data ?? "").trim(),
-		name: String(btn.text ?? btn.name ?? btn.label ?? "").trim(),
-		style: btn.style ?? "default",
-		context: typeof btn.context === "object" && btn.context !== null ? {
-			...btn.context,
-			[SIGNED_CHANNEL_ID_CONTEXT_KEY]: params.channelId
-		} : { [SIGNED_CHANNEL_ID_CONTEXT_KEY]: params.channelId }
-	})).filter((btn) => btn.id && btn.name);
-	if (buttons.length === 0) return;
-	return { attachments: buildButtonAttachments({
-		callbackUrl: params.callbackUrl,
-		accountId: params.accountId,
-		buttons,
-		text: params.text
-	}) };
-}
-function readInteractionBody(req) {
-	return new Promise((resolve, reject) => {
-		const chunks = [];
-		let totalBytes = 0;
-		const timer = setTimeout(() => {
-			req.destroy();
-			reject(/* @__PURE__ */ new Error("Request body read timeout"));
-		}, INTERACTION_BODY_TIMEOUT_MS);
-		req.on("data", (chunk) => {
-			totalBytes += chunk.length;
-			if (totalBytes > INTERACTION_MAX_BODY_BYTES) {
-				req.destroy();
-				clearTimeout(timer);
-				reject(/* @__PURE__ */ new Error("Request body too large"));
-				return;
-			}
-			chunks.push(chunk);
-		});
-		req.on("end", () => {
-			clearTimeout(timer);
-			resolve(Buffer.concat(chunks).toString("utf8"));
-		});
-		req.on("error", (err) => {
-			clearTimeout(timer);
-			reject(err);
-		});
-	});
-}
-function createMattermostInteractionHandler(params) {
-	const { client, accountId, log } = params;
-	const core = getMattermostRuntime();
-	return async (req, res) => {
-		if (req.method !== "POST") {
-			res.statusCode = 405;
-			res.setHeader("Allow", "POST");
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Method Not Allowed" }));
-			return;
-		}
-		if (!isAllowedInteractionSource({
-			req,
-			allowedSourceIps: params.allowedSourceIps,
-			trustedProxies: params.trustedProxies,
-			allowRealIpFallback: params.allowRealIpFallback
-		})) {
-			log?.(`mattermost interaction: rejected callback source remote=${req.socket?.remoteAddress ?? "?"}`);
-			res.statusCode = 403;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Forbidden origin" }));
-			return;
-		}
-		let payload;
-		try {
-			const raw = await readInteractionBody(req);
-			payload = JSON.parse(raw);
-		} catch (err) {
-			log?.(`mattermost interaction: failed to parse body: ${String(err)}`);
-			res.statusCode = 400;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Invalid request body" }));
-			return;
-		}
-		const context = payload.context;
-		if (!context) {
-			res.statusCode = 400;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Missing context" }));
-			return;
-		}
-		const token = context._token;
-		if (typeof token !== "string") {
-			log?.("mattermost interaction: missing _token in context");
-			res.statusCode = 403;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Missing token" }));
-			return;
-		}
-		const { _token, ...contextWithoutToken } = context;
-		if (!verifyInteractionToken(contextWithoutToken, token, accountId)) {
-			log?.("mattermost interaction: invalid _token");
-			res.statusCode = 403;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Invalid token" }));
-			return;
-		}
-		const actionId = context.action_id;
-		if (typeof actionId !== "string") {
-			res.statusCode = 400;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Missing action_id in context" }));
-			return;
-		}
-		const signedChannelId = typeof contextWithoutToken[SIGNED_CHANNEL_ID_CONTEXT_KEY] === "string" ? contextWithoutToken[SIGNED_CHANNEL_ID_CONTEXT_KEY].trim() : "";
-		if (signedChannelId && signedChannelId !== payload.channel_id) {
-			log?.(`mattermost interaction: signed channel mismatch payload=${payload.channel_id} signed=${signedChannelId}`);
-			res.statusCode = 403;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Channel mismatch" }));
-			return;
-		}
-		const userName = payload.user_name ?? payload.user_id;
-		let originalMessage = "";
-		let originalPost = null;
-		let clickedButtonName = null;
-		try {
-			originalPost = await client.request(`/posts/${payload.post_id}`);
-			const postChannelId = originalPost.channel_id?.trim();
-			if (!postChannelId || postChannelId !== payload.channel_id) {
-				log?.(`mattermost interaction: post channel mismatch payload=${payload.channel_id} post=${postChannelId ?? "<missing>"}`);
-				res.statusCode = 403;
-				res.setHeader("Content-Type", "application/json");
-				res.end(JSON.stringify({ error: "Post/channel mismatch" }));
-				return;
-			}
-			originalMessage = originalPost.message ?? "";
-			const postAttachments = Array.isArray(originalPost?.props?.attachments) ? originalPost.props.attachments : [];
-			for (const att of postAttachments) {
-				const match = att.actions?.find((a) => a.id === actionId);
-				if (match?.name) {
-					clickedButtonName = match.name;
-					break;
-				}
-			}
-			if (clickedButtonName === null) {
-				log?.(`mattermost interaction: action ${actionId} not found in post ${payload.post_id}`);
-				res.statusCode = 403;
-				res.setHeader("Content-Type", "application/json");
-				res.end(JSON.stringify({ error: "Unknown action" }));
-				return;
-			}
-		} catch (err) {
-			log?.(`mattermost interaction: failed to validate post ${payload.post_id}: ${String(err)}`);
-			res.statusCode = 500;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Failed to validate interaction" }));
-			return;
-		}
-		if (!originalPost) {
-			log?.(`mattermost interaction: missing fetched post ${payload.post_id}`);
-			res.statusCode = 500;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Failed to load interaction post" }));
-			return;
-		}
-		log?.(`mattermost interaction: action=${actionId} user=${payload.user_name ?? payload.user_id} post=${payload.post_id} channel=${payload.channel_id}`);
-		if (params.authorizeButtonClick) try {
-			const authorization = await params.authorizeButtonClick({
-				payload,
-				post: originalPost
-			});
-			if (!authorization.ok) {
-				res.statusCode = authorization.statusCode ?? 200;
-				res.setHeader("Content-Type", "application/json");
-				res.end(JSON.stringify(authorization.response ?? { ephemeral_text: "You are not allowed to use this action here." }));
-				return;
-			}
-		} catch (err) {
-			log?.(`mattermost interaction: authorization failed: ${String(err)}`);
-			res.statusCode = 500;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Interaction authorization failed" }));
-			return;
-		}
-		if (params.handleInteraction) try {
-			const response = await params.handleInteraction({
-				payload,
-				userName,
-				actionId,
-				actionName: clickedButtonName,
-				originalMessage,
-				context: contextWithoutToken,
-				post: originalPost
-			});
-			if (response !== null) {
-				res.statusCode = 200;
-				res.setHeader("Content-Type", "application/json");
-				res.end(JSON.stringify(response));
-				return;
-			}
-		} catch (err) {
-			log?.(`mattermost interaction: custom handler failed: ${String(err)}`);
-			res.statusCode = 500;
-			res.setHeader("Content-Type", "application/json");
-			res.end(JSON.stringify({ error: "Interaction handler failed" }));
-			return;
-		}
-		try {
-			const eventLabel = `Mattermost button click: action="${actionId}" by ${payload.user_name ?? payload.user_id} in channel ${payload.channel_id}`;
-			const sessionKey = params.resolveSessionKey ? await params.resolveSessionKey({
-				channelId: payload.channel_id,
-				userId: payload.user_id,
-				post: originalPost
-			}) : `agent:main:mattermost:${accountId}:${payload.channel_id}`;
-			core.system.enqueueSystemEvent(eventLabel, {
-				sessionKey,
-				contextKey: `mattermost:interaction:${payload.post_id}:${actionId}`
-			});
-		} catch (err) {
-			log?.(`mattermost interaction: system event dispatch failed: ${String(err)}`);
-		}
-		try {
-			await updateMattermostPost(client, payload.post_id, {
-				message: originalMessage,
-				props: { attachments: [{ text: `✓ **${clickedButtonName}** selected by @${userName}` }] }
-			});
-		} catch (err) {
-			log?.(`mattermost interaction: failed to update post ${payload.post_id}: ${String(err)}`);
-		}
-		res.statusCode = 200;
-		res.setHeader("Content-Type", "application/json");
-		res.end("{}");
-		if (params.dispatchButtonClick) try {
-			await params.dispatchButtonClick({
-				channelId: payload.channel_id,
-				userId: payload.user_id,
-				userName,
-				actionId,
-				actionName: clickedButtonName,
-				postId: payload.post_id,
-				post: originalPost
-			});
-		} catch (err) {
-			log?.(`mattermost interaction: dispatchButtonClick failed: ${String(err)}`);
-		}
-	};
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/model-picker.ts
-const MATTERMOST_MODEL_PICKER_CONTEXT_KEY = "oc_model_picker";
-const MODELS_PAGE_SIZE = 8;
-const ACTION_IDS = {
-	providers: "mdlprov",
-	list: "mdllist",
-	select: "mdlsel",
-	back: "mdlback"
-};
-function splitModelRef(modelRef) {
-	const match = (modelRef?.trim())?.match(/^([^/]+)\/(.+)$/u);
-	if (!match) return null;
-	const provider = normalizeProviderId(match[1]);
-	const model = match[2].trim();
-	if (!provider || !model) return null;
-	return {
-		provider,
-		model
-	};
-}
-function normalizePage(value) {
-	if (!Number.isFinite(value)) return 1;
-	return Math.max(1, Math.floor(value));
-}
-function paginateItems(items, page, pageSize = MODELS_PAGE_SIZE) {
-	const totalPages = Math.max(1, Math.ceil(items.length / pageSize));
-	const safePage = Math.max(1, Math.min(normalizePage(page), totalPages));
-	const start = (safePage - 1) * pageSize;
-	return {
-		items: items.slice(start, start + pageSize),
-		page: safePage,
-		totalPages,
-		hasPrev: safePage > 1,
-		hasNext: safePage < totalPages,
-		totalItems: items.length
-	};
-}
-function buildContext(state) {
-	return {
-		[MATTERMOST_MODEL_PICKER_CONTEXT_KEY]: true,
-		...state
-	};
-}
-function buildButtonId(state) {
-	const digest = createHash("sha256").update(JSON.stringify(state)).digest("hex").slice(0, 12);
-	return `${ACTION_IDS[state.action]}${digest}`;
-}
-function buildButton(params) {
-	const baseState = params.action === "providers" || params.action === "back" ? {
-		action: params.action,
-		ownerUserId: params.ownerUserId
-	} : params.action === "list" ? {
-		action: "list",
-		ownerUserId: params.ownerUserId,
-		provider: normalizeProviderId(params.provider ?? ""),
-		page: normalizePage(params.page)
-	} : {
-		action: "select",
-		ownerUserId: params.ownerUserId,
-		provider: normalizeProviderId(params.provider ?? ""),
-		page: normalizePage(params.page),
-		model: String(params.model ?? "").trim()
-	};
-	return {
-		id: buildButtonId(baseState),
-		text: params.text,
-		...params.style ? { style: params.style } : {},
-		context: buildContext(baseState)
-	};
-}
-function getProviderModels(data, provider) {
-	return [...data.byProvider.get(normalizeProviderId(provider)) ?? /* @__PURE__ */ new Set()].toSorted();
-}
-function formatCurrentModelLine(currentModel) {
-	const parsed = splitModelRef(currentModel);
-	if (!parsed) return "Current: default";
-	return `Current: ${parsed.provider}/${parsed.model}`;
-}
-function resolveMattermostModelPickerEntry(commandText) {
-	const normalized = commandText.trim().replace(/\s+/g, " ");
-	if (/^\/model$/i.test(normalized)) return { kind: "summary" };
-	if (/^\/models$/i.test(normalized)) return { kind: "providers" };
-	const providerMatch = normalized.match(/^\/models\s+(\S+)$/i);
-	if (!providerMatch?.[1]) return null;
-	return {
-		kind: "models",
-		provider: normalizeProviderId(providerMatch[1])
-	};
-}
-function parseMattermostModelPickerContext(context) {
-	if (!context || context[MATTERMOST_MODEL_PICKER_CONTEXT_KEY] !== true) return null;
-	const ownerUserId = String(context.ownerUserId ?? "").trim();
-	const action = String(context.action ?? "").trim();
-	if (!ownerUserId) return null;
-	if (action === "providers" || action === "back") return {
-		action,
-		ownerUserId
-	};
-	const provider = normalizeProviderId(String(context.provider ?? ""));
-	const page = Number.parseInt(String(context.page ?? "1"), 10);
-	if (!provider) return null;
-	if (action === "list") return {
-		action,
-		ownerUserId,
-		provider,
-		page: normalizePage(page)
-	};
-	if (action === "select") {
-		const model = String(context.model ?? "").trim();
-		if (!model) return null;
-		return {
-			action,
-			ownerUserId,
-			provider,
-			page: normalizePage(page),
-			model
-		};
-	}
-	return null;
-}
-function buildMattermostAllowedModelRefs(data) {
-	const refs = /* @__PURE__ */ new Set();
-	for (const provider of data.providers) for (const model of data.byProvider.get(provider) ?? []) refs.add(`${provider}/${model}`);
-	return refs;
-}
-function resolveMattermostModelPickerCurrentModel(params) {
-	const fallback = `${params.data.resolvedDefault.provider}/${params.data.resolvedDefault.model}`;
-	try {
-		const storePath = resolveStorePath(params.cfg.session?.store, { agentId: params.route.agentId });
-		const sessionStore = params.skipCache ? loadSessionStore(storePath, { skipCache: true }) : loadSessionStore(storePath);
-		const sessionEntry = sessionStore[params.route.sessionKey];
-		const override = resolveStoredModelOverride({
-			sessionEntry,
-			sessionStore,
-			sessionKey: params.route.sessionKey
-		});
-		if (!override?.model) return fallback;
-		const provider = (override.provider || params.data.resolvedDefault.provider).trim();
-		return provider ? `${provider}/${override.model}` : fallback;
-	} catch {
-		return fallback;
-	}
-}
-function renderMattermostModelSummaryView(params) {
-	return {
-		text: [
-			formatCurrentModelLine(params.currentModel),
-			"",
-			"Tap below to browse models, or use:",
-			"/oc_model <provider/model> to switch",
-			"/oc_model status for details"
-		].join("\n"),
-		buttons: [[buildButton({
-			action: "providers",
-			ownerUserId: params.ownerUserId,
-			text: "Browse providers",
-			style: "primary"
-		})]]
-	};
-}
-function renderMattermostProviderPickerView(params) {
-	const currentProvider = splitModelRef(params.currentModel)?.provider;
-	const rows = params.data.providers.map((provider) => [buildButton({
-		action: "list",
-		ownerUserId: params.ownerUserId,
-		text: `${provider} (${params.data.byProvider.get(provider)?.size ?? 0})`,
-		provider,
-		page: 1,
-		style: provider === currentProvider ? "primary" : "default"
-	})]);
-	return {
-		text: [
-			formatCurrentModelLine(params.currentModel),
-			"",
-			"Select a provider:"
-		].join("\n"),
-		buttons: rows
-	};
-}
-function renderMattermostModelsPickerView(params) {
-	const provider = normalizeProviderId(params.provider);
-	const models = getProviderModels(params.data, provider);
-	const current = splitModelRef(params.currentModel);
-	if (models.length === 0) return {
-		text: [
-			formatCurrentModelLine(params.currentModel),
-			"",
-			`Unknown provider: ${provider}`
-		].join("\n"),
-		buttons: [[buildButton({
-			action: "back",
-			ownerUserId: params.ownerUserId,
-			text: "Back to providers"
-		})]]
-	};
-	const page = paginateItems(models, params.page);
-	const rows = page.items.map((model) => {
-		const isCurrent = current?.provider === provider && current.model === model;
-		return [buildButton({
-			action: "select",
-			ownerUserId: params.ownerUserId,
-			text: isCurrent ? `${model} [current]` : model,
-			provider,
-			model,
-			page: page.page,
-			style: isCurrent ? "primary" : "default"
-		})];
-	});
-	const navRow = [];
-	if (page.hasPrev) navRow.push(buildButton({
-		action: "list",
-		ownerUserId: params.ownerUserId,
-		text: "Prev",
-		provider,
-		page: page.page - 1
-	}));
-	if (page.hasNext) navRow.push(buildButton({
-		action: "list",
-		ownerUserId: params.ownerUserId,
-		text: "Next",
-		provider,
-		page: page.page + 1
-	}));
-	if (navRow.length > 0) rows.push(navRow);
-	rows.push([buildButton({
-		action: "back",
-		ownerUserId: params.ownerUserId,
-		text: "Back to providers"
-	})]);
-	return {
-		text: [
-			`Models (${provider}) - ${page.totalItems} available`,
-			formatCurrentModelLine(params.currentModel),
-			`Page ${page.page}/${page.totalPages}`,
-			"Select a model to switch immediately."
-		].join("\n"),
-		buttons: rows
-	};
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/monitor-auth.ts
-function normalizeMattermostAllowEntry(entry) {
-	const trimmed = entry.trim();
-	if (!trimmed) return "";
-	if (trimmed === "*") return "*";
-	return trimmed.replace(/^(mattermost|user):/i, "").replace(/^@/, "").toLowerCase();
-}
-function normalizeMattermostAllowList(entries) {
-	const normalized = entries.map((entry) => normalizeMattermostAllowEntry(String(entry))).filter(Boolean);
-	return Array.from(new Set(normalized));
-}
-function resolveMattermostEffectiveAllowFromLists(params) {
-	return resolveEffectiveAllowFromLists({
-		allowFrom: normalizeMattermostAllowList(params.allowFrom ?? []),
-		groupAllowFrom: normalizeMattermostAllowList(params.groupAllowFrom ?? []),
-		storeAllowFrom: normalizeMattermostAllowList(params.storeAllowFrom ?? []),
-		dmPolicy: params.dmPolicy
-	});
-}
-function isMattermostSenderAllowed(params) {
-	const allowFrom = normalizeMattermostAllowList(params.allowFrom);
-	if (allowFrom.length === 0) return false;
-	return resolveAllowlistMatchSimple({
-		allowFrom,
-		senderId: normalizeMattermostAllowEntry(params.senderId),
-		senderName: params.senderName ? normalizeMattermostAllowEntry(params.senderName) : void 0,
-		allowNameMatching: params.allowNameMatching
-	}).allowed;
-}
-function mapMattermostChannelKind(channelType) {
-	const normalized = channelType?.trim().toUpperCase();
-	if (normalized === "D") return "direct";
-	if (normalized === "G" || normalized === "P") return "group";
-	return "channel";
-}
-function authorizeMattermostCommandInvocation(params) {
-	const { account, cfg, senderId, senderName, channelId, channelInfo, storeAllowFrom, allowTextCommands, hasControlCommand } = params;
-	if (!channelInfo) return {
-		ok: false,
-		denyReason: "unknown-channel",
-		commandAuthorized: false,
-		channelInfo: null,
-		kind: "channel",
-		chatType: "channel",
-		channelName: "",
-		channelDisplay: "",
-		roomLabel: `#${channelId}`
-	};
-	const kind = mapMattermostChannelKind(channelInfo.type);
-	const chatType = kind;
-	const channelName = channelInfo.name ?? "";
-	const channelDisplay = channelInfo.display_name ?? channelName;
-	const roomLabel = channelName ? `#${channelName}` : channelDisplay || `#${channelId}`;
-	const dmPolicy = account.config.dmPolicy ?? "pairing";
-	const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-	const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
-	const allowNameMatching = isDangerousNameMatchingEnabled(account.config);
-	const configAllowFrom = normalizeMattermostAllowList(account.config.allowFrom ?? []);
-	const configGroupAllowFrom = normalizeMattermostAllowList(account.config.groupAllowFrom ?? []);
-	const { effectiveAllowFrom, effectiveGroupAllowFrom } = resolveMattermostEffectiveAllowFromLists({
-		allowFrom: configAllowFrom,
-		groupAllowFrom: configGroupAllowFrom,
-		storeAllowFrom: normalizeMattermostAllowList(storeAllowFrom ?? []),
-		dmPolicy
-	});
-	const useAccessGroups = cfg.commands?.useAccessGroups !== false;
-	const commandDmAllowFrom = kind === "direct" ? effectiveAllowFrom : configAllowFrom;
-	const commandGroupAllowFrom = kind === "direct" ? effectiveGroupAllowFrom : configGroupAllowFrom.length > 0 ? configGroupAllowFrom : configAllowFrom;
-	const senderAllowedForCommands = isMattermostSenderAllowed({
-		senderId,
-		senderName,
-		allowFrom: commandDmAllowFrom,
-		allowNameMatching
-	});
-	const groupAllowedForCommands = isMattermostSenderAllowed({
-		senderId,
-		senderName,
-		allowFrom: commandGroupAllowFrom,
-		allowNameMatching
-	});
-	const commandGate = resolveControlCommandGate({
-		useAccessGroups,
-		authorizers: [{
-			configured: commandDmAllowFrom.length > 0,
-			allowed: senderAllowedForCommands
-		}, {
-			configured: commandGroupAllowFrom.length > 0,
-			allowed: groupAllowedForCommands
-		}],
-		allowTextCommands,
-		hasControlCommand: allowTextCommands && hasControlCommand
-	});
-	const commandAuthorized = kind === "direct" ? dmPolicy === "open" || senderAllowedForCommands : commandGate.commandAuthorized;
-	if (kind === "direct") {
-		if (dmPolicy === "disabled") return {
-			ok: false,
-			denyReason: "dm-disabled",
-			commandAuthorized: false,
-			channelInfo,
-			kind,
-			chatType,
-			channelName,
-			channelDisplay,
-			roomLabel
-		};
-		if (dmPolicy !== "open" && !senderAllowedForCommands) return {
-			ok: false,
-			denyReason: dmPolicy === "pairing" ? "dm-pairing" : "unauthorized",
-			commandAuthorized: false,
-			channelInfo,
-			kind,
-			chatType,
-			channelName,
-			channelDisplay,
-			roomLabel
-		};
-	} else {
-		const senderGroupAccess = evaluateSenderGroupAccessForPolicy({
-			groupPolicy,
-			groupAllowFrom: effectiveGroupAllowFrom,
-			senderId,
-			isSenderAllowed: (_senderId, allowFrom) => isMattermostSenderAllowed({
-				senderId,
-				senderName,
-				allowFrom,
-				allowNameMatching
-			})
-		});
-		if (!senderGroupAccess.allowed && senderGroupAccess.reason === "disabled") return {
-			ok: false,
-			denyReason: "channels-disabled",
-			commandAuthorized: false,
-			channelInfo,
-			kind,
-			chatType,
-			channelName,
-			channelDisplay,
-			roomLabel
-		};
-		if (!senderGroupAccess.allowed && senderGroupAccess.reason === "empty_allowlist") return {
-			ok: false,
-			denyReason: "channel-no-allowlist",
-			commandAuthorized: false,
-			channelInfo,
-			kind,
-			chatType,
-			channelName,
-			channelDisplay,
-			roomLabel
-		};
-		if (!senderGroupAccess.allowed && senderGroupAccess.reason === "sender_not_allowlisted") return {
-			ok: false,
-			denyReason: "unauthorized",
-			commandAuthorized: false,
-			channelInfo,
-			kind,
-			chatType,
-			channelName,
-			channelDisplay,
-			roomLabel
-		};
-		if (commandGate.shouldBlock) return {
-			ok: false,
-			denyReason: "unauthorized",
-			commandAuthorized: false,
-			channelInfo,
-			kind,
-			chatType,
-			channelName,
-			channelDisplay,
-			roomLabel
-		};
-	}
-	return {
-		ok: true,
-		commandAuthorized,
-		channelInfo,
-		kind,
-		chatType,
-		channelName,
-		channelDisplay,
-		roomLabel
-	};
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/monitor-helpers.ts
-const formatInboundFromLabel = formatInboundFromLabel$1;
-function resolveThreadSessionKeys(params) {
-	return resolveThreadSessionKeys$1({
-		...params,
-		normalizeThreadId: (threadId) => threadId
-	});
-}
-/**
-* Strip bot mention from message text while preserving newlines and
-* block-level Markdown formatting (headings, lists, blockquotes).
-*/
-function normalizeMention(text, mention) {
-	if (!mention) return text.trim();
-	const escaped = mention.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-	const hasMentionRe = new RegExp(`@${escaped}\\b`, "i");
-	const leadingMentionRe = new RegExp(`^([\\t ]*)@${escaped}\\b[\\t ]*`, "i");
-	const trailingMentionRe = new RegExp(`[\\t ]*@${escaped}\\b[\\t ]*$`, "i");
-	const normalizedLines = text.split("\n").map((line) => {
-		const hadMention = hasMentionRe.test(line);
-		const normalizedLine = line.replace(leadingMentionRe, "$1").replace(trailingMentionRe, "").replace(new RegExp(`@${escaped}\\b`, "gi"), "").replace(/(\S)[ \t]{2,}/g, "$1 ");
-		return {
-			text: normalizedLine,
-			mentionOnlyBlank: hadMention && normalizedLine.trim() === ""
-		};
-	});
-	while (normalizedLines[0]?.mentionOnlyBlank) normalizedLines.shift();
-	while (normalizedLines.at(-1)?.text.trim() === "") normalizedLines.pop();
-	return normalizedLines.map((line) => line.text).join("\n");
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/monitor-onchar.ts
-const DEFAULT_ONCHAR_PREFIXES = [">", "!"];
-function resolveOncharPrefixes(prefixes) {
-	const cleaned = prefixes?.map((entry) => entry.trim()).filter(Boolean) ?? DEFAULT_ONCHAR_PREFIXES;
-	return cleaned.length > 0 ? cleaned : DEFAULT_ONCHAR_PREFIXES;
-}
-function stripOncharPrefix(text, prefixes) {
-	const trimmed = text.trimStart();
-	for (const prefix of prefixes) {
-		if (!prefix) continue;
-		if (trimmed.startsWith(prefix)) return {
-			triggered: true,
-			stripped: trimmed.slice(prefix.length).trimStart()
-		};
-	}
-	return {
-		triggered: false,
-		stripped: text
-	};
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/monitor-websocket.ts
-var WebSocketClosedBeforeOpenError = class extends Error {
-	constructor(code, reason) {
-		super(`websocket closed before open (code ${code})`);
-		this.code = code;
-		this.reason = reason;
-		this.name = "WebSocketClosedBeforeOpenError";
-	}
-};
-const defaultMattermostWebSocketFactory = (url) => new WebSocket$1(url);
-function parsePostedPayload(payload) {
-	if (payload.event !== "posted") return null;
-	const postData = payload.data?.post;
-	if (!postData) return null;
-	let post = null;
-	if (typeof postData === "string") try {
-		post = JSON.parse(postData);
-	} catch {
-		return null;
-	}
-	else if (typeof postData === "object") post = postData;
-	if (!post) return null;
-	return {
-		payload,
-		post
-	};
-}
-function createMattermostConnectOnce(opts) {
-	const webSocketFactory = opts.webSocketFactory ?? defaultMattermostWebSocketFactory;
-	return async () => {
-		const ws = webSocketFactory(opts.wsUrl);
-		const onAbort = () => ws.terminate();
-		opts.abortSignal?.addEventListener("abort", onAbort, { once: true });
-		try {
-			return await new Promise((resolve, reject) => {
-				let opened = false;
-				let settled = false;
-				const resolveOnce = () => {
-					if (settled) return;
-					settled = true;
-					resolve();
-				};
-				const rejectOnce = (error) => {
-					if (settled) return;
-					settled = true;
-					reject(error);
-				};
-				ws.on("open", () => {
-					opened = true;
-					opts.statusSink?.({
-						connected: true,
-						lastConnectedAt: Date.now(),
-						lastError: null
-					});
-					ws.send(JSON.stringify({
-						seq: opts.nextSeq(),
-						action: "authentication_challenge",
-						data: { token: opts.botToken }
-					}));
-				});
-				ws.on("message", async (data) => {
-					const raw = rawDataToString(data);
-					let payload;
-					try {
-						payload = JSON.parse(raw);
-					} catch {
-						return;
-					}
-					if (payload.event === "reaction_added" || payload.event === "reaction_removed") {
-						if (!opts.onReaction) return;
-						try {
-							await opts.onReaction(payload);
-						} catch (err) {
-							opts.runtime.error?.(`mattermost reaction handler failed: ${String(err)}`);
-						}
-						return;
-					}
-					if (payload.event !== "posted") return;
-					const parsed = parsePostedPayload(payload);
-					if (!parsed) return;
-					try {
-						await opts.onPosted(parsed.post, parsed.payload);
-					} catch (err) {
-						opts.runtime.error?.(`mattermost handler failed: ${String(err)}`);
-					}
-				});
-				ws.on("close", (code, reason) => {
-					const message = reasonToString(reason);
-					opts.statusSink?.({
-						connected: false,
-						lastDisconnect: {
-							at: Date.now(),
-							status: code,
-							error: message || void 0
-						}
-					});
-					if (opened) {
-						resolveOnce();
-						return;
-					}
-					rejectOnce(new WebSocketClosedBeforeOpenError(code, message || void 0));
-				});
-				ws.on("error", (err) => {
-					opts.runtime.error?.(`mattermost websocket error: ${String(err)}`);
-					opts.statusSink?.({ lastError: String(err) });
-					try {
-						ws.close();
-					} catch {}
-				});
-			});
-		} finally {
-			opts.abortSignal?.removeEventListener("abort", onAbort);
-		}
-	};
-}
-function reasonToString(reason) {
-	if (!reason) return "";
-	if (typeof reason === "string") return reason;
-	return reason.length > 0 ? reason.toString("utf8") : "";
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/reconnect.ts
-/**
-* Reconnection loop with exponential backoff.
-*
-* Calls `connectFn` in a while loop. On normal resolve (connection closed),
-* the backoff resets. On thrown error (connection failed), the current delay is
-* used, then doubled for the next retry.
-* The loop exits when `abortSignal` fires.
-*/
-async function runWithReconnect(connectFn, opts = {}) {
-	const { initialDelayMs = 2e3, maxDelayMs = 6e4 } = opts;
-	const jitterRatio = Math.max(0, opts.jitterRatio ?? 0);
-	const random = opts.random ?? Math.random;
-	let retryDelay = initialDelayMs;
-	let attempt = 0;
-	while (!opts.abortSignal?.aborted) {
-		let shouldIncreaseDelay = false;
-		let outcome = "resolved";
-		let error;
-		try {
-			await connectFn();
-			retryDelay = initialDelayMs;
-		} catch (err) {
-			if (opts.abortSignal?.aborted) return;
-			outcome = "rejected";
-			error = err;
-			opts.onError?.(err);
-			shouldIncreaseDelay = true;
-		}
-		if (opts.abortSignal?.aborted) return;
-		const delayMs = withJitter(retryDelay, jitterRatio, random);
-		if (!(opts.shouldReconnect?.({
-			attempt,
-			delayMs,
-			outcome,
-			error
-		}) ?? true)) return;
-		opts.onReconnect?.(delayMs);
-		await sleepAbortable(delayMs, opts.abortSignal);
-		if (shouldIncreaseDelay) retryDelay = Math.min(retryDelay * 2, maxDelayMs);
-		attempt++;
-	}
-}
-function withJitter(baseMs, jitterRatio, random) {
-	if (jitterRatio <= 0) return baseMs;
-	const normalized = Math.max(0, Math.min(1, random()));
-	const spread = baseMs * jitterRatio;
-	return Math.max(1, Math.round(baseMs - spread + normalized * spread * 2));
-}
-function sleepAbortable(ms, signal) {
-	return new Promise((resolve) => {
-		if (signal?.aborted) {
-			resolve();
-			return;
-		}
-		const onAbort = () => {
-			clearTimeout(timer);
-			resolve();
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/reply-delivery.ts
-async function deliverMattermostReplyPayload(params) {
-	const mediaUrls = params.payload.mediaUrls ?? (params.payload.mediaUrl ? [params.payload.mediaUrl] : []);
-	const text = params.core.channel.text.convertMarkdownTables(params.payload.text ?? "", params.tableMode);
-	if (mediaUrls.length === 0) {
-		const chunkMode = params.core.channel.text.resolveChunkMode(params.cfg, "mattermost", params.accountId);
-		const chunks = params.core.channel.text.chunkMarkdownTextWithMode(text, params.textLimit, chunkMode);
-		for (const chunk of chunks.length > 0 ? chunks : [text]) {
-			if (!chunk) continue;
-			await params.sendMessage(params.to, chunk, {
-				accountId: params.accountId,
-				replyToId: params.replyToId
-			});
-		}
-		return;
-	}
-	const mediaLocalRoots = getAgentScopedMediaLocalRoots(params.cfg, params.agentId);
-	let first = true;
-	for (const mediaUrl of mediaUrls) {
-		const caption = first ? text : "";
-		first = false;
-		await params.sendMessage(params.to, caption, {
-			accountId: params.accountId,
-			mediaUrl,
-			mediaLocalRoots,
-			replyToId: params.replyToId
-		});
-	}
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/target-resolution.ts
-const mattermostOpaqueTargetCache = /* @__PURE__ */ new Map();
-function cacheKey$1(baseUrl, token, id) {
-	return `${baseUrl}::${token}::${id}`;
-}
-/** Mattermost IDs are 26-character lowercase alphanumeric strings. */
-function isMattermostId(value) {
-	return /^[a-z0-9]{26}$/.test(value);
-}
-function isExplicitMattermostTarget(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) return false;
-	return /^(channel|user|mattermost):/i.test(trimmed) || trimmed.startsWith("@") || trimmed.startsWith("#");
-}
-function parseMattermostApiStatus(err) {
-	if (!err || typeof err !== "object") return;
-	const msg = "message" in err ? String(err.message ?? "") : "";
-	const match = /Mattermost API (\d{3})\b/.exec(msg);
-	if (!match) return;
-	const code = Number(match[1]);
-	return Number.isFinite(code) ? code : void 0;
-}
-async function resolveMattermostOpaqueTarget(params) {
-	const input = params.input.trim();
-	if (!input || isExplicitMattermostTarget(input) || !isMattermostId(input)) return null;
-	const account = params.cfg && (!params.token || !params.baseUrl) ? resolveMattermostAccount({
-		cfg: params.cfg,
-		accountId: params.accountId
-	}) : null;
-	const token = params.token?.trim() || account?.botToken?.trim();
-	const baseUrl = normalizeMattermostBaseUrl(params.baseUrl ?? account?.baseUrl);
-	if (!token || !baseUrl) return null;
-	const key = cacheKey$1(baseUrl, token, input);
-	const cached = mattermostOpaqueTargetCache.get(key);
-	if (cached === true) return {
-		kind: "user",
-		id: input,
-		to: `user:${input}`
-	};
-	if (cached === false) return {
-		kind: "channel",
-		id: input,
-		to: `channel:${input}`
-	};
-	const client = createMattermostClient({
-		baseUrl,
-		botToken: token
-	});
-	try {
-		await fetchMattermostUser(client, input);
-		mattermostOpaqueTargetCache.set(key, true);
-		return {
-			kind: "user",
-			id: input,
-			to: `user:${input}`
-		};
-	} catch (err) {
-		if (parseMattermostApiStatus(err) === 404) mattermostOpaqueTargetCache.set(key, false);
-		return {
-			kind: "channel",
-			id: input,
-			to: `channel:${input}`
-		};
-	}
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/send.ts
-const botUserCache = /* @__PURE__ */ new Map();
-const userByNameCache = /* @__PURE__ */ new Map();
-const channelByNameCache = /* @__PURE__ */ new Map();
-const dmChannelCache = /* @__PURE__ */ new Map();
-const getCore = () => getMattermostRuntime();
-function cacheKey(baseUrl, token) {
-	return `${baseUrl}::${token}`;
-}
-function normalizeMessage(text, mediaUrl) {
-	return [text.trim(), mediaUrl?.trim()].filter(Boolean).join("\n");
-}
-function isHttpUrl(value) {
-	return /^https?:\/\//i.test(value);
-}
-function parseMattermostTarget(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) throw new Error("Recipient is required for Mattermost sends");
-	const lower = trimmed.toLowerCase();
-	if (lower.startsWith("channel:")) {
-		const id = trimmed.slice(8).trim();
-		if (!id) throw new Error("Channel id is required for Mattermost sends");
-		if (id.startsWith("#")) {
-			const name = id.slice(1).trim();
-			if (!name) throw new Error("Channel name is required for Mattermost sends");
-			return {
-				kind: "channel-name",
-				name
-			};
-		}
-		if (!isMattermostId(id)) return {
-			kind: "channel-name",
-			name: id
-		};
-		return {
-			kind: "channel",
-			id
-		};
-	}
-	if (lower.startsWith("user:")) {
-		const id = trimmed.slice(5).trim();
-		if (!id) throw new Error("User id is required for Mattermost sends");
-		return {
-			kind: "user",
-			id
-		};
-	}
-	if (lower.startsWith("mattermost:")) {
-		const id = trimmed.slice(11).trim();
-		if (!id) throw new Error("User id is required for Mattermost sends");
-		return {
-			kind: "user",
-			id
-		};
-	}
-	if (trimmed.startsWith("@")) {
-		const username = trimmed.slice(1).trim();
-		if (!username) throw new Error("Username is required for Mattermost sends");
-		return {
-			kind: "user",
-			username
-		};
-	}
-	if (trimmed.startsWith("#")) {
-		const name = trimmed.slice(1).trim();
-		if (!name) throw new Error("Channel name is required for Mattermost sends");
-		return {
-			kind: "channel-name",
-			name
-		};
-	}
-	if (!isMattermostId(trimmed)) return {
-		kind: "channel-name",
-		name: trimmed
-	};
-	return {
-		kind: "channel",
-		id: trimmed
-	};
-}
-async function resolveBotUser(baseUrl, token) {
-	const key = cacheKey(baseUrl, token);
-	const cached = botUserCache.get(key);
-	if (cached) return cached;
-	const user = await fetchMattermostMe(createMattermostClient({
-		baseUrl,
-		botToken: token
-	}));
-	botUserCache.set(key, user);
-	return user;
-}
-async function resolveUserIdByUsername(params) {
-	const { baseUrl, token, username } = params;
-	const key = `${cacheKey(baseUrl, token)}::${username.toLowerCase()}`;
-	const cached = userByNameCache.get(key);
-	if (cached?.id) return cached.id;
-	const user = await fetchMattermostUserByUsername(createMattermostClient({
-		baseUrl,
-		botToken: token
-	}), username);
-	userByNameCache.set(key, user);
-	return user.id;
-}
-async function resolveChannelIdByName(params) {
-	const { baseUrl, token, name } = params;
-	const key = `${cacheKey(baseUrl, token)}::channel::${name.toLowerCase()}`;
-	const cached = channelByNameCache.get(key);
-	if (cached) return cached;
-	const client = createMattermostClient({
-		baseUrl,
-		botToken: token
-	});
-	const teams = await fetchMattermostUserTeams(client, (await fetchMattermostMe(client)).id);
-	for (const team of teams) try {
-		const channel = await fetchMattermostChannelByName(client, team.id, name);
-		if (channel?.id) {
-			channelByNameCache.set(key, channel.id);
-			return channel.id;
-		}
-	} catch {}
-	throw new Error(`Mattermost channel "#${name}" not found in any team the bot belongs to`);
-}
-async function resolveTargetChannelId(params) {
-	if (params.target.kind === "channel") return params.target.id;
-	if (params.target.kind === "channel-name") return await resolveChannelIdByName({
-		baseUrl: params.baseUrl,
-		token: params.token,
-		name: params.target.name
-	});
-	const userId = params.target.id ? params.target.id : await resolveUserIdByUsername({
-		baseUrl: params.baseUrl,
-		token: params.token,
-		username: params.target.username ?? ""
-	});
-	const dmKey = `${cacheKey(params.baseUrl, params.token)}::dm::${userId}`;
-	const cachedDm = dmChannelCache.get(dmKey);
-	if (cachedDm) return cachedDm;
-	const botUser = await resolveBotUser(params.baseUrl, params.token);
-	const channel = await createMattermostDirectChannel(createMattermostClient({
-		baseUrl: params.baseUrl,
-		botToken: params.token
-	}), [botUser.id, userId]);
-	dmChannelCache.set(dmKey, channel.id);
-	return channel.id;
-}
-async function resolveMattermostSendContext(to, opts = {}) {
-	const core = getCore();
-	const cfg = opts.cfg ?? core.config.loadConfig();
-	const account = resolveMattermostAccount({
-		cfg,
-		accountId: opts.accountId
-	});
-	const token = opts.botToken?.trim() || account.botToken?.trim();
-	if (!token) throw new Error(`Mattermost bot token missing for account "${account.accountId}" (set channels.mattermost.accounts.${account.accountId}.botToken or MATTERMOST_BOT_TOKEN for default).`);
-	const baseUrl = normalizeMattermostBaseUrl(opts.baseUrl ?? account.baseUrl);
-	if (!baseUrl) throw new Error(`Mattermost baseUrl missing for account "${account.accountId}" (set channels.mattermost.accounts.${account.accountId}.baseUrl or MATTERMOST_URL for default).`);
-	const trimmedTo = to?.trim() ?? "";
-	const opaqueTarget = await resolveMattermostOpaqueTarget({
-		input: trimmedTo,
-		token,
-		baseUrl
-	});
-	const channelId = await resolveTargetChannelId({
-		target: opaqueTarget?.kind === "user" ? {
-			kind: "user",
-			id: opaqueTarget.id
-		} : opaqueTarget?.kind === "channel" ? {
-			kind: "channel",
-			id: opaqueTarget.id
-		} : parseMattermostTarget(trimmedTo),
-		baseUrl,
-		token
-	});
-	return {
-		cfg,
-		accountId: account.accountId,
-		token,
-		baseUrl,
-		channelId
-	};
-}
-async function sendMessageMattermost(to, text, opts = {}) {
-	const core = getCore();
-	const logger = core.logging.getChildLogger({ module: "mattermost" });
-	const { cfg, accountId, token, baseUrl, channelId } = await resolveMattermostSendContext(to, opts);
-	const client = createMattermostClient({
-		baseUrl,
-		botToken: token
-	});
-	let props = opts.props;
-	if (!props && Array.isArray(opts.buttons) && opts.buttons.length > 0) {
-		setInteractionSecret(accountId, token);
-		props = buildButtonProps({
-			callbackUrl: resolveInteractionCallbackUrl(accountId, {
-				gateway: cfg.gateway,
-				interactions: resolveMattermostAccount({
-					cfg,
-					accountId
-				}).config?.interactions
-			}),
-			accountId,
-			channelId,
-			buttons: opts.buttons,
-			text: opts.attachmentText
-		});
-	}
-	let message = text?.trim() ?? "";
-	let fileIds;
-	let uploadError;
-	const mediaUrl = opts.mediaUrl?.trim();
-	if (mediaUrl) try {
-		const media = await loadOutboundMediaFromUrl(mediaUrl, { mediaLocalRoots: opts.mediaLocalRoots });
-		fileIds = [(await uploadMattermostFile(client, {
-			channelId,
-			buffer: media.buffer,
-			fileName: media.fileName ?? "upload",
-			contentType: media.contentType ?? void 0
-		})).id];
-	} catch (err) {
-		uploadError = err instanceof Error ? err : new Error(String(err));
-		if (core.logging.shouldLogVerbose()) logger.debug?.(`mattermost send: media upload failed, falling back to URL text: ${String(err)}`);
-		message = normalizeMessage(message, isHttpUrl(mediaUrl) ? mediaUrl : "");
-	}
-	if (message) {
-		const tableMode = core.channel.text.resolveMarkdownTableMode({
-			cfg,
-			channel: "mattermost",
-			accountId
-		});
-		message = core.channel.text.convertMarkdownTables(message, tableMode);
-	}
-	if (!message && (!fileIds || fileIds.length === 0)) {
-		if (uploadError) throw new Error(`Mattermost media upload failed: ${uploadError.message}`);
-		throw new Error("Mattermost message is empty");
-	}
-	const post = await createMattermostPost(client, {
-		channelId,
-		message,
-		rootId: opts.replyToId,
-		fileIds,
-		props
-	});
-	core.channel.activity.record({
-		channel: "mattermost",
-		accountId,
-		direction: "outbound"
-	});
-	return {
-		messageId: post.id ?? "unknown",
-		channelId
-	};
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/slash-commands.ts
-/**
-* Built-in MoldClaw commands to register as native slash commands.
-* These mirror the text-based commands already handled by the gateway.
-*/
-const DEFAULT_COMMAND_SPECS = [
-	{
-		trigger: "oc_status",
-		originalName: "status",
-		description: "Show session status (model, usage, uptime)",
-		autoComplete: true
-	},
-	{
-		trigger: "oc_model",
-		originalName: "model",
-		description: "View or change the current model",
-		autoComplete: true,
-		autoCompleteHint: "[model-name]"
-	},
-	{
-		trigger: "oc_models",
-		originalName: "models",
-		description: "Browse available models",
-		autoComplete: true,
-		autoCompleteHint: "[provider]"
-	},
-	{
-		trigger: "oc_new",
-		originalName: "new",
-		description: "Start a new conversation session",
-		autoComplete: true
-	},
-	{
-		trigger: "oc_help",
-		originalName: "help",
-		description: "Show available commands",
-		autoComplete: true
-	},
-	{
-		trigger: "oc_think",
-		originalName: "think",
-		description: "Set thinking/reasoning level",
-		autoComplete: true,
-		autoCompleteHint: "[off|low|medium|high]"
-	},
-	{
-		trigger: "oc_reasoning",
-		originalName: "reasoning",
-		description: "Toggle reasoning mode",
-		autoComplete: true,
-		autoCompleteHint: "[on|off]"
-	},
-	{
-		trigger: "oc_verbose",
-		originalName: "verbose",
-		description: "Toggle verbose mode",
-		autoComplete: true,
-		autoCompleteHint: "[on|off]"
-	}
-];
-/**
-* List existing custom slash commands for a team.
-*/
-async function listMattermostCommands(client, teamId) {
-	return await client.request(`/commands?team_id=${encodeURIComponent(teamId)}&custom_only=true`);
-}
-/**
-* Create a custom slash command on a Mattermost team.
-*/
-async function createMattermostCommand(client, params) {
-	return await client.request("/commands", {
-		method: "POST",
-		body: JSON.stringify(params)
-	});
-}
-/**
-* Delete a custom slash command.
-*/
-async function deleteMattermostCommand(client, commandId) {
-	await client.request(`/commands/${encodeURIComponent(commandId)}`, { method: "DELETE" });
-}
-/**
-* Update an existing custom slash command.
-*/
-async function updateMattermostCommand(client, params) {
-	return await client.request(`/commands/${encodeURIComponent(params.id)}`, {
-		method: "PUT",
-		body: JSON.stringify(params)
-	});
-}
-/**
-* Register all MoldClaw slash commands for a given team.
-* Skips commands that are already registered with the same trigger + callback URL.
-* Returns the list of newly created command IDs.
-*/
-async function registerSlashCommands(params) {
-	const { client, teamId, creatorUserId, callbackUrl, commands, log } = params;
-	const normalizedCreatorUserId = creatorUserId.trim();
-	if (!normalizedCreatorUserId) throw new Error("creatorUserId is required for slash command reconciliation");
-	let existing = [];
-	try {
-		existing = await listMattermostCommands(client, teamId);
-	} catch (err) {
-		log?.(`mattermost: failed to list existing commands: ${String(err)}`);
-		throw err;
-	}
-	const existingByTrigger = /* @__PURE__ */ new Map();
-	for (const cmd of existing) {
-		const list = existingByTrigger.get(cmd.trigger) ?? [];
-		list.push(cmd);
-		existingByTrigger.set(cmd.trigger, list);
-	}
-	const registered = [];
-	for (const spec of commands) {
-		const existingForTrigger = existingByTrigger.get(spec.trigger) ?? [];
-		const ownedCommands = existingForTrigger.filter((cmd) => cmd.creator_id?.trim() === normalizedCreatorUserId);
-		const foreignCommands = existingForTrigger.filter((cmd) => cmd.creator_id?.trim() !== normalizedCreatorUserId);
-		if (ownedCommands.length === 0 && foreignCommands.length > 0) {
-			log?.(`mattermost: trigger /${spec.trigger} already used by non-MoldClaw command(s); skipping to avoid mutating external integrations`);
-			continue;
-		}
-		if (ownedCommands.length > 1) log?.(`mattermost: multiple owned commands found for /${spec.trigger}; using the first and leaving extras untouched`);
-		const existingCmd = ownedCommands[0];
-		if (existingCmd && existingCmd.url === callbackUrl) {
-			log?.(`mattermost: command /${spec.trigger} already registered (id=${existingCmd.id})`);
-			registered.push({
-				id: existingCmd.id,
-				trigger: spec.trigger,
-				teamId,
-				token: existingCmd.token,
-				managed: false
-			});
-			continue;
-		}
-		if (existingCmd && existingCmd.url !== callbackUrl) {
-			log?.(`mattermost: command /${spec.trigger} exists with different callback URL; updating (id=${existingCmd.id})`);
-			try {
-				const updated = await updateMattermostCommand(client, {
-					id: existingCmd.id,
-					team_id: teamId,
-					trigger: spec.trigger,
-					method: "P",
-					url: callbackUrl,
-					description: spec.description,
-					auto_complete: spec.autoComplete,
-					auto_complete_desc: spec.description,
-					auto_complete_hint: spec.autoCompleteHint
-				});
-				registered.push({
-					id: updated.id,
-					trigger: spec.trigger,
-					teamId,
-					token: updated.token,
-					managed: false
-				});
-				continue;
-			} catch (err) {
-				log?.(`mattermost: failed to update command /${spec.trigger} (id=${existingCmd.id}): ${String(err)}`);
-				try {
-					await deleteMattermostCommand(client, existingCmd.id);
-					log?.(`mattermost: deleted stale command /${spec.trigger} (id=${existingCmd.id})`);
-				} catch (deleteErr) {
-					log?.(`mattermost: failed to delete stale command /${spec.trigger} (id=${existingCmd.id}): ${String(deleteErr)}`);
-					continue;
-				}
-			}
-		}
-		try {
-			const created = await createMattermostCommand(client, {
-				team_id: teamId,
-				trigger: spec.trigger,
-				method: "P",
-				url: callbackUrl,
-				description: spec.description,
-				auto_complete: spec.autoComplete,
-				auto_complete_desc: spec.description,
-				auto_complete_hint: spec.autoCompleteHint
-			});
-			log?.(`mattermost: registered command /${spec.trigger} (id=${created.id})`);
-			registered.push({
-				id: created.id,
-				trigger: spec.trigger,
-				teamId,
-				token: created.token,
-				managed: true
-			});
-		} catch (err) {
-			log?.(`mattermost: failed to register command /${spec.trigger}: ${String(err)}`);
-		}
-	}
-	return registered;
-}
-/**
-* Clean up all registered slash commands.
-*/
-async function cleanupSlashCommands(params) {
-	const { client, commands, log } = params;
-	for (const cmd of commands) {
-		if (!cmd.managed) continue;
-		try {
-			await deleteMattermostCommand(client, cmd.id);
-			log?.(`mattermost: deleted command /${cmd.trigger} (id=${cmd.id})`);
-		} catch (err) {
-			log?.(`mattermost: failed to delete command /${cmd.trigger}: ${String(err)}`);
-		}
-	}
-}
-/**
-* Parse a Mattermost slash command callback payload from a URL-encoded or JSON body.
-*/
-function parseSlashCommandPayload(body, contentType) {
-	if (!body) return null;
-	try {
-		if (contentType?.includes("application/json")) {
-			const parsed = JSON.parse(body);
-			const token = typeof parsed.token === "string" ? parsed.token : "";
-			const teamId = typeof parsed.team_id === "string" ? parsed.team_id : "";
-			const channelId = typeof parsed.channel_id === "string" ? parsed.channel_id : "";
-			const userId = typeof parsed.user_id === "string" ? parsed.user_id : "";
-			const command = typeof parsed.command === "string" ? parsed.command : "";
-			if (!token || !teamId || !channelId || !userId || !command) return null;
-			return {
-				token,
-				team_id: teamId,
-				team_domain: typeof parsed.team_domain === "string" ? parsed.team_domain : void 0,
-				channel_id: channelId,
-				channel_name: typeof parsed.channel_name === "string" ? parsed.channel_name : void 0,
-				user_id: userId,
-				user_name: typeof parsed.user_name === "string" ? parsed.user_name : void 0,
-				command,
-				text: typeof parsed.text === "string" ? parsed.text : "",
-				trigger_id: typeof parsed.trigger_id === "string" ? parsed.trigger_id : void 0,
-				response_url: typeof parsed.response_url === "string" ? parsed.response_url : void 0
-			};
-		}
-		const params = new URLSearchParams(body);
-		const token = params.get("token");
-		const teamId = params.get("team_id");
-		const channelId = params.get("channel_id");
-		const userId = params.get("user_id");
-		const command = params.get("command");
-		if (!token || !teamId || !channelId || !userId || !command) return null;
-		return {
-			token,
-			team_id: teamId,
-			team_domain: params.get("team_domain") ?? void 0,
-			channel_id: channelId,
-			channel_name: params.get("channel_name") ?? void 0,
-			user_id: userId,
-			user_name: params.get("user_name") ?? void 0,
-			command,
-			text: params.get("text") ?? "",
-			trigger_id: params.get("trigger_id") ?? void 0,
-			response_url: params.get("response_url") ?? void 0
-		};
-	} catch {
-		return null;
-	}
-}
-/**
-* Map the trigger word back to the original MoldClaw command name.
-* e.g. "oc_status" -> "/status", "oc_model" -> "/model"
-*/
-function resolveCommandText(trigger, text, triggerMap) {
-	const commandName = triggerMap?.get(trigger) ?? (trigger.startsWith("oc_") ? trigger.slice(3) : trigger);
-	const args = text.trim();
-	return args ? `/${commandName} ${args}` : `/${commandName}`;
-}
-const DEFAULT_CALLBACK_PATH = "/api/channels/mattermost/command";
-/**
-* Ensure the callback path starts with a leading `/` to prevent
-* malformed URLs like `http://host:portapi/...`.
-*/
-function normalizeCallbackPath(path) {
-	const trimmed = path.trim();
-	if (!trimmed) return DEFAULT_CALLBACK_PATH;
-	return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
-}
-function resolveSlashCommandConfig(raw) {
-	return {
-		native: raw?.native ?? "auto",
-		nativeSkills: raw?.nativeSkills ?? "auto",
-		callbackPath: normalizeCallbackPath(raw?.callbackPath ?? DEFAULT_CALLBACK_PATH),
-		callbackUrl: raw?.callbackUrl?.trim() || void 0
-	};
-}
-function isSlashCommandsEnabled(config) {
-	if (config.native === true) return true;
-	if (config.native === false) return false;
-	return false;
-}
-/**
-* Build the callback URL that Mattermost will POST to when a command is invoked.
-*/
-function resolveCallbackUrl(params) {
-	if (params.config.callbackUrl) return params.config.callbackUrl;
-	const isWildcardBindHost = (rawHost) => {
-		const trimmed = rawHost.trim();
-		if (!trimmed) return false;
-		const host = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
-		return host === "0.0.0.0" || host === "::" || host === "0:0:0:0:0:0:0:0" || host === "::0";
-	};
-	let host = params.gatewayHost && !isWildcardBindHost(params.gatewayHost) ? params.gatewayHost : "localhost";
-	const path = normalizeCallbackPath(params.config.callbackPath);
-	if (host.includes(":") && !(host.startsWith("[") && host.endsWith("]"))) host = `[${host}]`;
-	return `http://${host}:${params.gatewayPort}${path}`;
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/slash-http.ts
-const MAX_BODY_BYTES = 64 * 1024;
-const BODY_READ_TIMEOUT_MS = 5e3;
-/**
-* Read the full request body as a string.
-*/
-function readBody(req, maxBytes) {
-	return readRequestBodyWithLimit(req, {
-		maxBytes,
-		timeoutMs: BODY_READ_TIMEOUT_MS
-	});
-}
-function sendJsonResponse(res, status, body) {
-	res.statusCode = status;
-	res.setHeader("Content-Type", "application/json; charset=utf-8");
-	res.end(JSON.stringify(body));
-}
-async function authorizeSlashInvocation(params) {
-	const { account, cfg, client, commandText, channelId, senderId, senderName, log } = params;
-	const core = getMattermostRuntime();
-	let channelInfo = null;
-	try {
-		channelInfo = await fetchMattermostChannel(client, channelId);
-	} catch (err) {
-		log?.(`mattermost: slash channel lookup failed for ${channelId}: ${String(err)}`);
-	}
-	if (!channelInfo) return {
-		ok: false,
-		denyResponse: {
-			response_type: "ephemeral",
-			text: "Temporary error: unable to determine channel type. Please try again."
-		},
-		commandAuthorized: false,
-		channelInfo: null,
-		kind: "channel",
-		chatType: "channel",
-		channelName: "",
-		channelDisplay: "",
-		roomLabel: `#${channelId}`
-	};
-	const allowTextCommands = core.channel.commands.shouldHandleTextCommands({
-		cfg,
-		surface: "mattermost"
-	});
-	const hasControlCommand = core.channel.text.hasControlCommand(commandText, cfg);
-	const storeAllowFrom = normalizeMattermostAllowList(await core.channel.pairing.readAllowFromStore({
-		channel: "mattermost",
-		accountId: account.accountId
-	}).catch(() => []));
-	const decision = authorizeMattermostCommandInvocation({
-		account,
-		cfg,
-		senderId,
-		senderName,
-		channelId,
-		channelInfo,
-		storeAllowFrom,
-		allowTextCommands,
-		hasControlCommand
-	});
-	if (!decision.ok) {
-		if (decision.denyReason === "dm-pairing") {
-			const { code } = await core.channel.pairing.upsertPairingRequest({
-				channel: "mattermost",
-				accountId: account.accountId,
-				id: senderId,
-				meta: { name: senderName }
-			});
-			return {
-				...decision,
-				denyResponse: {
-					response_type: "ephemeral",
-					text: core.channel.pairing.buildPairingReply({
-						channel: "mattermost",
-						idLine: `Your Mattermost user id: ${senderId}`,
-						code
-					})
-				}
-			};
-		}
-		const denyText = decision.denyReason === "unknown-channel" ? "Temporary error: unable to determine channel type. Please try again." : decision.denyReason === "dm-disabled" ? "This bot is not accepting direct messages." : decision.denyReason === "channels-disabled" ? "Slash commands are disabled in channels." : decision.denyReason === "channel-no-allowlist" ? "Slash commands are not configured for this channel (no allowlist)." : "Unauthorized.";
-		return {
-			...decision,
-			denyResponse: {
-				response_type: "ephemeral",
-				text: denyText
-			}
-		};
-	}
-	return {
-		...decision,
-		denyResponse: void 0
-	};
-}
-/**
-* Create the HTTP request handler for Mattermost slash command callbacks.
-*
-* This handler is registered as a plugin HTTP route and receives POSTs
-* from the Mattermost server when a user invokes a registered slash command.
-*/
-function createSlashCommandHttpHandler(params) {
-	const { account, cfg, runtime, commandTokens, triggerMap, log } = params;
-	return async (req, res) => {
-		if (req.method !== "POST") {
-			res.statusCode = 405;
-			res.setHeader("Allow", "POST");
-			res.end("Method Not Allowed");
-			return;
-		}
-		let body;
-		try {
-			body = await readBody(req, MAX_BODY_BYTES);
-		} catch (error) {
-			if (isRequestBodyLimitError(error, "REQUEST_BODY_TIMEOUT")) {
-				res.statusCode = 408;
-				res.end("Request body timeout");
-				return;
-			}
-			res.statusCode = 413;
-			res.end("Payload Too Large");
-			return;
-		}
-		const contentType = req.headers["content-type"] ?? "";
-		const payload = parseSlashCommandPayload(body, contentType);
-		if (!payload) {
-			sendJsonResponse(res, 400, {
-				response_type: "ephemeral",
-				text: "Invalid slash command payload."
-			});
-			return;
-		}
-		if (commandTokens.size === 0 || !commandTokens.has(payload.token)) {
-			sendJsonResponse(res, 401, {
-				response_type: "ephemeral",
-				text: "Unauthorized: invalid command token."
-			});
-			return;
-		}
-		const trigger = payload.command.replace(/^\//, "").trim();
-		const commandText = resolveCommandText(trigger, payload.text, triggerMap);
-		const channelId = payload.channel_id;
-		const senderId = payload.user_id;
-		const senderName = payload.user_name ?? senderId;
-		const client = createMattermostClient({
-			baseUrl: account.baseUrl ?? "",
-			botToken: account.botToken ?? ""
-		});
-		const auth = await authorizeSlashInvocation({
-			account,
-			cfg,
-			client,
-			commandText,
-			channelId,
-			senderId,
-			senderName,
-			log
-		});
-		if (!auth.ok) {
-			sendJsonResponse(res, 200, auth.denyResponse ?? {
-				response_type: "ephemeral",
-				text: "Unauthorized."
-			});
-			return;
-		}
-		log?.(`mattermost: slash command /${trigger} from ${senderName} in ${channelId}`);
-		sendJsonResponse(res, 200, {
-			response_type: "ephemeral",
-			text: "Processing..."
-		});
-		try {
-			await handleSlashCommandAsync({
-				account,
-				cfg,
-				runtime,
-				client,
-				commandText,
-				channelId,
-				senderId,
-				senderName,
-				teamId: payload.team_id,
-				triggerId: payload.trigger_id,
-				kind: auth.kind,
-				chatType: auth.chatType,
-				channelName: auth.channelName,
-				channelDisplay: auth.channelDisplay,
-				roomLabel: auth.roomLabel,
-				commandAuthorized: auth.commandAuthorized,
-				log
-			});
-		} catch (err) {
-			log?.(`mattermost: slash command handler error: ${String(err)}`);
-			try {
-				await sendMessageMattermost(`channel:${channelId}`, "Sorry, something went wrong processing that command.", { accountId: account.accountId });
-			} catch {}
-		}
-	};
-}
-async function handleSlashCommandAsync(params) {
-	const { account, cfg, runtime, client, commandText, channelId, senderId, senderName, teamId, kind, chatType, channelName, channelDisplay, roomLabel, commandAuthorized, triggerId, log } = params;
-	const core = getMattermostRuntime();
-	const route = core.channel.routing.resolveAgentRoute({
-		cfg,
-		channel: "mattermost",
-		accountId: account.accountId,
-		teamId,
-		peer: {
-			kind,
-			id: kind === "direct" ? senderId : channelId
-		}
-	});
-	const fromLabel = kind === "direct" ? `Mattermost DM from ${senderName}` : `Mattermost message in ${roomLabel} from ${senderName}`;
-	const to = kind === "direct" ? `user:${senderId}` : `channel:${channelId}`;
-	const pickerEntry = resolveMattermostModelPickerEntry(commandText);
-	if (pickerEntry) {
-		const data = await buildModelsProviderData(cfg, route.agentId);
-		if (data.providers.length === 0) {
-			await sendMessageMattermost(to, "No models available.", { accountId: account.accountId });
-			return;
-		}
-		const currentModel = resolveMattermostModelPickerCurrentModel({
-			cfg,
-			route,
-			data
-		});
-		const view = pickerEntry.kind === "summary" ? renderMattermostModelSummaryView({
-			ownerUserId: senderId,
-			currentModel
-		}) : pickerEntry.kind === "providers" ? renderMattermostProviderPickerView({
-			ownerUserId: senderId,
-			data,
-			currentModel
-		}) : renderMattermostModelsPickerView({
-			ownerUserId: senderId,
-			data,
-			provider: pickerEntry.provider,
-			page: 1,
-			currentModel
-		});
-		await sendMessageMattermost(to, view.text, {
-			accountId: account.accountId,
-			buttons: view.buttons
-		});
-		runtime.log?.(`delivered model picker to ${to}`);
-		return;
-	}
-	const ctxPayload = core.channel.reply.finalizeInboundContext({
-		Body: commandText,
-		BodyForAgent: commandText,
-		RawBody: commandText,
-		CommandBody: commandText,
-		From: kind === "direct" ? `mattermost:${senderId}` : kind === "group" ? `mattermost:group:${channelId}` : `mattermost:channel:${channelId}`,
-		To: to,
-		SessionKey: route.sessionKey,
-		AccountId: route.accountId,
-		ChatType: chatType,
-		ConversationLabel: fromLabel,
-		GroupSubject: kind !== "direct" ? channelDisplay || roomLabel : void 0,
-		SenderName: senderName,
-		SenderId: senderId,
-		Provider: "mattermost",
-		Surface: "mattermost",
-		MessageSid: triggerId ?? `slash-${Date.now()}`,
-		Timestamp: Date.now(),
-		WasMentioned: true,
-		CommandAuthorized: commandAuthorized,
-		CommandSource: "native",
-		OriginatingChannel: "mattermost",
-		OriginatingTo: to
-	});
-	const textLimit = core.channel.text.resolveTextChunkLimit(cfg, "mattermost", account.accountId, { fallbackLimit: account.textChunkLimit ?? 4e3 });
-	const tableMode = core.channel.text.resolveMarkdownTableMode({
-		cfg,
-		channel: "mattermost",
-		accountId: account.accountId
-	});
-	const { onModelSelected, ...prefixOptions } = createReplyPrefixOptions({
-		cfg,
-		agentId: route.agentId,
-		channel: "mattermost",
-		accountId: account.accountId
-	});
-	const humanDelay = core.channel.reply.resolveHumanDelayConfig(cfg, route.agentId);
-	const typingCallbacks = createTypingCallbacks({
-		start: () => sendMattermostTyping(client, { channelId }),
-		onStartError: (err) => {
-			logTypingFailure({
-				log: (message) => log?.(message),
-				channel: "mattermost",
-				target: channelId,
-				error: err
-			});
-		}
-	});
-	const { dispatcher, replyOptions, markDispatchIdle } = core.channel.reply.createReplyDispatcherWithTyping({
-		...prefixOptions,
-		humanDelay,
-		deliver: async (payload) => {
-			await deliverMattermostReplyPayload({
-				core,
-				cfg,
-				payload,
-				to,
-				accountId: account.accountId,
-				agentId: route.agentId,
-				textLimit,
-				tableMode,
-				sendMessage: sendMessageMattermost
-			});
-			runtime.log?.(`delivered slash reply to ${to}`);
-		},
-		onError: (err, info) => {
-			runtime.error?.(`mattermost slash ${info.kind} reply failed: ${String(err)}`);
-		},
-		onReplyStart: typingCallbacks.onReplyStart
-	});
-	await core.channel.reply.withReplyDispatcher({
-		dispatcher,
-		onSettled: () => {
-			markDispatchIdle();
-		},
-		run: () => core.channel.reply.dispatchReplyFromConfig({
-			ctx: ctxPayload,
-			cfg,
-			dispatcher,
-			replyOptions: {
-				...replyOptions,
-				disableBlockStreaming: typeof account.blockStreaming === "boolean" ? !account.blockStreaming : void 0,
-				onModelSelected
-			}
-		})
-	});
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/slash-state.ts
-/** Map from accountId → per-account slash command state. */
-const accountStates = /* @__PURE__ */ new Map();
-function resolveSlashHandlerForToken(token) {
-	const matches = [];
-	for (const [accountId, state] of accountStates) if (state.commandTokens.has(token) && state.handler) matches.push({
-		accountId,
-		handler: state.handler
-	});
-	if (matches.length === 0) return { kind: "none" };
-	if (matches.length === 1) return {
-		kind: "single",
-		handler: matches[0].handler,
-		accountIds: [matches[0].accountId]
-	};
-	return {
-		kind: "ambiguous",
-		accountIds: matches.map((entry) => entry.accountId)
-	};
-}
-/**
-* Get the slash command state for a specific account, or null if not activated.
-*/
-function getSlashCommandState(accountId) {
-	return accountStates.get(accountId) ?? null;
-}
-/**
-* Activate slash commands for a specific account.
-* Called from the monitor after bot connects.
-*/
-function activateSlashCommands(params) {
-	const { account, commandTokens, registeredCommands, triggerMap, api, log } = params;
-	const accountId = account.accountId;
-	const tokenSet = new Set(commandTokens);
-	const handler = createSlashCommandHttpHandler({
-		account,
-		cfg: api.cfg,
-		runtime: api.runtime,
-		commandTokens: tokenSet,
-		triggerMap,
-		log
-	});
-	accountStates.set(accountId, {
-		commandTokens: tokenSet,
-		registeredCommands,
-		handler,
-		account,
-		triggerMap: triggerMap ?? /* @__PURE__ */ new Map()
-	});
-	log?.(`mattermost: slash commands activated for account ${accountId} (${registeredCommands.length} commands)`);
-}
-/**
-* Deactivate slash commands for a specific account (on shutdown/disconnect).
-*/
-function deactivateSlashCommands(accountId) {
-	if (accountId) {
-		const state = accountStates.get(accountId);
-		if (state) {
-			state.commandTokens.clear();
-			state.registeredCommands = [];
-			state.handler = null;
-			accountStates.delete(accountId);
-		}
-	} else {
-		for (const [, state] of accountStates) {
-			state.commandTokens.clear();
-			state.registeredCommands = [];
-			state.handler = null;
-		}
-		accountStates.clear();
-	}
-}
-/**
-* Register the HTTP route for slash command callbacks.
-* Called during plugin registration.
-*
-* The single HTTP route dispatches to the correct per-account handler
-* by matching the inbound token against each account's registered tokens.
-*/
-function registerSlashCommandRoute(api) {
-	const mmConfig = api.config.channels?.mattermost;
-	const callbackPaths = /* @__PURE__ */ new Set();
-	const addCallbackPaths = (raw) => {
-		const resolved = resolveSlashCommandConfig(raw);
-		callbackPaths.add(resolved.callbackPath);
-		if (resolved.callbackUrl) try {
-			const urlPath = new URL(resolved.callbackUrl).pathname;
-			if (urlPath && urlPath !== resolved.callbackPath) callbackPaths.add(urlPath);
-		} catch {}
-	};
-	const commandsRaw = mmConfig?.commands;
-	addCallbackPaths(commandsRaw);
-	const accountsRaw = mmConfig?.accounts ?? {};
-	for (const accountId of Object.keys(accountsRaw)) {
-		const accountCommandsRaw = accountsRaw[accountId]?.commands;
-		addCallbackPaths(accountCommandsRaw);
-	}
-	const routeHandler = async (req, res) => {
-		if (accountStates.size === 0) {
-			res.statusCode = 503;
-			res.setHeader("Content-Type", "application/json; charset=utf-8");
-			res.end(JSON.stringify({
-				response_type: "ephemeral",
-				text: "Slash commands are not yet initialized. Please try again in a moment."
-			}));
-			return;
-		}
-		if (accountStates.size === 1) {
-			const [, state] = [...accountStates.entries()][0];
-			if (!state.handler) {
-				res.statusCode = 503;
-				res.setHeader("Content-Type", "application/json; charset=utf-8");
-				res.end(JSON.stringify({
-					response_type: "ephemeral",
-					text: "Slash commands are not yet initialized. Please try again in a moment."
-				}));
-				return;
-			}
-			await state.handler(req, res);
-			return;
-		}
-		const chunks = [];
-		const MAX_BODY = 64 * 1024;
-		let size = 0;
-		for await (const chunk of req) {
-			size += chunk.length;
-			if (size > MAX_BODY) {
-				res.statusCode = 413;
-				res.end("Payload Too Large");
-				return;
-			}
-			chunks.push(chunk);
-		}
-		const bodyStr = Buffer.concat(chunks).toString("utf8");
-		let token = null;
-		const ct = req.headers["content-type"] ?? "";
-		try {
-			if (ct.includes("application/json")) token = JSON.parse(bodyStr).token ?? null;
-			else token = new URLSearchParams(bodyStr).get("token");
-		} catch {}
-		const match = token ? resolveSlashHandlerForToken(token) : { kind: "none" };
-		if (match.kind === "none") {
-			res.statusCode = 401;
-			res.setHeader("Content-Type", "application/json; charset=utf-8");
-			res.end(JSON.stringify({
-				response_type: "ephemeral",
-				text: "Unauthorized: invalid command token."
-			}));
-			return;
-		}
-		if (match.kind === "ambiguous") {
-			api.logger.warn?.(`mattermost: slash callback token matched multiple accounts (${match.accountIds?.join(", ")})`);
-			res.statusCode = 409;
-			res.setHeader("Content-Type", "application/json; charset=utf-8");
-			res.end(JSON.stringify({
-				response_type: "ephemeral",
-				text: "Conflict: command token is not unique across accounts."
-			}));
-			return;
-		}
-		const matchedHandler = match.handler;
-		const { Readable } = await import("node:stream");
-		const syntheticReq = new Readable({ read() {
-			this.push(Buffer.from(bodyStr, "utf8"));
-			this.push(null);
-		} });
-		syntheticReq.method = req.method;
-		syntheticReq.url = req.url;
-		syntheticReq.headers = req.headers;
-		await matchedHandler(syntheticReq, res);
-	};
-	for (const callbackPath of callbackPaths) {
-		api.registerHttpRoute({
-			path: callbackPath,
-			auth: "plugin",
-			handler: routeHandler
-		});
-		api.logger.info?.(`mattermost: registered slash command callback at ${callbackPath}`);
-	}
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/monitor.ts
-const RECENT_MATTERMOST_MESSAGE_TTL_MS = 5 * 6e4;
-const RECENT_MATTERMOST_MESSAGE_MAX = 2e3;
-const CHANNEL_CACHE_TTL_MS = 5 * 6e4;
-const USER_CACHE_TTL_MS = 10 * 6e4;
-function isLoopbackHost(hostname) {
-	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
-}
-function normalizeInteractionSourceIps(values) {
-	return (values ?? []).map((value) => value.trim()).filter(Boolean);
-}
-const recentInboundMessages = createDedupeCache({
-	ttlMs: RECENT_MATTERMOST_MESSAGE_TTL_MS,
-	maxSize: RECENT_MATTERMOST_MESSAGE_MAX
-});
-function resolveRuntime(opts) {
-	return opts.runtime ?? {
-		log: console.log,
-		error: console.error,
-		exit: (code) => {
-			throw new Error(`exit ${code}`);
-		}
-	};
-}
-function isSystemPost(post) {
-	const type = post.type?.trim();
-	return Boolean(type);
-}
-function mapMattermostChannelTypeToChatType(channelType) {
-	if (!channelType) return "channel";
-	const normalized = channelType.trim().toUpperCase();
-	if (normalized === "D") return "direct";
-	if (normalized === "G") return "group";
-	if (normalized === "P") return "group";
-	return "channel";
-}
-function channelChatType(kind) {
-	if (kind === "direct") return "direct";
-	if (kind === "group") return "group";
-	return "channel";
-}
-function evaluateMattermostMentionGate(params) {
-	const shouldRequireMention = params.kind !== "direct" && params.resolveRequireMention({
-		cfg: params.cfg,
-		channel: "mattermost",
-		accountId: params.accountId,
-		groupId: params.channelId,
-		requireMentionOverride: params.requireMentionOverride
-	});
-	const shouldBypassMention = params.isControlCommand && shouldRequireMention && !params.wasMentioned && params.commandAuthorized;
-	const effectiveWasMentioned = params.wasMentioned || shouldBypassMention || params.oncharTriggered;
-	if (params.oncharEnabled && !params.oncharTriggered && !params.wasMentioned && !params.isControlCommand) return {
-		shouldRequireMention,
-		shouldBypassMention,
-		effectiveWasMentioned,
-		dropReason: "onchar-not-triggered"
-	};
-	if (params.kind !== "direct" && shouldRequireMention && params.canDetectMention && !effectiveWasMentioned) return {
-		shouldRequireMention,
-		shouldBypassMention,
-		effectiveWasMentioned,
-		dropReason: "missing-mention"
-	};
-	return {
-		shouldRequireMention,
-		shouldBypassMention,
-		effectiveWasMentioned,
-		dropReason: null
-	};
-}
-function resolveMattermostReplyRootId(params) {
-	const threadRootId = params.threadRootId?.trim();
-	if (threadRootId) return threadRootId;
-	return params.replyToId?.trim() || void 0;
-}
-function resolveMattermostEffectiveReplyToId(params) {
-	const threadRootId = params.threadRootId?.trim();
-	if (threadRootId) return threadRootId;
-	if (params.kind === "direct") return;
-	const postId = params.postId?.trim();
-	if (!postId) return;
-	return params.replyToMode === "all" || params.replyToMode === "first" ? postId : void 0;
-}
-function resolveMattermostThreadSessionContext(params) {
-	const effectiveReplyToId = resolveMattermostEffectiveReplyToId({
-		kind: params.kind,
-		postId: params.postId,
-		replyToMode: params.replyToMode,
-		threadRootId: params.threadRootId
-	});
-	const threadKeys = resolveThreadSessionKeys({
-		baseSessionKey: params.baseSessionKey,
-		threadId: effectiveReplyToId,
-		parentSessionKey: effectiveReplyToId ? params.baseSessionKey : void 0
-	});
-	return {
-		effectiveReplyToId,
-		sessionKey: threadKeys.sessionKey,
-		parentSessionKey: threadKeys.parentSessionKey
-	};
-}
-function buildMattermostAttachmentPlaceholder(mediaList) {
-	if (mediaList.length === 0) return "";
-	if (mediaList.length === 1) return `<media:${mediaList[0].kind === "unknown" ? "document" : mediaList[0].kind}>`;
-	const allImages = mediaList.every((media) => media.kind === "image");
-	const label = allImages ? "image" : "file";
-	const suffix = mediaList.length === 1 ? label : `${label}s`;
-	return `${allImages ? "<media:image>" : "<media:document>"} (${mediaList.length} ${suffix})`;
-}
-function buildMattermostWsUrl(baseUrl) {
-	const normalized = normalizeMattermostBaseUrl(baseUrl);
-	if (!normalized) throw new Error("Mattermost baseUrl is required");
-	return `${normalized.replace(/^http/i, "ws")}/api/v4/websocket`;
-}
-async function monitorMattermostProvider(opts = {}) {
-	const core = getMattermostRuntime();
-	const runtime = resolveRuntime(opts);
-	const cfg = opts.config ?? core.config.loadConfig();
-	const account = resolveMattermostAccount({
-		cfg,
-		accountId: opts.accountId
-	});
-	const pairing = createScopedPairingAccess({
-		core,
-		channel: "mattermost",
-		accountId: account.accountId
-	});
-	const allowNameMatching = isDangerousNameMatchingEnabled(account.config);
-	const botToken = opts.botToken?.trim() || account.botToken?.trim();
-	if (!botToken) throw new Error(`Mattermost bot token missing for account "${account.accountId}" (set channels.mattermost.accounts.${account.accountId}.botToken or MATTERMOST_BOT_TOKEN for default).`);
-	const baseUrl = normalizeMattermostBaseUrl(opts.baseUrl ?? account.baseUrl);
-	if (!baseUrl) throw new Error(`Mattermost baseUrl missing for account "${account.accountId}" (set channels.mattermost.accounts.${account.accountId}.baseUrl or MATTERMOST_URL for default).`);
-	const client = createMattermostClient({
-		baseUrl,
-		botToken
-	});
-	const botUser = await fetchMattermostMe(client);
-	const botUserId = botUser.id;
-	const botUsername = botUser.username?.trim() || void 0;
-	runtime.log?.(`mattermost connected as ${botUsername ? `@${botUsername}` : botUserId}`);
-	const commandsRaw = account.config.commands;
-	const slashConfig = resolveSlashCommandConfig(commandsRaw);
-	const slashEnabled = isSlashCommandsEnabled(slashConfig);
-	if (slashEnabled) try {
-		const teams = await fetchMattermostUserTeams(client, botUserId);
-		const envPortRaw = process.env.MOLDCLAW_GATEWAY_PORT?.trim();
-		const slashCallbackUrl = resolveCallbackUrl({
-			config: slashConfig,
-			gatewayPort: parseStrictPositiveInteger(envPortRaw) ?? cfg.gateway?.port ?? 18789,
-			gatewayHost: cfg.gateway?.customBindHost ?? void 0
-		});
-		try {
-			const mmHost = new URL(baseUrl).hostname;
-			const callbackHost = new URL(slashCallbackUrl).hostname;
-			if (isLoopbackHost(callbackHost) && !isLoopbackHost(mmHost)) runtime.error?.(`mattermost: slash commands callbackUrl resolved to ${slashCallbackUrl} (loopback) while baseUrl is ${baseUrl}. This MAY be unreachable depending on your deployment. If native slash commands don't work, set channels.mattermost.commands.callbackUrl to a URL reachable from the Mattermost server (e.g. your public reverse proxy URL).`);
-		} catch {}
-		const commandsToRegister = [...DEFAULT_COMMAND_SPECS];
-		if (slashConfig.nativeSkills === true) try {
-			const skillCommands = listSkillCommandsForAgents({ cfg });
-			for (const spec of skillCommands) {
-				const name = typeof spec.name === "string" ? spec.name.trim() : "";
-				if (!name) continue;
-				const trigger = name.startsWith("oc_") ? name : `oc_${name}`;
-				commandsToRegister.push({
-					trigger,
-					description: spec.description || `Run skill ${name}`,
-					autoComplete: true,
-					autoCompleteHint: "[args]",
-					originalName: name
-				});
-			}
-		} catch (err) {
-			runtime.error?.(`mattermost: failed to list skill commands: ${String(err)}`);
-		}
-		const seen = /* @__PURE__ */ new Set();
-		const dedupedCommands = commandsToRegister.filter((cmd) => {
-			const key = cmd.trigger.trim();
-			if (!key) return false;
-			if (seen.has(key)) return false;
-			seen.add(key);
-			return true;
-		});
-		const allRegistered = [];
-		let teamRegistrationFailures = 0;
-		for (const team of teams) try {
-			const registered = await registerSlashCommands({
-				client,
-				teamId: team.id,
-				creatorUserId: botUserId,
-				callbackUrl: slashCallbackUrl,
-				commands: dedupedCommands,
-				log: (msg) => runtime.log?.(msg)
-			});
-			allRegistered.push(...registered);
-		} catch (err) {
-			teamRegistrationFailures += 1;
-			runtime.error?.(`mattermost: failed to register slash commands for team ${team.id}: ${String(err)}`);
-		}
-		if (allRegistered.length === 0) runtime.error?.("mattermost: native slash commands enabled but no commands could be registered; keeping slash callbacks inactive");
-		else {
-			if (teamRegistrationFailures > 0) runtime.error?.(`mattermost: slash command registration completed with ${teamRegistrationFailures} team error(s)`);
-			const triggerMap = /* @__PURE__ */ new Map();
-			for (const cmd of dedupedCommands) if (cmd.originalName) triggerMap.set(cmd.trigger, cmd.originalName);
-			activateSlashCommands({
-				account,
-				commandTokens: allRegistered.map((cmd) => cmd.token).filter(Boolean),
-				registeredCommands: allRegistered,
-				triggerMap,
-				api: {
-					cfg,
-					runtime
-				},
-				log: (msg) => runtime.log?.(msg)
-			});
-			runtime.log?.(`mattermost: slash commands registered (${allRegistered.length} commands across ${teams.length} teams, callback=${slashCallbackUrl})`);
-		}
-	} catch (err) {
-		runtime.error?.(`mattermost: failed to register slash commands: ${String(err)}`);
-	}
-	setInteractionSecret(account.accountId, botToken);
-	const interactionPath = resolveInteractionCallbackPath(account.accountId);
-	const callbackUrl = computeInteractionCallbackUrl(account.accountId, {
-		gateway: cfg.gateway,
-		interactions: account.config.interactions
-	});
-	setInteractionCallbackUrl(account.accountId, callbackUrl);
-	const allowedInteractionSourceIps = normalizeInteractionSourceIps(account.config.interactions?.allowedSourceIps);
-	try {
-		const mmHost = new URL(baseUrl).hostname;
-		const callbackHost = new URL(callbackUrl).hostname;
-		if (isLoopbackHost(callbackHost) && !isLoopbackHost(mmHost)) runtime.error?.(`mattermost: interactions callbackUrl resolved to ${callbackUrl} (loopback) while baseUrl is ${baseUrl}. This MAY be unreachable depending on your deployment. If button clicks don't work, set channels.mattermost.interactions.callbackBaseUrl to a URL reachable from the Mattermost server (e.g. your public reverse proxy URL).`);
-		if (!isLoopbackHost(callbackHost) && allowedInteractionSourceIps.length === 0) runtime.error?.(`mattermost: interactions callbackUrl resolved to ${callbackUrl} without channels.mattermost.interactions.allowedSourceIps. For safety, non-loopback callback sources will be rejected until you allowlist the Mattermost server or trusted ingress IPs.`);
-	} catch {}
-	const effectiveInteractionSourceIps = allowedInteractionSourceIps.length > 0 ? allowedInteractionSourceIps : ["127.0.0.1", "::1"];
-	const unregisterInteractions = registerPluginHttpRoute({
-		path: interactionPath,
-		fallbackPath: "/mattermost/interactions/default",
-		auth: "plugin",
-		handler: createMattermostInteractionHandler({
-			client,
-			botUserId,
-			accountId: account.accountId,
-			allowedSourceIps: effectiveInteractionSourceIps,
-			trustedProxies: cfg.gateway?.trustedProxies,
-			allowRealIpFallback: cfg.gateway?.allowRealIpFallback === true,
-			handleInteraction: handleModelPickerInteraction,
-			authorizeButtonClick: async ({ payload, post }) => {
-				const channelInfo = await resolveChannelInfo(payload.channel_id);
-				const isDirect = channelInfo?.type?.trim().toUpperCase() === "D";
-				const allowTextCommands = core.channel.commands.shouldHandleTextCommands({
-					cfg,
-					surface: "mattermost"
-				});
-				const decision = authorizeMattermostCommandInvocation({
-					account,
-					cfg,
-					senderId: payload.user_id,
-					senderName: payload.user_name ?? "",
-					channelId: payload.channel_id,
-					channelInfo,
-					storeAllowFrom: isDirect ? await readStoreAllowFromForDmPolicy({
-						provider: "mattermost",
-						accountId: account.accountId,
-						dmPolicy: account.config.dmPolicy ?? "pairing",
-						readStore: pairing.readStoreForDmPolicy
-					}) : void 0,
-					allowTextCommands,
-					hasControlCommand: false
-				});
-				if (decision.ok) return { ok: true };
-				return {
-					ok: false,
-					response: {
-						update: {
-							message: post.message ?? "",
-							props: post.props
-						},
-						ephemeral_text: `MoldClaw ignored this action for ${decision.roomLabel}.`
-					}
-				};
-			},
-			resolveSessionKey: async ({ channelId, userId, post }) => {
-				const channelInfo = await resolveChannelInfo(channelId);
-				const kind = mapMattermostChannelTypeToChatType(channelInfo?.type);
-				const teamId = channelInfo?.team_id ?? void 0;
-				const route = core.channel.routing.resolveAgentRoute({
-					cfg,
-					channel: "mattermost",
-					accountId: account.accountId,
-					teamId,
-					peer: {
-						kind,
-						id: kind === "direct" ? userId : channelId
-					}
-				});
-				const replyToMode = resolveMattermostReplyToMode(account, kind);
-				return resolveMattermostThreadSessionContext({
-					baseSessionKey: route.sessionKey,
-					kind,
-					postId: post.id || void 0,
-					replyToMode,
-					threadRootId: post.root_id
-				}).sessionKey;
-			},
-			dispatchButtonClick: async (opts) => {
-				const channelInfo = await resolveChannelInfo(opts.channelId);
-				const kind = mapMattermostChannelTypeToChatType(channelInfo?.type);
-				const chatType = channelChatType(kind);
-				const teamId = channelInfo?.team_id ?? void 0;
-				const channelName = channelInfo?.name ?? void 0;
-				const channelDisplay = channelInfo?.display_name ?? channelName ?? opts.channelId;
-				const route = core.channel.routing.resolveAgentRoute({
-					cfg,
-					channel: "mattermost",
-					accountId: account.accountId,
-					teamId,
-					peer: {
-						kind,
-						id: kind === "direct" ? opts.userId : opts.channelId
-					}
-				});
-				const replyToMode = resolveMattermostReplyToMode(account, kind);
-				const threadContext = resolveMattermostThreadSessionContext({
-					baseSessionKey: route.sessionKey,
-					kind,
-					postId: opts.post.id || opts.postId,
-					replyToMode,
-					threadRootId: opts.post.root_id
-				});
-				const to = kind === "direct" ? `user:${opts.userId}` : `channel:${opts.channelId}`;
-				const bodyText = `[Button click: user @${opts.userName} selected "${opts.actionName}"]`;
-				const ctxPayload = core.channel.reply.finalizeInboundContext({
-					Body: bodyText,
-					BodyForAgent: bodyText,
-					RawBody: bodyText,
-					CommandBody: bodyText,
-					From: kind === "direct" ? `mattermost:${opts.userId}` : kind === "group" ? `mattermost:group:${opts.channelId}` : `mattermost:channel:${opts.channelId}`,
-					To: to,
-					SessionKey: threadContext.sessionKey,
-					ParentSessionKey: threadContext.parentSessionKey,
-					AccountId: route.accountId,
-					ChatType: chatType,
-					ConversationLabel: `mattermost:${opts.userName}`,
-					GroupSubject: kind !== "direct" ? channelDisplay : void 0,
-					GroupChannel: channelName ? `#${channelName}` : void 0,
-					GroupSpace: teamId,
-					SenderName: opts.userName,
-					SenderId: opts.userId,
-					Provider: "mattermost",
-					Surface: "mattermost",
-					MessageSid: `interaction:${opts.postId}:${opts.actionId}`,
-					ReplyToId: threadContext.effectiveReplyToId,
-					MessageThreadId: threadContext.effectiveReplyToId,
-					WasMentioned: true,
-					CommandAuthorized: false,
-					OriginatingChannel: "mattermost",
-					OriginatingTo: to
-				});
-				const textLimit = core.channel.text.resolveTextChunkLimit(cfg, "mattermost", account.accountId, { fallbackLimit: account.textChunkLimit ?? 4e3 });
-				const tableMode = core.channel.text.resolveMarkdownTableMode({
-					cfg,
-					channel: "mattermost",
-					accountId: account.accountId
-				});
-				const { onModelSelected, ...prefixOptions } = createReplyPrefixOptions({
-					cfg,
-					agentId: route.agentId,
-					channel: "mattermost",
-					accountId: account.accountId
-				});
-				const typingCallbacks = createTypingCallbacks({
-					start: () => sendTypingIndicator(opts.channelId, threadContext.effectiveReplyToId),
-					onStartError: (err) => {
-						logTypingFailure({
-							log: (message) => logger.debug?.(message),
-							channel: "mattermost",
-							target: opts.channelId,
-							error: err
-						});
-					}
-				});
-				const { dispatcher, replyOptions, markDispatchIdle } = core.channel.reply.createReplyDispatcherWithTyping({
-					...prefixOptions,
-					humanDelay: core.channel.reply.resolveHumanDelayConfig(cfg, route.agentId),
-					deliver: async (payload) => {
-						await deliverMattermostReplyPayload({
-							core,
-							cfg,
-							payload,
-							to,
-							accountId: account.accountId,
-							agentId: route.agentId,
-							replyToId: resolveMattermostReplyRootId({
-								threadRootId: threadContext.effectiveReplyToId,
-								replyToId: payload.replyToId
-							}),
-							textLimit,
-							tableMode,
-							sendMessage: sendMessageMattermost
-						});
-						runtime.log?.(`delivered button-click reply to ${to}`);
-					},
-					onError: (err, info) => {
-						runtime.error?.(`mattermost button-click ${info.kind} reply failed: ${String(err)}`);
-					},
-					onReplyStart: typingCallbacks.onReplyStart
-				});
-				await core.channel.reply.dispatchReplyFromConfig({
-					ctx: ctxPayload,
-					cfg,
-					dispatcher,
-					replyOptions: {
-						...replyOptions,
-						disableBlockStreaming: typeof account.blockStreaming === "boolean" ? !account.blockStreaming : void 0,
-						onModelSelected
-					}
-				});
-				markDispatchIdle();
-			},
-			log: (msg) => runtime.log?.(msg)
-		}),
-		pluginId: "mattermost",
-		source: "mattermost-interactions",
-		accountId: account.accountId,
-		log: (msg) => runtime.log?.(msg)
-	});
-	const channelCache = /* @__PURE__ */ new Map();
-	const userCache = /* @__PURE__ */ new Map();
-	const logger = core.logging.getChildLogger({ module: "mattermost" });
-	const logVerboseMessage = (message) => {
-		if (!core.logging.shouldLogVerbose()) return;
-		logger.debug?.(message);
-	};
-	const mediaMaxBytes = resolveChannelMediaMaxBytes({
-		cfg,
-		resolveChannelLimitMb: () => void 0,
-		accountId: account.accountId
-	}) ?? 8 * 1024 * 1024;
-	const historyLimit = Math.max(0, cfg.messages?.groupChat?.historyLimit ?? 50);
-	const channelHistories = /* @__PURE__ */ new Map();
-	const defaultGroupPolicy = resolveDefaultGroupPolicy(cfg);
-	const { groupPolicy, providerMissingFallbackApplied } = resolveAllowlistProviderRuntimeGroupPolicy({
-		providerConfigPresent: cfg.channels?.mattermost !== void 0,
-		groupPolicy: account.config.groupPolicy,
-		defaultGroupPolicy
-	});
-	warnMissingProviderGroupPolicyFallbackOnce({
-		providerMissingFallbackApplied,
-		providerKey: "mattermost",
-		accountId: account.accountId,
-		log: (message) => logVerboseMessage(message)
-	});
-	const resolveMattermostMedia = async (fileIds) => {
-		const ids = (fileIds ?? []).map((id) => id?.trim()).filter(Boolean);
-		if (ids.length === 0) return [];
-		const out = [];
-		for (const fileId of ids) try {
-			const fetched = await core.channel.media.fetchRemoteMedia({
-				url: `${client.apiBaseUrl}/files/${fileId}`,
-				requestInit: { headers: { Authorization: `Bearer ${client.token}` } },
-				filePathHint: fileId,
-				maxBytes: mediaMaxBytes,
-				ssrfPolicy: { allowedHostnames: [new URL(client.baseUrl).hostname] }
-			});
-			const saved = await core.channel.media.saveMediaBuffer(fetched.buffer, fetched.contentType ?? void 0, "inbound", mediaMaxBytes);
-			const contentType = saved.contentType ?? fetched.contentType ?? void 0;
-			out.push({
-				path: saved.path,
-				contentType,
-				kind: core.media.mediaKindFromMime(contentType) ?? "unknown"
-			});
-		} catch (err) {
-			logger.debug?.(`mattermost: failed to download file ${fileId}: ${String(err)}`);
-		}
-		return out;
-	};
-	const sendTypingIndicator = async (channelId, parentId) => {
-		await sendMattermostTyping(client, {
-			channelId,
-			parentId
-		});
-	};
-	const resolveChannelInfo = async (channelId) => {
-		const cached = channelCache.get(channelId);
-		if (cached && cached.expiresAt > Date.now()) return cached.value;
-		try {
-			const info = await fetchMattermostChannel(client, channelId);
-			channelCache.set(channelId, {
-				value: info,
-				expiresAt: Date.now() + CHANNEL_CACHE_TTL_MS
-			});
-			return info;
-		} catch (err) {
-			logger.debug?.(`mattermost: channel lookup failed: ${String(err)}`);
-			channelCache.set(channelId, {
-				value: null,
-				expiresAt: Date.now() + CHANNEL_CACHE_TTL_MS
-			});
-			return null;
-		}
-	};
-	const resolveUserInfo = async (userId) => {
-		const cached = userCache.get(userId);
-		if (cached && cached.expiresAt > Date.now()) return cached.value;
-		try {
-			const info = await fetchMattermostUser(client, userId);
-			userCache.set(userId, {
-				value: info,
-				expiresAt: Date.now() + USER_CACHE_TTL_MS
-			});
-			return info;
-		} catch (err) {
-			logger.debug?.(`mattermost: user lookup failed: ${String(err)}`);
-			userCache.set(userId, {
-				value: null,
-				expiresAt: Date.now() + USER_CACHE_TTL_MS
-			});
-			return null;
-		}
-	};
-	const buildModelPickerProps = (channelId, buttons) => buildButtonProps({
-		callbackUrl,
-		accountId: account.accountId,
-		channelId,
-		buttons
-	});
-	const updateModelPickerPost = async (params) => {
-		const props = buildModelPickerProps(params.channelId, params.buttons ?? []) ?? { attachments: [] };
-		await updateMattermostPost(client, params.postId, {
-			message: params.message,
-			props
-		});
-		return {};
-	};
-	const runModelPickerCommand = async (params) => {
-		const to = params.kind === "direct" ? `user:${params.senderId}` : `channel:${params.channelId}`;
-		const fromLabel = params.kind === "direct" ? `Mattermost DM from ${params.senderName}` : `Mattermost message in ${params.roomLabel} from ${params.senderName}`;
-		const ctxPayload = core.channel.reply.finalizeInboundContext({
-			Body: params.commandText,
-			BodyForAgent: params.commandText,
-			RawBody: params.commandText,
-			CommandBody: params.commandText,
-			From: params.kind === "direct" ? `mattermost:${params.senderId}` : params.kind === "group" ? `mattermost:group:${params.channelId}` : `mattermost:channel:${params.channelId}`,
-			To: to,
-			SessionKey: params.sessionKey,
-			ParentSessionKey: params.parentSessionKey,
-			AccountId: params.route.accountId,
-			ChatType: params.chatType,
-			ConversationLabel: fromLabel,
-			GroupSubject: params.kind !== "direct" ? params.channelDisplay || params.roomLabel : void 0,
-			GroupChannel: params.channelName ? `#${params.channelName}` : void 0,
-			GroupSpace: params.teamId,
-			SenderName: params.senderName,
-			SenderId: params.senderId,
-			Provider: "mattermost",
-			Surface: "mattermost",
-			MessageSid: `interaction:${params.postId}:${Date.now()}`,
-			ReplyToId: params.effectiveReplyToId,
-			MessageThreadId: params.effectiveReplyToId,
-			Timestamp: Date.now(),
-			WasMentioned: true,
-			CommandAuthorized: params.commandAuthorized,
-			CommandSource: "native",
-			OriginatingChannel: "mattermost",
-			OriginatingTo: to
-		});
-		const tableMode = core.channel.text.resolveMarkdownTableMode({
-			cfg,
-			channel: "mattermost",
-			accountId: account.accountId
-		});
-		const textLimit = core.channel.text.resolveTextChunkLimit(cfg, "mattermost", account.accountId, { fallbackLimit: account.textChunkLimit ?? 4e3 });
-		const { onModelSelected, ...prefixOptions } = createReplyPrefixOptions({
-			cfg,
-			agentId: params.route.agentId,
-			channel: "mattermost",
-			accountId: account.accountId
-		});
-		const shouldDeliverReplies = params.deliverReplies === true;
-		const capturedTexts = [];
-		const typingCallbacks = shouldDeliverReplies ? createTypingCallbacks({
-			start: () => sendTypingIndicator(params.channelId, params.effectiveReplyToId),
-			onStartError: (err) => {
-				logTypingFailure({
-					log: (message) => logger.debug?.(message),
-					channel: "mattermost",
-					target: params.channelId,
-					error: err
-				});
-			}
-		}) : void 0;
-		const { dispatcher, replyOptions, markDispatchIdle } = core.channel.reply.createReplyDispatcherWithTyping({
-			...prefixOptions,
-			deliver: async (payload) => {
-				const trimmedPayload = {
-					...payload,
-					text: core.channel.text.convertMarkdownTables(payload.text ?? "", tableMode).trim()
-				};
-				if (!shouldDeliverReplies) {
-					if (trimmedPayload.text) capturedTexts.push(trimmedPayload.text);
-					return;
-				}
-				await deliverMattermostReplyPayload({
-					core,
-					cfg,
-					payload: trimmedPayload,
-					to,
-					accountId: account.accountId,
-					agentId: params.route.agentId,
-					replyToId: resolveMattermostReplyRootId({
-						threadRootId: params.effectiveReplyToId,
-						replyToId: trimmedPayload.replyToId
-					}),
-					textLimit,
-					tableMode: "off",
-					sendMessage: sendMessageMattermost
-				});
-			},
-			onError: (err, info) => {
-				runtime.error?.(`mattermost model picker ${info.kind} reply failed: ${String(err)}`);
-			},
-			onReplyStart: typingCallbacks?.onReplyStart
-		});
-		await core.channel.reply.withReplyDispatcher({
-			dispatcher,
-			onSettled: () => {
-				markDispatchIdle();
-			},
-			run: () => core.channel.reply.dispatchReplyFromConfig({
-				ctx: ctxPayload,
-				cfg,
-				dispatcher,
-				replyOptions: {
-					...replyOptions,
-					disableBlockStreaming: typeof account.blockStreaming === "boolean" ? !account.blockStreaming : void 0,
-					onModelSelected
-				}
-			})
-		});
-		return capturedTexts.join("\n\n").trim();
-	};
-	async function handleModelPickerInteraction(params) {
-		const pickerState = parseMattermostModelPickerContext(params.context);
-		if (!pickerState) return null;
-		if (pickerState.ownerUserId !== params.payload.user_id) return { ephemeral_text: "Only the person who opened this picker can use it." };
-		const channelInfo = await resolveChannelInfo(params.payload.channel_id);
-		const pickerCommandText = pickerState.action === "select" ? `/model ${pickerState.provider}/${pickerState.model}` : pickerState.action === "list" ? `/models ${pickerState.provider}` : "/models";
-		const allowTextCommands = core.channel.commands.shouldHandleTextCommands({
-			cfg,
-			surface: "mattermost"
-		});
-		const hasControlCommand = core.channel.text.hasControlCommand(pickerCommandText, cfg);
-		const dmPolicy = account.config.dmPolicy ?? "pairing";
-		const storeAllowFrom = normalizeMattermostAllowList(await readStoreAllowFromForDmPolicy({
-			provider: "mattermost",
-			accountId: account.accountId,
-			dmPolicy,
-			readStore: pairing.readStoreForDmPolicy
-		}));
-		const auth = authorizeMattermostCommandInvocation({
-			account,
-			cfg,
-			senderId: params.payload.user_id,
-			senderName: params.userName,
-			channelId: params.payload.channel_id,
-			channelInfo,
-			storeAllowFrom,
-			allowTextCommands,
-			hasControlCommand
-		});
-		if (!auth.ok) {
-			if (auth.denyReason === "dm-pairing") {
-				const { code } = await pairing.upsertPairingRequest({
-					id: params.payload.user_id,
-					meta: { name: params.userName }
-				});
-				return { ephemeral_text: core.channel.pairing.buildPairingReply({
-					channel: "mattermost",
-					idLine: `Your Mattermost user id: ${params.payload.user_id}`,
-					code
-				}) };
-			}
-			return { ephemeral_text: auth.denyReason === "unknown-channel" ? "Temporary error: unable to determine channel type. Please try again." : auth.denyReason === "dm-disabled" ? "This bot is not accepting direct messages." : auth.denyReason === "channels-disabled" ? "Model picker actions are disabled in channels." : auth.denyReason === "channel-no-allowlist" ? "Model picker actions are not configured for this channel." : "Unauthorized." };
-		}
-		const kind = auth.kind;
-		const chatType = auth.chatType;
-		const teamId = auth.channelInfo.team_id ?? params.payload.team_id ?? void 0;
-		const channelName = auth.channelName || void 0;
-		const channelDisplay = auth.channelDisplay || auth.channelName || params.payload.channel_id;
-		const roomLabel = auth.roomLabel;
-		const route = core.channel.routing.resolveAgentRoute({
-			cfg,
-			channel: "mattermost",
-			accountId: account.accountId,
-			teamId,
-			peer: {
-				kind,
-				id: kind === "direct" ? params.payload.user_id : params.payload.channel_id
-			}
-		});
-		const replyToMode = resolveMattermostReplyToMode(account, kind);
-		const threadContext = resolveMattermostThreadSessionContext({
-			baseSessionKey: route.sessionKey,
-			kind,
-			postId: params.post.id || params.payload.post_id,
-			replyToMode,
-			threadRootId: params.post.root_id
-		});
-		const modelSessionRoute = {
-			agentId: route.agentId,
-			sessionKey: threadContext.sessionKey
-		};
-		const data = await buildModelsProviderData(cfg, route.agentId);
-		if (data.providers.length === 0) return await updateModelPickerPost({
-			channelId: params.payload.channel_id,
-			postId: params.payload.post_id,
-			message: "No models available."
-		});
-		if (pickerState.action === "providers" || pickerState.action === "back") {
-			const currentModel = resolveMattermostModelPickerCurrentModel({
-				cfg,
-				route: modelSessionRoute,
-				data
-			});
-			const view = renderMattermostProviderPickerView({
-				ownerUserId: pickerState.ownerUserId,
-				data,
-				currentModel
-			});
-			return await updateModelPickerPost({
-				channelId: params.payload.channel_id,
-				postId: params.payload.post_id,
-				message: view.text,
-				buttons: view.buttons
-			});
-		}
-		if (pickerState.action === "list") {
-			const currentModel = resolveMattermostModelPickerCurrentModel({
-				cfg,
-				route: modelSessionRoute,
-				data
-			});
-			const view = renderMattermostModelsPickerView({
-				ownerUserId: pickerState.ownerUserId,
-				data,
-				provider: pickerState.provider,
-				page: pickerState.page,
-				currentModel
-			});
-			return await updateModelPickerPost({
-				channelId: params.payload.channel_id,
-				postId: params.payload.post_id,
-				message: view.text,
-				buttons: view.buttons
-			});
-		}
-		const targetModelRef = `${pickerState.provider}/${pickerState.model}`;
-		if (!buildMattermostAllowedModelRefs(data).has(targetModelRef)) return { ephemeral_text: `That model is no longer available: ${targetModelRef}` };
-		(async () => {
-			try {
-				await runModelPickerCommand({
-					commandText: `/model ${targetModelRef}`,
-					commandAuthorized: auth.commandAuthorized,
-					route,
-					sessionKey: threadContext.sessionKey,
-					parentSessionKey: threadContext.parentSessionKey,
-					channelId: params.payload.channel_id,
-					senderId: params.payload.user_id,
-					senderName: params.userName,
-					kind,
-					chatType,
-					channelName,
-					channelDisplay,
-					roomLabel,
-					teamId,
-					postId: params.payload.post_id,
-					effectiveReplyToId: threadContext.effectiveReplyToId,
-					deliverReplies: true
-				});
-				const updatedModel = resolveMattermostModelPickerCurrentModel({
-					cfg,
-					route: modelSessionRoute,
-					data,
-					skipCache: true
-				});
-				const view = renderMattermostModelsPickerView({
-					ownerUserId: pickerState.ownerUserId,
-					data,
-					provider: pickerState.provider,
-					page: pickerState.page,
-					currentModel: updatedModel
-				});
-				await updateModelPickerPost({
-					channelId: params.payload.channel_id,
-					postId: params.payload.post_id,
-					message: view.text,
-					buttons: view.buttons
-				});
-			} catch (err) {
-				runtime.error?.(`mattermost model picker select failed: ${String(err)}`);
-			}
-		})();
-		return {};
-	}
-	const handlePost = async (post, payload, messageIds) => {
-		const channelId = post.channel_id ?? payload.data?.channel_id ?? payload.broadcast?.channel_id;
-		if (!channelId) {
-			logVerboseMessage("mattermost: drop post (missing channel id)");
-			return;
-		}
-		const allMessageIds = messageIds?.length ? messageIds : post.id ? [post.id] : [];
-		if (allMessageIds.length === 0) {
-			logVerboseMessage("mattermost: drop post (missing message id)");
-			return;
-		}
-		const dedupeEntries = allMessageIds.map((id) => recentInboundMessages.check(`${account.accountId}:${id}`));
-		if (dedupeEntries.length > 0 && dedupeEntries.every(Boolean)) {
-			logVerboseMessage(`mattermost: drop post (dedupe account=${account.accountId} ids=${allMessageIds.length})`);
-			return;
-		}
-		const senderId = post.user_id ?? payload.broadcast?.user_id;
-		if (!senderId) {
-			logVerboseMessage("mattermost: drop post (missing sender id)");
-			return;
-		}
-		if (senderId === botUserId) {
-			logVerboseMessage(`mattermost: drop post (self sender=${senderId})`);
-			return;
-		}
-		if (isSystemPost(post)) {
-			logVerboseMessage(`mattermost: drop post (system post type=${post.type ?? "unknown"})`);
-			return;
-		}
-		const channelInfo = await resolveChannelInfo(channelId);
-		const kind = mapMattermostChannelTypeToChatType(payload.data?.channel_type ?? channelInfo?.type ?? void 0);
-		const chatType = channelChatType(kind);
-		const senderName = payload.data?.sender_name?.trim() || (await resolveUserInfo(senderId))?.username?.trim() || senderId;
-		const rawText = post.message?.trim() || "";
-		const dmPolicy = account.config.dmPolicy ?? "pairing";
-		const normalizedAllowFrom = normalizeMattermostAllowList(account.config.allowFrom ?? []);
-		const normalizedGroupAllowFrom = normalizeMattermostAllowList(account.config.groupAllowFrom ?? []);
-		const storeAllowFrom = normalizeMattermostAllowList(await readStoreAllowFromForDmPolicy({
-			provider: "mattermost",
-			accountId: account.accountId,
-			dmPolicy,
-			readStore: pairing.readStoreForDmPolicy
-		}));
-		const accessDecision = resolveDmGroupAccessWithLists({
-			isGroup: kind !== "direct",
-			dmPolicy,
-			groupPolicy,
-			allowFrom: normalizedAllowFrom,
-			groupAllowFrom: normalizedGroupAllowFrom,
-			storeAllowFrom,
-			isSenderAllowed: (allowFrom) => isMattermostSenderAllowed({
-				senderId,
-				senderName,
-				allowFrom,
-				allowNameMatching
-			})
-		});
-		const effectiveAllowFrom = accessDecision.effectiveAllowFrom;
-		const effectiveGroupAllowFrom = accessDecision.effectiveGroupAllowFrom;
-		const allowTextCommands = core.channel.commands.shouldHandleTextCommands({
-			cfg,
-			surface: "mattermost"
-		});
-		const hasControlCommand = core.channel.text.hasControlCommand(rawText, cfg);
-		const isControlCommand = allowTextCommands && hasControlCommand;
-		const useAccessGroups = cfg.commands?.useAccessGroups !== false;
-		const commandDmAllowFrom = kind === "direct" ? effectiveAllowFrom : normalizedAllowFrom;
-		const senderAllowedForCommands = isMattermostSenderAllowed({
-			senderId,
-			senderName,
-			allowFrom: commandDmAllowFrom,
-			allowNameMatching
-		});
-		const groupAllowedForCommands = isMattermostSenderAllowed({
-			senderId,
-			senderName,
-			allowFrom: effectiveGroupAllowFrom,
-			allowNameMatching
-		});
-		const commandGate = resolveControlCommandGate({
-			useAccessGroups,
-			authorizers: [{
-				configured: commandDmAllowFrom.length > 0,
-				allowed: senderAllowedForCommands
-			}, {
-				configured: effectiveGroupAllowFrom.length > 0,
-				allowed: groupAllowedForCommands
-			}],
-			allowTextCommands,
-			hasControlCommand
-		});
-		const commandAuthorized = commandGate.commandAuthorized;
-		if (accessDecision.decision !== "allow") {
-			if (kind === "direct") {
-				if (accessDecision.reasonCode === DM_GROUP_ACCESS_REASON.DM_POLICY_DISABLED) {
-					logVerboseMessage(`mattermost: drop dm (dmPolicy=disabled sender=${senderId})`);
-					return;
-				}
-				if (accessDecision.decision === "pairing") {
-					const { code, created } = await pairing.upsertPairingRequest({
-						id: senderId,
-						meta: { name: senderName }
-					});
-					logVerboseMessage(`mattermost: pairing request sender=${senderId} created=${created}`);
-					if (created) try {
-						await sendMessageMattermost(`user:${senderId}`, core.channel.pairing.buildPairingReply({
-							channel: "mattermost",
-							idLine: `Your Mattermost user id: ${senderId}`,
-							code
-						}), { accountId: account.accountId });
-						opts.statusSink?.({ lastOutboundAt: Date.now() });
-					} catch (err) {
-						logVerboseMessage(`mattermost: pairing reply failed for ${senderId}: ${String(err)}`);
-					}
-					return;
-				}
-				logVerboseMessage(`mattermost: drop dm sender=${senderId} (dmPolicy=${dmPolicy})`);
-				return;
-			}
-			if (accessDecision.reasonCode === DM_GROUP_ACCESS_REASON.GROUP_POLICY_DISABLED) {
-				logVerboseMessage("mattermost: drop group message (groupPolicy=disabled)");
-				return;
-			}
-			if (accessDecision.reasonCode === DM_GROUP_ACCESS_REASON.GROUP_POLICY_EMPTY_ALLOWLIST) {
-				logVerboseMessage("mattermost: drop group message (no group allowlist)");
-				return;
-			}
-			if (accessDecision.reasonCode === DM_GROUP_ACCESS_REASON.GROUP_POLICY_NOT_ALLOWLISTED) {
-				logVerboseMessage(`mattermost: drop group sender=${senderId} (not in groupAllowFrom)`);
-				return;
-			}
-			logVerboseMessage(`mattermost: drop group message (groupPolicy=${groupPolicy} reason=${accessDecision.reason})`);
-			return;
-		}
-		if (kind !== "direct" && commandGate.shouldBlock) {
-			logInboundDrop({
-				log: logVerboseMessage,
-				channel: "mattermost",
-				reason: "control command (unauthorized)",
-				target: senderId
-			});
-			return;
-		}
-		const teamId = payload.data?.team_id ?? channelInfo?.team_id ?? void 0;
-		const channelName = payload.data?.channel_name ?? channelInfo?.name ?? "";
-		const channelDisplay = payload.data?.channel_display_name ?? channelInfo?.display_name ?? channelName;
-		const roomLabel = channelName ? `#${channelName}` : channelDisplay || `#${channelId}`;
-		const route = core.channel.routing.resolveAgentRoute({
-			cfg,
-			channel: "mattermost",
-			accountId: account.accountId,
-			teamId,
-			peer: {
-				kind,
-				id: kind === "direct" ? senderId : channelId
-			}
-		});
-		const baseSessionKey = route.sessionKey;
-		const threadRootId = post.root_id?.trim() || void 0;
-		const replyToMode = resolveMattermostReplyToMode(account, kind);
-		const { effectiveReplyToId, sessionKey, parentSessionKey } = resolveMattermostThreadSessionContext({
-			baseSessionKey,
-			kind,
-			postId: post.id,
-			replyToMode,
-			threadRootId
-		});
-		const historyKey = kind === "direct" ? null : sessionKey;
-		const mentionRegexes = core.channel.mentions.buildMentionRegexes(cfg, route.agentId);
-		const wasMentioned = kind !== "direct" && ((botUsername ? rawText.toLowerCase().includes(`@${botUsername.toLowerCase()}`) : false) || core.channel.mentions.matchesMentionPatterns(rawText, mentionRegexes));
-		const pendingBody = rawText || (post.file_ids?.length ? `[Mattermost ${post.file_ids.length === 1 ? "file" : "files"}]` : "");
-		const pendingSender = senderName;
-		const recordPendingHistory = () => {
-			const trimmed = pendingBody.trim();
-			recordPendingHistoryEntryIfEnabled({
-				historyMap: channelHistories,
-				limit: historyLimit,
-				historyKey: historyKey ?? "",
-				entry: historyKey && trimmed ? {
-					sender: pendingSender,
-					body: trimmed,
-					timestamp: typeof post.create_at === "number" ? post.create_at : void 0,
-					messageId: post.id ?? void 0
-				} : null
-			});
-		};
-		const oncharEnabled = account.chatmode === "onchar" && kind !== "direct";
-		const oncharPrefixes = oncharEnabled ? resolveOncharPrefixes(account.oncharPrefixes) : [];
-		const oncharResult = oncharEnabled ? stripOncharPrefix(rawText, oncharPrefixes) : {
-			triggered: false,
-			stripped: rawText
-		};
-		const oncharTriggered = oncharResult.triggered;
-		const canDetectMention = Boolean(botUsername) || mentionRegexes.length > 0;
-		const mentionDecision = evaluateMattermostMentionGate({
-			kind,
-			cfg,
-			accountId: account.accountId,
-			channelId,
-			threadRootId,
-			requireMentionOverride: account.requireMention,
-			resolveRequireMention: core.channel.groups.resolveRequireMention,
-			wasMentioned,
-			isControlCommand,
-			commandAuthorized,
-			oncharEnabled,
-			oncharTriggered,
-			canDetectMention
-		});
-		const { shouldRequireMention, shouldBypassMention } = mentionDecision;
-		if (mentionDecision.dropReason === "onchar-not-triggered") {
-			logVerboseMessage(`mattermost: drop group message (onchar not triggered channel=${channelId} sender=${senderId})`);
-			recordPendingHistory();
-			return;
-		}
-		if (mentionDecision.dropReason === "missing-mention") {
-			logVerboseMessage(`mattermost: drop group message (missing mention channel=${channelId} sender=${senderId} requireMention=${shouldRequireMention} bypass=${shouldBypassMention} canDetectMention=${canDetectMention})`);
-			recordPendingHistory();
-			return;
-		}
-		const mediaList = await resolveMattermostMedia(post.file_ids);
-		const mediaPlaceholder = buildMattermostAttachmentPlaceholder(mediaList);
-		const bodyText = normalizeMention([oncharTriggered ? oncharResult.stripped : rawText, mediaPlaceholder].filter(Boolean).join("\n").trim(), botUsername);
-		if (!bodyText) {
-			logVerboseMessage(`mattermost: drop group message (empty body after normalization channel=${channelId} sender=${senderId})`);
-			return;
-		}
-		core.channel.activity.record({
-			channel: "mattermost",
-			accountId: account.accountId,
-			direction: "inbound"
-		});
-		const fromLabel = formatInboundFromLabel({
-			isGroup: kind !== "direct",
-			groupLabel: channelDisplay || roomLabel,
-			groupId: channelId,
-			groupFallback: roomLabel || "Channel",
-			directLabel: senderName,
-			directId: senderId
-		});
-		const preview = bodyText.replace(/\s+/g, " ").slice(0, 160);
-		const inboundLabel = kind === "direct" ? `Mattermost DM from ${senderName}` : `Mattermost message in ${roomLabel} from ${senderName}`;
-		core.system.enqueueSystemEvent(`${inboundLabel}: ${preview}`, {
-			sessionKey,
-			contextKey: `mattermost:message:${channelId}:${post.id ?? "unknown"}`
-		});
-		const textWithId = `${bodyText}\n[mattermost message id: ${post.id ?? "unknown"} channel: ${channelId}]`;
-		let combinedBody = core.channel.reply.formatInboundEnvelope({
-			channel: "Mattermost",
-			from: fromLabel,
-			timestamp: typeof post.create_at === "number" ? post.create_at : void 0,
-			body: textWithId,
-			chatType,
-			sender: {
-				name: senderName,
-				id: senderId
-			}
-		});
-		if (historyKey) combinedBody = buildPendingHistoryContextFromMap({
-			historyMap: channelHistories,
-			historyKey,
-			limit: historyLimit,
-			currentMessage: combinedBody,
-			formatEntry: (entry) => core.channel.reply.formatInboundEnvelope({
-				channel: "Mattermost",
-				from: fromLabel,
-				timestamp: entry.timestamp,
-				body: `${entry.body}${entry.messageId ? ` [id:${entry.messageId} channel:${channelId}]` : ""}`,
-				chatType,
-				senderLabel: entry.sender
-			})
-		});
-		const to = kind === "direct" ? `user:${senderId}` : `channel:${channelId}`;
-		const mediaPayload = buildAgentMediaPayload(mediaList);
-		const commandBody = rawText.trim();
-		const inboundHistory = historyKey && historyLimit > 0 ? (channelHistories.get(historyKey) ?? []).map((entry) => ({
-			sender: entry.sender,
-			body: entry.body,
-			timestamp: entry.timestamp
-		})) : void 0;
-		const ctxPayload = core.channel.reply.finalizeInboundContext({
-			Body: combinedBody,
-			BodyForAgent: bodyText,
-			InboundHistory: inboundHistory,
-			RawBody: bodyText,
-			CommandBody: commandBody,
-			BodyForCommands: commandBody,
-			From: kind === "direct" ? `mattermost:${senderId}` : kind === "group" ? `mattermost:group:${channelId}` : `mattermost:channel:${channelId}`,
-			To: to,
-			SessionKey: sessionKey,
-			ParentSessionKey: parentSessionKey,
-			AccountId: route.accountId,
-			ChatType: chatType,
-			ConversationLabel: fromLabel,
-			GroupSubject: kind !== "direct" ? channelDisplay || roomLabel : void 0,
-			GroupChannel: channelName ? `#${channelName}` : void 0,
-			GroupSpace: teamId,
-			SenderName: senderName,
-			SenderId: senderId,
-			Provider: "mattermost",
-			Surface: "mattermost",
-			MessageSid: post.id ?? void 0,
-			MessageSids: allMessageIds.length > 1 ? allMessageIds : void 0,
-			MessageSidFirst: allMessageIds.length > 1 ? allMessageIds[0] : void 0,
-			MessageSidLast: allMessageIds.length > 1 ? allMessageIds[allMessageIds.length - 1] : void 0,
-			ReplyToId: effectiveReplyToId,
-			MessageThreadId: effectiveReplyToId,
-			Timestamp: typeof post.create_at === "number" ? post.create_at : void 0,
-			WasMentioned: kind !== "direct" ? mentionDecision.effectiveWasMentioned : void 0,
-			CommandAuthorized: commandAuthorized,
-			OriginatingChannel: "mattermost",
-			OriginatingTo: to,
-			...mediaPayload
-		});
-		if (kind === "direct") {
-			const sessionCfg = cfg.session;
-			const storePath = core.channel.session.resolveStorePath(sessionCfg?.store, { agentId: route.agentId });
-			await core.channel.session.updateLastRoute({
-				storePath,
-				sessionKey: route.mainSessionKey,
-				deliveryContext: {
-					channel: "mattermost",
-					to,
-					accountId: route.accountId
-				}
-			});
-		}
-		const previewLine = bodyText.slice(0, 200).replace(/\n/g, "\\n");
-		logVerboseMessage(`mattermost inbound: from=${ctxPayload.From} len=${bodyText.length} preview="${previewLine}"`);
-		const textLimit = core.channel.text.resolveTextChunkLimit(cfg, "mattermost", account.accountId, { fallbackLimit: account.textChunkLimit ?? 4e3 });
-		const tableMode = core.channel.text.resolveMarkdownTableMode({
-			cfg,
-			channel: "mattermost",
-			accountId: account.accountId
-		});
-		const { onModelSelected, ...prefixOptions } = createReplyPrefixOptions({
-			cfg,
-			agentId: route.agentId,
-			channel: "mattermost",
-			accountId: account.accountId
-		});
-		const typingCallbacks = createTypingCallbacks({
-			start: () => sendTypingIndicator(channelId, effectiveReplyToId),
-			onStartError: (err) => {
-				logTypingFailure({
-					log: (message) => logger.debug?.(message),
-					channel: "mattermost",
-					target: channelId,
-					error: err
-				});
-			}
-		});
-		const { dispatcher, replyOptions, markDispatchIdle } = core.channel.reply.createReplyDispatcherWithTyping({
-			...prefixOptions,
-			humanDelay: core.channel.reply.resolveHumanDelayConfig(cfg, route.agentId),
-			typingCallbacks,
-			deliver: async (payload) => {
-				await deliverMattermostReplyPayload({
-					core,
-					cfg,
-					payload,
-					to,
-					accountId: account.accountId,
-					agentId: route.agentId,
-					replyToId: resolveMattermostReplyRootId({
-						threadRootId: effectiveReplyToId,
-						replyToId: payload.replyToId
-					}),
-					textLimit,
-					tableMode,
-					sendMessage: sendMessageMattermost
-				});
-				runtime.log?.(`delivered reply to ${to}`);
-			},
-			onError: (err, info) => {
-				runtime.error?.(`mattermost ${info.kind} reply failed: ${String(err)}`);
-			}
-		});
-		await core.channel.reply.withReplyDispatcher({
-			dispatcher,
-			onSettled: () => {
-				markDispatchIdle();
-			},
-			run: () => core.channel.reply.dispatchReplyFromConfig({
-				ctx: ctxPayload,
-				cfg,
-				dispatcher,
-				replyOptions: {
-					...replyOptions,
-					disableBlockStreaming: typeof account.blockStreaming === "boolean" ? !account.blockStreaming : void 0,
-					onModelSelected
-				}
-			})
-		});
-		if (historyKey) clearHistoryEntriesIfEnabled({
-			historyMap: channelHistories,
-			historyKey,
-			limit: historyLimit
-		});
-	};
-	const handleReactionEvent = async (payload) => {
-		const reactionData = payload.data?.reaction;
-		if (!reactionData) return;
-		let reaction = null;
-		if (typeof reactionData === "string") try {
-			reaction = JSON.parse(reactionData);
-		} catch {
-			return;
-		}
-		else if (typeof reactionData === "object") reaction = reactionData;
-		if (!reaction) return;
-		const userId = reaction.user_id?.trim();
-		const postId = reaction.post_id?.trim();
-		const emojiName = reaction.emoji_name?.trim();
-		if (!userId || !postId || !emojiName) return;
-		if (userId === botUserId) return;
-		const action = payload.event === "reaction_removed" ? "removed" : "added";
-		const senderName = (await resolveUserInfo(userId))?.username?.trim() || userId;
-		const channelId = payload.broadcast?.channel_id;
-		if (!channelId) {
-			logVerboseMessage(`mattermost: drop reaction (no channel_id in broadcast, cannot enforce policy)`);
-			return;
-		}
-		const channelInfo = await resolveChannelInfo(channelId);
-		if (!channelInfo?.type) {
-			logVerboseMessage(`mattermost: drop reaction (cannot resolve channel type for ${channelId})`);
-			return;
-		}
-		const kind = mapMattermostChannelTypeToChatType(channelInfo.type);
-		const dmPolicy = account.config.dmPolicy ?? "pairing";
-		const storeAllowFrom = normalizeMattermostAllowList(await readStoreAllowFromForDmPolicy({
-			provider: "mattermost",
-			accountId: account.accountId,
-			dmPolicy,
-			readStore: pairing.readStoreForDmPolicy
-		}));
-		const reactionAccess = resolveDmGroupAccessWithLists({
-			isGroup: kind !== "direct",
-			dmPolicy,
-			groupPolicy,
-			allowFrom: normalizeMattermostAllowList(account.config.allowFrom ?? []),
-			groupAllowFrom: normalizeMattermostAllowList(account.config.groupAllowFrom ?? []),
-			storeAllowFrom,
-			isSenderAllowed: (allowFrom) => isMattermostSenderAllowed({
-				senderId: userId,
-				senderName,
-				allowFrom,
-				allowNameMatching
-			})
-		});
-		if (reactionAccess.decision !== "allow") {
-			if (kind === "direct") logVerboseMessage(`mattermost: drop reaction (dmPolicy=${dmPolicy} sender=${userId} reason=${reactionAccess.reason})`);
-			else logVerboseMessage(`mattermost: drop reaction (groupPolicy=${groupPolicy} sender=${userId} reason=${reactionAccess.reason} channel=${channelId})`);
-			return;
-		}
-		const teamId = channelInfo?.team_id ?? void 0;
-		const sessionKey = core.channel.routing.resolveAgentRoute({
-			cfg,
-			channel: "mattermost",
-			accountId: account.accountId,
-			teamId,
-			peer: {
-				kind,
-				id: kind === "direct" ? userId : channelId
-			}
-		}).sessionKey;
-		const eventText = `Mattermost reaction ${action}: :${emojiName}: by @${senderName} on post ${postId} in channel ${channelId}`;
-		core.system.enqueueSystemEvent(eventText, {
-			sessionKey,
-			contextKey: `mattermost:reaction:${postId}:${emojiName}:${userId}:${action}`
-		});
-		logVerboseMessage(`mattermost reaction: ${action} :${emojiName}: by ${senderName} on ${postId}`);
-	};
-	const inboundDebounceMs = core.channel.debounce.resolveInboundDebounceMs({
-		cfg,
-		channel: "mattermost"
-	});
-	const debouncer = core.channel.debounce.createInboundDebouncer({
-		debounceMs: inboundDebounceMs,
-		buildKey: (entry) => {
-			const channelId = entry.post.channel_id ?? entry.payload.data?.channel_id ?? entry.payload.broadcast?.channel_id;
-			if (!channelId) return null;
-			const threadId = entry.post.root_id?.trim();
-			const threadKey = threadId ? `thread:${threadId}` : "channel";
-			return `mattermost:${account.accountId}:${channelId}:${threadKey}`;
-		},
-		shouldDebounce: (entry) => {
-			if (entry.post.file_ids && entry.post.file_ids.length > 0) return false;
-			const text = entry.post.message?.trim() ?? "";
-			if (!text) return false;
-			return !core.channel.text.hasControlCommand(text, cfg);
-		},
-		onFlush: async (entries) => {
-			const last = entries.at(-1);
-			if (!last) return;
-			if (entries.length === 1) {
-				await handlePost(last.post, last.payload);
-				return;
-			}
-			const combinedText = entries.map((entry) => entry.post.message?.trim() ?? "").filter(Boolean).join("\n");
-			const mergedPost = {
-				...last.post,
-				message: combinedText,
-				file_ids: []
-			};
-			const ids = entries.map((entry) => entry.post.id).filter(Boolean);
-			await handlePost(mergedPost, last.payload, ids.length > 0 ? ids : void 0);
-		},
-		onError: (err) => {
-			runtime.error?.(`mattermost debounce flush failed: ${String(err)}`);
-		}
-	});
-	const wsUrl = buildMattermostWsUrl(baseUrl);
-	let seq = 1;
-	const connectOnce = createMattermostConnectOnce({
-		wsUrl,
-		botToken,
-		abortSignal: opts.abortSignal,
-		statusSink: opts.statusSink,
-		runtime,
-		webSocketFactory: opts.webSocketFactory,
-		nextSeq: () => seq++,
-		onPosted: async (post, payload) => {
-			await debouncer.enqueue({
-				post,
-				payload
-			});
-		},
-		onReaction: async (payload) => {
-			await handleReactionEvent(payload);
-		}
-	});
-	let slashShutdownCleanup = null;
-	if (slashEnabled) {
-		const runAbortCleanup = () => {
-			if (slashShutdownCleanup) return;
-			const commands = getSlashCommandState(account.accountId)?.registeredCommands ?? [];
-			deactivateSlashCommands(account.accountId);
-			slashShutdownCleanup = cleanupSlashCommands({
-				client,
-				commands,
-				log: (msg) => runtime.log?.(msg)
-			}).catch((err) => {
-				runtime.error?.(`mattermost: slash cleanup failed: ${String(err)}`);
-			});
-		};
-		if (opts.abortSignal?.aborted) runAbortCleanup();
-		else opts.abortSignal?.addEventListener("abort", runAbortCleanup, { once: true });
-	}
-	try {
-		await runWithReconnect(connectOnce, {
-			abortSignal: opts.abortSignal,
-			jitterRatio: .2,
-			onError: (err) => {
-				runtime.error?.(`mattermost connection failed: ${String(err)}`);
-				opts.statusSink?.({
-					lastError: String(err),
-					connected: false
-				});
-			},
-			onReconnect: (delayMs) => {
-				runtime.log?.(`mattermost reconnecting in ${Math.round(delayMs / 1e3)}s`);
-			}
-		});
-	} finally {
-		unregisterInteractions?.();
-	}
-	if (slashShutdownCleanup) await slashShutdownCleanup;
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/probe.ts
-async function probeMattermost(baseUrl, botToken, timeoutMs = 2500) {
-	const normalized = normalizeMattermostBaseUrl(baseUrl);
-	if (!normalized) return {
-		ok: false,
-		error: "baseUrl missing"
-	};
-	const url = `${normalized}/api/v4/users/me`;
-	const start = Date.now();
-	const controller = timeoutMs > 0 ? new AbortController() : void 0;
-	let timer = null;
-	if (controller) timer = setTimeout(() => controller.abort(), timeoutMs);
-	try {
-		const res = await fetch(url, {
-			headers: { Authorization: `Bearer ${botToken}` },
-			signal: controller?.signal
-		});
-		const elapsedMs = Date.now() - start;
-		if (!res.ok) {
-			const detail = await readMattermostError(res);
-			return {
-				ok: false,
-				status: res.status,
-				error: detail || res.statusText,
-				elapsedMs
-			};
-		}
-		const bot = await res.json();
-		return {
-			ok: true,
-			status: res.status,
-			elapsedMs,
-			bot
-		};
-	} catch (err) {
-		return {
-			ok: false,
-			status: null,
-			error: err instanceof Error ? err.message : String(err),
-			elapsedMs: Date.now() - start
-		};
-	} finally {
-		if (timer) clearTimeout(timer);
-	}
-}
-//#endregion
-//#region extensions/mattermost/src/mattermost/reactions.ts
-const BOT_USER_CACHE_TTL_MS = 10 * 6e4;
-const botUserIdCache = /* @__PURE__ */ new Map();
-async function resolveBotUserId(client, cacheKey) {
-	const cached = botUserIdCache.get(cacheKey);
-	if (cached && cached.expiresAt > Date.now()) return cached.userId;
-	const userId = (await fetchMattermostMe(client))?.id?.trim();
-	if (!userId) return null;
-	botUserIdCache.set(cacheKey, {
-		userId,
-		expiresAt: Date.now() + BOT_USER_CACHE_TTL_MS
-	});
-	return userId;
-}
-async function addMattermostReaction(params) {
-	return runMattermostReaction(params, {
-		action: "add",
-		mutation: createReaction
-	});
-}
-async function removeMattermostReaction(params) {
-	return runMattermostReaction(params, {
-		action: "remove",
-		mutation: deleteReaction
-	});
-}
-async function runMattermostReaction(params, options) {
-	const resolved = resolveMattermostAccount({
-		cfg: params.cfg,
-		accountId: params.accountId
-	});
-	const baseUrl = resolved.baseUrl?.trim();
-	const botToken = resolved.botToken?.trim();
-	if (!baseUrl || !botToken) return {
-		ok: false,
-		error: "Mattermost botToken/baseUrl missing."
-	};
-	const client = createMattermostClient({
-		baseUrl,
-		botToken,
-		fetchImpl: params.fetchImpl
-	});
-	const userId = await resolveBotUserId(client, `${baseUrl}:${botToken}`);
-	if (!userId) return {
-		ok: false,
-		error: "Mattermost reactions failed: could not resolve bot user id."
-	};
-	try {
-		await options.mutation(client, {
-			userId,
-			postId: params.postId,
-			emojiName: params.emojiName
-		});
-	} catch (err) {
-		return {
-			ok: false,
-			error: `Mattermost ${options.action} reaction failed: ${String(err)}`
-		};
-	}
-	return { ok: true };
-}
-async function createReaction(client, params) {
-	await client.request("/reactions", {
-		method: "POST",
-		body: JSON.stringify({
-			user_id: params.userId,
-			post_id: params.postId,
-			emoji_name: params.emojiName
-		})
-	});
-}
-async function deleteReaction(client, params) {
-	const emoji = encodeURIComponent(params.emojiName);
-	await client.request(`/users/${params.userId}/posts/${params.postId}/reactions/${emoji}`, { method: "DELETE" });
-}
-//#endregion
-//#region extensions/mattermost/src/normalize.ts
-function normalizeMattermostMessagingTarget(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) return;
-	const lower = trimmed.toLowerCase();
-	if (lower.startsWith("channel:")) {
-		const id = trimmed.slice(8).trim();
-		return id ? `channel:${id}` : void 0;
-	}
-	if (lower.startsWith("group:")) {
-		const id = trimmed.slice(6).trim();
-		return id ? `channel:${id}` : void 0;
-	}
-	if (lower.startsWith("user:")) {
-		const id = trimmed.slice(5).trim();
-		return id ? `user:${id}` : void 0;
-	}
-	if (lower.startsWith("mattermost:")) {
-		const id = trimmed.slice(11).trim();
-		return id ? `user:${id}` : void 0;
-	}
-	if (trimmed.startsWith("@")) {
-		const id = trimmed.slice(1).trim();
-		return id ? `@${id}` : void 0;
-	}
-	if (trimmed.startsWith("#")) return;
-}
-function looksLikeMattermostTargetId(raw, normalized) {
-	const trimmed = raw.trim();
-	if (!trimmed) return false;
-	if (/^(user|channel|group|mattermost):/i.test(trimmed)) return true;
-	if (trimmed.startsWith("@")) return true;
-	return /^[a-z0-9]{26}$/i.test(trimmed) || /^[a-z0-9]{26}__[a-z0-9]{26}$/i.test(trimmed);
-}
-//#endregion
-//#region extensions/mattermost/src/setup-core.ts
-const channel$1 = "mattermost";
-function isMattermostConfigured(account) {
-	return (Boolean(account.botToken?.trim()) || hasConfiguredSecretInput(account.config.botToken)) && Boolean(account.baseUrl);
-}
-function resolveMattermostAccountWithSecrets(cfg, accountId) {
-	return resolveMattermostAccount({
-		cfg,
-		accountId,
-		allowUnresolvedSecretRef: true
-	});
-}
-const mattermostSetupAdapter = {
-	resolveAccountId: ({ accountId }) => normalizeAccountId(accountId),
-	applyAccountName: ({ cfg, accountId, name }) => applyAccountNameToChannelSection({
-		cfg,
-		channelKey: channel$1,
-		accountId,
-		name
-	}),
-	validateInput: ({ accountId, input }) => {
-		const token = input.botToken ?? input.token;
-		const baseUrl = normalizeMattermostBaseUrl(input.httpUrl);
-		if (input.useEnv && accountId !== "default") return "Mattermost env vars can only be used for the default account.";
-		if (!input.useEnv && (!token || !baseUrl)) return "Mattermost requires --bot-token and --http-url (or --use-env).";
-		if (input.httpUrl && !baseUrl) return "Mattermost --http-url must include a valid base URL.";
-		return null;
-	},
-	applyAccountConfig: ({ cfg, accountId, input }) => {
-		const token = input.botToken ?? input.token;
-		const baseUrl = normalizeMattermostBaseUrl(input.httpUrl);
-		const namedConfig = applyAccountNameToChannelSection({
-			cfg,
-			channelKey: channel$1,
-			accountId,
-			name: input.name
-		});
-		return applySetupAccountConfigPatch({
-			cfg: accountId !== "default" ? migrateBaseNameToDefaultAccount({
-				cfg: namedConfig,
-				channelKey: channel$1
-			}) : namedConfig,
-			channelKey: channel$1,
-			accountId,
-			patch: input.useEnv ? {} : {
-				...token ? { botToken: token } : {},
-				...baseUrl ? { baseUrl } : {}
-			}
-		});
-	}
-};
-//#endregion
-//#region extensions/mattermost/src/setup-surface.ts
-const channel = "mattermost";
-const mattermostSetupWizard = {
-	channel,
-	status: {
-		configuredLabel: "configured",
-		unconfiguredLabel: "needs token + url",
-		configuredHint: "configured",
-		unconfiguredHint: "needs setup",
-		configuredScore: 2,
-		unconfiguredScore: 1,
-		resolveConfigured: ({ cfg }) => listMattermostAccountIds(cfg).some((accountId) => isMattermostConfigured(resolveMattermostAccountWithSecrets(cfg, accountId)))
-	},
-	introNote: {
-		title: "Mattermost bot token",
-		lines: [
-			"1) Mattermost System Console -> Integrations -> Bot Accounts",
-			"2) Create a bot + copy its token",
-			"3) Use your server base URL (e.g., https://chat.example.com)",
-			"Tip: the bot must be a member of any channel you want it to monitor.",
-			`Docs: ${formatDocsLink("/mattermost", "mattermost")}`
-		],
-		shouldShow: ({ cfg, accountId }) => !isMattermostConfigured(resolveMattermostAccountWithSecrets(cfg, accountId))
-	},
-	envShortcut: {
-		prompt: "MATTERMOST_BOT_TOKEN + MATTERMOST_URL detected. Use env vars?",
-		preferredEnvVar: "MATTERMOST_BOT_TOKEN",
-		isAvailable: ({ cfg, accountId }) => {
-			if (accountId !== "default") return false;
-			const resolvedAccount = resolveMattermostAccountWithSecrets(cfg, accountId);
-			const hasConfigValues = hasConfiguredSecretInput(resolvedAccount.config.botToken) || Boolean(resolvedAccount.config.baseUrl?.trim());
-			return Boolean(process.env.MATTERMOST_BOT_TOKEN?.trim() && process.env.MATTERMOST_URL?.trim() && !hasConfigValues);
-		},
-		apply: ({ cfg, accountId }) => applySetupAccountConfigPatch({
-			cfg,
-			channelKey: channel,
-			accountId,
-			patch: {}
-		})
-	},
-	credentials: [{
-		inputKey: "botToken",
-		providerHint: channel,
-		credentialLabel: "bot token",
-		preferredEnvVar: "MATTERMOST_BOT_TOKEN",
-		envPrompt: "MATTERMOST_BOT_TOKEN + MATTERMOST_URL detected. Use env vars?",
-		keepPrompt: "Mattermost bot token already configured. Keep it?",
-		inputPrompt: "Enter Mattermost bot token",
-		inspect: ({ cfg, accountId }) => {
-			const resolvedAccount = resolveMattermostAccountWithSecrets(cfg, accountId);
-			return {
-				accountConfigured: isMattermostConfigured(resolvedAccount),
-				hasConfiguredValue: hasConfiguredSecretInput(resolvedAccount.config.botToken)
-			};
-		}
-	}],
-	textInputs: [{
-		inputKey: "httpUrl",
-		message: "Enter Mattermost base URL",
-		confirmCurrentValue: false,
-		currentValue: ({ cfg, accountId }) => resolveMattermostAccountWithSecrets(cfg, accountId).baseUrl ?? process.env.MATTERMOST_URL?.trim(),
-		initialValue: ({ cfg, accountId }) => resolveMattermostAccountWithSecrets(cfg, accountId).baseUrl ?? process.env.MATTERMOST_URL?.trim(),
-		shouldPrompt: ({ cfg, accountId, credentialValues, currentValue }) => {
-			const resolvedAccount = resolveMattermostAccountWithSecrets(cfg, accountId);
-			const tokenConfigured = Boolean(resolvedAccount.botToken?.trim()) || hasConfiguredSecretInput(resolvedAccount.config.botToken);
-			return Boolean(credentialValues.botToken) || !tokenConfigured || !currentValue;
-		},
-		validate: ({ value }) => normalizeMattermostBaseUrl(value) ? void 0 : "Mattermost base URL must include a valid base URL.",
-		normalizeValue: ({ value }) => normalizeMattermostBaseUrl(value) ?? value.trim()
-	}],
-	disable: (cfg) => ({
-		...cfg,
-		channels: {
-			...cfg.channels,
-			mattermost: {
-				...cfg.channels?.mattermost,
-				enabled: false
-			}
-		}
-	})
-};
-//#endregion
-//#region extensions/mattermost/src/channel.ts
-const mattermostMessageActions = {
-	listActions: ({ cfg }) => {
-		const enabledAccounts = listMattermostAccountIds(cfg).map((accountId) => resolveMattermostAccount({
-			cfg,
-			accountId
-		})).filter((account) => account.enabled).filter((account) => Boolean(account.botToken?.trim() && account.baseUrl?.trim()));
-		const actions = [];
-		if (enabledAccounts.length > 0) actions.push("send");
-		const baseReactions = (cfg.channels?.mattermost?.actions)?.reactions;
-		if (enabledAccounts.some((account) => {
-			return (account.config.actions?.reactions ?? baseReactions ?? true) !== false;
-		})) actions.push("react");
-		return actions;
-	},
-	supportsAction: ({ action }) => {
-		return action === "send" || action === "react";
-	},
-	getCapabilities: ({ cfg }) => {
-		return listMattermostAccountIds(cfg).map((id) => resolveMattermostAccount({
-			cfg,
-			accountId: id
-		})).filter((a) => a.enabled && a.botToken?.trim() && a.baseUrl?.trim()).length > 0 ? ["buttons"] : [];
-	},
-	handleAction: async ({ action, params, cfg, accountId }) => {
-		if (action === "react") {
-			const mmBase = cfg?.channels?.mattermost;
-			const accounts = mmBase?.accounts;
-			const resolvedAccountId = accountId ?? resolveDefaultMattermostAccountId(cfg);
-			const acctActions = (accounts?.[resolvedAccountId])?.actions;
-			const baseActions = mmBase?.actions;
-			if (!(acctActions?.reactions ?? baseActions?.reactions ?? true)) throw new Error("Mattermost reactions are disabled in config");
-			const postId = (typeof params?.messageId === "string" ? params.messageId : typeof params?.postId === "string" ? params.postId : "").trim();
-			if (!postId) throw new Error("Mattermost react requires messageId (post id)");
-			const emojiName = (typeof params?.emoji === "string" ? params.emoji : "").trim().replace(/^:+|:+$/g, "");
-			if (!emojiName) throw new Error("Mattermost react requires emoji");
-			if (params?.remove === true) {
-				const result = await removeMattermostReaction({
-					cfg,
-					postId,
-					emojiName,
-					accountId: resolvedAccountId
-				});
-				if (!result.ok) throw new Error(result.error);
-				return {
-					content: [{
-						type: "text",
-						text: `Removed reaction :${emojiName}: from ${postId}`
-					}],
-					details: {}
-				};
-			}
-			const result = await addMattermostReaction({
-				cfg,
-				postId,
-				emojiName,
-				accountId: resolvedAccountId
-			});
-			if (!result.ok) throw new Error(result.error);
-			return {
-				content: [{
-					type: "text",
-					text: `Reacted with :${emojiName}: on ${postId}`
-				}],
-				details: {}
-			};
-		}
-		if (action !== "send") throw new Error(`Unsupported Mattermost action: ${action}`);
-		const to = typeof params.to === "string" ? params.to.trim() : typeof params.target === "string" ? params.target.trim() : "";
-		if (!to) throw new Error("Mattermost send requires a target (to).");
-		const message = typeof params.message === "string" ? params.message : "";
-		const replyToId = readMattermostReplyToId(params);
-		const resolvedAccountId = accountId || void 0;
-		const mediaUrl = typeof params.media === "string" ? params.media.trim() || void 0 : void 0;
-		const result = await sendMessageMattermost(to, message, {
-			accountId: resolvedAccountId,
-			replyToId,
-			buttons: Array.isArray(params.buttons) ? params.buttons : void 0,
-			attachmentText: typeof params.attachmentText === "string" ? params.attachmentText : void 0,
-			mediaUrl
-		});
-		return {
-			content: [{
-				type: "text",
-				text: JSON.stringify({
-					ok: true,
-					channel: "mattermost",
-					messageId: result.messageId,
-					channelId: result.channelId
-				})
-			}],
-			details: {}
-		};
-	}
-};
-const meta = {
-	id: "mattermost",
-	label: "Mattermost",
-	selectionLabel: "Mattermost (plugin)",
-	detailLabel: "Mattermost Bot",
-	docsPath: "/channels/mattermost",
-	docsLabel: "mattermost",
-	blurb: "self-hosted Slack-style chat; install the plugin to enable.",
-	systemImage: "bubble.left.and.bubble.right",
-	order: 65,
-	quickstartAllowFrom: true
-};
-function readMattermostReplyToId(params) {
-	const readNormalizedValue = (value) => {
-		if (typeof value !== "string") return;
-		return value.trim() || void 0;
-	};
-	return readNormalizedValue(params.replyToId) ?? readNormalizedValue(params.replyTo);
-}
-function normalizeAllowEntry(entry) {
-	return entry.trim().replace(/^(mattermost|user):/i, "").replace(/^@/, "").toLowerCase();
-}
-function formatAllowEntry(entry) {
-	const trimmed = entry.trim();
-	if (!trimmed) return "";
-	if (trimmed.startsWith("@")) {
-		const username = trimmed.slice(1).trim();
-		return username ? `@${username.toLowerCase()}` : "";
-	}
-	return trimmed.replace(/^(mattermost|user):/i, "").toLowerCase();
-}
-const mattermostConfigAccessors = createScopedAccountConfigAccessors({
-	resolveAccount: ({ cfg, accountId }) => resolveMattermostAccount({
-		cfg,
-		accountId
-	}),
-	resolveAllowFrom: (account) => account.config.allowFrom,
-	formatAllowFrom: (allowFrom) => formatNormalizedAllowFromEntries({
-		allowFrom,
-		normalizeEntry: formatAllowEntry
-	})
-});
-const mattermostPlugin = {
-	id: "mattermost",
-	meta: { ...meta },
-	setup: mattermostSetupAdapter,
-	setupWizard: mattermostSetupWizard,
-	pairing: {
-		idLabel: "mattermostUserId",
-		normalizeAllowEntry: (entry) => normalizeAllowEntry(entry),
-		notifyApproval: async ({ id }) => {
-			console.log(`[mattermost] User ${id} approved for pairing`);
-		}
-	},
-	capabilities: {
-		chatTypes: [
-			"direct",
-			"channel",
-			"group",
-			"thread"
-		],
-		reactions: true,
-		threads: true,
-		media: true,
-		nativeCommands: true
-	},
-	streaming: { blockStreamingCoalesceDefaults: {
-		minChars: 1500,
-		idleMs: 1e3
-	} },
-	threading: { resolveReplyToMode: ({ cfg, accountId, chatType }) => {
-		return resolveMattermostReplyToMode(resolveMattermostAccount({
-			cfg,
-			accountId: accountId ?? "default"
-		}), chatType === "direct" || chatType === "group" || chatType === "channel" ? chatType : "channel");
-	} },
-	reload: { configPrefixes: ["channels.mattermost"] },
-	configSchema: buildChannelConfigSchema(MattermostConfigSchema),
-	config: {
-		listAccountIds: (cfg) => listMattermostAccountIds(cfg),
-		resolveAccount: (cfg, accountId) => resolveMattermostAccount({
-			cfg,
-			accountId
-		}),
-		defaultAccountId: (cfg) => resolveDefaultMattermostAccountId(cfg),
-		setAccountEnabled: ({ cfg, accountId, enabled }) => setAccountEnabledInConfigSection({
-			cfg,
-			sectionKey: "mattermost",
-			accountId,
-			enabled,
-			allowTopLevel: true
-		}),
-		deleteAccount: ({ cfg, accountId }) => deleteAccountFromConfigSection({
-			cfg,
-			sectionKey: "mattermost",
-			accountId,
-			clearBaseFields: [
-				"botToken",
-				"baseUrl",
-				"name"
-			]
-		}),
-		isConfigured: (account) => Boolean(account.botToken && account.baseUrl),
-		describeAccount: (account) => ({
-			accountId: account.accountId,
-			name: account.name,
-			enabled: account.enabled,
-			configured: Boolean(account.botToken && account.baseUrl),
-			botTokenSource: account.botTokenSource,
-			baseUrl: account.baseUrl
-		}),
-		...mattermostConfigAccessors
-	},
-	security: {
-		resolveDmPolicy: ({ cfg, accountId, account }) => {
-			return buildAccountScopedDmSecurityPolicy({
-				cfg,
-				channelKey: "mattermost",
-				accountId,
-				fallbackAccountId: account.accountId ?? "default",
-				policy: account.config.dmPolicy,
-				allowFrom: account.config.allowFrom ?? [],
-				policyPathSuffix: "dmPolicy",
-				normalizeEntry: (raw) => normalizeAllowEntry(raw)
-			});
-		},
-		collectWarnings: ({ account, cfg }) => {
-			return collectAllowlistProviderRestrictSendersWarnings({
-				cfg,
-				providerConfigPresent: cfg.channels?.mattermost !== void 0,
-				configuredGroupPolicy: account.config.groupPolicy,
-				surface: "Mattermost channels",
-				openScope: "any member",
-				groupPolicyPath: "channels.mattermost.groupPolicy",
-				groupAllowFromPath: "channels.mattermost.groupAllowFrom"
-			});
-		}
-	},
-	groups: { resolveRequireMention: resolveMattermostGroupRequireMention },
-	actions: mattermostMessageActions,
-	directory: {
-		listGroups: async (params) => listMattermostDirectoryGroups(params),
-		listGroupsLive: async (params) => listMattermostDirectoryGroups(params),
-		listPeers: async (params) => listMattermostDirectoryPeers(params),
-		listPeersLive: async (params) => listMattermostDirectoryPeers(params)
-	},
-	messaging: {
-		normalizeTarget: normalizeMattermostMessagingTarget,
-		targetResolver: {
-			looksLikeId: looksLikeMattermostTargetId,
-			hint: "<channelId|user:ID|channel:ID>",
-			resolveTarget: async ({ cfg, accountId, input }) => {
-				const resolved = await resolveMattermostOpaqueTarget({
-					input,
-					cfg,
-					accountId
-				});
-				if (!resolved) return null;
-				return {
-					to: resolved.to,
-					kind: resolved.kind,
-					source: "directory"
-				};
-			}
-		}
-	},
-	outbound: {
-		deliveryMode: "direct",
-		chunker: (text, limit) => getMattermostRuntime().channel.text.chunkMarkdownText(text, limit),
-		chunkerMode: "markdown",
-		textChunkLimit: 4e3,
-		resolveTarget: ({ to }) => {
-			const trimmed = to?.trim();
-			if (!trimmed) return {
-				ok: false,
-				error: /* @__PURE__ */ new Error("Delivering to Mattermost requires --to <channelId|@username|user:ID|channel:ID>")
-			};
-			return {
-				ok: true,
-				to: trimmed
-			};
-		},
-		sendText: async ({ cfg, to, text, accountId, replyToId, threadId }) => {
-			return {
-				channel: "mattermost",
-				...await sendMessageMattermost(to, text, {
-					cfg,
-					accountId: accountId ?? void 0,
-					replyToId: replyToId ?? (threadId != null ? String(threadId) : void 0)
-				})
-			};
-		},
-		sendMedia: async ({ cfg, to, text, mediaUrl, mediaLocalRoots, accountId, replyToId, threadId }) => {
-			return {
-				channel: "mattermost",
-				...await sendMessageMattermost(to, text, {
-					cfg,
-					accountId: accountId ?? void 0,
-					mediaUrl,
-					mediaLocalRoots,
-					replyToId: replyToId ?? (threadId != null ? String(threadId) : void 0)
-				})
-			};
-		}
-	},
-	status: {
-		defaultRuntime: {
-			accountId: DEFAULT_ACCOUNT_ID,
-			running: false,
-			connected: false,
-			lastConnectedAt: null,
-			lastDisconnect: null,
-			lastStartAt: null,
-			lastStopAt: null,
-			lastError: null
-		},
-		buildChannelSummary: ({ snapshot }) => buildPassiveProbedChannelStatusSummary(snapshot, {
-			botTokenSource: snapshot.botTokenSource ?? "none",
-			connected: snapshot.connected ?? false,
-			baseUrl: snapshot.baseUrl ?? null
-		}),
-		probeAccount: async ({ account, timeoutMs }) => {
-			const token = account.botToken?.trim();
-			const baseUrl = account.baseUrl?.trim();
-			if (!token || !baseUrl) return {
-				ok: false,
-				error: "bot token or baseUrl missing"
-			};
-			return await probeMattermost(baseUrl, token, timeoutMs);
-		},
-		buildAccountSnapshot: ({ account, runtime, probe }) => {
-			return {
-				...buildComputedAccountStatusSnapshot({
-					accountId: account.accountId,
-					name: account.name,
-					enabled: account.enabled,
-					configured: Boolean(account.botToken && account.baseUrl),
-					runtime,
-					probe
-				}),
-				botTokenSource: account.botTokenSource,
-				baseUrl: account.baseUrl,
-				connected: runtime?.connected ?? false,
-				lastConnectedAt: runtime?.lastConnectedAt ?? null,
-				lastDisconnect: runtime?.lastDisconnect ?? null
-			};
-		}
-	},
-	gateway: { startAccount: async (ctx) => {
-		const account = ctx.account;
-		const statusSink = createAccountStatusSink({
-			accountId: ctx.accountId,
-			setStatus: ctx.setStatus
-		});
-		statusSink({
-			baseUrl: account.baseUrl,
-			botTokenSource: account.botTokenSource
-		});
-		ctx.log?.info(`[${account.accountId}] starting channel`);
-		return monitorMattermostProvider({
-			botToken: account.botToken ?? void 0,
-			baseUrl: account.baseUrl ?? void 0,
-			accountId: account.accountId,
-			config: ctx.cfg,
-			runtime: ctx.runtime,
-			abortSignal: ctx.abortSignal,
-			statusSink
-		});
-	} }
-};
-//#endregion
-export { registerSlashCommandRoute as n, setMattermostRuntime as r, mattermostPlugin as t };