loopengine 0.3.8 → 0.3.9

package/dist/core/messaging/connectors/telegram/index.d.ts

@@ -31,9 +31,13 @@ export declare function setTelegramWebhook(botToken: string, url: string, secret
     botUsername?: string;
 }>;
 /** Where the bot's updates go now, and the last delivery error Telegram saw. */
+/** Where the bot's updates go now; the last delivery error Telegram saw
+ * and when (it keeps it until a newer one); and how many are waiting. */
 export declare function telegramWebhookInfo(botToken: string): Promise<{
     ok: boolean;
     url?: string;
     lastError?: string;
+    lastErrorAt?: string;
+    pending?: number;
     error?: string;
 }>;

package/dist/core/messaging/connectors/telegram/index.js

@@ -121,11 +121,20 @@ export async function setTelegramWebhook(botToken, url, secret) {
     return { ok: true, botUsername: await telegramBotUsername(botToken) };
 }
 /** Where the bot's updates go now, and the last delivery error Telegram saw. */
+/** Where the bot's updates go now; the last delivery error Telegram saw
+ * and when (it keeps it until a newer one); and how many are waiting. */
 export async function telegramWebhookInfo(botToken) {
     const info = await callTelegram(botToken, 'getWebhookInfo', {});
     if (!info.ok)
         return { ok: false, error: telegramSetupError(info.description) };
-    return { ok: true, url: info.result?.url || undefined, ...(info.result?.last_error_message ? { lastError: info.result.last_error_message } : {}) };
+    const r = info.result;
+    return {
+        ok: true,
+        url: r?.url || undefined,
+        ...(r?.last_error_message ? { lastError: r.last_error_message } : {}),
+        ...(r?.last_error_date ? { lastErrorAt: new Date(r.last_error_date * 1000).toISOString() } : {}),
+        ...(r?.pending_update_count ? { pending: r.pending_update_count } : {}),
+    };
 }
 function telegramSetupError(description) {
     if (/unauthorized|not found/i.test(description ?? ''))

package/dist/core/model-calls/openai-model-call.d.ts

@@ -34,5 +34,9 @@ export declare function toResponsesInput(message: Message): ResponseInputItem[];
  * blocks, message text, and function calls as tool_use blocks (their
  * call_id is the id a tool result answers). */
 export declare function fromResponse(response: OpenAI.Responses.Response): ModelResponse;
+/** OpenAI's reasoning models (GPT-5 on, the o-series), which reason by
+ * default and take a reasoning effort; older ones (gpt-4o, gpt-4.1)
+ * reject one. */
+export declare function isOpenAIReasoningModel(model: string): boolean;
 export declare function createOpenAIModelCall(options: OpenAIModelCallOptions): ModelCall;
 export {};

package/dist/core/model-calls/openai-model-call.js

@@ -232,10 +232,20 @@ export function fromResponse(response) {
     const usage = response.usage ? { input_tokens: response.usage.input_tokens, output_tokens: response.usage.output_tokens } : undefined;
     return { stop_reason, content, ...(usage ? { usage } : {}) };
 }
+/** OpenAI's reasoning models (GPT-5 on, the o-series), which reason by
+ * default and take a reasoning effort; older ones (gpt-4o, gpt-4.1)
+ * reject one. */
+export function isOpenAIReasoningModel(model) {
+    return /^(gpt-(5|6|7|8|9)|o\d)/i.test(model);
+}
 export function createOpenAIModelCall(options) {
     const client = options.client ?? new OpenAI({ apiKey: options.apiKey });
+    // A reasoning model with no effort set reasons at OpenAI's default
+    // anyway (medium), which used to spend the 4096-token cap before it
+    // got to a tool call. Unset is low for those: quick, and room to act.
+    const reasoningEffort = options.reasoningEffort ?? (isOpenAIReasoningModel(options.model) ? 'low' : undefined);
     // Reasoning counts toward max_output_tokens.
-    const maxTokens = options.maxTokens ?? (options.reasoningEffort && options.reasoningEffort !== 'none' ? 16000 : 4096);
+    const maxTokens = options.maxTokens ?? (reasoningEffort && reasoningEffort !== 'none' ? 16000 : 4096);
     return async (messages, system, tools) => {
         const response = await client.responses.create({
             model: options.model,
@@ -245,7 +255,7 @@ export function createOpenAIModelCall(options) {
             tools: tools.length
                 ? tools.map((t) => ({ type: 'function', name: t.name, description: t.description, parameters: t.input_schema, strict: false }))
                 : undefined,
-            ...(options.reasoningEffort ? { reasoning: { effort: options.reasoningEffort } } : {}),
+            ...(reasoningEffort ? { reasoning: { effort: reasoningEffort } } : {}),
             store: false,
             include: ['reasoning.encrypted_content'],
         });

package/dist/core/system-agents/workflow-planner.js

@@ -411,7 +411,8 @@ export function workflowTemplate(plan) {
             ...(plan.apps?.length ? { apps: plan.apps } : {}),
             keys: plan.keys,
             skills: [{ id: plan.id, description: plan.skill.description, body: plan.skill.body }],
-            rules: plan.rules.map((r) => ({ name: slugify(`${plan.id}-${r.tool}`, `${plan.id}-rule`), tool: r.tool, decision: r.decision })),
+            // Named after the tool: readable, and made unique if taken.
+            rules: plan.rules.map((r) => ({ name: r.tool, tool: r.tool, decision: r.decision })),
             ...(plan.trigger.kind === 'schedule' && plan.trigger.every
                 ? { schedule: { every: plan.trigger.every, ...(plan.trigger.at ? { at: plan.trigger.at } : {}), ...(plan.trigger.weekday !== undefined ? { weekday: plan.trigger.weekday } : {}), name: plan.name, message: plan.startMessage, workflowId: plan.id, ...(plan.notify?.on ? { notify: true } : {}) } }
                 : {}),

package/dist/web/actauth-admin.d.ts

@@ -23,7 +23,38 @@ export declare function readActauthConfig(agentName: string): ActauthConfigView;
 /** Appends a new rule. `rule.name` must be unique among this agent's
  * existing rules — it's the only handle update/removeActauthRule below
  * have to find it again, so a duplicate would make those ambiguous. */
-export declare function addActauthRule(agentName: string, rule: ActauthRuleInput): void;
+/** Adds a rule at the end, or, with `before`, just above that named rule
+ * (the first rule that matches a call decides it, so above is what makes
+ * it count). */
+export declare function addActauthRule(agentName: string, rule: ActauthRuleInput, options?: {
+    before?: string;
+}): void;
+type RuleDecision = 'allow' | 'ask' | 'deny';
+export interface PlannedRule {
+    tool: string;
+    decision: RuleDecision;
+    /** Its name in actauth.yml; the tool's name (made unique) by default. */
+    name?: string;
+}
+export interface PlannedRulesResult {
+    added: string[];
+    /** Tools that already had a rule with the same decision. */
+    unchanged: string[];
+    /** Tools whose first rule is stricter or looser than planned and was
+     * kept as it is: the plan never loosens a decision the agent has. */
+    kept: {
+        tool: string;
+        has: RuleDecision;
+        wants: RuleDecision;
+    }[];
+}
+/** Gives the planned tools their decisions, once the agent's abilities and
+ * apps are installed (their own rules in place), so nothing is added twice:
+ * a tool with no rule gets one; one whose first matching rule already says
+ * the same is left alone; one a plan wants stricter (ask where an ability
+ * allows) gets its rule just above, so it counts; one a plan wants looser
+ * keeps what it has, and is reported. */
+export declare function applyPlannedRules(agentName: string, planned: PlannedRule[]): PlannedRulesResult;
 /** Mutates an existing rule's scope/tool/decision in place (via the
  * node's own `.set()`, not remove-then-re-add), so any comment attached
  * to that specific rule in the source YAML survives the edit. */
@@ -34,3 +65,4 @@ export declare function updateActauthRule(agentName: string, ruleName: string, u
 }): void;
 export declare function removeActauthRule(agentName: string, ruleName: string): void;
 export declare function setDefaultDecision(agentName: string, decision: Decision): void;
+export {};

package/dist/web/actauth-admin.js

@@ -62,16 +62,53 @@ function findRuleIndex(rules, ruleName) {
 /** Appends a new rule. `rule.name` must be unique among this agent's
  * existing rules — it's the only handle update/removeActauthRule below
  * have to find it again, so a duplicate would make those ambiguous. */
-export function addActauthRule(agentName, rule) {
+/** Adds a rule at the end, or, with `before`, just above that named rule
+ * (the first rule that matches a call decides it, so above is what makes
+ * it count). */
+export function addActauthRule(agentName, rule, options = {}) {
     const dir = agentDir(agentName);
     const { path, doc } = loadDoc(dir);
     const rules = doc.get('rules');
     if (findRuleIndex(rules, rule.name) !== -1) {
         throw new ActauthRuleExistsError(`A rule named '${rule.name}' already exists for '${agentName}' — pick a different name or remove it first.`);
     }
-    rules.add(doc.createNode({ name: rule.name, scope: rule.scope, tool: rule.tool, decision: rule.decision }));
+    const node = doc.createNode({ name: rule.name, scope: rule.scope, tool: rule.tool, decision: rule.decision });
+    const at = options.before ? findRuleIndex(rules, options.before) : -1;
+    if (at === -1)
+        rules.add(node);
+    else
+        rules.items.splice(at, 0, node);
     saveDoc(dir, path, doc);
 }
+const STRICTNESS = { allow: 0, ask: 1, deny: 2 };
+/** Gives the planned tools their decisions, once the agent's abilities and
+ * apps are installed (their own rules in place), so nothing is added twice:
+ * a tool with no rule gets one; one whose first matching rule already says
+ * the same is left alone; one a plan wants stricter (ask where an ability
+ * allows) gets its rule just above, so it counts; one a plan wants looser
+ * keeps what it has, and is reported. */
+export function applyPlannedRules(agentName, planned) {
+    const result = { added: [], unchanged: [], kept: [] };
+    for (const rule of planned) {
+        const current = readActauthConfig(agentName).rules;
+        const first = current.find((r) => r.tool === rule.tool);
+        if (first && first.decision === rule.decision) {
+            result.unchanged.push(rule.tool);
+            continue;
+        }
+        if (first && STRICTNESS[rule.decision] < STRICTNESS[first.decision]) {
+            result.kept.push({ tool: rule.tool, has: first.decision, wants: rule.decision });
+            continue;
+        }
+        const base = rule.name ?? rule.tool;
+        let name = base;
+        for (let i = 2; current.some((r) => r.name === name); i++)
+            name = `${base}-${i}`;
+        addActauthRule(agentName, { name, scope: '*/*', tool: rule.tool, decision: rule.decision }, first ? { before: first.name } : {});
+        result.added.push(name);
+    }
+    return result;
+}
 /** Mutates an existing rule's scope/tool/decision in place (via the
  * node's own `.set()`, not remove-then-re-add), so any comment attached
  * to that specific rule in the source YAML survives the edit. */

package/dist/web/agents-config-page.js

@@ -438,10 +438,6 @@ ${consoleShellScript}
     return attempt().catch(function () { return attempt(); });
   }
 
-  function badge(label) {
-    return '<span class="badge ' + (label === 'custom' ? 'badge-custom' : 'badge-default') + '">' + escapeHtml(label) + '</span>';
-  }
-
   // A small, deliberately non-CommonMark markdown-to-HTML renderer for
   // the skill Body field's Preview toggle (see wireSkillsHandlers) — this
   // page stays a self-contained string, no build step, no CDN (same
@@ -899,6 +895,7 @@ ${consoleShellScript}
       if (!r.ok) { el.innerHTML = '<p class="error">Could not load workflows: ' + escapeHtml(r.body.error || 'unknown error') + '</p>'; return; }
       var workflows = r.body.workflows || [];
       fillWorkflowsCard(workflows);
+      leShell.setCount('workflows', workflows.length);
       workflowsById = {};
       workflows.forEach(function (w) { workflowsById[w.id] = w; });
       el.innerHTML = renderWorkflowsHtml(name, workflows);
@@ -1224,7 +1221,11 @@ ${consoleShellScript}
         var action = btn.dataset.action;
         if (action === 'cancel' && btn.dataset.confirming !== '1') { btn.dataset.confirming = '1'; btn.textContent = 'Click again to remove'; return; }
         btn.disabled = true;
-        fetchJsonRetryOnce('/schedules/' + encodeURIComponent(btn.dataset.id) + '/' + action, { method: 'POST' }).then(function () { loadWorkflowsSection(name); });
+        fetchJsonRetryOnce('/schedules/' + encodeURIComponent(btn.dataset.id) + '/' + action, { method: 'POST' }).then(function () {
+          loadWorkflowsSection(name);
+          // The Schedules tab's count, and the Overview's tile.
+          fillOverviewCards(name);
+        });
       });
     }
     card.querySelector('.workflow-run').addEventListener('click', function (ev) {
@@ -1277,6 +1278,7 @@ ${consoleShellScript}
       var waiting = active.filter(function (t) { return t.status === 'awaiting_approval'; }).length;
       var next = active.map(function (t) { return t.next_run_at; }).filter(Boolean).sort()[0];
       set('ovSchedulesValue', String(active.length));
+      leShell.setCount('schedules', active.length);
       var schedulesDetail = [];
       if (waiting) schedulesDetail.push(waiting + ' waiting for approval');
       if (next) schedulesDetail.push('Next run ' + escapeHtml(new Date(next).toLocaleString()));
@@ -1310,7 +1312,10 @@ ${consoleShellScript}
           '<dt>Provider</dt><dd>' + escapeHtml(cfg.model.provider) + '</dd>' +
           '<dt>Model</dt><dd>' + escapeHtml(cfg.model.model || '(provider default)') + '</dd>' +
           '<dt>Max tokens</dt><dd>' + escapeHtml(cfg.model.maxTokens != null ? cfg.model.maxTokens : '(default)') + '</dd>' +
-          '<dt>Reasoning effort</dt><dd>' + escapeHtml(cfg.model.reasoningEffort || (REASONING_PROVIDERS.indexOf(cfg.model.provider) !== -1 ? '(model default)' : 'n/a')) + '</dd>' +
+          // Unset is low for OpenAI's reasoning models (core/model-calls/openai-model-call.ts).
+          '<dt>Reasoning effort</dt><dd>' + escapeHtml(cfg.model.reasoningEffort ||
+            (cfg.model.provider === 'openai' && /^(gpt-[5-9]|o[0-9])/i.test(cfg.model.model || '') ? 'low (default)'
+              : REASONING_PROVIDERS.indexOf(cfg.model.provider) !== -1 ? '(model default)' : 'n/a')) + '</dd>' +
         '</dl>' +
         '<form class="add-source" id="modelForm" style="display:none">' +
           '<label>Provider' +
@@ -1326,7 +1331,7 @@ ${consoleShellScript}
           '<label>Max tokens <span class="hint">(blank for provider default)</span>' +
             '<input type="number" name="maxTokens" min="1" step="1" value="' + (cfg.model.maxTokens != null ? escapeHtml(cfg.model.maxTokens) : '') + '">' +
           '</label>' +
-          '<label id="reasoningEffortField">Reasoning effort <span class="hint">(how much the model thinks before answering: none turns it off, unset uses the model\\\'s default)</span>' +
+          '<label id="reasoningEffortField">Reasoning effort <span class="hint">(how much the model thinks before answering: none turns it off, unset uses the model\\\'s default, and low for OpenAI\\\'s reasoning models)</span>' +
             '<select name="reasoningEffort">' +
               ['', 'none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'].map(function (v) {
                 return '<option value="' + v + '"' + (v === (cfg.model.reasoningEffort || '') ? ' selected' : '') + '>' + (v || '(unset)') + '</option>';
@@ -1342,11 +1347,6 @@ ${consoleShellScript}
     return renderOverviewCards(cfg) +
       '<section>' + systemPromptSection + '</section>' +
       '<section>' + modelSection + '</section>' +
-      '<section><h3>Hooks</h3><dl class="kv">' +
-        '<dt>sessionIdFor</dt><dd>' + badge(cfg.sessionIdFor.indexOf('custom') === 0 ? 'custom' : 'default') + ' <span class="muted">' + escapeHtml(cfg.sessionIdFor) + '</span></dd>' +
-        '<dt>tenantFor</dt><dd>' + badge(cfg.tenantFor.indexOf('custom') === 0 ? 'custom' : 'default') + ' <span class="muted">' + escapeHtml(cfg.tenantFor) + '</span></dd>' +
-        '<dt>isSafeTool</dt><dd>' + badge(cfg.isSafeTool === 'custom' ? 'custom' : 'default') + ' <span class="muted">' + escapeHtml(cfg.isSafeTool) + '</span></dd>' +
-        '</dl></section>' +
       '<section><h3>Limits &amp; budgets <button type="button" class="edit-btn" id="editLimitsBtn">Edit</button></h3>' +
         '<dl class="kv" id="limitsDisplay">' +
           '<dt>maxTurns</dt><dd>' + escapeHtml(cfg.maxTurns) + '</dd>' +
@@ -1367,7 +1367,6 @@ ${consoleShellScript}
           '<button type="button" id="cancelLimitsBtn">Cancel</button>' +
           '<div class="error" id="limitsError"></div>' +
         '</form>' +
-        '<dl class="kv"><dt>skillsDirs</dt><dd>' + escapeHtml(cfg.skillsDirs.join(', ') || '(none)') + '</dd></dl>' +
       '</section>';
   }
 
@@ -1956,7 +1955,10 @@ ${consoleShellScript}
           (saved ? '<button type="button" class="delete-btn notifier-remove"' + (locked ? ' disabled' : '') + '>Remove</button>' : '') + '</div>' +
         (isWebhook ? '<p class="hint" style="margin:0">A webhook always sends once saved, alongside the primary messaging app.</p>' : '') +
         '<div class="hint notifier-result"></div>' +
-      '</form></details>';
+      '</form>' +
+      // Who can decide and give jobs here: part of this app's settings.
+      (channel === 'slack' || channel === 'telegram' ? renderApproversHtml(n, channel) : '') +
+      '</details>';
   }
 
   function renderConnectionsHtml(n) {
@@ -2011,7 +2013,7 @@ ${consoleShellScript}
         '<td><button type="button" class="delete-btn approver-remove" data-user="' + escapeHtml(a.user) + '"' + (n.canSave === false ? ' disabled' : '') + '>Remove</button></td></tr>';
     }).join('');
     var where = app === 'telegram' ? 'by replying to it' : 'by replying in its thread';
-    return '<section class="approvers-section" data-app="' + app + '"><h3>' + title + ' approvers</h3>' +
+    return '<section class="approvers-section" data-app="' + app + '" style="max-width:560px;margin-top:18px;padding-top:14px;border-top:1px solid var(--le-line, #e5e7eb)"><h4 style="margin:0 0 6px">Approvers</h4>' +
       (n.primary !== app ? '<p class="hint" style="margin:0 0 8px">' + title + ' isn&#39;t primary, so requests aren&#39;t sent there until it is. Jobs started there still use this list.</p>' : '') +
       '<p class="muted" style="margin:0 0 10px">People who can approve, deny, change or answer a request ' + where + ', like &ldquo;yes, go ahead&rdquo; or &ldquo;make it $40&rdquo;. A plain &ldquo;yes&rdquo; runs it; a reply that&#39;s less clear (&ldquo;sure, send it&rdquo;, &ldquo;yes but check the amount&rdquo;) shows exactly what will run with a Confirm button first, and a change is shown to approve first. Once anyone is listed, only approvers&#39; button clicks count, and only approvers can give the agent jobs. Anyone can still ask about a request.</p>' +
       (approvers.length
@@ -2101,8 +2103,7 @@ ${consoleShellScript}
       '<p class="muted" style="margin:0 0 12px">' + renderNotifierStatus(n) + '</p>' +
         (n.error ? '<p class="error">' + escapeHtml(n.error) + '</p>' : '') +
         (n.source === 'code' ? '' : renderConnectionsHtml(n)) + '</section>' +
-      renderApproversHtml(n, 'slack') +
-      renderApproversHtml(n, 'telegram') +
+
       '<section><h3>Recent deliveries</h3>' + renderDeliveries(n.deliveries || []) + '</section>';
   }
 
@@ -2251,8 +2252,16 @@ ${consoleShellScript}
         fetchJsonRetryOnce(url).then(function (r) {
           if (!r.ok) { out.textContent = r.body.error || 'Could not check'; return; }
           var b = r.body;
+          // Telegram keeps its last error until a newer one, so it says when.
+          var when = '';
+          if (b.lastErrorAt) {
+            var mins = Math.max(0, Math.round((Date.now() - Date.parse(b.lastErrorAt)) / 60000));
+            when = mins < 2 ? 'just now' : mins < 120 ? mins + ' minutes ago' : mins < 2880 ? Math.round(mins / 60) + ' hours ago' : Math.round(mins / 1440) + ' days ago';
+            when = ' (' + when + ', ' + new Date(b.lastErrorAt).toLocaleString() + ')';
+          }
           out.textContent = (b.pointsHere ? 'Connected' + (b.botUsername ? ' (@' + b.botUsername + ')' : '') + '.' : b.url ? 'The bot sends its updates somewhere else: ' + b.url + '. Connect again to point it here.' : 'The bot isn' + String.fromCharCode(8217) + 't sending its updates anywhere. Connect again.') +
-            (b.lastError ? ' Telegram' + String.fromCharCode(8217) + 's last delivery error: ' + b.lastError : '');
+            (b.pending ? ' ' + b.pending + ' update' + (b.pending === 1 ? '' : 's') + ' waiting to be delivered.' : '') +
+            (b.lastError ? ' Telegram' + String.fromCharCode(8217) + 's last delivery error' + when + ': ' + b.lastError + (b.pointsHere && !b.pending ? ' Nothing is waiting, so it' + String.fromCharCode(8217) + 's likely from before and since fixed.' : '') : '');
         });
       });
     }
@@ -3610,11 +3619,7 @@ ${consoleShellScript}
 
   function renderSkillsTabHtml(cfg) {
     var listHtml = cfg.skills.length ? cfg.skills.map(renderSkillCard).join('') : '<p class="hint">No skills yet.</p>';
-    return '<section><h3>Skills dirs</h3><dl class="kv">' +
-        '<dt>skillsDirs</dt><dd>' + escapeHtml(cfg.skillsDirs.join(', ') || '(none)') + '</dd>' +
-        '<dt>skillIndexBudgetTokens</dt><dd>' + escapeHtml(cfg.skillIndexBudgetTokens) + '</dd>' +
-        '</dl></section>' +
-      '<section><h3>Skills (' + cfg.skills.length + ')</h3><div id="skillList">' + listHtml + '</div></section>' +
+    return '<section><h3>Skills (' + cfg.skills.length + ')</h3><div id="skillList">' + listHtml + '</div></section>' +
       '<section><h3 id="skillFormHeading">Add a skill</h3>' +
         '<form class="add-source" id="skillForm">' +
           '<label>Id <span class="hint">(lowercase, hyphen-separated — becomes the SKILL.md folder name; nested skills aren\\'t editable here)</span>' +
@@ -4501,7 +4506,7 @@ ${consoleShellScript}
         prompt: cfg.systemPrompt,
         chips: [modelChip(cfg), { text: 'unmatched calls: ' + cfg.permissions.defaultDecision }],
         tab: currentTab,
-        counts: { tools: cfg.tools.length, skills: cfg.skills.length, abilities: cfg.abilityCount, actauth: cfg.permissions.rules.length },
+        counts: { tools: cfg.tools.length, skills: cfg.skills.length, abilities: cfg.abilityCount, workflows: cfg.skills.filter(function (s) { return s.workflow; }).length },
       }) +
       '<div class="le-scroll"><div class="le-page" style="display:block">' +
       '<div class="tab-panel" data-tab-panel="overview">' + renderOverviewHtml(cfg) + '</div>' +

package/dist/web/console-shell.js

@@ -56,8 +56,8 @@ export const consoleShellScript = `<script>
   // ability on the Apps tab (id 'abilities', so older links still work).
   // ?tab=tools and ?tab=skills still open Advanced.
   var TABS = [
-    ['overview', 'Overview'], ['workflows', 'Workflows'], ['abilities', 'Apps'], ['actauth', 'Permissions'],
-    ['messaging', 'Messaging'], ['schedules', 'Schedules'], ['env', 'Environment'], ['advanced', 'Advanced'], ['chat', 'Chat']
+    ['overview', 'Overview'], ['workflows', 'Workflows'], ['abilities', 'Apps'], ['chat', 'Chat'],
+    ['messaging', 'Messaging'], ['schedules', 'Schedules'], ['actauth', 'Permissions'], ['env', 'Environment'], ['advanced', 'Advanced']
   ];
 
   function esc(s) {

package/dist/web/notifier-admin.d.ts

@@ -127,6 +127,8 @@ export declare function setupAgentTelegramWebhook(config: AgentConfig, baseUrl:
 export declare function agentTelegramWebhookInfo(config: AgentConfig): Promise<{
     url?: string;
     lastError?: string;
+    lastErrorAt?: string;
+    pending?: number;
     pointsHere: boolean;
     botUsername?: string;
 }>;

package/dist/web/notifier-admin.js

@@ -161,7 +161,7 @@ export function jobAllowed(config, app, message) {
     const home = app === 'slack' ? file?.channelId : file?.chatId;
     if (!message.direct && home && home === message.conversation)
         return { allowed: true };
-    return { allowed: false, message: `Jobs by direct message need approvers: add yourself in this agent's Messaging tab in LoopEngine (${APP_NAMES[app]} section).` };
+    return { allowed: false, message: `Jobs by direct message need approvers: in LoopEngine, open this agent's Messaging tab, then ${APP_NAMES[app]} → Approvers, and add yourself.` };
 }
 /** Replaces the approver list on the agent's saved connection for `app`,
  * primary or not. Throws NotifierFileError when there's no connection
@@ -224,6 +224,8 @@ export async function agentTelegramWebhookInfo(config) {
     return {
         ...(info.url ? { url: info.url } : {}),
         ...(info.lastError ? { lastError: info.lastError } : {}),
+        ...(info.lastErrorAt ? { lastErrorAt: info.lastErrorAt } : {}),
+        ...(info.pending ? { pending: info.pending } : {}),
         pointsHere: Boolean(info.url?.endsWith(`/hooks/telegram/${encodeURIComponent(config.name)}`)),
         ...(botUsername ? { botUsername } : {}),
     };

package/dist/web/playground.js

@@ -1433,7 +1433,7 @@ ${consoleShellScript}
       var counts = {};
       if (cfg) {
         chips.push({ text: typeof cfg.model === 'string' ? cfg.model : cfg.model.provider + ' \u00b7 ' + (cfg.model.model || 'default model'), mono: true });
-        counts = { tools: cfg.tools.length, skills: cfg.skills.length, abilities: cfg.abilityCount, actauth: cfg.permissions.rules.length };
+        counts = { tools: cfg.tools.length, skills: cfg.skills.length, abilities: cfg.abilityCount };
       }
       head.innerHTML = leShell.renderHead({ name: name, prompt: agent.systemPrompt, chips: chips, tab: 'chat', counts: counts });
     }

package/dist/web/templates-admin.js

@@ -11,7 +11,7 @@
 import { createScheduledTask, pauseScheduledTask } from '../core/scheduler.js';
 import { workspaceTimeZone } from '../core/time-zone.js';
 import { STARTER_TEMPLATES, starterTemplate, templateScheduleStart } from '../core/system-agents/templates.js';
-import { ActauthRuleExistsError, addActauthRule, setDefaultDecision } from './actauth-admin.js';
+import { ActauthRuleExistsError, addActauthRule, applyPlannedRules, setDefaultDecision } from './actauth-admin.js';
 import { setAgentEnvVar } from './env-admin.js';
 import { freeAgentName } from './interview-admin.js';
 import { writeSkill } from './skills-admin.js';
@@ -126,19 +126,9 @@ export async function createFromTemplate(id, deps) {
 export async function createFromTemplateObject(template, deps) {
     const { candidate, setup } = template;
     const name = freeAgentName(candidate.agent.name, deps.agentExists);
-    // 1. The agent, and its permissions: everything asks unless a rule says
-    //    otherwise, and the template's rules come first.
+    // 1. The agent: everything asks unless a rule says otherwise.
     await deps.scaffoldAgent(name, candidate.agent.systemPrompt);
     setDefaultDecision(name, 'ask');
-    for (const rule of setup.rules) {
-        try {
-            addActauthRule(name, { name: rule.name, scope: '*/*', tool: rule.tool, decision: rule.decision });
-        }
-        catch (err) {
-            if (!(err instanceof ActauthRuleExistsError))
-                throw err;
-        }
-    }
     // 2. Abilities: their tools, skills and rules. One failing doesn't stop
     //    the rest; it heads the checklist.
     const installed = [];
@@ -185,6 +175,9 @@ export async function createFromTemplateObject(template, deps) {
             failed.push({ name: app.title, error: installFailureReason(err) });
         }
     }
+    // The template's rules, now that abilities and apps have added theirs:
+    // none twice, a stricter one placed so it counts, none loosened.
+    applyPlannedRules(name, setup.rules.map((r) => ({ name: r.name, tool: r.tool, decision: r.decision })));
     // 3. Its own skills and non-secret settings.
     for (const skill of setup.skills ?? [])
         writeSkill(name, skill.id, { description: skill.description, body: skill.body });

package/dist/web/workflow-admin.js

@@ -6,11 +6,11 @@
 // one without changing anything that agent already does.
 import { join } from 'node:path';
 import { addGatewayTool, readGatewayToolsFromDir } from '../core/gateway-tools.js';
-import { addActauthRule, readActauthConfig } from './actauth-admin.js';
+import { applyPlannedRules } from './actauth-admin.js';
 import { writeSkill } from './skills-admin.js';
 import { createFromTemplateObject, installFailureReason, templateChecklist } from './templates-admin.js';
 import { templateScheduleStart } from '../core/system-agents/templates.js';
-import { planParameters, planWebhook, planWorkflowWithModel, slugify, workflowTemplate } from '../core/system-agents/workflow-planner.js';
+import { planParameters, planWebhook, planWorkflowWithModel, workflowTemplate } from '../core/system-agents/workflow-planner.js';
 import { createTrigger, getTriggerStore, listTriggers, publicTrigger } from '../core/workflow-triggers.js';
 import { mcpAbilityNames } from '../core/mcp-ability-generator.js';
 import { clearWorkflowFields, migrateWorkflowsFile, readWorkflow, readWorkflows, setWorkflowFields, validateParams, workflowRunMessage } from '../core/workflows.js';
@@ -375,18 +375,7 @@ export async function createWorkflow(input, deps) {
     if (!agent)
         throw new WorkflowError(`There's no agent named ${target.agent ?? '(none)'}.`);
     const check = checkWorkflowForAgent(plan, agent);
-    // 1. Rules: only for tools the agent has no rule for.
-    const { rules: current } = readActauthConfig(agent.name);
-    for (const rule of plan.rules) {
-        if (current.some((r) => r.tool === rule.tool))
-            continue;
-        let name = slugify(`${plan.id}-${rule.tool}`, `${plan.id}-rule`);
-        for (let i = 2; current.some((r) => r.name === name); i++)
-            name = `${slugify(`${plan.id}-${rule.tool}`)}-${i}`;
-        addActauthRule(agent.name, { name, scope: '*/*', tool: rule.tool, decision: rule.decision });
-        current.push({ name, scope: '*/*', tool: rule.tool, decision: rule.decision });
-    }
-    // 2. Abilities it doesn't have yet.
+    // 1. Abilities it doesn't have yet (their rules come with them).
     const installed = [];
     const failed = [...mcp.failed];
     for (const spec of check.toInstall) {
@@ -441,6 +430,10 @@ export async function createWorkflow(input, deps) {
     const connected = copyConnectedTools(plan, agent.name, agents, deps.agentDir);
     installed.push(...connected.copied);
     failed.push(...connected.failed);
+    // 2. Rules, now that what was installed has added its own: none twice,
+    //    a stricter one (ask where an ability allows) placed so it counts,
+    //    and a decision the agent already has never loosened.
+    const ruled = applyPlannedRules(agent.name, plan.rules);
     // 3. Its steps, as a skill; then load the agent again with all of it.
     writeSkill(agent.name, plan.id, { description: plan.skill.description, body: plan.skill.body });
     let loadError;
@@ -477,7 +470,7 @@ export async function createWorkflow(input, deps) {
         newAgent: false,
         workflow: plan.name,
         abilities: { installed, failed },
-        keptDecisions: check.conflicts,
+        keptDecisions: ruled.kept,
         checklist: [...withMissingSteps(plan, agent.name, templateChecklist(template, agent.name, deps, failed, appsToConnect)), ...hook.checklist],
         ...(hook.webhook ? { webhook: hook.webhook } : {}),
         ...(hook.webhookError ? { webhookError: hook.webhookError } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",