dexto 1.2.3 → 1.2.5

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Load environment variables FIRST with layered loading
-import { applyLayeredEnvironmentLoading } from '@dexto/core';
+import { applyLayeredEnvironmentLoading } from './utils/env.js';
 // Apply layered environment loading before any other imports
 await applyLayeredEnvironmentLoading();
 import { existsSync } from 'fs';
@@ -14,23 +14,23 @@ import { withAnalytics, safeExit, ExitSignal } from './analytics/wrapper.js';
 // Use createRequire to import package.json without experimental warning
 const require = createRequire(import.meta.url);
 const pkg = require('../package.json');
-import { logger, getProviderFromModel, getAllSupportedModels, DextoAgent, loadAgentConfig, globalPreferencesExist, loadGlobalPreferences, } from '@dexto/core';
-import { resolveAgentPath, getAgentRegistry, isPath, resolveApiKeyForProvider, getPrimaryApiKeyEnvVar, } from '@dexto/core';
-import { startAiCli, startHeadlessCli, loadMostRecentSession } from './cli/cli.js';
-import { startApiServer } from './api/server.js';
+import { logger, getProviderFromModel, getAllSupportedModels, DextoAgent, isPath, resolveApiKeyForProvider, getPrimaryApiKeyEnvVar, } from '@dexto/core';
+import { resolveAgentPath, getAgentRegistry, loadAgentConfig, globalPreferencesExist, loadGlobalPreferences, } from '@dexto/agent-management';
+import { startHonoApiServer } from './api/server-hono.js';
 import { startDiscordBot } from './discord/bot.js';
 import { startTelegramBot } from './telegram/bot.js';
 import { validateCliOptions, handleCliOptionsError } from './cli/utils/options.js';
 import { validateAgentConfig } from './cli/utils/config-validation.js';
 import { applyCLIOverrides } from './config/cli-overrides.js';
-import { getPort } from '@dexto/core';
+import { enrichAgentConfig } from '@dexto/agent-management';
+import { getPort } from './utils/port-utils.js';
 import { createDextoProject, createTsconfigJson, addDextoScriptsToPackageJson, postCreateDexto, initDexto, postInitDexto, getUserInputToInitDextoApp, } from './cli/commands/index.js';
 import { handleSetupCommand, handleInstallCommand, handleUninstallCommand, handleListAgentsCommand, handleWhichCommand, } from './cli/commands/index.js';
 import { handleSessionListCommand, handleSessionHistoryCommand, handleSessionDeleteCommand, handleSessionSearchCommand, } from './cli/commands/session-commands.js';
 import { requiresSetup } from './cli/utils/setup-utils.js';
 import { checkForFileInCurrentDirectory, FileNotFoundError } from './cli/utils/package-mgmt.js';
 import { startNextJsWebServer } from './web.js';
-import { initializeMcpServer, createMcpTransport } from './api/mcp/mcp_handler.js';
+import { initializeMcpServer, createMcpTransport } from '@dexto/server';
 import { createAgentCard } from '@dexto/core';
 import { initializeMcpToolAggregationServer } from './api/mcp/tool-aggregation-handler.js';
 const program = new Command();
@@ -50,8 +50,8 @@ program
     .option('-m, --model <model>', 'Specify the LLM model to use')
     .option('--router <router>', 'Specify the LLM router to use (vercel or in-built)')
     .option('--auto-approve', 'Always approve tool executions without confirmation prompts')
-    .option('-c, --continue', 'Continue most recent conversation')
-    .option('-r, --resume <sessionId>', 'Resume session by ID')
+    .option('-c, --continue', 'Continue most recent session (requires -p/prompt)')
+    .option('-r, --resume <sessionId>', 'Resume specific session (requires -p/prompt)')
     .option('--mode <mode>', 'The application in which dexto should talk to you - web | cli | server | discord | telegram | mcp', 'web')
     .option('--web-port <port>', 'port for the web UI (default: 3000)', '3000')
     .option('--api-port <port>', 'port for the API server (default: web-port + 1)')
@@ -240,7 +240,18 @@ async function bootstrapAgentFromGlobalOpts() {
     const resolvedPath = await resolveAgentPath(globalOpts.agent, globalOpts.autoInstall !== false, true);
     const rawConfig = await loadAgentConfig(resolvedPath);
     const mergedConfig = applyCLIOverrides(rawConfig, globalOpts);
-    const agent = new DextoAgent(mergedConfig, resolvedPath);
+    const enrichedConfig = enrichAgentConfig(mergedConfig, resolvedPath);
+    // Override approval config for read-only commands (never run conversations)
+    // This avoids needing to set up unused approval handlers
+    enrichedConfig.toolConfirmation = {
+        mode: 'auto-approve',
+        timeout: enrichedConfig.toolConfirmation?.timeout ?? 120000,
+    };
+    enrichedConfig.elicitation = {
+        enabled: false,
+        timeout: enrichedConfig.elicitation?.timeout ?? 120000,
+    };
+    const agent = new DextoAgent(enrichedConfig, resolvedPath);
     await agent.start();
     // Register graceful shutdown
     const shutdown = async () => {
@@ -255,6 +266,30 @@ async function bootstrapAgentFromGlobalOpts() {
     process.on('SIGTERM', shutdown);
     return agent;
 }
+// Helper to find the most recent session
+// @param includeHeadless - If false, skip ephemeral headless sessions (for interactive mode)
+//                          If true, include all sessions (for headless mode continuation)
+async function getMostRecentSessionId(agent, includeHeadless = false) {
+    const sessionIds = await agent.listSessions();
+    if (sessionIds.length === 0) {
+        return null;
+    }
+    // Get metadata for all sessions to find most recent
+    let mostRecentId = null;
+    let mostRecentActivity = 0;
+    for (const sessionId of sessionIds) {
+        // Skip ephemeral headless sessions unless includeHeadless is true
+        if (!includeHeadless && sessionId.startsWith('headless-')) {
+            continue;
+        }
+        const metadata = await agent.getSessionMetadata(sessionId);
+        if (metadata && metadata.lastActivity > mostRecentActivity) {
+            mostRecentActivity = metadata.lastActivity;
+            mostRecentId = sessionId;
+        }
+    }
+    return mostRecentId;
+}
 // 9) `session` SUB-COMMAND
 const sessionCommand = program.command('session').description('Manage chat sessions');
 sessionCommand
@@ -416,24 +451,28 @@ program
     '  dexto -p "query"         Run one-shot query, then exit\n' +
     '  cat file | dexto -p "query"  Process piped content\n\n' +
     'CLI Mode:\n' +
-    '  dexto --mode cli         Start interactive CLI REPL\n\n' +
-    'Session Management:\n' +
-    '  dexto -c                 Continue most recent conversation\n' +
-    '  dexto -c -p "query"      Continue with one-shot query, then exit\n' +
-    '  dexto -r "<session-id>" "query"  Resume with one-shot query\n\n' +
-    'Tool Confirmation:\n' +
-    '  dexto --auto-approve     Auto-approve all tool executions\n\n' +
+    '  dexto --mode cli         Start interactive CLI\n\n' +
+    'Headless Session Continuation:\n' +
+    '  dexto -c -p "message"           Continue most recent session\n' +
+    '  dexto -r <session-id> -p "msg"  Resume specific session by ID\n' +
+    '  (Interactive mode: use /resume command instead)\n\n' +
+    'Session Management Commands:\n' +
+    '  dexto session list              List all sessions\n' +
+    '  dexto session history [id]      Show session history\n' +
+    '  dexto session delete <id>       Delete a session\n' +
+    '  dexto search <query>            Search across sessions\n' +
+    '    Options: --session <id>, --role <user|assistant>, --limit <n>\n\n' +
     'Agent Selection:\n' +
     '  dexto --agent coding-agent       Use installed agent by name\n' +
     '  dexto --agent ./my-agent.yml     Use agent from file path\n' +
     '  dexto -a agents/custom.yml       Short form with relative path\n\n' +
+    'Tool Confirmation:\n' +
+    '  dexto --auto-approve     Auto-approve all tool executions\n\n' +
     'Advanced Modes:\n' +
     '  dexto --mode server      Run as API server\n' +
     '  dexto --mode discord     Run as Discord bot\n' +
     '  dexto --mode telegram    Run as Telegram bot\n' +
     '  dexto --mode mcp         Run as MCP server\n\n' +
-    'Session Commands: dexto session list|history|delete • search\n' +
-    'Search: dexto search <query> [--session <id>] [--role <role>]\n\n' +
     'See https://docs.dexto.ai for documentation and examples')
     .action(withAnalytics('main', async (prompt = []) => {
     // ——— ENV CHECK (optional) ———
@@ -482,11 +521,19 @@ program
     }
     // Note: Agent selection must be passed via -a/--agent. We no longer interpret
     // the first positional argument as an agent name to avoid ambiguity with prompts.
+    // ——— VALIDATE SESSION FLAGS ———
+    // -c and -r are for headless mode only (require a prompt)
+    if ((opts.continue || opts.resume) && !headlessInput) {
+        console.error('❌ Session continuation flags (-c/--continue or -r/--resume) require a prompt for headless mode.');
+        console.error('   Provide a prompt: dexto -c -p "your message" or dexto -r <sessionId> -p "your message"');
+        console.error('   For interactive mode with session management, use: dexto (starts new) or use /resume command');
+        safeExit('main', 1, 'session-flag-without-prompt');
+    }
     // ——— FORCE CLI MODE FOR HEADLESS PROMPTS ———
     // If a prompt was provided via -p or positional args, force CLI mode
     if (headlessInput && opts.mode !== 'cli') {
-        console.log(`ℹ️  Prompt detected via -p or positional argument. Forcing CLI mode for one-shot execution.`);
-        console.log(`   Original mode: ${opts.mode} → Overridden to: cli`);
+        console.error(`ℹ️  Prompt detected via -p or positional argument. Forcing CLI mode for one-shot execution.`);
+        console.error(`   Original mode: ${opts.mode} → Overridden to: cli`);
         opts.mode = 'cli';
     }
     // ——— Infer provider & API key from model ———
@@ -558,8 +605,13 @@ program
         // Load raw config and apply CLI overrides
         const rawConfig = await loadAgentConfig(resolvedPath);
         const mergedConfig = applyCLIOverrides(rawConfig, opts);
-        // Validate with interactive setup if needed (for API key issues)
-        validatedConfig = await validateAgentConfig(mergedConfig, opts.interactive !== false);
+        // Enrich config with per-agent paths BEFORE validation
+        // Enrichment adds filesystem paths to storage (schema has in-memory defaults)
+        // Interactive CLI mode: only log to file (console would interfere with chat UI)
+        const isInteractiveCli = opts.mode === 'cli' && !headlessInput;
+        const enrichedConfig = enrichAgentConfig(mergedConfig, resolvedPath, isInteractiveCli);
+        // Validate enriched config with interactive setup if needed (for API key issues)
+        validatedConfig = await validateAgentConfig(enrichedConfig, opts.interactive !== false);
     }
     catch (err) {
         if (err instanceof ExitSignal)
@@ -568,11 +620,39 @@ program
         console.error(`❌ Failed to load configuration: ${err}`);
         safeExit('main', 1, 'config-load-failed');
     }
+    // ——— VALIDATE APPROVAL MODE COMPATIBILITY ———
+    // Check if approval handler is needed (manual mode OR elicitation enabled)
+    const needsHandler = validatedConfig.toolConfirmation?.mode === 'manual' ||
+        validatedConfig.elicitation.enabled;
+    if (needsHandler) {
+        // Headless CLI cannot do interactive approval
+        if (opts.mode === 'cli' && headlessInput) {
+            console.error('❌ Manual approval and elicitation are not supported in headless CLI mode (pipes/scripts).');
+            console.error('💡 Use interactive CLI mode, or update your config:');
+            console.error('   - Set toolConfirmation.mode to "auto-approve" or "auto-deny"');
+            console.error('   - Set elicitation.enabled to false');
+            safeExit('main', 1, 'approval-unsupported-headless');
+        }
+        // Only web, server, and interactive CLI support approval handlers
+        // TODO: Add approval support for other modes:
+        // - Discord: Could use Discord message buttons/reactions for approval UI
+        // - Telegram: Could use Telegram inline keyboards for approval prompts
+        // - MCP: Could implement callback-based approval mechanism in MCP protocol
+        const supportedModes = ['web', 'server', 'cli'];
+        if (!supportedModes.includes(opts.mode)) {
+            console.error(`❌ Manual approval and elicitation are not supported in "${opts.mode}" mode.`);
+            console.error(`💡 These features require interactive UI and are only supported in: ${supportedModes.join(', ')}`);
+            console.error('   Update your config:');
+            console.error('   - Set toolConfirmation.mode to "auto-approve" or "auto-deny"');
+            console.error('   - Set elicitation.enabled to false');
+            safeExit('main', 1, 'approval-unsupported-mode');
+        }
+    }
     // ——— CREATE AGENT ———
     let agent;
     let derivedAgentId;
     try {
-        console.log(`🚀 Initializing Dexto with config: ${resolvedPath}`);
+        console.error(`🚀 Initializing Dexto with config: ${resolvedPath}`);
         // Set run mode for tool confirmation provider
         process.env.DEXTO_RUN_MODE = opts.mode;
         // Apply --strict flag to all server configs
@@ -582,10 +662,16 @@ program
                 serverConfig.connectionMode = 'strict';
             }
         }
+        // Config is already enriched and validated - ready for agent creation
         // DextoAgent will parse/validate again (parse-twice pattern)
         agent = new DextoAgent(validatedConfig, resolvedPath);
         // Start the agent (initialize async services)
-        await agent.start();
+        // - web/server modes: initializeHonoApi will set approval handler and start the agent
+        // - cli mode: handles its own approval setup in the case block
+        // - other modes: start immediately (no approval support)
+        if (opts.mode !== 'web' && opts.mode !== 'server' && opts.mode !== 'cli') {
+            await agent.start();
+        }
         // Derive a concise agent ID for display purposes (used by API/UI)
         // Prefer agentCard.name, otherwise extract from filename
         derivedAgentId =
@@ -600,69 +686,170 @@ program
         safeExit('main', 1, 'config-error');
     }
     // ——— Dispatch based on --mode ———
+    // TODO: Refactor mode-specific logic into separate handler files
+    // This switch statement has grown large with nested if-else chains for each mode.
+    // Consider breaking down into mode-specific handlers (e.g., cli/modes/cli.ts, cli/modes/web.ts)
+    // to improve maintainability and reduce complexity in this entry point file.
+    // See PR 450 comment: https://github.com/truffle-ai/dexto/pull/450#discussion_r2546242983
     switch (opts.mode) {
         case 'cli': {
-            // Handle session options - only for CLI mode
-            if (opts.resume) {
-                try {
+            // Set up approval handler for interactive CLI if manual mode OR elicitation enabled
+            // Note: Headless CLI with manual mode is blocked by validation above
+            // Ink CLI uses ApprovalCoordinator (same as server/web mode) to coordinate
+            // approval requests with React UI components
+            const needsHandler = !headlessInput &&
+                (validatedConfig.toolConfirmation?.mode === 'manual' ||
+                    validatedConfig.elicitation.enabled);
+            if (needsHandler) {
+                const { createManualApprovalHandler, ApprovalCoordinator } = await import('@dexto/server');
+                const approvalCoordinator = new ApprovalCoordinator();
+                const handler = createManualApprovalHandler(approvalCoordinator);
+                agent.setApprovalHandler(handler);
+                logger.debug('Event-based approval handler configured for Ink CLI');
+            }
+            // Start the agent now that approval handler is configured
+            await agent.start();
+            // Session management - CLI uses explicit sessionId like WebUI
+            // NOTE: Migrated from defaultSession pattern which will be deprecated in core
+            // We now pass sessionId explicitly to all agent methods (agent.run, agent.switchLLM, etc.)
+            // Note: CLI uses different implementations for interactive vs headless modes
+            // - Interactive: Ink CLI with full TUI
+            // - Headless: CLISubscriber (no TUI, works in pipes/scripts)
+            if (headlessInput) {
+                // Headless mode - isolated execution by default
+                // Each run gets a unique ephemeral session to avoid context bleeding between runs
+                // Use persistent session if explicitly resuming with -r or -c
+                let headlessSessionId;
+                if (opts.resume) {
                     // Resume specific session by ID
-                    await agent.loadSessionAsDefault(opts.resume);
-                    logger.info(`Resumed session: ${opts.resume}`, null, 'cyan');
+                    try {
+                        const session = await agent.getSession(opts.resume);
+                        if (!session) {
+                            console.error(`❌ Session '${opts.resume}' not found`);
+                            console.error('💡 Use `dexto session list` to see available sessions');
+                            safeExit('main', 1, 'resume-failed');
+                        }
+                        headlessSessionId = opts.resume;
+                        logger.info(`Resumed session: ${headlessSessionId}`, null, 'cyan');
+                    }
+                    catch (err) {
+                        console.error(`❌ Failed to resume session '${opts.resume}': ${err instanceof Error ? err.message : String(err)}`);
+                        console.error('💡 Use `dexto session list` to see available sessions');
+                        safeExit('main', 1, 'resume-failed');
+                    }
                 }
-                catch (err) {
-                    console.error(`❌ Failed to resume session '${opts.resume}': ${err instanceof Error ? err.message : String(err)}`);
-                    console.error('💡 Use `dexto session list` to see available sessions');
-                    safeExit('main', 1, 'resume-failed');
+                else if (opts.continue) {
+                    // Continue most recent conversation (include headless sessions in headless mode)
+                    const mostRecentSessionId = await getMostRecentSessionId(agent, true);
+                    if (!mostRecentSessionId) {
+                        console.error(`❌ No previous sessions found`);
+                        console.error('💡 Start a new conversation or use `dexto session list` to see available sessions');
+                        safeExit('main', 1, 'no-sessions-found');
+                    }
+                    headlessSessionId = mostRecentSessionId;
+                    logger.info(`Continuing most recent session: ${headlessSessionId}`, null, 'cyan');
                 }
-            }
-            else if (opts.continue) {
+                else {
+                    // TODO: Remove this workaround once defaultSession is deprecated in core
+                    // Currently passing null/undefined to agent.run() falls back to defaultSession,
+                    // causing context to bleed between headless runs. We create a unique ephemeral
+                    // session ID to ensure each headless run is isolated.
+                    // When defaultSession is removed, we can pass null here for truly stateless execution.
+                    headlessSessionId = `headless-${Date.now()}-${Math.random().toString(36).substring(7)}`;
+                    logger.debug(`Created ephemeral session for headless run: ${headlessSessionId}`);
+                }
+                // Headless mode - use CLISubscriber for simple stdout output
+                const llm = agent.getCurrentLLMConfig();
+                capture('dexto_prompt', {
+                    mode: 'headless',
+                    provider: llm.provider,
+                    model: llm.model,
+                });
+                const { CLISubscriber } = await import('./cli/cli-subscriber.js');
+                const cliSubscriber = new CLISubscriber();
+                cliSubscriber.subscribe(agent.agentEventBus);
                 try {
-                    // Continue from most recent session
-                    await loadMostRecentSession(agent);
-                    // If no sessions existed, create a new one to honor default-new invariant
-                    const sessionsAfter = await agent.listSessions();
-                    if (sessionsAfter.length === 0) {
-                        const session = await agent.createSession();
-                        await agent.loadSessionAsDefault(session.id);
-                        logger.info(`Created new session: ${session.id}`, null, 'green');
+                    await cliSubscriber.runAndWait(agent, headlessInput, headlessSessionId);
+                    // Clean up before exit
+                    cliSubscriber.cleanup();
+                    try {
+                        await agent.stop();
+                    }
+                    catch (stopError) {
+                        logger.debug(`Agent stop error (ignoring): ${stopError}`);
                     }
+                    safeExit('main', 0);
                 }
-                catch (err) {
-                    console.error(`❌ Failed to continue session: ${err instanceof Error ? err.message : String(err)}`);
-                    safeExit('main', 1, 'continue-failed');
+                catch (error) {
+                    // Rethrow ExitSignal - it's not an error, it's how safeExit works
+                    if (error instanceof ExitSignal)
+                        throw error;
+                    // Write to stderr for headless users/scripts
+                    const errorMessage = error instanceof Error ? error.message : String(error);
+                    console.error(`❌ Error in headless mode: ${errorMessage}`);
+                    if (error instanceof Error && error.stack) {
+                        console.error(error.stack);
+                    }
+                    // Also log for diagnostics
+                    logger.error(`Error in headless mode: ${errorMessage}`);
+                    cliSubscriber.cleanup();
+                    await agent.stop().catch(() => { }); // Best effort cleanup
+                    safeExit('main', 1, 'headless-error');
                 }
             }
             else {
-                // Default behavior: create new session for CLI mode
+                // Interactive mode - session management handled via /resume command
+                // Note: -c and -r flags are validated to require a prompt (headless mode only)
+                // Defer session creation until first message is sent to prevent stale empty sessions
+                const cliSessionId = null;
+                // Interactive mode - use Ink CLI with session support
+                // Suppress console output before starting Ink UI
+                const originalConsole = {
+                    log: console.log,
+                    error: console.error,
+                    warn: console.warn,
+                    info: console.info,
+                };
+                const noOp = () => { };
+                console.log = noOp;
+                console.error = noOp;
+                console.warn = noOp;
+                console.info = noOp;
+                let inkError = undefined;
                 try {
-                    const session = await agent.createSession();
-                    await agent.loadSessionAsDefault(session.id);
-                    logger.info(`Created new session: ${session.id}`, null, 'green');
+                    const { startInkCliRefactored } = await import('./cli/ink-cli/InkCLIRefactored.js');
+                    await startInkCliRefactored(agent, cliSessionId);
                 }
-                catch (err) {
-                    console.error(`❌ Failed to create new session: ${err instanceof Error ? err.message : String(err)}`);
-                    safeExit('main', 1, 'create-session-failed');
+                catch (error) {
+                    inkError = error;
+                }
+                finally {
+                    // Restore console methods so any errors are visible
+                    console.log = originalConsole.log;
+                    console.error = originalConsole.error;
+                    console.warn = originalConsole.warn;
+                    console.info = originalConsole.info;
+                }
+                // Stop the agent after Ink CLI exits
+                try {
+                    await agent.stop();
+                }
+                catch {
+                    // Ignore shutdown errors
+                }
+                // Handle any errors from Ink CLI
+                if (inkError) {
+                    if (inkError instanceof ExitSignal)
+                        throw inkError;
+                    const errorMessage = inkError instanceof Error ? inkError.message : String(inkError);
+                    console.error(`❌ Ink CLI failed: ${errorMessage}`);
+                    if (inkError instanceof Error && inkError.stack) {
+                        console.error(inkError.stack);
+                    }
+                    safeExit('main', 1, 'ink-cli-error');
                 }
-            }
-            const toolConfirmationMode = agent.getEffectiveConfig().toolConfirmation?.mode ?? 'event-based';
-            if (toolConfirmationMode === 'event-based') {
-                // Set up CLI tool confirmation subscriber
-                const { CLIToolConfirmationSubscriber } = await import('./cli/tool-confirmation/cli-confirmation-handler.js');
-                const cliSubscriber = new CLIToolConfirmationSubscriber();
-                cliSubscriber.subscribe(agent.agentEventBus);
-                logger.info('Setting up CLI event subscriptions...');
-            }
-            else {
-                logger.info(`Tool confirmation mode '${toolConfirmationMode}' active – skipping interactive CLI approval prompts.`);
-            }
-            if (headlessInput) {
-                // One shot CLI
-                await startHeadlessCli(agent, headlessInput);
                 safeExit('main', 0);
             }
-            else {
-                await startAiCli(agent); // Interactive CLI
-            }
             break;
         }
         case 'web': {
@@ -675,8 +862,8 @@ program
             const apiPort = getPort(process.env.API_PORT, defaultApiPort, 'API_PORT');
             const apiUrl = process.env.API_URL ?? `http://localhost:${apiPort}`;
             const nextJSserverURL = process.env.FRONTEND_URL ?? `http://localhost:${frontPort}`;
-            // Start API server
-            await startApiServer(agent, apiPort, agent.getEffectiveConfig().agentCard || {}, derivedAgentId);
+            // Start API server (Hono)
+            await startHonoApiServer(agent, apiPort, agent.config.agentCard || {}, derivedAgentId);
             // Start Next.js web server
             const webServerStarted = await startNextJsWebServer(apiUrl, frontPort, nextJSserverURL);
             // Open WebUI in browser if server started successfully
@@ -692,24 +879,24 @@ program
             }
             break;
         }
-        // Start server with REST APIs and WebSockets on port 3001
+        // Start server with REST APIs and SSE on port 3001
         // This also enables dexto to be used as a remote mcp server at localhost:3001/mcp
         case 'server': {
-            // Start server with REST APIs and WebSockets only
-            const agentCard = agent.getEffectiveConfig().agentCard ?? {};
+            // Start server with REST APIs and SSE only
+            const agentCard = agent.config.agentCard ?? {};
             // Use explicit --api-port if provided, otherwise default to 3001
             const defaultApiPort = opts.apiPort ? parseInt(opts.apiPort, 10) : 3001;
             const apiPort = getPort(process.env.API_PORT, defaultApiPort, 'API_PORT');
             const apiUrl = process.env.API_URL ?? `http://localhost:${apiPort}`;
-            console.log('🌐 Starting server (REST APIs + WebSockets)...');
-            await startApiServer(agent, apiPort, agentCard, derivedAgentId);
+            console.log('🌐 Starting server (REST APIs + SSE)...');
+            await startHonoApiServer(agent, apiPort, agentCard, derivedAgentId);
             console.log(`✅ Server running at ${apiUrl}`);
             console.log('Available endpoints:');
             console.log('  POST /api/message - Send async message');
             console.log('  POST /api/message-sync - Send sync message');
             console.log('  POST /api/reset - Reset conversation');
             console.log('  GET  /api/mcp/servers - List MCP servers');
-            console.log('  WebSocket support available for real-time events');
+            console.log('  SSE support available for real-time events');
             break;
         }
         case 'discord':
@@ -738,7 +925,7 @@ program
         // Use `dexto --mode server` to start dexto as a remote server
         case 'mcp': {
             // Start stdio mcp server only
-            const agentCardConfig = agent.getEffectiveConfig().agentCard || {
+            const agentCardConfig = agent.config.agentCard || {
                 name: 'dexto',
                 version: '1.0.0',
             };
@@ -752,7 +939,7 @@ program
                 );
                 // Use stdio transport in mcp mode
                 const mcpTransport = await createMcpTransport('stdio');
-                await initializeMcpServer(() => agent, () => agentCardData, mcpTransport);
+                await initializeMcpServer(agent, agentCardData, mcpTransport);
             }
             catch (err) {
                 // Write to stderr instead of stdout to avoid interfering with MCP protocol

package/dist/telegram/bot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bot.d.ts","sourceRoot":"","sources":["../../src/telegram/bot.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,GAAG,EAAkB,MAAM,QAAQ,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAyCzC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,gFAoMjD"}
+{"version":3,"file":"bot.d.ts","sourceRoot":"","sources":["../../src/telegram/bot.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,GAAG,EAAkB,MAAM,QAAQ,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAU,MAAM,aAAa,CAAC;AAyCjD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,gFAyOjD"}

package/dist/telegram/bot.js

@@ -2,6 +2,7 @@
 import dotenv from 'dotenv';
 import { Bot, InlineKeyboard } from 'grammy';
 import https from 'https';
+import { logger } from '@dexto/core';
 // Load environment variables (including TELEGRAM_BOT_TOKEN)
 dotenv.config();
 const token = process.env.TELEGRAM_BOT_TOKEN;
@@ -40,6 +41,11 @@ export function startTelegramBot(agent) {
     // Create and start Telegram Bot
     const bot = new Bot(token);
     console.log('Telegram bot started');
+    // Helper to get or create session for a Telegram user
+    // Each Telegram user gets their own persistent session
+    function getTelegramSessionId(userId) {
+        return `telegram-${userId}`;
+    }
     // /start command with sample buttons
     bot.command('start', async (ctx) => {
         const keyboard = new InlineKeyboard()
@@ -53,9 +59,10 @@ export function startTelegramBot(agent) {
     // Handle button callbacks
     bot.on('callback_query:data', async (ctx) => {
         const action = ctx.callbackQuery.data;
+        const sessionId = getTelegramSessionId(ctx.callbackQuery.from.id);
         try {
             if (action === 'reset') {
-                await agent.resetConversation();
+                await agent.resetConversation(sessionId);
                 await ctx.reply('🔄 Conversation has been reset.');
             }
             else if (action === 'help') {
@@ -84,9 +91,14 @@ export function startTelegramBot(agent) {
             });
             return;
         }
+        if (!ctx.from) {
+            logger.error('Telegram /ask command received without from field');
+            return;
+        }
+        const sessionId = getTelegramSessionId(ctx.from.id);
         try {
             await ctx.replyWithChatAction('typing');
-            const answer = await agent.run(question);
+            const answer = await agent.run(question, undefined, undefined, sessionId);
             if (answer) {
                 await ctx.reply(answer);
             }
@@ -124,9 +136,10 @@ export function startTelegramBot(agent) {
         }
         currentInlineQueries++;
         try {
+            const sessionId = getTelegramSessionId(userId);
             const queryTimeout = 15000; // 15 seconds timeout
             const resultText = await Promise.race([
-                agent.run(query),
+                agent.run(query, undefined, undefined, sessionId),
                 new Promise((_, reject) => setTimeout(() => reject(new Error('Query timed out')), queryTimeout)),
             ]);
             const results = [
@@ -199,16 +212,28 @@ export function startTelegramBot(agent) {
         // or simply no text was ever present and no image.
         if (userText === undefined && !imageDataInput)
             return;
+        // Get session for this user
+        // ctx.from can be undefined for channel posts or anonymous admin messages
+        // We require user context for session isolation - don't use chat ID as it would
+        // cause multiple users in a group to share the same session (breaks isolation)
+        if (!ctx.from) {
+            logger.debug('Telegram message without user context (channel post or anonymous admin); skipping');
+            return;
+        }
+        const sessionId = getTelegramSessionId(ctx.from.id);
         // Subscribe for toolCall events
         const toolCallHandler = (payload) => {
+            // Filter by sessionId to avoid cross-session leakage
+            if (payload.sessionId !== sessionId)
+                return;
             ctx.reply(`Calling *${payload.toolName}* with args: ${JSON.stringify(payload.args)}`, {
                 parse_mode: 'Markdown',
             });
         };
-        agentEventBus.on('llmservice:toolCall', toolCallHandler);
+        agentEventBus.on('llm:tool-call', toolCallHandler);
         try {
             await ctx.replyWithChatAction('typing');
-            const responseText = await agent.run(userText || '', imageDataInput);
+            const responseText = await agent.run(userText || '', imageDataInput, undefined, sessionId);
             await ctx.reply(responseText || 'No response generated');
         }
         catch (error) {
@@ -217,7 +242,7 @@ export function startTelegramBot(agent) {
             await ctx.reply(`Error: ${errorMessage}`);
         }
         finally {
-            agentEventBus.off('llmservice:toolCall', toolCallHandler);
+            agentEventBus.off('llm:tool-call', toolCallHandler);
         }
     });
     // Start the bot

package/dist/utils/env.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Multi-layer environment variable loading with context awareness.
+ * Loads environment variables in priority order:
+ * 1. Shell environment (highest priority)
+ * 2. Project .env (if in dexto project)
+ * 3. Global ~/.dexto/.env (fallback)
+ *
+ * @param startPath Starting directory for project detection
+ * @returns Combined environment variables object
+ */
+export declare function loadEnvironmentVariables(startPath?: string): Promise<Record<string, string>>;
+/**
+ * Apply layered environment loading to process.env.
+ * This replaces the simple dotenv.config() with multi-layer loading.
+ * Should be called at CLI startup before any schema validation.
+ *
+ * @param startPath Starting directory for project detection
+ */
+export declare function applyLayeredEnvironmentLoading(startPath?: string): Promise<void>;
+//# sourceMappingURL=env.d.ts.map

package/dist/utils/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/utils/env.ts"],"names":[],"mappings":"AASA;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC1C,SAAS,GAAE,MAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgDjC;AAED;;;;;;GAMG;AACH,wBAAsB,8BAA8B,CAChD,SAAS,GAAE,MAAsB,GAClC,OAAO,CAAC,IAAI,CAAC,CAKf"}