charness 3.3.2 → 3.5.0

package/dist/bot.js

@@ -34,7 +34,6 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMMANDS_MENU = exports.telegramInbound = exports.routedCommandTriggerDeps = void 0;
-exports.buildBindKeyboard = buildBindKeyboard;
 exports.getStartReadyMessage = getStartReadyMessage;
 exports.checkIsRoutedCommand = checkIsRoutedCommand;
 exports.handleRoutedCommandMessage = handleRoutedCommandMessage;
@@ -84,6 +83,8 @@ const timezone_1 = require("./utils/timezone");
 const timezonePicker_1 = require("./connectors/telegram/timezonePicker");
 const timezoneRecompute_1 = require("./scheduler/timezoneRecompute");
 const validation_1 = require("./validation");
+const bindPicker_1 = require("./connectors/telegram/bindPicker");
+const topicCommand_1 = require("./connectors/telegram/commands/topicCommand");
 const providerDisconnectPlan_1 = require("./utils/providerDisconnectPlan");
 const folderName_1 = require("./folderName");
 const threadRouting_1 = require("./threadRouting");
@@ -157,6 +158,13 @@ const claudeLivenessAction_1 = require("./utils/claudeLivenessAction");
 const isoTimestamp_1 = require("./utils/isoTimestamp");
 const effortLevels_1 = require("./effortLevels");
 const instanceSettings_1 = require("./instanceSettings");
+const constants_1 = require("./selfUpdate/constants");
+const launchEnvironment_1 = require("./selfUpdate/launchEnvironment");
+const restart_1 = require("./selfUpdate/restart");
+const updateEngine_1 = require("./selfUpdate/updateEngine");
+const updateMessages_1 = require("./selfUpdate/updateMessages");
+const updatePolicy_1 = require("./selfUpdate/updatePolicy");
+const updateRuntime_1 = require("./selfUpdate/updateRuntime");
 const threadContextPreamble_1 = require("./threadContextPreamble");
 const pinnedBannerSkipDecision_1 = require("./utils/pinnedBannerSkipDecision");
 const replyQuote_1 = require("./utils/replyQuote");
@@ -207,6 +215,8 @@ const claudeUsageRefresher_1 = require("./utils/claudeUsageRefresher");
 const openCodeUsage_1 = require("./utils/openCodeUsage");
 const usageRefreshBudget_1 = require("./utils/usageRefreshBudget");
 const claudeLimitSwitch_1 = require("./utils/claudeLimitSwitch");
+const anthropicApiKeyCheck_1 = require("./utils/anthropicApiKeyCheck");
+const claudeApiKeyHelper_1 = require("./utils/claudeApiKeyHelper");
 const fallbackSwitchNotice_1 = require("./utils/fallbackSwitchNotice");
 const adapterSwitchSessionIds_1 = require("./utils/adapterSwitchSessionIds");
 const fallbackChain_1 = require("./utils/fallbackChain");
@@ -216,7 +226,10 @@ const limitsBoard_1 = require("./connectors/telegram/commands/limitsBoard");
 const backendSwitch_1 = require("./connectors/telegram/commands/backendSwitch");
 const operatorSwitchPlan_1 = require("./utils/operatorSwitchPlan");
 const backendSwitchPlan_1 = require("./utils/backendSwitchPlan");
+const selfUpdate_1 = require("./connectors/telegram/commands/selfUpdate");
 const stt_1 = require("./connectors/telegram/commands/stt");
+const claudeApiSpend_1 = require("./utils/claudeApiSpend");
+const claudeProfileUsageLines_1 = require("./utils/claudeProfileUsageLines");
 const resolveBinary_1 = require("./utils/resolveBinary");
 // ═══════════════════════════════════════════════════════════════════════════════
 //  ENV parsing & fatal validation
@@ -595,6 +608,18 @@ bot.use(async (ctx, next) => {
     });
     return next();
 });
+/**
+ * Epoch ms of the last update a human sent (a message, a button tap), `null` since the start. The updater restarts the bot only
+ * after a quiet period (`quietPeriodMs`) — somebody typing right now is the one case it must not interrupt.
+ */
+let lastHumanInboundAt = null;
+bot.use(async (ctx, next) => {
+    if (ctx.message || ctx.callbackQuery)
+        lastHumanInboundAt = Date.now();
+    return next();
+});
+/** The update engine of this process; built at boot (`startBot`), read by the `/update` command. */
+let updateEngine = null;
 // Locale is a Telegram-chat concern, not a process env knob. Every update runs
 // inside an async i18n context: explicit `/language` override for the DM/group
 // wins, else this sender's Telegram `language_code`, else the last seen Telegram
@@ -856,6 +881,12 @@ const limitResumeNoticePinnedMessageId = new Map();
  * Cleared by {@link cancelApiRetry} (the user took over / the session went away).
  */
 const autoContinueOffNoticedThreads = new Set();
+/**
+ * @description Threads that already got the «API credits used up» notice for the CURRENT episode
+ * ({@link handleBalanceExhausted}): that flow arms no retry either, so — like the OFF notice above — a repeated frame
+ * of the same error needs its own guard. Cleared by {@link cancelApiRetry} (the user took over / the session went away).
+ */
+const balanceExhaustedNoticedThreads = new Set();
 /**
  * The OPEN «switch» offer per thread (`utils/fallbackChain.ts`): the limit episode the buttons on the notice
  * were posted for, the rung the topic was on and the candidate list the buttons index into. A tap is honoured
@@ -1121,6 +1152,11 @@ const wedgeRecoveriesInFlight = new Set();
  */
 function handleApiError(key, cls, options = {}) {
     const k = (0, sessionKey_1.keyToString)(key);
+    // A used-up API credit balance: no wait refills it — the account is marked, and the chain or the operator takes over.
+    if (cls.kind === 'usageLimit' && cls.isBalanceExhausted === true) {
+        void handleBalanceExhausted(key, cls);
+        return;
+    }
     // An unconfirmed usage limit is probed first; it reaches the wait below only once confirmed.
     if (cls.kind === 'usageLimit' && cls.isUnconfirmed === true && handleUnconfirmedLimit(key))
         return;
@@ -1215,7 +1251,7 @@ function armApiRetryTimer(key, arming) {
     // bottom (debounced; no-op when no question is pending).
     onThreadActivityWhileQuestionPending(key);
     void state
-        .setApiRetry(key, { kind: arming.kind, attempt: arming.attempt, fireAt: arming.fireAt, ...(arming.isLimitProbe ? { isLimitProbe: true } : {}) })
+        .setApiRetry(key, { kind: arming.kind, attempt: arming.attempt, fireAt: arming.fireAt, ...(arming.isLimitProbe ? { isLimitProbe: true } : {}), ...(arming.resumeOn ? { resumeOn: arming.resumeOn } : {}) })
         .catch(e => console.error('[apiRetry] persist failed:', e));
     clearSavedFiredLimitProbe(key);
     const timer = setTimeout(() => {
@@ -1231,6 +1267,7 @@ function armApiRetryTimer(key, arming) {
         fireAt: arming.fireAt,
         limitWait: arming.limitWait,
         isLimitProbe: arming.isLimitProbe,
+        resumeOn: arming.resumeOn,
     });
 }
 /**
@@ -1422,15 +1459,90 @@ async function announceUsageLimitOrSwitch(key, cls, episodeId, initialWait, atte
         }
     }
     const texts = getLimitWaitTexts(key, wait, attempt, resumeOn);
-    const keyboard = plan.action === 'offer'
-        ? telegraf_1.Markup.inlineKeyboard(plan.candidates.map((entry, index) => [
-            telegraf_1.Markup.button.callback((0, i18n_1.t)('fallback.switchButton', { label: formatFallbackEntry(entry) }), (0, fallbackChain_1.buildFallbackSwitchCallbackData)(episodeId, index)),
-        ]))
-        : undefined;
+    const keyboard = plan.action === 'offer' ? buildFallbackSwitchKeyboard(episodeId, plan.candidates) : undefined;
     const { isPlainNoticePosted } = await announceLimitWait(key, wait, texts, isPlainNoticeDue, keyboard);
     if (keyboard && !isPlainNoticePosted)
         await replyToThread(key, (0, i18n_1.t)('fallback.switchOffer'), keyboard);
 }
+/** The «🔁 Switch to …» buttons of a limit episode's notice, one per candidate (best first; the index is into that episode's list). */
+function buildFallbackSwitchKeyboard(episodeId, candidates) {
+    return telegraf_1.Markup.inlineKeyboard(candidates.map((entry, index) => [
+        telegraf_1.Markup.button.callback((0, i18n_1.t)('fallback.switchButton', { label: formatFallbackEntry(entry) }), (0, fallbackChain_1.buildFallbackSwitchCallbackData)(episodeId, index)),
+    ]));
+}
+/** Whose API credits a balance notice names: a Claude account `«console»`, an OpenCode `provider/model`. */
+function formatBalanceOwner(from) {
+    if (from === null)
+        return (0, i18n_1.t)('fallback.backendClaude');
+    return from.backend === 'claude' ? `«${from.profile}»` : (0, fallbackChain_1.buildOpenCodeModelLabel)(from);
+}
+/**
+ * @description A used-up API credit balance on `key` («Credit balance is too low», `isBalanceExhausted`): nothing resets
+ * it, so no wait for a reset is armed and no hourly retry runs. The Claude account is marked out of credits
+ * (`creditExhaustedAt`, until the operator picks it or signs it in again, or a billed turn on it goes through), the parked
+ * episode is settled (a restart does not run this again), and the fallback chain decides as for a limit, with that
+ * account out: switching ON moves the topic at once; OFF puts «switch to …» buttons on the notice. With no rung free
+ * now, the topic waits only for a rung that comes back at a KNOWN time (the earliest reset, and only with «wait for
+ * reset» on) and resumes there; otherwise the notice is all, and an open request is answered and no longer woken. A
+ * repeat of the same episode (another frame, another scrape of the line, a scheduled run into the same balance) says
+ * nothing in the topic again; a request opened since — a scheduled run's — is still answered and no longer woken, unless
+ * a wait for another rung's reset is armed.
+ */
+async function handleBalanceExhausted(key, cls) {
+    const k = (0, sessionKey_1.keyToString)(key);
+    markLimitEpisodeSettled(key);
+    const position = getTopicFallbackPosition(key);
+    if (position?.backend === 'claude')
+        state.setClaudeProfileCreditExhausted(position.profile, new Date().toISOString());
+    const notice = `${(0, i18n_1.t)('apiRetry.balanceExhaustedNotice', { name: formatBalanceOwner(position) })}${getBalanceSpentLine(position)}`;
+    const texts = { plainNotice: notice, answerBody: (0, i18n_1.t)('requests.limit.answerBalanceExhaustedNotice') };
+    const stopped = { kind: 'autoResumeOff' };
+    if (balanceExhaustedNoticedThreads.has(k)) {
+        // Like the «wait for reset» OFF repeat: without it the wake-up engine re-prods that request into the same refused
+        // balance and ends in an alert.
+        if (getArmedApiRetry(key) === null)
+            await announceLimitWait(key, stopped, texts, false);
+        return;
+    }
+    balanceExhaustedNoticedThreads.add(k);
+    const episodeId = Date.now();
+    let plan = { action: 'none', from: position, earliest: null };
+    try {
+        plan = await planFallbackSwitch(key, cls, episodeId);
+    }
+    catch (e) {
+        console.warn(`[fallback] ${k}: the switch plan after a used-up balance failed:`, e instanceof Error ? e.message : e);
+    }
+    if (plan.action === 'auto') {
+        const to = plan.to;
+        await replyToThread(key, notice);
+        const outcome = await switchTopicToFallbackEntry(key, plan.from, to, { isAnnounced: true }).catch((e) => {
+            console.warn(`[fallback] ${k}: the auto-switch to ${formatFallbackEntry(to)} failed:`, e instanceof Error ? e.message : e);
+            return { isSwitched: false };
+        });
+        // The notice is already in the topic; an open request still hears that the work stopped.
+        if (!outcome.isSwitched)
+            await announceLimitWait(key, stopped, texts, false);
+        return;
+    }
+    if (plan.action === 'offer') {
+        const keyboard = buildFallbackSwitchKeyboard(episodeId, plan.candidates);
+        const { isPlainNoticePosted } = await announceLimitWait(key, stopped, texts, true, keyboard);
+        if (!isPlainNoticePosted)
+            await replyToThread(key, (0, i18n_1.t)('fallback.switchOffer'), keyboard);
+        return;
+    }
+    if (plan.earliest && state.checkIsAutoContinueOnLimitEnabled(key)) {
+        const fireAt = plan.earliest.untilMs + apiErrorRetry_1.resetBufferMs;
+        const wait = { kind: 'afterReset', resetAt: plan.earliest.untilMs, fireAt };
+        clearLimitResumeNotice(key);
+        armApiRetryTimer(key, { kind: 'usageLimit', attempt: 1, fireAt, delayMs: Math.max(fireAt - Date.now(), 0), limitWait: wait, resumeOn: plan.earliest.entry });
+        const waitTexts = getLimitWaitTexts(key, wait, 1, plan.earliest.entry);
+        await announceLimitWait(key, wait, { plainNotice: `${notice}\n\n${waitTexts.plainNotice}`, answerBody: waitTexts.answerBody }, true);
+        return;
+    }
+    await announceLimitWait(key, stopped, texts, true);
+}
 /**
  * @description Re-aim the ARMED usage-limit wait of `key` at the rung that comes back first: the timer moves to
  * that rung's reset (+ the usual buffer), and the persisted retry record carries the rung (`resumeOn`), so the
@@ -1529,6 +1641,7 @@ function cancelApiRetry(key) {
     // error — so neither can re-notify per message.
     clearLimitResumeNotice(key);
     autoContinueOffNoticedThreads.delete(k);
+    balanceExhaustedNoticedThreads.delete(k);
     fallbackSwitchOffers.delete(k);
     // NOTE: intentionally does NOT touch the logged-out notice. `cancelApiRetry`
     // fires on EVERY inbound message (user takeover); clearing the auth notice here
@@ -1720,13 +1833,16 @@ function clearLimitResumeNotice(key) {
  * sign-in driver built here), so the driver reaches it through this late-bound slot.
  */
 let claudeProfileAuthStatusSink = null;
+/** Where an API key pasted into an API account's sign-in goes: the `/account` module too, through the same late-bound idiom. */
+let claudeProfileApiKeySink = null;
 // Out-of-band sign-in drivers (`/login`, `/connect` OAuth): `agentLogin/README.md`.
-const { cancelPendingLogin, checkIsAuthLoginAwaitingCode, cancelClaudeAuthLogin, startClaudeAuthLogin, submitClaudeAuthLoginCode, checkIsOpenCodeOAuthAwaitingReply, cancelOpenCodeOAuthLogin, startOpenCodeOAuthLogin, submitOpenCodeOAuthReply, } = (0, agentLogin_1.createAgentLogin)({
+const { cancelPendingLogin, checkIsAuthLoginAwaitingCode, cancelClaudeAuthLogin, startClaudeAuthLogin, submitClaudeAuthLoginCode, checkIsOpenCodeOAuthAwaitingReply, cancelOpenCodeOAuthLogin, startOpenCodeOAuthLogin, submitOpenCodeOAuthReply, checkIsAnyLoginInProgress, } = (0, agentLogin_1.createAgentLogin)({
     replyToThread,
     deleteThreadMessage,
     clearAuthNotice,
     execFileAsync,
     onClaudeProfileAuthStatus: (key, profile, status) => claudeProfileAuthStatusSink?.(key, profile, status) ?? Promise.resolve(),
+    onClaudeProfileApiKey: (key, profile, apiKey) => claudeProfileApiKeySink?.(key, profile, apiKey) ?? Promise.resolve((0, i18n_1.t)('account.apiKeyNoDirectory', { name: profile.name })),
 });
 /**
  * @description Buffers prompts typed while an agent session is still booting so
@@ -3466,8 +3582,6 @@ function getWorkDirStartDecision(key) {
 // `validateSubdir` + `BindError` live in `src/validation.ts` so the
 // security-critical bits can be unit-tested without booting Telegraf
 // (plan §11 Этап 7, R3). The import at the top of this file pulls them in.
-/** Inline-keyboard page size for `/bind`. 20 fits one phone screen comfortably. */
-const BIND_PAGE_SIZE = 20;
 /**
  * @description List immediate subdirectories of `WORK_ROOT` for the `/bind`
  * inline-button picker and the `forum_topic_created` welcome message.
@@ -3519,71 +3633,6 @@ function listAvailableSubdirs(workRoot, limit = 200) {
     subdirCache.set(cacheKey, { value: result, ts: Date.now() });
     return result;
 }
-/**
- * @description Build a `subdir`-suggestion keyboard for `/bind` and friends.
- *
- * Lists are paginated at {@link BIND_PAGE_SIZE} entries: a `WORK_ROOT` with
- * many subfolders (mono-repo workspace, packages dir, etc.) would otherwise
- * push the inline keyboard past Telegram's per-message height limit and
- * lose entries below the fold.
- *
- * The nav row appears only when there's more than one page. The middle
- * `pageLabel` button is a no-op (`bind_page_noop` callback) — it exists
- * solely so the user sees "2/5" without us having to fake a divider with
- * a separate message.
- *
- * Subdirs whose callback_data exceeds 64 bytes are filtered out upstream
- * in `listAvailableSubdirs`. `page` is clamped to a valid index so a stale
- * callback (folders disappeared since the keyboard was sent) just lands
- * on the last available page.
- *
- * When `isBound` the FIRST row is a full-width «leave current dir» button
- * (`bindLeaveCurrentCallback`, the folded-in `/unbind`); the «create new folder»
- * button (`bindCreateFolderCallback`) follows. Both callbacks deliberately do
- * NOT start with `bind_`, so they can't be mistaken for a folder pick by the
- * `bind_<subdir>` action regex. They ride on every page so they're reachable
- * regardless of pagination.
- */
-const bindCreateFolderCallback = 'bindCreateFolder';
-/**
- * «Leave current dir» button — the folded-in `/unbind`. Like
- * `bindCreateFolderCallback`, the callback id deliberately does NOT start with
- * `bind_`, so the `bind_<subdir>` action regex can't mistake it for a folder
- * pick. Only rendered in a bound topic.
- */
-const bindLeaveCurrentCallback = 'bindLeaveCurrent';
-function buildBindKeyboard(subdirs, page = 0, pageSize = BIND_PAGE_SIZE, isBound = false) {
-    const { slice, currentPage, totalPages } = (0, validation_1.paginateBindList)(subdirs, page, pageSize);
-    const rows = [
-        [telegraf_1.Markup.button.callback((0, i18n_1.t)('bind.create_button'), bindCreateFolderCallback)],
-    ];
-    // A bound topic gets a full-width «leave current dir» row PREPENDED above the
-    // «create new folder» row — this is the folded-in `/unbind`. Its callback
-    // deliberately avoids the `bind_` prefix so the `bind_<subdir>` action regex
-    // can't catch it. The row is omitted when unbound (nothing to leave).
-    if (isBound) {
-        rows.unshift([telegraf_1.Markup.button.callback((0, i18n_1.t)('bind.leave_button'), bindLeaveCurrentCallback)]);
-    }
-    for (let i = 0; i < slice.length; i += 2) {
-        const row = [telegraf_1.Markup.button.callback(`📁 ${slice[i]}`, `bind_${slice[i]}`)];
-        if (slice[i + 1]) {
-            row.push(telegraf_1.Markup.button.callback(`📁 ${slice[i + 1]}`, `bind_${slice[i + 1]}`));
-        }
-        rows.push(row);
-    }
-    if (totalPages > 1) {
-        const nav = [];
-        if (currentPage > 0) {
-            nav.push(telegraf_1.Markup.button.callback('⬅️ Prev', `bind_page_${currentPage - 1}`));
-        }
-        nav.push(telegraf_1.Markup.button.callback(`${currentPage + 1}/${totalPages}`, 'bind_page_noop'));
-        if (currentPage < totalPages - 1) {
-            nav.push(telegraf_1.Markup.button.callback('Next ➡️', `bind_page_${currentPage + 1}`));
-        }
-        rows.push(nav);
-    }
-    return telegraf_1.Markup.inlineKeyboard(rows);
-}
 /**
  * @description Bot-level wrapper around the pure sweep helper in
  * `createAdapter.ts`. Binds the production adapter resolver so callers
@@ -4495,6 +4544,13 @@ const { checkIsThreadCompacting, noteThreadActivity, noteThreadUserActivity, mar
 function checkIsRoutedCommand(name) {
     return commandRouter.checkIsRegistered(name);
 }
+/** `/esc` and its other names: the interrupt, which also cancels a pending sign-in or `/topic` prompt first. */
+const escapeCommandNames = ['esc', 'escape', 'interrupt'];
+/** @description Whether `messageText` is one of the {@link escapeCommandNames} (`@botmention` tolerated). */
+function checkIsEscapeCommandText(messageText) {
+    const [commandToken = ''] = (0, utils_1.stripCommandBotMention)(messageText.trim()).split(/\s+/, 1);
+    return escapeCommandNames.includes(commandToken.replace(/^\//, '').toLowerCase());
+}
 /**
  * @description Running ANY command exits the single-purpose input modes an
  * earlier command armed:
@@ -4503,6 +4559,7 @@ function checkIsRoutedCommand(name) {
  *    it afterwards via its own callback);
  *  - `/connect`'s pending provider connect — cancelled out loud, unless the
  *    command IS another `/connect` (which continues the flow);
+ *  - `/topic`'s pending name prompts (the topic's, the new folder's) — but `/esc`, which cancels them with a notice of its own;
  *  - an in-flight `/reminders` wizard, at whatever step. Unconditional rather
  *    than only during the step-4 text wait: that is what makes a repeat
  *    `/reminders` retire the previous wizard (relabelling its message) instead
@@ -4512,6 +4569,9 @@ function checkIsRoutedCommand(name) {
 async function exitPendingInputModes(key, messageText) {
     const keyString = (0, sessionKey_1.keyToString)(key);
     awaitingFolderName.delete(keyString);
+    // `/topic`'s name prompts end silently, except for `/esc`, which cancels them out loud in its own handler.
+    if (!checkIsEscapeCommandText(messageText))
+        cancelTopicInput(key);
     const hadPendingProviderConnect = pendingProviderConnects.delete(keyString);
     if (hadPendingProviderConnect && !(0, recvPreviewRedaction_1.checkIsConnectCommandText)(messageText)) {
         await replyToThread(key, (0, i18n_1.t)('connect.cancelled'));
@@ -4892,6 +4952,8 @@ function armFolderCreation(key) {
     const kStr = (0, sessionKey_1.keyToString)(key);
     awaitingModelSelection.delete(kStr);
     awaitingSessionSelection.delete(kStr);
+    // The `/topic` prompts are other readers of the next plain message.
+    cancelTopicInput(key);
     // A stale pending question would otherwise consume the message AFTER the
     // folder name as an answer to the old (pre-rebind) agent question.
     clearPendingQuestion(key);
@@ -4909,21 +4971,18 @@ function mapNewFolderError(reason) {
     }
 }
 /**
- * @description Create a new folder under WORK_ROOT from a user-typed name and
- * bind the thread to it. Validates the name first (no traversal/slashes/dots),
- * then `mkdir` (recursive: an already-existing folder is fine — we just bind
- * to it and tell the user), then routes through `applyBinding` for the same
- * containment/symlink defence + welcome stack the picker uses.
- *
- * Returns `{ ok }` so the caller knows whether to disarm the await-name mode:
- * an invalid name keeps the thread armed for a retry; success or a real
- * filesystem failure disarms it.
+ * @description Create a new folder under WORK_ROOT from a user-typed name:
+ * validate the name first (no traversal/slashes/dots), then `mkdir` (recursive:
+ * an already-existing folder is fine — the caller just uses it, and the topic is
+ * told so). A refusal or a filesystem failure is reported to `key`'s topic here;
+ * the outcome says which, so the caller knows whether a retry is still wanted
+ * (`invalid`) or not (`failed`).
  */
-async function createAndBindFolder(key, rawName) {
+async function createWorkFolder(key, rawName) {
     const validated = (0, folderName_1.validateNewFolderName)(rawName);
     if (!validated.ok) {
         await replyToThread(key, mapNewFolderError(validated.reason));
-        return { ok: false };
+        return { outcome: 'invalid' };
     }
     const targetPath = path.join(ENV.workRoot, validated.name);
     const alreadyExisted = fs.existsSync(targetPath);
@@ -4934,7 +4993,7 @@ async function createAndBindFolder(key, rawName) {
         await replyToThread(key, (0, i18n_1.t)('bind.create_failed', {
             error: e instanceof Error ? e.message : String(e),
         }));
-        return { ok: true };
+        return { outcome: 'failed' };
     }
     // Folder freshly on disk → the cached subdir list is stale; drop it so the
     // next picker render includes the new folder.
@@ -4942,12 +5001,43 @@ async function createAndBindFolder(key, rawName) {
     if (alreadyExisted) {
         await replyToThread(key, (0, i18n_1.t)('bind.create_exists', { subdir: validated.name }));
     }
-    const result = await applyBinding(key, validated.name);
+    return { outcome: 'ready', subdir: validated.name };
+}
+/**
+ * @description Create a new folder under WORK_ROOT from a user-typed name and
+ * bind the thread to it ({@link createWorkFolder}), routing through
+ * `applyBinding` for the same containment/symlink defence + welcome stack the
+ * picker uses.
+ *
+ * Returns `{ ok }` so the caller knows whether to disarm the await-name mode:
+ * an invalid name keeps the thread armed for a retry; success or a real
+ * filesystem failure disarms it.
+ */
+async function createAndBindFolder(key, rawName) {
+    const folder = await createWorkFolder(key, rawName);
+    if (folder.outcome === 'invalid')
+        return { ok: false };
+    if (folder.outcome === 'failed')
+        return { ok: true };
+    const result = await applyBinding(key, folder.subdir);
     await replyToThread(key, result.message);
     if (result.ok)
         await sendBindingWelcome(key, result.subdir);
     return { ok: true };
 }
+/**
+ * @description Bind a topic the bot has just created (`/topic`) to `subdir` and greet it with the usual binding welcome:
+ * the folder's stats and the start buttons. No agent starts by itself: it is started there as in any bound topic. The binding's own notice
+ * is left out: its warning about other topics on the folder would warn of what the person just asked for. The topic's name
+ * rides on the binding for the thread-context preamble. Resolves why it could not bind, `null` once it is bound.
+ */
+async function bindNewTopic(key, subdir, topicName) {
+    const result = await applyBinding(key, subdir, { topicName });
+    if (!result.ok)
+        return result.message;
+    await sendBindingWelcome(key, result.subdir);
+    return null;
+}
 command('bind', async (_ctx, key, parsed) => {
     if (checkIsGeneral(key)) {
         await replyToThread(key, (0, i18n_1.t)('bind.in_general'));
@@ -4971,7 +5061,7 @@ command('bind', async (_ctx, key, parsed) => {
         // «create new folder» button, which is the only way to bootstrap a folder
         // from an empty WORK_ROOT without the slash form. When already bound it
         // also carries the «leave current dir» button (the folded-in /unbind).
-        await replyToThread(key, usage, buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!binding));
+        await replyToThread(key, usage, (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!binding));
         return;
     }
     const result = await applyBinding(key, arg);
@@ -5158,26 +5248,27 @@ async function getCliVersion(cmd, args = ['--version']) {
     }
 }
 command('version', async (_ctx, key) => {
-    // Read our own version from package.json so we don't drift if it ever bumps
-    // again without us updating a hardcoded string here.
-    let botVersion = (0, i18n_1.t)('version.unknown');
-    try {
-        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
-        botVersion = pkg.version || botVersion;
-    }
-    catch { /* fall through to unknown */ }
+    // The version this process STARTED as, read once at boot by the updater's runtime: an in-place install rewrites package.json
+    // under a running bot, and the new number must not show before the restart that makes it true.
+    const updateStatus = updateEngine?.getStatus();
+    const botVersion = updateStatus?.running.version ?? (0, i18n_1.t)('version.unknown');
+    const offer = updateStatus?.offer;
+    const availableUpdate = offer && offer.action !== 'skipped' && offer.action !== 'needsNode' ? offer.target : null;
     const [tmuxV, claudeV, opencodeV] = await Promise.all([
         getCliVersion('tmux', ['-V']),
         getCliVersion('claude'),
         getCliVersion('opencode'),
     ]);
-    await replyToThread(key, (0, i18n_1.t)('version.report', {
+    const report = (0, i18n_1.t)('version.report', {
         bot: botVersion,
         node: process.version,
         tmux: tmuxV,
         claude: claudeV,
         opencode: opencodeV,
-    }), { parse_mode: 'Markdown' });
+    });
+    await replyToThread(key, availableUpdate === null ? report : `${report}\n${(0, i18n_1.t)('version.updateAvailable', { version: availableUpdate })}`, {
+        parse_mode: 'Markdown',
+    });
 });
 command('whoami', async (ctx, key) => {
     const userId = ctx.from?.id ?? 0;
@@ -5246,7 +5337,7 @@ command('help', async (_ctx, key) => {
     const binding = state.getBinding(key);
     if (!binding) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await replyToThread(key, (0, i18n_1.t)('help.thread_unbound'), {
             parse_mode: 'Markdown',
             ...(extra ?? {}),
@@ -5591,7 +5682,7 @@ async function handleAgentStart(key, adapterName, args) {
     // natural-language path in the text handler (plan §11 Этап 4).
     if (!state.getBinding(key)) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
         return;
     }
@@ -5777,14 +5868,19 @@ function resolveThreadClaudeConfigDir(key) {
     }
     return dir;
 }
-/** `claude auth status --json` under `configDir` (`null` = `~/.claude`), the subscription login only; `null` when the probe fails. */
+/**
+ * `claude auth status --json` under `configDir` (`null` = `~/.claude`) as its sessions see it: never through an
+ * `ANTHROPIC_API_KEY` of the bot's own, with the `apiKeyHelper` of a profile that holds a pasted API key; `null` when
+ * the probe fails.
+ */
 async function readClaudeAuthStatusUnder(configDir) {
     const env = { ...process.env };
     delete env.ANTHROPIC_API_KEY;
     if (configDir !== null)
         env[claudeProfiles_1.claudeConfigDirVariableName] = configDir;
     try {
-        const { stdout } = await execFileAsync((0, resolveBinary_1.resolveClaudeBinary)(), ['auth', 'status', '--json'], { timeout: claudeAuthStatusProbeTimeoutMs, env });
+        const args = [...(0, claudeApiKeyHelper_1.buildClaudeAuthProbeSettingsArgs)(configDir), 'auth', 'status', '--json'];
+        const { stdout } = await execFileAsync((0, resolveBinary_1.resolveClaudeBinary)(), args, { timeout: claudeAuthStatusProbeTimeoutMs, env });
         return (0, claudeProfiles_1.parseClaudeAuthStatus)(stdout);
     }
     catch (e) {
@@ -5847,9 +5943,12 @@ const openCodeUsagePoller = (0, openCodeUsage_1.createOpenCodeUsagePoller)({
  */
 const claudeUsageRefresher = (0, claudeUsageRefresher_1.createClaudeUsageRefresher)({
     listProfiles: () => [
-        { name: claudeProfiles_1.defaultClaudeProfileName, configDir: null, loggedIn: state.getClaudeProfileInfo(claudeProfiles_1.defaultClaudeProfileName)?.loggedIn },
+        {
+            name: claudeProfiles_1.defaultClaudeProfileName, configDir: null,
+            loggedIn: state.getClaudeProfileInfo(claudeProfiles_1.defaultClaudeProfileName)?.loggedIn, billing: state.getClaudeProfileInfo(claudeProfiles_1.defaultClaudeProfileName)?.billing,
+        },
         ...Object.entries(state.getClaudeProfileRecords()).map(([name, record]) => ({
-            name, configDir: (0, claudeProfiles_1.resolveClaudeProfileDir)((0, state_1.resolveDataDir)(), name), loggedIn: record.loggedIn,
+            name, configDir: (0, claudeProfiles_1.resolveClaudeProfileDir)((0, state_1.resolveDataDir)(), name), loggedIn: record.loggedIn, billing: record.billing,
         })),
     ],
     getSnapshot: (name) => state.getClaudeProfileInfo(name)?.usage,
@@ -5885,6 +5984,27 @@ function onClaudeRateLimitEvent(configDir, event) {
         state.setClaudeProfileLimitedUntil(name, null);
     }
 }
+/**
+ * A json-stream turn's cost (`utils/claudeApiSpend.ts`): the topic's conversation baseline moves on for EVERY account
+ * (a later API turn of the same conversation must count only itself), and the turn's spend adds to the account's only
+ * when it is billed to API credits. A billed turn that went through ends a used-up-credits mark on whatever account it
+ * ran on: the balance is back.
+ */
+function onClaudeTurnCost(key, configDir, report) {
+    const turnCostUsd = (0, claudeApiSpend_1.computeClaudeTurnCostUsd)({ previous: state.getClaudeCostBaseline(key), ...report });
+    state.setClaudeCostBaseline(key, { sessionId: report.sessionId, totalCostUsd: report.totalCostUsd });
+    const name = resolveClaudeProfileNameForDir(configDir);
+    if (name === null)
+        return;
+    const info = state.getClaudeProfileInfo(name);
+    const outcome = (0, claudeApiSpend_1.getClaudeTurnCostOutcome)({
+        billing: info?.billing ?? null, isCreditExhausted: info?.creditExhaustedAt !== undefined, isError: report.isError, turnCostUsd,
+    });
+    if (outcome.isCreditMarkCleared)
+        state.setClaudeProfileCreditExhausted(name, null);
+    if (outcome.spendUsd !== null)
+        state.setClaudeProfileApiSpend(name, (0, claudeApiSpend_1.addClaudeApiSpend)(info?.apiSpend, outcome.spendUsd, new Date().toISOString()));
+}
 /** The model a topic's Claude session runs (or last ran), for the usage ranking's choice of windows. */
 function getThreadClaudeModel(key) {
     return (0, createAdapter_1.getThreadAdapter)(key).getCurrentModel?.(key) ?? state.getAgent(key)?.model ?? null;
@@ -5892,7 +6012,10 @@ function getThreadClaudeModel(key) {
 /** What `/status` names of a Claude profile: its last probed sign-in and email, and its limit mark (none until probed). */
 function readStatusAccountSource(name) {
     const info = state.getClaudeProfileInfo(name);
-    return { name, email: info?.email ?? null, loggedIn: info?.loggedIn, limitedUntil: info?.limitedUntil ?? null };
+    return {
+        name, email: info?.email ?? null, loggedIn: info?.loggedIn, limitedUntil: info?.limitedUntil ?? null,
+        billing: info?.billing ?? null, creditExhaustedAt: info?.creditExhaustedAt ?? null, ...(info?.apiSpend ? { apiSpend: info.apiSpend } : {}),
+    };
 }
 /** Whether the topic's agent is a Claude backend (a usage limit there is a limit of its account profile). */
 function checkIsClaudeProfileBackend(key) {
@@ -5991,13 +6114,15 @@ async function planFallbackSwitch(key, cls, episodeId) {
     const nowMs = Date.now();
     const resetAtMs = cls.kind === 'usageLimit' ? cls.resetAt : undefined;
     if (from.backend === 'claude') {
-        state.setClaudeProfileLimitedUntil(from.profile, (0, claudeLimitSwitch_1.resolveClaudeLimitedUntil)({
-            resetAtMs,
-            usage: state.getClaudeProfileInfo(from.profile)?.usage,
-            existingLimitedUntil: state.getClaudeProfileInfo(from.profile)?.limitedUntil ?? null,
-            nowMs,
-            fallbackMs: apiErrorRetry_1.usageLimitDefaultMs,
-        }));
+        // A used-up balance has no reset: its own flow marks the account (`creditExhaustedAt`) instead.
+        if (cls.isBalanceExhausted !== true)
+            state.setClaudeProfileLimitedUntil(from.profile, (0, claudeLimitSwitch_1.resolveClaudeLimitedUntil)({
+                resetAtMs,
+                usage: state.getClaudeProfileInfo(from.profile)?.usage,
+                existingLimitedUntil: state.getClaudeProfileInfo(from.profile)?.limitedUntil ?? null,
+                nowMs,
+                fallbackMs: apiErrorRetry_1.usageLimitDefaultMs,
+            }));
     }
     else {
         const label = (0, fallbackChain_1.buildOpenCodeModelLabel)(from);
@@ -6027,8 +6152,11 @@ async function planFallbackSwitch(key, cls, episodeId) {
     let earliest = null;
     if (plan.action === 'none') {
         const explicit = state.getFallbackChain();
+        // Without a chain the implicit one is the signed-in SUBSCRIPTIONS: an account billed to API credits never ends a wait by itself.
         const rungs = explicit.length > 0 ? explicit : from.backend === 'claude'
-            ? detection.claudeProfiles.filter((profile) => profile.loggedIn !== false).map((profile) => ({ backend: 'claude', profile: profile.name, model: null }))
+            ? detection.claudeProfiles
+                .filter((profile) => profile.loggedIn !== false && profile.billing !== 'api')
+                .map((profile) => ({ backend: 'claude', profile: profile.name, model: null }))
             : [];
         const found = (0, fallbackChain_1.pickEarliestResetRung)({ chain: rungs, current: from, detection, nowMs: Date.now() });
         if (found && !found.isCurrent)
@@ -6049,9 +6177,23 @@ function getFallbackResetTime(from) {
         return null;
     return (0, localClock_1.formatLocalClockWithDateIfNotToday)(untilMs, Date.now());
 }
-/** The «switched» notice (`utils/fallbackSwitchNotice.ts`), with the reset of the exhausted rung when known. */
+/**
+ * The «switched» notice (`utils/fallbackSwitchNotice.ts`), with the reset of the exhausted rung when known — and, onto
+ * an account billed to API credits, the line that it costs money per request and what it has spent so far.
+ */
 function getFallbackSwitchedNotice(from, to, runningModel) {
-    return (0, fallbackSwitchNotice_1.buildFallbackSwitchedNotice)({ from, to, resetTime: getFallbackResetTime(from), runningModel });
+    const notice = (0, fallbackSwitchNotice_1.buildFallbackSwitchedNotice)({ from, to, resetTime: getFallbackResetTime(from), runningModel });
+    const info = to.backend === 'claude' ? state.getClaudeProfileInfo(to.profile) : undefined;
+    if (to.backend !== 'claude' || info?.billing !== 'api')
+        return notice;
+    return `${notice}\n${(0, i18n_1.t)('fallback.switchedToApi', { name: to.profile, spent: (0, claudeApiSpend_1.formatUsd)(info.apiSpend?.totalUsd ?? 0) })}`;
+}
+/** The spend line a «credits used up» notice ends with (what the account spent through the bot); `''` before any spend. */
+function getBalanceSpentLine(from) {
+    const spend = from?.backend === 'claude' ? state.getClaudeProfileInfo(from.profile)?.apiSpend : undefined;
+    if (!spend)
+        return '';
+    return `\n${(0, i18n_1.t)('apiRetry.balanceSpent', (0, claudeProfileUsageLines_1.formatClaudeApiSpendWords)(spend, getCurrentTimezone(), Date.now()))}`;
 }
 /**
  * @description The model the topic's Claude session runs ACROSS a move onto `to`, for deciding whether the move
@@ -6318,6 +6460,10 @@ function buildBackendSwitchTargetOfRung(to) {
  * The outcome tells the screen what to say; the question and the limit move's notice are already posted.
  */
 async function switchTopicByOperator(key, to) {
+    // The operator's own pick of an account whose API credits were used up is the act that ends that mark (topped up, or
+    // trying anyway): a failing request marks it again.
+    if (to.backend === 'claude')
+        state.setClaudeProfileCreditExhausted(to.profile, null);
     const currentFamily = getTopicBackendFamily(key);
     const from = getTopicFallbackPosition(key);
     const isUsageLimitWaitArmed = getArmedApiRetry(key)?.kind === 'usageLimit';
@@ -6422,7 +6568,7 @@ const { registerLimitsBoardCommands, registerLimitsBoardCallbacks } = (0, limits
     runAutoSwitchCommand,
     getArmedLimitRetryFireAt,
 });
-const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAwaitingProfileName, cancelProfileNameCapture, submitProfileName, pickClaudeAccount, onClaudeProfileAuthStatus: recordClaudeProfileAuthStatus, } = (0, claudeAccounts_1.createClaudeAccounts)({
+const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAwaitingProfileName, cancelProfileNameCapture, submitProfileName, pickClaudeAccount, onClaudeProfileAuthStatus: recordClaudeProfileAuthStatus, onClaudeProfileApiKey: storeClaudeProfileApiKey, } = (0, claudeAccounts_1.createClaudeAccounts)({
     ...botCore,
     getDataDir: state_1.resolveDataDir,
     getInstanceTimezone: getCurrentTimezone,
@@ -6438,9 +6584,11 @@ const { registerClaudeAccountCommands, registerClaudeAccountCallbacks, checkIsAw
     disconnectOpenCodeProvider: applyProviderDisconnect,
     startOpenCodeConnect: showConnectMethodPicker,
     applyAutoSwitch,
+    verifyAnthropicApiKey: (apiKey) => (0, anthropicApiKeyCheck_1.verifyAnthropicApiKey)(apiKey),
 });
 claudeProfileAuthStatusSink = recordClaudeProfileAuthStatus;
-const { registerSttCommands, registerSttCallbacks, startSttAutoInstall, resumeSttInstallAtBoot, getAwaitedSttStep, submitSttInput, cancelSttInput, } = (0, stt_1.createStt)({
+claudeProfileApiKeySink = storeClaudeProfileApiKey;
+const { registerSttCommands, registerSttCallbacks, startSttAutoInstall, resumeSttInstallAtBoot, getAwaitedSttStep, checkIsAnySttInputAwaited, submitSttInput, cancelSttInput, } = (0, stt_1.createStt)({
     ...botCore,
     getConfigPath: () => (0, sttSettings_1.getSttConfigPath)(),
     getDataDir: state_1.resolveDataDir,
@@ -6453,10 +6601,30 @@ const { registerSttCommands, registerSttCallbacks, startSttAutoInstall, resumeSt
         return groupId !== null ? (0, sessionKeyCodec_1.makeTelegramKey)(groupId, threadRouting_1.GENERAL_THREAD_ID) : null;
     },
 });
+const { registerTopicCommand, registerTopicCallbacks, checkIsAwaitingTopicInput, submitTopicInput, cancelTopicInput, cancelTopicWizard, } = (0, topicCommand_1.createTopicCommand)({
+    ...botCore,
+    checkIsDmKey,
+    disarmFolderCreation: (key) => {
+        awaitingFolderName.delete((0, sessionKey_1.keyToString)(key));
+    },
+    listAvailableSubdirs: () => listAvailableSubdirs(ENV.workRoot),
+    createWorkFolder,
+    bindNewTopic,
+});
 registerClaudeAccountCommands();
+registerTopicCommand();
 registerFallbackChainCommands();
 registerLimitsBoardCommands();
 registerSttCommands();
+const { registerSelfUpdateCommands, registerSelfUpdateCallbacks } = (0, selfUpdate_1.createSelfUpdate)({
+    ...botCore,
+    getUpdateEngine: () => updateEngine,
+    getSettingsPath: () => (0, instanceSettings_1.getInstanceSettingsPath)(),
+    now: () => Date.now(),
+    // The instance's time zone is `process.env.TZ` (`/timezone`), which `toLocaleTimeString` follows.
+    formatClock: (epochMs) => new Date(epochMs).toLocaleTimeString('en-GB', { hour: '2-digit', minute: '2-digit' }),
+});
+registerSelfUpdateCommands();
 registerCompactionCommands();
 /**
  * @description Build the agent-picker keyboard.
@@ -6490,7 +6658,7 @@ async function handleSessionsList(key) {
     }
     if (!state.getBinding(key)) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
         return;
     }
@@ -6750,8 +6918,8 @@ command('tab', async (_ctx, key) => {
     else
         await replyToThread(key, `Not supported for ${adapter.label}`);
 });
-command(['esc', 'escape'], async (_ctx, key) => {
-    // A pending «Add account» name prompt, then a pending sign-in (`/login`, `/connect` OAuth) take
+command(escapeCommandNames, async (_ctx, key) => {
+    // A pending «Add account» name prompt, a pending sign-in (`/login`, `/connect` OAuth) and a `/topic` wizard take
     // priority: the first /esc only cancels it, so the topic stops waiting for typed input.
     if (cancelProfileNameCapture(key)) {
         await replyToThread(key, (0, i18n_1.t)('account.askNameCancelled'));
@@ -6761,12 +6929,21 @@ command(['esc', 'escape'], async (_ctx, key) => {
         await replyToThread(key, (0, i18n_1.t)('login.cancelled'));
         return;
     }
+    // A `/topic` wizard is ended at whatever step it waits (it says so itself).
+    if (await cancelTopicWizard(key))
+        return;
     const adapter = (0, createAdapter_1.getThreadAdapter)(key);
     if (adapter.sendEscape) {
         // The operator interrupted the turn: its open request closes silently.
         cancelConversationRequest(key);
         markNeedsNewMessage(key);
+        // A turn blocked on a question ends with it: the question is closed on the agent first (an open OpenCode one is
+        // re-found at every reattach; a Claude stream-json one is denied), then the turn is stopped — neither waits for Telegram. Only
+        // then the question's buttons are retired, as when a prompt walks away from it (that edit goes through the send pacer).
+        adapter.rejectQuestion?.(key);
         adapter.sendEscape(key);
+        if (pendingQuestions.has((0, sessionKey_1.keyToString)(key)))
+            await retirePendingQuestion(key);
     }
     else {
         await replyToThread(key, `Not supported for ${adapter.label}`);
@@ -7037,10 +7214,10 @@ command('clear_messages', async (ctx, key) => {
 // agent.
 const botCommands = new Set([
     'start', 'claude', 'opencode', 'oc', 'terminal', 'agent', 'sessions', 'resume', 'cancel', 'model', 'connect',
-    'disconnect', 'stop', 'stopall', 'stop-all', 'status', 'c', 'y', 'n', 'enter', 'up', 'down', 'tab', 'esc', 'escape', 'output', 'clear_messages',
-    'bind', 'unbind', 'where', 'ls', 'list', 'new', 'clear_session', 'whoami', 'version', 'help', 'language', 'lang',
+    'disconnect', 'stop', 'stopall', 'stop-all', 'status', 'c', 'y', 'n', 'enter', 'up', 'down', 'tab', 'esc', 'escape', 'interrupt', 'output', 'clear_messages',
+    'bind', 'topic', 'unbind', 'where', 'ls', 'list', 'new', 'clear_session', 'whoami', 'version', 'help', 'language', 'lang',
     'doctor', 'mcp', 'rename_session', 'compact', 'compact_on_idle', 'compact_summary', 'auto_continue_limits', 'limits', 'limits_autoswitch', 'trace', 'timestamps', 'timezone', 'schedule', 'reminders', 'thinking', 'tool_results',
-    'subagent', 'claude_mode', 'effort', 'verbosity', 'quit', 'q', 'quit-all', 'quitall', 'pair', 'account', 'accounts', 'fallback', 'stt', 'voice', 'speech',
+    'subagent', 'claude_mode', 'effort', 'verbosity', 'quit', 'q', 'quit-all', 'quitall', 'pair', 'account', 'accounts', 'fallback', 'stt', 'voice', 'speech', 'update',
 ]);
 /**
  * @description The bare `/clear` is no longer bot-owned (it was renamed to
@@ -7073,6 +7250,7 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
         const cmd = text.slice(1).split(' ')[0].split('@')[0].toLowerCase();
         // A slash command ends a pending «Add account» name prompt (the command itself runs normally).
         cancelProfileNameCapture(key);
+        cancelTopicInput(key);
         // ... and an armed `/stt` address or key step.
         await cancelSttInput(key);
         if (botCommands.has(cmd))
@@ -7121,7 +7299,13 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
     // `/account` «Add» asked for the new profile's name → this message is it (a bad name keeps the prompt
     // armed and says so; a slash command above already disarmed it).
     if (checkIsAwaitingProfileName(key) && !text.startsWith('/')) {
-        await submitProfileName(key, text);
+        await submitProfileName(key, text, ctx.message.message_id);
+        return;
+    }
+    // `/topic` asked for the new topic's name, or for the name of a folder to create → this message is the answer (a bad
+    // name keeps the prompt armed and says so; a slash command above already ended it).
+    if (checkIsAwaitingTopicInput(key) && !text.startsWith('/')) {
+        await submitTopicInput(key, text);
         return;
     }
     // `/stt` asked for a server address or an API key → this message is the answer. A plausible key is deleted at
@@ -7289,7 +7473,7 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
             });
             if (!result.ok && result.reason === 'unbound') {
                 const subdirs = listAvailableSubdirs(ENV.workRoot);
-                const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+                const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
                 await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
                 return;
             }
@@ -7370,7 +7554,7 @@ bot.on((0, filters_1.message)('text'), async (ctx) => {
     const binding = state.getBinding(key);
     if (!binding) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
         return;
     }
@@ -7501,7 +7685,7 @@ async function processVoiceJob(key, fileId, durationSeconds, requesterId, sentAt
                 });
                 if (!result.ok && result.reason === 'unbound') {
                     const subdirs = listAvailableSubdirs(ENV.workRoot);
-                    const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+                    const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
                     await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
                     return;
                 }
@@ -7521,7 +7705,7 @@ async function processVoiceJob(key, fileId, durationSeconds, requesterId, sentAt
             const binding = state.getBinding(key);
             if (!binding) {
                 const subdirs = listAvailableSubdirs(ENV.workRoot);
-                const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+                const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
                 await replyToThread(key, (0, i18n_1.t)('thread.no_binding'), extra);
                 return;
             }
@@ -7589,7 +7773,7 @@ async function checkFileIntakeGatePassed(key, isStarting, sendHint) {
     const binding = state.getBinding(key);
     if (!binding) {
         const subdirs = listAvailableSubdirs(ENV.workRoot);
-        const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+        const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
         await sendHint((0, i18n_1.t)('thread.no_binding'), extra);
         return false;
     }
@@ -7924,7 +8108,7 @@ bot.on((0, filters_1.message)('forum_topic_created'), async (ctx) => {
             // Fall through to picker.
         }
     }
-    const extra = buildBindKeyboard(subdirs, 0, BIND_PAGE_SIZE, !!state.getBinding(key));
+    const extra = (0, bindPicker_1.buildBindKeyboard)(subdirs, 0, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
     await replyToThread(key, (0, i18n_1.t)('thread.welcome_pick'), extra);
 });
 /**
@@ -8038,7 +8222,7 @@ bot.action(/^bind_page_(\d+)$/, async (ctx) => {
     }
     const page = parseInt(ctx.match[1], 10);
     const subdirs = listAvailableSubdirs(ENV.workRoot);
-    const keyboard = buildBindKeyboard(subdirs, page, BIND_PAGE_SIZE, !!state.getBinding(key));
+    const keyboard = (0, bindPicker_1.buildBindKeyboard)(subdirs, page, bindPicker_1.BIND_PAGE_SIZE, !!state.getBinding(key));
     try {
         await ctx.editMessageReplyMarkup(keyboard.reply_markup);
     }
@@ -8051,14 +8235,14 @@ bot.action(/^bind_page_(\d+)$/, async (ctx) => {
     await ctx.answerCbQuery();
 });
 // Middle "N/M" pill in the nav row — pure UI, no state change.
-bot.action('bind_page_noop', async (ctx) => {
+bot.action(bindPicker_1.bindPageNoopCallback, async (ctx) => {
     await ctx.answerCbQuery();
 });
 // «Create new folder» — first option in the /bind picker. Arms the thread's
 // await-folder-name mode; the next text message is the name (see the text
 // handler). Callback id deliberately avoids the `bind_` prefix so it can't be
 // matched by the `bind_<subdir>` regex below.
-bot.action(bindCreateFolderCallback, async (ctx) => {
+bot.action(bindPicker_1.bindCreateFolderCallback, async (ctx) => {
     const key = await authoriseContext(ctx);
     if (!key) {
         await ctx.answerCbQuery((0, i18n_1.t)('cb.access_denied'));
@@ -8075,7 +8259,7 @@ bot.action(bindCreateFolderCallback, async (ctx) => {
 // «Leave current dir» — the folded-in `/unbind`, shown only in a bound topic.
 // Callback id deliberately avoids the `bind_` prefix so it can't be matched by
 // the `bind_<subdir>` regex below.
-bot.action(bindLeaveCurrentCallback, async (ctx) => {
+bot.action(bindPicker_1.bindLeaveCurrentCallback, async (ctx) => {
     const key = await authoriseContext(ctx);
     if (!key) {
         await ctx.answerCbQuery((0, i18n_1.t)('cb.access_denied'));
@@ -8088,6 +8272,8 @@ bot.action(bindLeaveCurrentCallback, async (ctx) => {
     await ctx.answerCbQuery();
     await unbindThread(key);
 });
+// `/topic`'s buttons: patterns of their own (`topic_…`), disjoint from the `bind_<subdir>` regex below.
+registerTopicCallbacks();
 bot.action(/^bind_(.+)$/, async (ctx) => {
     const key = await authoriseContext(ctx);
     if (!key) {
@@ -8246,6 +8432,7 @@ registerClaudeAccountCallbacks();
 registerFallbackChainCallbacks();
 registerLimitsBoardCallbacks();
 registerSttCallbacks();
+registerSelfUpdateCallbacks();
 // «⏭ Skip once» on the `/limits` board and the `/limits_autoswitch` screen: drop THIS armed resume and
 // leave the on/off setting alone. The episode is identified by the `fireAt` baked
 // into the callback data, so an untouched older picker can never cancel a LATER
@@ -8568,32 +8755,38 @@ async function deliverActivePrompt(key, adapter, text, intake, sentAtMs, replyCo
     return outcome;
 }
 /**
- * @description Cancel a pending OpenCode question because the user sent free-form
- * input instead of answering it, then deliver that input as a fresh prompt. In
- * order: clear the bot's pending-question state, neutralize the stale buttons
- * message (edit it to a "cancelled" label so a late tap can't re-answer an
- * aborted question), abort the wedged OpenCode turn (`SIGINT` → `/session/:id/
- * abort`), post the "previous question cancelled" notice, then forward.
+ * @description Retire the on-screen state of a pending OpenCode question the user walked away from: clear the bot's
+ * pending-question state and neutralize the stale buttons message (edit it to a "cancelled" label so a late tap can't
+ * re-answer an aborted question). Closing the question on the server is the caller's, before it aborts the turn.
+ * Returns whether the buttons message itself was relabelled — it IS the cancellation notice then.
  *
- * The buttons-message edit runs through `runQuestionLifecycleOp` (same serializer
- * as the answer path) so it can't race a concurrent re-post-to-bottom. The
- * `messageId` + header are captured BEFORE clearing, since `clearPendingQuestion`
- * drops the state.
+ * The edit runs through `runQuestionLifecycleOp` (same serializer as the answer path) so it can't race a concurrent
+ * re-post-to-bottom. The `messageId` + header are captured BEFORE clearing, since `clearPendingQuestion` drops the state.
  */
-async function cancelPendingQuestionAndForward(key, adapter, text, sentAtMs, replyContext, requestHeader) {
+async function retirePendingQuestion(key) {
     const pending = pendingQuestions.get((0, sessionKey_1.keyToString)(key));
     const cancelledMessageId = pending?.messageId ?? null;
     const cancelledQuestion = pending?.data.questions[pending.currentIndex];
-    // Whether we relabel the on-screen question bubble itself to "❌ … cancelled"
-    // below. When we do, that IS the cancellation notice — a second standalone
-    // "previous question cancelled" line is pure noise (the reported triple
-    // message). The standalone notice is kept only for the no-bubble case.
-    const didLabelQuestionMessage = cancelledMessageId !== null && cancelledQuestion !== undefined;
     clearPendingQuestion(key);
-    if (cancelledMessageId !== null && cancelledQuestion) {
-        const header = cancelledQuestion.header || cancelledQuestion.question;
-        await runQuestionLifecycleOp(key, () => editThreadMessage(key, cancelledMessageId, (0, i18n_1.t)('agent.question_cancelled_msg_label', { header })));
-    }
+    if (cancelledMessageId === null || !cancelledQuestion)
+        return false;
+    const header = cancelledQuestion.header || cancelledQuestion.question;
+    await runQuestionLifecycleOp(key, () => editThreadMessage(key, cancelledMessageId, (0, i18n_1.t)('agent.question_cancelled_msg_label', { header })));
+    return true;
+}
+/**
+ * @description Cancel a pending OpenCode question because the user sent free-form
+ * input instead of answering it, then deliver that input as a fresh prompt. In
+ * order: retire the question's on-screen state ({@link retirePendingQuestion}),
+ * close it on the server, abort the wedged OpenCode turn (`SIGINT` → `/session/:id/
+ * abort`), post the "previous question cancelled" notice, then forward.
+ */
+async function cancelPendingQuestionAndForward(key, adapter, text, sentAtMs, replyContext, requestHeader) {
+    // When the question bubble itself was relabelled to "❌ … cancelled", that IS the
+    // cancellation notice — a second standalone "previous question cancelled" line is
+    // pure noise (the reported triple message). The standalone notice is kept only
+    // for the no-bubble case.
+    const didLabelQuestionMessage = await retirePendingQuestion(key);
     // Close the question on the OpenCode server too (not just the bot-local +
     // Telegram state above): an abandoned-but-still-open question keeps getting
     // re-found by `restoreOpenQuestion` (`GET /question` on every reattach) and
@@ -9954,6 +10147,7 @@ exports.COMMANDS_MENU = [
     { command: 'help', description: '❓ Context-aware help' },
     { command: 'doctor', description: '🔍 Self-diagnostics' },
     { command: 'bind', description: '📁 Bind thread to a subfolder' },
+    { command: 'topic', description: '🧵 New topic on a folder (name, then folder)' },
     { command: 'ls', description: '📂 List WORK_ROOT subfolders' },
     { command: 'list', description: '🧵 List all bound threads' },
     { command: 'mcp', description: '🔌 List active MCP servers' },
@@ -9981,6 +10175,7 @@ exports.COMMANDS_MENU = [
     { command: 'limits', description: '🚧 Usage limits — switch this topic' },
     { command: 'limits_autoswitch', description: '🔁 Automatic switching on a usage limit' },
     { command: 'stt', description: '🎙 Voice recognition: engines, language, local engine' },
+    { command: 'update', description: '🔄 Bot updates: automatic, notify only, off' },
     { command: 'schedule', description: '⏰ Schedule a prompt (agent does the work)' },
     { command: 'reminders', description: '🔔 Reminders — add, list, delete (no agent)' },
     { command: 'status', description: '📊 Show status' },
@@ -9996,7 +10191,8 @@ exports.COMMANDS_MENU = [
     { command: 'up', description: '⬆️ Arrow Up' },
     { command: 'down', description: '⬇️ Arrow Down' },
     { command: 'tab', description: '⇥ Tab' },
-    { command: 'esc', description: '⎋ Escape (interrupt / dismiss / cancel a pending login)' },
+    { command: 'interrupt', description: '⏹ Interrupt the running turn — the next message steers it (alias /esc)' },
+    { command: 'esc', description: '⎋ Escape (interrupt / dismiss / cancel a pending login; alias /interrupt)' },
     { command: 'y', description: '✅ Send "y"' },
     { command: 'n', description: '❌ Send "n"' },
     { command: 'c', description: '🛑 Ctrl+C' },
@@ -11055,6 +11251,66 @@ async function resolveBotAdminRights(groupId, botUserId) {
         return null;
     }
 }
+/**
+ * @description The General topic the updater talks in: the paired group's General when a group is paired, else the owner's DM
+ * General (`null` when neither exists — a Jira-only instance has no Telegram to say anything in).
+ */
+function getUpdateGeneralKey() {
+    const groupId = getAllowedGroupId();
+    if (groupId !== null)
+        return (0, sessionKeyCodec_1.makeTelegramKey)(groupId, threadRouting_1.GENERAL_THREAD_ID);
+    const ownerUserId = getOwnerUserId();
+    return Number.isFinite(ownerUserId) ? (0, sessionKeyCodec_1.makeTelegramKey)(ownerUserId, threadRouting_1.DM_GENERAL_THREAD_ID) : null;
+}
+/**
+ * @description Say an update message in General, worded in that chat's language: pinned when it asks the operator to act, with
+ * the install tap (the version printed on the button is the version it installs) when it offers one. A failed send or pin is
+ * logged — the updater never fails because Telegram did.
+ */
+async function postUpdateMessageToGeneral(message) {
+    if (!ENV.isTelegramServed)
+        return;
+    const generalKey = getUpdateGeneralKey();
+    if (generalKey === null) {
+        console.log(`[update] no General topic to post "${message.kind}" in`);
+        return;
+    }
+    const rendered = withThreadLocale(generalKey, () => (0, updateMessages_1.renderUpdateMessage)(message, (code, vars) => (0, i18n_1.t)(code, vars)));
+    const extra = rendered.buttons.length > 0
+        ? telegraf_1.Markup.inlineKeyboard(rendered.buttons.map((button) => [telegraf_1.Markup.button.callback(button.label, button.callbackData)]))
+        : {};
+    const messageId = await replyToThread(generalKey, rendered.text, extra);
+    if (messageId !== null && rendered.pin)
+        await pinMessageQuiet(generalKey, messageId, { disableNotification: false });
+}
+/**
+ * @description Whether the bot may be restarted now, from what it knows: no agent working in any bound topic (`checkIsWorking`, else
+ * `checkIsBusy`), no input an adapter has not taken in, nothing held in the startup buffer, no sign-in, no in-memory wizard or pasted
+ * key, and no human message within the quiet period. A sleeping or idle-but-alive session does not count: it survives the restart.
+ */
+function getUpdateIdleVerdict(isUserRequested) {
+    const keys = getServedBindings().map(({ key }) => key);
+    const isAnyAgentWorking = keys.some((key) => {
+        const adapter = (0, createAdapter_1.getThreadAdapter)(key);
+        return adapter.checkIsWorking ? adapter.checkIsWorking(key) : adapter.checkIsBusy?.(key) === true;
+    });
+    return (0, updatePolicy_1.getIdleVerdict)({
+        isAnyAgentWorking,
+        hasUnconsumedInput: keys.some((key) => (0, createAdapter_1.getThreadAdapter)(key).checkHasUnconsumedInput?.(key) === true),
+        hasBufferedStartupPrompt: startupPromptBuffer.checkIsAnyPending(),
+        isSignInRunning: checkIsAnyLoginInProgress(),
+        isWizardOpen: reminderWizards.size > 0 ||
+            awaitingFolderName.size > 0 ||
+            awaitingModelSelection.size > 0 ||
+            awaitingSessionSelection.size > 0 ||
+            pendingProviderConnects.size > 0 ||
+            checkIsAnySttInputAwaited(),
+        lastHumanMessageAt: lastHumanInboundAt,
+        now: Date.now(),
+        quietMs: constants_1.quietPeriodMs,
+        isUserRequested,
+    });
+}
 /**
  * @description Boot-time readiness status (plan 2026-07-12): on startup tell the
  * owner whether the bot can process messages, or list the setup steps still
@@ -11232,6 +11488,7 @@ async function startBot() {
     // Every Claude spawn from here on reads the conversation's account profile (`/account`).
     (0, createAdapter_1.registerClaudeConfigDirReader)(resolveThreadClaudeConfigDir);
     (0, createAdapter_1.registerClaudeRateLimitSink)(onClaudeRateLimitEvent);
+    (0, createAdapter_1.registerClaudeTurnCostSink)(onClaudeTurnCost);
     // The usage cache: a first poll now (off the boot path), then the timer.
     claudeUsageRefresher.start();
     void claudeUsageRefresher.refreshAll();
@@ -11715,36 +11972,82 @@ async function startBot() {
     //    `stopOpenCodeServer()` or `adapter.stopSession()` here — tmux and
     //    opencode survive the bot process by design and are picked back up
     //    by `reattachExistingSessions` on the next boot.
+    // The ordered sequence is the same for a signal and for an update's restart; only what happens AFTER it differs
+    // (`exit` ends the process, the restart replaces it with a fresh image of the same install).
+    const runShutdown = (signal, exit) => (0, shutdown_1.gracefulShutdown)({
+        signal,
+        // Without Telegram there is no polling to stop, and `bot.stop` throws when it never launched.
+        bot: ENV.isTelegramServed ? bot : { stop: () => { } },
+        state,
+        releaseLock: instanceLock_1.releaseLock,
+        exit,
+        drainPendingUpdates: () => updateDispatcher.drainIdle(updateDrainTimeoutMs),
+        finalizePendingOutput: () => finalizePendingOutputOnShutdown(),
+        clearTransientFrames: () => sweepTransientFramesOnShutdown(),
+        // A hot worker's reload keeps the sidecar for the next worker to adopt; the supervisor stops it for good.
+        stopSidecars: (0, installManager_1.checkIsOpenCodeExternalHost)() ? undefined : () => sttOwner.stop(),
+        cleanupTimers: () => {
+            clearInterval(inMemoryGcInterval);
+            clearInterval(heartbeatInterval);
+            clearInterval(fileSweepInterval);
+            clearInterval(rateSummaryInterval);
+            // Scheduler (S8): clear every armed job timer; persisted nextRunAt
+            // means the next boot's rearmAll picks them back up (catch-up replay).
+            schedulerEngine?.shutdown();
+            requestWakeUpEngine?.stop();
+            jiraConnector?.stop();
+            if (isSchedulerMcpStarted)
+                void schedulerMcpHandle.stop().catch(() => { });
+            updateEngine?.stop();
+        },
+    });
     const shutdown = (signal) => {
-        void (0, shutdown_1.gracefulShutdown)({
-            signal,
-            // Without Telegram there is no polling to stop, and `bot.stop` throws when it never launched.
-            bot: ENV.isTelegramServed ? bot : { stop: () => { } },
-            state,
-            releaseLock: instanceLock_1.releaseLock,
-            exit: (code) => process.exit(code),
-            drainPendingUpdates: () => updateDispatcher.drainIdle(updateDrainTimeoutMs),
-            finalizePendingOutput: () => finalizePendingOutputOnShutdown(),
-            clearTransientFrames: () => sweepTransientFramesOnShutdown(),
-            // A hot worker's reload keeps the sidecar for the next worker to adopt; the supervisor stops it for good.
-            stopSidecars: (0, installManager_1.checkIsOpenCodeExternalHost)() ? undefined : () => sttOwner.stop(),
-            cleanupTimers: () => {
-                clearInterval(inMemoryGcInterval);
-                clearInterval(heartbeatInterval);
-                clearInterval(fileSweepInterval);
-                clearInterval(rateSummaryInterval);
-                // Scheduler (S8): clear every armed job timer; persisted nextRunAt
-                // means the next boot's rearmAll picks them back up (catch-up replay).
-                schedulerEngine?.shutdown();
-                requestWakeUpEngine?.stop();
-                jiraConnector?.stop();
-                if (isSchedulerMcpStarted)
-                    void schedulerMcpHandle.stop().catch(() => { });
-            },
-        });
+        void runShutdown(signal, (code) => process.exit(code));
     };
     process.once('SIGINT', () => shutdown('SIGINT'));
     process.once('SIGTERM', () => shutdown('SIGTERM'));
+    // 7b. Automatic updates (`src/selfUpdate/`): the engine finds a new version, installs it when nobody is using the bot and
+    //     restarts it in place — the same sequence as a signal, then `process.execve` with the launch environment.
+    const updateRuntime = await (0, updateRuntime_1.createUpdateRuntime)({
+        dataDir: path.dirname(state.stateFilePath),
+        packageRoot: path.resolve(__dirname, '..'),
+        execPath: process.execPath,
+        platform: process.platform,
+        nodeVersion: process.versions.node,
+        argv: process.argv,
+        isHotMode: (0, installManager_1.checkIsOpenCodeExternalHost)(),
+    });
+    const readUpdateSettings = (0, instanceSettings_1.createUpdateSettingsReader)(() => (0, instanceSettings_1.getInstanceSettingsPath)(), (line) => console.error(line));
+    updateEngine = (0, updateEngine_1.createUpdateEngine)({
+        ...updateRuntime,
+        now: () => Date.now(),
+        setTimer: (callback, delayMs) => {
+            const timer = setTimeout(callback, delayMs);
+            timer.unref();
+            return timer;
+        },
+        clearTimer: (handle) => clearTimeout(handle),
+        log: (line) => console.log(line),
+        getSettings: readUpdateSettings,
+        state: {
+            getRecord: () => state.getSelfUpdateRecord(),
+            setRecord: (record) => state.setSelfUpdateRecord(record),
+            getLastRun: () => state.getLastRunVersion(),
+            setLastRun: (lastRun) => state.setLastRunVersion(lastRun),
+        },
+        getIdleVerdict: getUpdateIdleVerdict,
+        postToGeneral: postUpdateMessageToGeneral,
+        restartInPlace: () => runShutdown('update', () => (0, restart_1.reexecProcess)(updateRuntime.reexecTarget, (0, launchEnvironment_1.getLaunchEnvironment)(), (0, restart_1.createDefaultReexecDeps)())),
+    });
+    const startUpdates = async () => {
+        try {
+            await updateEngine?.runBootStep();
+        }
+        catch (e) {
+            console.warn('[update] boot step failed:', e instanceof Error ? e.message : e);
+        }
+        updateEngine?.start();
+    };
     // 8. Launch. `dropPendingUpdates` follows the boot classifier: on a hot
     //    reload we KEEP the buffered backlog so a message typed during the
     //    ~1s reload window still routes to its live agent; on a cold start
@@ -11761,6 +12064,7 @@ async function startBot() {
     if (!ENV.isTelegramServed) {
         // No polling: the MCP server and the connector timers keep the process alive.
         console.log('[boot] running without Telegram (connectors: ' + [...ENV.servedPlatforms].join(', ') + ')');
+        await startUpdates();
         return;
     }
     try {
@@ -11769,6 +12073,7 @@ async function startBot() {
     catch (e) {
         console.warn('[startup-status] failed:', e instanceof Error ? e.message : e);
     }
+    await startUpdates();
     // The local speech engine: clean up after an earlier run, re-attach to / start its install. Starts no process.
     void bootSttLocalEngine().catch((e) => console.warn('[STT] boot step failed:', e instanceof Error ? e.message : e));
     console.log(`Launching Telegraf bot (long polling, dropPendingUpdates=${bootMode.dropPendingUpdates})...`);