charness 3.3.2 → 3.4.0

package/dist/bot.js

@@ -34,7 +34,6 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMMANDS_MENU = exports.telegramInbound = exports.routedCommandTriggerDeps = void 0;
-exports.buildBindKeyboard = buildBindKeyboard;
 exports.getStartReadyMessage = getStartReadyMessage;
 exports.checkIsRoutedCommand = checkIsRoutedCommand;
 exports.handleRoutedCommandMessage = handleRoutedCommandMessage;
@@ -84,6 +83,8 @@ const timezone_1 = require("./utils/timezone");
 const timezonePicker_1 = require("./connectors/telegram/timezonePicker");
 const timezoneRecompute_1 = require("./scheduler/timezoneRecompute");
 const validation_1 = require("./validation");
+const bindPicker_1 = require("./connectors/telegram/bindPicker");
+const topicCommand_1 = require("./connectors/telegram/commands/topicCommand");
 const providerDisconnectPlan_1 = require("./utils/providerDisconnectPlan");
 const folderName_1 = require("./folderName");
 const threadRouting_1 = require("./threadRouting");
@@ -157,6 +158,13 @@ const claudeLivenessAction_1 = require("./utils/claudeLivenessAction");
 const isoTimestamp_1 = require("./utils/isoTimestamp");
 const effortLevels_1 = require("./effortLevels");
 const instanceSettings_1 = require("./instanceSettings");
+const constants_1 = require("./selfUpdate/constants");
+const launchEnvironment_1 = require("./selfUpdate/launchEnvironment");
+const restart_1 = require("./selfUpdate/restart");
+const updateEngine_1 = require("./selfUpdate/updateEngine");
+const updateMessages_1 = require("./selfUpdate/updateMessages");
+const updatePolicy_1 = require("./selfUpdate/updatePolicy");
+const updateRuntime_1 = require("./selfUpdate/updateRuntime");
 const threadContextPreamble_1 = require("./threadContextPreamble");
 const pinnedBannerSkipDecision_1 = require("./utils/pinnedBannerSkipDecision");
 const replyQuote_1 = require("./utils/replyQuote");
@@ -216,6 +224,7 @@ const limitsBoard_1 = require("./connectors/telegram/commands/limitsBoard");
 const backendSwitch_1 = require("./connectors/telegram/commands/backendSwitch");
 const operatorSwitchPlan_1 = require("./utils/operatorSwitchPlan");
 const backendSwitchPlan_1 = require("./utils/backendSwitchPlan");
+const selfUpdate_1 = require("./connectors/telegram/commands/selfUpdate");
 const stt_1 = require("./connectors/telegram/commands/stt");
 const resolveBinary_1 = require("./utils/resolveBinary");
 // ═══════════════════════════════════════════════════════════════════════════════
@@ -595,6 +604,18 @@ bot.use(async (ctx, next) => {
     });
     return next();
 });
+/**
+ * Epoch ms of the last update a human sent (a message, a button tap), `null` since the start. The updater restarts the bot only
+ * after a quiet period (`quietPeriodMs`) — somebody typing right now is the one case it must not interrupt.
+ */
+let lastHumanInboundAt = null;
+bot.use(async (ctx, next) => {
+    if (ctx.message || ctx.callbackQuery)
+        lastHumanInboundAt = Date.now();
+    return next();
+});
+/** The update engine of this process; built at boot (`startBot`), read by the `/update` command. */
+let updateEngine = null;
 // Locale is a Telegram-chat concern, not a process env knob. Every update runs
 // inside an async i18n context: explicit `/language` override for the DM/group
 // wins, else this sender's Telegram `language_code`, else the last seen Telegram
@@ -1721,7 +1742,7 @@ function clearLimitResumeNotice(key) {
  */
 let claudeProfileAuthStatusSink = null;
 // Out-of-band sign-in drivers (`/login`, `/connect` OAuth): `agentLogin/README.md`.
-const { cancelPendingLogin, checkIsAuthLoginAwaitingCode, cancelClaudeAuthLogin, startClaudeAuthLogin, submitClaudeAuthLoginCode, checkIsOpenCodeOAuthAwaitingReply, cancelOpenCodeOAuthLogin, startOpenCodeOAuthLogin, submitOpenCodeOAuthReply, } = (0, agentLogin_1.createAgentLogin)({
+const { cancelPendingLogin, checkIsAuthLoginAwaitingCode, cancelClaudeAuthLogin, startClaudeAuthLogin, submitClaudeAuthLoginCode, checkIsOpenCodeOAuthAwaitingReply, cancelOpenCodeOAuthLogin, startOpenCodeOAuthLogin, submitOpenCodeOAuthReply, checkIsAnyLoginInProgress, } = (0, agentLogin_1.createAgentLogin)({
     replyToThread,
     deleteThreadMessage,
     clearAuthNotice,
@@ -3466,8 +3487,6 @@ function getWorkDirStartDecision(key) {
 // `validateSubdir` + `BindError` live in `src/validation.ts` so the
 // security-critical bits can be unit-tested without booting Telegraf
 // (plan §11 Этап 7, R3). The import at the top of this file pulls them in.
-/** Inline-keyboard page size for `/bind`. 20 fits one phone screen comfortably. */
-const BIND_PAGE_SIZE = 20;
 /**
  * @description List immediate subdirectories of `WORK_ROOT` for the `/bind`
  * inline-button picker and the `forum_topic_created` welcome message.
@@ -3519,71 +3538,6 @@ function listAvailableSubdirs(workRoot, limit = 200) {
     subdirCache.set(cacheKey, { value: result, ts: Date.now() });
     return result;
 }
-/**
- * @description Build a `subdir`-suggestion keyboard for `/bind` and friends.
- *
- * Lists are paginated at {@link BIND_PAGE_SIZE} entries: a `WORK_ROOT` with
- * many subfolders (mono-repo workspace, packages dir, etc.) would otherwise
- * push the inline keyboard past Telegram's per-message height limit and
- * lose entries below the fold.
- *
- * The nav row appears only when there's more than one page. The middle
- * `pageLabel` button is a no-op (`bind_page_noop` callback) — it exists
- * solely so the user sees "2/5" without us having to fake a divider with
- * a separate message.
- *
- * Subdirs whose callback_data exceeds 64 bytes are filtered out upstream
- * in `listAvailableSubdirs`. `page` is clamped to a valid index so a stale
- * callback (folders disappeared since the keyboard was sent) just lands
- * on the last available page.
- *
- * When `isBound` the FIRST row is a full-width «leave current dir» button
- * (`bindLeaveCurrentCallback`, the folded-in `/unbind`); the «create new folder»
- * button (`bindCreateFolderCallback`) follows. Both callbacks deliberately do
- * NOT start with `bind_`, so they can't be mistaken for a folder pick by the
- * `bind_<subdir>` action regex. They ride on every page so they're reachable
- * regardless of pagination.
- */
-const bindCreateFolderCallback = 'bindCreateFolder';
-/**
- * «Leave current dir» button — the folded-in `/unbind`. Like
- * `bindCreateFolderCallback`, the callback id deliberately does NOT start with
- * `bind_`, so the `bind_<subdir>` action regex can't mistake it for a folder
- * pick. Only rendered in a bound topic.
- */
-const bindLeaveCurrentCallback = 'bindLeaveCurrent';
-function buildBindKeyboard(subdirs, page = 0, pageSize = BIND_PAGE_SIZE, isBound = false) {
-    const { slice, currentPage, totalPages } = (0, validation_1.paginateBindList)(subdirs, page, pageSize);
-    const rows = [
-        [telegraf_1.Markup.button.callback((0, i18n_1.t)('bind.create_button'), bindCreateFolderCallback)],
-    ];
-    // A bound topic gets a full-width «leave current dir» row PREPENDED above the
-    // «create new folder» row — this is the folded-in `/unbind`. Its callback
-    // deliberately avoids the `bind_` prefix so the `bind_<subdir>` action regex
-    // can't catch it. The row is omitted when unbound (nothing to leave).
-    if (isBound) {
-        rows.unshift([telegraf_1.Markup.button.callback((0, i18n_1.t)('bind.leave_button'), bindLeaveCurrentCallback)]);
-    }
-    for (let i = 0; i < slice.length; i += 2) {
-        const row = [telegraf_1.Markup.button.callback(`📁 ${slice[i]}`, `bind_${slice[i]}`)];
-        if (slice[i + 1]) {
-            row.push(telegraf_1.Markup.button.callback(`📁 ${slice[i + 1]}`, `bind_${slice[i + 1]}`));
-        }
-        rows.push(row);
-    }
-    if (totalPages > 1) {
-        const nav = [];
-        if (currentPage > 0) {
-            nav.push(telegraf_1.Markup.button.callback('⬅️ Prev', `bind_page_${currentPage - 1}`));
-        }
-        nav.push(telegraf_1.Markup.button.callback(`${currentPage + 1}/${totalPages}`, 'bind_page_noop'));
-        if (currentPage < totalPages - 1) {
-            nav.push(telegraf_1.Markup.button.callback('Next ➡️', `bind_page_${currentPage + 1}`));
-        }
-        rows.push(nav);
-    }
-    return telegraf_1.Markup.inlineKeyboard(rows);
-}
 /**
  * @description Bot-level wrapper around the pure sweep helper in
  * `createAdapter.ts`. Binds the production adapter resolver so callers
@@ -4495,6 +4449,13 @@ const { checkIsThreadCompacting, noteThreadActivity, noteThreadUserActivity, mar
 function checkIsRoutedCommand(name) {
     return commandRouter.checkIsRegistered(name);
 }
+/** `/esc` and its other names: the interrupt, which also cancels a pending sign-in or `/topic` prompt first. */
+const escapeCommandNames = ['esc', 'escape', 'interrupt'];
+/** @description Whether `messageText` is one of the {@link escapeCommandNames} (`@botmention` tolerated). */
+function checkIsEscapeCommandText(messageText) {
+    const [commandToken = ''] = (0, utils_1.stripCommandBotMention)(messageText.trim()).split(/\s+/, 1);
+    return escapeCommandNames.includes(commandToken.replace(/^\//, '').toLowerCase());
+}
 /**
  * @description Running ANY command exits the single-purpose input modes an
  * earlier command armed:
@@ -4503,6 +4464,7 @@ function checkIsRoutedCommand(name) {
  *    it afterwards via its own callback);
  *  - `/connect`'s pending provider connect — cancelled out loud, unless the
  *    command IS another `/connect` (which continues the flow);
+ *  - `/topic`'s pending name prompts (the topic's, the new folder's) — but `/esc`, which cancels them with a notice of its own;
  *  - an in-flight `/reminders` wizard, at whatever step. Unconditional rather
  *    than only during the step-4 text wait: that is what makes a repeat
  *    `/reminders` retire the previous wizard (relabelling its message) instead
@@ -4512,6 +4474,9 @@ function checkIsRoutedCommand(name) {
 async function exitPendingInputModes(key, messageText) {
     const keyString = (0, sessionKey_1.keyToString)(key);
     awaitingFolderName.delete(keyString);
+    // `/topic`'s name prompts end silently, except for `/esc`, which cancels them out loud in its own handler.
+    if (!checkIsEscapeCommandText(messageText))
+        cancelTopicInput(key);
     const hadPendingProviderConnect = pendingProviderConnects.delete(keyString);
     if (hadPendingProviderConnect && !(0, recvPreviewRedaction_1.checkIsConnectCommandText)(messageText)) {
         await replyToThread(key, (0, i18n_1.t)('connect.cancelled'));
@@ -4892,6 +4857,8 @@ function armFolderCreation(key) {
     const kStr = (0, sessionKey_1.keyToString)(key);
     awaitingModelSelection.delete(kStr);
     awaitingSessionSelection.delete(kStr);
+    // The `/topic` prompts are other readers of the next plain message.
+    cancelTopicInput(key);
     // A stale pending question would otherwise consume the message AFTER the
     // folder name as an answer to the old (pre-rebind) agent question.
     clearPendingQuestion(key);
@@ -4909,21 +4876,18 @@ function mapNewFolderError(reason) {
     }
 }
 /**
- * @description Create a new folder under WORK_ROOT from a user-typed name and
- * bind the thread to it. Validates the name first (no traversal/slashes/dots),
- * then `mkdir` (recursive: an already-existing folder is fine — we just bind
- * to it and tell the user), then routes through `applyBinding` for the same
- * containment/symlink defence + welcome stack the picker uses.
- *
- * Returns `{ ok }` so the caller knows whether to disarm the await-name mode:
- * an invalid name keeps the thread armed for a retry; success or a real
- * filesystem failure disarms it.
+ * @description Create a new folder under WORK_ROOT from a user-typed name:
+ * validate the name first (no traversal/slashes/dots), then `mkdir` (recursive:
+ * an already-existing folder is fine — the caller just uses it, and the topic is
+ * told so). A refusal or a filesystem failure is reported to `key`'s topic here;
+ * the outcome says which, so the caller knows whether a retry is still wanted
+ * (`invalid`) or not (`failed`).
  */
-async function createAndBindFolder(key, rawName) {
+async function createWorkFolder(key, rawName) {
     const validated = (0, folderName_1.validateNewFolderName)(rawName);
     if (!validated.ok) {
         await replyToThread(key, mapNewFolderError(validated.reason));
-        return { ok: false };
+        return { outcome: 'invalid' };
     }
     const targetPath = path.join(ENV.workRoot, validated.name);
     const alreadyExisted = fs.existsSync(targetPath);
@@ -4934,7 +4898,7 @@ async function createAndBindFolder(key, rawName) {
         await replyToThread(key, (0, i18n_1.t)('bind.create_failed', {
             error: e instanceof Error ? e.message : String(e),
         }));
-        return { ok: true };
+        return { outcome: 'failed' };
     }
     // Folder freshly on disk → the cached subdir list is stale; drop it so the
     // next picker render includes the new folder.
@@ -4942,12 +4906,43 @@ async function createAndBindFolder(key, rawName) {
     if (alreadyExisted) {
         await replyToThread(key, (0, i18n_1.t)('bind.create_exists', { subdir: validated.name }));
     }
-    const result = await applyBinding(key, validated.name);
+    return { outcome: 'ready', subdir: validated.name };
+}
+/**
+ * @description Create a new folder under WORK_ROOT from a user-typed name and
+ * bind the thread to it ({@link createWorkFolder}), routing through
+ * `applyBinding` for the same containment/symlink defence + welcome stack the
+ * picker uses.
+ *
+ * Returns `{ ok }` so the caller knows whether to disarm the await-name mode:
+ * an invalid name keeps the thread armed for a retry; success or a real
+ * filesystem failure disarms it.
+ */
+async function createAndBindFolder(key, rawName) {
+    const folder = await createWorkFolder(key, rawName);
+    if (folder.outcome === 'invalid')
+        return { ok: false };
+    if (folder.outcome === 'failed')
+        return { ok: true };
+    const result = await applyBinding(key, folder.subdir);
     await replyToThread(key, result.message);
     if (result.ok)
         await sendBindingWelcome(key, result.subdir);
     return { ok: true };
 }
+/**
+ * @description Bind a topic the bot has just created (`/topic`) to `subdir` and greet it with the usual binding welcome:
+ * the folder's stats and the start buttons. No agent starts by itself: it is started there as in any bound topic. The binding's own notice
+ * is left out: its warning about other topics on the folder would warn of what the person just asked for. The topic's name
+ * rides on the binding for the thread-context preamble. Resolves why it could not bind, `null` once it is bound.
+ */
+async function bindNewTopic(key, subdir, topicName) {
+    const result = await applyBinding(key, subdir, { topicName });
+    if (!result.ok)
+        return result.message;
+    await sendBindingWelcome(key, result.subdir);
+    return null;
+}
 command('bind', async (_ctx, key, parsed) => {
     if (checkIsGeneral(key)) {
         await replyToThread(key, (0, i18n_1.t)('bind.in_general'));
@@ -4971,7 +4966,7 @@ command('bind', async (_ctx, key, parsed) => {
         // «create new folder» button, which is the only way to bootstrap a folder
         // from an empty WORK_ROOT without the slash form. When already bound it
         // also carries the «leave current dir» button (the folded-in /unbind).
-        await replyToThread(key, usage, buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!binding));
+        await replyToThread(key, usage, (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!binding));
         return;
     }
     const result = await applyBinding(key, arg);
@@ -5158,26 +5153,27 @@ async function getCliVersion(cmd, args = ['--version']) {
     }
 }
 command('version', async (_ctx, key) => {
-    // Read our own version from package.json so we don't drift if it ever bumps
-    // again without us updating a hardcoded string here.
-    let botVersion = (0, i18n_1.t)('version.unknown');
-    try {
-        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
-        botVersion = pkg.version || botVersion;
-    }
-    catch { /* fall through to unknown */ }
+    // The version this process STARTED as, read once at boot by the updater's runtime: an in-place install rewrites package.json
+    // under a running bot, and the new number must not show before the restart that makes it true.
+    const updateStatus = updateEngine?.getStatus();
+    const botVersion = updateStatus?.running.version ?? (0, i18n_1.t)('version.unknown');
+    const offer = updateStatus?.offer;
+    const availableUpdate = offer && offer.action !== 'skipped' && offer.action !== 'needsNode' ? offer.target : null;
     const [tmuxV, claudeV, opencodeV] = await Promise.all([
         getCliVersion('tmux', ['-V']),
         getCliVersion('claude'),
         getCliVersion('opencode'),
     ]);
-    await replyToThread(key, (0, i18n_1.t)('version.report', {
+    const report = (0, i18n_1.t)('version.report', {
         bot: botVersion,
         node: process.version,
         tmux: tmuxV,
         claude: claudeV,
         opencode: opencodeV,
-    }), { parse_mode: 'Markdown' });
+    });
+    await replyToThread(key, availableUpdate === null ? report : `${report}\n${(0, i18n_1.t)('version.updateAvailable', { version: availableUpdate })}`, {
+        parse_mode: 'Markdown',
+    });
 });
 command('whoami', async (ctx, key) => {
     const userId = ctx.from?.id ?? 0;
@@ -5246,7 +5242,7 @@ command('help', async (_ctx, key) => {
     const binding = state.getBinding(key);
     if (!binding) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await replyToThread(key, (0, i18n_1.t)('help.thread_unbound'), {
             parse_mode: 'Markdown',
             ...(extra ?? {}),
@@ -5591,7 +5587,7 @@ async function handleAgentStart(key, adapterName, args) {
     // natural-language path in the text handler (plan §11 Этап 4).
     if (!state.getBinding(key)) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
         return;
     }
@@ -6440,7 +6436,7 @@ const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAw
     applyAutoSwitch,
 });
 claudeProfileAuthStatusSink = recordClaudeProfileAuthStatus;
-const { registerSttCommands, registerSttCallbacks, startSttAutoInstall, resumeSttInstallAtBoot, getAwaitedSttStep, submitSttInput, cancelSttInput, } = (0, stt_1.createStt)({
+const { registerSttCommands, registerSttCallbacks, startSttAutoInstall, resumeSttInstallAtBoot, getAwaitedSttStep, checkIsAnySttInputAwaited, submitSttInput, cancelSttInput, } = (0, stt_1.createStt)({
     ...botCore,
     getConfigPath: () => (0, sttSettings_1.getSttConfigPath)(),
     getDataDir: state_1.resolveDataDir,
@@ -6453,10 +6449,30 @@ const { registerSttCommands, registerSttCallbacks, startSttAutoInstall, resumeSt
         return groupId !== null ? (0, sessionKeyCodec_1.makeTelegramKey)(groupId, threadRouting_1.GENERAL_THREAD_ID) : null;
     },
 });
+const { registerTopicCommand, registerTopicCallbacks, checkIsAwaitingTopicInput, submitTopicInput, cancelTopicInput, cancelTopicWizard, } = (0, topicCommand_1.createTopicCommand)({
+    ...botCore,
+    checkIsDmKey,
+    disarmFolderCreation: (key) => {
+        awaitingFolderName.delete((0, sessionKey_1.keyToString)(key));
+    },
+    listAvailableSubdirs: () => listAvailableSubdirs(ENV.workRoot),
+    createWorkFolder,
+    bindNewTopic,
+});
 registerClaudeAccountCommands();
+registerTopicCommand();
 registerFallbackChainCommands();
 registerLimitsBoardCommands();
 registerSttCommands();
+const { registerSelfUpdateCommands, registerSelfUpdateCallbacks } = (0, selfUpdate_1.createSelfUpdate)({
+    ...botCore,
+    getUpdateEngine: () => updateEngine,
+    getSettingsPath: () => (0, instanceSettings_1.getInstanceSettingsPath)(),
+    now: () => Date.now(),
+    // The instance's time zone is `process.env.TZ` (`/timezone`), which `toLocaleTimeString` follows.
+    formatClock: (epochMs) => new Date(epochMs).toLocaleTimeString('en-GB', { hour: '2-digit', minute: '2-digit' }),
+});
+registerSelfUpdateCommands();
 registerCompactionCommands();
 /**
  * @description Build the agent-picker keyboard.
@@ -6490,7 +6506,7 @@ async function handleSessionsList(key) {
     }
     if (!state.getBinding(key)) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
         return;
     }
@@ -6750,8 +6766,8 @@ command('tab', async (_ctx, key) => {
     else
         await replyToThread(key, `Not supported for ${adapter.label}`);
 });
-command(['esc', 'escape'], async (_ctx, key) => {
-    // A pending «Add account» name prompt, then a pending sign-in (`/login`, `/connect` OAuth) take
+command(escapeCommandNames, async (_ctx, key) => {
+    // A pending «Add account» name prompt, a pending sign-in (`/login`, `/connect` OAuth) and a `/topic` wizard take
     // priority: the first /esc only cancels it, so the topic stops waiting for typed input.
     if (cancelProfileNameCapture(key)) {
         await replyToThread(key, (0, i18n_1.t)('account.askNameCancelled'));
@@ -6761,12 +6777,21 @@ command(['esc', 'escape'], async (_ctx, key) => {
         await replyToThread(key, (0, i18n_1.t)('login.cancelled'));
         return;
     }
+    // A `/topic` wizard is ended at whatever step it waits (it says so itself).
+    if (await cancelTopicWizard(key))
+        return;
     const adapter = (0, createAdapter_1.getThreadAdapter)(key);
     if (adapter.sendEscape) {
         // The operator interrupted the turn: its open request closes silently.
         cancelConversationRequest(key);
         markNeedsNewMessage(key);
+        // A turn blocked on a question ends with it: the question is closed on the agent first (an open OpenCode one is
+        // re-found at every reattach; a Claude stream-json one is denied), then the turn is stopped — neither waits for Telegram. Only
+        // then the question's buttons are retired, as when a prompt walks away from it (that edit goes through the send pacer).
+        adapter.rejectQuestion?.(key);
         adapter.sendEscape(key);
+        if (pendingQuestions.has((0, sessionKey_1.keyToString)(key)))
+            await retirePendingQuestion(key);
     }
     else {
         await replyToThread(key, `Not supported for ${adapter.label}`);
@@ -7037,10 +7062,10 @@ command('clear_messages', async (ctx, key) => {
 // agent.
 const botCommands = new Set([
     'start', 'claude', 'opencode', 'oc', 'terminal', 'agent', 'sessions', 'resume', 'cancel', 'model', 'connect',
-    'disconnect', 'stop', 'stopall', 'stop-all', 'status', 'c', 'y', 'n', 'enter', 'up', 'down', 'tab', 'esc', 'escape', 'output', 'clear_messages',
-    'bind', 'unbind', 'where', 'ls', 'list', 'new', 'clear_session', 'whoami', 'version', 'help', 'language', 'lang',
+    'disconnect', 'stop', 'stopall', 'stop-all', 'status', 'c', 'y', 'n', 'enter', 'up', 'down', 'tab', 'esc', 'escape', 'interrupt', 'output', 'clear_messages',
+    'bind', 'topic', 'unbind', 'where', 'ls', 'list', 'new', 'clear_session', 'whoami', 'version', 'help', 'language', 'lang',
     'doctor', 'mcp', 'rename_session', 'compact', 'compact_on_idle', 'compact_summary', 'auto_continue_limits', 'limits', 'limits_autoswitch', 'trace', 'timestamps', 'timezone', 'schedule', 'reminders', 'thinking', 'tool_results',
-    'subagent', 'claude_mode', 'effort', 'verbosity', 'quit', 'q', 'quit-all', 'quitall', 'pair', 'account', 'accounts', 'fallback', 'stt', 'voice', 'speech',
+    'subagent', 'claude_mode', 'effort', 'verbosity', 'quit', 'q', 'quit-all', 'quitall', 'pair', 'account', 'accounts', 'fallback', 'stt', 'voice', 'speech', 'update',
 ]);
 /**
  * @description The bare `/clear` is no longer bot-owned (it was renamed to
@@ -7073,6 +7098,7 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
         const cmd = text.slice(1).split(' ')[0].split('@')[0].toLowerCase();
         // A slash command ends a pending «Add account» name prompt (the command itself runs normally).
         cancelProfileNameCapture(key);
+        cancelTopicInput(key);
         // ... and an armed `/stt` address or key step.
         await cancelSttInput(key);
         if (botCommands.has(cmd))
@@ -7124,6 +7150,12 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
         await submitProfileName(key, text);
         return;
     }
+    // `/topic` asked for the new topic's name, or for the name of a folder to create → this message is the answer (a bad
+    // name keeps the prompt armed and says so; a slash command above already ended it).
+    if (checkIsAwaitingTopicInput(key) && !text.startsWith('/')) {
+        await submitTopicInput(key, text);
+        return;
+    }
     // `/stt` asked for a server address or an API key → this message is the answer. A plausible key is deleted at
     // once and never echoed; anything else re-arms the step. A slash command above already disarmed it.
     if (getAwaitedSttStep(key) !== null && !text.startsWith('/')) {
@@ -7289,7 +7321,7 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
             });
             if (!result.ok && result.reason === 'unbound') {
                 const subdirs = listAvailableSubdirs(ENV.workRoot);
-                const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+                const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
                 await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
                 return;
             }
@@ -7370,7 +7402,7 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
     const binding = state.getBinding(key);
     if (!binding) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
         return;
     }
@@ -7501,7 +7533,7 @@ async function processVoiceJob(key, fileId, durationSeconds, requesterId, sentAt
                 });
                 if (!result.ok && result.reason === 'unbound') {
                     const subdirs = listAvailableSubdirs(ENV.workRoot);
-                    const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+                    const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
                     await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
                     return;
                 }
@@ -7521,7 +7553,7 @@ async function processVoiceJob(key, fileId, durationSeconds, requesterId, sentAt
             const binding = state.getBinding(key);
             if (!binding) {
                 const subdirs = listAvailableSubdirs(ENV.workRoot);
-                const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+                const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
                 await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
                 return;
             }
@@ -7589,7 +7621,7 @@ async function checkFileIntakeGatePassed(key, isStarting, sendHint) {
     const binding = state.getBinding(key);
     if (!binding) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await sendHint((0, i18n_1.t)('thread.no_binding'), extra);
         return false;
     }
@@ -7924,7 +7956,7 @@ bot.on((0, filters_1.message)('forum_topic_created'), async (ctx) => {
             // Fall through to picker.
         }
     }
-    const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+    const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
     await replyToThread(key, (0, i18n_1.t)('thread.welcome_pick'), extra);
 });
 /**
@@ -8038,7 +8070,7 @@ bot.action(/^bind_page_(\d+)$/, async (ctx) => {
     }
     const page = parseInt(ctx.match[1], 10);
     const subdirs = listAvailableSubdirs(ENV.workRoot);
-    const keyboard = buildBindKeyboard(subdirs, page, BIND_PAGE_SIZE, !!state.getBinding(key));
+    const keyboard = (0, bindPicker_1.buildBindKeyboard)(subdirs, page, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
     try {
         await ctx.editMessageReplyMarkup(keyboard.reply_markup);
     }
@@ -8051,14 +8083,14 @@ bot.action(/^bind_page_(\d+)$/, async (ctx) => {
     await ctx.answerCbQuery();
 });
 // Middle "N/M" pill in the nav row — pure UI, no state change.
-bot.action('bind_page_noop', async (ctx) => {
+bot.action(bindPicker_1.bindPageNoopCallback, async (ctx) => {
     await ctx.answerCbQuery();
 });
 // «Create new folder» — first option in the /bind picker. Arms the thread's
 // await-folder-name mode; the next text message is the name (see the text
 // handler). Callback id deliberately avoids the `bind_` prefix so it can't be
 // matched by the `bind_<subdir>` regex below.
-bot.action(bindCreateFolderCallback, async (ctx) => {
+bot.action(bindPicker_1.bindCreateFolderCallback, async (ctx) => {
     const key = await authoriseContext(ctx);
     if (!key) {
         await ctx.answerCbQuery((0, i18n_1.t)('cb.access_denied'));
@@ -8075,7 +8107,7 @@ bot.action(bindCreateFolderCallback, async (ctx) => {
 // «Leave current dir» — the folded-in `/unbind`, shown only in a bound topic.
 // Callback id deliberately avoids the `bind_` prefix so it can't be matched by
 // the `bind_<subdir>` regex below.
-bot.action(bindLeaveCurrentCallback, async (ctx) => {
+bot.action(bindPicker_1.bindLeaveCurrentCallback, async (ctx) => {
     const key = await authoriseContext(ctx);
     if (!key) {
         await ctx.answerCbQuery((0, i18n_1.t)('cb.access_denied'));
@@ -8088,6 +8120,8 @@ bot.action(bindLeaveCurrentCallback, async (ctx) => {
     await ctx.answerCbQuery();
     await unbindThread(key);
 });
+// `/topic`'s buttons: patterns of their own (`topic_…`), disjoint from the `bind_<subdir>` regex below.
+registerTopicCallbacks();
 bot.action(/^bind_(.+)$/, async (ctx) => {
     const key = await authoriseContext(ctx);
     if (!key) {
@@ -8246,6 +8280,7 @@ registerClaudeAccountCallbacks();
 registerFallbackChainCallbacks();
 registerLimitsBoardCallbacks();
 registerSttCallbacks();
+registerSelfUpdateCallbacks();
 // «⏭ Skip once» on the `/limits` board and the `/limits_autoswitch` screen: drop THIS armed resume and
 // leave the on/off setting alone. The episode is identified by the `fireAt` baked
 // into the callback data, so an untouched older picker can never cancel a LATER
@@ -8568,32 +8603,38 @@ async function deliverActivePrompt(key, adapter, text, intake, sentAtMs, replyCo
     return outcome;
 }
 /**
- * @description Cancel a pending OpenCode question because the user sent free-form
- * input instead of answering it, then deliver that input as a fresh prompt. In
- * order: clear the bot's pending-question state, neutralize the stale buttons
- * message (edit it to a "cancelled" label so a late tap can't re-answer an
- * aborted question), abort the wedged OpenCode turn (`SIGINT` → `/session/:id/
- * abort`), post the "previous question cancelled" notice, then forward.
+ * @description Retire the on-screen state of a pending OpenCode question the user walked away from: clear the bot's
+ * pending-question state and neutralize the stale buttons message (edit it to a "cancelled" label so a late tap can't
+ * re-answer an aborted question). Closing the question on the server is the caller's, before it aborts the turn.
+ * Returns whether the buttons message itself was relabelled — it IS the cancellation notice then.
  *
- * The buttons-message edit runs through `runQuestionLifecycleOp` (same serializer
- * as the answer path) so it can't race a concurrent re-post-to-bottom. The
- * `messageId` + header are captured BEFORE clearing, since `clearPendingQuestion`
- * drops the state.
+ * The edit runs through `runQuestionLifecycleOp` (same serializer as the answer path) so it can't race a concurrent
+ * re-post-to-bottom. The `messageId` + header are captured BEFORE clearing, since `clearPendingQuestion` drops the state.
  */
-async function cancelPendingQuestionAndForward(key, adapter, text, sentAtMs, replyContext, requestHeader) {
+async function retirePendingQuestion(key) {
     const pending = pendingQuestions.get((0, sessionKey_1.keyToString)(key));
     const cancelledMessageId = pending?.messageId ?? null;
     const cancelledQuestion = pending?.data.questions[pending.currentIndex];
-    // Whether we relabel the on-screen question bubble itself to "❌ … cancelled"
-    // below. When we do, that IS the cancellation notice — a second standalone
-    // "previous question cancelled" line is pure noise (the reported triple
-    // message). The standalone notice is kept only for the no-bubble case.
-    const didLabelQuestionMessage = cancelledMessageId !== null && cancelledQuestion !== undefined;
     clearPendingQuestion(key);
-    if (cancelledMessageId !== null && cancelledQuestion) {
-        const header = cancelledQuestion.header || cancelledQuestion.question;
-        await runQuestionLifecycleOp(key, () => editThreadMessage(key, cancelledMessageId, (0, i18n_1.t)('agent.question_cancelled_msg_label', { header })));
-    }
+    if (cancelledMessageId === null || !cancelledQuestion)
+        return false;
+    const header = cancelledQuestion.header || cancelledQuestion.question;
+    await runQuestionLifecycleOp(key, () => editThreadMessage(key, cancelledMessageId, (0, i18n_1.t)('agent.question_cancelled_msg_label', { header })));
+    return true;
+}
+/**
+ * @description Cancel a pending OpenCode question because the user sent free-form
+ * input instead of answering it, then deliver that input as a fresh prompt. In
+ * order: retire the question's on-screen state ({@link retirePendingQuestion}),
+ * close it on the server, abort the wedged OpenCode turn (`SIGINT` → `/session/:id/
+ * abort`), post the "previous question cancelled" notice, then forward.
+ */
+async function cancelPendingQuestionAndForward(key, adapter, text, sentAtMs, replyContext, requestHeader) {
+    // When the question bubble itself was relabelled to "❌ … cancelled", that IS the
+    // cancellation notice — a second standalone "previous question cancelled" line is
+    // pure noise (the reported triple message). The standalone notice is kept only
+    // for the no-bubble case.
+    const didLabelQuestionMessage = await retirePendingQuestion(key);
     // Close the question on the OpenCode server too (not just the bot-local +
     // Telegram state above): an abandoned-but-still-open question keeps getting
     // re-found by `restoreOpenQuestion` (`GET /question` on every reattach) and
@@ -9954,6 +9995,7 @@ exports.COMMANDS_MENU = [
     { command: 'help', description: '❓ Context-aware help' },
     { command: 'doctor', description: '🔍 Self-diagnostics' },
     { command: 'bind', description: '📁 Bind thread to a subfolder' },
+    { command: 'topic', description: '🧵 New topic on a folder (name, then folder)' },
     { command: 'ls', description: '📂 List WORK_ROOT subfolders' },
     { command: 'list', description: '🧵 List all bound threads' },
     { command: 'mcp', description: '🔌 List active MCP servers' },
@@ -9981,6 +10023,7 @@ exports.COMMANDS_MENU = [
     { command: 'limits', description: '🚧 Usage limits — switch this topic' },
     { command: 'limits_autoswitch', description: '🔁 Automatic switching on a usage limit' },
     { command: 'stt', description: '🎙 Voice recognition: engines, language, local engine' },
+    { command: 'update', description: '🔄 Bot updates: automatic, notify only, off' },
     { command: 'schedule', description: '⏰ Schedule a prompt (agent does the work)' },
     { command: 'reminders', description: '🔔 Reminders — add, list, delete (no agent)' },
     { command: 'status', description: '📊 Show status' },
@@ -9996,7 +10039,8 @@ exports.COMMANDS_MENU = [
     { command: 'up', description: '⬆️ Arrow Up' },
     { command: 'down', description: '⬇️ Arrow Down' },
     { command: 'tab', description: '⇥ Tab' },
-    { command: 'esc', description: '⎋ Escape (interrupt / dismiss / cancel a pending login)' },
+    { command: 'interrupt', description: '⏹ Interrupt the running turn — the next message steers it (alias /esc)' },
+    { command: 'esc', description: '⎋ Escape (interrupt / dismiss / cancel a pending login; alias /interrupt)' },
     { command: 'y', description: '✅ Send "y"' },
     { command: 'n', description: '❌ Send "n"' },
     { command: 'c', description: '🛑 Ctrl+C' },
@@ -11055,6 +11099,66 @@ async function resolveBotAdminRights(groupId, botUserId) {
         return null;
     }
 }
+/**
+ * @description The General topic the updater talks in: the paired group's General when a group is paired, else the owner's DM
+ * General (`null` when neither exists — a Jira-only instance has no Telegram to say anything in).
+ */
+function getUpdateGeneralKey() {
+    const groupId = getAllowedGroupId();
+    if (groupId !== null)
+        return (0, sessionKeyCodec_1.makeTelegramKey)(groupId, threadRouting_1.GENERAL_THREAD_ID);
+    const ownerUserId = getOwnerUserId();
+    return Number.isFinite(ownerUserId) ? (0, sessionKeyCodec_1.makeTelegramKey)(ownerUserId, threadRouting_1.DM_GENERAL_THREAD_ID) : null;
+}
+/**
+ * @description Say an update message in General, worded in that chat's language: pinned when it asks the operator to act, with
+ * the install tap (the version printed on the button is the version it installs) when it offers one. A failed send or pin is
+ * logged — the updater never fails because Telegram did.
+ */
+async function postUpdateMessageToGeneral(message) {
+    if (!ENV.isTelegramServed)
+        return;
+    const generalKey = getUpdateGeneralKey();
+    if (generalKey === null) {
+        console.log(`[update] no General topic to post "${message.kind}" in`);
+        return;
+    }
+    const rendered = withThreadLocale(generalKey, () => (0, updateMessages_1.renderUpdateMessage)(message, (code, vars) => (0, i18n_1.t)(code, vars)));
+    const extra = rendered.buttons.length > 0
+        ? telegraf_1.Markup.inlineKeyboard(rendered.buttons.map((button) => [telegraf_1.Markup.button.callback(button.label, button.callbackData)]))
+        : {};
+    const messageId = await replyToThread(generalKey, rendered.text, extra);
+    if (messageId !== null && rendered.pin)
+        await pinMessageQuiet(generalKey, messageId, { disableNotification: false });
+}
+/**
+ * @description Whether the bot may be restarted now, from what it knows: no agent working in any bound topic (`checkIsWorking`, else
+ * `checkIsBusy`), no input an adapter has not taken in, nothing held in the startup buffer, no sign-in, no in-memory wizard or pasted
+ * key, and no human message within the quiet period. A sleeping or idle-but-alive session does not count: it survives the restart.
+ */
+function getUpdateIdleVerdict(isUserRequested) {
+    const keys = getServedBindings().map(({ key }) => key);
+    const isAnyAgentWorking = keys.some((key) => {
+        const adapter = (0, createAdapter_1.getThreadAdapter)(key);
+        return adapter.checkIsWorking ? adapter.checkIsWorking(key) : adapter.checkIsBusy?.(key) === true;
+    });
+    return (0, updatePolicy_1.getIdleVerdict)({
+        isAnyAgentWorking,
+        hasUnconsumedInput: keys.some((key) => (0, createAdapter_1.getThreadAdapter)(key).checkHasUnconsumedInput?.(key) === true),
+        hasBufferedStartupPrompt: startupPromptBuffer.checkIsAnyPending(),
+        isSignInRunning: checkIsAnyLoginInProgress(),
+        isWizardOpen: reminderWizards.size > 0 ||
+            awaitingFolderName.size > 0 ||
+            awaitingModelSelection.size > 0 ||
+            awaitingSessionSelection.size > 0 ||
+            pendingProviderConnects.size > 0 ||
+            checkIsAnySttInputAwaited(),
+        lastHumanMessageAt: lastHumanInboundAt,
+        now: Date.now(),
+        quietMs: constants_1.quietPeriodMs,
+        isUserRequested,
+    });
+}
 /**
  * @description Boot-time readiness status (plan 2026-07-12): on startup tell the
  * owner whether the bot can process messages, or list the setup steps still
@@ -11715,36 +11819,82 @@ async function startBot() {
     //    `stopOpenCodeServer()` or `adapter.stopSession()` here — tmux and
     //    opencode survive the bot process by design and are picked back up
     //    by `reattachExistingSessions` on the next boot.
+    // The ordered sequence is the same for a signal and for an update's restart; only what happens AFTER it differs
+    // (`exit` ends the process, the restart replaces it with a fresh image of the same install).
+    const runShutdown = (signal, exit) => (0, shutdown_1.gracefulShutdown)({
+        signal,
+        // Without Telegram there is no polling to stop, and `bot.stop` throws when it never launched.
+        bot: ENV.isTelegramServed ? bot : { stop: () => { } },
+        state,
+        releaseLock: instanceLock_1.releaseLock,
+        exit,
+        drainPendingUpdates: () => updateDispatcher.drainIdle(updateDrainTimeoutMs),
+        finalizePendingOutput: () => finalizePendingOutputOnShutdown(),
+        clearTransientFrames: () => sweepTransientFramesOnShutdown(),
+        // A hot worker's reload keeps the sidecar for the next worker to adopt; the supervisor stops it for good.
+        stopSidecars: (0, installManager_1.checkIsOpenCodeExternalHost)() ? undefined : () => sttOwner.stop(),
+        cleanupTimers: () => {
+            clearInterval(inMemoryGcInterval);
+            clearInterval(heartbeatInterval);
+            clearInterval(fileSweepInterval);
+            clearInterval(rateSummaryInterval);
+            // Scheduler (S8): clear every armed job timer; persisted nextRunAt
+            // means the next boot's rearmAll picks them back up (catch-up replay).
+            schedulerEngine?.shutdown();
+            requestWakeUpEngine?.stop();
+            jiraConnector?.stop();
+            if (isSchedulerMcpStarted)
+                void schedulerMcpHandle.stop().catch(() => { });
+            updateEngine?.stop();
+        },
+    });
     const shutdown = (signal) => {
-        void (0, shutdown_1.gracefulShutdown)({
-            signal,
-            // Without Telegram there is no polling to stop, and `bot.stop` throws when it never launched.
-            bot: ENV.isTelegramServed ? bot : { stop: () => { } },
-            state,
-            releaseLock: instanceLock_1.releaseLock,
-            exit: (code) => process.exit(code),
-            drainPendingUpdates: () => updateDispatcher.drainIdle(updateDrainTimeoutMs),
-            finalizePendingOutput: () => finalizePendingOutputOnShutdown(),
-            clearTransientFrames: () => sweepTransientFramesOnShutdown(),
-            // A hot worker's reload keeps the sidecar for the next worker to adopt; the supervisor stops it for good.
-            stopSidecars: (0, installManager_1.checkIsOpenCodeExternalHost)() ? undefined : () => sttOwner.stop(),
-            cleanupTimers: () => {
-                clearInterval(inMemoryGcInterval);
-                clearInterval(heartbeatInterval);
-                clearInterval(fileSweepInterval);
-                clearInterval(rateSummaryInterval);
-                // Scheduler (S8): clear every armed job timer; persisted nextRunAt
-                // means the next boot's rearmAll picks them back up (catch-up replay).
-                schedulerEngine?.shutdown();
-                requestWakeUpEngine?.stop();
-                jiraConnector?.stop();
-                if (isSchedulerMcpStarted)
-                    void schedulerMcpHandle.stop().catch(() => { });
-            },
-        });
+        void runShutdown(signal, (code) => process.exit(code));
     };
     process.once('SIGINT', () => shutdown('SIGINT'));
     process.once('SIGTERM', () => shutdown('SIGTERM'));
+    // 7b. Automatic updates (`src/selfUpdate/`): the engine finds a new version, installs it when nobody is using the bot and
+    //     restarts it in place — the same sequence as a signal, then `process.execve` with the launch environment.
+    const updateRuntime = await (0, updateRuntime_1.createUpdateRuntime)({
+        dataDir: path.dirname(state.stateFilePath),
+        packageRoot: path.resolve(__dirname, '..'),
+        execPath: process.execPath,
+        platform: process.platform,
+        nodeVersion: process.versions.node,
+        argv: process.argv,
+        isHotMode: (0, installManager_1.checkIsOpenCodeExternalHost)(),
+    });
+    const readUpdateSettings = (0, instanceSettings_1.createUpdateSettingsReader)(() => (0, instanceSettings_1.getInstanceSettingsPath)(), (line) => console.error(line));
+    updateEngine = (0, updateEngine_1.createUpdateEngine)({
+        ...updateRuntime,
+        now: () => Date.now(),
+        setTimer: (callback, delayMs) => {
+            const timer = setTimeout(callback, delayMs);
+            timer.unref();
+            return timer;
+        },
+        clearTimer: (handle) => clearTimeout(handle),
+        log: (line) => console.log(line),
+        getSettings: readUpdateSettings,
+        state: {
+            getRecord: () => state.getSelfUpdateRecord(),
+            setRecord: (record) => state.setSelfUpdateRecord(record),
+            getLastRun: () => state.getLastRunVersion(),
+            setLastRun: (lastRun) => state.setLastRunVersion(lastRun),
+        },
+        getIdleVerdict: getUpdateIdleVerdict,
+        postToGeneral: postUpdateMessageToGeneral,
+        restartInPlace: () => runShutdown('update', () => (0, restart_1.reexecProcess)(updateRuntime.reexecTarget, (0, launchEnvironment_1.getLaunchEnvironment)(), (0, restart_1.createDefaultReexecDeps)())),
+    });
+    const startUpdates = async () => {
+        try {
+            await updateEngine?.runBootStep();
+        }
+        catch (e) {
+            console.warn('[update] boot step failed:', e instanceof Error ? e.message : e);
+        }
+        updateEngine?.start();
+    };
     // 8. Launch. `dropPendingUpdates` follows the boot classifier: on a hot
     //    reload we KEEP the buffered backlog so a message typed during the
     //    ~1s reload window still routes to its live agent; on a cold start
@@ -11761,6 +11911,7 @@ async function startBot() {
     if (!ENV.isTelegramServed) {
         // No polling: the MCP server and the connector timers keep the process alive.
         console.log('[boot] running without Telegram (connectors: ' + [...ENV.servedPlatforms].join(', ') + ')');
+        await startUpdates();
         return;
     }
     try {
@@ -11769,6 +11920,7 @@ async function startBot() {
     catch (e) {
         console.warn('[startup-status] failed:', e instanceof Error ? e.message : e);
     }
+    await startUpdates();
     // The local speech engine: clean up after an earlier run, re-attach to / start its install. Starts no process.
     void bootSttLocalEngine().catch((e) => console.warn('[STT] boot step failed:', e instanceof Error ? e.message : e));
     console.log(`Launching Telegraf bot (long polling, dropPendingUpdates=${bootMode.dropPendingUpdates})...`);