hovclaw 0.1.0 → 0.1.2

package/dist/{src-D_mIwpeq.js → src-Y6AqidKn.js}

@@ -1,10 +1,11 @@
-import { D as getDefaultFileConfig, F as saveConfigFile, L as writeOpenClawMirror, N as loadFileConfig, P as resolveTelegramAccountConfig, S as config, _ as resolveModelAlias, a as TelegramChannel, b as parseConnectParams, c as composeSessionKey, d as extractAssistantText, f as toUserFacingAssistantError, g as parseModelRef, h as listConfiguredModelRefs, i as HovClawDb, j as loadConfig, k as hasConfigFile, l as ensureWorkspaceBootstrapForConfig, m as loadSkill, n as LocalHostRuntime, o as DiscordChannel, p as listAvailableSkills, r as ContainerRuntime, s as PiAgentManager, t as createTools, u as extractAssistantError, v as logger, w as ensureConfigFromLegacyEnv, x as parseGatewayFrame, y as PROTOCOL_VERSION } from "./hovclaw.js";
+import { A as ensureConfigFromLegacyEnv, B as resolveTelegramAccountConfig, C as resolveModelAlias, D as parseGatewayFrame, E as parseConnectParams, F as hasConfigFile, L as loadConfig, N as getDefaultFileConfig, O as config, S as parseModelRef, T as PROTOCOL_VERSION, U as writeOpenClawMirror, V as saveConfigFile, _ as extractAssistantText, a as LocalHostRuntime, b as loadSkill, c as redactSensitiveData, d as PiAgentManager, f as composeSessionKey, g as extractAssistantError, h as resolveAgentWorkspaceDir, i as createTools, l as TelegramChannel, m as ensureWorkspaceBootstrapForConfig, o as ContainerRuntime, p as WORKSPACE_CONTEXT_FILE_ORDER, r as TelegramPairingStore, s as HovClawDb, t as requestDaemonRestartFromCurrentProcess, u as DiscordChannel, v as toUserFacingAssistantError, w as logger, x as listConfiguredModelRefs, y as listAvailableSkills, z as loadFileConfig } from "./hovclaw.js";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { ZodError, z } from "zod";
 import { randomUUID } from "node:crypto";
 import WebSocket, { WebSocketServer } from "ws";
+import fs$1 from "node:fs/promises";
 import { createServer } from "node:http";
 import { spawnSync } from "node:child_process";
 import { Cron } from "croner";
@@ -157,98 +158,240 @@ function buildModelCatalog(aliases) {
 }
 
 //#endregion
-//#region src/channels/telegram-policy.ts
-function toIdSet(values) {
-	return new Set((values ?? []).map((value) => String(value).trim().toLowerCase()).filter(Boolean));
+//#region src/channels/command-auth.ts
+function normalizeAllowFromEntry(value) {
+	return String(value).trim().toLowerCase();
 }
-function splitThread(chatId) {
-	const [baseChatIdRaw, threadIdRaw] = chatId.split("#");
-	return {
-		baseChatId: baseChatIdRaw ?? chatId,
-		...threadIdRaw ? { threadId: threadIdRaw } : {}
-	};
+function senderCandidates(msg) {
+	const candidates = /* @__PURE__ */ new Set();
+	const userId = msg.userId.trim();
+	if (userId) candidates.add(userId.toLowerCase());
+	const displayName = msg.displayName.trim();
+	if (displayName.startsWith("@")) candidates.add(displayName.toLowerCase());
+	return Array.from(candidates);
 }
-function isDirectMessage(msg) {
-	return msg.peer?.kind === "direct" || !msg.chatId.startsWith("-") && !msg.chatId.includes("#");
+function resolveCommandsAllowFrom(config, channel) {
+	const entries = config.commands.allowFrom;
+	if (Object.keys(entries).length === 0) return null;
+	const providerSpecific = entries[channel];
+	if (Array.isArray(providerSpecific)) return providerSpecific;
+	const global = entries["*"];
+	if (Array.isArray(global)) return global;
+	return [];
 }
-function containsMention(text, assistantName) {
-	const normalized = assistantName.trim().toLowerCase();
-	if (!normalized) return false;
-	return text.toLowerCase().includes(`@${normalized}`);
-}
-function isAllowListed(msg, allowSet) {
-	if (allowSet.has("*")) return true;
-	const userId = msg.userId.trim().toLowerCase();
-	if (userId && allowSet.has(userId)) return true;
-	const displayName = msg.displayName.trim().replace(/^@/, "").toLowerCase();
-	if (displayName && allowSet.has(displayName)) return true;
+function isCommandAuthorized(config, msg) {
+	const allowFrom = resolveCommandsAllowFrom(config, msg.channel);
+	if (allowFrom === null) return true;
+	const normalizedAllow = new Set(allowFrom.map((entry) => normalizeAllowFromEntry(entry)));
+	if (normalizedAllow.has("*")) return true;
+	for (const candidate of senderCandidates(msg)) if (normalizedAllow.has(candidate)) return true;
 	return false;
 }
-function evaluateTelegramPolicy(params) {
-	const { config, msg, pairingStore } = params;
-	const accountId = (msg.accountId ?? config.channels.telegram.defaultAccountId).trim() || "default";
-	const account = config.channels.telegram.accounts[accountId] ?? config.channels.telegram.accounts[config.channels.telegram.defaultAccountId] ?? config.channels.telegram.accounts.default;
-	if (!account || account.enabled === false) return {
-		allowed: false,
-		reason: "account-disabled"
-	};
-	const direct = isDirectMessage(msg);
-	const allowFromSet = toIdSet(account.allowFrom);
-	if (direct) {
-		const dmPolicy = account.dmPolicy ?? "pairing";
-		if (dmPolicy === "disabled") return {
-			allowed: false,
-			reason: "dm-disabled"
-		};
-		if (dmPolicy === "open") return { allowed: true };
-		if (dmPolicy === "allowlist") {
-			if (isAllowListed(msg, allowFromSet) || pairingStore.isApproved(accountId, msg.userId)) return { allowed: true };
-			return {
-				allowed: false,
-				reason: "dm-not-allowlisted"
-			};
-		}
-		if (isAllowListed(msg, allowFromSet) || pairingStore.isApproved(accountId, msg.userId)) return { allowed: true };
-		return {
-			allowed: false,
-			reason: "pairing-required",
-			pairingCode: pairingStore.ensurePendingCode(accountId, msg.userId)
-		};
+
+//#endregion
+//#region src/channels/commands-registry.ts
+const TELEGRAM_COMMAND_NAME_RE = /^[a-z0-9_]{1,32}$/;
+const TELEGRAM_COMMAND_LIMIT = 100;
+const BASE_COMMANDS = [
+	{
+		key: "help",
+		nativeName: "help",
+		description: "Show available commands"
+	},
+	{
+		key: "commands",
+		nativeName: "commands",
+		description: "List all slash commands"
+	},
+	{
+		key: "status",
+		nativeName: "status",
+		description: "Show runtime status"
+	},
+	{
+		key: "whoami",
+		nativeName: "whoami",
+		description: "Show your sender id"
+	},
+	{
+		key: "context",
+		nativeName: "context",
+		description: "Show prompt/workspace context info"
+	},
+	{
+		key: "model",
+		nativeName: "model",
+		description: "Show or set interactive model"
+	},
+	{
+		key: "models",
+		nativeName: "models",
+		description: "List available models"
+	},
+	{
+		key: "skill",
+		nativeName: "skill",
+		description: "Run a skill by name"
+	},
+	{
+		key: "skills",
+		nativeName: "skills",
+		description: "List installed skills"
+	},
+	{
+		key: "identity",
+		nativeName: "identity",
+		description: "View or update IDENTITY.md"
+	},
+	{
+		key: "soul",
+		nativeName: "soul",
+		description: "View or update SOUL.md"
+	},
+	{
+		key: "pair",
+		nativeName: "pair",
+		description: "Show pairing approval hint"
+	},
+	{
+		key: "new",
+		nativeName: "new",
+		description: "Start a fresh conversation session"
+	},
+	{
+		key: "reset",
+		nativeName: "reset",
+		description: "Reset current conversation session"
+	},
+	{
+		key: "think",
+		nativeName: "think",
+		description: "Set per-task or default thinking level"
+	},
+	{
+		key: "verbose",
+		nativeName: "verbose",
+		description: "Toggle verbose mode (hint)"
+	},
+	{
+		key: "reasoning",
+		nativeName: "reasoning",
+		description: "Toggle reasoning visibility (hint)"
+	},
+	{
+		key: "stop",
+		nativeName: "stop",
+		description: "Stop current run (not yet supported)"
+	},
+	{
+		key: "config",
+		nativeName: "config",
+		description: "View or edit runtime config (if enabled)"
+	},
+	{
+		key: "debug",
+		nativeName: "debug",
+		description: "Inspect or change debug state (if enabled)"
+	},
+	{
+		key: "bash",
+		nativeName: "bash",
+		description: "Run a shell command through the assistant (if enabled)"
+	},
+	{
+		key: "restart",
+		nativeName: "restart",
+		description: "Restart daemon (if enabled)"
 	}
-	const { baseChatId, threadId } = splitThread(msg.chatId);
-	const groupConfig = account.groups?.[baseChatId];
-	const topicConfig = threadId ? groupConfig?.topics?.[threadId] : void 0;
-	if (groupConfig?.enabled === false) return {
-		allowed: false,
-		reason: "group-disabled"
-	};
-	if (topicConfig?.enabled === false) return {
-		allowed: false,
-		reason: "topic-disabled"
-	};
-	const groupPolicy = topicConfig?.groupPolicy ?? groupConfig?.groupPolicy ?? account.groupPolicy ?? "open";
-	if (groupPolicy === "disabled") return {
-		allowed: false,
-		reason: "group-disabled"
-	};
-	if (groupPolicy === "allowlist") {
-		if (!isAllowListed(msg, toIdSet(topicConfig?.allowFrom ?? groupConfig?.allowFrom ?? account.groupAllowFrom))) return {
-			allowed: false,
-			reason: "group-not-allowlisted"
-		};
+];
+function sanitizeCommandName(raw) {
+	return raw.toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "").slice(0, 32);
+}
+function coerceDescription(input, fallback) {
+	const trimmed = input.trim();
+	if (!trimmed) return fallback;
+	if (trimmed.length <= 256) return trimmed;
+	return `${trimmed.slice(0, 255)}…`;
+}
+function resolveSkillCommandName(skillName, used) {
+	const base = sanitizeCommandName(skillName) || "skill";
+	if (!used.has(base)) return base;
+	for (let i = 2; i < 500; i += 1) {
+		const suffix = `_${i}`;
+		const maxBaseLen = Math.max(1, 32 - suffix.length);
+		const candidate = `${base.slice(0, maxBaseLen)}${suffix}`;
+		if (!used.has(candidate)) return candidate;
 	}
-	if ((topicConfig?.requireMention ?? groupConfig?.requireMention ?? false) && !containsMention(msg.text, config.assistantName)) return {
-		allowed: false,
-		reason: "mention-required"
-	};
-	return { allowed: true };
+	return `skill_${used.size}`;
 }
-function canApproveTelegramPairing(params) {
-	const { config, msg } = params;
-	const accountId = (msg.accountId ?? config.channels.telegram.defaultAccountId).trim() || "default";
-	const account = config.channels.telegram.accounts[accountId] ?? config.channels.telegram.accounts[config.channels.telegram.defaultAccountId] ?? config.channels.telegram.accounts.default;
-	if (!account) return false;
-	return isAllowListed(msg, toIdSet(account.allowFrom));
+function resolveNativeEnabled(config, accountId) {
+	const accountMode = config.channels.telegram.accounts[accountId]?.commands;
+	if (typeof accountMode === "boolean") return accountMode;
+	if (typeof config.commands.native === "boolean") return config.commands.native;
+	return true;
+}
+function resolveNativeSkillsEnabled(config) {
+	if (typeof config.commands.nativeSkills === "boolean") return config.commands.nativeSkills;
+	return true;
+}
+function listSkillCommandSpecs(config) {
+	const installed = listAvailableSkills();
+	const used = /* @__PURE__ */ new Set();
+	for (const command of BASE_COMMANDS) used.add(command.nativeName);
+	const specs = [];
+	for (const skillName of installed) {
+		const loaded = loadSkill(skillName);
+		if (!loaded) continue;
+		const commandName = resolveSkillCommandName(skillName, used);
+		if (!TELEGRAM_COMMAND_NAME_RE.test(commandName)) continue;
+		used.add(commandName);
+		specs.push({
+			name: commandName,
+			skillName,
+			description: coerceDescription(loaded.frontmatter.description ?? `Run ${skillName} skill`, `Run ${skillName} skill`)
+		});
+	}
+	return specs;
+}
+function listCustomCommandSpecs(config, accountId) {
+	const account = config.channels.telegram.accounts[accountId];
+	if (!account) return [];
+	const commands = Array.isArray(account.customCommands) ? account.customCommands : [];
+	const out = [];
+	for (const entry of commands) {
+		const normalized = sanitizeCommandName(entry.command);
+		if (!TELEGRAM_COMMAND_NAME_RE.test(normalized)) continue;
+		out.push({
+			command: normalized,
+			description: coerceDescription(entry.description, `Run /${normalized}`)
+		});
+	}
+	return out;
+}
+function listTelegramNativeCommandSpecs(config, accountId) {
+	if (!resolveNativeEnabled(config, accountId)) return [];
+	const out = BASE_COMMANDS.map((command) => ({
+		command: command.nativeName,
+		description: command.description
+	}));
+	if (resolveNativeSkillsEnabled(config)) out.push(...listSkillCommandSpecs(config).map((skill) => ({
+		command: skill.name,
+		description: skill.description
+	})));
+	out.push(...listCustomCommandSpecs(config, accountId));
+	const deduped = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of out) {
+		if (!TELEGRAM_COMMAND_NAME_RE.test(entry.command)) continue;
+		if (seen.has(entry.command)) continue;
+		seen.add(entry.command);
+		deduped.push(entry);
+		if (deduped.length >= TELEGRAM_COMMAND_LIMIT) break;
+	}
+	return deduped;
+}
+function listBaseCommands() {
+	return [...BASE_COMMANDS];
 }
 
 //#endregion
@@ -339,11 +482,28 @@ function buildModelsKeyboard(params) {
 
 //#endregion
 //#region src/channels/telegram-commands.ts
+const SKILL_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/;
+const DEBUG_LOG_LEVELS = new Set([
+	"trace",
+	"debug",
+	"info",
+	"warn",
+	"error",
+	"fatal",
+	"silent"
+]);
+const BLOCKED_CONFIG_PATH_SEGMENTS = new Set([
+	"__proto__",
+	"prototype",
+	"constructor"
+]);
 function extractCommand(text) {
 	const trimmed = text.trim();
 	if (!trimmed.startsWith("/")) return null;
 	const segments = trimmed.split(/\s+/);
-	const command = segments[0]?.slice(1).toLowerCase();
+	const raw = segments[0]?.slice(1).toLowerCase();
+	if (!raw) return null;
+	const command = raw.split("@")[0]?.trim();
 	if (!command) return null;
 	return {
 		command,
@@ -358,8 +518,125 @@ function callbackDataFromMessage(msg) {
 function setInteractiveModel(modelRef) {
 	const next = loadFileConfig();
 	next.models.interactive = modelRef;
+	persistFileConfig(next);
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepMerge$1(base, patch) {
+	const result = { ...base };
+	for (const [key, value] of Object.entries(patch)) {
+		const existing = result[key];
+		if (isRecord$1(existing) && isRecord$1(value)) {
+			result[key] = deepMerge$1(existing, value);
+			continue;
+		}
+		result[key] = value;
+	}
+	return result;
+}
+function reloadRuntimeConfig() {
+	const reloaded = loadConfig();
+	Object.assign(config, reloaded);
+	logger.level = reloaded.logLevel;
+}
+function persistFileConfig(next) {
 	saveConfigFile(next);
-	config.models.interactive = modelRef;
+	reloadRuntimeConfig();
+	writeOpenClawMirror(config);
+}
+function parseConfigPath(raw) {
+	const pathValue = raw?.trim();
+	if (!pathValue) return null;
+	const segments = pathValue.split(".").map((segment) => segment.trim()).filter(Boolean);
+	if (segments.length === 0) return null;
+	if (segments.some((segment) => BLOCKED_CONFIG_PATH_SEGMENTS.has(segment))) return null;
+	return segments;
+}
+function readPathValue(root, segments) {
+	let current = root;
+	for (const segment of segments) {
+		if (Array.isArray(current)) {
+			const index = Number.parseInt(segment, 10);
+			if (!Number.isInteger(index) || index < 0 || index >= current.length) return { found: false };
+			current = current[index];
+			continue;
+		}
+		if (!isRecord$1(current) || !(segment in current)) return { found: false };
+		current = current[segment];
+	}
+	return {
+		found: true,
+		value: current
+	};
+}
+function writePathValue(root, segments, value) {
+	if (segments.length === 0) return false;
+	let current = root;
+	for (let i = 0; i < segments.length - 1; i += 1) {
+		const segment = segments[i];
+		const nextSegment = segments[i + 1];
+		if (!segment || !nextSegment) return false;
+		if (Array.isArray(current)) {
+			const index = Number.parseInt(segment, 10);
+			if (!Number.isInteger(index) || index < 0) return false;
+			if (current[index] === void 0) current[index] = /^[0-9]+$/.test(nextSegment) ? [] : {};
+			current = current[index];
+			continue;
+		}
+		if (!isRecord$1(current)) return false;
+		const existing = current[segment];
+		if (existing === void 0 || !isRecord$1(existing) && !Array.isArray(existing)) current[segment] = /^[0-9]+$/.test(nextSegment) ? [] : {};
+		current = current[segment];
+	}
+	const lastSegment = segments[segments.length - 1];
+	if (!lastSegment) return false;
+	if (Array.isArray(current)) {
+		const index = Number.parseInt(lastSegment, 10);
+		if (!Number.isInteger(index) || index < 0) return false;
+		current[index] = value;
+		return true;
+	}
+	if (!isRecord$1(current)) return false;
+	current[lastSegment] = value;
+	return true;
+}
+function parseConfigValue(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return "";
+	try {
+		return JSON.parse(trimmed);
+	} catch {
+		return raw;
+	}
+}
+function formatValue(value) {
+	if (typeof value === "string") return value;
+	return JSON.stringify(value, null, 2);
+}
+function configSummaryText(current) {
+	return [
+		"Config summary",
+		`assistant.name=${current.assistant.name}`,
+		`models.interactive=${current.models.interactive}`,
+		`models.discord=${current.models.discord}`,
+		`models.cron=${current.models.cron}`,
+		`runtime.mode=${current.runtime.mode}`,
+		`commands.text=${current.commands.text}`,
+		`commands.defaultThinkingLevel=${current.commands.defaultThinkingLevel}`,
+		`commands.config=${current.commands.config}`,
+		`commands.debug=${current.commands.debug}`,
+		`commands.bash=${current.commands.bash}`,
+		`commands.restart=${current.commands.restart}`,
+		`channels.telegram.enabled=${current.channels.telegram.enabled}`,
+		`channels.discord.enabled=${current.channels.discord.enabled}`,
+		"",
+		"Usage:",
+		"/config get <path>",
+		"/config set <path> <json-or-text>",
+		"/config patch <json-object>",
+		"/config reload"
+	].join("\n");
 }
 function groupedModels() {
 	return buildModelCatalog(config.models.aliases).reduce((acc, entry) => {
@@ -369,9 +646,57 @@ function groupedModels() {
 		return acc;
 	}, {});
 }
+function workspaceFilePath(agentId, fileName) {
+	return path.join(resolveAgentWorkspaceDir(config, agentId), fileName);
+}
+async function readWorkspaceFileOrEmpty(agentId, fileName) {
+	const filePath = workspaceFilePath(agentId, fileName);
+	try {
+		return await fs$1.readFile(filePath, "utf8");
+	} catch {
+		return "";
+	}
+}
+async function writeWorkspaceFile(agentId, fileName, content) {
+	const filePath = workspaceFilePath(agentId, fileName);
+	await fs$1.mkdir(path.dirname(filePath), { recursive: true });
+	await fs$1.writeFile(filePath, `${content.trimEnd()}\n`, "utf8");
+}
+function trimForTelegram(text, limit = 3600) {
+	if (text.length <= limit) return text;
+	return `${text.slice(0, limit)}\n\n[...truncated]`;
+}
+async function addSkillToAgent(agentId, skillName) {
+	const agentDir = path.join(config.agentsDir, agentId);
+	const agentPath = path.join(agentDir, "agent.json");
+	let parsed = {};
+	try {
+		const raw = await fs$1.readFile(agentPath, "utf8");
+		parsed = JSON.parse(raw);
+	} catch {
+		parsed = {};
+	}
+	const existingSkills = Array.isArray(parsed.skills) ? parsed.skills.filter((value) => typeof value === "string") : [];
+	if (existingSkills.includes(skillName)) return {
+		added: false,
+		path: agentPath
+	};
+	const nextSkills = [...existingSkills, skillName];
+	const next = {
+		...parsed,
+		skills: nextSkills
+	};
+	await fs$1.mkdir(agentDir, { recursive: true });
+	await fs$1.writeFile(agentPath, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+	return {
+		added: true,
+		path: agentPath
+	};
+}
 async function handleModelCallback(context, callbackData) {
 	const parsed = parseModelCallbackData(callbackData);
 	if (!parsed) return false;
+	const authorized = isCommandAuthorized(config, context.msg);
 	const grouped = groupedModels();
 	const target = {
 		channel: "telegram",
@@ -403,6 +728,12 @@ async function handleModelCallback(context, callbackData) {
 		if (callbackId) await context.channel.answerCallbackQuery(callbackId);
 		return true;
 	}
+	if (!authorized) {
+		await context.channel.sendMessage(target, "You are not authorized to use this command.");
+		const callbackId = context.msg.raw?.callback_query?.id;
+		if (callbackId) await context.channel.answerCallbackQuery(callbackId, "Not authorized");
+		return true;
+	}
 	const selectedRef = `${parsed.provider}:${parsed.model}`;
 	setInteractiveModel(selectedRef);
 	await context.channel.sendMessage(target, `Interactive model set to ${selectedRef}.`);
@@ -410,201 +741,575 @@ async function handleModelCallback(context, callbackData) {
 	if (callbackId) await context.channel.answerCallbackQuery(callbackId, "Model updated");
 	return true;
 }
+function buildCommandsHelpText(accountId) {
+	const nativeCommands = listTelegramNativeCommandSpecs(config, accountId);
+	const fallbackCommands = [...listBaseCommands().map((command) => ({
+		command: command.nativeName,
+		description: command.description
+	})), ...listSkillCommandSpecs(config).map((command) => ({
+		command: command.name,
+		description: command.description
+	}))];
+	return ["Commands:", ...(nativeCommands.length > 0 ? nativeCommands : fallbackCommands).map((command) => `/${command.command} - ${command.description}`)].join("\n");
+}
+function resolveSkillPrompt(skillName, args) {
+	const input = args.join(" ").trim();
+	if (!input) return `Use the ${skillName} skill to help with the user's request.`;
+	return `Use the ${skillName} skill for this request: ${input}`;
+}
+function normalizeSkillName(raw) {
+	const name = raw?.trim();
+	if (!name) return null;
+	if (!SKILL_NAME_RE.test(name)) return null;
+	return name;
+}
+function parseThinkingLevel(raw) {
+	const value = raw?.trim().toLowerCase();
+	if (value === "low" || value === "medium" || value === "high") return value;
+	return null;
+}
 async function handleTelegramCommand(context) {
 	const callbackData = callbackDataFromMessage(context.msg);
-	if (callbackData) return await handleModelCallback(context, callbackData);
+	if (callbackData) return { handled: await handleModelCallback(context, callbackData) };
 	const parsed = extractCommand(context.msg.text);
-	if (!parsed) return false;
+	if (!parsed) return { handled: false };
+	if (!config.commands.text) return { handled: false };
 	const target = {
 		channel: "telegram",
 		chatId: context.msg.chatId,
 		accountId: context.msg.accountId
 	};
-	if (parsed.command === "help") {
-		await context.channel.sendMessage(target, [
-			"Commands:",
-			"/help",
-			"/status",
-			"/models",
-			"/model [provider:model]",
-			"/pair approve <code>",
-			"/pair reject <code>"
-		].join("\n"));
-		return true;
+	const authorized = isCommandAuthorized(config, context.msg);
+	const allowWithoutAuth = parsed.command === "help" || parsed.command === "commands";
+	if (!authorized && !allowWithoutAuth) {
+		await context.channel.sendMessage(target, "You are not authorized to use this command.");
+		return { handled: true };
+	}
+	if (parsed.command === "help" || parsed.command === "commands") {
+		const accountId = (context.msg.accountId ?? config.channels.telegram.defaultAccountId).trim() || "default";
+		await context.channel.sendMessage(target, buildCommandsHelpText(accountId));
+		return { handled: true };
 	}
 	if (parsed.command === "status") {
 		const diagnostics = context.channel.getDiagnostics?.() ?? {};
 		await context.channel.sendMessage(target, `Status\nactiveSessions=${context.db.listSessions().length}\n${JSON.stringify(diagnostics)}`);
-		return true;
+		return { handled: true };
+	}
+	if (parsed.command === "whoami") {
+		const lines = [
+			"Identity",
+			`channel=${context.msg.channel}`,
+			`chatId=${context.msg.chatId}`,
+			`userId=${context.msg.userId}`,
+			`displayName=${context.msg.displayName}`,
+			`agent=${context.agentId}`
+		];
+		await context.channel.sendMessage(target, lines.join("\n"));
+		return { handled: true };
+	}
+	if (parsed.command === "context") {
+		const workspaceDir = resolveAgentWorkspaceDir(config, context.agentId);
+		const lines = [
+			`Agent: ${context.agentId}`,
+			`Workspace: ${workspaceDir}`,
+			"Context files:",
+			...WORKSPACE_CONTEXT_FILE_ORDER.map((file) => `- ${file}`)
+		];
+		await context.channel.sendMessage(target, lines.join("\n"));
+		return { handled: true };
 	}
 	if (parsed.command === "models") {
-		const lines = buildModelCatalog(config.models.aliases).slice(0, 80).map((entry) => `- ${entry.ref}${entry.alias ? ` (alias: ${entry.alias})` : ""}`);
+		const lines = buildModelCatalog(config.models.aliases).slice(0, 100).map((entry) => `- ${entry.ref}${entry.alias ? ` (alias: ${entry.alias})` : ""}`);
 		await context.channel.sendMessage(target, lines.length > 0 ? lines.join("\n") : "No models found.");
-		return true;
+		return { handled: true };
 	}
 	if (parsed.command === "model") {
-		const modelArg = parsed.args[0]?.trim();
+		const modelArg = parsed.args.join(" ").trim();
 		if (modelArg) {
 			setInteractiveModel(modelArg);
 			await context.channel.sendMessage(target, `Interactive model set to ${modelArg}.`);
-			return true;
+			return { handled: true };
 		}
 		const providerEntries = Object.entries(groupedModels()).map(([id, models]) => ({
 			id,
 			count: models.length
 		}));
 		await context.channel.sendRichMessage(target, `Current interactive model: ${config.models.interactive}`, { inlineKeyboard: providerEntries.length > 0 ? buildProviderKeyboard(providerEntries) : buildBrowseProvidersButton() });
-		return true;
+		return { handled: true };
 	}
 	if (parsed.command === "pair") {
-		if (!canApproveTelegramPairing({
-			config,
-			msg: context.msg
-		})) {
-			await context.channel.sendMessage(target, "Not authorized to approve pairing requests.");
-			return true;
-		}
-		const action = parsed.args[0]?.toLowerCase();
-		const code = parsed.args[1]?.trim().toUpperCase();
 		const accountId = (context.msg.accountId ?? config.channels.telegram.defaultAccountId).trim() || "default";
-		if (!action || !code) {
-			await context.channel.sendMessage(target, "Usage: /pair approve <code> or /pair reject <code>");
-			return true;
-		}
-		if (action === "approve") {
-			const result = context.pairingStore.approveByCode(accountId, code);
-			if (!result.ok) await context.channel.sendMessage(target, `Pairing code not found: ${code}`);
-			else {
-				context.db.appendAuditEvent({
-					actor: "channel",
-					eventType: "telegram.pair.approve",
-					payload: {
-						accountId,
-						code,
-						userId: result.userId,
-						approver: context.msg.userId
-					}
-				});
-				await context.channel.sendMessage(target, `Approved pairing for user ${result.userId}.`);
+		const code = (parsed.args[1] ?? parsed.args[0])?.trim().toUpperCase() || "<code>";
+		await context.channel.sendMessage(target, `Pair approvals are CLI-only. Run: hovclaw pairing approve --channel telegram --account ${accountId} ${code}`);
+		return { handled: true };
+	}
+	if (parsed.command === "skills") {
+		const skills = listAvailableSkills();
+		if (skills.length === 0) {
+			await context.channel.sendMessage(target, "No installed skills found.");
+			return { handled: true };
+		}
+		const lines = skills.slice(0, 40).map((name) => {
+			return `- ${name}: ${loadSkill(name)?.frontmatter.description?.trim() || "No description"}`;
+		});
+		await context.channel.sendMessage(target, trimForTelegram(lines.join("\n")));
+		return { handled: true };
+	}
+	if (parsed.command === "identity" || parsed.command === "soul") {
+		const fileName = parsed.command === "identity" ? "IDENTITY.md" : "SOUL.md";
+		const subcommand = parsed.args[0]?.toLowerCase();
+		const body = parsed.args.slice(1).join(" ").trim();
+		if (!subcommand || subcommand === "view") {
+			const current = await readWorkspaceFileOrEmpty(context.agentId, fileName);
+			if (!current.trim()) {
+				await context.channel.sendMessage(target, `${fileName} is empty.`);
+				return { handled: true };
 			}
-			return true;
-		}
-		if (action === "reject") {
-			const result = context.pairingStore.rejectByCode(accountId, code);
-			if (!result.ok) await context.channel.sendMessage(target, `Pairing code not found: ${code}`);
-			else {
-				context.db.appendAuditEvent({
-					actor: "channel",
-					eventType: "telegram.pair.reject",
-					payload: {
-						accountId,
-						code,
-						userId: result.userId,
-						approver: context.msg.userId
-					}
-				});
-				await context.channel.sendMessage(target, `Rejected pairing for user ${result.userId}.`);
+			await context.channel.sendMessage(target, trimForTelegram(current));
+			return { handled: true };
+		}
+		if (subcommand === "set") {
+			if (!body) {
+				await context.channel.sendMessage(target, `Usage: /${parsed.command} set <content>`);
+				return { handled: true };
 			}
-			return true;
+			await writeWorkspaceFile(context.agentId, fileName, body);
+			await context.channel.sendMessage(target, `${fileName} updated.`);
+			return { handled: true };
 		}
-		await context.channel.sendMessage(target, "Unknown /pair action. Use approve or reject.");
-		return true;
+		if (subcommand === "append") {
+			if (!body) {
+				await context.channel.sendMessage(target, `Usage: /${parsed.command} append <content>`);
+				return { handled: true };
+			}
+			const current = await readWorkspaceFileOrEmpty(context.agentId, fileName);
+			const next = current.trim().length > 0 ? `${current.trimEnd()}\n${body}` : body;
+			await writeWorkspaceFile(context.agentId, fileName, next);
+			await context.channel.sendMessage(target, `${fileName} appended.`);
+			return { handled: true };
+		}
+		await context.channel.sendMessage(target, `Usage: /${parsed.command} [view]\n/${parsed.command} set <content>\n/${parsed.command} append <content>`);
+		return { handled: true };
 	}
-	return false;
+	if (parsed.command === "reset" || parsed.command === "new") {
+		const remainder = parsed.args.join(" ").trim();
+		if (!remainder) return {
+			handled: true,
+			resetSession: true
+		};
+		return {
+			handled: false,
+			resetSession: true,
+			promptOverride: remainder
+		};
+	}
+	if (parsed.command === "skill") {
+		const sub = parsed.args[0]?.toLowerCase();
+		if (!sub) {
+			await context.channel.sendMessage(target, "Usage: /skill <name> [input] | /skill create <name> [description] | /skill add <name>");
+			return { handled: true };
+		}
+		if (sub === "create") {
+			const name = normalizeSkillName(parsed.args[1]);
+			if (!name) {
+				await context.channel.sendMessage(target, "Usage: /skill create <name> [description]");
+				return { handled: true };
+			}
+			const description = parsed.args.slice(2).join(" ").trim() || `Skill ${name}`;
+			const skillDir = path.join(config.skillsDir, name);
+			const skillPath = path.join(skillDir, "SKILL.md");
+			const scaffold = [
+				"---",
+				`name: ${name}`,
+				`description: ${description}`,
+				"---",
+				"",
+				`# ${name}`,
+				"",
+				"Describe how this skill should solve the task."
+			].join("\n");
+			try {
+				await fs$1.mkdir(skillDir, { recursive: false });
+			} catch {
+				await context.channel.sendMessage(target, `Skill already exists: ${name}`);
+				return { handled: true };
+			}
+			await fs$1.writeFile(skillPath, `${scaffold}\n`, "utf8");
+			await context.channel.sendMessage(target, `Created ${skillPath}`);
+			return { handled: true };
+		}
+		if (sub === "add") {
+			const skillName = normalizeSkillName(parsed.args[1]);
+			if (!skillName) {
+				await context.channel.sendMessage(target, "Usage: /skill add <name>");
+				return { handled: true };
+			}
+			const { added, path: agentPath } = await addSkillToAgent(context.agentId, skillName);
+			await context.channel.sendMessage(target, added ? `Added ${skillName} to ${agentPath}` : `${skillName} is already enabled for ${context.agentId}.`);
+			return { handled: true };
+		}
+		const targetSkill = normalizeSkillName(sub);
+		if (!targetSkill) {
+			await context.channel.sendMessage(target, "Invalid skill name.");
+			return { handled: true };
+		}
+		if (!new Set(listAvailableSkills()).has(targetSkill)) {
+			await context.channel.sendMessage(target, `Skill not found: ${targetSkill}. Run /skills to list installed skills or /skill create ${targetSkill}.`);
+			return { handled: true };
+		}
+		return {
+			handled: false,
+			promptOverride: resolveSkillPrompt(targetSkill, parsed.args.slice(1))
+		};
+	}
+	const skillCommand = listSkillCommandSpecs(config).find((entry) => entry.name === parsed.command);
+	if (skillCommand) return {
+		handled: false,
+		promptOverride: resolveSkillPrompt(skillCommand.skillName, parsed.args)
+	};
+	if (parsed.command === "think") {
+		if (parsed.args.length === 0) {
+			await context.channel.sendMessage(target, [
+				`Default thinking level: ${config.commands.defaultThinkingLevel}`,
+				"Usage:",
+				"/think <low|medium|high> <task>",
+				"/think default <low|medium|high>"
+			].join("\n"));
+			return { handled: true };
+		}
+		if (parsed.args[0]?.trim().toLowerCase() === "default") {
+			const requested = parseThinkingLevel(parsed.args[1]);
+			if (!requested) {
+				await context.channel.sendMessage(target, `Current default thinking level: ${config.commands.defaultThinkingLevel}\nUsage: /think default <low|medium|high>`);
+				return { handled: true };
+			}
+			const next = loadFileConfig();
+			next.commands.defaultThinkingLevel = requested;
+			try {
+				persistFileConfig(next);
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				await context.channel.sendMessage(target, `Failed to update default thinking level: ${message}`);
+				return { handled: true };
+			}
+			await context.channel.sendMessage(target, `Default thinking level set to ${requested}.`);
+			return { handled: true };
+		}
+		const level = parseThinkingLevel(parsed.args[0]);
+		if (!level || parsed.args.length < 2) {
+			await context.channel.sendMessage(target, "Usage: /think <low|medium|high> <task>\nOr set default: /think default <low|medium|high>");
+			return { handled: true };
+		}
+		return {
+			handled: false,
+			promptOverride: parsed.args.slice(1).join(" ").trim(),
+			thinkingLevelOverride: level
+		};
+	}
+	if (parsed.command === "reasoning") {
+		if (parsed.args.length < 2) {
+			await context.channel.sendMessage(target, "Usage: /reasoning <on|off> <task>\nThis command is per-message and not persisted.");
+			return { handled: true };
+		}
+		const mode = (parsed.args[0] ?? "on").trim().toLowerCase() === "off" ? "off" : "on";
+		const task = parsed.args.slice(1).join(" ").trim();
+		return {
+			handled: false,
+			promptOverride: mode === "on" ? `Solve this task and include concise reasoning in your response: ${task}` : `Solve this task and return only final output without exposing internal reasoning: ${task}`
+		};
+	}
+	if (parsed.command === "verbose") {
+		if (parsed.args.length < 2) {
+			await context.channel.sendMessage(target, "Usage: /verbose <on|off> <task>\nThis command is per-message and not persisted.");
+			return { handled: true };
+		}
+		const mode = (parsed.args[0] ?? "on").trim().toLowerCase() === "off" ? "off" : "on";
+		const task = parsed.args.slice(1).join(" ").trim();
+		return {
+			handled: false,
+			promptOverride: mode === "on" ? `Answer in a detailed, explicit style for this request: ${task}` : `Answer briefly and directly for this request: ${task}`
+		};
+	}
+	if (parsed.command === "stop") {
+		await context.channel.sendMessage(target, "Stopping an in-flight run is not supported yet. Use /new to start a fresh session.");
+		return { handled: true };
+	}
+	if (parsed.command === "restart") {
+		if (!config.commands.restart) {
+			await context.channel.sendMessage(target, "Restart command is disabled. Set commands.restart=true to enable.");
+			return { handled: true };
+		}
+		await context.channel.sendMessage(target, "Restart requested. Applying restart now.");
+		try {
+			if ((await requestDaemonRestartFromCurrentProcess()).mode === "spawn-reexec") setTimeout(() => {
+				try {
+					process.kill(process.pid, "SIGTERM");
+				} catch {}
+			}, 250);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			await context.channel.sendMessage(target, `Restart failed: ${message}`);
+		}
+		return { handled: true };
+	}
+	if (parsed.command === "config") {
+		if (!config.commands.config) {
+			await context.channel.sendMessage(target, "/config is disabled. Set commands.config=true to enable.");
+			return { handled: true };
+		}
+		const sub = parsed.args[0]?.toLowerCase() ?? "show";
+		if (sub === "show" || sub === "status") {
+			const current = loadFileConfig();
+			await context.channel.sendMessage(target, trimForTelegram(configSummaryText(current)));
+			return { handled: true };
+		}
+		if (sub === "reload") {
+			try {
+				reloadRuntimeConfig();
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				await context.channel.sendMessage(target, `Failed to reload config: ${message}`);
+				return { handled: true };
+			}
+			await context.channel.sendMessage(target, "Reloaded runtime config from disk.");
+			return { handled: true };
+		}
+		if (sub === "get") {
+			const pathSegments = parseConfigPath(parsed.args[1]);
+			if (!pathSegments) {
+				await context.channel.sendMessage(target, "Usage: /config get <path>");
+				return { handled: true };
+			}
+			const found = readPathValue(loadFileConfig(), pathSegments);
+			if (!found.found) {
+				await context.channel.sendMessage(target, `Path not found: ${parsed.args[1]}`);
+				return { handled: true };
+			}
+			const pretty = formatValue(found.value);
+			await context.channel.sendMessage(target, trimForTelegram(`${parsed.args[1]} = ${pretty}`));
+			return { handled: true };
+		}
+		if (sub === "set") {
+			const pathSegments = parseConfigPath(parsed.args[1]);
+			const valueRaw = parsed.args.slice(2).join(" ");
+			if (!pathSegments || !valueRaw.trim()) {
+				await context.channel.sendMessage(target, "Usage: /config set <path> <json-or-text>");
+				return { handled: true };
+			}
+			const next = loadFileConfig();
+			if (!writePathValue(next, pathSegments, parseConfigValue(valueRaw))) {
+				await context.channel.sendMessage(target, `Could not update path: ${parsed.args[1]}`);
+				return { handled: true };
+			}
+			try {
+				persistFileConfig(next);
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				await context.channel.sendMessage(target, `Config update failed: ${message}`);
+				return { handled: true };
+			}
+			await context.channel.sendMessage(target, `Updated ${parsed.args[1]}.`);
+			return { handled: true };
+		}
+		if (sub === "patch") {
+			const patchRaw = parsed.args.slice(1).join(" ").trim();
+			if (!patchRaw) {
+				await context.channel.sendMessage(target, "Usage: /config patch <json-object>");
+				return { handled: true };
+			}
+			let patch;
+			try {
+				patch = JSON.parse(patchRaw);
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				await context.channel.sendMessage(target, `Invalid JSON patch: ${message}`);
+				return { handled: true };
+			}
+			if (!isRecord$1(patch)) {
+				await context.channel.sendMessage(target, "Patch must be a JSON object.");
+				return { handled: true };
+			}
+			const merged = deepMerge$1(loadFileConfig(), patch);
+			try {
+				persistFileConfig(merged);
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				await context.channel.sendMessage(target, `Config patch failed: ${message}`);
+				return { handled: true };
+			}
+			await context.channel.sendMessage(target, "Config patch applied.");
+			return { handled: true };
+		}
+		await context.channel.sendMessage(target, "Usage: /config show | get <path> | set <path> <value> | patch <json-object> | reload");
+		return { handled: true };
+	}
+	if (parsed.command === "debug") {
+		const sub = parsed.args[0]?.toLowerCase() ?? "status";
+		const canSelfEnable = sub === "on";
+		if (!config.commands.debug && !canSelfEnable) {
+			await context.channel.sendMessage(target, "/debug is disabled. Set commands.debug=true to enable.");
+			return { handled: true };
+		}
+		if (sub === "on" || sub === "off") {
+			const next = loadFileConfig();
+			next.commands.debug = sub === "on";
+			try {
+				persistFileConfig(next);
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				await context.channel.sendMessage(target, `Failed to update debug mode: ${message}`);
+				return { handled: true };
+			}
+			await context.channel.sendMessage(target, `commands.debug=${next.commands.debug}`);
+			return { handled: true };
+		}
+		if (sub === "level") {
+			const requested = parsed.args[1]?.trim().toLowerCase();
+			if (!requested || !DEBUG_LOG_LEVELS.has(requested)) {
+				await context.channel.sendMessage(target, "Usage: /debug level <trace|debug|info|warn|error|fatal|silent>");
+				return { handled: true };
+			}
+			logger.level = requested;
+			process.env.LOG_LEVEL = requested;
+			await context.channel.sendMessage(target, `Logger level set to ${requested} (runtime only).`);
+			return { handled: true };
+		}
+		if (sub === "dump") {
+			const payload = {
+				pid: process.pid,
+				uptimeSec: Math.floor(process.uptime()),
+				loggerLevel: logger.level,
+				commands: config.commands,
+				activeSessions: context.db.listSessions().length,
+				channelDiagnostics: context.channel.getDiagnostics?.() ?? {}
+			};
+			await context.channel.sendMessage(target, trimForTelegram(JSON.stringify(payload, null, 2)));
+			return { handled: true };
+		}
+		if (sub === "status") {
+			const lines = [
+				"Debug status",
+				`pid=${process.pid}`,
+				`uptimeSec=${Math.floor(process.uptime())}`,
+				`logger.level=${logger.level}`,
+				`commands.debug=${config.commands.debug}`,
+				`commands.config=${config.commands.config}`,
+				`commands.bash=${config.commands.bash}`,
+				`commands.restart=${config.commands.restart}`,
+				`activeSessions=${context.db.listSessions().length}`,
+				"",
+				"Usage:",
+				"/debug status",
+				"/debug level <trace|debug|info|warn|error|fatal|silent>",
+				"/debug dump",
+				"/debug on|off"
+			];
+			await context.channel.sendMessage(target, lines.join("\n"));
+			return { handled: true };
+		}
+		await context.channel.sendMessage(target, "Usage: /debug status | level <...> | dump | on | off");
+		return { handled: true };
+	}
+	if (parsed.command === "bash") {
+		if (!config.commands.bash) {
+			await context.channel.sendMessage(target, "/bash is disabled. Set commands.bash=true to enable.");
+			return { handled: true };
+		}
+		return {
+			handled: false,
+			promptOverride: `Run this shell command safely: ${parsed.args.join(" ").trim()}`
+		};
+	}
+	return { handled: false };
 }
 
 //#endregion
-//#region src/channels/telegram-pairing-store.ts
-function nowIso() {
-	return (/* @__PURE__ */ new Date()).toISOString();
-}
-function randomCode() {
-	return Math.random().toString(36).slice(2, 8).toUpperCase();
-}
-var TelegramPairingStore = class {
-	filePath;
-	state = null;
-	constructor(storeDir) {
-		this.filePath = path.join(storeDir, "telegram-pairing.json");
-	}
-	load() {
-		if (this.state) return this.state;
-		if (!fs.existsSync(this.filePath)) {
-			this.state = {
-				approved: {},
-				pending: {}
+//#region src/channels/telegram-policy.ts
+function toIdSet(values) {
+	return new Set((values ?? []).map((value) => String(value).trim().toLowerCase()).filter(Boolean));
+}
+function splitThread(chatId) {
+	const [baseChatIdRaw, threadIdRaw] = chatId.split("#");
+	return {
+		baseChatId: baseChatIdRaw ?? chatId,
+		...threadIdRaw ? { threadId: threadIdRaw } : {}
+	};
+}
+function isDirectMessage(msg) {
+	return msg.peer?.kind === "direct" || !msg.chatId.startsWith("-") && !msg.chatId.includes("#");
+}
+function containsMention(text, assistantName) {
+	const normalized = assistantName.trim().toLowerCase();
+	if (!normalized) return false;
+	return text.toLowerCase().includes(`@${normalized}`);
+}
+function isAllowListed(msg, allowSet) {
+	if (allowSet.has("*")) return true;
+	const userId = msg.userId.trim().toLowerCase();
+	if (userId && allowSet.has(userId)) return true;
+	const displayName = msg.displayName.trim().replace(/^@/, "").toLowerCase();
+	if (displayName && allowSet.has(displayName)) return true;
+	return false;
+}
+function evaluateTelegramPolicy(params) {
+	const { config, msg, pairingStore } = params;
+	const accountId = (msg.accountId ?? config.channels.telegram.defaultAccountId).trim() || "default";
+	const account = config.channels.telegram.accounts[accountId] ?? config.channels.telegram.accounts[config.channels.telegram.defaultAccountId] ?? config.channels.telegram.accounts.default;
+	if (!account || account.enabled === false) return {
+		allowed: false,
+		reason: "account-disabled"
+	};
+	const direct = isDirectMessage(msg);
+	const allowFromSet = toIdSet(account.allowFrom);
+	if (direct) {
+		const dmPolicy = account.dmPolicy ?? "pairing";
+		if (dmPolicy === "disabled") return {
+			allowed: false,
+			reason: "dm-disabled"
+		};
+		if (dmPolicy === "open") return { allowed: true };
+		if (dmPolicy === "allowlist") {
+			if (isAllowListed(msg, allowFromSet) || pairingStore.isApproved(accountId, msg.userId)) return { allowed: true };
+			return {
+				allowed: false,
+				reason: "dm-not-allowlisted"
 			};
-			return this.state;
 		}
-		try {
-			const parsed = JSON.parse(fs.readFileSync(this.filePath, "utf8"));
-			this.state = {
-				approved: parsed.approved ?? {},
-				pending: parsed.pending ?? {}
-			};
-			return this.state;
-		} catch {
-			this.state = {
-				approved: {},
-				pending: {}
-			};
-			return this.state;
-		}
-	}
-	save() {
-		if (!this.state) return;
-		fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
-		fs.writeFileSync(this.filePath, `${JSON.stringify(this.state, null, 2)}\n`, "utf8");
-	}
-	isApproved(accountId, userId) {
-		return (this.load().approved[accountId] ?? []).includes(userId);
-	}
-	ensurePendingCode(accountId, userId) {
-		const state = this.load();
-		const pendingByAccount = state.pending[accountId] ?? {};
-		const existing = Object.entries(pendingByAccount).find(([, entry]) => entry.userId === userId);
-		if (existing) return existing[0];
-		const code = randomCode();
-		state.pending[accountId] = {
-			...pendingByAccount,
-			[code]: {
-				userId,
-				createdAt: nowIso()
-			}
-		};
-		this.save();
-		return code;
-	}
-	approveByCode(accountId, code) {
-		const state = this.load();
-		const pendingByAccount = state.pending[accountId] ?? {};
-		const entry = pendingByAccount[code];
-		if (!entry) return { ok: false };
-		const approved = new Set(state.approved[accountId] ?? []);
-		approved.add(entry.userId);
-		state.approved[accountId] = Array.from(approved).sort((a, b) => a.localeCompare(b));
-		delete pendingByAccount[code];
-		state.pending[accountId] = pendingByAccount;
-		this.save();
+		if (isAllowListed(msg, allowFromSet) || pairingStore.isApproved(accountId, msg.userId)) return { allowed: true };
 		return {
-			ok: true,
-			userId: entry.userId
+			allowed: false,
+			reason: "pairing-required",
+			pairingCode: pairingStore.ensurePendingCode(accountId, msg.userId)
 		};
 	}
-	rejectByCode(accountId, code) {
-		const state = this.load();
-		const pendingByAccount = state.pending[accountId] ?? {};
-		const entry = pendingByAccount[code];
-		if (!entry) return { ok: false };
-		delete pendingByAccount[code];
-		state.pending[accountId] = pendingByAccount;
-		this.save();
-		return {
-			ok: true,
-			userId: entry.userId
+	const { baseChatId, threadId } = splitThread(msg.chatId);
+	const groupConfig = account.groups?.[baseChatId];
+	const topicConfig = threadId ? groupConfig?.topics?.[threadId] : void 0;
+	if (groupConfig?.enabled === false) return {
+		allowed: false,
+		reason: "group-disabled"
+	};
+	if (topicConfig?.enabled === false) return {
+		allowed: false,
+		reason: "topic-disabled"
+	};
+	const groupPolicy = topicConfig?.groupPolicy ?? groupConfig?.groupPolicy ?? account.groupPolicy ?? "open";
+	if (groupPolicy === "disabled") return {
+		allowed: false,
+		reason: "group-disabled"
+	};
+	if (groupPolicy === "allowlist") {
+		if (!isAllowListed(msg, toIdSet(topicConfig?.allowFrom ?? groupConfig?.allowFrom ?? account.groupAllowFrom))) return {
+			allowed: false,
+			reason: "group-not-allowlisted"
 		};
 	}
-};
+	if ((topicConfig?.requireMention ?? groupConfig?.requireMention ?? false) && !containsMention(msg.text, config.assistantName)) return {
+		allowed: false,
+		reason: "mention-required"
+	};
+	return { allowed: true };
+}
 
 //#endregion
 //#region src/gateway/methods/agent.ts
@@ -773,7 +1478,7 @@ function deepMerge(base, patch) {
 	return result;
 }
 const configGetMethod = async (_params, context) => {
-	return context.readFileConfig();
+	return redactSensitiveData(context.readFileConfig());
 };
 const configSetMethod = async (params, context) => {
 	const parsed = configSetParamsSchema.parse(params);
@@ -855,7 +1560,7 @@ const logsTailMethod = async (params, context) => {
 		message: event.eventType,
 		sessionKey: event.sessionKey,
 		actor: event.actor,
-		payload: event.payload
+		payload: redactSensitiveData(event.payload)
 	})) };
 };
 
@@ -1102,7 +1807,46 @@ function sendResponse(socket, id, ok, payload, error) {
 function setUiSecurityHeaders(res) {
 	res.setHeader("X-Frame-Options", "DENY");
 	res.setHeader("X-Content-Type-Options", "nosniff");
-	res.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
+	res.setHeader("Content-Security-Policy", [
+		"default-src 'self'",
+		"script-src 'self'",
+		"style-src 'self'",
+		"img-src 'self' data:",
+		"font-src 'self'",
+		"connect-src 'self'",
+		"object-src 'none'",
+		"base-uri 'none'",
+		"frame-ancestors 'none'",
+		"form-action 'none'"
+	].join("; "));
+}
+function normalizeOrigin(value) {
+	try {
+		const parsed = new URL(value);
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+		return `${parsed.protocol}//${parsed.host}`.toLowerCase();
+	} catch {
+		return null;
+	}
+}
+function isOriginAllowed(request, config) {
+	const rawOrigin = request.headers.origin;
+	if (typeof rawOrigin !== "string" || rawOrigin.trim().length === 0) return true;
+	const normalizedOrigin = normalizeOrigin(rawOrigin.trim());
+	if (!normalizedOrigin) return false;
+	const rawHost = request.headers.host;
+	if (typeof rawHost === "string" && rawHost.trim().length > 0) {
+		const normalizedHost = rawHost.trim().toLowerCase();
+		if (normalizedOrigin === `http://${normalizedHost}` || normalizedOrigin === `https://${normalizedHost}`) return true;
+	}
+	const allowedOrigins = config.gateway.auth.allowedOrigins;
+	if (allowedOrigins.includes("*")) return true;
+	for (const allowed of allowedOrigins) {
+		const normalizedAllowed = normalizeOrigin(allowed);
+		if (!normalizedAllowed) continue;
+		if (normalizedAllowed === normalizedOrigin) return true;
+	}
+	return false;
 }
 function contentTypeForFile(filePath) {
 	const ext = path.extname(filePath).toLowerCase();
@@ -1203,6 +1947,15 @@ var HovClawGatewayServer = class {
 				socket.destroy();
 				return;
 			}
+			if (!isOriginAllowed(request, this.runtimeConfig)) {
+				socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+				socket.destroy();
+				logger.warn({
+					origin: request.headers.origin,
+					host: request.headers.host
+				}, "Rejected websocket upgrade due to origin policy");
+				return;
+			}
 			this.wss.handleUpgrade(request, socket, head, (wsSocket) => {
 				this.wss?.emit("connection", wsSocket, request);
 			});
@@ -1317,7 +2070,14 @@ var HovClawGatewayServer = class {
 		const connectParams = parseConnectParams(request.params);
 		const expectedToken = this.runtimeConfig.gateway.auth.token.trim();
 		const expectedPassword = this.runtimeConfig.gateway.auth.password.trim();
-		if (!expectedToken && !expectedPassword) return { ok: true };
+		const allowUnauthenticated = this.runtimeConfig.gateway.auth.allowUnauthenticated;
+		if (!expectedToken && !expectedPassword) {
+			if (allowUnauthenticated) return { ok: true };
+			return {
+				ok: false,
+				reason: "gateway auth required"
+			};
+		}
 		if (expectedToken && connectParams.auth?.token === expectedToken) return { ok: true };
 		if (expectedPassword && connectParams.auth?.password === expectedPassword) return { ok: true };
 		return {
@@ -1765,6 +2525,19 @@ var HovClawScheduler = class {
 function normalizePrompt(msg) {
 	return msg.text.trim();
 }
+function formatModelForSessionNotice(modelRef) {
+	const match = modelRef.match(/^([^:\/]+)[:\/](.+)$/);
+	if (!match) return modelRef;
+	const provider = match[1];
+	const model = match[2];
+	if (!provider || !model) return modelRef;
+	return `${provider}/${model}`;
+}
+function applyThinkingLevel(prompt, level, force = false) {
+	if (/^Use (low|medium|high) reasoning effort for this task:/i.test(prompt)) return prompt;
+	if (level === "medium" && !force) return prompt;
+	return `Use ${level} reasoning effort for this task: ${prompt}`;
+}
 function buildChannelTarget(msg) {
 	return {
 		channel: msg.channel,
@@ -1800,6 +2573,17 @@ var MultiNotifier = class {
 		}, text);
 	}
 };
+function validateGatewaySecurityConfig() {
+	if (!config.gateway.enabled) return;
+	const auth = config.gateway.auth;
+	if (auth.allowUnauthenticated) return;
+	if (auth.token.trim() || auth.password.trim()) return;
+	throw new Error([
+		"Gateway auth is required when gateway is enabled.",
+		"Set gateway.auth.token or gateway.auth.password in ~/.hovclaw/config.json,",
+		"or explicitly set gateway.auth.allowUnauthenticated=true for insecure compatibility mode."
+	].join(" "));
+}
 async function main() {
 	const importedLegacyEnv = ensureConfigFromLegacyEnv();
 	if (!hasConfigFile()) {
@@ -1810,6 +2594,7 @@ async function main() {
 		configPath: config.configPath,
 		credentialsPath: config.credentialsPath
 	}, "Imported legacy env configuration into ~/.hovclaw");
+	validateGatewaySecurityConfig();
 	try {
 		const bootstrap = await ensureWorkspaceBootstrapForConfig(config);
 		if (bootstrap.createdFileCount > 0) logger.info({
@@ -1840,7 +2625,8 @@ async function main() {
 	});
 	const agentManager = new PiAgentManager(db, createTools({
 		runtime,
-		audit: (record) => db.appendAuditEvent(record)
+		audit: (record) => db.appendAuditEvent(record),
+		bashEnabled: config.runtime.tools.bashEnabled
 	}));
 	let lastMessageAt = null;
 	const telegramPairingStore = new TelegramPairingStore(config.storeDir);
@@ -1851,10 +2637,19 @@ async function main() {
 	const channels = channelPluginManager.initializeAdapters();
 	const handleMessage = async (msg) => {
 		lastMessageAt = (/* @__PURE__ */ new Date()).toISOString();
-		const normalizedPrompt = normalizePrompt(msg);
-		if (!normalizedPrompt) return;
 		const channel = channels.get(msg.channel);
 		if (!channel) return;
+		const agentId = resolveAgentIdForInbound(config, msg);
+		const sessionKey = composeSessionKey({
+			agent: agentId,
+			channel: msg.channel,
+			identity: canonicalizeSessionIdentity(msg)
+		});
+		const target = buildChannelTarget(msg);
+		let normalizedPrompt = normalizePrompt(msg);
+		if (!normalizedPrompt) return;
+		let thinkingLevel = config.commands.defaultThinkingLevel;
+		let thinkingLevelForced = false;
 		if (msg.channel === "telegram") {
 			const policy = evaluateTelegramPolicy({
 				config,
@@ -1863,12 +2658,13 @@ async function main() {
 			});
 			if (!policy.allowed) {
 				if (policy.pairingCode && channel instanceof TelegramChannel) {
-					await channel.sendMessage(buildChannelTarget(msg), `Pairing required. Ask an approver to run: /pair approve ${policy.pairingCode}`);
+					const accountId = (msg.accountId ?? config.channels.telegram.defaultAccountId).trim() || "default";
+					await channel.sendMessage(target, `Pairing required. Ask an approver to run: hovclaw pairing approve --channel telegram --account ${accountId} ${policy.pairingCode}`);
 					db.appendAuditEvent({
 						actor: "channel",
 						eventType: "telegram.pair.pending",
 						payload: {
-							accountId: msg.accountId ?? config.channels.telegram.defaultAccountId,
+							accountId,
 							userId: msg.userId,
 							code: policy.pairingCode
 						}
@@ -1877,20 +2673,36 @@ async function main() {
 				return;
 			}
 			if (channel instanceof TelegramChannel) {
-				if (await handleTelegramCommand({
+				const result = await handleTelegramCommand({
 					msg,
 					channel,
 					db,
-					pairingStore: telegramPairingStore
-				})) return;
+					agentId,
+					sessionKey
+				});
+				if (result.resetSession) {
+					try {
+						await agentManager.resetSession(sessionKey);
+					} catch (error) {
+						logger.error({
+							error,
+							sessionKey
+						}, "Failed to reset session");
+						await channel.sendMessage(target, "Failed to reset session. Check logs and try again.");
+						return;
+					}
+					const modelLabel = formatModelForSessionNotice(config.models.interactive);
+					await channel.sendMessage(target, `New session started. Model: ${modelLabel}`);
+				}
+				if (result.promptOverride?.trim()) normalizedPrompt = result.promptOverride.trim();
+				if (result.thinkingLevelOverride) {
+					thinkingLevel = result.thinkingLevelOverride;
+					thinkingLevelForced = true;
+				}
+				if (result.handled) return;
 			}
 		}
-		const sessionKey = composeSessionKey({
-			agent: resolveAgentIdForInbound(config, msg),
-			channel: msg.channel,
-			identity: canonicalizeSessionIdentity(msg)
-		});
-		const target = buildChannelTarget(msg);
+		normalizedPrompt = applyThinkingLevel(normalizedPrompt, thinkingLevel, thinkingLevelForced);
 		try {
 			await channel.setTyping?.(target, true);
 			let finalText = null;
@@ -1940,6 +2752,18 @@ async function main() {
 		channel.onMessage(handleMessage);
 		try {
 			await channel.start();
+			if (channel instanceof TelegramChannel) {
+				const commands = listTelegramNativeCommandSpecs(config, channel.getAccountId());
+				try {
+					await channel.setMyCommands(commands);
+				} catch (commandError) {
+					logger.warn({
+						error: commandError,
+						channel: channelName,
+						commandCount: commands.length
+					}, "Telegram command registration failed; continuing without native command menu sync");
+				}
+			}
 		} catch (error) {
 			logger.error({
 				error,
@@ -1979,6 +2803,7 @@ async function main() {
 	gatewayServer?.start();
 	const healthPortRaw = process.env.HEALTH_PORT || "8787";
 	const healthPort = Number(healthPortRaw);
+	const healthHost = (process.env.HEALTH_HOST || "127.0.0.1").trim() || "127.0.0.1";
 	const healthServer = Number.isFinite(healthPort) && healthPort > 0 ? createServer((req, res) => {
 		if (req.url !== "/health") {
 			res.statusCode = 404;
@@ -1999,8 +2824,11 @@ async function main() {
 				port: config.gateway.port
 			}
 		}));
-	}).listen(healthPort, () => {
-		logger.info({ healthPort }, "Health endpoint started");
+	}).listen(healthPort, healthHost, () => {
+		logger.info({
+			healthHost,
+			healthPort
+		}, "Health endpoint started");
 	}) : null;
 	const shutdown = async () => {
 		logger.info("Shutting down...");