dexterm-cli 0.1.1 → 0.1.3

package/dist/packages/cli/src/alerts/adapters/discord.js

@@ -0,0 +1,36 @@
+import { deliveryLine } from "../format.js";
+const nodeFetch = (url, init) => globalThis.fetch(url, init);
+export function createDiscordAdapter(deps) {
+    const creds = deps.creds;
+    const doFetch = deps.fetch ?? nodeFetch;
+    const timeoutMs = deps.timeoutMs ?? 8000;
+    return {
+        name: 'discord',
+        available: () => !!creds?.webhook,
+        deliver: async (d) => {
+            if (!creds)
+                return { ok: false, skipped: true, reason: 'discord not configured (dexterm alerts set-discord)' };
+            const ac = new AbortController();
+            const t = setTimeout(() => ac.abort(), timeoutMs);
+            try {
+                const res = await doFetch(creds.webhook, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json' },
+                    // Content is already firewalled; cap to Discord's 2000-char limit for safety.
+                    body: JSON.stringify({ content: deliveryLine(d).slice(0, 1900) }),
+                    signal: ac.signal,
+                });
+                if (!res.ok)
+                    return { ok: false, reason: `discord ${res.status}` };
+                return { ok: true };
+            }
+            catch (e) {
+                const name = e.name;
+                return { ok: false, reason: name === 'AbortError' ? 'discord timed out' : 'discord unreachable' };
+            }
+            finally {
+                clearTimeout(t);
+            }
+        },
+    };
+}

package/dist/packages/cli/src/alerts/adapters/telegram.js

@@ -0,0 +1,43 @@
+import { deliveryLine } from "../format.js";
+const nodeFetch = (url, init) => globalThis.fetch(url, init);
+export function createTelegramAdapter(deps) {
+    const creds = deps.creds;
+    const doFetch = deps.fetch ?? nodeFetch;
+    const timeoutMs = deps.timeoutMs ?? 8000;
+    return {
+        name: 'telegram',
+        available: () => !!creds?.token && !!creds?.chatId,
+        deliver: async (d) => {
+            if (!creds)
+                return { ok: false, skipped: true, reason: 'telegram not configured (dexterm alerts set-telegram)' };
+            const ac = new AbortController();
+            const t = setTimeout(() => ac.abort(), timeoutMs);
+            try {
+                const res = await doFetch(`https://api.telegram.org/bot${creds.token}/sendMessage`, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify({ chat_id: creds.chatId, text: deliveryLine(d), disable_web_page_preview: true }),
+                    signal: ac.signal,
+                });
+                // Never echo the token/url: only the status code and Telegram's own error description.
+                if (!res.ok) {
+                    let desc = '';
+                    try {
+                        const j = JSON.parse(await res.text());
+                        desc = j.description ? `: ${j.description}` : '';
+                    }
+                    catch { /* ignore body */ }
+                    return { ok: false, reason: `telegram ${res.status}${desc}`.slice(0, 160) };
+                }
+                return { ok: true };
+            }
+            catch (e) {
+                const name = e.name;
+                return { ok: false, reason: name === 'AbortError' ? 'telegram timed out' : 'telegram unreachable' };
+            }
+            finally {
+                clearTimeout(t);
+            }
+        },
+    };
+}

package/dist/packages/cli/src/alerts/adapters/toast.js

@@ -0,0 +1,16 @@
+import { deliveryLine } from "../format.js";
+export function createToastAdapter(sink) {
+    return {
+        name: 'toast',
+        available: () => true,
+        deliver: async (d) => {
+            try {
+                sink(deliveryLine(d), d);
+                return { ok: true };
+            }
+            catch (e) {
+                return { ok: false, reason: e.message };
+            }
+        },
+    };
+}

package/dist/packages/cli/src/alerts/creds.js

@@ -0,0 +1,83 @@
+// dexterm — alert-channel credentials (task-1398). Bot tokens and webhook URLs are NEVER in config.json
+// (the config schema has no key-shaped fields, by rule). They live in ~/.dexterm/<channel>.json, mode 0600,
+// outside every repo, read only by the adapters. Nothing here ever prints a secret; `redactCreds()` scrubs
+// a token / webhook out of any string before it could reach a log, a toast, a test fixture or an error.
+import { readFileSync, writeFileSync, mkdirSync, statSync, chmodSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+export const telegramCredsPath = (home) => join(home, 'telegram.json');
+export const discordCredsPath = (home) => join(home, 'discord.json');
+function readJson(path) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    try {
+        const v = JSON.parse(text);
+        return v && typeof v === 'object' && !Array.isArray(v) ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeJson(path, home, value) {
+    mkdirSync(home, { recursive: true, mode: 0o700 });
+    const tmp = `${path}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+    // rename is atomic; chmod again in case an old file had looser bits.
+    try {
+        chmodSync(tmp, 0o600);
+    }
+    catch { /* best effort */ }
+    renameSync(tmp, path);
+}
+export function readTelegramCreds(home) {
+    const j = readJson(telegramCredsPath(home));
+    if (!j)
+        return null;
+    const token = typeof j.token === 'string' ? j.token.trim() : '';
+    const chatId = typeof j.chatId === 'string' ? j.chatId.trim() : (typeof j.chatId === 'number' ? String(j.chatId) : '');
+    if (!token || !chatId)
+        return null;
+    return { token, chatId };
+}
+export function writeTelegramCreds(home, creds) {
+    if (!creds.token.trim())
+        throw new Error('telegram token is empty');
+    if (!/^-?\d{1,19}$/.test(creds.chatId.trim()))
+        throw new Error('telegram chatId must be a numeric id (e.g. 123456789 or -1001234567890)');
+    writeJson(telegramCredsPath(home), home, { token: creds.token.trim(), chatId: creds.chatId.trim() });
+}
+export function readDiscordCreds(home) {
+    const j = readJson(discordCredsPath(home));
+    if (!j)
+        return null;
+    const webhook = typeof j.webhook === 'string' ? j.webhook.trim() : '';
+    if (!webhook)
+        return null;
+    return { webhook };
+}
+export function writeDiscordCreds(home, creds) {
+    const w = creds.webhook.trim();
+    if (!/^https:\/\/(?:[a-z0-9.-]+\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/[\w-]+$/i.test(w)) {
+        throw new Error('discord webhook must be a https://discord.com/api/webhooks/<id>/<token> URL');
+    }
+    writeJson(discordCredsPath(home), home, { webhook: w });
+}
+/** True when the file exists with 0600-ish perms; a looser mode is reported so the user can tighten it. */
+export function credsMode(path) {
+    try {
+        return statSync(path).mode & 0o777;
+    }
+    catch {
+        return null;
+    }
+}
+const TELEGRAM_TOKEN_RE = /\b\d{6,}:[A-Za-z0-9_-]{20,}\b/g;
+const DISCORD_WEBHOOK_RE = /https:\/\/(?:[a-z0-9.-]+\.)?discord(?:app)?\.com\/api\/webhooks\/\S+/gi;
+/** Scrub any bot token / webhook URL out of a string before it could be logged or shown. Total; never throws. */
+export function redactCreds(s) {
+    return String(s ?? '').replace(TELEGRAM_TOKEN_RE, 'bot[redacted]').replace(DISCORD_WEBHOOK_RE, '[redacted-webhook]');
+}

package/dist/packages/cli/src/alerts/format.js

@@ -0,0 +1,66 @@
+// dexterm — turn a rule-engine alert / proposal into a firewalled AlertDelivery (task-1398). Pure.
+//
+// Untrusted text (a token symbol, and whatever the user put in the rule's alert text) is run through the
+// prompt firewall (control/bidi/ANSI stripped, URLs → [url], foreign base58 → [addr], wide glyphs → ▯,
+// injection-like content neutralised) and the spoken form through the `say` sanitiser (defuses `[[…]]`,
+// shortens addresses). Nothing reaches a channel raw.
+import { firewallText } from '../../../data/src/index.js';
+import { sanitizeSpeech } from '../../../voice/src/index.js';
+const TITLE_MAX = 64;
+const BODY_MAX = 180;
+/** Local short address (the copy module's own, inlined so the delivery layer imports no copy runtime). */
+function shortAddr(a) { return a.length <= 10 ? a : `${a.slice(0, 4)}…${a.slice(-4)}`; }
+/** Firewall a string; keep the row's own mint readable, drop URLs, cap length. */
+function fw(s, max, mint) {
+    return firewallText(s, { keepMint: mint ?? null, keepUrls: false, max }).text;
+}
+export function alertToDelivery(a) {
+    const symbol = fw(a.symbol, 24) || '?';
+    const body = fw(a.text, BODY_MAX, a.mint);
+    const title = `${symbol} ⚑`.slice(0, TITLE_MAX);
+    return {
+        kind: 'alert', level: a.level, title, body,
+        spoken: sanitizeSpeech(`${symbol}. ${body}`),
+        symbol, mint: a.mint, source: a.source, rule: a.rule, at: a.at,
+    };
+}
+export function proposalToDelivery(p) {
+    const symbol = fw(p.symbol, 24) || '?';
+    const what = p.type === 'ticket'
+        ? `rule proposes ${p.side} ${p.size} ${p.unit} — confirm in the app (nothing armed)`
+        : `rule asks the analyst: ${p.skill}`;
+    const body = fw(what, BODY_MAX, p.mint);
+    const title = `${symbol} ⚑ proposal`.slice(0, TITLE_MAX);
+    return {
+        kind: 'proposal', level: 'info', title, body,
+        spoken: sanitizeSpeech(`${symbol}. ${body}`),
+        symbol, mint: p.mint, source: p.source, rule: p.rule, at: p.at,
+    };
+}
+/**
+ * task-1399 — a WALLET TRACKER event (a followed wallet's decoded buy/sell) as a firewalled AlertDelivery, so a
+ * follow alert reaches the same push channels (desktop / Telegram / Discord) as a rule alert. The delivery layer
+ * stays read-only: this only READS the CopyAlert. `source` is `follow`; `rule` names the followed wallet (short,
+ * never a real-person label beyond the user's own words). A buy is `up`, a sell `down`. No performance claim: the
+ * body states the fill and carries "not a recommendation".
+ */
+export function copyAlertToDelivery(a) {
+    const tr = a.trade;
+    const did = tr.side === 'buy' ? 'bought' : 'sold';
+    const who = fw(a.name ?? shortAddr(a.wallet), 24) || shortAddr(a.wallet);
+    const mintShort = shortAddr(tr.mint);
+    const usd = tr.usd !== null ? ` ≈ $${tr.usd.toFixed(0)}` : '';
+    const sol = tr.solDelta !== null ? ` (${Math.abs(tr.solDelta).toFixed(3)} SOL)` : '';
+    const symbol = mintShort;
+    const title = `follow: ${who} ${did}`.slice(0, TITLE_MAX);
+    const body = fw(`${who} ${did} ${mintShort}${usd}${sol} · not a recommendation`, BODY_MAX, tr.mint);
+    return {
+        kind: 'alert', level: tr.side === 'buy' ? 'up' : 'down', title, body,
+        spoken: sanitizeSpeech(`${who} ${did} ${mintShort}${usd}`),
+        symbol, mint: tr.mint, source: 'follow', rule: shortAddr(a.wallet), at: a.t,
+    };
+}
+/** The one-line form a text channel sends (Telegram / Discord / stdout toast). */
+export function deliveryLine(d) {
+    return d.title === `${d.symbol} ⚑` ? `${d.title} ${d.body}` : `${d.title} — ${d.body}`;
+}

package/dist/packages/cli/src/alerts/index.js

@@ -0,0 +1,10 @@
+// dexterm — alert delivery subsystem (task-1398). See DESIGN.md.
+export * from "./types.js";
+export * from "./format.js";
+export * from "./route.js";
+export * from "./creds.js";
+export * from "./notifier.js";
+export { createToastAdapter } from "./adapters/toast.js";
+export { createDesktopAdapter } from "./adapters/desktop.js";
+export { createTelegramAdapter } from "./adapters/telegram.js";
+export { createDiscordAdapter } from "./adapters/discord.js";

package/dist/packages/cli/src/alerts/notifier.js

@@ -0,0 +1,53 @@
+import { CHANNELS } from "./types.js";
+import { routeChannels } from "./route.js";
+import { redactCreds, readTelegramCreds, readDiscordCreds } from "./creds.js";
+import { createToastAdapter } from "./adapters/toast.js";
+import { createDesktopAdapter } from "./adapters/desktop.js";
+import { createTelegramAdapter } from "./adapters/telegram.js";
+import { createDiscordAdapter } from "./adapters/discord.js";
+export function createNotifier(cfg, adapters) {
+    return {
+        async deliver(d) {
+            const results = [];
+            for (const name of routeChannels(cfg, d)) {
+                const ad = adapters[name];
+                if (!ad) {
+                    results.push({ channel: name, ok: false, skipped: true, reason: 'no adapter' });
+                    continue;
+                }
+                if (!ad.available()) {
+                    results.push({ channel: name, ok: false, skipped: true, reason: `${name} not configured` });
+                    continue;
+                }
+                try {
+                    results.push({ channel: name, ...(await ad.deliver(d)) });
+                }
+                catch (e) {
+                    results.push({ channel: name, ok: false, reason: redactCreds(e.message) });
+                }
+            }
+            return results;
+        },
+        readyChannels(level) {
+            const probe = { kind: 'alert', level: level ?? 'info' };
+            return routeChannels(cfg, probe).filter((n) => adapters[n]?.available());
+        },
+    };
+}
+/** Build a Notifier with the real adapters: toast + desktop + telegram/discord read from ~/.dexterm. */
+export function buildNotifier(home, cfg, deps) {
+    const adapters = {
+        toast: createToastAdapter(deps.toastSink),
+        desktop: createDesktopAdapter(deps.desktop),
+        telegram: createTelegramAdapter({ creds: readTelegramCreds(home), fetch: deps.fetch }),
+        discord: createDiscordAdapter({ creds: readDiscordCreds(home), fetch: deps.fetch }),
+    };
+    return createNotifier(cfg, adapters);
+}
+/** True when config enables at least one PUSH channel (desktop/telegram/discord) — i.e. a Notifier is worth building. */
+export function hasPushChannel(cfg) {
+    const ch = cfg?.channels;
+    if (!ch)
+        return false;
+    return CHANNELS.filter((c) => c !== 'toast').some((c) => ch[c]?.enabled === true);
+}

package/dist/packages/cli/src/alerts/route.js

@@ -0,0 +1,19 @@
+import { CHANNELS } from "./types.js";
+/** The channels a delivery is routed to, given config. Pure; order is CHANNELS order. */
+export function routeChannels(cfg, d) {
+    if (d.kind === 'proposal' && !cfg?.proposals)
+        return [];
+    const channels = cfg?.channels ?? {};
+    const out = [];
+    for (const name of CHANNELS) {
+        const c = channels[name];
+        const enabled = name === 'toast' ? c?.enabled !== false : c?.enabled === true;
+        if (!enabled)
+            continue;
+        const levels = c?.levels;
+        if (levels && levels.length > 0 && !levels.includes(d.level))
+            continue;
+        out.push(name);
+    }
+    return out;
+}

package/dist/packages/cli/src/alerts/types.js

@@ -0,0 +1 @@
+export const CHANNELS = ['toast', 'desktop', 'telegram', 'discord'];

package/dist/packages/cli/src/alerts-cmd.js

@@ -0,0 +1,212 @@
+// dexterm — `dexterm alerts …` (task-1398): configure WHERE rule alerts are delivered. No model, and the
+// only network is an explicit `dexterm alerts test`. Enable flags + the per-channel `levels` filter live in
+// config.json (user-only path); the Telegram bot token / Discord webhook URL are SECRETS and never touch
+// config.json, argv or a log — they come from an env var or stdin and are written to ~/.dexterm/<channel>.json
+// (0600). The command echoes only how many characters were stored, never the value.
+//
+//   dexterm alerts [status] | enable|disable <toast|desktop|telegram|discord> | levels <channel> <list|all>
+//                  | proposals <on|off> | set-telegram --chat <id> | set-discord | unset-telegram|unset-discord | test [channel]
+import { dextermHome, loadConfig, applyAndJournal } from '../../custom/src/index.js';
+import { readTelegramCreds, writeTelegramCreds, readDiscordCreds, writeDiscordCreds, telegramCredsPath, discordCredsPath, credsMode, } from "./alerts/creds.js";
+import { buildNotifier } from "./alerts/notifier.js";
+import { CHANNELS } from "./alerts/types.js";
+import { unlinkSync } from 'node:fs';
+export const ALERTS_USAGE = `usage: dexterm alerts [status]
+       dexterm alerts enable|disable <toast|desktop|telegram|discord>
+       dexterm alerts levels <channel> <up,down,info,warn | all>
+       dexterm alerts proposals <on|off>
+       dexterm alerts set-telegram --chat <id>   (token from $DEXTERM_TELEGRAM_TOKEN or stdin; never on argv)
+       dexterm alerts set-discord                (webhook from $DEXTERM_DISCORD_WEBHOOK or stdin; never on argv)
+       dexterm alerts unset-telegram | unset-discord
+       dexterm alerts test [channel]             (send a sample alert through the enabled channels)
+
+  Credentials are stored in ~/.dexterm/telegram.json / discord.json (0600), never in config.json or a log.
+`;
+const LEVELS = ['up', 'down', 'info', 'warn'];
+const isChannel = (s) => CHANNELS.includes(s);
+/** Read a secret from an env var, else one line of stdin. Never printed. Returns null when neither is available. */
+async function defaultReadSecret(io, envVar) {
+    const fromEnv = io.env[envVar];
+    if (typeof fromEnv === 'string' && fromEnv.trim())
+        return fromEnv.trim();
+    const stdin = io.stdin;
+    if (!stdin || stdin.isTTY) {
+        io.stderr.write(`dexterm alerts: set ${envVar} or pipe the value on stdin (never pass a secret on the command line)\n`);
+        return null;
+    }
+    return new Promise((resolve) => {
+        let buf = '';
+        stdin.setEncoding('utf8');
+        stdin.on('data', (c) => { buf += c; });
+        stdin.on('end', () => resolve(buf.split('\n')[0].trim() || null));
+        stdin.on('error', () => resolve(null));
+    });
+}
+/** Patch config.alerts as a whole (so a missing /alerts section is created, not a missing-parent error). */
+function setAlerts(home, mutate, why) {
+    const loaded = loadConfig(home);
+    const cur = loaded.config.alerts ? structuredClone(loaded.config.alerts) : {};
+    const next = mutate(cur);
+    const op = loaded.config.alerts === undefined ? 'add' : 'replace';
+    const { config } = applyAndJournal(home, [{ op, path: '/alerts', value: next }], { actor: 'user', why });
+    return config;
+}
+function renderStatus(home, cfg, io) {
+    io.stdout.write('alerts — delivery channels\n');
+    const ch = cfg?.channels ?? {};
+    for (const name of CHANNELS) {
+        const c = ch[name];
+        const on = name === 'toast' ? c?.enabled !== false : c?.enabled === true;
+        const levels = c?.levels && c.levels.length ? ` [${c.levels.join(',')}]` : '';
+        let detail = '';
+        if (name === 'telegram') {
+            const creds = readTelegramCreds(home);
+            detail = creds ? ` chat ${creds.chatId}, token set` : ' (no token — set-telegram)';
+        }
+        else if (name === 'discord') {
+            const creds = readDiscordCreds(home);
+            detail = creds ? ' webhook set' : ' (no webhook — set-discord)';
+        }
+        else if (name === 'desktop')
+            detail = process.platform === 'darwin' ? ' (osascript)' : process.platform === 'linux' ? ' (notify-send)' : ' (unsupported OS)';
+        io.stdout.write(`  ${on ? '●' : '○'} ${name.padEnd(9)}${on ? 'on ' : 'off'}${levels}${detail}\n`);
+    }
+    io.stdout.write(`  proposals: ${cfg?.proposals ? 'delivered' : 'in-app only'}\n`);
+    for (const [label, p] of [['telegram.json', telegramCredsPath(home)], ['discord.json', discordCredsPath(home)]]) {
+        const mode = credsMode(p);
+        if (mode !== null && mode !== 0o600)
+            io.stdout.write(`  ⚠ ${label} is mode 0${mode.toString(8)} (should be 0600; chmod 600 it)\n`);
+    }
+}
+export async function alertsCommand(argv, io, deps = {}) {
+    const home = dextermHome(io.env);
+    const cmd = argv[0] ?? 'status';
+    if (cmd === '--help' || cmd === '-h') {
+        io.stdout.write(ALERTS_USAGE);
+        return 0;
+    }
+    try {
+        switch (cmd) {
+            case 'status':
+                renderStatus(home, loadConfig(home).config.alerts, io);
+                return 0;
+            case 'enable':
+            case 'disable': {
+                const name = argv[1];
+                if (!name || !isChannel(name)) {
+                    io.stderr.write(`dexterm alerts: ${cmd} <${CHANNELS.join('|')}>\n`);
+                    return 2;
+                }
+                const on = cmd === 'enable';
+                if (on && name === 'telegram' && !readTelegramCreds(home))
+                    io.stderr.write('note: telegram has no token yet — run `dexterm alerts set-telegram --chat <id>`\n');
+                if (on && name === 'discord' && !readDiscordCreds(home))
+                    io.stderr.write('note: discord has no webhook yet — run `dexterm alerts set-discord`\n');
+                setAlerts(home, (a) => { const ch = { ...(a.channels ?? {}) }; ch[name] = { ...(ch[name] ?? {}), enabled: on }; return { ...a, channels: ch }; }, `${cmd} alerts ${name}`);
+                io.stdout.write(`${name} ${on ? 'enabled' : 'disabled'}\n`);
+                return 0;
+            }
+            case 'levels': {
+                const name = argv[1];
+                const spec = argv[2];
+                if (!name || !isChannel(name) || !spec) {
+                    io.stderr.write('dexterm alerts: levels <channel> <up,down,info,warn | all>\n');
+                    return 2;
+                }
+                let levels;
+                if (spec !== 'all') {
+                    const parts = spec.split(',').map((s) => s.trim()).filter(Boolean);
+                    const bad = parts.filter((p) => !LEVELS.includes(p));
+                    if (bad.length || !parts.length) {
+                        io.stderr.write(`dexterm alerts: bad levels "${spec}" (use ${LEVELS.join(',')} or all)\n`);
+                        return 2;
+                    }
+                    levels = parts;
+                }
+                setAlerts(home, (a) => { const ch = { ...(a.channels ?? {}) }; const c = { ...(ch[name] ?? {}) }; if (levels)
+                    c.levels = levels;
+                else
+                    delete c.levels; ch[name] = c; return { ...a, channels: ch }; }, `alerts levels ${name}`);
+                io.stdout.write(`${name} levels: ${levels ? levels.join(',') : 'all'}\n`);
+                return 0;
+            }
+            case 'proposals': {
+                const v = argv[1];
+                if (v !== 'on' && v !== 'off') {
+                    io.stderr.write('dexterm alerts: proposals <on|off>\n');
+                    return 2;
+                }
+                setAlerts(home, (a) => ({ ...a, proposals: v === 'on' }), `alerts proposals ${v}`);
+                io.stdout.write(`proposal delivery ${v === 'on' ? 'on' : 'off'}\n`);
+                return 0;
+            }
+            case 'set-telegram': {
+                const ci = argv.indexOf('--chat');
+                const chatId = ci >= 0 ? argv[ci + 1] : undefined;
+                if (!chatId) {
+                    io.stderr.write('dexterm alerts: set-telegram --chat <id>\n');
+                    return 2;
+                }
+                const token = await (deps.readSecret ? deps.readSecret('telegram bot token') : defaultReadSecret(io, 'DEXTERM_TELEGRAM_TOKEN'));
+                if (!token)
+                    return 2;
+                writeTelegramCreds(home, { token, chatId });
+                io.stdout.write(`telegram token stored (${token.length} chars) for chat ${chatId} in ~/.dexterm/telegram.json (0600)\n`);
+                return 0;
+            }
+            case 'set-discord': {
+                const webhook = await (deps.readSecret ? deps.readSecret('discord webhook url') : defaultReadSecret(io, 'DEXTERM_DISCORD_WEBHOOK'));
+                if (!webhook)
+                    return 2;
+                writeDiscordCreds(home, { webhook });
+                io.stdout.write(`discord webhook stored (${webhook.length} chars) in ~/.dexterm/discord.json (0600)\n`);
+                return 0;
+            }
+            case 'unset-telegram': {
+                try {
+                    unlinkSync(telegramCredsPath(home));
+                }
+                catch { /* ignore */ }
+                io.stdout.write('telegram credentials removed\n');
+                return 0;
+            }
+            case 'unset-discord': {
+                try {
+                    unlinkSync(discordCredsPath(home));
+                }
+                catch { /* ignore */ }
+                io.stdout.write('discord credentials removed\n');
+                return 0;
+            }
+            case 'test': {
+                const only = argv[1];
+                if (only && !isChannel(only)) {
+                    io.stderr.write(`dexterm alerts: test [<${CHANNELS.join('|')}>]\n`);
+                    return 2;
+                }
+                const cfg = loadConfig(home).config.alerts;
+                const notifier = deps.notifier ?? buildNotifier(home, cfg, { toastSink: (line) => io.stdout.write(`toast: ${line}\n`) });
+                const sample = {
+                    kind: 'alert', level: 'info', title: 'dexterm ⚑ test', body: 'alert delivery test — if you see this, the channel works.',
+                    spoken: 'dexterm test alert', symbol: 'dexterm', mint: '', source: 'user', rule: 'alerts-test', at: Date.now(),
+                };
+                const results = await notifier.deliver(sample);
+                const shown = only ? results.filter((r) => r.channel === only) : results;
+                if (!shown.length) {
+                    io.stdout.write('no channel routed this alert (enable one first)\n');
+                    return 0;
+                }
+                for (const r of shown)
+                    io.stdout.write(`  ${r.ok ? '✓' : r.skipped ? '–' : '✗'} ${r.channel}${r.reason ? `: ${r.reason}` : ''}\n`);
+                return shown.every((r) => r.ok || r.skipped) ? 0 : 1;
+            }
+            default:
+                io.stderr.write(`dexterm alerts: unknown subcommand "${cmd}"\n\n${ALERTS_USAGE}`);
+                return 2;
+        }
+    }
+    catch (e) {
+        io.stderr.write(`dexterm alerts: ${e.message}\n`);
+        return 1;
+    }
+}