cli-jaw 2.17.61 → 2.17.62

package/public/dist/manager/index.html

@@ -6,7 +6,7 @@
   <link rel="icon" type="image/png" href="/dist/assets/icon-192-CADbZUeU.png">
   <title>Jaw Manager</title>
   <script src="/manager/theme-boot.js"></script>
-  <script type="module" crossorigin src="/dist/assets/manager-C5cU1joU.js"></script>
+  <script type="module" crossorigin src="/dist/assets/manager-Bi_xw7TW.js"></script>
   <link rel="stylesheet" crossorigin href="/dist/assets/vendor-render-DSSkXCir.css">
   <link rel="stylesheet" crossorigin href="/dist/assets/settings-embedding-DhEdT86W.css">
   <link rel="stylesheet" crossorigin href="/dist/assets/manager-BnQHAKk6.css">

package/public/dist/settings/index.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Settings</title>
   <script src="/manager/theme-boot.js"></script>
-  <script type="module" crossorigin src="/dist/assets/settings-CA2LQDGh.js"></script>
+  <script type="module" crossorigin src="/dist/assets/settings-W4KG9ivu.js"></script>
   <link rel="stylesheet" crossorigin href="/dist/assets/settings-embedding-DhEdT86W.css">
 </head>
 <body>

package/public/js/features/settings-discord.ts

@@ -1,9 +1,22 @@
 // ── Discord Settings ──
 import { apiJson } from '../api.js';
 import { openSetupGuideIfUnconfigured } from './channel-setup-guide.js';
+import { t } from './i18n.js';
 import type { SettingsData } from './settings-types.js';
 
+let discordEnvironmentVariables: string[] = [];
+
+function discordEnvironmentMessage(): string {
+    return t('settings.discord.managedByEnvironment', {
+        variables: discordEnvironmentVariables.join(', ') || 'DISCORD_*',
+    });
+}
+
 export async function saveDiscordSettings(): Promise<void> {
+    if (discordEnvironmentVariables.length > 0) {
+        window.alert(discordEnvironmentMessage());
+        return;
+    }
     const token = (document.getElementById('dcToken') as HTMLInputElement)?.value.trim() || '';
     const guildId = (document.getElementById('dcGuildId') as HTMLInputElement)?.value.trim() || '';
     const channelIdsRaw = (document.getElementById('dcChannelIds') as HTMLInputElement)?.value.trim() || '';
@@ -14,6 +27,10 @@ export async function saveDiscordSettings(): Promise<void> {
 }
 
 export async function setDiscord(enabled: boolean): Promise<void> {
+    if (discordEnvironmentVariables.length > 0) {
+        window.alert(discordEnvironmentMessage());
+        return;
+    }
     document.getElementById('dcOn')?.classList.toggle('active', enabled);
     document.getElementById('dcOff')?.classList.toggle('active', !enabled);
     await apiJson('/api/settings', 'PUT', { discord: { enabled } });
@@ -41,16 +58,33 @@ export async function setDiscordMentionOnly(enabled: boolean): Promise<void> {
 export function loadDiscordSettings(s: SettingsData): void {
     if (!s.discord) return;
     const dc = s.discord;
+    discordEnvironmentVariables = Array.isArray(s.discordEnvironmentVariables)
+        ? s.discordEnvironmentVariables
+        : [];
+    const environmentManaged = discordEnvironmentVariables.length > 0;
+    const notice = document.getElementById('discord-environment-managed');
+    if (notice) {
+        notice.style.display = environmentManaged ? '' : 'none';
+        notice.textContent = environmentManaged
+            ? t('settings.discord.managedByEnvironment', { variables: discordEnvironmentVariables.join(', ') })
+            : '';
+    }
+    for (const id of ['dcToken', 'dcGuildId', 'dcChannelIds']) {
+        const input = document.getElementById(id) as HTMLInputElement | null;
+        if (input) input.disabled = environmentManaged;
+    }
+    for (const id of ['dcOff', 'dcOn', 'discord-onboarding-trigger']) {
+        const button = document.getElementById(id) as HTMLButtonElement | null;
+        if (button) button.disabled = environmentManaged;
+    }
     document.getElementById('dcOn')?.classList.toggle('active', !!dc.enabled);
     document.getElementById('dcOff')?.classList.toggle('active', !dc.enabled);
     const dcToken = document.getElementById('dcToken') as HTMLInputElement | null;
-    if (dc.token && dcToken) dcToken.value = dc.token;
+    if (dcToken) dcToken.value = environmentManaged ? '' : dc.token || '';
     const dcGuildId = document.getElementById('dcGuildId') as HTMLInputElement | null;
-    if (dc.guildId && dcGuildId) dcGuildId.value = dc.guildId;
+    if (dcGuildId) dcGuildId.value = environmentManaged ? '' : dc.guildId || '';
     const dcChannelIds = document.getElementById('dcChannelIds') as HTMLInputElement | null;
-    if (dc.channelIds?.length && dcChannelIds) {
-        dcChannelIds.value = dc.channelIds.join(', ');
-    }
+    if (dcChannelIds) dcChannelIds.value = environmentManaged ? '' : dc.channelIds?.join(', ') || '';
     const fwdOn = dc.forwardAll !== false;
     document.getElementById('dcForwardOn')?.classList.toggle('active', fwdOn);
     document.getElementById('dcForwardOff')?.classList.toggle('active', !fwdOn);

package/public/js/features/settings-telegram.ts

@@ -1,9 +1,22 @@
 // ── Telegram Settings ──
 import { apiJson } from '../api.js';
 import { openSetupGuideIfUnconfigured } from './channel-setup-guide.js';
+import { t } from './i18n.js';
 import type { SettingsData } from './settings-types.js';
 
+let telegramEnvironmentVariables: string[] = [];
+
+function telegramEnvironmentMessage(): string {
+    return t('settings.telegram.managedByEnvironment', {
+        variables: telegramEnvironmentVariables.join(', ') || 'TELEGRAM_*',
+    });
+}
+
 export async function saveTelegramSettings(): Promise<void> {
+    if (telegramEnvironmentVariables.length > 0) {
+        window.alert(telegramEnvironmentMessage());
+        return;
+    }
     const token = (document.getElementById('tgToken') as HTMLInputElement)?.value.trim() || '';
     const chatIdsRaw = (document.getElementById('tgChatIds') as HTMLInputElement)?.value.trim() || '';
     const allowedChatIds = chatIdsRaw
@@ -13,6 +26,10 @@ export async function saveTelegramSettings(): Promise<void> {
 }
 
 export async function setTelegram(enabled: boolean): Promise<void> {
+    if (telegramEnvironmentVariables.length > 0) {
+        window.alert(telegramEnvironmentMessage());
+        return;
+    }
     document.getElementById('tgOn')?.classList.toggle('active', enabled);
     document.getElementById('tgOff')?.classList.toggle('active', !enabled);
     await apiJson('/api/settings', 'PUT', { telegram: { enabled } });
@@ -34,14 +51,31 @@ export async function setTelegramMentionOnly(enabled: boolean): Promise<void> {
 export function loadTelegramSettings(s: SettingsData): void {
     if (!s.telegram) return;
     const tg = s.telegram;
+    telegramEnvironmentVariables = Array.isArray(s.telegramEnvironmentVariables)
+        ? s.telegramEnvironmentVariables
+        : [];
+    const environmentManaged = telegramEnvironmentVariables.length > 0;
+    const notice = document.getElementById('telegram-environment-managed');
+    if (notice) {
+        notice.style.display = environmentManaged ? '' : 'none';
+        notice.textContent = environmentManaged
+            ? t('settings.telegram.managedByEnvironment', { variables: telegramEnvironmentVariables.join(', ') })
+            : '';
+    }
+    for (const id of ['tgToken', 'tgChatIds']) {
+        const input = document.getElementById(id) as HTMLInputElement | null;
+        if (input) input.disabled = environmentManaged;
+    }
+    for (const id of ['tgOff', 'tgOn', 'telegram-onboarding-trigger']) {
+        const button = document.getElementById(id) as HTMLButtonElement | null;
+        if (button) button.disabled = environmentManaged;
+    }
     document.getElementById('tgOn')?.classList.toggle('active', !!tg.enabled);
     document.getElementById('tgOff')?.classList.toggle('active', !tg.enabled);
     const tgToken = document.getElementById('tgToken') as HTMLInputElement | null;
-    if (tg.token && tgToken) tgToken.value = tg.token;
+    if (tgToken) tgToken.value = environmentManaged ? '' : tg.token || '';
     const tgChatIds = document.getElementById('tgChatIds') as HTMLInputElement | null;
-    if (tg.allowedChatIds?.length && tgChatIds) {
-        tgChatIds.value = tg.allowedChatIds.join(', ');
-    }
+    if (tgChatIds) tgChatIds.value = environmentManaged ? '' : tg.allowedChatIds?.join(', ') || '';
     const fwdOn = tg.forwardAll !== false;
     document.getElementById('tgForwardOn')?.classList.toggle('active', fwdOn);
     document.getElementById('tgForwardOff')?.classList.toggle('active', !fwdOn);

package/public/js/features/settings-types.ts

@@ -153,6 +153,8 @@ export interface SettingsData {
     discord?: DiscordConfig;
     slack?: SlackConfig;
     slackEnvironmentVariables?: string[];
+    telegramEnvironmentVariables?: string[];
+    discordEnvironmentVariables?: string[];
     /** @deprecated Use messaging.homeChannel (response alias). */
     channel?: 'telegram' | 'discord' | 'slack';
     messaging?: MessagingConfig;

package/public/locales/en.json

@@ -873,6 +873,8 @@
   "settings.slack.resetFailed": "Could not reset the Slack app connection. Try again.",
   "settings.slack.resetManagedByEnvironment": "This Slack connection is managed by environment variables ({variables}). Remove them and restart cli-jaw before resetting the connection.",
   "settings.slack.managedByEnvironment": "Connection settings are read-only because they are managed by environment variables: {variables}. Remove them and restart cli-jaw to edit here.",
+  "settings.telegram.managedByEnvironment": "Connection settings are read-only because they are managed by environment variables: {variables}. Remove them and restart cli-jaw to edit here.",
+  "settings.discord.managedByEnvironment": "Connection settings are read-only because they are managed by environment variables: {variables}. Remove them and restart cli-jaw to edit here.",
   "settings.slack.attachPort": "Attach instance port",
   "settings.channel.notAttachInstanceHint": "Another instance owns this Slack connection (check the attach instance port)",
   "settings.slack.guide.step2Desc": "App settings → OAuth & Permissions → confirm files:read → Reinstall to Workspace → copy Bot User OAuth Token",

package/public/locales/ja.json

@@ -862,6 +862,8 @@
   "settings.slack.resetFailed": "Slack アプリの接続をリセットできませんでした。もう一度お試しください。",
   "settings.slack.resetManagedByEnvironment": "この Slack 接続は環境変数（{variables}）で管理されています。環境変数を削除して cli-jaw を再起動してから、接続をリセットしてください。",
   "settings.slack.managedByEnvironment": "接続設定は環境変数（{variables}）で管理されているため読み取り専用です。ここで編集するには環境変数を削除し、cli-jaw を再起動してください。",
+  "settings.telegram.managedByEnvironment": "接続設定は環境変数（{variables}）で管理されているため読み取り専用です。ここで編集するには環境変数を削除し、cli-jaw を再起動してください。",
+  "settings.discord.managedByEnvironment": "接続設定は環境変数（{variables}）で管理されているため読み取り専用です。ここで編集するには環境変数を削除し、cli-jaw を再起動してください。",
   "settings.slack.attachPort": "接続インスタンスのポート",
   "settings.channel.notAttachInstanceHint": "別のインスタンスがこの Slack 接続を所有しています（接続インスタンスのポートを確認）",
   "settings.slack.guide.step2Desc": "アプリ設定 → OAuth & Permissions → files:read を確認 → Reinstall to Workspace → Bot User OAuth Token をコピー",

package/public/locales/ko.json

@@ -873,6 +873,8 @@
   "settings.slack.resetFailed": "Slack 앱 연결을 초기화하지 못했습니다. 다시 시도해주세요.",
   "settings.slack.resetManagedByEnvironment": "이 Slack 연결은 환경변수({variables})로 관리되고 있습니다. 해당 환경변수를 제거하고 cli-jaw를 재시작한 후 연결을 초기화하세요.",
   "settings.slack.managedByEnvironment": "연결 설정은 환경변수({variables})로 관리되어 읽기 전용입니다. 여기서 수정하려면 환경변수를 제거하고 cli-jaw를 재시작하세요.",
+  "settings.telegram.managedByEnvironment": "연결 설정은 환경변수({variables})로 관리되어 읽기 전용입니다. 여기서 수정하려면 환경변수를 제거하고 cli-jaw를 재시작하세요.",
+  "settings.discord.managedByEnvironment": "연결 설정은 환경변수({variables})로 관리되어 읽기 전용입니다. 여기서 수정하려면 환경변수를 제거하고 cli-jaw를 재시작하세요.",
   "settings.slack.attachPort": "연결 인스턴스 포트",
   "settings.channel.notAttachInstanceHint": "다른 인스턴스가 이 Slack 연결을 소유하고 있습니다 (연결 인스턴스 포트 확인)",
   "settings.slack.guide.step2Desc": "앱 설정 → OAuth & Permissions → files:read 확인 → Reinstall to Workspace → Bot User OAuth Token 복사",

package/public/locales/zh.json

@@ -862,6 +862,8 @@
   "settings.slack.resetFailed": "无法重置 Slack 应用连接，请重试。",
   "settings.slack.resetManagedByEnvironment": "此 Slack 连接由环境变量（{variables}）管理。请删除这些环境变量并重启 cli-jaw，然后再重置连接。",
   "settings.slack.managedByEnvironment": "连接设置由环境变量（{variables}）管理，因此为只读。若要在此编辑，请删除这些变量并重启 cli-jaw。",
+  "settings.telegram.managedByEnvironment": "连接设置由环境变量（{variables}）管理，因此为只读。若要在此编辑，请删除这些变量并重启 cli-jaw。",
+  "settings.discord.managedByEnvironment": "连接设置由环境变量（{variables}）管理，因此为只读。若要在此编辑，请删除这些变量并重启 cli-jaw。",
   "settings.slack.attachPort": "连接实例端口",
   "settings.channel.notAttachInstanceHint": "另一个实例拥有此 Slack 连接（请检查连接实例端口）",
   "settings.slack.guide.step2Desc": "应用设置 → OAuth & Permissions → 确认 files:read → Reinstall to Workspace → 复制 Bot User OAuth Token",

package/public/manager/src/App.tsx

@@ -19,7 +19,7 @@ import { useInvalidationSubscription } from './sync/useInvalidationSubscription'
 import type { BoardView } from './dashboard-board/board-view';
 import { type ScheduleGroup } from './dashboard-schedule/DashboardScheduleSidebar';
 import { normalizeSidebarModeForBuild, REMINDERS_WORKSPACE_ENABLED } from './dashboard-features';
-import { readInitialSidebarMode, readTrayRemindersMode } from './dashboard-url-state';
+import { readInitialSelectedPort, readInitialSidebarMode, readTrayRemindersMode } from './dashboard-url-state';
 import { TrayRemindersApp } from './dashboard-reminders/TrayRemindersApp';
 import { useDashboardRegistry } from './hooks/useDashboardRegistry';
 import { useDashboardView, hydrateInstanceSettings, createInstanceSettingsNavigation, useSettingsDirtyState } from './hooks/useDashboardView';
@@ -195,6 +195,9 @@ export function App() { if (readTrayRemindersMode(window.location.search) && REM
                 const ui = loaded.registry.ui;
                 const restored = hydrateInstanceSettings(ui);
                 view.setSelectedPort(ui.selectedPort); view.setActiveDetailTab(restored.selectedTab); view.setSidebarCollapsed(ui.sidebarCollapsed);
+                // Menu bar "open instance" links win over the restored selection without persisting it.
+                const urlPort = readInitialSelectedPort(window.location.search);
+                if (urlPort !== null) view.setSelectedPort(urlPort);
                 view.setActivityDockCollapsed(ui.activityDockCollapsed); view.setActivityDockHeight(ui.activityDockHeight);
                 const sidebarMode = normalizeSidebarModeForBuild(readInitialSidebarMode(window.location.search) ?? restored.sidebarMode); // restored carries the legacy settings request
                 view.setSidebarMode(sidebarMode);

package/public/manager/src/code/code-controller-runtime.ts

@@ -99,7 +99,8 @@ export class CodeController {
     private historyLoading = new Set<string>();
     private indexLoading = false;
     private moreSessions = false;
-    private offset = 0;
+    private cursor: string | null = null;
+    private fetched = 0;
     private indexError: string | null = null;
     private timer: ReturnType<typeof setTimeout> | undefined;
     private listeners = new Set<() => void>();
@@ -153,6 +154,8 @@ export class CodeController {
             this.summaries.clear();
             this.attention.clear();
             this.rows = [];
+            this.cursor = null;
+            this.fetched = 0;
             this.gitGeneration++;
             this.pickerGeneration++;
         };
@@ -338,12 +341,15 @@ export class CodeController {
     private async readIndex(more = false): Promise<void> {
         const generation = ++this.indexGeneration;
         const life = this.lifetime;
-        const offset = more ? this.offset : 0;
-        const limit = more ? INDEX_PAGE_SIZE : Math.min(MAX_INDEX, Math.max(INDEX_PAGE_SIZE, this.offset));
+        // Pages are keyset slices of the stable creation order; a refresh
+        // re-reads a grown prefix instead of resuming the stream.
+        const cursor = more ? this.cursor : null;
+        const limit = more ? INDEX_PAGE_SIZE : Math.min(MAX_INDEX, Math.max(INDEX_PAGE_SIZE, this.fetched));
         this.indexLoading = true;
         this.notify();
         try {
-            const page = await this.client.listSessions({ ...this.filter, limit, offset,
+            const page = await this.client.listSessions({ ...this.filter, limit,
+                ...(cursor === null ? {} : { cursor }),
                 ...(this.filter.scope === 'cwd' ? { cwd: this.workingDir } : {}) }, this.abort.signal);
             if (!this.active || life !== this.lifetime || generation !== this.indexGeneration) return;
             for (const session of page.sessions) {
@@ -357,7 +363,8 @@ export class CodeController {
                 }
             }
             this.rows = [...new Set([...(more ? this.rows : []), ...page.sessions.map(row => row.sessionId)])].slice(0, MAX_INDEX);
-            this.offset = page.offset + page.sessions.length;
+            this.cursor = page.nextCursor;
+            this.fetched = (more ? this.fetched : 0) + page.sessions.length;
             this.moreSessions = page.hasMore && this.rows.length < MAX_INDEX;
             this.indexError = null;
             const retained = new Set([...this.rows, ...this.details.keys(), ...(this.book.selectedId ? [this.book.selectedId] : [])]);
@@ -463,7 +470,7 @@ export class CodeController {
         await Promise.all([this.readCatalog(), this.readIndex(), id ? this.sync(id, true) : Promise.resolve(), this.readGit()]);
     };
     loadMoreSessions = async (): Promise<void> => { if (this.moreSessions && !this.indexLoading) await this.readIndex(true); };
-    setFilter = (filter: CodeSessionFilter): void => { this.filter = { ...filter }; this.offset = 0; this.rows = []; this.moreSessions = false; this.notify(); void this.readIndex(); };
+    setFilter = (filter: CodeSessionFilter): void => { this.filter = { ...filter }; this.cursor = null; this.fetched = 0; this.rows = []; this.moreSessions = false; this.notify(); void this.readIndex(); };
     // Explicitly abandon only the local uncertain attempt. The server session may exist.
     startAnotherSession = (): void => {
         const previous = this.book.fresh;

package/public/manager/src/code/code-session-client.ts

@@ -29,7 +29,7 @@ export interface CodeGitInfo {
 }
 
 export interface CodeListOptions {
-    scope?: 'all' | 'cwd'; cwd?: string; archived?: boolean; offset?: number; limit?: number;
+    scope?: 'all' | 'cwd'; cwd?: string; archived?: boolean; cursor?: string; limit?: number;
 }
 export interface CodeSessionClient {
     listSessions(options?: CodeListOptions, signal?: AbortSignal): Promise<CodeSessionPage>;

package/public/manager/src/code/session-order.ts

@@ -4,13 +4,12 @@ import type { CodeSessionInfo } from '../../../../src/code-mode/wire';
  * How the session list is ordered and grouped, kept apart from rendering so the
  * rules can be stated and tested on their own.
  *
- * The server returns sessions by `last_used_at DESC`, which means answering a
- * prompt in the third session moves it to the top while the reader is looking
- * at it. Order here is anchored to creation instead: a row holds its place
- * until something actually changes about it, so the list moves when a session
- * is created or archived and not merely because it is busy. Which session is
- * running is carried by the row's own status, which is where a changing fact
- * belongs.
+ * The server pages sessions by `created_at DESC` — the stable key that keeps a
+ * paged read complete while `last_used_at` moves under it. Order here is
+ * anchored to that same creation order: a row holds its place until something
+ * actually changes about it, so the list moves when a session is created or
+ * archived and not merely because it is busy. Which session is running is
+ * carried by the row's own status, which is where a changing fact belongs.
  */
 export type CodeSessionSection = 'active' | 'archived';
 

package/public/manager/src/dashboard-url-state.ts

@@ -17,3 +17,11 @@ export function readInitialSidebarMode(search: string): DashboardSidebarMode | n
 export function readTrayRemindersMode(search: string): boolean {
     return new URLSearchParams(search).get('tray') === '1';
 }
+
+/** `?port=<n>` from the menu bar "open instance" item; null when absent or invalid. */
+export function readInitialSelectedPort(search: string): number | null {
+    const raw = new URLSearchParams(search).get('port');
+    if (raw === null || !/^\d{1,5}$/.test(raw)) return null;
+    const port = Number(raw);
+    return port >= 1 && port <= 65535 ? port : null;
+}

package/public/manager/src/settings/pages/AdvancedExport.tsx

@@ -45,6 +45,8 @@ export function stripServerOwnedSettingsFields(settings: Record<string, unknown>
         nativeTransportMigration: _nativeTransportMigration,
         maxConcurrentDefaultMigration: _maxConcurrentDefaultMigration,
         slackEnvironmentVariables: _slackEnvironmentVariables,
+        telegramEnvironmentVariables: _telegramEnvironmentVariables,
+        discordEnvironmentVariables: _discordEnvironmentVariables,
         ...userOwned
     } = settings;
     return userOwned;

package/public/manager/src/settings/pages/Agent.tsx

@@ -10,7 +10,7 @@ import {
     PageOffline,
     usePageSnapshot,
 } from './page-shell';
-import { parsePermissionsValue } from './Permissions';
+import { parsePermissionsValue, permissionsEditMode } from './Permissions';
 import { RuntimeHeader } from './components/agent/RuntimeHeader';
 import { PermissionQuickSection } from './components/agent/PermissionQuickSection';
 import { FlushAgentSection } from './components/agent/FlushAgentSection';
@@ -124,7 +124,10 @@ type RuntimeDraft = {
     model: string;
     effort: string;
     workingDir: string;
-    permissions: 'auto' | 'safe' | string[];
+    // 'auto' | 'safe' | string[] when the stored policy is a known shape; the raw
+    // stored value otherwise, so the editor can render it as invalid rather than
+    // silently selecting Auto (#788).
+    permissions: unknown;
 };
 
 export default function Agent({ port, client, dirty, registerSave }: SettingsPageProps) {
@@ -277,6 +280,7 @@ export default function Agent({ port, client, dirty, registerSave }: SettingsPag
         const cliKeys = Object.keys(state.data.perCli || {});
         const cli = state.data.cli || cliKeys[0] || '';
         const permissions = parsePermissionsValue(state.data.permissions);
+        const permissionsMode = permissionsEditMode(state.data.permissions);
         const meta = metaFor(cli, cliMeta);
         setDraft({
             cli,
@@ -286,8 +290,12 @@ export default function Agent({ port, client, dirty, registerSave }: SettingsPag
             workingDir: state.data.workingDir || '',
             // Preserve 'safe' rather than collapsing it: an untouched Safe instance must not
             // become Auto (YOLO) as a side effect of saving something unrelated on this page.
-            permissions: permissions.mode === 'custom' ? permissions.tokens
-                : permissions.mode === 'safe' ? 'safe' : 'auto',
+            // An unrecognized stored value stays in the draft as-is so the editor can show
+            // a recoverable invalid state instead of silently selecting Auto (#788).
+            permissions: permissionsMode === 'invalid' ? state.data.permissions
+                : permissions.mode === 'custom' ? permissions.tokens
+                : permissions.mode === 'safe' ? 'safe'
+                : 'auto',
         });
     }, [cliMeta, state]);
 
@@ -570,7 +578,7 @@ export default function Agent({ port, client, dirty, registerSave }: SettingsPag
                     setEntry('permissions', {
                         value: next,
                         original: settingsData.permissions ?? 'auto',
-                        valid: next === 'auto' || next.length > 0,
+                        valid: next === 'auto' || next === 'safe' || next.length > 0,
                     });
                 }}
             />

package/public/manager/src/settings/pages/ChannelsDiscord.tsx

@@ -11,7 +11,7 @@
 //   discord.allowBots
 //   discord.mentionOnly
 
-import { useCallback, useEffect, useMemo, useState } from 'react';
+import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react';
 import type { SettingsPageProps, DirtyEntry } from '../types';
 import { ToggleField, SecretField, ChipListField, TextField } from '../fields';
 import {
@@ -22,6 +22,7 @@ import {
     usePageSnapshot,
 } from './page-shell';
 import { expandPatch } from './path-utils';
+import { slackText } from './components/SlackSetup';
 import { HealthBadge, interpretDiscordHealth } from './components/HealthBadge';
 import type { MessengerChannel } from './components/ChannelEnablementControl';
 import { TransportStatusChips } from './components/TransportStatusChips';
@@ -46,6 +47,7 @@ type DiscordBlock = {
 type DiscordSnapshot = {
     channel?: MessengerChannel;
     discord?: DiscordBlock;
+    discordEnvironmentVariables?: string[];
     messaging?: MessagingBlock;
     [key: string]: unknown;
 };
@@ -62,13 +64,16 @@ const DISCORD_KEYS = [
     'discord.mentionOnly',
 ] as const;
 
+const CONNECTION_KEYS = ['discord.enabled', 'discord.token', 'discord.guildId', 'discord.channelIds'];
+
 /** Discord IDs are snowflakes — long numeric strings. Be lenient: 16+ digits typical. */
 export function isValidSnowflake(chip: string): boolean {
     if (!chip) return false;
     return /^\d{5,32}$/.test(chip.trim());
 }
 
-export default function ChannelsDiscord({ port, client, dirty, registerSave }: SettingsPageProps) {
+export default function ChannelsDiscord({ port, client, dirty, registerSave, manager }: SettingsPageProps) {
+    const t = useMemo(() => slackText(manager?.ui.locale ?? document.documentElement.lang), [manager?.ui.locale]);
     const { state, refresh, setData } = usePageSnapshot<DiscordSnapshot>(client, '/api/settings');
 
     const [setupOpen, setSetupOpen] = useState(false);
@@ -114,10 +119,22 @@ export default function ChannelsDiscord({ port, client, dirty, registerSave }: S
         return state.data.discord || {};
     }, [state]);
 
+    const environmentVariables = state.kind === 'ready' && Array.isArray(state.data.discordEnvironmentVariables)
+        ? state.data.discordEnvironmentVariables
+        : [];
+    const environmentManaged = environmentVariables.length > 0;
+    const savePolicyRef = useRef({ environmentManaged, environmentVariables, t });
+    useLayoutEffect(() => { savePolicyRef.current = { environmentManaged, environmentVariables, t }; },
+        [environmentManaged, environmentVariables, t]);
+
     const onSave = useCallback(async () => {
         if (setupOpen) throw new Error('Finish channel setup before saving settings.');
         const bundle = dirty.saveBundle();
         if (Object.keys(bundle).length === 0) return;
+        const policy = savePolicyRef.current;
+        if (policy.environmentManaged && CONNECTION_KEYS.some(key => key in bundle)) {
+            throw new Error(policy.t('settings.discord.managedByEnvironment', { variables: policy.environmentVariables.join(', ') }));
+        }
         const patch = expandPatch(bundle);
         const updated = await client.put<DiscordSnapshot>('/api/settings', patch);
         const fresh = (updated && typeof updated === 'object' && 'data' in updated
@@ -189,11 +206,14 @@ export default function ChannelsDiscord({ port, client, dirty, registerSave }: S
                 <TransportStatusChips client={client} channel="discord" />
             </SettingsSection>
 
-            <SettingsSection title="Discord" hint="Bot token, guild + channels, forwarding rules.">
+            <SettingsSection title="Discord" hint={environmentManaged
+                ? t('settings.discord.managedByEnvironment', { variables: environmentVariables.join(', ') })
+                : 'Bot token, guild + channels, forwarding rules.'}>
                 <ToggleField
                     id="dc-enabled"
                     label="Discord enabled"
                     value={enabled}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setEnabled(next);
                         setEntry('discord.enabled', {
@@ -208,6 +228,7 @@ export default function ChannelsDiscord({ port, client, dirty, registerSave }: S
                     label="Bot token"
                     value={token}
                     placeholder={tokenPlaceholder}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setToken(next);
                         if (next.length === 0) {
@@ -227,6 +248,7 @@ export default function ChannelsDiscord({ port, client, dirty, registerSave }: S
                     value={guildId}
                     placeholder="123456789012345678"
                     error={guildError}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setGuildId(next);
                         const valid = next.length === 0 || isValidSnowflake(next);
@@ -243,6 +265,7 @@ export default function ChannelsDiscord({ port, client, dirty, registerSave }: S
                     value={channelIds}
                     placeholder="987654321098765432"
                     error={channelIdsError}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setChannelIds(next);
                         const allValid = next.every(isValidSnowflake);
@@ -307,7 +330,7 @@ export default function ChannelsDiscord({ port, client, dirty, registerSave }: S
                 />
             </SettingsSection>
             </fieldset>
-            <ChannelSetupEntry channel="discord" client={client} dirty={dirty}
+            <ChannelSetupEntry channel="discord" client={client} dirty={dirty} disabled={environmentManaged}
                 open={setupOpen} onOpenChange={setSetupOpen} onSaved={async () => setData(await client.get<DiscordSnapshot>('/api/settings'))} />
         </form>
     );

package/public/manager/src/settings/pages/ChannelsTelegram.tsx

@@ -9,7 +9,7 @@
 //   telegram.forwardAll
 //   telegram.mentionOnly
 
-import { useCallback, useEffect, useMemo, useState } from 'react';
+import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react';
 import type { SettingsPageProps, DirtyEntry } from '../types';
 import { ToggleField, SecretField, ChipListField } from '../fields';
 import {
@@ -20,6 +20,7 @@ import {
     usePageSnapshot,
 } from './page-shell';
 import { expandPatch } from './path-utils';
+import { slackText } from './components/SlackSetup';
 import { HealthBadge, interpretTelegramProbe } from './components/HealthBadge';
 import type { MessengerChannel } from './components/ChannelEnablementControl';
 import { TransportStatusChips } from './components/TransportStatusChips';
@@ -42,6 +43,7 @@ type TelegramBlock = {
 type TelegramSnapshot = {
     channel?: MessengerChannel;
     telegram?: TelegramBlock;
+    telegramEnvironmentVariables?: string[];
     messaging?: MessagingBlock;
     [key: string]: unknown;
 };
@@ -56,6 +58,8 @@ const TELEGRAM_KEYS = [
     'telegram.mentionOnly',
 ] as const;
 
+const CONNECTION_KEYS = ['telegram.enabled', 'telegram.token', 'telegram.allowedChatIds'];
+
 // ── pure helpers (exported for tests) ────────────────────────────────
 
 /** Strict numeric-string check: digits, optional leading minus. No floats, no "1e9". */
@@ -97,7 +101,8 @@ export function chipsToChatIds(chips: ReadonlyArray<string>): number[] {
 
 // ── component ────────────────────────────────────────────────────────
 
-export default function ChannelsTelegram({ port, client, dirty, registerSave }: SettingsPageProps) {
+export default function ChannelsTelegram({ port, client, dirty, registerSave, manager }: SettingsPageProps) {
+    const t = useMemo(() => slackText(manager?.ui.locale ?? document.documentElement.lang), [manager?.ui.locale]);
     const { state, refresh, setData } = usePageSnapshot<TelegramSnapshot>(client, '/api/settings');
 
     const [setupOpen, setSetupOpen] = useState(false);
@@ -142,10 +147,22 @@ export default function ChannelsTelegram({ port, client, dirty, registerSave }:
         return state.data.telegram || {};
     }, [state]);
 
+    const environmentVariables = state.kind === 'ready' && Array.isArray(state.data.telegramEnvironmentVariables)
+        ? state.data.telegramEnvironmentVariables
+        : [];
+    const environmentManaged = environmentVariables.length > 0;
+    const savePolicyRef = useRef({ environmentManaged, environmentVariables, t });
+    useLayoutEffect(() => { savePolicyRef.current = { environmentManaged, environmentVariables, t }; },
+        [environmentManaged, environmentVariables, t]);
+
     const onSave = useCallback(async () => {
         if (setupOpen) throw new Error('Finish channel setup before saving settings.');
         const bundle = dirty.saveBundle();
         if (Object.keys(bundle).length === 0) return;
+        const policy = savePolicyRef.current;
+        if (policy.environmentManaged && CONNECTION_KEYS.some(key => key in bundle)) {
+            throw new Error(policy.t('settings.telegram.managedByEnvironment', { variables: policy.environmentVariables.join(', ') }));
+        }
         const patch = expandPatch(bundle);
         const updated = await client.put<TelegramSnapshot>('/api/settings', patch);
         const fresh = (updated && typeof updated === 'object' && 'data' in updated
@@ -212,11 +229,14 @@ export default function ChannelsTelegram({ port, client, dirty, registerSave }:
                 <TransportStatusChips client={client} channel="telegram" />
             </SettingsSection>
 
-            <SettingsSection title="Telegram" hint="Bot token, allow-list, and forwarding rules.">
+            <SettingsSection title="Telegram" hint={environmentManaged
+                ? t('settings.telegram.managedByEnvironment', { variables: environmentVariables.join(', ') })
+                : 'Bot token, allow-list, and forwarding rules.'}>
                 <ToggleField
                     id="tg-enabled"
                     label="Telegram enabled"
                     value={enabled}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setEnabled(next);
                         setEntry('telegram.enabled', {
@@ -231,6 +251,7 @@ export default function ChannelsTelegram({ port, client, dirty, registerSave }:
                     label="Bot token"
                     value={token}
                     placeholder={tokenPlaceholder}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setToken(next);
                         // Empty input means "leave existing token alone"; only
@@ -252,6 +273,7 @@ export default function ChannelsTelegram({ port, client, dirty, registerSave }:
                     value={chips}
                     placeholder="123456789"
                     error={chipsError}
+                    disabled={environmentManaged}
                     onChange={(next) => {
                         setChips(next);
                         const allValid = next.every(isValidChatId);
@@ -303,7 +325,7 @@ export default function ChannelsTelegram({ port, client, dirty, registerSave }:
                 />
             </SettingsSection>
             </fieldset>
-            <ChannelSetupEntry channel="telegram" client={client} dirty={dirty}
+            <ChannelSetupEntry channel="telegram" client={client} dirty={dirty} disabled={environmentManaged}
                 open={setupOpen} onOpenChange={setSetupOpen} onSaved={async () => setData(await client.get<TelegramSnapshot>('/api/settings'))} />
         </form>
     );