metheus-governance-mcp-cli 0.2.70 → 0.2.72

package/README.md

@@ -231,8 +231,9 @@ Behavior:
 - For Telegram, the local env key is auto-generated from the matched server bot name or verified username, so you do not have to invent a separate local nickname first.
 - For Telegram, the CLI tries to match the verified bot identity against the server `me/bots` list first. If the server exposes one logical bot name with multiple roles such as `approval`, `worker`, `review`, and `monitor`, the CLI does not ask you to choose one UUID. It binds by server bot name and keeps the local role/AI fields empty so runtime can use the server bot role for each route.
 - When the Telegram username matches exactly one server bot role, the CLI still auto-fills the local `role_profile` and blank AI defaults from your local `bot-runner.json` `role_profiles` mapping.
-- `bot edit` without flags starts a guided numbered flow: provider -> bot entry -> guided edit -> step-by-step field choices.
-- In guided `bot edit`, changing the bound Telegram responsibility can also auto-fill blank local AI fields from the selected server role and skip redundant role/AI prompts.
+- `bot edit` without flags now uses the same sequential flow every time: provider -> bot entry -> username/token review -> grouped server-role review when needed -> AI field choices -> default choice -> save.
+- if one server bot name maps to multiple server roles, `bot edit` keeps the Telegram env entry bound to the server identity and lets you review the local `role_profiles` for each detected role instead of forcing one role/profile UUID choice up front.
+- In the normal Telegram edit path, the CLI keeps or re-resolves the server bot binding automatically. It no longer asks you to pick `approval / worker / review / monitor` or a server bot UUID first.
 - `bot set-default` without flags starts a guided numbered flow: provider -> bot entry -> confirm default change.
 - `bot verify` without flags starts a guided numbered flow: provider -> bot entry -> output format.
 - `bot remove` without flags starts a guided numbered flow: provider -> bot entry -> confirm removal.

package/cli.mjs

@@ -3362,6 +3362,7 @@ function buildBotCommandDeps() {
     loadProviderEnvConfig,
     verifyLocalProviderToken,
     loadBotRunnerConfig,
+    saveBotRunnerConfig,
     listServerBots: async ({ provider, baseURL, timeoutSeconds }) => {
       const authFlowDeps = buildAuthFlowDeps();
       const resolved = resolveCurrentAccessToken(authFlowDeps);

package/lib/bot-commands.mjs

@@ -147,7 +147,8 @@ function printBotUsage(deps) {
       `  - bot add without flags uses the shortest practical guided flow: provider -> token -> verify -> optional username fallback -> optional default bot.`,
       `  - in the normal Telegram path, bot add does not ask for a local bot key or a server role/profile choice.`,
       `  - server bot name/UUID is the source of truth; local key is auto-derived unless you intentionally override it with --bot-key.`,
-      `  - bot edit without flags asks for provider, existing entry, then a numbered edit flow.`,
+      `  - bot edit without flags asks for provider, existing entry, then walks field-by-field in a numbered flow.`,
+      `  - in the normal Telegram edit path, the CLI keeps or re-resolves the server bot binding automatically instead of asking you to pick a server role/profile UUID first.`,
       `  - bot set-default / bot verify / bot remove also support guided numbered selection when run without flags.`,
       "",
     ].join("\n"),
@@ -594,58 +595,11 @@ function buildDerivedTelegramBotKey(parsedEnv, deps, preferredValues, { excludeK
 
 async function editTelegramBotGuided(ui, parsed, selected, current, flags, deps) {
   let serverRoleAutoResolved = "";
-  const aiFlagOverrides = hasOwnFlag(flags, "client")
-    || hasOwnFlag(flags, "ai-client")
-    || hasOwnFlag(flags, "model")
-    || hasOwnFlag(flags, "ai-model")
-    || hasOwnFlag(flags, "permission-mode")
-    || hasOwnFlag(flags, "ai-permission-mode")
-    || hasOwnFlag(flags, "reasoning-effort")
-    || hasOwnFlag(flags, "ai-reasoning-effort");
-  const bindingAction = await promptKeepChangeClear(ui, "Server bot binding", {
-    allowClear: true,
-    defaultValue: current.serverBotID ? "keep" : "change",
-  });
-  if (bindingAction === "change") {
-    const serverBot = await chooseServerBot(
-      ui,
-      "telegram",
-      flags["base-url"] || deps.defaultSiteURL,
-      intFromRaw(flags["timeout-seconds"], 15) || 15,
-      deps,
-      {
-        preferredUsername: current.username,
-        preferredName: current.username,
-      },
-    );
-    if (serverBot.matchMode === "group") {
-      current.serverBotID = "";
-      current.__preferServerIdentity = true;
-      if (!String(flags["role-profile"] || "").trim()) {
-        current.roleProfile = "";
-      }
-      if (!aiFlagOverrides) {
-        current.client = "";
-        current.model = "";
-        current.permissionMode = "";
-        current.reasoningEffort = "";
-      }
-      serverRoleAutoResolved = "__server_role_group__";
-      process.stdout.write(
-        `Matched server Telegram bot "${serverBot.name || current.username || current.key}" with roles: ${ensureArray(serverBot.roles).join(", ")}. Runtime will use the server role, so local role/AI fields can stay empty.\n`,
-      );
-    } else {
-      current.serverBotID = serverBot.botID;
-      current.__preferServerIdentity = true;
-      if (!current.roleProfile && serverBot.role) {
-        current.roleProfile = serverBot.role;
-      }
-      serverRoleAutoResolved = String(serverBot.role || current.roleProfile || "").trim();
-      applyRoleProfileDefaults(current, resolveRoleProfileDefaults(current.roleProfile || serverBot.role, deps));
-    }
-  } else if (bindingAction === "clear") {
-    current.serverBotID = "";
-    current.__preferServerIdentity = false;
+  let groupedServerRoles = [];
+  let groupedServerName = "";
+  if (current.serverBotID || current.__preferServerIdentity) {
+    current.__preferServerIdentity = true;
+    serverRoleAutoResolved = String(current.roleProfile || "").trim() || "__server_binding__";
   }
 
   const usernameAction = await promptKeepChangeClear(ui, "Telegram username", {
@@ -683,7 +637,35 @@ async function editTelegramBotGuided(ui, parsed, selected, current, flags, deps)
     }
   }
 
-  if (!serverRoleAutoResolved) {
+  if (!current.serverBotID || current.__preferServerIdentity || usernameAction === "change" || tokenAction === "change") {
+    const serverBot = await autoResolveTelegramServerBot(current, flags, deps);
+    if (serverBot.matchMode === "group") {
+      current.serverBotID = "";
+      current.__preferServerIdentity = true;
+      current.roleProfile = "";
+      current.client = "";
+      current.model = "";
+      current.permissionMode = "";
+      current.reasoningEffort = "";
+      serverRoleAutoResolved = "__server_role_group__";
+      groupedServerRoles = preferredRoleSort(serverBot.roles);
+      groupedServerName = String(serverBot.name || current.username || current.key).trim();
+      process.stdout.write(
+        `Using server Telegram bot "${groupedServerName}" with roles: ${groupedServerRoles.join(", ")}. Runtime will use the server role automatically.\n`,
+      );
+    } else if (String(serverBot.botID || "").trim()) {
+      current.serverBotID = String(serverBot.botID || "").trim();
+      current.__preferServerIdentity = true;
+      current.roleProfile = String(serverBot.role || current.roleProfile || "").trim();
+      serverRoleAutoResolved = String(serverBot.role || current.roleProfile || "").trim() || "__server_binding__";
+      applyRoleProfileDefaults(current, resolveRoleProfileDefaults(current.roleProfile || serverBot.role, deps));
+    } else if (current.serverBotID) {
+      current.__preferServerIdentity = true;
+      serverRoleAutoResolved = String(current.roleProfile || "").trim() || "__server_binding__";
+    }
+  }
+
+  if (!current.serverBotID && !current.__preferServerIdentity) {
     const roleAction = await promptKeepChangeClear(ui, "Role profile", {
       allowClear: true,
       defaultValue: current.roleProfile ? "keep" : "change",
@@ -696,7 +678,18 @@ async function editTelegramBotGuided(ui, parsed, selected, current, flags, deps)
     } else if (roleAction === "clear") {
       current.roleProfile = "";
     }
+  }
 
+  if (serverRoleAutoResolved === "__server_role_group__") {
+    await maybePromptGroupedServerRoleProfiles(
+      ui,
+      {
+        name: groupedServerName,
+        roles: groupedServerRoles,
+      },
+      deps,
+    );
+  } else {
     const clientAction = await promptKeepChangeClear(ui, "AI client", {
       allowClear: true,
       defaultValue: current.client ? "keep" : "change",
@@ -747,21 +740,6 @@ async function editTelegramBotGuided(ui, parsed, selected, current, flags, deps)
     }
   }
 
-  const botKeyAction = await promptKeepChangeClear(ui, "Local bot key", {
-    allowClear: false,
-    defaultValue: "keep",
-  });
-  if (botKeyAction === "change") {
-    const normalizeBotKey = requireDependency(deps, "normalizeTelegramBotEnvKey");
-    let nextKey = normalizeBotKey(await promptRequiredLine(ui, "Local bot key", current.key), current.key);
-    const existing = new Set(telegramEntriesForDisplay(parsed, deps).map((entry) => entry.key).filter((key) => key !== current.key));
-    while (existing.has(nextKey)) {
-      process.stdout.write(`Telegram bot key "${nextKey}" already exists.\n`);
-      nextKey = normalizeBotKey(await promptRequiredLine(ui, "Local bot key", `${nextKey}_2`), `${nextKey}_2`);
-    }
-    current.key = nextKey;
-  }
-
   const defaultChoice = await promptChoice(
     ui,
     "Default Telegram bot setting",
@@ -1326,6 +1304,144 @@ function applyRoleProfileDefaults(entry, defaults, { overwrite = false } = {}) {
   }
 }
 
+function preferredRoleSort(roles) {
+  const order = ["monitor", "review", "worker", "approval"];
+  return ensureArray(roles).slice().sort((left, right) => {
+    const leftText = String(left || "").trim();
+    const rightText = String(right || "").trim();
+    const leftIndex = order.indexOf(leftText);
+    const rightIndex = order.indexOf(rightText);
+    if (leftIndex >= 0 && rightIndex >= 0) return leftIndex - rightIndex;
+    if (leftIndex >= 0) return -1;
+    if (rightIndex >= 0) return 1;
+    return leftText.localeCompare(rightText);
+  });
+}
+
+function currentRoleProfileState(roleName, deps) {
+  const normalizedRole = requireDependency(deps, "normalizeRunnerRoleProfileName")(roleName || "");
+  const defaults = resolveRoleProfileDefaults(normalizedRole, deps);
+  const config = requireDependency(deps, "loadBotRunnerConfig")({ persistIfNeeded: true });
+  const profile = safeObject(safeObject(config.roleProfiles || {})[normalizedRole]);
+  return {
+    role: normalizedRole,
+    client: requireDependency(deps, "normalizeLocalAIClientName")(profile.client || defaults.client || "", ""),
+    model: String(profile.model || defaults.model || "").trim(),
+    permissionMode: requireDependency(deps, "normalizeLocalAIPermissionMode")(
+      profile.permission_mode || profile.permissionMode || defaults.permissionMode || "",
+      "",
+    ),
+    reasoningEffort: requireDependency(deps, "normalizeLocalAIReasoningEffort")(
+      profile.reasoning_effort || profile.reasoningEffort || defaults.reasoningEffort || "",
+      "",
+    ),
+  };
+}
+
+function formatRoleProfileSummary(profile) {
+  const current = safeObject(profile);
+  return [
+    current.client ? `client:${current.client}` : "client:(blank)",
+    current.model ? `model:${current.model}` : "model:(blank)",
+    current.permissionMode ? `permission:${current.permissionMode}` : "permission:(blank)",
+    current.reasoningEffort ? `reasoning:${current.reasoningEffort}` : "reasoning:(blank)",
+  ].join(" | ");
+}
+
+function persistRoleProfileState(profile, deps) {
+  const current = safeObject(profile);
+  const role = requireDependency(deps, "normalizeRunnerRoleProfileName")(current.role || "");
+  if (!role) return null;
+  const config = requireDependency(deps, "loadBotRunnerConfig")({ persistIfNeeded: true });
+  const nextRoleProfiles = {
+    ...safeObject(config.roleProfiles || {}),
+    [role]: {
+      client: String(current.client || "").trim(),
+      model: String(current.model || "").trim(),
+      permission_mode: String(current.permissionMode || "").trim(),
+      reasoning_effort: String(current.reasoningEffort || "").trim(),
+    },
+  };
+  const nextConfig = {
+    ...config,
+    roleProfiles: nextRoleProfiles,
+  };
+  return requireDependency(deps, "saveBotRunnerConfig")(nextConfig, config.filePath);
+}
+
+async function promptRoleExecutionProfile(ui, roleName, deps) {
+  const current = currentRoleProfileState(roleName, deps);
+  const action = await promptChoice(
+    ui,
+    `Role "${current.role}" local execution profile`,
+    [
+      {
+        value: "keep",
+        label: "Keep current settings",
+        description: formatRoleProfileSummary(current),
+      },
+      {
+        value: "edit",
+        label: "Edit settings",
+        description: "change AI client, model, permission, and reasoning",
+      },
+    ],
+    { defaultIndex: 0 },
+  );
+  if (action?.value !== "edit") {
+    return { changed: false, filePath: "" };
+  }
+  current.client = requireDependency(deps, "normalizeLocalAIClientName")(
+    await promptAIClient(ui, deps, current.client),
+    "",
+  );
+  current.model = await promptLine(ui, `AI model for role "${current.role}"`, current.model);
+  current.permissionMode = requireDependency(deps, "normalizeLocalAIPermissionMode")(
+    await promptPermissionMode(ui, current.permissionMode),
+    "",
+  );
+  current.reasoningEffort = requireDependency(deps, "normalizeLocalAIReasoningEffort")(
+    await promptReasoningEffort(ui, current.reasoningEffort),
+    "",
+  );
+  const filePath = persistRoleProfileState(current, deps);
+  if (filePath) {
+    process.stdout.write(`Saved local execution profile for role "${current.role}" to ${filePath}\n`);
+  }
+  return { changed: true, filePath };
+}
+
+async function maybePromptGroupedServerRoleProfiles(ui, serverBot, deps) {
+  const roles = preferredRoleSort(ensureArray(serverBot?.roles).filter(Boolean));
+  if (roles.length <= 1) {
+    return false;
+  }
+  const editChoice = await promptChoice(
+    ui,
+    `Server bot "${String(serverBot?.name || "").trim() || "telegram"}" uses multiple roles. What should happen to the local execution settings?`,
+    [
+      {
+        value: "keep",
+        label: "Keep current role settings",
+        description: "use the existing role_profiles defaults as-is",
+      },
+      {
+        value: "review",
+        label: "Review role settings",
+        description: "check each role and change AI client/model/permission/reasoning when needed",
+      },
+    ],
+    { defaultIndex: 0 },
+  );
+  if (editChoice?.value !== "review") {
+    return false;
+  }
+  for (const role of roles) {
+    await promptRoleExecutionProfile(ui, role, deps);
+  }
+  return true;
+}
+
 function buildTemporaryTelegramEnvConfig({ token, apiBaseURL }) {
   return {
     ok: true,
@@ -1339,6 +1455,46 @@ async function verifyTelegramTokenCandidate(provider, token, apiBaseURL, timeout
   return verifier(provider, buildTemporaryTelegramEnvConfig({ token, apiBaseURL }), timeoutSeconds);
 }
 
+async function autoResolveTelegramServerBot(current, flags, deps) {
+  const existingBotID = String(current?.serverBotID || "").trim();
+  const preferredIdentity = firstNonEmptyString([
+    current?.username,
+    current?.key,
+  ]);
+  if (!preferredIdentity) {
+    return {
+      botID: existingBotID,
+      role: String(current?.roleProfile || "").trim(),
+      name: "",
+      roles: [],
+      matchMode: existingBotID ? "existing" : "blank",
+    };
+  }
+  try {
+    return await resolveServerBotForNonInteractive(
+      "telegram",
+      {
+        "bot-name": preferredIdentity,
+        "base-url": flags["base-url"] || deps.defaultSiteURL,
+        "timeout-seconds": intFromRaw(flags["timeout-seconds"], 15) || 15,
+      },
+      deps,
+      {
+        preferredUsername: preferredIdentity,
+        preferredName: preferredIdentity,
+      },
+    );
+  } catch {
+    return {
+      botID: existingBotID,
+      role: String(current?.roleProfile || "").trim(),
+      name: "",
+      roles: [],
+      matchMode: existingBotID ? "existing" : "blank",
+    };
+  }
+}
+
 async function addTelegramBot(ui, flags, deps) {
   const state = loadProviderEnvState("telegram", deps);
   const parsed = { ...state.parsed };
@@ -1624,122 +1780,7 @@ async function editTelegramBot(ui, flags, deps) {
     saveTelegramBotEdit(parsed, selected, current, deps);
     return;
   }
-  const editMode = await promptChoice(
-    ui,
-    `How do you want to edit Telegram bot "${current.key}"?`,
-    [
-      { value: "guided", label: "Guided edit (Recommended)", description: "Step-by-step prompts with numbered choices" },
-      { value: "field_menu", label: "Field menu", description: "Choose one field at a time until save" },
-    ],
-    { defaultIndex: 0 },
-  );
-  if (editMode?.value === "guided") {
-    await editTelegramBotGuided(ui, parsed, selected, current, flags, deps);
-    return;
-  }
-  while (true) {
-    const choice = await promptChoice(
-      ui,
-      `Edit Telegram bot "${current.key}"`,
-      [
-        { value: "server_bot_id", label: "Server bot UUID", description: current.serverBotID || "-" },
-        { value: "username", label: "Telegram username", description: current.username ? `@${current.username}` : "-" },
-        { value: "token", label: "Telegram token", description: current.token ? maskSecret(current.token) : "-" },
-        { value: "role_profile", label: "Role profile", description: current.roleProfile || "-" },
-        { value: "client", label: "AI client", description: current.client || "-" },
-        { value: "model", label: "AI model", description: current.model || "-" },
-        { value: "permission", label: "AI permission mode", description: current.permissionMode || "-" },
-        { value: "reasoning", label: "AI reasoning effort", description: current.reasoningEffort || "-" },
-        { value: "bot_key", label: "Local bot key", description: current.key },
-        { value: "set_default", label: "Set as default bot", description: boolFromRaw(flags.default, false) || String(parsed.TELEGRAM_DEFAULT_BOT_KEY || "").trim() === current.key ? "yes" : "no" },
-        { value: "save", label: "Save changes" },
-      ],
-      { defaultIndex: 0 },
-    );
-    if (!choice) return;
-    if (choice.value === "save") {
-      saveTelegramBotEdit(parsed, selected, current, deps);
-      return;
-    }
-    if (choice.value === "server_bot_id") {
-      const serverBot = await chooseServerBot(
-        ui,
-        "telegram",
-        flags["base-url"] || deps.defaultSiteURL,
-        intFromRaw(flags["timeout-seconds"], 15) || 15,
-        deps,
-        {
-          preferredUsername: current.username,
-          preferredName: current.username,
-        },
-      );
-      if (serverBot.matchMode === "group") {
-        current.serverBotID = "";
-        process.stdout.write(
-          `Matched server Telegram bot "${serverBot.name || current.username || current.key}" with roles: ${ensureArray(serverBot.roles).join(", ")}. Keep role/AI fields empty if you want runtime role-based resolution.\n`,
-        );
-      } else {
-        current.serverBotID = serverBot.botID;
-        if (!current.roleProfile && serverBot.role) {
-          current.roleProfile = serverBot.role;
-        }
-      }
-    } else if (choice.value === "username") {
-      current.username = requireDependency(deps, "normalizeTelegramBotUsername")(
-        await promptLine(ui, "Telegram username (without @)", current.username),
-        "",
-      );
-    } else if (choice.value === "token") {
-      current.token = await promptRequiredLine(ui, "Telegram bot token", current.token);
-      if (await promptYesNo(ui, "Verify updated token now?", true)) {
-        const verifyResult = await verifyTelegramTokenCandidate(
-          "telegram",
-          current.token,
-          String(parsed.TELEGRAM_API_BASE_URL || "").trim(),
-          intFromRaw(flags["timeout-seconds"], 15) || 15,
-          deps,
-        );
-        process.stdout.write(`Verify: ${verifyResult.ok ? "OK" : "FAIL"}${verifyResult.detail ? ` - ${verifyResult.detail}` : ""}\n`);
-        const maybeUsername = extractVerifiedTelegramUsername(verifyResult.detail);
-        if (verifyResult.ok && maybeUsername && !current.username) {
-          current.username = maybeUsername;
-        }
-      }
-    } else if (choice.value === "role_profile") {
-      current.roleProfile = requireDependency(deps, "normalizeRunnerRoleProfileName")(
-        await promptTelegramRoleProfile(ui, deps, current.roleProfile),
-      );
-    } else if (choice.value === "client") {
-      current.client = requireDependency(deps, "normalizeLocalAIClientName")(
-        await promptAIClient(ui, deps, current.client),
-        "",
-      );
-    } else if (choice.value === "model") {
-      current.model = await promptLine(ui, "AI model", current.model);
-    } else if (choice.value === "permission") {
-      current.permissionMode = requireDependency(deps, "normalizeLocalAIPermissionMode")(
-        await promptPermissionMode(ui, current.permissionMode),
-        "",
-      );
-    } else if (choice.value === "reasoning") {
-      current.reasoningEffort = requireDependency(deps, "normalizeLocalAIReasoningEffort")(
-        await promptReasoningEffort(ui, current.reasoningEffort),
-        "",
-      );
-    } else if (choice.value === "bot_key") {
-      const normalizeBotKey = requireDependency(deps, "normalizeTelegramBotEnvKey");
-      let nextKey = normalizeBotKey(await promptRequiredLine(ui, "Local bot key", current.key), current.key);
-      const existing = new Set(telegramEntriesForDisplay(parsed, deps).map((entry) => entry.key).filter((key) => key !== current.key));
-      while (existing.has(nextKey)) {
-        process.stdout.write(`Telegram bot key "${nextKey}" already exists.\n`);
-        nextKey = normalizeBotKey(await promptRequiredLine(ui, "Local bot key", `${nextKey}_2`), `${nextKey}_2`);
-      }
-      current.key = nextKey;
-    } else if (choice.value === "set_default") {
-      parsed.TELEGRAM_DEFAULT_BOT_KEY = current.key;
-      process.stdout.write(`Default Telegram bot will be "${current.key}".\n`);
-    }
-  }
+  await editTelegramBotGuided(ui, parsed, selected, current, flags, deps);
 }
 
 async function removeTelegramBot(ui, deps) {

package/lib/selftest-bot-commands.mjs

@@ -341,6 +341,51 @@ export async function runSelftestBotCommands(push, deps) {
           && String(groupedState.TELEGRAM_BOT_RYOAI_BOT_AI_PERMISSION_MODE || "") === "",
         `username=${String(groupedState.TELEGRAM_BOT_RYOAI_BOT_USERNAME || "")} server_bot_id=${String(groupedState.TELEGRAM_BOT_RYOAI_BOT_SERVER_BOT_ID || "")} role=${String(groupedState.TELEGRAM_BOT_RYOAI_BOT_ROLE_PROFILE || "")}`,
       );
+
+      await runCLI({
+        cliPath,
+        args: [
+          "bot", "edit",
+          "--base-url", `http://127.0.0.1:${groupedMock.port}`,
+          "--timeout-seconds", "5",
+        ],
+        env: {
+          ...env,
+          METHEUS_SCRIPTED_PROMPT_ANSWERS: JSON.stringify([
+            "1", // provider: telegram
+            "2", // bot entry: ryoai_bot
+            "1", // keep username
+            "1", // keep token
+            "2", // review grouped server role settings
+            "1", // monitor: keep current role profile settings
+            "1", // review: keep current role profile settings
+            "2", // worker: edit settings
+            "3", // worker AI client: claude
+            "worker-sonnet-4",
+            "4", // worker permission: danger_full_access
+            "4", // worker reasoning: high
+            "2", // approval: edit settings
+            "4", // approval AI client: gemini
+            "approval-pro-2",
+            "4", // approval permission: danger_full_access
+            "4", // approval reasoning: high
+            "1", // keep current default setting
+            "y", // save
+          ]),
+        },
+      });
+      const groupedRunnerConfigPath = path.join(tempHome, ".metheus", "bot-runner.json");
+      const groupedRunnerConfig = readJSON(fs.readFileSync(groupedRunnerConfigPath, "utf8"));
+      push(
+        "bot_edit_grouped_server_roles_updates_role_profiles",
+        String(safeObject(safeObject(groupedRunnerConfig.role_profiles || {}).worker).client || "") === "claude"
+          && String(safeObject(safeObject(groupedRunnerConfig.role_profiles || {}).worker).model || "") === "worker-sonnet-4"
+          && String(safeObject(safeObject(groupedRunnerConfig.role_profiles || {}).worker).permission_mode || "") === "danger_full_access"
+          && String(safeObject(safeObject(groupedRunnerConfig.role_profiles || {}).worker).reasoning_effort || "") === "high"
+          && String(safeObject(safeObject(groupedRunnerConfig.role_profiles || {}).approval).client || "") === "gemini"
+          && String(safeObject(safeObject(groupedRunnerConfig.role_profiles || {}).approval).model || "") === "approval-pro-2",
+        `worker=${JSON.stringify(safeObject(safeObject(groupedRunnerConfig.role_profiles || {}).worker))} approval=${JSON.stringify(safeObject(safeObject(groupedRunnerConfig.role_profiles || {}).approval))}`,
+      );
     } finally {
       await groupedMock.close();
       await runCLI({
@@ -381,11 +426,8 @@ export async function runSelftestBotCommands(push, deps) {
         METHEUS_SCRIPTED_PROMPT_ANSWERS: JSON.stringify([
         "1", // provider: telegram
         "1", // bot entry: @monitorselftestbot
-        "1", // edit mode: guided
-        "1", // keep server bot binding
         "1", // keep username
         "1", // keep token
-        "1", // keep role profile
         "2", // change AI client
         "4", // gemini
         "2", // change AI model

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "metheus-governance-mcp-cli",
-  "version": "0.2.70",
+  "version": "0.2.72",
   "description": "Metheus Governance MCP CLI (setup + stdio proxy)",
   "type": "module",
   "files": [