cc-claw 0.12.8 → 0.13.0

package/dist/cli.js

@@ -72,7 +72,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = true ? "0.12.8" : (() => {
+    VERSION = true ? "0.13.0" : (() => {
       try {
         return JSON.parse(readFileSync(join2(process.cwd(), "package.json"), "utf-8")).version ?? "unknown";
       } catch {
@@ -83,6 +83,13 @@ var init_version = __esm({
 });
 
 // src/log.ts
+var log_exports = {};
+__export(log_exports, {
+  error: () => error,
+  errorMessage: () => errorMessage,
+  log: () => log,
+  warn: () => warn
+});
 function ts() {
   const d = /* @__PURE__ */ new Date();
   const pad = (n) => String(n).padStart(2, "0");
@@ -102,7 +109,17 @@ function error(...args) {
   console.error(`[${ts()}]`, ...args);
 }
 function errorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
+  if (!(err instanceof Error)) return String(err);
+  let msg = err.message;
+  let cause = err.cause;
+  let depth = 0;
+  while (cause && depth < 5) {
+    const causeMsg = cause instanceof Error ? cause.message : String(cause);
+    msg += ` [caused by: ${causeMsg}]`;
+    cause = cause instanceof Error ? cause.cause : void 0;
+    depth++;
+  }
+  return msg;
 }
 var init_log = __esm({
   "src/log.ts"() {
@@ -122,6 +139,7 @@ __export(store_exports, {
   getActiveOrchestration: () => getActiveOrchestration,
   getAgent: () => getAgent,
   getNextQueuedAgent: () => getNextQueuedAgent,
+  getNextQueuedAgentGlobal: () => getNextQueuedAgentGlobal,
   getOrchestration: () => getOrchestration,
   getState: () => getState,
   getTask: () => getTask,
@@ -267,26 +285,28 @@ function setOrchestrationBudget(db3, id, budgetLimit) {
 }
 function createAgent(db3, opts) {
   const id = randomUUID();
-  db3.prepare(`
-    INSERT INTO agents (id, orchestrationId, parentAgentId, runnerId, name, description, model, task, skills, permMode, role, persona, maxRuntimeMs, summarizeResult, createdAt)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
-  `).run(
-    id,
-    opts.orchestrationId,
-    opts.parentAgentId ?? null,
-    opts.runnerId,
-    opts.name ?? null,
-    opts.description ?? null,
-    opts.model ?? null,
-    opts.task ?? null,
-    JSON.stringify(opts.skills ?? []),
-    opts.permMode ?? "inherit",
-    opts.role ?? "worker",
-    opts.persona ?? null,
-    opts.maxRuntimeMs ?? 6e5,
-    opts.summarizeResult ?? 0
-  );
-  db3.prepare("UPDATE orchestrations SET agentCount = agentCount + 1 WHERE id = ?").run(opts.orchestrationId);
+  db3.transaction(() => {
+    db3.prepare(`
+      INSERT INTO agents (id, orchestrationId, parentAgentId, runnerId, name, description, model, task, skills, permMode, role, persona, maxRuntimeMs, summarizeResult, createdAt)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
+    `).run(
+      id,
+      opts.orchestrationId,
+      opts.parentAgentId ?? null,
+      opts.runnerId,
+      opts.name ?? null,
+      opts.description ?? null,
+      opts.model ?? null,
+      opts.task ?? null,
+      JSON.stringify(opts.skills ?? []),
+      opts.permMode ?? "inherit",
+      opts.role ?? "worker",
+      opts.persona ?? null,
+      opts.maxRuntimeMs ?? 6e5,
+      opts.summarizeResult ?? 0
+    );
+    db3.prepare("UPDATE orchestrations SET agentCount = agentCount + 1 WHERE id = ?").run(opts.orchestrationId);
+  })();
   return id;
 }
 function getAgent(db3, id) {
@@ -302,18 +322,41 @@ function listQueuedAgents(db3) {
   return db3.prepare("SELECT * FROM agents WHERE status = 'queued' ORDER BY createdAt").all();
 }
 function cleanupStaleAgents(db3) {
-  const result = db3.prepare(`
+  const stale = db3.prepare(`
+    SELECT id, pid FROM agents WHERE status IN ('starting', 'running', 'idle')
+  `).all();
+  let cleaned = 0;
+  const markFailed = db3.prepare(`
     UPDATE agents SET status = 'failed', completedAt = datetime('now'),
     resultSummary = 'Marked stale after service restart'
-    WHERE status IN ('queued', 'starting', 'running', 'idle')
-  `).run();
-  return result.changes;
+    WHERE id = ?
+  `);
+  for (const agent of stale) {
+    let isAlive = false;
+    if (agent.pid) {
+      try {
+        process.kill(agent.pid, 0);
+        isAlive = true;
+      } catch {
+      }
+    }
+    if (!isAlive) {
+      markFailed.run(agent.id);
+      cleaned++;
+    }
+  }
+  return cleaned;
 }
 function getNextQueuedAgent(db3, orchestrationId) {
   return db3.prepare(
     "SELECT * FROM agents WHERE orchestrationId = ? AND status = 'queued' ORDER BY createdAt LIMIT 1"
   ).get(orchestrationId) ?? null;
 }
+function getNextQueuedAgentGlobal(db3) {
+  return db3.prepare(
+    "SELECT * FROM agents WHERE status = 'queued' ORDER BY createdAt LIMIT 1"
+  ).get() ?? null;
+}
 function updateAgentStatus(db3, id, status) {
   const updates = ["status = ?"];
   const params = [status];
@@ -386,20 +429,28 @@ function updateTaskStatus(db3, id, status, result) {
   db3.prepare(`UPDATE agent_tasks SET ${updates.join(", ")} WHERE id = ?`).run(...params);
 }
 function claimTask(db3, taskId, agentId) {
-  const task = getTask(db3, taskId);
-  if (!task || task.status !== "pending") return false;
-  const blockedBy = JSON.parse(task.blockedBy);
-  if (blockedBy.length > 0) {
-    const placeholders = blockedBy.map(() => "?").join(",");
-    const incomplete = db3.prepare(
-      `SELECT COUNT(*) as count FROM agent_tasks WHERE id IN (${placeholders}) AND status NOT IN ('completed', 'failed', 'abandoned')`
-    ).get(...blockedBy);
-    if (incomplete.count > 0) return false;
-  }
-  const result = db3.prepare(
-    "UPDATE agent_tasks SET assignee = ?, status = 'in_progress' WHERE id = ? AND status = 'pending'"
-  ).run(agentId, taskId);
-  return result.changes > 0;
+  const claim = db3.transaction(() => {
+    const task = getTask(db3, taskId);
+    if (!task || task.status !== "pending") return false;
+    let blockedBy;
+    try {
+      blockedBy = JSON.parse(task.blockedBy);
+    } catch {
+      blockedBy = [];
+    }
+    if (blockedBy.length > 0) {
+      const placeholders = blockedBy.map(() => "?").join(",");
+      const incomplete = db3.prepare(
+        `SELECT COUNT(*) as count FROM agent_tasks WHERE id IN (${placeholders}) AND status NOT IN ('completed', 'failed', 'abandoned')`
+      ).get(...blockedBy);
+      if (incomplete.count > 0) return false;
+    }
+    const result = db3.prepare(
+      "UPDATE agent_tasks SET assignee = ?, status = 'in_progress' WHERE id = ? AND status = 'pending'"
+    ).run(agentId, taskId);
+    return result.changes > 0;
+  });
+  return claim();
 }
 function sendInboxMessage(db3, opts) {
   const result = db3.prepare(`
@@ -422,6 +473,12 @@ function markAllRead(db3, orchestrationId, agentId) {
   ).run(orchestrationId, agentId);
 }
 function setState(db3, orchestrationId, key, value, setBy) {
+  const existing = db3.prepare(
+    "SELECT setBy, value FROM orchestration_state WHERE orchestrationId = ? AND key = ?"
+  ).get(orchestrationId, key);
+  if (existing && existing.setBy !== setBy) {
+    console.warn(`[state] Key "${key}" overwritten by ${setBy} (was set by ${existing.setBy})`);
+  }
   db3.prepare(`
     INSERT INTO orchestration_state (orchestrationId, key, value, setBy, updatedAt)
     VALUES (?, ?, ?, ?, datetime('now'))
@@ -602,7 +659,7 @@ function initActivityTable(db3) {
   db3.exec(
     "CREATE INDEX IF NOT EXISTS idx_activity_chat_time ON activity_log (chatId, createdAt DESC)"
   );
-  cleanupActivity(db3);
+  setTimeout(() => cleanupActivity(db3), 5e3);
 }
 function logActivity(db3, event) {
   db3.prepare(`
@@ -641,18 +698,23 @@ function cleanupActivity(db3) {
   if (aged.changes > 0) {
     log(`[activity] Pruned ${aged.changes} events older than ${RETENTION_DAYS} days`);
   }
-  const excess = db3.prepare(`
+  const chats2 = db3.prepare(
+    "SELECT DISTINCT chatId FROM activity_log"
+  ).all();
+  let totalExcess = 0;
+  const deleteStmt = db3.prepare(`
     DELETE FROM activity_log
-    WHERE id NOT IN (
-      SELECT id FROM (
-        SELECT id, ROW_NUMBER() OVER (PARTITION BY chatId ORDER BY createdAt DESC) AS rn
-        FROM activity_log
-      ) ranked
-      WHERE rn <= ?
+    WHERE chatId = ? AND id NOT IN (
+      SELECT id FROM activity_log WHERE chatId = ?
+      ORDER BY createdAt DESC LIMIT ?
     )
-  `).run(MAX_ROWS_PER_CHAT);
-  if (excess.changes > 0) {
-    log(`[activity] Capped activity log: pruned ${excess.changes} excess rows`);
+  `);
+  for (const { chatId } of chats2) {
+    const result = deleteStmt.run(chatId, chatId, MAX_ROWS_PER_CHAT);
+    totalExcess += result.changes;
+  }
+  if (totalExcess > 0) {
+    log(`[activity] Capped activity log: pruned ${totalExcess} excess rows across ${chats2.length} chats`);
   }
 }
 var RETENTION_DAYS, MAX_ROWS_PER_CHAT;
@@ -695,12 +757,14 @@ __export(store_exports4, {
   advanceReviewSession: () => advanceReviewSession,
   cleanupBackupFiles: () => cleanupBackupFiles,
   cleanupReflectionData: () => cleanupReflectionData,
+  clearDiscussionMode: () => clearDiscussionMode,
   createReviewSession: () => createReviewSession,
   deleteReviewSession: () => deleteReviewSession,
   getActiveReflectionChatIds: () => getActiveReflectionChatIds,
   getAppliedCountTodayForFile: () => getAppliedCountTodayForFile,
   getAppliedInsightCountToday: () => getAppliedInsightCountToday,
   getAppliedInsights: () => getAppliedInsights,
+  getDiscussionMode: () => getDiscussionMode,
   getGrowthMetrics: () => getGrowthMetrics,
   getInsightById: () => getInsightById,
   getLastAnalysisTime: () => getLastAnalysisTime,
@@ -718,6 +782,7 @@ __export(store_exports4, {
   logInsight: () => logInsight,
   logSignal: () => logSignal,
   markSignalsProcessed: () => markSignalsProcessed,
+  setDiscussionMode: () => setDiscussionMode,
   setReflectionModelConfig: () => setReflectionModelConfig,
   setReflectionSettings: () => setReflectionSettings,
   setReflectionStatus: () => setReflectionStatus,
@@ -1104,10 +1169,21 @@ function cleanupReflectionData(db3) {
     DELETE FROM review_sessions WHERE created_at < datetime('now', '-1 day')
   `).run();
 }
+function setDiscussionMode(chatId, insightId) {
+  discussionMode.set(chatId, insightId);
+}
+function getDiscussionMode(chatId) {
+  return discussionMode.get(chatId) ?? null;
+}
+function clearDiscussionMode(chatId) {
+  discussionMode.delete(chatId);
+}
+var discussionMode;
 var init_store4 = __esm({
   "src/reflection/store.ts"() {
     "use strict";
     init_paths();
+    discussionMode = /* @__PURE__ */ new Map();
   }
 });
 
@@ -1225,7 +1301,7 @@ function hybridScore(item, vectorWeight) {
   const w = vectorWeight ?? getVectorWeight();
   const relevance = w * item.vectorScore + (1 - w) * item.ftsScore;
   const decay = Math.pow(1 - item.decayRate, item.daysSinceAccess);
-  return relevance * item.salience * decay;
+  return Math.max(0, relevance * item.salience * decay);
 }
 function serializeEmbedding(embedding) {
   return JSON.stringify(embedding);
@@ -1471,6 +1547,7 @@ __export(store_exports5, {
   pinChatGeminiSlot: () => pinChatGeminiSlot,
   pruneJobRuns: () => pruneJobRuns,
   pruneMessageLog: () => pruneMessageLog,
+  reenableSlot: () => reenableSlot,
   removeChatAlias: () => removeChatAlias,
   removeGeminiSlot: () => removeGeminiSlot,
   removeHeartbeatWatch: () => removeHeartbeatWatch,
@@ -1521,14 +1598,22 @@ import Database from "better-sqlite3";
 function openDatabaseReadOnly() {
   const readDb = new Database(DB_PATH, { readonly: true });
   readDb.exec("PRAGMA journal_mode = WAL");
-  readDb.exec("PRAGMA busy_timeout = 3000");
+  readDb.exec("PRAGMA busy_timeout = 5000");
   return readDb;
 }
 function initDatabase() {
   db = new Database(DB_PATH);
   db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA busy_timeout = 3000");
+  db.exec("PRAGMA busy_timeout = 5000");
+  db.exec("PRAGMA synchronous = NORMAL");
   db.exec("PRAGMA foreign_keys = ON");
+  walCheckpointTimer = setInterval(() => {
+    try {
+      db.pragma("wal_checkpoint(PASSIVE)");
+    } catch {
+    }
+  }, 30 * 60 * 1e3);
+  walCheckpointTimer.unref();
   db.exec(`
     CREATE TABLE IF NOT EXISTS memories (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1712,9 +1797,42 @@ function initDatabase() {
             consecutive_failures INTEGER NOT NULL DEFAULT 0
           );
         `);
+        const v1Info = db.prepare("PRAGMA table_info(jobs_v1)").all();
+        const v1Cols = new Set(v1Info.map((c) => c.name));
+        const allColumns = [
+          "id",
+          "schedule_type",
+          "cron",
+          "at_time",
+          "every_ms",
+          "title",
+          "description",
+          "chat_id",
+          "backend",
+          "model",
+          "thinking",
+          "timeout",
+          "fallbacks",
+          "session_type",
+          "channel",
+          "target",
+          "delivery_mode",
+          "timezone",
+          "job_type",
+          "enabled",
+          "active",
+          "created_at",
+          "last_run_at",
+          "next_run_at",
+          "consecutive_failures"
+        ];
+        const selectParts = allColumns.map((col) => {
+          if (v1Cols.has(col)) return col;
+          return null;
+        }).filter(Boolean);
         db.exec(`
-          INSERT INTO jobs (id, cron, description, chat_id, active, created_at)
-          SELECT id, cron, description, chat_id, active, created_at FROM jobs_v1
+          INSERT INTO jobs (${selectParts.join(", ")})
+          SELECT ${selectParts.join(", ")} FROM jobs_v1
         `);
         db.exec("DROP TABLE jobs_v1");
         db.exec("COMMIT");
@@ -2071,7 +2189,8 @@ function saveMemoryWithEmbedding(trigger, content, type = "semantic") {
         warn(`[embeddings] Failed to update memory ${id} embedding: ${errorMessage(err)}`);
       }
     }
-  }).catch(() => {
+  }).catch((err) => {
+    warn(`[embeddings] Failed to generate embedding for memory ${id}: ${errorMessage(err)}`);
   });
   return id;
 }
@@ -2971,21 +3090,29 @@ function getNextGeminiSlot(chatId, mode) {
   const eligible = getEligibleGeminiSlots(mode);
   return eligible.length > 0 ? eligible[0] : null;
 }
-function markSlotExhausted(slotId, quotaClass) {
-  const cooldownHours = quotaClass === "billing" ? 24 : 6;
+function markSlotExhausted(slotId, quotaClass, reason) {
+  const cooldownHours = quotaClass === "billing" ? 24 : quotaClass === "capacity" ? 1 : 6;
   const disable = quotaClass === "billing" ? 1 : 0;
   db.prepare(`
     UPDATE gemini_credentials
-    SET cooldown_until = datetime('now', '+${cooldownHours} hours'),
+    SET cooldown_until = datetime('now', '+' || ? || ' hours'),
         consecutive_errors = consecutive_errors + 1,
         enabled = CASE WHEN consecutive_errors + 1 >= 10 THEN 0 ELSE CASE WHEN ? = 1 THEN 0 ELSE enabled END END
     WHERE id = ?
-  `).run(disable, slotId);
+  `).run(cooldownHours, disable, slotId);
 }
 function markSlotSuccess(slotId) {
   db.prepare(`
     UPDATE gemini_credentials
-    SET last_used = datetime('now'), consecutive_errors = 0, cooldown_until = NULL
+    SET last_used = datetime('now'), consecutive_errors = 0,
+        cooldown_until = CASE WHEN cooldown_until < datetime('now') THEN NULL ELSE cooldown_until END
+    WHERE id = ?
+  `).run(slotId);
+}
+function reenableSlot(slotId) {
+  db.prepare(`
+    UPDATE gemini_credentials
+    SET enabled = 1, consecutive_errors = 0, cooldown_until = NULL
     WHERE id = ?
   `).run(slotId);
 }
@@ -3055,7 +3182,7 @@ function pruneMessageLog(retentionDays = 30, rowCapPerChat = 2e3) {
     `).run(chat_id, chat_id, rowCapPerChat);
   }
 }
-var db, STOP_WORDS, pendingEscalations, ESCALATION_TTL_MS, ALL_TOOLS, JOB_SELECT;
+var db, walCheckpointTimer, STOP_WORDS, pendingEscalations, ESCALATION_TTL_MS, ALL_TOOLS, JOB_SELECT;
 var init_store5 = __esm({
   "src/memory/store.ts"() {
     "use strict";
@@ -3236,6 +3363,26 @@ var init_env = __esm({
   }
 });
 
+// src/backends/strip-thinking.ts
+function stripThinkingContent(text) {
+  let result = text;
+  for (const pattern of THINKING_PATTERNS) {
+    result = result.replace(pattern, "");
+  }
+  return result.trim();
+}
+var THINKING_PATTERNS;
+var init_strip_thinking = __esm({
+  "src/backends/strip-thinking.ts"() {
+    "use strict";
+    THINKING_PATTERNS = [
+      /<think>[\s\S]*?<\/think>/gi,
+      /<thinking>[\s\S]*?<\/thinking>/gi,
+      /\[Thought:\s*true\][\s\S]*?(?:\[\/Thought\]|\[Thought:\s*false\])/gi
+    ];
+  }
+});
+
 // src/backends/claude.ts
 import { existsSync as existsSync2 } from "fs";
 import { execSync } from "child_process";
@@ -3245,6 +3392,7 @@ var init_claude = __esm({
   "src/backends/claude.ts"() {
     "use strict";
     init_env();
+    init_strip_thinking();
     init_paths();
     init_log();
     ADAPTIVE_MODELS = /* @__PURE__ */ new Set(["claude-opus-4-6", "claude-sonnet-4-6", "claude-opus-4-6[1m]", "claude-sonnet-4-6[1m]"]);
@@ -3448,7 +3596,8 @@ var init_claude = __esm({
             }
           }
           if (textParts.length > 0) {
-            events.push({ type: "text", text: textParts.join("") });
+            const cleaned = stripThinkingContent(textParts.join(""));
+            if (cleaned) events.push({ type: "text", text: cleaned });
           }
         } else if (line.type === "user") {
           const message = line.message;
@@ -3492,25 +3641,14 @@ var init_claude = __esm({
 import { existsSync as existsSync3, mkdirSync } from "fs";
 import { execSync as execSync2 } from "child_process";
 import { join as join5 } from "path";
-function stripThinkingContent(text) {
-  let result = text;
-  for (const pattern of THINKING_PATTERNS) {
-    result = result.replace(pattern, "");
-  }
-  return result.trim();
-}
-var THINKING_PATTERNS, GeminiAdapter;
+var GeminiAdapter;
 var init_gemini = __esm({
   "src/backends/gemini.ts"() {
     "use strict";
     init_store5();
     init_env();
     init_paths();
-    THINKING_PATTERNS = [
-      /<think>[\s\S]*?<\/think>/gi,
-      /<thinking>[\s\S]*?<\/thinking>/gi,
-      /\[Thought:\s*true\][\s\S]*?(?:\[\/Thought\]|\[Thought:\s*false\])/gi
-    ];
+    init_strip_thinking();
     GeminiAdapter = class {
       id = "gemini";
       displayName = "Gemini";
@@ -3694,6 +3832,7 @@ var init_codex = __esm({
   "src/backends/codex.ts"() {
     "use strict";
     init_env();
+    init_strip_thinking();
     CodexAdapter = class {
       id = "codex";
       displayName = "Codex";
@@ -3813,7 +3952,8 @@ var init_codex = __esm({
         } else if (line.type === "item.completed") {
           const item = line.item;
           if (item?.type === "agent_message" && item.text) {
-            events.push({ type: "text", text: item.text });
+            const cleaned = stripThinkingContent(item.text);
+            if (cleaned) events.push({ type: "text", text: cleaned });
           } else if (item?.type === "command_execution") {
             events.push({
               type: "tool_end",
@@ -4262,7 +4402,7 @@ function extractKeyField(input) {
   }
   const sorted = Object.keys(input).sort();
   const parts = sorted.map((k) => `${k}:${JSON.stringify(input[k])}`);
-  return parts.join("|");
+  return parts.join("|").slice(0, 500);
 }
 function fingerprint(toolName, input) {
   const key = extractKeyField(input);
@@ -4272,8 +4412,8 @@ var DEFAULT_WINDOW_SIZE, DEFAULT_THRESHOLD, HARD_TURN_CAP, ToolLoopDetector;
 var init_tool_loop_detector = __esm({
   "src/tool-loop-detector.ts"() {
     "use strict";
-    DEFAULT_WINDOW_SIZE = 15;
-    DEFAULT_THRESHOLD = 3;
+    DEFAULT_WINDOW_SIZE = parseInt(process.env.CC_CLAW_LOOP_WINDOW_SIZE ?? "15", 10);
+    DEFAULT_THRESHOLD = parseInt(process.env.CC_CLAW_LOOP_THRESHOLD ?? "3", 10);
     HARD_TURN_CAP = 200;
     ToolLoopDetector = class {
       windowSize;
@@ -4320,15 +4460,24 @@ var init_tool_loop_detector = __esm({
 });
 
 // src/memory/inject.ts
+function getTopK(query) {
+  const wordCount = query.split(/\s+/).length;
+  const scale = wordCount <= 3 ? 0.5 : wordCount <= 8 ? 0.75 : 1;
+  return {
+    vectorK: Math.max(5, Math.round(BASE_VECTOR_TOP_K * scale)),
+    ftsK: Math.max(5, Math.round(BASE_FTS_TOP_K * scale))
+  };
+}
 function daysSince(dateStr) {
-  const date = /* @__PURE__ */ new Date(dateStr.replace(" ", "T") + (dateStr.includes("Z") ? "" : "Z"));
+  const trimmed = dateStr.trim();
+  const date = /* @__PURE__ */ new Date(trimmed.replace(" ", "T") + (trimmed.includes("Z") ? "" : "Z"));
   return Math.max(0, (Date.now() - date.getTime()) / (1e3 * 60 * 60 * 24));
 }
 function normalizeFtsScores(items) {
   const scores = /* @__PURE__ */ new Map();
   if (items.length === 0) return scores;
   const ranks = items.map((it) => Math.abs(it._ftsRank ?? 0));
-  const maxRank = Math.max(...ranks, 1e-3);
+  const maxRank = ranks.reduce((max, r) => r > max ? r : max, 1e-3);
   for (let i = 0; i < items.length; i++) {
     scores.set(items[i].id, ranks[i] / maxRank);
   }
@@ -4398,14 +4547,15 @@ async function injectMemoryContext(userMessage) {
     queryEmbedding = await embedQuery(userMessage);
   }
   const hasVectors = queryEmbedding !== null;
+  const { vectorK, ftsK } = getTopK(userMessage);
   let ftsMemories = [];
   let ftsSessions = [];
   try {
-    ftsMemories = searchMemories(userMessage, FTS_TOP_K);
+    ftsMemories = searchMemories(userMessage, ftsK);
   } catch {
   }
   try {
-    ftsSessions = searchSessionSummaries(userMessage, FTS_TOP_K);
+    ftsSessions = searchSessionSummaries(userMessage, ftsK);
   } catch {
   }
   let combinedMemories;
@@ -4413,8 +4563,8 @@ async function injectMemoryContext(userMessage) {
   if (hasVectors) {
     const allEmbeddedMemories = getAllMemoriesWithEmbeddings();
     const allEmbeddedSessions = getAllSessionSummariesWithEmbeddings();
-    const memVectorMatches = vectorSearch(queryEmbedding, allEmbeddedMemories, VECTOR_TOP_K);
-    const sesVectorMatches = vectorSearch(queryEmbedding, allEmbeddedSessions, VECTOR_TOP_K);
+    const memVectorMatches = vectorSearch(queryEmbedding, allEmbeddedMemories, vectorK);
+    const sesVectorMatches = vectorSearch(queryEmbedding, allEmbeddedSessions, vectorK);
     const memMap = /* @__PURE__ */ new Map();
     for (const m of ftsMemories) memMap.set(m.id, m);
     for (const vm of memVectorMatches) {
@@ -4483,16 +4633,16 @@ async function injectMemoryContext(userMessage) {
 ${lines.join("\n")}
 [End memory context]`;
 }
-var MEMORY_DECAY_RATE, SESSION_DECAY_RATE, VECTOR_TOP_K, FTS_TOP_K, FINAL_TOP_K_MEMORIES, FINAL_TOP_K_SESSIONS, MAX_MEMORY_CHARS, MAX_SESSION_CHARS, MAX_BRIDGE_CHARS, pendingContextBridges;
+var MEMORY_DECAY_RATE, SESSION_DECAY_RATE, BASE_VECTOR_TOP_K, BASE_FTS_TOP_K, FINAL_TOP_K_MEMORIES, FINAL_TOP_K_SESSIONS, MAX_MEMORY_CHARS, MAX_SESSION_CHARS, MAX_BRIDGE_CHARS, pendingContextBridges;
 var init_inject = __esm({
   "src/memory/inject.ts"() {
     "use strict";
     init_store5();
     init_embeddings();
-    MEMORY_DECAY_RATE = 0.02;
-    SESSION_DECAY_RATE = 5e-3;
-    VECTOR_TOP_K = 20;
-    FTS_TOP_K = 20;
+    MEMORY_DECAY_RATE = parseFloat(process.env.CC_CLAW_MEMORY_DECAY_RATE ?? "0.02");
+    SESSION_DECAY_RATE = parseFloat(process.env.CC_CLAW_SESSION_DECAY_RATE ?? "0.005");
+    BASE_VECTOR_TOP_K = 20;
+    BASE_FTS_TOP_K = 20;
     FINAL_TOP_K_MEMORIES = 5;
     FINAL_TOP_K_SESSIONS = 3;
     MAX_MEMORY_CHARS = 500;
@@ -4587,6 +4737,16 @@ You are an expert user and operator of the CC-Claw architecture. Because you are
 - **Files**: You can send physical files to the user across Telegram by simply writing \`[SEND_FILE:/absolute/path/to/file]\` in your response.
 - **MCP Ecosystem**: You are deeply natively integrated with Model Context Protocol (MCP) servers (like Perplexity, NotebookLM, Context7) granting you immense external reach.
 
+## 7. CLI Reference
+- Run \\\`cc-claw --ai\\\` for a comprehensive command reference covering all CLI and Telegram commands
+- Use \\\`cc-claw --ai --install\\\` to install the skill to all backend skill directories
+
+## 8. CRITICAL RULES \u2014 Memory & State
+- NEVER use native CLI memory tools (Gemini's save_memory, Claude's memory, etc.) \u2014 they are backend-local
+- NEVER modify the SQLite database directly (no INSERT/UPDATE/DELETE SQL)
+- ALWAYS use CC-Claw slash commands (/remember, /evolve, etc.) or the cc-claw CLI
+- Memory MUST be cross-backend persistent \u2014 only CC-Claw's own API guarantees this
+
 If the user asks *how* to do something with CC-Claw, use this expertise to suggest the most native, idiomatic approach available in the architecture.
 `;
   }
@@ -4740,6 +4900,14 @@ function syncNativeCliFiles() {
     "- For heartbeat checks: respond with exactly HEARTBEAT_OK if nothing needs attention",
     "- Your working directory is ~/.cc-claw/workspace/",
     "- Skills are in ~/.cc-claw/workspace/skills/",
+    "",
+    "## CRITICAL: Tool Usage Rules",
+    "",
+    "- Do NOT use native CLI memory/storage tools (save_memory, etc.) \u2014 they are backend-local and invisible to other backends",
+    "- Do NOT modify the database directly with SQL (no INSERT/UPDATE/DELETE) \u2014 use CC-Claw commands only",
+    "- To save a memory: use /remember in Telegram, or tell the user to use it",
+    "- To learn your full CLI: run `cc-claw --ai`",
+    "- All state changes must go through the CC-Claw API layer for cross-backend persistence",
     ""
   ].join("\n");
   const ccClawPath = join6(IDENTITY_PATH, "CC-CLAW.md");
@@ -4997,6 +5165,19 @@ var init_loader = __esm({
   }
 });
 
+// src/text-utils.ts
+function appendTextChunk(accumulated, chunk) {
+  if (!accumulated) return chunk;
+  if (!chunk) return accumulated;
+  const needsSpace = !/\s$/.test(accumulated) && !/^\s/.test(chunk);
+  return needsSpace ? accumulated + " " + chunk : accumulated + chunk;
+}
+var init_text_utils = __esm({
+  "src/text-utils.ts"() {
+    "use strict";
+  }
+});
+
 // src/memory/session-log.ts
 var session_log_exports = {};
 __export(session_log_exports, {
@@ -5006,8 +5187,13 @@ __export(session_log_exports, {
   getLastMessageTimestamp: () => getLastMessageTimestamp,
   getLog: () => getLog,
   getLoggedChatIds: () => getLoggedChatIds,
-  getMessagePairCount: () => getMessagePairCount
+  getMessagePairCount: () => getMessagePairCount,
+  parseDbTimestamp: () => parseDbTimestamp
 });
+function parseDbTimestamp(ts2) {
+  const trimmed = ts2.trim();
+  return (/* @__PURE__ */ new Date(trimmed + (trimmed.includes("Z") ? "" : "Z"))).getTime();
+}
 function appendToLog(chatId, userMessage, assistantResponse, backend2, model2, sessionId) {
   const now = Date.now();
   appendMessageLog(chatId, "user", userMessage, backend2 ?? null, model2 ?? null, sessionId ?? null);
@@ -5027,7 +5213,8 @@ function getLog(chatId) {
   return rows.map((r) => ({
     role: r.role,
     text: r.content,
-    timestamp: (/* @__PURE__ */ new Date(r.created_at + (r.created_at.includes("Z") ? "" : "Z"))).getTime()
+    // Audit C26: Use shared timestamp parser for consistency with inject.ts
+    timestamp: parseDbTimestamp(r.created_at)
   }));
 }
 function getMessagePairCount(chatId) {
@@ -5035,7 +5222,8 @@ function getMessagePairCount(chatId) {
   if (cached && cached.length > 0) {
     return Math.floor(cached.length / 2);
   }
-  return Math.floor(getUnsummarizedLog(chatId).length / 2);
+  const dbRows = getUnsummarizedLog(chatId);
+  return Math.floor(dbRows.length / 2);
 }
 function clearLog(chatId) {
   markMessageLogSummarized(chatId);
@@ -5049,7 +5237,7 @@ function getLastMessageTimestamp(chatId) {
   const rows = getUnsummarizedLog(chatId);
   if (rows.length === 0) return null;
   const last = rows[rows.length - 1];
-  return (/* @__PURE__ */ new Date(last.created_at + (last.created_at.includes("Z") ? "" : "Z"))).getTime();
+  return parseDbTimestamp(last.created_at);
 }
 function getCachedLog(chatId) {
   return cache.get(chatId) ?? [];
@@ -5062,7 +5250,7 @@ var init_session_log = __esm({
   "src/memory/session-log.ts"() {
     "use strict";
     init_store5();
-    CACHE_SIZE = 20;
+    CACHE_SIZE = 50;
     cache = /* @__PURE__ */ new Map();
   }
 });
@@ -5077,21 +5265,27 @@ __export(summarize_exports, {
 });
 import { spawn } from "child_process";
 import { createInterface } from "readline";
+function getTranscriptCap(model2) {
+  if (model2 && /flash/i.test(model2)) return TRANSCRIPT_CAP_FLASH;
+  return TRANSCRIPT_CAP_DEFAULT;
+}
 function buildTranscript(entries) {
   const lines = [];
   let totalLen = 0;
-  for (const e of entries) {
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const e = entries[i];
     const limit = e.role === "user" ? USER_MSG_LIMIT : AGENT_MSG_LIMIT;
     const label2 = e.role === "user" ? "User" : "Agent";
     const text = e.text.length > limit ? e.text.slice(0, limit) + "\n[...truncated]" : e.text;
     const line = `[${label2}] ${text}`;
-    if (totalLen + line.length > TRANSCRIPT_CAP) {
+    if (totalLen + line.length > getTranscriptCap()) {
       lines.push("[...earlier messages truncated for length]");
       break;
     }
     lines.push(line);
     totalLen += line.length;
   }
+  lines.reverse();
   return lines.join("\n\n");
 }
 async function attemptSummarize(chatId, adapter, model2, entries) {
@@ -5121,11 +5315,12 @@ ${transcript}`;
       });
       proc.stderr?.resume();
       const rl2 = createInterface({ input: proc.stdout });
+      let killTimer;
       const timeout = setTimeout(() => {
         warn(`[summarize] Timeout (${adapter.id}:${model2}) for chat ${chatId}`);
         rl2.close();
         proc.kill("SIGTERM");
-        setTimeout(() => proc.kill("SIGKILL"), 2e3);
+        killTimer = setTimeout(() => proc.kill("SIGKILL"), 2e3);
       }, SUMMARIZE_TIMEOUT_MS);
       rl2.on("line", (line) => {
         if (!line.trim()) return;
@@ -5137,7 +5332,7 @@ ${transcript}`;
         }
         const events = adapter.parseLine(msg);
         for (const ev of events) {
-          if (ev.type === "text" && ev.text) accumulatedText += ev.text;
+          if (ev.type === "text" && ev.text) accumulatedText = appendTextChunk(accumulatedText, ev.text);
           if (ev.type === "usage" && ev.usage) {
             inputTokens += ev.usage.input;
             outputTokens += ev.usage.output;
@@ -5157,13 +5352,23 @@ ${transcript}`;
           }
         }
       });
-      proc.on("error", () => {
-        clearTimeout(timeout);
-        resolve();
+      let settled = false;
+      proc.on("error", (err) => {
+        warn(`[summarize] Spawn error (${adapter.id}:${model2}): ${err}`);
+        if (!settled) {
+          settled = true;
+          clearTimeout(timeout);
+          clearTimeout(killTimer);
+          resolve();
+        }
       });
       proc.on("close", () => {
-        clearTimeout(timeout);
-        resolve();
+        if (!settled) {
+          settled = true;
+          clearTimeout(timeout);
+          clearTimeout(killTimer);
+          resolve();
+        }
       });
     });
     if (inputTokens + outputTokens > 0) {
@@ -5219,66 +5424,84 @@ async function extractAndLogSignals(rawText, chatId, adapterId, model2) {
   }
 }
 async function summarizeWithFallbackChain(chatId, targetBackendId, excludeBackend, clearLogAfter = true) {
-  const pairCount = getMessagePairCount(chatId);
-  if (pairCount < MIN_PAIRS) {
-    if (clearLogAfter) clearLog(chatId);
+  const existing = summarizationLocks.get(chatId);
+  if (existing) {
+    warn(`[summarize] Already summarizing ${chatId}, skipping concurrent call`);
+    await existing;
     return false;
   }
-  const entries = getLog(chatId);
-  if (entries.length === 0) return false;
-  const tried = /* @__PURE__ */ new Set();
-  if (excludeBackend) {
-    const excluded = getAdapter(excludeBackend);
-    tried.add(`${excluded.id}:${excluded.summarizerModel}`);
-  }
-  try {
-    const config2 = getSummarizer(chatId);
-    if (config2.backend !== "off") {
-      const adapter = config2.backend ? getAdapter(config2.backend) : getAdapterForChat(chatId);
-      const model2 = config2.model ?? adapter.summarizerModel;
-      const key = `${adapter.id}:${model2}`;
-      tried.add(key);
-      const result = await attemptSummarize(chatId, adapter, model2, entries);
-      if (result.success) {
-        await extractAndLogSignals(result.rawText, chatId, adapter.id, model2);
-        if (clearLogAfter) clearLog(chatId);
-        return true;
-      }
+  const doSummarize = async () => {
+    const pairCount = getMessagePairCount(chatId);
+    if (pairCount < MIN_PAIRS) {
+      return false;
+    }
+    const entries = getLog(chatId);
+    if (entries.length === 0) return false;
+    const tried = /* @__PURE__ */ new Set();
+    if (excludeBackend) {
+      const excluded = getAdapter(excludeBackend);
+      tried.add(`${excluded.id}:${excluded.summarizerModel}`);
     }
-  } catch {
-  }
-  if (targetBackendId) {
     try {
-      const targetAdapter = getAdapter(targetBackendId);
-      const model2 = targetAdapter.summarizerModel;
-      const key = `${targetAdapter.id}:${model2}`;
-      if (!tried.has(key)) {
+      const config2 = getSummarizer(chatId);
+      if (config2.backend !== "off") {
+        const adapter = config2.backend ? getAdapter(config2.backend) : getAdapterForChat(chatId);
+        const model2 = config2.model ?? adapter.summarizerModel;
+        const key = `${adapter.id}:${model2}`;
         tried.add(key);
-        const result = await attemptSummarize(chatId, targetAdapter, model2, entries);
+        const result = await attemptSummarize(chatId, adapter, model2, entries);
         if (result.success) {
-          await extractAndLogSignals(result.rawText, chatId, targetAdapter.id, model2);
+          await extractAndLogSignals(result.rawText, chatId, adapter.id, model2);
           if (clearLogAfter) clearLog(chatId);
           return true;
         }
       }
     } catch {
     }
-  }
-  for (const adapter of getAllAdapters()) {
-    const model2 = adapter.summarizerModel;
-    const key = `${adapter.id}:${model2}`;
-    if (!tried.has(key)) {
-      tried.add(key);
-      const result = await attemptSummarize(chatId, adapter, model2, entries);
-      if (result.success) {
-        await extractAndLogSignals(result.rawText, chatId, adapter.id, model2);
-        if (clearLogAfter) clearLog(chatId);
-        return true;
+    if (targetBackendId) {
+      try {
+        const targetAdapter = getAdapter(targetBackendId);
+        const model2 = targetAdapter.summarizerModel;
+        const key = `${targetAdapter.id}:${model2}`;
+        if (!tried.has(key)) {
+          tried.add(key);
+          const result = await attemptSummarize(chatId, targetAdapter, model2, entries);
+          if (result.success) {
+            await extractAndLogSignals(result.rawText, chatId, targetAdapter.id, model2);
+            if (clearLogAfter) clearLog(chatId);
+            return true;
+          }
+        }
+      } catch {
+      }
+    }
+    let fallbackCount = 0;
+    const MAX_FALLBACK_ATTEMPTS = 3;
+    for (const adapter of getAllAdapters()) {
+      if (fallbackCount >= MAX_FALLBACK_ATTEMPTS) break;
+      const model2 = adapter.summarizerModel;
+      const key = `${adapter.id}:${model2}`;
+      if (!tried.has(key)) {
+        tried.add(key);
+        fallbackCount++;
+        const result = await attemptSummarize(chatId, adapter, model2, entries);
+        if (result.success) {
+          await extractAndLogSignals(result.rawText, chatId, adapter.id, model2);
+          if (clearLogAfter) clearLog(chatId);
+          return true;
+        }
       }
     }
+    warn(`[summarize] All fallback attempts failed for chat ${chatId} \u2014 raw log preserved`);
+    return false;
+  };
+  const promise = doSummarize();
+  summarizationLocks.set(chatId, promise);
+  try {
+    return await promise;
+  } finally {
+    summarizationLocks.delete(chatId);
   }
-  warn(`[summarize] All fallback attempts failed for chat ${chatId} \u2014 raw log preserved`);
-  return false;
 }
 async function summarizeSession(chatId, clearLogAfter = true) {
   return summarizeWithFallbackChain(chatId, void 0, void 0, clearLogAfter);
@@ -5299,7 +5522,7 @@ async function summarizeAllPending() {
     await summarizeSession(chatId);
   }
 }
-var MIN_PAIRS, USER_MSG_LIMIT, AGENT_MSG_LIMIT, TRANSCRIPT_CAP, SUMMARIZE_TIMEOUT_MS, SUMMARIZE_PROMPT, CONTEXT_BRIDGE_PROMPT, VALID_SIGNAL_TYPES;
+var MIN_PAIRS, summarizationLocks, USER_MSG_LIMIT, AGENT_MSG_LIMIT, TRANSCRIPT_CAP_DEFAULT, TRANSCRIPT_CAP_FLASH, SUMMARIZE_TIMEOUT_MS, SUMMARIZE_PROMPT, CONTEXT_BRIDGE_PROMPT, VALID_SIGNAL_TYPES;
 var init_summarize = __esm({
   "src/memory/summarize.ts"() {
     "use strict";
@@ -5307,10 +5530,13 @@ var init_summarize = __esm({
     init_store5();
     init_session_log();
     init_backends();
+    init_text_utils();
     MIN_PAIRS = 2;
+    summarizationLocks = /* @__PURE__ */ new Map();
     USER_MSG_LIMIT = 4e3;
     AGENT_MSG_LIMIT = 6e3;
-    TRANSCRIPT_CAP = 1e5;
+    TRANSCRIPT_CAP_DEFAULT = 1e5;
+    TRANSCRIPT_CAP_FLASH = 5e4;
     SUMMARIZE_TIMEOUT_MS = 6e4;
     SUMMARIZE_PROMPT = `You are summarizing a conversation session for long-term episodic memory. This summary will be injected into future conversations to provide context, so it must contain enough specific detail to be useful weeks or months later.
 
@@ -5358,7 +5584,7 @@ Be specific. The new assistant has no prior context. Cover any domain \u2014 per
 // src/gemini/quota.ts
 function classifyGeminiQuota(errorText) {
   for (const p of CAPACITY_PATTERNS) {
-    if (p.test(errorText)) return "rate_limited";
+    if (p.test(errorText)) return "capacity";
   }
   for (const p of RATE_LIMITED_PATTERNS) {
     if (p.test(errorText)) return "rate_limited";
@@ -5389,8 +5615,9 @@ var init_quota = __esm({
     ];
     DAILY_QUOTA_PATTERNS = [
       /quota exceeded.*per day/i,
-      /resource.?exhausted/i,
-      /check.?quota/i,
+      // Audit C39: Tightened — require both "resource exhausted" AND "check quota" together
+      // to avoid matching generic 500s that mention "exhausted" in a different context
+      /resource.?exhausted.*check.?quota/i,
       /RESOURCE_EXHAUSTED/,
       /exhausted.*quota/i
     ];
@@ -5497,9 +5724,15 @@ import { spawn as spawn2 } from "child_process";
 import { createInterface as createInterface2 } from "readline";
 import { readFileSync as readFileSync4 } from "fs";
 function stripFrontmatter(text) {
-  const match = text.match(/^---\s*\n[\s\S]*?\n---\s*\n?/m);
-  if (!match || match.index !== 0) return text;
-  return text.slice(match[0].length);
+  const lines = text.split("\n");
+  if (lines.length < 2 || lines[0].trim() !== "---") return text;
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i].trim() === "---") {
+      const start = i + 1 < lines.length && lines[i + 1].trim() === "" ? i + 2 : i + 1;
+      return lines.slice(start).join("\n");
+    }
+  }
+  return text;
 }
 function buildAgentPrompt(opts, runnerSkillPath) {
   const parts = [];
@@ -5527,7 +5760,11 @@ function buildSpawnEnv(runner, isSubAgent = false) {
   const runnerEnv = runner.getEnv();
   const env = { ...base, ...runnerEnv };
   if (isSubAgent) {
-    for (const key of SENSITIVE_ENV_KEYS) delete env[key];
+    for (const key of SENSITIVE_ENV_KEYS) {
+      if (!(key in runnerEnv)) {
+        delete env[key];
+      }
+    }
   }
   return env;
 }
@@ -5609,7 +5846,11 @@ var init_spawn = __esm({
       "ELEVENLABS_API_KEY",
       "DASHBOARD_TOKEN",
       "ALLOWED_CHAT_ID",
-      "CC_CLAW_DASHBOARD_TOKEN"
+      "CC_CLAW_DASHBOARD_TOKEN",
+      // Audit C15: API keys that should not leak to sub-agents
+      "ANTHROPIC_API_KEY",
+      "GEMINI_API_KEY",
+      "OPENAI_API_KEY"
     ];
   }
 });
@@ -5619,7 +5860,7 @@ var MAX_CONCURRENT_AGENTS, IDLE_THRESHOLD_MS, DEFAULT_MAX_RUNTIME_MS, BUDGET_WAR
 var init_types = __esm({
   "src/agents/types.ts"() {
     "use strict";
-    MAX_CONCURRENT_AGENTS = 4;
+    MAX_CONCURRENT_AGENTS = parseInt(process.env.CC_CLAW_MAX_AGENTS ?? "4", 10);
     IDLE_THRESHOLD_MS = 6e4;
     DEFAULT_MAX_RUNTIME_MS = 6e5;
     BUDGET_WARNING_PERCENT = 0.8;
@@ -5640,6 +5881,9 @@ function checkBudget(db3, orchestrationId) {
   if (budgetLimit === null || budgetLimit === void 0) {
     return { totalCost, budgetLimit: null, percentUsed: null, exceeded: false, warning: false };
   }
+  if (budgetLimit <= 0) {
+    return { totalCost, budgetLimit, percentUsed: 100, exceeded: true, warning: true };
+  }
   const percentUsed = totalCost / budgetLimit * 100;
   const exceeded = totalCost >= budgetLimit;
   const warning4 = percentUsed >= BUDGET_WARNING_PERCENT * 100;
@@ -5669,18 +5913,40 @@ async function discoverExistingMcps(runner) {
       encoding: "utf-8",
       env: runner.getEnv(),
       cwd: homedir3(),
-      timeout: 3e4
+      // Audit O20: Reduced from 30s — mcp list should be fast
+      timeout: 1e4
     });
     const stdout = typeof result === "string" ? result : Array.isArray(result) ? result[0] : result?.stdout ?? null;
     if (stdout == null) return [];
+    try {
+      const parsed = JSON.parse(stdout);
+      const servers = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.servers) ? parsed.servers : Array.isArray(parsed?.mcpServers) ? parsed.mcpServers : null;
+      if (servers) {
+        return servers.map((s) => s.name ?? s.id).filter((n) => typeof n === "string" && n.length > 0);
+      }
+    } catch {
+    }
+    const NAME_PATTERNS = [
+      /^([a-zA-Z0-9_-]+)\s*:/,
+      // "name: description" format
+      /^([a-zA-Z0-9_-]+)\s*\(/,
+      // "name (transport)" format
+      /^\s*"?([a-zA-Z0-9_-]+)"?\s*$/,
+      // bare name on its own line
+      /name["\s:=]+([a-zA-Z0-9_-]+)/i
+      // key-value: name = "foo"
+    ];
     const seen = /* @__PURE__ */ new Set();
     for (const line of stdout.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed || SKIP_LINE.test(trimmed)) continue;
       const cleaned = trimmed.replace(/^[✓✗•\-●]\s*/, "");
-      const match = cleaned.match(/^([a-zA-Z0-9_-]+):/);
-      if (match && !seen.has(match[1])) {
-        seen.add(match[1]);
+      for (const pattern of NAME_PATTERNS) {
+        const match = cleaned.match(pattern);
+        if (match && match[1] && !seen.has(match[1])) {
+          seen.add(match[1]);
+          break;
+        }
       }
     }
     return [...seen];
@@ -5693,31 +5959,47 @@ function diffMcps(needed, existing) {
   return needed.filter((name) => !existingSet.has(name.toLowerCase()));
 }
 function defToConfig(def) {
-  const config2 = {
-    name: def.name,
-    transport: def.transport
-  };
-  if (def.command) config2.command = def.command;
-  if (def.args) config2.args = JSON.parse(def.args);
-  if (def.url) config2.url = def.url;
-  if (def.env) config2.env = JSON.parse(def.env);
-  return config2;
+  try {
+    const config2 = {
+      name: def.name,
+      transport: def.transport
+    };
+    if (def.command) config2.command = def.command;
+    if (def.args) config2.args = JSON.parse(def.args);
+    if (def.url) config2.url = def.url;
+    if (def.env) config2.env = JSON.parse(def.env);
+    return config2;
+  } catch (err) {
+    const { warn: warn2 } = (init_log(), __toCommonJS(log_exports));
+    warn2(`[mcp] Skipping MCP "${def.name}" \u2014 malformed JSON in args/env:`, err);
+    return null;
+  }
 }
 async function injectMcps(runner, mcpNames, db3, scope) {
   const added = [];
   const exe = runner.getExecutablePath();
   const runnerId = runner.id;
-  for (const name of mcpNames) {
-    const def = getMcpServer(db3, name);
-    if (!def) continue;
-    try {
-      const config2 = defToConfig(def);
-      const addCmd = runner.getMcpAddCommand(config2);
-      const args = addCmd.slice(1);
-      await execFileAsync(exe, args, { encoding: "utf-8" });
-      addPropagation(db3, name, runnerId, scope);
-      added.push(name);
-    } catch {
+  const results = await Promise.allSettled(
+    mcpNames.map(async (name) => {
+      const def = getMcpServer(db3, name);
+      if (!def) return null;
+      try {
+        const config2 = defToConfig(def);
+        if (!config2) return null;
+        const addCmd = runner.getMcpAddCommand(config2);
+        const args = addCmd.slice(1);
+        await execFileAsync(exe, args, { encoding: "utf-8" });
+        addPropagation(db3, name, runnerId, scope);
+        return name;
+      } catch (err) {
+        warn(`[mcp] inject ${name} \u2192 ${runnerId} failed:`, err);
+        return null;
+      }
+    })
+  );
+  for (const result of results) {
+    if (result.status === "fulfilled" && result.value) {
+      added.push(result.value);
     }
   }
   return added;
@@ -5730,9 +6012,11 @@ async function cleanupMcps(runner, mcps2, db3, scope) {
       const removeCmd = runner.getMcpRemoveCommand(name);
       const args = removeCmd.slice(1);
       await execFileAsync(exe, args, { encoding: "utf-8" });
+      removePropagation(db3, name, runnerId, scope);
     } catch {
+      const { warn: warn2 } = (init_log(), __toCommonJS(log_exports));
+      warn2(`[propagate] Failed to remove MCP "${name}" from ${runnerId} \u2014 record kept for retry`);
     }
-    removePropagation(db3, name, runnerId, scope);
   }
 }
 var execFileAsync, SKIP_LINE;
@@ -5740,6 +6024,7 @@ var init_propagate = __esm({
   "src/mcps/propagate.ts"() {
     "use strict";
     init_store2();
+    init_log();
     execFileAsync = promisify(execFile);
     SKIP_LINE = /^(Checking|Configured|No MCP|Try |──)/i;
   }
@@ -6011,7 +6296,7 @@ var init_agent_log = __esm({
 import { existsSync as existsSync10 } from "fs";
 async function withRunnerLock(runnerId, fn) {
   const prev = runnerLocks.get(runnerId) ?? Promise.resolve();
-  const next = prev.then(fn, fn);
+  const next = prev.then(fn, () => fn());
   runnerLocks.set(runnerId, next.then(() => {
   }, () => {
   }));
@@ -6176,12 +6461,13 @@ async function startAgent(agentId, chatId, opts) {
       warn(`[orchestrator] MCP injection failed for agent ${agentId}:`, err);
     }
   }
+  const dashboardEnabled = process.env.DASHBOARD_ENABLED === "1";
   let mcpExtraArgs = [];
   let orchestratorMcpName = "";
-  if (process.env.DASHBOARD_ENABLED !== "1") {
+  if (!dashboardEnabled) {
     warn(`[orchestrator] DASHBOARD_ENABLED is not set \u2014 agent ${agentId.slice(0, 8)} will NOT have orchestrator MCP tools (set_state, send_message, etc.)`);
   }
-  if (process.env.DASHBOARD_ENABLED === "1") {
+  if (dashboardEnabled) {
     try {
       const { createSubAgentToken: createSubAgentToken2 } = await Promise.resolve().then(() => (init_server(), server_exports));
       const scopedToken = createSubAgentToken2(agentId);
@@ -6193,10 +6479,12 @@ async function startAgent(agentId, chatId, opts) {
       } else {
         await withRunnerLock(runner.id, async () => {
           const addCmd = runner.getMcpAddCommand(mcpConfig);
-          const { execFileSync: execFileSync5 } = await import("child_process");
+          const { execFile: execFile5 } = await import("child_process");
+          const { promisify: promisify3 } = await import("util");
+          const execFileAsync3 = promisify3(execFile5);
           const exe = addCmd[0];
           const args = addCmd.slice(1);
-          execFileSync5(exe, args, { encoding: "utf-8", timeout: 15e3, env: runner.getEnv() });
+          await execFileAsync3(exe, args, { encoding: "utf-8", timeout: 15e3, env: runner.getEnv() });
         });
         mcpsAdded = [...mcpsAdded, orchestratorMcpName];
         updateAgentMcpsAdded(db3, agentId, mcpsAdded);
@@ -6211,6 +6499,7 @@ async function startAgent(agentId, chatId, opts) {
   }
   updateAgentStatus(db3, agentId, "starting");
   const stderrChunks = [];
+  const MAX_STDERR_CHUNKS = 50;
   const rawStdoutLines = [];
   let gotResult = false;
   const startedAt = Date.now();
@@ -6268,7 +6557,9 @@ async function startAgent(agentId, chatId, opts) {
       );
       startNextQueued(chatId);
     },
-    onStderr: (chunk) => stderrChunks.push(chunk)
+    onStderr: (chunk) => {
+      if (stderrChunks.length < MAX_STDERR_CHUNKS) stderrChunks.push(chunk);
+    }
   });
   if (child.pid) {
     updateAgentPid(db3, agentId, child.pid);
@@ -6295,6 +6586,9 @@ async function startAgent(agentId, chatId, opts) {
     agentId
   );
   child.on("close", (code, signal) => {
+    clearTimeout(timeoutTimers.get(agentId));
+    timeoutTimers.delete(agentId);
+    activeProcesses.delete(agentId);
     if (gotResult) return;
     const agent = getAgent(db3, agentId);
     if (!agent || agent.status === "completed" || agent.status === "failed") return;
@@ -6322,10 +6616,10 @@ async function startAgent(agentId, chatId, opts) {
     }
     let exitCode = code ?? 1;
     let exitCodeForced = false;
-    if (exitCode === 0) {
+    if (exitCode === 0 && durationMs < 5e3) {
       exitCode = 1;
       exitCodeForced = true;
-      warn(`[orchestrator] Agent ${agentId.slice(0, 8)}: exit code 0 with no output \u2014 forced to 1 (likely auth/model issue)`);
+      warn(`[orchestrator] Agent ${agentId.slice(0, 8)}: exit code 0 with no output in ${durationMs}ms \u2014 forced to 1 (likely auth/model issue)`);
     }
     const errMsg = exitCodeForced ? `CLI exited cleanly but produced no output (${durationMs}ms) \u2014 likely auth failure or invalid model${stderr ? `: ${stderr.slice(0, 200)}` : ""}` : `CLI exited with code ${exitCode}${stderr ? `: ${stderr.slice(0, 200)}` : ""}`;
     updateAgentResult(db3, agentId, {
@@ -6356,11 +6650,11 @@ async function startAgent(agentId, chatId, opts) {
     if (crashedAgent) {
       const mcpsCrashed = crashedAgent.mcpsAdded ? JSON.parse(crashedAgent.mcpsAdded) : [];
       if (mcpsCrashed.length > 0) {
-        const runner2 = getRunner(crashedAgent.runnerId);
-        if (runner2) {
-          const cleanupFn = () => cleanupMcps(runner2, mcpsCrashed, db3, `agent:${agentId}`);
-          if (runner2.capabilities.mcpInjection === "add-remove") {
-            withRunnerLock(runner2.id, cleanupFn).catch((err) => {
+        const cleanupRunner = getRunner(crashedAgent.runnerId);
+        if (cleanupRunner) {
+          const cleanupFn = () => cleanupMcps(cleanupRunner, mcpsCrashed, db3, `agent:${agentId}`);
+          if (cleanupRunner.capabilities.mcpInjection === "add-remove") {
+            withRunnerLock(cleanupRunner.id, cleanupFn).catch((err) => {
               warn(`[orchestrator] MCP cleanup failed for crashed agent ${agentId.slice(0, 8)}:`, err);
             });
           } else {
@@ -6528,22 +6822,32 @@ async function handleAgentComplete(agentId, chatId, resultText, usage2, mcpsAdde
 }
 function startNextQueued(chatId) {
   const db3 = getDb();
-  const orch = getActiveOrchestration(db3, chatId);
-  if (!orch) return;
   const runningCount = getRunningAgentCount();
   if (runningCount >= MAX_CONCURRENT_AGENTS) return;
-  const next = getNextQueuedAgent(db3, orch.id);
+  const orch = getActiveOrchestration(db3, chatId);
+  let next = null;
+  let resolvedChatId = chatId;
+  if (orch) {
+    next = getNextQueuedAgent(db3, orch.id);
+  }
+  if (!next) {
+    next = getNextQueuedAgentGlobal(db3);
+    if (next) {
+      const agentOrch = getOrchestration(db3, next.orchestrationId);
+      if (agentOrch) resolvedChatId = agentOrch.chatId;
+    }
+  }
   if (!next) return;
   const agent = getAgent(db3, next.id);
   if (!agent) return;
-  startAgent(next.id, chatId, {
+  startAgent(next.id, resolvedChatId, {
     runner: agent.runnerId,
     task: agent.task ?? "",
     name: agent.name ?? void 0,
     description: agent.description ?? void 0,
     model: agent.model ?? void 0,
     skills: JSON.parse(agent.skills),
-    permMode: agent.permMode === "inherit" ? getMode(chatId) : agent.permMode,
+    permMode: agent.permMode === "inherit" ? getMode(resolvedChatId) : agent.permMode,
     role: agent.role ?? "worker",
     persona: agent.persona ?? void 0,
     maxRuntimeMs: agent.maxRuntimeMs,
@@ -6604,6 +6908,10 @@ function cancelAgent(agentId, reason = "user_cancelled") {
   }).catch(() => {
   });
   log(`[orchestrator] Agent ${agentId} cancelled (reason: ${reason})`);
+  const cancelOrch = getOrchestration(db3, agent.orchestrationId);
+  if (cancelOrch) {
+    startNextQueued(cancelOrch.chatId);
+  }
   return true;
 }
 function cancelAllAgents(chatId, reason = "user_cancelled") {
@@ -6708,8 +7016,10 @@ function registerMcp(db3, opts) {
   propagateChange(db3, opts.name, "add").catch(() => {
   });
 }
-function unregisterMcp(db3, name) {
-  propagateChange(db3, name, "remove").catch(() => {
+async function unregisterMcp(db3, name) {
+  await propagateChange(db3, name, "remove").catch((err) => {
+    const { warn: warn2 } = (init_log(), __toCommonJS(log_exports));
+    warn2(`[mcp] Propagation removal failed for "${name}":`, err);
   });
   removeMcpServer(db3, name);
 }
@@ -7057,6 +7367,12 @@ import { createInterface as createInterface3 } from "readline";
 import { readFileSync as readFileSync6, existsSync as existsSync11, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
 import { join as join11 } from "path";
 import { homedir as homedir4 } from "os";
+function applySignalDecay(confidence, createdAt) {
+  const ageMs = Date.now() - (/* @__PURE__ */ new Date(createdAt + (createdAt.endsWith("Z") ? "" : "Z"))).getTime();
+  const ageDays = ageMs / (24 * 60 * 60 * 1e3);
+  const decayed = confidence * Math.pow(0.5, ageDays / SIGNAL_DECAY_HALF_LIFE_DAYS);
+  return decayed >= SIGNAL_DECAY_MIN_CONFIDENCE ? Math.round(decayed * 100) / 100 : 0;
+}
 function discoverReflectionTargets() {
   const ccClawHome = join11(homedir4(), ".cc-claw");
   const targets = [];
@@ -7070,7 +7386,7 @@ function discoverReflectionTargets() {
         if (!existsSync11(skillFile)) continue;
         let desc = "skill";
         try {
-          const content = readFileSync6(skillFile, "utf-8").slice(0, 500);
+          const content = readFileSync6(skillFile, "utf-8");
           const descMatch = content.match(/description:\s*["']?([^"'\n]+)/);
           if (descMatch) desc = descMatch[1].trim().slice(0, 80);
         } catch {
@@ -7138,6 +7454,13 @@ ${categoryList}`);
   sections.push(soulMd || "(empty)");
   sections.push("[Current USER.md]");
   sections.push(userMd || "(empty)");
+  if (params.skillContents && params.skillContents.length > 0) {
+    sections.push("[Current Skill File Contents]");
+    for (const skill of params.skillContents) {
+      sections.push(`--- ${skill.path} ---`);
+      sections.push(skill.content);
+    }
+  }
   sections.push("[Previously Applied Insights]");
   if (appliedInsights.length === 0) {
     sections.push("(none)");
@@ -7170,13 +7493,13 @@ ${categoryList}`);
 Available targets:
 ${targetList.map((t) => `- ${t}`).join("\n")}
 
-Choose the MOST SPECIFIC target for each insight:
-- Workflow or process improvements \u2192 the relevant skill file
-- Tool usage patterns or domain-specific steps \u2192 the relevant skill file
-- User preference or profile info \u2192 USER.md
-- Personality, tone, general behavior \u2192 SOUL.md
-- Domain knowledge or reference material \u2192 a context file
-- If no matching skill/context file exists, fall back to SOUL.md or USER.md`);
+Routing priority (MOST SPECIFIC first \u2014 SOUL.md is a LAST RESORT):
+1. Workflow, process, or tool usage \u2192 the relevant skill file
+2. Domain knowledge or reference material \u2192 a context file (workspace/context/)
+3. User preference, profile, personal info \u2192 USER.md
+4. Personality, tone, general behavior \u2192 SOUL.md (ONLY if no skill/context file fits)
+
+IMPORTANT: Before routing to SOUL.md, check if an existing skill or context file covers the topic. If one exists, route there instead. SOUL.md should only receive broad personality or behavioral rules that don't fit anywhere else.`);
   const targetOptions = targetList.map((t) => t.split(" \u2014 ")[0]).join(" | ");
   sections.push(`[Output Format]
 For each insight, output EXACTLY this format. Separate multiple insights with "---" on its own line.
@@ -7350,7 +7673,7 @@ async function spawnAnalysis(adapter, model2, prompt, timeoutMs = ANALYSIS_TIMEO
       }
       const events = adapter.parseLine(msg);
       for (const ev of events) {
-        if (ev.type === "text" && ev.text) accumulatedText += ev.text;
+        if (ev.type === "text" && ev.text) accumulatedText = appendTextChunk(accumulatedText, ev.text);
         if (ev.type === "result") {
           resultText = ev.resultText || accumulatedText;
           if (adapter.shouldKillOnResult()) {
@@ -7373,6 +7696,18 @@ async function spawnAnalysis(adapter, model2, prompt, timeoutMs = ANALYSIS_TIMEO
   return resultText;
 }
 async function runAnalysis(chatId, opts = {}) {
+  if (analysisLocks.has(chatId)) {
+    log(`[reflection] Skipping analysis for ${chatId} \u2014 another analysis is already in progress`);
+    return [];
+  }
+  analysisLocks.add(chatId);
+  try {
+    return await runAnalysisImpl(chatId, opts);
+  } finally {
+    analysisLocks.delete(chatId);
+  }
+}
+async function runAnalysisImpl(chatId, opts) {
   const db3 = getDb();
   const { force = false } = opts;
   if (!force) {
@@ -7398,13 +7733,37 @@ async function runAnalysis(chatId, opts = {}) {
   const rejected = getRejectedInsights(db3, chatId);
   const codebaseEnabled = process.env.REFLECTION_CODEBASE_RECOMMENDATIONS === "1";
   const availableTargets = discoverReflectionTargets();
+  const SKILL_CONTENT_CAP = 15e3;
+  const skillContents = [];
+  const ccClawHome = join11(homedir4(), ".cc-claw");
+  const signalCorpus = signals.map((s) => s.trigger).join(" ").toLowerCase();
+  const convCorpus = (conversations ?? "").toLowerCase();
+  const searchCorpus = signalCorpus + " " + convCorpus;
+  let totalSkillChars = 0;
+  for (const target of availableTargets) {
+    if (!target.path.startsWith("workspace/skills/")) continue;
+    const skillName = target.path.split("/")[2] ?? "";
+    const skillNameNorm = skillName.toLowerCase().replace(/-/g, " ");
+    const descNorm = target.description.toLowerCase();
+    const isRelevant = searchCorpus.includes(skillNameNorm) || searchCorpus.includes(skillName.toLowerCase()) || descNorm.split(/\s+/).some((word) => word.length > 4 && searchCorpus.includes(word));
+    if (!isRelevant) continue;
+    try {
+      const fullPath = join11(ccClawHome, target.path);
+      if (existsSync11(fullPath)) {
+        const content = readFileSync6(fullPath, "utf-8");
+        if (totalSkillChars + content.length > SKILL_CONTENT_CAP) break;
+        skillContents.push({ path: target.path, content });
+        totalSkillChars += content.length;
+      }
+    } catch {
+    }
+  }
   const prompt = buildAnalysisPrompt({
-    signals: signals.map((s) => ({
-      signalType: s.signalType,
-      trigger: s.trigger,
-      confidence: s.confidence,
-      created_at: s.created_at
-    })),
+    signals: signals.map((s) => {
+      const decayedConfidence = applySignalDecay(s.confidence, s.created_at);
+      return { signalType: s.signalType, trigger: s.trigger, confidence: decayedConfidence, created_at: s.created_at };
+    }).filter((s) => s.confidence > 0),
+    // drop signals that decayed below threshold
     conversations,
     soulMd,
     userMd,
@@ -7420,7 +7779,8 @@ async function runAnalysis(chatId, opts = {}) {
       category: i.category
     })),
     codebaseEnabled,
-    availableTargets
+    availableTargets,
+    skillContents
   });
   const resolved = resolveReflectionAdapter(chatId);
   if (!resolved) {
@@ -7442,6 +7802,7 @@ async function runAnalysis(chatId, opts = {}) {
     return [];
   }
   const parsed = parseAnalysisOutput(rawOutput);
+  const hasUsableOutput = parsed.length > 0;
   const signalIdStr = signals.length > 0 ? signals.map((s) => s.id).join(",") : "manual";
   for (const insight of parsed) {
     let conflictsWithId = null;
@@ -7464,7 +7825,11 @@ async function runAnalysis(chatId, opts = {}) {
       model: model2
     });
   }
-  if (signals.length > 0) markSignalsProcessed(db3, signals.map((s) => s.id));
+  if (hasUsableOutput && signals.length > 0) {
+    markSignalsProcessed(db3, signals.map((s) => s.id));
+  } else if (!hasUsableOutput && signals.length > 0) {
+    log(`[reflection] Analysis returned unparseable output for ${chatId} \u2014 signals preserved for retry`);
+  }
   aggregateDailyMetrics(db3, chatId);
   logActivity(db3, {
     chatId,
@@ -7545,11 +7910,12 @@ async function runNightlyReflection(opts = {}) {
   log(`[reflection] Nightly reflection complete: ${results.length} chat(s) produced insights`);
   return { results };
 }
-var ANALYSIS_TIMEOUT_MS, CONVERSATIONS_CAP, MAX_INSIGHTS, VALID_CATEGORIES, VALID_CATEGORIES_NO_CODEBASE;
+var ANALYSIS_TIMEOUT_MS, CONVERSATIONS_CAP, MAX_INSIGHTS, SIGNAL_DECAY_HALF_LIFE_DAYS, SIGNAL_DECAY_MIN_CONFIDENCE, VALID_CATEGORIES, VALID_CATEGORIES_NO_CODEBASE, analysisLocks;
 var init_analyze = __esm({
   "src/reflection/analyze.ts"() {
     "use strict";
     init_log();
+    init_text_utils();
     init_paths();
     init_store5();
     init_backends();
@@ -7559,6 +7925,8 @@ var init_analyze = __esm({
     ANALYSIS_TIMEOUT_MS = 12e4;
     CONVERSATIONS_CAP = 4e3;
     MAX_INSIGHTS = 5;
+    SIGNAL_DECAY_HALF_LIFE_DAYS = 7;
+    SIGNAL_DECAY_MIN_CONFIDENCE = 0.1;
     VALID_CATEGORIES = [
       "behavior",
       "preference",
@@ -7574,6 +7942,7 @@ var init_analyze = __esm({
       "domain",
       "error_pattern"
     ];
+    analysisLocks = /* @__PURE__ */ new Set();
   }
 });
 
@@ -7862,12 +8231,12 @@ import { randomBytes } from "crypto";
 import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync6, existsSync as existsSync13 } from "fs";
 function createSubAgentToken(agentId) {
   const token = `sub:${agentId.slice(0, 8)}:${randomBytes(16).toString("hex")}`;
-  subAgentTokens.set(token, agentId);
+  subAgentTokens.set(token, { agentId, expiresAt: Date.now() + SUB_AGENT_TOKEN_TTL_MS });
   return token;
 }
 function revokeSubAgentToken(agentId) {
-  for (const [token, id] of subAgentTokens) {
-    if (id === agentId) {
+  for (const [token, entry] of subAgentTokens) {
+    if (entry.agentId === agentId) {
       subAgentTokens.delete(token);
       break;
     }
@@ -7881,6 +8250,14 @@ function htmlResponse(res, html) {
   res.writeHead(200, { "Content-Type": "text/html" });
   res.end(html);
 }
+function validateAgentIdentity(req, body) {
+  const boundAgentId = req.__boundAgentId;
+  if (!boundAgentId) return;
+  const callerAgentId = body.agentId ?? body.fromAgentId ?? body.message?.fromAgentId;
+  if (callerAgentId && callerAgentId !== boundAgentId) {
+    throw new Error(`IDENTITY_MISMATCH: Token bound to agent ${boundAgentId}, but request claims ${callerAgentId}`);
+  }
+}
 function readBody(req) {
   return new Promise((resolve, reject) => {
     const chunks = [];
@@ -7903,22 +8280,31 @@ function startDashboard() {
     const url = new URL(req.url ?? "/", `http://localhost:${PORT}`);
     const authHeader = req.headers.authorization ?? "";
     const bearerToken = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
-    const queryToken = url.searchParams.get("token") ?? "";
-    const presentedToken = bearerToken || queryToken;
+    const presentedToken = bearerToken;
     const isMainToken = presentedToken === DASHBOARD_TOKEN;
-    const isSubAgentToken = subAgentTokens.has(presentedToken);
+    const subEntry = subAgentTokens.get(presentedToken);
+    const isSubAgentToken = !!subEntry && subEntry.expiresAt > Date.now();
     if (!isMainToken && !isSubAgentToken) {
       res.writeHead(401, { "Content-Type": "text/plain" });
       res.end("Unauthorized");
       return;
     }
-    const MAIN_ONLY_PATHS = /* @__PURE__ */ new Set([
-      "/api/orchestrator/spawn",
-      "/api/orchestrator/cancel",
-      "/api/orchestrator/create-task"
+    const SUB_AGENT_ALLOWED_PATHS = /* @__PURE__ */ new Set([
+      "/api/orchestrator/update-task",
+      "/api/orchestrator/set-state",
+      "/api/orchestrator/send-message",
+      "/api/orchestrator/read-inbox",
+      "/api/orchestrator/broadcast",
+      "/api/orchestrator/get-state",
+      "/api/orchestrator/list-state",
+      "/api/orchestrator/check-agent",
+      "/api/health"
     ]);
-    if (isSubAgentToken && MAIN_ONLY_PATHS.has(url.pathname)) {
-      return jsonResponse(res, { error: "Forbidden: sub-agent tokens cannot access this endpoint" }, 403);
+    if (isSubAgentToken && !SUB_AGENT_ALLOWED_PATHS.has(url.pathname)) {
+      return jsonResponse(res, { error: "Forbidden: sub-agent tokens can only access designated endpoints" }, 403);
+    }
+    if (isSubAgentToken && req.method === "POST" && url.pathname.startsWith("/api/orchestrator/") && url.pathname !== "/api/health") {
+      req.__boundAgentId = subEntry.agentId;
     }
     if (url.pathname === "/api/health") {
       return jsonResponse(res, { status: "ok", version: VERSION, uptime: process.uptime() });
@@ -8013,8 +8399,8 @@ function startDashboard() {
     if (url.pathname.startsWith("/api/mcps/") && url.pathname !== "/api/mcps/sync" && url.pathname !== "/api/mcps/import" && req.method === "DELETE") {
       try {
         const name = decodeURIComponent(url.pathname.slice("/api/mcps/".length));
-        const { removeMcpServer: removeMcpServer2 } = await Promise.resolve().then(() => (init_store2(), store_exports2));
-        removeMcpServer2(getDb(), name);
+        const { unregisterMcp: unregisterMcp2 } = await Promise.resolve().then(() => (init_registry2(), registry_exports2));
+        await unregisterMcp2(getDb(), name);
         return jsonResponse(res, { success: true });
       } catch (err) {
         return jsonResponse(res, { error: errorMessage(err) }, 400);
@@ -8085,6 +8471,7 @@ function startDashboard() {
     if (url.pathname === "/api/orchestrator/send-message" && req.method === "POST") {
       try {
         const body = JSON.parse(await readBody(req));
+        validateAgentIdentity(req, body);
         const db3 = getDb();
         const orchId = getOrCreateOrchestration(body.chatId);
         const msgId = sendInboxMessage(db3, { orchestrationId: orchId, ...body.message });
@@ -8096,6 +8483,7 @@ function startDashboard() {
     if (url.pathname === "/api/orchestrator/read-inbox" && req.method === "POST") {
       try {
         const body = JSON.parse(await readBody(req));
+        validateAgentIdentity(req, body);
         const db3 = getDb();
         const orchId = getOrCreateOrchestration(body.chatId);
         const messages = getUnreadMessages(db3, orchId, body.agentId);
@@ -8110,6 +8498,7 @@ function startDashboard() {
     if (url.pathname === "/api/orchestrator/set-state" && req.method === "POST") {
       try {
         const body = JSON.parse(await readBody(req));
+        validateAgentIdentity(req, body);
         const db3 = getDb();
         const orchId = getOrCreateOrchestration(body.chatId);
         setState(db3, orchId, body.key, body.value, body.setBy);
@@ -8144,6 +8533,7 @@ function startDashboard() {
     if (url.pathname === "/api/orchestrator/broadcast" && req.method === "POST") {
       try {
         const body = JSON.parse(await readBody(req));
+        validateAgentIdentity(req, body);
         const db3 = getDb();
         const orchId = getOrCreateOrchestration(body.chatId);
         const agents2 = listActiveAgents(db3).filter((a) => a.orchestrationId === orchId);
@@ -8306,11 +8696,17 @@ function startDashboard() {
             "Cache-Control": "no-cache",
             Connection: "keep-alive"
           });
+          let clientDisconnected = false;
+          res.on("close", () => {
+            clientDisconnected = true;
+          });
           const sendSSE = (event, data) => {
-            res.write(`event: ${event}
+            if (!clientDisconnected && !res.writableEnded) {
+              res.write(`event: ${event}
 data: ${JSON.stringify(data)}
 
 `);
+            }
           };
           try {
             const response = await askAgent2(chatId, body.message, {
@@ -8323,10 +8719,10 @@ data: ${JSON.stringify(data)}
             });
             if (response.usage) addUsage2(chatId, response.usage.input, response.usage.output, response.usage.cacheRead, model2 ?? "unknown", void 0, response.usage.contextSize);
             sendSSE("done", JSON.stringify({ text: response.text, usage: response.usage }));
-            res.end();
+            if (!res.writableEnded) res.end();
           } catch (err) {
             sendSSE("error", errorMessage(err));
-            res.end();
+            if (!res.writableEnded) res.end();
           }
         } else {
           const response = await askAgent2(chatId, body.message, { cwd, model: model2, permMode: mode });
@@ -8577,6 +8973,75 @@ data: ${JSON.stringify(data)}
           const result = await triggerJob2(id);
           return jsonResponse(res, { success: true, result });
         }
+        if (action === "create") {
+          const { insertJob: insertJob2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
+          const { startSingleJob: startSingleJob2 } = await Promise.resolve().then(() => (init_cron(), cron_exports));
+          const job = insertJob2(body);
+          startSingleJob2(job);
+          return jsonResponse(res, { id: job.id, success: true });
+        }
+        if (action === "edit") {
+          const { getDb: getDb2, getJobById: getJobById2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
+          const { startSingleJob: startSingleJob2, stopJobTimer: stopJobTimer2 } = await Promise.resolve().then(() => (init_cron(), cron_exports));
+          const db3 = getDb2();
+          const updates = [];
+          const values = [];
+          if (body.title !== void 0) {
+            updates.push("title = ?");
+            values.push(body.title);
+          }
+          if (body.description !== void 0) {
+            updates.push("description = ?");
+            values.push(body.description);
+          }
+          if (body.cron !== void 0) {
+            updates.push("cron = ?, schedule_type = 'cron', at_time = NULL, every_ms = NULL");
+            values.push(body.cron);
+          }
+          if (body.atTime !== void 0) {
+            updates.push("at_time = ?, schedule_type = 'at', cron = NULL, every_ms = NULL");
+            values.push(body.atTime);
+          }
+          if (body.everyMs !== void 0) {
+            updates.push("every_ms = ?, schedule_type = 'every', cron = NULL, at_time = NULL");
+            values.push(body.everyMs);
+          }
+          if (body.backend !== void 0) {
+            updates.push("backend = ?");
+            values.push(body.backend);
+          }
+          if (body.model !== void 0) {
+            updates.push("model = ?");
+            values.push(body.model);
+          }
+          if (body.thinking !== void 0) {
+            updates.push("thinking = ?");
+            values.push(body.thinking);
+          }
+          if (body.timeout !== void 0) {
+            updates.push("timeout = ?");
+            values.push(body.timeout);
+          }
+          if (body.timezone !== void 0) {
+            updates.push("timezone = ?");
+            values.push(body.timezone);
+          }
+          if (body.fallbacks !== void 0) {
+            updates.push("fallbacks = ?");
+            values.push(JSON.stringify(body.fallbacks));
+          }
+          if (updates.length === 0) {
+            return jsonResponse(res, { error: "No fields to update" }, 400);
+          }
+          values.push(body.id);
+          db3.prepare(`UPDATE jobs SET ${updates.join(", ")} WHERE id = ?`).run(...values);
+          const fresh = getJobById2(body.id);
+          if (fresh && fresh.active && fresh.enabled) {
+            stopJobTimer2(body.id);
+            startSingleJob2(fresh);
+          }
+          return jsonResponse(res, { id: body.id, success: true });
+        }
         return jsonResponse(res, { error: "Unknown cron action" }, 400);
       } catch (err) {
         return jsonResponse(res, { error: errorMessage(err) }, 400);
@@ -8709,7 +9174,7 @@ data: ${JSON.stringify(data)}
 function getDashboardToken() {
   return DASHBOARD_TOKEN;
 }
-var PORT, DASHBOARD_TOKEN, subAgentTokens, MAX_BODY_BYTES, DASHBOARD_HTML;
+var PORT, DASHBOARD_TOKEN, SUB_AGENT_TOKEN_TTL_MS, subAgentTokens, MAX_BODY_BYTES, DASHBOARD_HTML;
 var init_server = __esm({
   "src/dashboard/server.ts"() {
     "use strict";
@@ -8729,7 +9194,14 @@ var init_server = __esm({
     init_store3();
     PORT = parseInt(process.env.DASHBOARD_PORT ?? "3141", 10);
     DASHBOARD_TOKEN = process.env.DASHBOARD_TOKEN || randomBytes(32).toString("hex");
+    SUB_AGENT_TOKEN_TTL_MS = 36e5;
     subAgentTokens = /* @__PURE__ */ new Map();
+    setInterval(() => {
+      const now = Date.now();
+      for (const [token, entry] of subAgentTokens) {
+        if (entry.expiresAt < now) subAgentTokens.delete(token);
+      }
+    }, 3e5);
     MAX_BODY_BYTES = 1048576;
     DASHBOARD_HTML = `<!DOCTYPE html>
 <html lang="en">
@@ -9106,7 +9578,8 @@ var init_detect = __esm({
     init_store4();
     init_store5();
     CORRECTION_PATTERNS = [
-      /^no[,.\s!]/i,
+      // Audit O36: Tightened — require "no" followed by correction context (not "No problem", "No worries")
+      /^no[,.\s!]+\s*(that'?s|it'?s|i\s|you|this|the|not|don'?t|stop|wrong)/i,
       /\bwrong\b/i,
       /\bthat's not (right|what|correct)/i,
       /\bi (meant|said)\b/i,
@@ -9148,6 +9621,7 @@ var init_detect = __esm({
 // src/agent.ts
 var agent_exports = {};
 __export(agent_exports, {
+  FIRST_RESPONSE_TIMEOUT_ERROR: () => FIRST_RESPONSE_TIMEOUT_ERROR,
   askAgent: () => askAgent,
   getInFlightMessage: () => getInFlightMessage,
   isChatBusy: () => isChatBusy,
@@ -9166,7 +9640,8 @@ function getInFlightMessage(chatId) {
 function killProcessGroup(proc, signal = "SIGTERM") {
   try {
     if (proc.pid) process.kill(-proc.pid, signal);
-  } catch {
+  } catch (err) {
+    warn(`[agent] Group kill (-${proc.pid}) failed: ${err} \u2014 falling back to direct kill`);
     try {
       proc.kill(signal);
     } catch {
@@ -9179,7 +9654,7 @@ function withChatLock(chatId, fn) {
   if (isBlocked) {
     warn(`[agent] Chat ${chatId} is busy \u2014 queuing request (cross-channel head-of-line blocking)`);
   }
-  const next = prev.then(fn, fn);
+  const next = prev.then(fn, () => fn());
   chatLocks.set(chatId, next.then(() => {
     chatLocks.delete(chatId);
   }, () => {
@@ -9250,11 +9725,28 @@ function spawnQuery(adapter, config2, model2, cancelState, thinkingLevel, timeou
     proc.stderr?.on("data", (chunk) => stderrChunks.push(chunk));
     const rl2 = createInterface4({ input: proc.stdout });
     let firstLine = true;
+    const frTimeoutMs = opts?.firstResponseTimeoutMs ?? FIRST_RESPONSE_TIMEOUT_MS;
+    let firstResponseTimer;
+    if (frTimeoutMs > 0) {
+      firstResponseTimer = setTimeout(() => {
+        if (firstLine) {
+          warn(`[agent] First-response timeout after ${frTimeoutMs}ms for ${adapter.id} \u2014 no NDJSON output received, killing`);
+          killProcessGroup(proc, "SIGTERM");
+          timedOut = true;
+          cancelState.__firstResponseTimeout = true;
+          sigkillTimer = setTimeout(() => killProcessGroup(proc, "SIGKILL"), 3e3);
+        }
+      }, frTimeoutMs);
+    }
     rl2.on("line", (line) => {
       if (!line.trim()) return;
       if (firstLine) {
         log(`[agent] First CLI message after ${elapsed()}`);
         firstLine = false;
+        if (firstResponseTimer) {
+          clearTimeout(firstResponseTimer);
+          firstResponseTimer = void 0;
+        }
       }
       let msg;
       try {
@@ -9275,7 +9767,7 @@ function spawnQuery(adapter, config2, model2, cancelState, thinkingLevel, timeou
             break;
           case "text":
             if (ev.text) {
-              accumulatedText += ev.text;
+              accumulatedText = appendTextChunk(accumulatedText, ev.text);
               if (opts?.onStream) opts.onStream(ev.text);
             }
             break;
@@ -9351,6 +9843,7 @@ function spawnQuery(adapter, config2, model2, cancelState, thinkingLevel, timeou
     });
     proc.on("error", (err) => {
       clearTimeout(spawnTimeout);
+      if (firstResponseTimer) clearTimeout(firstResponseTimer);
       if (sigkillTimer) clearTimeout(sigkillTimer);
       rl2.close();
       cancelState.process = void 0;
@@ -9358,6 +9851,10 @@ function spawnQuery(adapter, config2, model2, cancelState, thinkingLevel, timeou
     });
     proc.on("close", (code, signal) => {
       clearTimeout(spawnTimeout);
+      if (firstResponseTimer) {
+        clearTimeout(firstResponseTimer);
+        firstResponseTimer = void 0;
+      }
       if (sigkillTimer) {
         clearTimeout(sigkillTimer);
         sigkillTimer = void 0;
@@ -9372,6 +9869,12 @@ function spawnQuery(adapter, config2, model2, cancelState, thinkingLevel, timeou
         if (stderr) warn(`[agent] stderr: ${stderr.slice(0, 500)}`);
       }
       if (timedOut) {
+        if (cancelState.__firstResponseTimeout) {
+          delete cancelState.__firstResponseTimeout;
+          const stderr = stderrChunks.length > 0 ? Buffer.concat(stderrChunks).toString().trim() : "";
+          reject(new Error(`${FIRST_RESPONSE_TIMEOUT_ERROR}: No response from ${adapter.id} within ${frTimeoutMs / 1e3}s${stderr ? ` \u2014 ${stderr.slice(-300)}` : ""}`));
+          return;
+        }
         let msg = `Spawn timeout after ${effectiveTimeout / 1e3}s`;
         if (pendingTools.size > 0) {
           const tools2 = Array.from(pendingTools.values()).map((t) => typeof t === "string" ? t : t.name).join(", ");
@@ -9393,11 +9896,12 @@ Partial output: ${accumulatedText.slice(-500)}`;
         reject(new Error(`CLI exited with code ${code}${stderr ? `: ${stderr.slice(0, 500)}` : ""}`));
         return;
       }
-      resolve({ resultText, sessionId, input, output: output2, cacheRead, contextSize, sawToolEvents, sawResultEvent });
+      const cleanedResult = stripThinkingContent(resultText || accumulatedText);
+      resolve({ resultText: cleanedResult, sessionId, input, output: output2, cacheRead, contextSize, sawToolEvents, sawResultEvent });
     });
   });
 }
-async function spawnGeminiWithRotation(chatId, adapter, baseConfig, configWithSession, model2, cancelState, thinkingLevel, timeoutMs, maxTurns, rotationMode, opts, onSlotRotation, parentChatId) {
+async function spawnGeminiWithRotation(chatId, adapter, baseConfig, configWithSession, model2, cancelState, thinkingLevel, timeoutMs, maxTurns, rotationMode, opts, onSlotRotation, parentChatId, onModelDowngrade) {
   const geminiAdapter = adapter;
   const slots = getEligibleGeminiSlots(rotationMode);
   if (slots.length === 0) {
@@ -9407,8 +9911,9 @@ async function spawnGeminiWithRotation(chatId, adapter, baseConfig, configWithSe
     const { env } = geminiAdapter.getEnvForSlot(parentChatId, void 0, rotationMode);
     return await spawnQuery(adapter, configWithSession, model2, cancelState, thinkingLevel, timeoutMs, maxTurns, { ...opts, envOverride: env });
   }
-  const maxAttempts = Math.min(slots.length, 10);
+  const maxAttempts = slots.length;
   let lastError;
+  let unknownRetried = false;
   for (let i = 0; i < maxAttempts; i++) {
     const { env, slot } = geminiAdapter.getEnvForSlot(chatId, void 0, rotationMode);
     if (!slot) break;
@@ -9418,18 +9923,52 @@ async function spawnGeminiWithRotation(chatId, adapter, baseConfig, configWithSe
     const effectiveConfig = i === 0 ? configWithSession : baseConfig;
     try {
       const result = await spawnQuery(adapter, effectiveConfig, model2, cancelState, thinkingLevel, timeoutMs, maxTurns, { ...opts, envOverride: env });
-      const combinedText = result.resultText || "";
-      if (combinedText && /RESOURCE.?EXHAUSTED|resource has been exhausted/i.test(combinedText)) {
-        throw new Error(combinedText);
+      const checkText = (result.resultText || "").slice(0, 500);
+      if (checkText && /RESOURCE.?EXHAUSTED|resource has been exhausted/i.test(checkText)) {
+        throw new Error(checkText);
       }
       markSlotSuccess(slot.id);
       return result;
     } catch (err) {
       const errMsg = err instanceof Error ? err.message : String(err);
+      const isTimeout = errMsg.startsWith(FIRST_RESPONSE_TIMEOUT_ERROR);
+      const isExhausted = /RESOURCE.?EXHAUSTED|resource has been exhausted/i.test(errMsg);
+      if ((isTimeout || isExhausted) && GEMINI_DOWNGRADE_MODELS.has(model2)) {
+        const reason = isTimeout ? "No response within timeout" : "Resource exhausted";
+        warn(`[agent:gemini-rotation] ${reason} on ${model2} (${slotLabel}) \u2014 downgrading to ${GEMINI_FALLBACK_MODEL}`);
+        onModelDowngrade?.(model2, GEMINI_FALLBACK_MODEL, `${reason} \u2014 model likely overloaded`);
+        const fallbackConfig = adapter.buildSpawnConfig({
+          prompt: effectiveConfig.args[effectiveConfig.args.indexOf("-p") + 1],
+          model: GEMINI_FALLBACK_MODEL,
+          permMode: "yolo",
+          allowedTools: [],
+          cwd: effectiveConfig.cwd,
+          thinkingLevel,
+          maxTurns
+        });
+        for (const arg of effectiveConfig.args) {
+          if (arg.startsWith("--mcp-config") || arg.startsWith("--resume") || arg.startsWith("--allowed-mcp-server-names")) {
+            const idx = effectiveConfig.args.indexOf(arg);
+            if (idx >= 0 && idx + 1 < effectiveConfig.args.length && !effectiveConfig.args[idx].includes("=")) {
+              fallbackConfig.args.push(arg, effectiveConfig.args[idx + 1]);
+            } else {
+              fallbackConfig.args.push(arg);
+            }
+          }
+        }
+        return await spawnQuery(adapter, fallbackConfig, GEMINI_FALLBACK_MODEL, cancelState, thinkingLevel, timeoutMs, maxTurns, { ...opts, envOverride: env, firstResponseTimeoutMs: 0 });
+      }
       const quotaClass = classifyGeminiQuota(errMsg);
       if (quotaClass === "rate_limited") {
         throw err;
       }
+      if (quotaClass === "unknown" && !unknownRetried) {
+        unknownRetried = true;
+        warn(`[agent:gemini-rotation] Unknown error on ${slotLabel}, retrying once: ${errMsg.slice(0, 200)}`);
+        lastError = err instanceof Error ? err : new Error(errMsg);
+        continue;
+      }
+      unknownRetried = false;
       const effectiveClass = quotaClass === "unknown" ? "daily_quota" : quotaClass;
       warn(`[agent:gemini-rotation] Slot ${slotLabel} exhausted (${effectiveClass}): ${errMsg.slice(0, 200)}`);
       markSlotExhausted(slot.id, effectiveClass);
@@ -9467,7 +10006,7 @@ function askAgent(chatId, userMessage, opts) {
   return withChatLock(chatId, () => askAgentImpl(chatId, userMessage, opts));
 }
 async function askAgentImpl(chatId, userMessage, opts) {
-  const { cwd, onStream, model: model2, backend: backend2, permMode, onToolAction, bootstrapTier, timeoutMs, maxTurns, onSlotRotation, agentMode: optsAgentMode, onSubagentActivity, settingsSourceChatId } = opts ?? {};
+  const { cwd, onStream, model: model2, backend: backend2, permMode, onToolAction, bootstrapTier, timeoutMs, maxTurns, onSlotRotation, onModelDowngrade, agentMode: optsAgentMode, onSubagentActivity, settingsSourceChatId } = opts ?? {};
   const settingsChat = settingsSourceChatId ?? chatId;
   const adapter = backend2 ? getAdapter(backend2) : getAdapterForChat(settingsChat);
   const mode = permMode ?? getMode(settingsChat);
@@ -9519,9 +10058,36 @@ async function askAgentImpl(chatId, userMessage, opts) {
   try {
     if (useGeminiRotation) {
       const rotationCb = onSlotRotation ? (from, to) => onSlotRotation(chatId, from, to) : void 0;
-      result = await spawnGeminiWithRotation(chatId, adapter, baseConfig, configWithSession, resolvedModel, cancelState, thinkingLevel, timeoutMs, maxTurns, rotationMode, spawnOpts, rotationCb, settingsSourceChatId);
+      const downgradeCb = onModelDowngrade ? (from, to, reason) => onModelDowngrade(chatId, from, to, reason) : void 0;
+      result = await spawnGeminiWithRotation(chatId, adapter, baseConfig, configWithSession, resolvedModel, cancelState, thinkingLevel, timeoutMs, maxTurns, rotationMode, spawnOpts, rotationCb, settingsSourceChatId, downgradeCb);
     } else {
-      result = await spawnQuery(adapter, configWithSession, resolvedModel, cancelState, thinkingLevel, timeoutMs, maxTurns, spawnOpts);
+      try {
+        result = await spawnQuery(adapter, configWithSession, resolvedModel, cancelState, thinkingLevel, timeoutMs, maxTurns, spawnOpts);
+      } catch (err) {
+        const errMsg = err instanceof Error ? err.message : String(err);
+        const isTimeout = errMsg.startsWith(FIRST_RESPONSE_TIMEOUT_ERROR);
+        const isExhausted = /RESOURCE.?EXHAUSTED|resource has been exhausted/i.test(errMsg);
+        if (adapter.id === "gemini" && (isTimeout || isExhausted) && GEMINI_DOWNGRADE_MODELS.has(resolvedModel)) {
+          const reason = isTimeout ? "No response within timeout" : "Resource exhausted";
+          warn(`[agent] ${reason} on ${resolvedModel} (no rotation) \u2014 downgrading to ${GEMINI_FALLBACK_MODEL}`);
+          onModelDowngrade?.(chatId, resolvedModel, GEMINI_FALLBACK_MODEL, `${reason} \u2014 model likely overloaded`);
+          const fallbackConfig = adapter.buildSpawnConfig({
+            prompt: configWithSession.args[configWithSession.args.indexOf("-p") + 1],
+            model: GEMINI_FALLBACK_MODEL,
+            permMode: mode,
+            allowedTools,
+            cwd: resolvedCwd,
+            thinkingLevel,
+            maxTurns
+          });
+          if (mcpConfigPath) {
+            fallbackConfig.args = injectMcpConfig(adapter.id, fallbackConfig.args, mcpConfigPath);
+          }
+          result = await spawnQuery(adapter, fallbackConfig, GEMINI_FALLBACK_MODEL, cancelState, thinkingLevel, timeoutMs, maxTurns, { ...spawnOpts, firstResponseTimeoutMs: 0 });
+        } else {
+          throw err;
+        }
+      }
     }
     const wasEmptyResponse = !result.resultText && !result.sawToolEvents && !result.sawResultEvent;
     if (wasEmptyResponse && !cancelState.cancelled && existingSessionId) {
@@ -9530,7 +10096,8 @@ async function askAgentImpl(chatId, userMessage, opts) {
       clearSession(chatId);
       if (useGeminiRotation) {
         const rotationCb = onSlotRotation ? (from, to) => onSlotRotation(chatId, from, to) : void 0;
-        result = await spawnGeminiWithRotation(chatId, adapter, baseConfig, baseConfig, resolvedModel, cancelState, thinkingLevel, timeoutMs, maxTurns, rotationMode, spawnOpts, rotationCb, settingsSourceChatId);
+        const downgradeCb = onModelDowngrade ? (from, to, reason) => onModelDowngrade(chatId, from, to, reason) : void 0;
+        result = await spawnGeminiWithRotation(chatId, adapter, baseConfig, baseConfig, resolvedModel, cancelState, thinkingLevel, timeoutMs, maxTurns, rotationMode, spawnOpts, rotationCb, settingsSourceChatId, downgradeCb);
       } else {
         result = await spawnQuery(adapter, baseConfig, resolvedModel, cancelState, thinkingLevel, timeoutMs, maxTurns, spawnOpts);
       }
@@ -9601,7 +10168,7 @@ function injectMcpConfig(adapterId, args, mcpConfigPath) {
   if (!flag) return args;
   return [...args, ...flag, mcpConfigPath];
 }
-var activeChats, chatLocks, SPAWN_TIMEOUT_MS, MCP_CONFIG_FLAG;
+var activeChats, chatLocks, SPAWN_TIMEOUT_MS, FIRST_RESPONSE_TIMEOUT_MS, FIRST_RESPONSE_TIMEOUT_ERROR, GEMINI_FALLBACK_MODEL, GEMINI_DOWNGRADE_MODELS, MCP_CONFIG_FLAG;
 var init_agent = __esm({
   "src/agent.ts"() {
     "use strict";
@@ -9611,6 +10178,8 @@ var init_agent = __esm({
     init_paths();
     init_loader();
     init_log();
+    init_strip_thinking();
+    init_text_utils();
     init_session_log();
     init_summarize();
     init_quota();
@@ -9622,6 +10191,10 @@ var init_agent = __esm({
     activeChats = /* @__PURE__ */ new Map();
     chatLocks = /* @__PURE__ */ new Map();
     SPAWN_TIMEOUT_MS = 10 * 60 * 1e3;
+    FIRST_RESPONSE_TIMEOUT_MS = parseInt(process.env.GEMINI_FIRST_RESPONSE_TIMEOUT_MS ?? "15000", 10);
+    FIRST_RESPONSE_TIMEOUT_ERROR = "FIRST_RESPONSE_TIMEOUT";
+    GEMINI_FALLBACK_MODEL = "gemini-2.5-pro";
+    GEMINI_DOWNGRADE_MODELS = /* @__PURE__ */ new Set(["gemini-3.1-pro-preview"]);
     MCP_CONFIG_FLAG = {
       claude: ["--mcp-config"]
     };
@@ -9646,10 +10219,19 @@ function getChannelRegistry() {
   return registry;
 }
 function isPathAllowed(filePath) {
+  const normalized = filePath.replace(/\.\.\/|\.\.$/g, "");
+  if (normalized !== filePath) return false;
   for (const pattern of BLOCKED_PATH_PATTERNS) {
-    if (pattern.test(filePath)) return false;
+    if (pattern.test(normalized)) return false;
   }
-  return true;
+  for (const prefix of ALLOWED_PATH_PREFIXES) {
+    if (normalized.startsWith(prefix)) return true;
+  }
+  const ccClawWorkspace = `${process.env.HOME ?? "/root"}/.cc-claw/workspace/`;
+  if (normalized.startsWith(ccClawWorkspace)) return true;
+  const homePath = process.env.HOME ?? "/root";
+  if (normalized.startsWith(homePath) && !normalized.includes("/.")) return true;
+  return false;
 }
 async function processFileSends(chatId, channel, text) {
   const fileSendPattern = /\[SEND_FILE:(.+?)\]/g;
@@ -9698,9 +10280,11 @@ ${responseText.slice(0, 500)}`);
   try {
     const text = responseText.replace(/\s*\[REACT:[^\]]*\]\s*/g, " ").trim();
     if (job.deliveryMode === "webhook") {
-      await deliverWebhook(job, text);
-      appendToLog(job.chatId, `[cron:#${job.id}] ${job.description}`, text, job.backend ?? "claude", job.model, null);
-      return true;
+      const webhookOk = await deliverWebhook(job, text);
+      if (webhookOk) {
+        appendToLog(job.chatId, `[cron:#${job.id}] ${job.description}`, text, job.backend ?? "claude", job.model, null);
+      }
+      return webhookOk;
     }
     const channelName = job.channel ?? "telegram";
     const channel = registry?.get(channelName);
@@ -9728,7 +10312,7 @@ async function deliverWebhook(job, responseText) {
   const url = job.target;
   if (!url) {
     error(`[delivery] Job #${job.id}: webhook mode but no target URL`);
-    return;
+    return false;
   }
   try {
     const resp = await fetch(url, {
@@ -9744,11 +10328,13 @@ async function deliverWebhook(job, responseText) {
     });
     if (!resp.ok) {
       error(`[delivery] Webhook POST to ${url} failed: ${resp.status} ${resp.statusText}`);
-    } else {
-      log(`[delivery] Webhook POST to ${url}: ${resp.status}`);
+      return false;
     }
+    log(`[delivery] Webhook POST to ${url}: ${resp.status}`);
+    return true;
   } catch (err) {
     error(`[delivery] Webhook POST to ${url} error: ${errorMessage(err)}`);
+    return false;
   }
 }
 async function notifyJobFailure(job, errorMessage2, retryInfo) {
@@ -9776,25 +10362,30 @@ async function notifyJobAutoPaused(job) {
   } catch {
   }
 }
-var registry, BLOCKED_PATH_PATTERNS;
+var registry, ALLOWED_PATH_PREFIXES, BLOCKED_PATH_PATTERNS;
 var init_delivery = __esm({
   "src/scheduler/delivery.ts"() {
     "use strict";
     init_log();
     init_session_log();
     registry = null;
+    ALLOWED_PATH_PREFIXES = [
+      "/tmp/",
+      "/var/tmp/"
+    ];
     BLOCKED_PATH_PATTERNS = [
       /\/\.ssh\//,
       /\/\.gnupg\//,
       /\/\.aws\//,
       /\/\.env$/,
       /\/\.env\./,
-      /\/\.cc-claw\/\.env$/,
       /\/credentials\.json$/,
       /\/\.gitconfig$/,
       /\/\.netrc$/,
       /\/etc\/shadow$/,
-      /\/etc\/passwd$/
+      /\/etc\/passwd$/,
+      /\/secret/i,
+      /\/token/i
     ];
   }
 });
@@ -9873,12 +10464,14 @@ var init_retry = __esm({
 });
 
 // src/scheduler/health.ts
+import * as os from "os";
 function startHealthMonitor2() {
   lastHeartbeat = /* @__PURE__ */ new Date();
   heartbeatTimer = setInterval(() => {
     lastHeartbeat = /* @__PURE__ */ new Date();
     log(`[health] Scheduler heartbeat at ${lastHeartbeat.toISOString()}`);
   }, HEARTBEAT_INTERVAL_MS);
+  heartbeatTimer.unref();
 }
 function stopHealthMonitor2() {
   if (heartbeatTimer) {
@@ -9900,7 +10493,10 @@ function getHealthReport() {
     activeJobs: activeJobs.length,
     pausedJobs: pausedJobs.length,
     failingJobs,
-    totalJobs: allJobs.length
+    totalJobs: allJobs.length,
+    // Audit O39: Include system metrics for operator visibility
+    memoryMB: Math.round(process.memoryUsage().heapUsed / 1024 / 1024),
+    loadAvg: os.loadavg()[0]
   };
 }
 function formatHealthReport(report) {
@@ -9926,7 +10522,11 @@ function computeStaggerMs(jobId, cronExpr) {
   if (parts[0] !== "0") return 0;
   if (!/[*/]/.test(parts[1])) return 0;
   const maxStagger = 12e4;
-  return jobId * 7919 % maxStagger;
+  let h = jobId * 2654435761;
+  h = (h >>> 16 ^ h) * 73244475;
+  h = (h >>> 16 ^ h) * 73244475;
+  h = h >>> 16 ^ h;
+  return Math.abs(h) % maxStagger;
 }
 var lastHeartbeat, heartbeatTimer, HEARTBEAT_INTERVAL_MS;
 var init_health2 = __esm({
@@ -10050,6 +10650,7 @@ function buildProposalKeyboard(insightId, category) {
   return [
     [
       { label: "Apply", data: `evolve:apply:${insightId}`, style: "success" },
+      { label: "Preview", data: `evolve:preview:${insightId}` },
       { label: "Discuss", data: `evolve:discuss:${insightId}` }
     ],
     [
@@ -10239,7 +10840,8 @@ function mergeAndDeduplicate(raw) {
   });
 }
 function parseFrontmatter2(content, fallbackName) {
-  const fmMatch = content.match(/^---\s*\n([\s\S]*?)\n---/);
+  const cleaned = content.replace(/^\uFEFF/, "");
+  const fmMatch = cleaned.match(/^---\s*\n([\s\S]*?)\n---/);
   if (!fmMatch) {
     return { name: fallbackName, description: "" };
   }
@@ -10808,9 +11410,19 @@ var init_format_time = __esm({
 });
 
 // src/intent/classify.ts
+var classify_exports = {};
+__export(classify_exports, {
+  classifyIntent: () => classifyIntent,
+  getIntentStats: () => getIntentStats,
+  resetIntentStats: () => resetIntentStats
+});
 function getIntentStats() {
   return { ...intentCounts };
 }
+function resetIntentStats() {
+  intentCounts.chat = 0;
+  intentCounts.agentic = 0;
+}
 function classifyIntent(text, chatId) {
   const trimmed = text.trim();
   if (trimmed.startsWith(">>")) return "agentic";
@@ -11013,9 +11625,20 @@ var init_image_gen = __esm({
 
 // src/voice/stt.ts
 import crypto from "crypto";
-import { execFile as execFile2 } from "child_process";
+import { execFile as execFile2, execFileSync } from "child_process";
 import { readFile as readFile4, unlink } from "fs/promises";
 import { promisify as promisify2 } from "util";
+function ensureFfmpeg() {
+  if (ffmpegAvailable === true) return;
+  if (ffmpegAvailable === false) throw new Error("ffmpeg is required for voice replies. Install it: brew install ffmpeg (macOS) or apt install ffmpeg (Linux)");
+  try {
+    execFileSync("ffmpeg", ["-version"], { stdio: "ignore" });
+    ffmpegAvailable = true;
+  } catch {
+    ffmpegAvailable = false;
+    throw new Error("ffmpeg is required for voice replies. Install it: brew install ffmpeg (macOS) or apt install ffmpeg (Linux)");
+  }
+}
 function isVoiceEnabled(chatId) {
   const db3 = getDb();
   const row = db3.prepare("SELECT enabled FROM chat_voice WHERE chat_id = ?").get(chatId);
@@ -11149,6 +11772,7 @@ async function grokTts(text, apiKey, voiceId) {
   return await mp3ToOgg(mp3Buffer);
 }
 async function mp3ToOgg(mp3Buffer) {
+  ensureFfmpeg();
   const id = crypto.randomUUID();
   const tmpMp3 = `/tmp/cc-claw-tts-${id}.mp3`;
   const tmpOgg = `/tmp/cc-claw-tts-${id}.ogg`;
@@ -11165,6 +11789,7 @@ async function mp3ToOgg(mp3Buffer) {
   return oggBuffer;
 }
 async function macOsTts(text, voice2 = "Samantha") {
+  ensureFfmpeg();
   const id = crypto.randomUUID();
   const tmpAiff = `/tmp/cc-claw-tts-${id}.aiff`;
   const tmpOgg = `/tmp/cc-claw-tts-${id}.ogg`;
@@ -11179,13 +11804,14 @@ async function macOsTts(text, voice2 = "Samantha") {
   });
   return oggBuffer;
 }
-var execFileAsync2, ELEVENLABS_VOICES, GROK_VOICES, MACOS_VOICES;
+var execFileAsync2, ffmpegAvailable, ELEVENLABS_VOICES, GROK_VOICES, MACOS_VOICES;
 var init_stt = __esm({
   "src/voice/stt.ts"() {
     "use strict";
     init_log();
     init_store5();
     execFileAsync2 = promisify2(execFile2);
+    ffmpegAvailable = null;
     ELEVENLABS_VOICES = {
       "21m00Tcm4TlvDq8ikWAM": { name: "Rachel", gender: "F" },
       "EXAVITQu4vr4xnSDxMaL": { name: "Sarah", gender: "F" },
@@ -12051,11 +12677,21 @@ var init_guard = __esm({
       /\bdd\b.*\bof=/,
       /\b(shutdown|reboot|halt|poweroff)\b/,
       />\s*\/dev\/sd/,
-      /\bchmod\s+-R\s+777\b/,
+      /\bchmod\b.*\b777\b/,
+      // catch chmod 777 regardless of flag order
       /\bchown\s+-R\b/,
       /\bkillall\b/,
       /\blaunchctl\s+(unload|remove)\b/,
-      /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;?\s*:/
+      /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;?\s*:/,
+      // Audit C02: indirect destructive commands
+      /\bfind\b.*\b-delete\b/,
+      // find / -delete
+      /\b(curl|wget)\b.*\|\s*(ba)?sh\b/,
+      // remote code execution
+      /\bbase64\b.*\|\s*(ba)?sh\b/,
+      // encoded payload execution
+      /\btruncate\s+-s\s*0\b/
+      // file wipe via truncate
     ];
     pendingCommands = /* @__PURE__ */ new Map();
     PENDING_TTL_MS = 5 * 60 * 1e3;
@@ -12066,8 +12702,9 @@ var init_guard = __esm({
 import { execFile as execFile3 } from "child_process";
 function executeShell(command, cwd, timeoutMs = SHELL_TIMEOUT_MS) {
   return new Promise((resolve) => {
+    const shell = process.env.SHELL || "/bin/sh";
     execFile3(
-      "/bin/zsh",
+      shell,
       ["-c", command],
       { cwd, timeout: timeoutMs, maxBuffer: 5 * 1024 * 1024 },
       (error3, stdout, stderr) => {
@@ -12090,9 +12727,12 @@ function executeShell(command, cwd, timeoutMs = SHELL_TIMEOUT_MS) {
     );
   });
 }
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
 function formatCodeBlock(command, output2, exitCode) {
-  return `<pre>$ ${command}
-${output2}
+  return `<pre>$ ${escapeHtml(command)}
+${escapeHtml(output2)}
 [exit ${exitCode}]</pre>`;
 }
 function formatRaw(output2) {
@@ -12253,7 +12893,6 @@ __export(router_exports, {
   stopAllSideQuests: () => stopAllSideQuests
 });
 import { readFile as readFile5, writeFile as writeFile3, unlink as unlink2, mkdir as mkdir2, readdir as readdir3, stat } from "fs/promises";
-import { existsSync as existsSync18 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
 import { resolve as resolvePath, join as join18 } from "path";
 import { homedir as homedir6 } from "os";
@@ -12700,6 +13339,7 @@ ${cmds.map((c) => `  ${c.cmd} \u2014 ${c.desc}`).join("\n")}`
     case "stop": {
       const stopped = stopAgent(chatId);
       stopAllSideQuests(chatId);
+      cancelAllAgents(chatId);
       await channel.sendText(
         chatId,
         stopped ? "Stopping current task..." : "Nothing is running.",
@@ -14170,13 +14810,17 @@ Message: "${testMsg}"`, { parseMode: "plain" });
           else if (diffHours < 24) lastText = `${diffHours}h ago`;
           else lastText = `${Math.floor(diffHours / 24)}d ago`;
         }
+        const { getReflectionModelConfig: getReflectionModelConfig2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
+        const modelConfig = getReflectionModelConfig2(getDb(), chatId);
+        const modelLabel = modelConfig.mode === "pinned" && modelConfig.backend && modelConfig.model ? `Pinned: ${modelConfig.backend}/${modelConfig.model}` : modelConfig.mode === "cheap" ? "Cheap" : "Auto";
         const dashText = [
           "Self-Learning & Evolution",
           "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501",
           "",
           `\u2705 Active`,
           `Signals: ${signals} pending  \xB7  Proposals: ${pending}`,
-          `Last analysis: ${lastText}`
+          `Last analysis: ${lastText}`,
+          `Model: ${modelLabel}`
         ].join("\n");
         if (typeof channel.sendKeyboard === "function") {
           const { buildEvolveMenuKeyboard: buildEvolveMenuKeyboard2 } = await Promise.resolve().then(() => (init_propose(), propose_exports));
@@ -14187,47 +14831,6 @@ Message: "${testMsg}"`, { parseMode: "plain" });
       }
       break;
     }
-    case "reflect": {
-      const lastReflect = lastReflectTime.get(chatId);
-      if (lastReflect && Date.now() - lastReflect < REFLECT_COOLDOWN_MS) {
-        const remaining = Math.ceil((REFLECT_COOLDOWN_MS - (Date.now() - lastReflect)) / 1e3);
-        await channel.sendText(chatId, `Please wait ${remaining}s before reflecting again.`, { parseMode: "plain" });
-        break;
-      }
-      const { getMessagePairCount: getMessagePairCount2 } = await Promise.resolve().then(() => (init_session_log(), session_log_exports));
-      const pairCount = getMessagePairCount2(chatId);
-      if (pairCount < 2) {
-        await channel.sendText(chatId, "Need more conversation to analyze \u2014 at least 2 message exchanges.", { parseMode: "plain" });
-        break;
-      }
-      lastReflectTime.set(chatId, Date.now());
-      await channel.sendText(chatId, "Step 1/3: Summarizing conversation...", { parseMode: "plain" });
-      try {
-        const { summarizeSession: summarizeSession2 } = await Promise.resolve().then(() => (init_summarize(), summarize_exports));
-        await summarizeSession2(chatId, false);
-      } catch (e) {
-        await channel.sendText(chatId, `Summarization failed: ${e}`, { parseMode: "plain" });
-        break;
-      }
-      await channel.sendText(chatId, "Step 2/3: Analyzing for insights...", { parseMode: "plain" });
-      try {
-        const { runAnalysis: runAnalysis2 } = await Promise.resolve().then(() => (init_analyze(), analyze_exports));
-        const insights = await runAnalysis2(chatId, { force: true });
-        if (insights.length === 0) {
-          await channel.sendText(chatId, "Step 3/3: No actionable improvements found in this session.", { parseMode: "plain" });
-        } else {
-          await channel.sendText(chatId, `Step 3/3: Found ${insights.length} proposal(s). Let's review them one by one.`, { parseMode: "plain" });
-          const { getPendingInsights: getPendingInsights2, createReviewSession: createReviewSession2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
-          const pending = getPendingInsights2(getDb(), chatId);
-          const insightIds = pending.slice(0, 5).map((p) => p.id);
-          createReviewSession2(getDb(), chatId, insightIds);
-          await sendCurrentProposal(chatId, channel);
-        }
-      } catch (e) {
-        await channel.sendText(chatId, `Analysis failed: ${e}. You can review any pending proposals with /evolve.`, { parseMode: "plain" });
-      }
-      break;
-    }
     default:
       await channel.sendText(chatId, `Unknown command: /${command}. Type /help for available commands.`, { parseMode: "plain" });
   }
@@ -14236,6 +14839,10 @@ async function handleVoice(msg, channel) {
   const { chatId, fileName } = msg;
   await channel.sendText(chatId, "Transcribing voice message...", { parseMode: "plain" });
   try {
+    if (!fileName) {
+      await channel.sendText(chatId, "Could not process voice message \u2014 file not available.", { parseMode: "plain" });
+      return;
+    }
     const audioBuffer = await channel.downloadFile(fileName);
     const transcript = await transcribeAudio(audioBuffer);
     if (!transcript) {
@@ -14326,6 +14933,10 @@ Acknowledge receipt. Do NOT analyze the video unless they ask you to.`;
       await sendResponse(chatId, channel, vidResponse, msg.messageId);
       return;
     }
+    if (!fileName) {
+      await channel.sendText(chatId, "Could not process file \u2014 file not available.", { parseMode: "plain" });
+      return;
+    }
     const fileBuffer = await channel.downloadFile(fileName);
     const originalName = fileName ?? "file";
     const ext = originalName.split(".").pop()?.toLowerCase() ?? "";
@@ -14342,8 +14953,18 @@ Please read the image file and respond to their caption/question.` : `The user s
 
 Please read the image file and describe what you see.`;
     } else if (isTextExt(ext)) {
-      const content = fileBuffer.toString("utf-8");
-      prompt = caption ? `Here's a file "${originalName}":
+      const MAX_TEXT_FILE_BYTES = 1048576;
+      if (fileBuffer.length > MAX_TEXT_FILE_BYTES) {
+        await channel.sendText(chatId, `\u26A0\uFE0F Text file too large for inline processing (${(fileBuffer.length / 1024 / 1024).toFixed(1)}MB, max 1MB). Saving to disk instead.`, { parseMode: "plain" });
+        tempFilePath = await saveMedia(fileBuffer, "file", ext || "txt");
+        prompt = caption ? `The user sent a large text file "${originalName}" (${fileBuffer.length} bytes), saved at: ${tempFilePath}
+
+${caption}` : `The user sent a large text file "${originalName}" (${fileBuffer.length} bytes), saved at: ${tempFilePath}
+
+Please read and analyze the file.`;
+      } else {
+        const content = fileBuffer.toString("utf-8");
+        prompt = caption ? `Here's a file "${originalName}":
 
 \`\`\`
 ${content}
@@ -14354,6 +14975,7 @@ ${caption}` : `Here's a file "${originalName}". Please analyze its contents:
 \`\`\`
 ${content}
 \`\`\``;
+      }
     } else {
       prompt = `I've shared a file "${originalName}" (${fileBuffer.length} bytes). ${caption || "What can you tell me about it?"}`;
     }
@@ -14440,6 +15062,64 @@ async function handleText(msg, channel) {
   if (hasSqPrefix) {
     text = sqCleanText;
   }
+  {
+    const { getDiscussionMode: getDiscussionMode2, clearDiscussionMode: clearDiscussionMode2, setDiscussionMode: reenterDiscussion, getInsightById: getInsightById2, updateInsightProposal: updateInsightProposal2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
+    const discussInsightId = getDiscussionMode2(chatId);
+    if (discussInsightId !== null) {
+      const insight = getInsightById2(getDb(), discussInsightId);
+      if (!insight) {
+        clearDiscussionMode2(chatId);
+        await channel.sendText(chatId, "Proposal not found \u2014 discussion cancelled.", { parseMode: "plain" });
+        return;
+      }
+      await channel.sendTyping?.(chatId);
+      const discussPrompt = [
+        `The user is discussing an evolve proposal. Here is the proposal context:`,
+        ``,
+        `Insight: "${insight.insight}"`,
+        `Target file: ${insight.targetFile ?? "none"}`,
+        `Category: ${insight.category}`,
+        `Proposed diff: ${insight.proposedDiff ?? "none"}`,
+        `Proposed action: ${insight.proposedAction ?? "none"}`,
+        ``,
+        `The user says: "${text}"`,
+        ``,
+        `Respond to their request. If they ask to retarget, output "RETARGET: <new_path>" on a line by itself.`,
+        `If they ask to revise the diff, output the full revised diff prefixed with "REVISED_DIFF:" on a line by itself, followed by the diff lines.`,
+        `Otherwise, answer their question concisely.`
+      ].join("\n");
+      try {
+        const discussResp = await askAgent(chatId, discussPrompt, { bootstrapTier: "chat", maxTurns: 1, timeoutMs: 6e4 });
+        const respText = discussResp.text?.trim() ?? "";
+        clearDiscussionMode2(chatId);
+        const retargetMatch = respText.match(/^RETARGET:\s*(.+)$/m);
+        const diffMatch = respText.match(/^REVISED_DIFF:\s*\n([\s\S]+)$/m);
+        if (retargetMatch) {
+          const newPath = retargetMatch[1].trim();
+          updateInsightProposal2(getDb(), discussInsightId, newPath, insight.proposedDiff, insight.proposedAction);
+          await channel.sendText(chatId, `\u2705 Retargeted to: ${newPath}`);
+        } else if (diffMatch) {
+          const newDiff = diffMatch[1].trim();
+          updateInsightProposal2(getDb(), discussInsightId, insight.targetFile ?? "", newDiff, insight.proposedAction);
+          await channel.sendText(chatId, `\u2705 Diff revised.`);
+        } else {
+          await channel.sendText(chatId, respText);
+        }
+        const updatedInsight = getInsightById2(getDb(), discussInsightId);
+        if (updatedInsight && updatedInsight.status === "pending") {
+          const { formatProposalCard: formatProposalCard2, buildProposalKeyboard: buildProposalKeyboard2 } = await Promise.resolve().then(() => (init_propose(), propose_exports));
+          const card = formatProposalCard2(updatedInsight);
+          const kb = buildProposalKeyboard2(updatedInsight.id, updatedInsight.category);
+          await channel.sendKeyboard(chatId, card, kb);
+        }
+      } catch (e) {
+        await channel.sendText(chatId, `Discussion error: ${e.message}
+
+You're still in discussion mode \u2014 try again or click a button to exit.`, { parseMode: "plain" });
+      }
+      return;
+    }
+  }
   if (isChatBusy(chatId) && !bypassBusyCheck.delete(chatId)) {
     if (typeof channel.sendKeyboard === "function") {
       pendingInterrupts.set(chatId, { msg, channel });
@@ -14508,6 +15188,12 @@ async function handleText(msg, channel) {
         const toIcon = toSlot?.slotType === "oauth" ? "\u{1F468}\u{1F3FD}\u200D\u{1F4BB}" : "\u{1F511}";
         channel.sendText(cid, `\u26A0\uFE0F Quota reached on ${fromIcon} ${from} \u2014 switched to ${toIcon} ${to}. Context saved.`, { parseMode: "plain" }).catch(() => {
         });
+      },
+      onModelDowngrade: (cid, fromModel, toModel, reason) => {
+        const shortFrom = formatModelShort(fromModel);
+        const shortTo = formatModelShort(toModel);
+        channel.sendText(cid, `\u26A0\uFE0F ${shortFrom} unresponsive \u2014 downgrading to ${shortTo}. (${reason})`, { parseMode: "plain" }).catch(() => {
+        });
       }
     });
     const elapsedSec = ((Date.now() - sigT0) / 1e3).toFixed(1);
@@ -15903,6 +16589,10 @@ Result: ${task.result.slice(0, 500)}` : ""
     const parts = data.split(":");
     const action = parts[1];
     const idStr = parts[2];
+    if (action !== "discuss") {
+      const { clearDiscussionMode: clearStale } = await Promise.resolve().then(() => (init_store4(), store_exports4));
+      clearStale(chatId);
+    }
     switch (action) {
       case "menu": {
         const { getReflectionStatus: getRefStatus, getUnprocessedSignalCount: getUnprocessedSignalCount2, getPendingInsightCount: getPendingInsightCount2, getLastAnalysisTime: getLastAnalysisTime2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
@@ -15980,6 +16670,65 @@ Result: ${task.result.slice(0, 500)}` : ""
         }
         break;
       }
+      case "preview": {
+        const { getInsightById: pvIns } = await Promise.resolve().then(() => (init_store4(), store_exports4));
+        const pvInsight = pvIns(getDb(), parseInt(idStr, 10));
+        if (!pvInsight) {
+          await channel.sendText(chatId, "Proposal not found.", { parseMode: "plain" });
+          break;
+        }
+        if (!pvInsight.targetFile || !pvInsight.proposedDiff) {
+          await channel.sendText(chatId, "No diff available for this proposal.", { parseMode: "plain" });
+          break;
+        }
+        const { readFileSync: pvRead, existsSync: pvExists } = await import("fs");
+        const { join: pvJoin } = await import("path");
+        const pvTargetPath = pvJoin(homedir6(), ".cc-claw", pvInsight.targetFile);
+        let previewLines;
+        if (pvExists(pvTargetPath)) {
+          const currentContent = pvRead(pvTargetPath, "utf-8");
+          const diffLines = pvInsight.proposedDiff.split("\n");
+          const additions = diffLines.filter((l) => l.startsWith("+")).map((l) => l.slice(1).trim());
+          const removals = diffLines.filter((l) => l.startsWith("-")).map((l) => l.slice(1).trim());
+          previewLines = [
+            `\u{1F4CB} Dry-run preview: ${pvInsight.targetFile}`,
+            `${"\u2500".repeat(40)}`,
+            ""
+          ];
+          if (removals.length > 0) {
+            previewLines.push("Lines to REMOVE:");
+            for (const r of removals) {
+              previewLines.push(`  - ${r}`);
+              const idx = currentContent.indexOf(r);
+              if (idx >= 0) {
+                const lineNum = currentContent.slice(0, idx).split("\n").length;
+                previewLines.push(`    (line ~${lineNum})`);
+              }
+            }
+            previewLines.push("");
+          }
+          if (additions.length > 0) {
+            previewLines.push("Lines to ADD:");
+            for (const a of additions) {
+              previewLines.push(`  + ${a}`);
+            }
+            previewLines.push("");
+          }
+          previewLines.push(`File size: ${currentContent.length} chars`);
+        } else {
+          previewLines = [
+            `\u{1F4CB} Dry-run preview: ${pvInsight.targetFile}`,
+            `${"\u2500".repeat(40)}`,
+            "",
+            "(File does not exist yet \u2014 will be created)",
+            "",
+            "Content to add:",
+            pvInsight.proposedDiff
+          ];
+        }
+        await channel.sendText(chatId, previewLines.join("\n"), { parseMode: "plain" });
+        break;
+      }
       case "diff": {
         const { getInsightById: getInsightById2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
         const { formatDiffCodeBlock: formatDiffCodeBlock2 } = await Promise.resolve().then(() => (init_propose(), propose_exports));
@@ -16008,166 +16757,15 @@ Result: ${task.result.slice(0, 500)}` : ""
       }
       case "discuss": {
         const insId = parseInt(idStr, 10);
-        await channel.sendKeyboard(chatId, [
-          "What would you like to do with this proposal?",
+        const { setDiscussionMode: setDiscussionMode2 } = await Promise.resolve().then(() => (init_store4(), store_exports4));
+        setDiscussionMode2(chatId, insId);
+        await channel.sendText(chatId, [
+          "\u{1F4AC} Discussion mode \u2014 tell me what you'd like to change about this proposal.",
           "",
-          "Why this file? \u2014 ask the AI to explain its reasoning",
-          "Retarget \u2014 move this change to a different file (e.g., a skill instead of SOUL.md)",
-          "Revise \u2014 ask the AI to rewrite the proposed change"
-        ].join("\n"), [
-          [
-            { label: "Why this file?", data: `evolve:discuss-why:${insId}`, style: "primary" },
-            { label: "Retarget", data: `evolve:discuss-retarget:${insId}` }
-          ],
-          [
-            { label: "Revise the change", data: `evolve:discuss-revise:${insId}` },
-            { label: "Back", data: `evolve:discuss-back:${insId}` }
-          ]
-        ]);
-        break;
-      }
-      case "discuss-why": {
-        const { getInsightById: gwIns } = await Promise.resolve().then(() => (init_store4(), store_exports4));
-        const { getDb: gwDb } = await Promise.resolve().then(() => (init_store5(), store_exports5));
-        const gwInsight = gwIns(gwDb(), parseInt(idStr, 10));
-        if (!gwInsight) {
-          await channel.sendText(chatId, "Proposal not found.", { parseMode: "plain" });
-          break;
-        }
-        await channel.sendTyping?.(chatId);
-        const whyPrompt = [
-          `Explain in 2-3 sentences why you chose "${gwInsight.targetFile}" as the target file for this insight:`,
-          `"${gwInsight.insight}"`,
-          `Consider what other files could work (skills, context files, USER.md) and explain your reasoning.`
-        ].join("\n");
-        try {
-          const whyResp = await askAgent(chatId, whyPrompt, { bootstrapTier: "chat", maxTurns: 1, timeoutMs: 6e4 });
-          await channel.sendText(chatId, whyResp.text ?? "No response.");
-        } catch (e) {
-          await channel.sendText(chatId, `Error: ${e.message}`, { parseMode: "plain" });
-        }
-        await channel.sendKeyboard(chatId, "What next?", [
-          [
-            { label: "OK, Apply", data: `evolve:apply:${idStr}`, style: "success" },
-            { label: "Retarget instead", data: `evolve:discuss-retarget:${idStr}` }
-          ],
-          [
-            { label: "Reject", data: `evolve:reject:${idStr}`, style: "danger" },
-            { label: "Back", data: `evolve:discuss-back:${idStr}` }
-          ]
-        ]);
-        break;
-      }
-      case "discuss-retarget": {
-        const { getInsightById: rtIns } = await Promise.resolve().then(() => (init_store4(), store_exports4));
-        const { getDb: rtDb } = await Promise.resolve().then(() => (init_store5(), store_exports5));
-        const rtInsight = rtIns(rtDb(), parseInt(idStr, 10));
-        if (!rtInsight) {
-          await channel.sendText(chatId, "Proposal not found.", { parseMode: "plain" });
-          break;
-        }
-        const currentTarget = rtInsight.targetFile ?? "unknown";
-        const targets = [
-          { label: "SOUL.md", path: "identity/SOUL.md" },
-          { label: "USER.md", path: "identity/USER.md" }
-        ];
-        const skillDirs = [
-          join18(homedir6(), ".cc-claw", "workspace", "skills")
-        ];
-        try {
-          const { readdirSync: readdirSync9, statSync: statSync10 } = await import("fs");
-          for (const dir of skillDirs) {
-            if (!existsSync18(dir)) continue;
-            for (const entry of readdirSync9(dir)) {
-              if (statSync10(join18(dir, entry)).isDirectory()) {
-                targets.push({ label: `skills/${entry}`, path: `workspace/skills/${entry}/SKILL.md` });
-              }
-            }
-          }
-        } catch {
-        }
-        const rows = targets.filter((t) => t.path !== currentTarget).map((t) => [{ label: t.label, data: `evolve:discuss-retarget-to:${idStr}:${t.path}` }]);
-        rows.push([{ label: "Cancel", data: `evolve:discuss-back:${idStr}` }]);
-        await channel.sendKeyboard(chatId, `Current target: ${currentTarget}
-
-Pick a different file for this change. Identity files (SOUL/USER) shape personality; skills teach specific workflows.`, rows);
-        break;
-      }
-      case "discuss-retarget-to": {
-        const retargetParts = data.split(":");
-        const rtId = parseInt(retargetParts[2], 10);
-        const newPath = retargetParts.slice(3).join(":");
-        const { getInsightById: rt2Ins, updateInsightProposal: rt2Update } = await Promise.resolve().then(() => (init_store4(), store_exports4));
-        const { formatProposalCard: rt2Card, buildProposalKeyboard: rt2Kb } = await Promise.resolve().then(() => (init_propose(), propose_exports));
-        const { getDb: rt2Db } = await Promise.resolve().then(() => (init_store5(), store_exports5));
-        const rt2Insight = rt2Ins(rt2Db(), rtId);
-        if (!rt2Insight) {
-          await channel.sendText(chatId, "Proposal not found.", { parseMode: "plain" });
-          break;
-        }
-        rt2Update(rt2Db(), rtId, newPath, rt2Insight.proposedDiff, rt2Insight.proposedAction);
-        const updatedIns = rt2Ins(rt2Db(), rtId);
-        if (updatedIns) {
-          const card = rt2Card(updatedIns);
-          const kb = rt2Kb(updatedIns.id, updatedIns.category);
-          await channel.sendKeyboard(chatId, `Retargeted to ${newPath}. Updated proposal:
-
-` + card, kb);
-        }
-        break;
-      }
-      case "discuss-revise": {
-        const { getInsightById: rvIns } = await Promise.resolve().then(() => (init_store4(), store_exports4));
-        const { getDb: rvDb } = await Promise.resolve().then(() => (init_store5(), store_exports5));
-        const rvInsight = rvIns(rvDb(), parseInt(idStr, 10));
-        if (!rvInsight) {
-          await channel.sendText(chatId, "Proposal not found.", { parseMode: "plain" });
-          break;
-        }
-        await channel.sendTyping?.(chatId);
-        const revisePrompt = [
-          `Revise this proposed change to be more specific and actionable:`,
-          `Current insight: "${rvInsight.insight}"`,
-          `Current diff: ${rvInsight.proposedDiff ?? "none"}`,
-          `Target: ${rvInsight.targetFile}`,
-          ``,
-          `Output ONLY the revised diff lines (starting with + for additions, - for removals). No explanation.`
-        ].join("\n");
-        try {
-          const rvResp = await askAgent(chatId, revisePrompt, { bootstrapTier: "chat", maxTurns: 1, timeoutMs: 6e4 });
-          const newDiff = rvResp.text?.trim() ?? rvInsight.proposedDiff;
-          if (newDiff) {
-            const { updateInsightProposal: rvUpdate } = await Promise.resolve().then(() => (init_store4(), store_exports4));
-            rvUpdate(rvDb(), parseInt(idStr, 10), rvInsight.targetFile ?? "", newDiff, rvInsight.proposedAction);
-          }
-          const updatedRv = rvIns(rvDb(), parseInt(idStr, 10));
-          if (updatedRv) {
-            const { formatProposalCard: rvCard, buildProposalKeyboard: rvKb } = await Promise.resolve().then(() => (init_propose(), propose_exports));
-            const card = rvCard(updatedRv);
-            const kb = rvKb(updatedRv.id, updatedRv.category);
-            await channel.sendKeyboard(chatId, "Revised proposal:\n\n" + card, kb);
-          }
-        } catch (e) {
-          await channel.sendText(chatId, `Revision error: ${e.message}`, { parseMode: "plain" });
-        }
-        break;
-      }
-      case "discuss-back": {
-        const { getInsightById: bkIns, getReviewSession: bkSession } = await Promise.resolve().then(() => (init_store4(), store_exports4));
-        const { formatProposalCardWithProgress: formatProposalCardWithProgress2, formatProposalCard: bkCardFn, buildProposalKeyboard: bkKb } = await Promise.resolve().then(() => (init_propose(), propose_exports));
-        const { getDb: bkDb } = await Promise.resolve().then(() => (init_store5(), store_exports5));
-        const bkInsight = bkIns(bkDb(), parseInt(idStr, 10));
-        if (bkInsight && bkInsight.status === "pending") {
-          const session2 = bkSession(bkDb(), chatId);
-          const kb = bkKb(bkInsight.id, bkInsight.category);
-          if (session2) {
-            const card = formatProposalCardWithProgress2(bkInsight, session2.currentIndex, session2.insightIds.length);
-            await channel.sendKeyboard(chatId, card, kb);
-          } else {
-            const card = bkCardFn(bkInsight);
-            await channel.sendKeyboard(chatId, card, kb);
-          }
-        }
+          'Examples: "Move this to a skill instead", "Rewrite the diff", "Why this file?", "Make it shorter"',
+          "",
+          "Type your reply and I'll handle it:"
+        ].join("\n"), { parseMode: "plain" });
         break;
       }
       case "reject": {
@@ -16231,13 +16829,13 @@ Pick a different file for this change. Identity files (SOUL/USER) shape personal
         const { getDb: getDb2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
         const current = getReflectionStatus2(getDb2(), chatId);
         if (current === "frozen") {
-          const { readFileSync: readFileSync21, existsSync: existsSync47 } = await import("fs");
+          const { readFileSync: readFileSync21, existsSync: existsSync46 } = await import("fs");
           const { join: join28 } = await import("path");
           const { CC_CLAW_HOME: CC_CLAW_HOME3 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
           const soulPath = join28(CC_CLAW_HOME3, "identity/SOUL.md");
           const userPath = join28(CC_CLAW_HOME3, "identity/USER.md");
-          const soul = existsSync47(soulPath) ? readFileSync21(soulPath, "utf-8") : "";
-          const user = existsSync47(userPath) ? readFileSync21(userPath, "utf-8") : "";
+          const soul = existsSync46(soulPath) ? readFileSync21(soulPath, "utf-8") : "";
+          const user = existsSync46(userPath) ? readFileSync21(userPath, "utf-8") : "";
           setReflectionStatus2(getDb2(), chatId, "active", soul, user);
           const { logActivity: logActivity2 } = await Promise.resolve().then(() => (init_store3(), store_exports3));
           logActivity2(getDb2(), { chatId, source: "telegram", eventType: "reflection_unfrozen", summary: "Reflection enabled" });
@@ -16831,7 +17429,7 @@ Use /skills <page> to navigate (e.g. /skills 2)` : "";
   const header2 = totalPages > 1 ? `${skills2.length} skills (page ${safePage}/${totalPages}). Select one to invoke:` : `${skills2.length} skills available. Select one to invoke:`;
   await channel.sendKeyboard(chatId, header2, buttons);
 }
-var PERM_MODES, VERBOSE_LEVELS, HELP_CATEGORIES, USAGE_WINDOW_MAP, MEDIA_INCOMING_PATH, TONE_PATTERNS, pendingInterrupts, bypassBusyCheck, activeSideQuests, MAX_SIDE_QUESTS, pendingFallbackMessages, dashboardClawWarnings, lastReflectTime, REFLECT_COOLDOWN_MS, pendingSummaryUndo, pendingNewchatUndo, CLI_INSTALL_HINTS, BLOCKED_PATH_PATTERNS2, ALLOWED_REACTION_EMOJIS, SKILLS_PER_PAGE;
+var PERM_MODES, VERBOSE_LEVELS, HELP_CATEGORIES, USAGE_WINDOW_MAP, MEDIA_INCOMING_PATH, TONE_PATTERNS, pendingInterrupts, bypassBusyCheck, activeSideQuests, MAX_SIDE_QUESTS, pendingFallbackMessages, dashboardClawWarnings, pendingSummaryUndo, pendingNewchatUndo, CLI_INSTALL_HINTS, BLOCKED_PATH_PATTERNS2, ALLOWED_REACTION_EMOJIS, SKILLS_PER_PAGE;
 var init_router = __esm({
   "src/router.ts"() {
     "use strict";
@@ -16974,8 +17572,6 @@ var init_router = __esm({
     MAX_SIDE_QUESTS = 2;
     pendingFallbackMessages = /* @__PURE__ */ new Map();
     dashboardClawWarnings = /* @__PURE__ */ new Map();
-    lastReflectTime = /* @__PURE__ */ new Map();
-    REFLECT_COOLDOWN_MS = 12e4;
     pendingSummaryUndo = /* @__PURE__ */ new Map();
     pendingNewchatUndo = /* @__PURE__ */ new Map();
     CLI_INSTALL_HINTS = {
@@ -17101,7 +17697,8 @@ function initScheduler(channelReg) {
     if (orphaned.changes > 0) {
       log(`[scheduler] Cleaned up ${orphaned.changes} orphaned run(s)`);
     }
-  } catch {
+  } catch (err) {
+    log(`[scheduler] Orphaned run cleanup skipped: ${err}`);
   }
   try {
     const jobs = getActiveJobs();
@@ -17254,7 +17851,6 @@ async function executeJob(job) {
     const contentStatus = isEmpty ? "no_content" : "success";
     const durationMs = Date.now() - t0;
     updateJobLastRun(job.id, (/* @__PURE__ */ new Date()).toISOString());
-    resetJobFailures(job.id);
     if (response.usage) {
       addUsage(job.chatId, response.usage.input, response.usage.output, response.usage.cacheRead, resolvedModel, void 0, response.usage.contextSize);
     }
@@ -17266,6 +17862,16 @@ async function executeJob(job) {
       cacheRead: response.usage?.cacheRead,
       durationMs
     });
+    if (finalStatus === "delivery_failed") {
+      const failures = incrementJobFailures(job.id);
+      error(`[scheduler] Job #${job.id} delivery failed (failures=${failures})`);
+      if (failures >= AUTO_PAUSE_THRESHOLD) {
+        pauseJob(job.id);
+        await notifyJobAutoPaused({ ...job, consecutiveFailures: failures });
+      }
+    } else if (finalStatus === "success") {
+      resetJobFailures(job.id);
+    }
   } catch (err) {
     const durationMs = Date.now() - t0;
     const errorClass = classifyError(err);
@@ -17558,18 +18164,18 @@ var init_wrap_backend = __esm({
 });
 
 // src/agents/runners/config-loader.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync8, existsSync as existsSync19, mkdirSync as mkdirSync8, watchFile, unwatchFile } from "fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync8, existsSync as existsSync18, mkdirSync as mkdirSync8, watchFile, unwatchFile } from "fs";
 import { join as join20 } from "path";
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 function resolveExecutable(config2) {
-  if (existsSync19(config2.executable)) return config2.executable;
+  if (existsSync18(config2.executable)) return config2.executable;
   try {
-    return execFileSync("which", [config2.executable], { encoding: "utf-8" }).trim();
+    return execFileSync2("which", [config2.executable], { encoding: "utf-8" }).trim();
   } catch {
   }
   for (const fallback of config2.executableFallbacks ?? []) {
     const resolved = fallback.replace(/^~/, process.env.HOME ?? "");
-    if (existsSync19(resolved)) return resolved;
+    if (existsSync18(resolved)) return resolved;
   }
   return config2.executable;
 }
@@ -17708,7 +18314,7 @@ function loadRunnerConfig(filePath) {
   }
 }
 function loadAllRunnerConfigs() {
-  if (!existsSync19(RUNNERS_PATH)) {
+  if (!existsSync18(RUNNERS_PATH)) {
     mkdirSync8(RUNNERS_PATH, { recursive: true });
     return [];
   }
@@ -17736,9 +18342,9 @@ function registerConfigRunners() {
   return count;
 }
 function watchRunnerConfigs(onChange) {
-  if (!existsSync19(RUNNERS_PATH)) return;
+  if (!existsSync18(RUNNERS_PATH)) return;
   for (const prev of watchedFiles) {
-    if (!existsSync19(prev)) {
+    if (!existsSync18(prev)) {
       unwatchFile(prev);
       watchedFiles.delete(prev);
     }
@@ -17795,11 +18401,12 @@ var init_runners = __esm({
 function checkIdleAgents(agents2, now, thresholdMs = IDLE_THRESHOLD_MS) {
   return agents2.filter((agent) => {
     if (agent.status !== "running" || !agent.lastOutputAt) return false;
-    const lastOutput = new Date(agent.lastOutputAt).getTime();
+    const ts2 = agent.lastOutputAt;
+    const lastOutput = (/* @__PURE__ */ new Date(ts2 + (ts2.includes("Z") ? "" : "Z"))).getTime();
     return now - lastOutput > thresholdMs;
   });
 }
-function startMonitor(callbacks, intervalMs = 15e3) {
+function startMonitor(callbacks, intervalMs = MONITOR_INTERVAL_MS) {
   if (monitorInterval) return;
   monitorInterval = setInterval(() => {
     try {
@@ -17821,7 +18428,7 @@ function stopMonitor() {
     monitorInterval = null;
   }
 }
-var monitorInterval;
+var monitorInterval, MONITOR_INTERVAL_MS;
 var init_monitor = __esm({
   "src/agents/monitor.ts"() {
     "use strict";
@@ -17830,6 +18437,7 @@ var init_monitor = __esm({
     init_types();
     init_log();
     monitorInterval = null;
+    MONITOR_INTERVAL_MS = parseInt(process.env.CC_CLAW_MONITOR_INTERVAL_MS ?? "30000", 10);
   }
 });
 
@@ -17952,6 +18560,18 @@ var init_telegram = __esm({
 
 // src/channels/telegram.ts
 import { Bot, InlineKeyboard, InputFile } from "grammy";
+function isFastPathMessage(msg) {
+  if (msg.type === "command" && msg.command && FAST_PATH_COMMANDS.has(msg.command)) {
+    return true;
+  }
+  if (msg.type === "text" && msg.text) {
+    const trimmed = msg.text.trim();
+    if (trimmed.startsWith("!!") || trimmed.startsWith("!") && trimmed.length > 1) {
+      return true;
+    }
+  }
+  return false;
+}
 function numericChatId(chatId) {
   if (chatId.startsWith("sq:") || chatId.startsWith("cron:")) {
     throw new Error(`Synthetic chatId "${chatId}" passed to Telegram API`);
@@ -17959,13 +18579,14 @@ function numericChatId(chatId) {
   const raw = chatId.includes(":") ? chatId.split(":").pop() : chatId;
   return parseInt(raw);
 }
-var TelegramChannel;
+var FAST_PATH_COMMANDS, TelegramChannel;
 var init_telegram2 = __esm({
   "src/channels/telegram.ts"() {
     "use strict";
     init_telegram();
     init_log();
     init_store5();
+    FAST_PATH_COMMANDS = /* @__PURE__ */ new Set(["stop", "status", "new", "newchat"]);
     TelegramChannel = class {
       name = "telegram";
       bot;
@@ -18077,41 +18698,48 @@ var init_telegram2 = __esm({
           { command: "evolve", description: "Self-learning & evolution controls" },
           { command: "reflect", description: "Trigger reflection analysis" }
         ]);
-        this.bot.on("message", (ctx) => {
+        this.bot.on("message", async (ctx) => {
           const chatId = ctx.chat.id.toString();
           const senderId = ctx.from?.id?.toString() ?? "";
           const authorized = this.isAuthorized(chatId) || this.isAuthorized(senderId);
           log(`[telegram] Message from chat ${chatId} sender ${senderId} (authorized: ${authorized})`);
           if (!authorized) return;
           const msg = this.buildIncomingMessage(ctx);
-          if (msg) {
-            log(`[telegram] Processing ${msg.type}: "${msg.text?.slice(0, 50) || msg.command || "(media)"}"`);
-            handler(msg, this).catch((err) => {
-              error("[telegram] Handler error:", err);
-            });
-          } else {
+          if (!msg) {
             this.sendText(chatId, "I can handle text, voice, photos, documents, and videos. This message type isn't supported yet.", { parseMode: "plain" }).catch(() => {
             });
+            return;
+          }
+          log(`[telegram] Processing ${msg.type}: "${msg.text?.slice(0, 50) || msg.command || "(media)"}"`);
+          if (isFastPathMessage(msg)) {
+            handler(msg, this).catch((err) => {
+              error("[telegram] Fast-path handler error:", err);
+            });
+            return;
           }
+          handler(msg, this).catch((err) => {
+            error("[telegram] Handler error:", err);
+          });
         });
-        this.bot.on("callback_query:data", async (ctx) => {
+        this.bot.on("callback_query:data", (ctx) => {
           const userId = ctx.from.id.toString();
           const chatId = ctx.callbackQuery.message?.chat?.id?.toString() ?? userId;
           log(`[telegram] Callback from user ${userId} in chat ${chatId}: ${ctx.callbackQuery.data}`);
           if (!this.isAuthorized(userId) && !this.isAuthorized(chatId)) {
-            await ctx.answerCallbackQuery("Unauthorized");
+            ctx.answerCallbackQuery("Unauthorized").catch(() => {
+            });
             return;
           }
           const data = ctx.callbackQuery.data;
-          await ctx.answerCallbackQuery().catch(() => {
+          ctx.answerCallbackQuery().catch(() => {
           });
-          try {
+          (async () => {
             for (const handler2 of this.callbackHandlers) {
               await handler2(chatId, data, this);
             }
-          } catch (err) {
+          })().catch((err) => {
             error("[telegram] Callback handler error:", err);
-          }
+          });
         });
         this.bot.on("message_reaction", async (ctx) => {
           const chatId = String(ctx.chat.id);
@@ -18444,19 +19072,19 @@ var init_telegram2 = __esm({
 });
 
 // src/skills/bootstrap.ts
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync19 } from "fs";
 import { readdir as readdir4, readFile as readFile6, writeFile as writeFile4, copyFile } from "fs/promises";
 import { join as join21, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 async function copyAgentManifestSkills() {
-  if (!existsSync20(PKG_SKILLS)) return;
+  if (!existsSync19(PKG_SKILLS)) return;
   try {
     const entries = await readdir4(PKG_SKILLS, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.startsWith("agent-") || !entry.name.endsWith(".md")) continue;
       const src = join21(PKG_SKILLS, entry.name);
       const dest = join21(SKILLS_PATH, entry.name);
-      if (existsSync20(dest)) continue;
+      if (existsSync19(dest)) continue;
       await copyFile(src, dest);
       log(`[skills] Bootstrapped ${entry.name} to ${SKILLS_PATH}`);
     }
@@ -18467,7 +19095,7 @@ async function copyAgentManifestSkills() {
 async function bootstrapSkills() {
   await copyAgentManifestSkills();
   const usmDir = join21(SKILLS_PATH, USM_DIR_NAME);
-  if (existsSync20(usmDir)) return;
+  if (existsSync19(usmDir)) return;
   try {
     const entries = await readdir4(SKILLS_PATH);
     const dirs = entries.filter((e) => !e.startsWith("."));
@@ -18490,7 +19118,7 @@ async function bootstrapSkills() {
 }
 async function patchUsmForCcClaw(usmDir) {
   const skillPath = join21(usmDir, "SKILL.md");
-  if (!existsSync20(skillPath)) return;
+  if (!existsSync19(skillPath)) return;
   try {
     let content = await readFile6(skillPath, "utf-8");
     let patched = false;
@@ -18750,13 +19378,13 @@ __export(ai_skill_exports, {
   generateAiSkill: () => generateAiSkill,
   installAiSkill: () => installAiSkill
 });
-import { existsSync as existsSync21, writeFileSync as writeFileSync7, mkdirSync as mkdirSync9 } from "fs";
+import { existsSync as existsSync20, writeFileSync as writeFileSync7, mkdirSync as mkdirSync9 } from "fs";
 import { join as join22 } from "path";
 import { homedir as homedir7 } from "os";
 function generateAiSkill() {
   const version = VERSION;
   let systemState = "";
-  if (existsSync21(DB_PATH)) {
+  if (existsSync20(DB_PATH)) {
     try {
       const { openDatabaseReadOnly: openDatabaseReadOnly2 } = (init_store5(), __toCommonJS(store_exports5));
       const readDb = openDatabaseReadOnly2();
@@ -18805,6 +19433,14 @@ Use the CC-Claw CLI when you need to:
 - Every command supports \`--json\` for machine-parseable output
 - Use \`--chat <id>\` to target a specific chat context
 
+## CRITICAL: CC-Claw Is Your API Layer
+
+- **NEVER** use native CLI memory/storage tools (Gemini's \`save_memory\`, Claude's memory, etc.) \u2014 they save to backend-local storage, invisible to other backends
+- **NEVER** modify the SQLite database directly (no INSERT/UPDATE/DELETE SQL)
+- **ALWAYS** use CC-Claw slash commands (\`/remember\`, \`/evolve\`, etc.) or the \`cc-claw\` CLI for state changes
+- Memory MUST be cross-backend persistent \u2014 only CC-Claw's own commands guarantee this
+- If you don't know the right command, ask the user or run \`cc-claw --ai\`
+
 ## Telegram Quick Reference
 
 **Navigation & help:**
@@ -18861,8 +19497,7 @@ Use the CC-Claw CLI when you need to:
 - \`/imagine <prompt>\` (\`/image\`) \u2014 Generate image (requires GEMINI_API_KEY)
 - \`/skills\` \u2014 List skills
 - \`/skill-install <url>\` \u2014 Install skill from GitHub
-- \`/evolve\` \u2014 Self-learning interactive keyboard
-- \`/reflect\` \u2014 Trigger reflection analysis
+- \`/evolve\` \u2014 Self-learning interactive keyboard (includes quick analyze)
 - \`/gemini_accounts\` \u2014 Gemini credential rotation management
 - \`/setup-profile\` \u2014 User profile setup wizard
 
@@ -18905,8 +19540,9 @@ cc-claw memory list --json               # All memories with salience
 cc-claw memory search "topic" --json     # Search memories
 cc-claw memory history --json            # Session summaries
 cc-claw memory history --limit 20 --json # Limit results
-cc-claw memory add "key" "value"         # Save a memory (needs daemon)
-cc-claw memory forget "keyword"          # Delete memories (needs daemon)
+# NOTE: To add/delete memories, use Telegram commands:
+#   /remember <text> \u2014 Save a memory
+#   /forget <keyword> \u2014 Delete memories
 \`\`\`
 
 ### Session
@@ -19186,7 +19822,7 @@ var index_exports = {};
 __export(index_exports, {
   main: () => main
 });
-import { mkdirSync as mkdirSync10, existsSync as existsSync22, renameSync, statSync as statSync5, readFileSync as readFileSync12 } from "fs";
+import { mkdirSync as mkdirSync10, existsSync as existsSync21, renameSync, statSync as statSync5, readFileSync as readFileSync12 } from "fs";
 import { join as join23 } from "path";
 import dotenv from "dotenv";
 function migrateLayout() {
@@ -19200,7 +19836,7 @@ function migrateLayout() {
     [join23(CC_CLAW_HOME, "cc-claw.error.log.1"), join23(LOGS_PATH, "cc-claw.error.log.1")]
   ];
   for (const [from, to] of moves) {
-    if (existsSync22(from) && !existsSync22(to)) {
+    if (existsSync21(from) && !existsSync21(to)) {
       try {
         renameSync(from, to);
       } catch {
@@ -19236,6 +19872,11 @@ async function main() {
   initDatabase();
   pruneMessageLog(30, 2e3);
   bootstrapBuiltinMcps(getDb());
+  try {
+    const { resetIntentStats: resetIntentStats2 } = await Promise.resolve().then(() => (init_classify(), classify_exports));
+    resetIntentStats2();
+  } catch {
+  }
   try {
     const { getAdapter: getAdapter2, probeBackendAvailability: probeBackendAvailability2 } = await Promise.resolve().then(() => (init_backends(), backends_exports));
     probeBackendAvailability2();
@@ -19409,10 +20050,10 @@ var init_index = __esm({
     init_bootstrap2();
     init_health3();
     for (const dir of [CC_CLAW_HOME, DATA_PATH, LOGS_PATH, SKILLS_PATH, RUNNERS_PATH, AGENTS_PATH]) {
-      if (!existsSync22(dir)) mkdirSync10(dir, { recursive: true });
+      if (!existsSync21(dir)) mkdirSync10(dir, { recursive: true });
     }
     migrateLayout();
-    if (existsSync22(ENV_PATH)) {
+    if (existsSync21(ENV_PATH)) {
       dotenv.config({ path: ENV_PATH });
     } else {
       console.error(`[cc-claw] Config not found at ${ENV_PATH} \u2014 run 'cc-claw setup' first`);
@@ -19433,12 +20074,12 @@ __export(api_client_exports, {
   apiPost: () => apiPost,
   isDaemonRunning: () => isDaemonRunning
 });
-import { readFileSync as readFileSync13, existsSync as existsSync23 } from "fs";
+import { readFileSync as readFileSync13, existsSync as existsSync22 } from "fs";
 import { request as httpRequest } from "http";
 function getToken() {
   if (process.env.CC_CLAW_API_TOKEN) return process.env.CC_CLAW_API_TOKEN;
   try {
-    if (existsSync23(TOKEN_PATH)) return readFileSync13(TOKEN_PATH, "utf-8").trim();
+    if (existsSync22(TOKEN_PATH)) return readFileSync13(TOKEN_PATH, "utf-8").trim();
   } catch {
   }
   return null;
@@ -19533,15 +20174,20 @@ __export(service_exports, {
   serviceStatus: () => serviceStatus,
   uninstallService: () => uninstallService
 });
-import { existsSync as existsSync24, mkdirSync as mkdirSync11, writeFileSync as writeFileSync8, unlinkSync as unlinkSync6 } from "fs";
-import { execFileSync as execFileSync2, execSync as execSync7 } from "child_process";
+import { existsSync as existsSync23, mkdirSync as mkdirSync11, writeFileSync as writeFileSync8, unlinkSync as unlinkSync6 } from "fs";
+import { execFileSync as execFileSync3, execSync as execSync7 } from "child_process";
 import { homedir as homedir8, platform } from "os";
 import { join as join24, dirname as dirname4 } from "path";
+function xmlEscape(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
 function resolveExecutable2(name) {
   try {
-    return execFileSync2("which", [name], { encoding: "utf-8" }).trim();
+    return execFileSync3("which", [name], { encoding: "utf-8" }).trim();
   } catch {
-    return process.argv[1];
+    const fallback = process.argv[1];
+    if (fallback && existsSync23(fallback)) return fallback;
+    throw new Error(`Cannot find '${name}' executable. Install globally: npm install -g cc-claw`);
   }
 }
 function getPathDirs() {
@@ -19565,21 +20211,28 @@ function generatePlist() {
   const ccClawBin = resolveExecutable2("cc-claw");
   const pathDirs = getPathDirs();
   const home = homedir8();
+  const safeBin = xmlEscape(ccClawBin);
+  const safePaths = xmlEscape(pathDirs);
+  const safeHome = xmlEscape(home);
+  const safeLabel = xmlEscape(PLIST_LABEL);
+  const safeCCHome = xmlEscape(CC_CLAW_HOME);
+  const safeLog = xmlEscape(LOG_PATH);
+  const safeErrLog = xmlEscape(ERROR_LOG_PATH);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>${PLIST_LABEL}</string>
+    <string>${safeLabel}</string>
 
     <key>ProgramArguments</key>
     <array>
-        <string>${ccClawBin}</string>
+        <string>${safeBin}</string>
         <string>start</string>
     </array>
 
     <key>WorkingDirectory</key>
-    <string>${CC_CLAW_HOME}</string>
+    <string>${safeCCHome}</string>
 
     <key>RunAtLoad</key>
     <true/>
@@ -19588,17 +20241,17 @@ function generatePlist() {
     <true/>
 
     <key>StandardOutPath</key>
-    <string>${LOG_PATH}</string>
+    <string>${safeLog}</string>
 
     <key>StandardErrorPath</key>
-    <string>${ERROR_LOG_PATH}</string>
+    <string>${safeErrLog}</string>
 
     <key>EnvironmentVariables</key>
     <dict>
         <key>PATH</key>
-        <string>${pathDirs}</string>
+        <string>${safePaths}</string>
         <key>HOME</key>
-        <string>${home}</string>
+        <string>${safeHome}</string>
     </dict>
 
     <key>ThrottleInterval</key>
@@ -19608,26 +20261,26 @@ function generatePlist() {
 }
 function installMacOS() {
   const agentsDir = dirname4(PLIST_PATH);
-  if (!existsSync24(agentsDir)) mkdirSync11(agentsDir, { recursive: true });
-  if (!existsSync24(LOGS_PATH)) mkdirSync11(LOGS_PATH, { recursive: true });
-  if (existsSync24(PLIST_PATH)) {
+  if (!existsSync23(agentsDir)) mkdirSync11(agentsDir, { recursive: true });
+  if (!existsSync23(LOGS_PATH)) mkdirSync11(LOGS_PATH, { recursive: true });
+  if (existsSync23(PLIST_PATH)) {
     try {
-      execFileSync2("launchctl", ["unload", PLIST_PATH]);
+      execFileSync3("launchctl", ["unload", PLIST_PATH]);
     } catch {
     }
   }
   writeFileSync8(PLIST_PATH, generatePlist());
   console.log(`  Installed: ${PLIST_PATH}`);
-  execFileSync2("launchctl", ["load", PLIST_PATH]);
+  execFileSync3("launchctl", ["load", PLIST_PATH]);
   console.log("  Service loaded and starting.");
 }
 function uninstallMacOS() {
-  if (!existsSync24(PLIST_PATH)) {
+  if (!existsSync23(PLIST_PATH)) {
     console.log("  No service found to uninstall.");
     return;
   }
   try {
-    execFileSync2("launchctl", ["unload", PLIST_PATH]);
+    execFileSync3("launchctl", ["unload", PLIST_PATH]);
   } catch {
   }
   unlinkSync6(PLIST_PATH);
@@ -19643,24 +20296,25 @@ function formatUptime(seconds) {
 async function getUptimeFromDaemon() {
   try {
     const { isDaemonRunning: isDaemonRunning2, apiGet: apiGet2 } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
-    if (!await isDaemonRunning2()) return null;
+    if (!await isDaemonRunning2()) return { status: "down" };
     const res = await apiGet2("/api/health");
     const sec = res.data?.uptime;
-    return sec ? formatUptime(sec) : null;
+    return sec ? { status: "ok", uptime: formatUptime(sec) } : { status: "down" };
   } catch {
-    return null;
+    return { status: "error" };
   }
 }
 function statusMacOS() {
   try {
-    const out = execSync7("launchctl list | grep cc-claw", { shell: "/bin/sh", encoding: "utf-8" }).trim();
-    if (out) {
-      const parts = out.split(/\s+/);
+    const out = execFileSync3("launchctl", ["list"], { encoding: "utf-8" });
+    const line = out.split("\n").find((l) => l.includes("cc-claw"));
+    if (line) {
+      const parts = line.trim().split(/\s+/);
       const pid = parts[0];
       const exitCode = parts[1];
       if (pid !== "-") {
-        getUptimeFromDaemon().then((uptime) => {
-          const uptimeStr = uptime ? `, uptime ${uptime}` : "";
+        getUptimeFromDaemon().then((result) => {
+          const uptimeStr = result.status === "ok" ? `, uptime ${result.uptime}` : "";
           console.log(`  Running (PID ${pid}${uptimeStr})`);
         }).catch(() => {
           console.log(`  Running (PID ${pid})`);
@@ -19696,30 +20350,30 @@ WantedBy=default.target
 `;
 }
 function installLinux() {
-  if (!existsSync24(SYSTEMD_DIR)) mkdirSync11(SYSTEMD_DIR, { recursive: true });
-  if (!existsSync24(LOGS_PATH)) mkdirSync11(LOGS_PATH, { recursive: true });
+  if (!existsSync23(SYSTEMD_DIR)) mkdirSync11(SYSTEMD_DIR, { recursive: true });
+  if (!existsSync23(LOGS_PATH)) mkdirSync11(LOGS_PATH, { recursive: true });
   writeFileSync8(UNIT_PATH, generateUnit());
   console.log(`  Installed: ${UNIT_PATH}`);
-  execFileSync2("systemctl", ["--user", "daemon-reload"]);
-  execFileSync2("systemctl", ["--user", "enable", "cc-claw"]);
-  execFileSync2("systemctl", ["--user", "start", "cc-claw"]);
+  execFileSync3("systemctl", ["--user", "daemon-reload"]);
+  execFileSync3("systemctl", ["--user", "enable", "cc-claw"]);
+  execFileSync3("systemctl", ["--user", "start", "cc-claw"]);
   console.log("  Service enabled and started.");
 }
 function uninstallLinux() {
-  if (!existsSync24(UNIT_PATH)) {
+  if (!existsSync23(UNIT_PATH)) {
     console.log("  No service found to uninstall.");
     return;
   }
   try {
-    execFileSync2("systemctl", ["--user", "stop", "cc-claw"]);
+    execFileSync3("systemctl", ["--user", "stop", "cc-claw"]);
   } catch {
   }
   try {
-    execFileSync2("systemctl", ["--user", "disable", "cc-claw"]);
+    execFileSync3("systemctl", ["--user", "disable", "cc-claw"]);
   } catch {
   }
   unlinkSync6(UNIT_PATH);
-  execFileSync2("systemctl", ["--user", "daemon-reload"]);
+  execFileSync3("systemctl", ["--user", "daemon-reload"]);
   console.log("  Service uninstalled.");
 }
 function statusLinux() {
@@ -19731,28 +20385,28 @@ function statusLinux() {
   }
 }
 function installService() {
-  if (!existsSync24(join24(CC_CLAW_HOME, ".env"))) {
+  if (!existsSync23(join24(CC_CLAW_HOME, ".env"))) {
     console.error(`  Config not found at ${CC_CLAW_HOME}/.env`);
     console.error("  Run 'cc-claw setup' before installing the service.");
     process.exitCode = 1;
     return;
   }
-  const os = platform();
-  if (os === "darwin") installMacOS();
-  else if (os === "linux") installLinux();
-  else console.error(`  Unsupported platform: ${os}. Only macOS and Linux are supported.`);
+  const os2 = platform();
+  if (os2 === "darwin") installMacOS();
+  else if (os2 === "linux") installLinux();
+  else console.error(`  Unsupported platform: ${os2}. Only macOS and Linux are supported.`);
 }
 function uninstallService() {
-  const os = platform();
-  if (os === "darwin") uninstallMacOS();
-  else if (os === "linux") uninstallLinux();
-  else console.error(`  Unsupported platform: ${os}.`);
+  const os2 = platform();
+  if (os2 === "darwin") uninstallMacOS();
+  else if (os2 === "linux") uninstallLinux();
+  else console.error(`  Unsupported platform: ${os2}.`);
 }
 function serviceStatus() {
-  const os = platform();
-  if (os === "darwin") statusMacOS();
-  else if (os === "linux") statusLinux();
-  else console.error(`  Unsupported platform: ${os}.`);
+  const os2 = platform();
+  if (os2 === "darwin") statusMacOS();
+  else if (os2 === "linux") statusLinux();
+  else console.error(`  Unsupported platform: ${os2}.`);
 }
 var PLIST_LABEL, PLIST_PATH, SYSTEMD_DIR, UNIT_PATH;
 var init_service = __esm({
@@ -19875,20 +20529,20 @@ __export(daemon_exports, {
 import { execSync as execSync8 } from "child_process";
 import { platform as platform2 } from "os";
 async function stopService() {
-  const os = platform2();
+  const os2 = platform2();
   try {
-    if (os === "darwin") {
+    if (os2 === "darwin") {
       execSync8("launchctl stop com.cc-claw");
       console.log(`
   ${success("Daemon stopped.")}
 `);
-    } else if (os === "linux") {
+    } else if (os2 === "linux") {
       execSync8("systemctl --user stop cc-claw");
       console.log(`
   ${success("Daemon stopped.")}
 `);
     } else {
-      outputError("UNSUPPORTED_PLATFORM", `Platform ${os} not supported for service management.`);
+      outputError("UNSUPPORTED_PLATFORM", `Platform ${os2} not supported for service management.`);
       process.exit(1);
     }
   } catch (err) {
@@ -19898,21 +20552,21 @@ async function stopService() {
   }
 }
 async function restartService() {
-  const os = platform2();
+  const os2 = platform2();
   try {
-    if (os === "darwin") {
+    if (os2 === "darwin") {
       const uid = process.getuid?.() ?? execSync8("id -u", { encoding: "utf-8" }).trim();
       execSync8(`launchctl kickstart -k gui/${uid}/com.cc-claw`);
       console.log(`
   ${success("Daemon restarted.")}
 `);
-    } else if (os === "linux") {
+    } else if (os2 === "linux") {
       execSync8("systemctl --user restart cc-claw");
       console.log(`
   ${success("Daemon restarted.")}
 `);
     } else {
-      outputError("UNSUPPORTED_PLATFORM", `Platform ${os} not supported for service management.`);
+      outputError("UNSUPPORTED_PLATFORM", `Platform ${os2} not supported for service management.`);
       process.exit(1);
     }
   } catch (err) {
@@ -19959,7 +20613,7 @@ var status_exports = {};
 __export(status_exports, {
   statusCommand: () => statusCommand
 });
-import { existsSync as existsSync25, statSync as statSync6 } from "fs";
+import { existsSync as existsSync24, statSync as statSync6 } from "fs";
 async function statusCommand(globalOpts, localOpts) {
   try {
     const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
@@ -19999,7 +20653,7 @@ async function statusCommand(globalOpts, localOpts) {
     const cwdRow = readDb.prepare("SELECT cwd FROM chat_cwd WHERE chat_id = ?").get(chatId);
     const voiceRow = readDb.prepare("SELECT enabled FROM chat_voice WHERE chat_id = ?").get(chatId);
     const usageRow = readDb.prepare("SELECT * FROM chat_usage WHERE chat_id = ?").get(chatId);
-    const dbStat = existsSync25(DB_PATH) ? statSync6(DB_PATH) : null;
+    const dbStat = existsSync24(DB_PATH) ? statSync6(DB_PATH) : null;
     let daemonRunning = false;
     let daemonInfo = {};
     if (localOpts.deep) {
@@ -20090,11 +20744,11 @@ var doctor_exports = {};
 __export(doctor_exports, {
   doctorCommand: () => doctorCommand
 });
-import { existsSync as existsSync26, statSync as statSync7, accessSync, constants } from "fs";
-import { execFileSync as execFileSync3 } from "child_process";
+import { existsSync as existsSync25, statSync as statSync7, accessSync, constants } from "fs";
+import { execFileSync as execFileSync4 } from "child_process";
 async function doctorCommand(globalOpts, localOpts) {
   const checks = [];
-  if (existsSync26(DB_PATH)) {
+  if (existsSync25(DB_PATH)) {
     const size = statSync7(DB_PATH).size;
     checks.push({ name: "Database", status: "ok", message: `${DB_PATH} (${(size / 1024).toFixed(0)}KB)` });
     try {
@@ -20124,7 +20778,7 @@ async function doctorCommand(globalOpts, localOpts) {
   } else {
     checks.push({ name: "Database", status: "error", message: `Not found at ${DB_PATH}`, fix: "cc-claw setup" });
   }
-  if (existsSync26(ENV_PATH)) {
+  if (existsSync25(ENV_PATH)) {
     checks.push({ name: "Environment", status: "ok", message: `.env loaded` });
   } else {
     checks.push({ name: "Environment", status: "error", message: "No .env found", fix: "cc-claw setup" });
@@ -20133,7 +20787,7 @@ async function doctorCommand(globalOpts, localOpts) {
   let installedBackends = 0;
   for (const [label2, binary] of Object.entries(CLI_BINARIES)) {
     try {
-      const path = execFileSync3("which", [binary], { encoding: "utf-8", timeout: 5e3 }).trim();
+      const path = execFileSync4("which", [binary], { encoding: "utf-8", timeout: 5e3 }).trim();
       checks.push({ name: `${label2} CLI`, status: "ok", message: path });
       installedBackends++;
     } catch {
@@ -20172,14 +20826,14 @@ async function doctorCommand(globalOpts, localOpts) {
     checks.push({ name: "Daemon", status: "warning", message: "could not probe" });
   }
   try {
-    const latest = execFileSync3("npm", ["view", "cc-claw", "version"], { encoding: "utf-8", timeout: 1e4 }).trim();
+    const latest = execFileSync4("npm", ["view", "cc-claw", "version"], { encoding: "utf-8", timeout: 1e4 }).trim();
     if (latest && latest !== VERSION) {
       checks.push({ name: "Update available", status: "warning", message: `v${latest} available (current: v${VERSION})`, fix: "npm install -g cc-claw@latest" });
     }
   } catch {
   }
   const tokenPath = `${DATA_PATH}/api-token`;
-  if (existsSync26(tokenPath)) {
+  if (existsSync25(tokenPath)) {
     try {
       accessSync(tokenPath, constants.R_OK);
       checks.push({ name: "API token", status: "ok", message: "token file readable" });
@@ -20204,7 +20858,7 @@ async function doctorCommand(globalOpts, localOpts) {
     }
   } catch {
   }
-  if (existsSync26(ERROR_LOG_PATH)) {
+  if (existsSync25(ERROR_LOG_PATH)) {
     try {
       const { readFileSync: readFileSync21 } = await import("fs");
       const logContent = readFileSync21(ERROR_LOG_PATH, "utf-8");
@@ -20232,15 +20886,15 @@ async function doctorCommand(globalOpts, localOpts) {
       if (check.name === "Daemon" && check.fix?.includes("service start")) {
         try {
           const { execSync: execSync9 } = await import("child_process");
-          const os = (await import("os")).platform();
-          if (os === "darwin") {
+          const os2 = (await import("os")).platform();
+          if (os2 === "darwin") {
             try {
               execSync9("launchctl start com.cc-claw");
               check.status = "ok";
               check.message = "restarted";
             } catch {
             }
-          } else if (os === "linux") {
+          } else if (os2 === "linux") {
             try {
               execSync9("systemctl --user start cc-claw");
               check.status = "ok";
@@ -20330,10 +20984,10 @@ var logs_exports = {};
 __export(logs_exports, {
   logsCommand: () => logsCommand
 });
-import { existsSync as existsSync27, readFileSync as readFileSync16, watchFile as watchFile2, unwatchFile as unwatchFile2 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync16, watchFile as watchFile2, unwatchFile as unwatchFile2 } from "fs";
 async function logsCommand(opts) {
   const logFile = opts.error ? ERROR_LOG_PATH : LOG_PATH;
-  if (!existsSync27(logFile)) {
+  if (!existsSync26(logFile)) {
     outputError("LOG_NOT_FOUND", `Log file not found: ${logFile}`);
     process.exit(1);
   }
@@ -20385,11 +21039,11 @@ __export(gemini_exports, {
   geminiReorder: () => geminiReorder,
   geminiRotation: () => geminiRotation
 });
-import { existsSync as existsSync28, mkdirSync as mkdirSync12, writeFileSync as writeFileSync9, readFileSync as readFileSync17, chmodSync } from "fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync12, writeFileSync as writeFileSync9, readFileSync as readFileSync17, chmodSync } from "fs";
 import { join as join25 } from "path";
 import { createInterface as createInterface5 } from "readline";
 function requireDb() {
-  if (!existsSync28(DB_PATH)) {
+  if (!existsSync27(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -20415,7 +21069,7 @@ function resolveOAuthEmail(configHome) {
   if (!configHome) return null;
   try {
     const accountsPath = join25(configHome, ".gemini", "google_accounts.json");
-    if (!existsSync28(accountsPath)) return null;
+    if (!existsSync27(accountsPath)) return null;
     const accounts = JSON.parse(readFileSync17(accountsPath, "utf-8"));
     return accounts.active || null;
   } catch {
@@ -20499,7 +21153,7 @@ async function geminiAddKey(globalOpts, opts) {
 async function geminiAddAccount(globalOpts, opts) {
   await requireWriteDb();
   const slotsDir = join25(CC_CLAW_HOME, "gemini-slots");
-  if (!existsSync28(slotsDir)) mkdirSync12(slotsDir, { recursive: true });
+  if (!existsSync27(slotsDir)) mkdirSync12(slotsDir, { recursive: true });
   const { addGeminiSlot: addGeminiSlot2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
   const tempId = Date.now();
   const slotDir = join25(slotsDir, `slot-${tempId}`);
@@ -20523,7 +21177,7 @@ async function geminiAddAccount(globalOpts, opts) {
   } catch {
   }
   const oauthPath = join25(slotDir, ".gemini", "oauth_creds.json");
-  if (!existsSync28(oauthPath)) {
+  if (!existsSync27(oauthPath)) {
     console.log(error2("\n  No OAuth credentials found. Sign-in may have failed."));
     console.log("  The slot directory is preserved at: " + slotDir);
     console.log("  Re-run: cc-claw gemini add-account\n");
@@ -20637,12 +21291,12 @@ __export(backend_exports, {
   backendList: () => backendList,
   backendSet: () => backendSet
 });
-import { existsSync as existsSync29 } from "fs";
+import { existsSync as existsSync28 } from "fs";
 async function backendList(globalOpts) {
   const { getAvailableAdapters: getAvailableAdapters2 } = await Promise.resolve().then(() => (init_backends(), backends_exports));
   const chatId = resolveChatId(globalOpts);
   let activeBackend = null;
-  if (existsSync29(DB_PATH)) {
+  if (existsSync28(DB_PATH)) {
     const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
     const readDb = openDatabaseReadOnly2();
     try {
@@ -20673,7 +21327,7 @@ async function backendList(globalOpts) {
 }
 async function backendGet(globalOpts) {
   const chatId = resolveChatId(globalOpts);
-  if (!existsSync29(DB_PATH)) {
+  if (!existsSync28(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -20717,13 +21371,13 @@ __export(model_exports, {
   modelList: () => modelList,
   modelSet: () => modelSet
 });
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync29 } from "fs";
 async function modelList(globalOpts) {
   const chatId = resolveChatId(globalOpts);
   const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
   const { getAdapter: getAdapter2, getAllAdapters: getAllAdapters3 } = await Promise.resolve().then(() => (init_backends(), backends_exports));
   let backendId = "claude";
-  if (existsSync30(DB_PATH)) {
+  if (existsSync29(DB_PATH)) {
     const readDb = openDatabaseReadOnly2();
     try {
       const row = readDb.prepare("SELECT backend FROM chat_backend WHERE chat_id = ?").get(chatId);
@@ -20756,7 +21410,7 @@ async function modelList(globalOpts) {
 }
 async function modelGet(globalOpts) {
   const chatId = resolveChatId(globalOpts);
-  if (!existsSync30(DB_PATH)) {
+  if (!existsSync29(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -20800,9 +21454,9 @@ __export(memory_exports, {
   memoryList: () => memoryList,
   memorySearch: () => memorySearch
 });
-import { existsSync as existsSync31 } from "fs";
+import { existsSync as existsSync30 } from "fs";
 async function memoryList(globalOpts) {
-  if (!existsSync31(DB_PATH)) {
+  if (!existsSync30(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -20826,7 +21480,7 @@ async function memoryList(globalOpts) {
   });
 }
 async function memorySearch(globalOpts, query) {
-  if (!existsSync31(DB_PATH)) {
+  if (!existsSync30(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -20848,7 +21502,7 @@ async function memorySearch(globalOpts, query) {
   });
 }
 async function memoryHistory(globalOpts, opts) {
-  if (!existsSync31(DB_PATH)) {
+  if (!existsSync30(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -20896,7 +21550,7 @@ __export(cron_exports2, {
   cronList: () => cronList,
   cronRuns: () => cronRuns
 });
-import { existsSync as existsSync32 } from "fs";
+import { existsSync as existsSync31 } from "fs";
 function parseFallbacks(raw) {
   return raw.slice(0, 3).map((f) => {
     const [backend2, ...rest] = f.split(":");
@@ -20917,7 +21571,7 @@ function parseAndValidateTimeout(raw) {
   return val;
 }
 async function cronList(globalOpts) {
-  if (!existsSync32(DB_PATH)) {
+  if (!existsSync31(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -20955,7 +21609,7 @@ async function cronList(globalOpts) {
   });
 }
 async function cronHealth(globalOpts) {
-  if (!existsSync32(DB_PATH)) {
+  if (!existsSync31(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -20984,7 +21638,7 @@ async function cronHealth(globalOpts) {
   });
 }
 async function cronCreate(globalOpts, opts) {
-  const { isDaemonRunning: isDaemonRunning2 } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
+  const { isDaemonRunning: isDaemonRunning2, apiPost: apiPost2 } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
   if (!await isDaemonRunning2()) {
     outputError("DAEMON_OFFLINE", "CC-Claw daemon is not running.\n\n  Start it with: cc-claw service start");
     process.exit(1);
@@ -20997,8 +21651,6 @@ async function cronCreate(globalOpts, opts) {
   const { success: successFmt } = await Promise.resolve().then(() => (init_format2(), format_exports));
   const timeout = parseAndValidateTimeout(opts.timeout);
   try {
-    const { initDatabase: initDatabase2, insertJob: insertJob2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
-    initDatabase2();
     const schedType = opts.cron ? "cron" : opts.at ? "at" : "every";
     let everyMs = null;
     if (opts.every) {
@@ -21010,7 +21662,7 @@ async function cronCreate(globalOpts, opts) {
       }
     }
     const fallbacks = opts.fallback?.length ? parseFallbacks(opts.fallback) : void 0;
-    const job = insertJob2({
+    const res = await apiPost2("/api/cron/create", {
       scheduleType: schedType,
       cron: opts.cron ?? null,
       atTime: opts.at ?? null,
@@ -21029,9 +21681,14 @@ async function cronCreate(globalOpts, opts) {
       target: opts.target ?? null,
       timezone: opts.timezone ?? "UTC"
     });
-    output({ id: job.id, success: true }, () => `
-  ${successFmt(`Job #${job.id} created.`)}
+    if (res.ok) {
+      output({ id: res.data.id, success: true }, () => `
+  ${successFmt(`Job #${res.data.id} created.`)}
 `);
+    } else {
+      outputError("CREATE_FAILED", `Failed: ${JSON.stringify(res.data)}`);
+      process.exit(1);
+    }
   } catch (err) {
     outputError("CREATE_FAILED", err.message);
     process.exit(1);
@@ -21057,7 +21714,7 @@ async function cronAction(globalOpts, action, id) {
   }
 }
 async function cronEdit(globalOpts, id, opts) {
-  const { isDaemonRunning: isDaemonRunning2 } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
+  const { isDaemonRunning: isDaemonRunning2, apiPost: apiPost2 } = await Promise.resolve().then(() => (init_api_client(), api_client_exports));
   if (!await isDaemonRunning2()) {
     outputError("DAEMON_OFFLINE", "CC-Claw daemon is not running.\n\n  Start it with: cc-claw service start");
     process.exit(1);
@@ -21065,82 +21722,53 @@ async function cronEdit(globalOpts, id, opts) {
   const jobId = parseInt(id, 10);
   const { success: successFmt } = await Promise.resolve().then(() => (init_format2(), format_exports));
   try {
-    const { initDatabase: initDatabase2, getDb: getDb2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
-    initDatabase2();
-    const db3 = getDb2();
-    const updates = [];
-    const values = [];
-    if (opts.title) {
-      updates.push("title = ?");
-      values.push(opts.title);
-    }
-    if (opts.description) {
-      updates.push("description = ?");
-      values.push(opts.description);
-    }
-    if (opts.cron) {
-      updates.push("cron = ?, schedule_type = 'cron'");
-      values.push(opts.cron);
-    }
-    if (opts.at) {
-      updates.push("at_time = ?, schedule_type = 'at'");
-      values.push(opts.at);
-    }
+    const payload = { id: jobId };
+    if (opts.title) payload.title = opts.title;
+    if (opts.description) payload.description = opts.description;
+    if (opts.cron) payload.cron = opts.cron;
+    if (opts.at) payload.atTime = opts.at;
     if (opts.every) {
       const m = opts.every.match(/^(\d+)\s*(m|min|h|hr|s|sec)$/i);
       if (m) {
         const num = parseInt(m[1], 10);
         const unit = m[2].toLowerCase();
-        const ms = unit.startsWith("h") ? num * 36e5 : unit.startsWith("m") ? num * 6e4 : num * 1e3;
-        updates.push("every_ms = ?, schedule_type = 'every'");
-        values.push(ms);
+        payload.everyMs = unit.startsWith("h") ? num * 36e5 : unit.startsWith("m") ? num * 6e4 : num * 1e3;
       } else {
-        updates.push("every_ms = ?, schedule_type = 'every'");
-        values.push(parseInt(opts.every, 10) || 0);
+        payload.everyMs = parseInt(opts.every, 10) || 0;
       }
     }
-    if (opts.backend) {
-      updates.push("backend = ?");
-      values.push(opts.backend);
-    }
-    if (opts.model) {
-      updates.push("model = ?");
-      values.push(opts.model);
-    }
-    if (opts.thinking) {
-      updates.push("thinking = ?");
-      values.push(opts.thinking);
-    }
+    if (opts.backend) payload.backend = opts.backend;
+    if (opts.model) payload.model = opts.model;
+    if (opts.thinking) payload.thinking = opts.thinking;
     if (opts.timeout) {
       const timeout = parseAndValidateTimeout(opts.timeout);
-      updates.push("timeout = ?");
-      values.push(timeout);
-    }
-    if (opts.timezone) {
-      updates.push("timezone = ?");
-      values.push(opts.timezone);
+      payload.timeout = timeout;
     }
+    if (opts.timezone) payload.timezone = opts.timezone;
     if (opts.fallback?.length) {
-      const fallbacks = parseFallbacks(opts.fallback);
-      updates.push("fallbacks = ?");
-      values.push(JSON.stringify(fallbacks));
+      payload.fallbacks = parseFallbacks(opts.fallback);
     }
-    if (updates.length === 0) {
+    const fieldCount = Object.keys(payload).length - 1;
+    if (fieldCount === 0) {
       outputError("NO_CHANGES", "No fields to update. Specify fields with flags (e.g. --description, --cron).");
       process.exit(1);
     }
-    values.push(jobId);
-    db3.prepare(`UPDATE jobs SET ${updates.join(", ")} WHERE id = ?`).run(...values);
-    output({ id: jobId, success: true }, () => `
+    const res = await apiPost2("/api/cron/edit", payload);
+    if (res.ok) {
+      output({ id: jobId, success: true }, () => `
   ${successFmt(`Job #${jobId} updated.`)}
 `);
+    } else {
+      outputError("EDIT_FAILED", `Failed: ${JSON.stringify(res.data)}`);
+      process.exit(1);
+    }
   } catch (err) {
     outputError("EDIT_FAILED", err.message);
     process.exit(1);
   }
 }
 async function cronRuns(globalOpts, jobId, opts) {
-  if (!existsSync32(DB_PATH)) {
+  if (!existsSync31(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -21187,16 +21815,16 @@ __export(agents_exports, {
   runnersList: () => runnersList,
   tasksList: () => tasksList
 });
-import { existsSync as existsSync33 } from "fs";
+import { existsSync as existsSync32 } from "fs";
 async function agentsList(globalOpts) {
-  if (!existsSync33(DB_PATH)) {
+  if (!existsSync32(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
   const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
   const readDb = openDatabaseReadOnly2();
   const agents2 = readDb.prepare(
-    "SELECT * FROM agents WHERE status IN ('running', 'queued', 'starting', 'idle') ORDER BY created_at DESC"
+    "SELECT * FROM agents WHERE status IN ('running', 'queued', 'starting', 'idle') ORDER BY createdAt DESC"
   ).all();
   readDb.close();
   output(agents2, (d) => {
@@ -21207,10 +21835,10 @@ async function agentsList(globalOpts) {
     const lines = ["", divider(`Active Agents (${list.length})`), ""];
     for (const a of list) {
       const shortId = a.id?.slice(0, 8) ?? "?";
-      lines.push(`  ${statusDot(a.status)} ${shortId} (${a.runner_id ?? a.runnerId}) \u2014 ${a.status}`);
+      lines.push(`  ${statusDot(a.status)} ${shortId} (${a.runnerId}) \u2014 ${a.status}`);
       if (a.task) lines.push(`    Task: ${a.task.slice(0, 80)}${a.task.length > 80 ? "\u2026" : ""}`);
-      const inK = ((a.token_input ?? a.tokenInput ?? 0) / 1e3).toFixed(1);
-      const outK = ((a.token_output ?? a.tokenOutput ?? 0) / 1e3).toFixed(1);
+      const inK = ((a.tokenInput ?? 0) / 1e3).toFixed(1);
+      const outK = ((a.tokenOutput ?? 0) / 1e3).toFixed(1);
       if (parseFloat(inK) > 0 || parseFloat(outK) > 0) {
         lines.push(`    Tokens: ${inK}k in / ${outK}k out`);
       }
@@ -21220,14 +21848,14 @@ async function agentsList(globalOpts) {
   });
 }
 async function tasksList(globalOpts) {
-  if (!existsSync33(DB_PATH)) {
+  if (!existsSync32(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
   const { openDatabaseReadOnly: openDatabaseReadOnly2 } = await Promise.resolve().then(() => (init_store5(), store_exports5));
   const readDb = openDatabaseReadOnly2();
   const tasks = readDb.prepare(
-    "SELECT t.* FROM tasks t JOIN orchestrations o ON t.orchestration_id = o.id WHERE o.status = 'active' ORDER BY t.id"
+    "SELECT t.* FROM agent_tasks t JOIN orchestrations o ON t.orchestrationId = o.id WHERE o.status = 'active' ORDER BY t.id"
   ).all();
   readDb.close();
   output(tasks, (d) => {
@@ -21348,10 +21976,10 @@ __export(db_exports, {
   dbPath: () => dbPath,
   dbStats: () => dbStats
 });
-import { existsSync as existsSync34, statSync as statSync8, copyFileSync as copyFileSync2, mkdirSync as mkdirSync13 } from "fs";
+import { existsSync as existsSync33, statSync as statSync8, copyFileSync as copyFileSync2, mkdirSync as mkdirSync13 } from "fs";
 import { dirname as dirname5 } from "path";
 async function dbStats(globalOpts) {
-  if (!existsSync34(DB_PATH)) {
+  if (!existsSync33(DB_PATH)) {
     outputError("DB_NOT_FOUND", `Database not found at ${DB_PATH}`);
     process.exit(1);
   }
@@ -21359,7 +21987,7 @@ async function dbStats(globalOpts) {
   const readDb = openDatabaseReadOnly2();
   const mainSize = statSync8(DB_PATH).size;
   const walPath = DB_PATH + "-wal";
-  const walSize = existsSync34(walPath) ? statSync8(walPath).size : 0;
+  const walSize = existsSync33(walPath) ? statSync8(walPath).size : 0;
   const tableNames = readDb.prepare(
     "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '%_fts%' ORDER BY name"
   ).all();
@@ -21393,7 +22021,7 @@ async function dbPath(globalOpts) {
   output({ path: DB_PATH }, (d) => d.path);
 }
 async function dbBackup(globalOpts, destPath) {
-  if (!existsSync34(DB_PATH)) {
+  if (!existsSync33(DB_PATH)) {
     outputError("DB_NOT_FOUND", `Database not found at ${DB_PATH}`);
     process.exit(1);
   }
@@ -21402,7 +22030,7 @@ async function dbBackup(globalOpts, destPath) {
     mkdirSync13(dirname5(dest), { recursive: true });
     copyFileSync2(DB_PATH, dest);
     const walPath = DB_PATH + "-wal";
-    if (existsSync34(walPath)) copyFileSync2(walPath, dest + "-wal");
+    if (existsSync33(walPath)) copyFileSync2(walPath, dest + "-wal");
     output({ path: dest, sizeBytes: statSync8(dest).size }, (d) => {
       const b = d;
       return `
@@ -21431,9 +22059,9 @@ __export(usage_exports, {
   usageCost: () => usageCost,
   usageTokens: () => usageTokens
 });
-import { existsSync as existsSync35 } from "fs";
+import { existsSync as existsSync34 } from "fs";
 function ensureDb() {
-  if (!existsSync35(DB_PATH)) {
+  if (!existsSync34(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -21623,9 +22251,9 @@ __export(config_exports, {
   configList: () => configList,
   configSet: () => configSet
 });
-import { existsSync as existsSync36, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync35, readFileSync as readFileSync18 } from "fs";
 async function configList(globalOpts) {
-  if (!existsSync36(DB_PATH)) {
+  if (!existsSync35(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -21659,7 +22287,7 @@ async function configGet(globalOpts, key) {
     outputError("INVALID_KEY", `Unknown config key "${key}". Valid keys: ${RUNTIME_KEYS.join(", ")}`);
     process.exit(1);
   }
-  if (!existsSync36(DB_PATH)) {
+  if (!existsSync35(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -21705,7 +22333,7 @@ async function configSet(globalOpts, key, value) {
   }
 }
 async function configEnv(_globalOpts) {
-  if (!existsSync36(ENV_PATH)) {
+  if (!existsSync35(ENV_PATH)) {
     outputError("ENV_NOT_FOUND", `No .env file at ${ENV_PATH}. Run cc-claw setup.`);
     process.exit(1);
   }
@@ -21759,9 +22387,9 @@ __export(session_exports, {
   sessionGet: () => sessionGet,
   sessionNew: () => sessionNew
 });
-import { existsSync as existsSync37 } from "fs";
+import { existsSync as existsSync36 } from "fs";
 async function sessionGet(globalOpts) {
-  if (!existsSync37(DB_PATH)) {
+  if (!existsSync36(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -21822,9 +22450,9 @@ __export(permissions_exports, {
   verboseGet: () => verboseGet,
   verboseSet: () => verboseSet
 });
-import { existsSync as existsSync38 } from "fs";
+import { existsSync as existsSync37 } from "fs";
 function ensureDb2() {
-  if (!existsSync38(DB_PATH)) {
+  if (!existsSync37(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -21971,9 +22599,9 @@ __export(cwd_exports, {
   cwdGet: () => cwdGet,
   cwdSet: () => cwdSet
 });
-import { existsSync as existsSync39 } from "fs";
+import { existsSync as existsSync38 } from "fs";
 async function cwdGet(globalOpts) {
-  if (!existsSync39(DB_PATH)) {
+  if (!existsSync38(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -22035,9 +22663,9 @@ __export(voice_exports, {
   voiceGet: () => voiceGet,
   voiceSet: () => voiceSet
 });
-import { existsSync as existsSync40 } from "fs";
+import { existsSync as existsSync39 } from "fs";
 async function voiceGet(globalOpts) {
-  if (!existsSync40(DB_PATH)) {
+  if (!existsSync39(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -22086,9 +22714,9 @@ __export(heartbeat_exports, {
   heartbeatGet: () => heartbeatGet,
   heartbeatSet: () => heartbeatSet
 });
-import { existsSync as existsSync41 } from "fs";
+import { existsSync as existsSync40 } from "fs";
 async function heartbeatGet(globalOpts) {
-  if (!existsSync41(DB_PATH)) {
+  if (!existsSync40(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -22198,9 +22826,9 @@ __export(chats_exports, {
   chatsList: () => chatsList,
   chatsRemoveAlias: () => chatsRemoveAlias
 });
-import { existsSync as existsSync42 } from "fs";
+import { existsSync as existsSync41 } from "fs";
 async function chatsList(_globalOpts) {
-  if (!existsSync42(DB_PATH)) {
+  if (!existsSync41(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -22328,9 +22956,9 @@ var mcps_exports = {};
 __export(mcps_exports, {
   mcpsList: () => mcpsList
 });
-import { existsSync as existsSync43 } from "fs";
+import { existsSync as existsSync42 } from "fs";
 async function mcpsList(_globalOpts) {
-  if (!existsSync43(DB_PATH)) {
+  if (!existsSync42(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found.");
     process.exit(1);
   }
@@ -22367,11 +22995,11 @@ __export(chat_exports, {
   chatSend: () => chatSend
 });
 import { request as httpRequest2 } from "http";
-import { readFileSync as readFileSync19, existsSync as existsSync44 } from "fs";
+import { readFileSync as readFileSync19, existsSync as existsSync43 } from "fs";
 function getToken2() {
   if (process.env.CC_CLAW_API_TOKEN) return process.env.CC_CLAW_API_TOKEN;
   try {
-    if (existsSync44(TOKEN_PATH2)) return readFileSync19(TOKEN_PATH2, "utf-8").trim();
+    if (existsSync43(TOKEN_PATH2)) return readFileSync19(TOKEN_PATH2, "utf-8").trim();
   } catch {
   }
   return null;
@@ -22841,9 +23469,9 @@ __export(evolve_exports, {
   evolveStatus: () => evolveStatus,
   evolveUndo: () => evolveUndo
 });
-import { existsSync as existsSync45 } from "fs";
+import { existsSync as existsSync44 } from "fs";
 function ensureDb3() {
-  if (!existsSync45(DB_PATH)) {
+  if (!existsSync44(DB_PATH)) {
     outputError("DB_NOT_FOUND", "Database not found. Run cc-claw setup first.");
     process.exit(1);
   }
@@ -23259,8 +23887,8 @@ var init_evolve = __esm({
 
 // src/setup.ts
 var setup_exports = {};
-import { existsSync as existsSync46, writeFileSync as writeFileSync11, readFileSync as readFileSync20, copyFileSync as copyFileSync3, mkdirSync as mkdirSync15, statSync as statSync9 } from "fs";
-import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync45, writeFileSync as writeFileSync11, readFileSync as readFileSync20, copyFileSync as copyFileSync3, mkdirSync as mkdirSync15, statSync as statSync9 } from "fs";
+import { execFileSync as execFileSync5 } from "child_process";
 import { createInterface as createInterface7 } from "readline";
 import { join as join27 } from "path";
 function divider2() {
@@ -23324,7 +23952,7 @@ async function setup() {
   let foundAnyBackend = false;
   for (const bk of backends) {
     try {
-      const path = execFileSync4("which", [bk.cmd], { encoding: "utf-8" }).trim();
+      const path = execFileSync5("which", [bk.cmd], { encoding: "utf-8" }).trim();
       console.log(green(`  ${bk.name} CLI found: ${path}`));
       foundAnyBackend = true;
     } catch {
@@ -23337,10 +23965,10 @@ async function setup() {
   }
   console.log("");
   for (const dir of [CC_CLAW_HOME, DATA_PATH, LOGS_PATH, SKILLS_PATH, RUNNERS_PATH, AGENTS_PATH]) {
-    if (!existsSync46(dir)) mkdirSync15(dir, { recursive: true });
+    if (!existsSync45(dir)) mkdirSync15(dir, { recursive: true });
   }
   const env = {};
-  const envSource = existsSync46(ENV_PATH) ? ENV_PATH : existsSync46(".env") ? ".env" : null;
+  const envSource = existsSync45(ENV_PATH) ? ENV_PATH : existsSync45(".env") ? ".env" : null;
   if (envSource) {
     console.log(yellow(`  Found existing config at ${envSource} \u2014 your values will be preserved`));
     console.log(yellow("  unless you enter new ones. Just press Enter to keep existing values.\n"));
@@ -23351,7 +23979,7 @@ async function setup() {
     }
   }
   const cwdDb = join27(process.cwd(), "cc-claw.db");
-  if (existsSync46(cwdDb) && !existsSync46(DB_PATH)) {
+  if (existsSync45(cwdDb) && !existsSync45(DB_PATH)) {
     const { size } = statSync9(cwdDb);
     console.log(yellow(`  Found existing database at ${cwdDb} (${(size / 1024).toFixed(0)}KB)`));
     const migrate = await confirm("Copy database to ~/.cc-claw/? (preserves memories & history)", true);
@@ -24184,8 +24812,8 @@ async function run(argv = process.argv) {
   if (argv.includes("--version") || argv.includes("-V")) {
     console.log(VERSION);
     try {
-      const { execFileSync: execFileSync5 } = await import("child_process");
-      const latest = execFileSync5("npm", ["view", "cc-claw", "version"], { encoding: "utf-8", timeout: 1e4 }).trim();
+      const { execFileSync: execFileSync6 } = await import("child_process");
+      const latest = execFileSync6("npm", ["view", "cc-claw", "version"], { encoding: "utf-8", timeout: 1e4 }).trim();
       if (latest && latest !== VERSION) {
         console.log(`
 Update available: v${latest} (current: v${VERSION})`);