obol-ai 0.2.25 → 0.2.26

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.2.26
+- show cleaning status instead of processing during /clean
+- fix ask deadlock, clean writes tests and audits secrets
+- clean confirmation gate, exec sandbox fix, mermaid tool, scheduler always-on
+
 ## 0.2.25
 - changelog
 - add npmignore to exclude local files from package

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "obol-ai",
-  "version": "0.2.25",
+  "version": "0.2.26",
   "description": "Self-evolving AI assistant that learns, remembers, and acts on its own. Persistent vector memory, self-rewriting personality, proactive heartbeats.",
   "main": "src/index.js",
   "bin": {

package/src/background.js

@@ -8,7 +8,7 @@ class BackgroundRunner {
     this.taskCounter = 0;
   }
 
-  spawn(claude, task, ctx, memory, parentContext) {
+  spawn(claude, task, ctx, memory, parentContext, opts = {}) {
     let running = 0;
     for (const t of this.tasks.values()) {
       if (t.status === 'running') running++;
@@ -30,13 +30,13 @@ class BackgroundRunner {
     const verbose = parentContext?.verbose || false;
     const verboseNotify = parentContext?._verboseNotify;
 
-    const promise = this._runTask(claude, task, taskState, ctx, memory, verbose, verboseNotify);
+    const promise = this._runTask(claude, task, taskState, ctx, memory, verbose, verboseNotify, opts.model);
     taskState.promise = promise;
 
     return taskId;
   }
 
-  async _runTask(claude, task, taskState, ctx, memory, verbose, verboseNotify) {
+  async _runTask(claude, task, taskState, ctx, memory, verbose, verboseNotify, model) {
     let statusMsgId = null;
     let statusTimer = null;
     let statusStart = Date.now();
@@ -76,6 +76,7 @@ TASK: ${task}`;
         chatId: `bg-${taskState.id}`,
         userName: 'BackgroundTask',
         verbose,
+        ...(model ? { _model: model } : {}),
         _verboseNotify: bgNotify,
         _onRouteDecision: (info) => {
           routeInfo = info;

package/src/claude/constants.js

@@ -24,16 +24,16 @@ const OPTIONAL_TOOLS = {
     tools: ['vercel_deploy', 'vercel_list'],
     config: {},
   },
-  scheduler: {
-    label: 'Scheduler',
-    tools: ['schedule_event', 'list_events', 'cancel_event'],
-    config: {},
-  },
   background: {
     label: 'Background Tasks',
     tools: ['background_task'],
     config: {},
   },
+  mermaid: {
+    label: 'Flowchart',
+    tools: ['mermaid_chart'],
+    config: {},
+  },
 };
 
 const BLOCKED_EXEC_PATTERNS = [

package/src/claude/prompt.js

@@ -56,7 +56,7 @@ ${workDir}/
 ├── scripts/        (utility scripts)
 ├── tests/          (test suite)
 ├── commands/       (command definitions)
-├── apps/           (web apps for Vercel)
+├── apps/           (git repos and web apps — any structure)
 ├── assets/         (uploaded files, images, media)
 └── logs/
 \`\`\`
@@ -177,6 +177,12 @@ Convert text to voice messages. Use when the user wants something read aloud.
 - \`text_to_speech\` — synthesize text and send as voice message. Voice defaults to user preference.
 - \`tts_voices\` — list available voices, filterable by language and gender
 
+### Flowchart / Diagram (\`mermaid_chart\`)
+Generate diagrams and send them as images. Supports flowcharts, sequence diagrams, ER diagrams, Gantt charts, pie charts, etc.
+- \`definition\` — Mermaid syntax (e.g. \`graph TD; A-->B\`)
+- \`theme\` — default / dark / forest / neutral
+- \`caption\` — optional caption on the image
+
 ### Bridge (\`bridge_ask\`, \`bridge_tell\`)
 Only available if bridge is enabled. Communicate with partner's AI agent.
 `);

package/src/claude/tool-registry.js

@@ -14,6 +14,7 @@ const bridgeTool = require('./tools/bridge');
 const historyTool = require('./tools/history');
 const agentTool = require('./tools/agent');
 const sttTool = require('./tools/stt');
+const mermaidTool = require('./tools/mermaid');
 
 const TOOL_MODULES = [
   execTool,
@@ -28,6 +29,7 @@ const TOOL_MODULES = [
   historyTool,
   agentTool,
   sttTool,
+  mermaidTool,
 ];
 
 const INPUT_SUMMARIES = {

package/src/claude/tools/exec.js

@@ -1,3 +1,4 @@
+const path = require('path');
 const { MAX_EXEC_TIMEOUT, BLOCKED_EXEC_PATTERNS } = require('../constants');
 const { execAsync } = require('../../sanitize');
 
@@ -20,6 +21,17 @@ function extractAbsolutePaths(command) {
   return [...paths];
 }
 
+/** Extract and resolve relative traversal paths (e.g. ../../etc) against userDir */
+function extractTraversalPaths(command, userDir) {
+  const re = /(?:^|[\s=|&;<>('"])(\.\.[\w.\-/]*)/g;
+  const paths = [];
+  let m;
+  while ((m = re.exec(command)) !== null) {
+    paths.push(path.resolve(userDir, m[1]));
+  }
+  return paths;
+}
+
 /** Returns true if path is within userDir or a safe system prefix */
 function isAllowedPath(p, userDir) {
   if (p === userDir || p.startsWith(userDir + '/')) return true;
@@ -48,9 +60,12 @@ const handlers = {
       }
     }
     if (userDir) {
-      const blockedPaths = extractAbsolutePaths(input.command).filter(p => !isAllowedPath(p, userDir));
-      if (blockedPaths.length > 0) {
-        return `Blocked: command accesses path(s) outside your workspace: ${blockedPaths.join(', ')}`;
+      const blocked = [
+        ...extractAbsolutePaths(input.command).filter(p => !isAllowedPath(p, userDir)),
+        ...extractTraversalPaths(input.command, userDir).filter(p => !isAllowedPath(p, userDir)),
+      ];
+      if (blocked.length > 0) {
+        return `Blocked: command accesses path(s) outside your workspace: ${blocked.join(', ')}. Your workspace is ${userDir} — all file operations must stay within it.`;
       }
     }
     const timeout = Math.min(input.timeout || 30, MAX_EXEC_TIMEOUT) * 1000;

package/src/claude/tools/mermaid.js

@@ -0,0 +1,68 @@
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+
+const definitions = [
+  {
+    name: 'mermaid_chart',
+    description: 'Generate a diagram from a Mermaid definition and send it as an image to the chat. Supports flowcharts, sequence diagrams, ER diagrams, Gantt charts, etc.',
+    input_schema: {
+      type: 'object',
+      properties: {
+        definition: { type: 'string', description: 'Mermaid diagram definition (e.g. "graph TD; A-->B")' },
+        caption: { type: 'string', description: 'Optional caption for the image' },
+        theme: { type: 'string', enum: ['default', 'dark', 'forest', 'neutral'], description: 'Chart theme (default: default)' },
+      },
+      required: ['definition'],
+    },
+  },
+];
+
+/** @param {string} url @returns {Promise<Buffer>} */
+function fetchBuffer(url) {
+  return new Promise((resolve, reject) => {
+    https.get(url, (res) => {
+      if (res.statusCode !== 200) return reject(new Error(`HTTP ${res.statusCode}`));
+      const chunks = [];
+      res.on('data', c => chunks.push(c));
+      res.on('end', () => resolve(Buffer.concat(chunks)));
+      res.on('error', reject);
+    }).on('error', reject);
+  });
+}
+
+const handlers = {
+  async mermaid_chart(input, memory, context) {
+    const telegramCtx = context.ctx;
+    if (!telegramCtx) return 'Cannot send charts in this context.';
+
+    const theme = input.theme || 'default';
+    const payload = JSON.stringify({ code: input.definition, mermaid: { theme } });
+    const encoded = Buffer.from(payload).toString('base64url');
+    const url = `https://mermaid.ink/img/${encoded}`;
+
+    let imgBuffer;
+    try {
+      imgBuffer = await fetchBuffer(url);
+    } catch (e) {
+      return `Failed to render chart: ${e.message}`;
+    }
+
+    const tmpPath = path.join('/tmp', `mermaid-${Date.now()}.png`);
+    fs.writeFileSync(tmpPath, imgBuffer);
+
+    try {
+      const { InputFile } = require('grammy');
+      await telegramCtx.replyWithPhoto(new InputFile(tmpPath), {
+        caption: input.caption || undefined,
+      });
+      return 'Chart sent.';
+    } catch (e) {
+      return `Failed to send chart: ${e.message}`;
+    } finally {
+      fs.unlink(tmpPath, () => {});
+    }
+  },
+};
+
+module.exports = { definitions, handlers };

package/src/clean.js

@@ -2,27 +2,23 @@ const fs = require('fs');
 const path = require('path');
 const { OBOL_DIR } = require('./config');
 
-const ALLOWED_DIRS = new Set(['personality', 'scripts', 'tests', 'commands', 'apps', 'logs', 'assets']);
-const ALLOWED_FILES = new Set([
+const ALLOWED_DIRS = new Set(['personality', 'scripts', 'tests', 'commands', 'apps', 'logs', 'assets', 'library']);
+const ALLOWED_ROOT_FILES = new Set([
   'config.json',
+  'secrets.json',
   '.evolution-state.json',
   '.first-run-done',
   '.post-setup-done',
 ]);
-const ALLOWED_PATTERNS = [/^\./];
 
-const FILE_RULES = {
-  '.js': 'scripts',
-  '.sh': 'scripts',
-  '.md': 'commands',
-};
+// Extensions that belong in scripts/
+const SCRIPT_EXTS = new Set(['.js', '.ts', '.sh', '.py', '.rb', '.php', '.go', '.rs', '.pl', '.lua']);
+// Extensions that belong in assets/
+const ASSET_EXTS = new Set(['.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg', '.mp4', '.mp3', '.wav', '.pdf', '.zip']);
 
-const DIR_FILE_RULES = {
-  personality: ['.md'],
-  scripts: ['.js', '.sh'],
-  tests: ['.js', '.sh'],
-  commands: ['.md'],
-};
+// Dirs where only .md files are allowed (with per-dir exceptions)
+const MD_ONLY_DIRS = new Set(['personality', 'commands']);
+const MD_DIR_EXCEPTIONS = { personality: new Set(['traits.json']) };
 
 function safeReaddir(dir) {
   try {
@@ -36,252 +32,149 @@ function safeReaddirAll(dir) {
   try { return fs.readdirSync(dir); } catch { return []; }
 }
 
+/** @param {string} filename @returns {string|null} */
 function guessDestination(filename) {
-  const ext = path.extname(filename);
-  if (filename.startsWith('test-') || filename.startsWith('test_')) return 'tests';
-  return FILE_RULES[ext] || null;
+  const ext = path.extname(filename).toLowerCase();
+  const base = path.basename(filename, ext).toLowerCase();
+  if (base.startsWith('test-') || base.startsWith('test_') || base.endsWith('.test') || base.endsWith('.spec')) return 'tests';
+  if (SCRIPT_EXTS.has(ext)) return 'scripts';
+  if (ASSET_EXTS.has(ext)) return 'assets';
+  if (ext === '.md') return 'commands';
+  if (ext === '.log') return 'logs';
+  return null;
 }
 
 /**
  * @param {string} userDir
- * @returns {Array<{type: string, name: string, children?: string[], currentDir?: string}>}
+ * @returns {Array<{type: string, name: string, dest?: string, children?: string[], currentDir?: string}>}
  */
 function scanWorkspace(userDir) {
-  const rogueItems = [];
-  if (!fs.existsSync(userDir)) return rogueItems;
+  const issues = [];
+  if (!fs.existsSync(userDir)) return issues;
 
   const entries = fs.readdirSync(userDir, { withFileTypes: true });
 
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (!ALLOWED_DIRS.has(entry.name) && !entry.name.startsWith('.')) {
-        rogueItems.push({ type: 'dir', name: entry.name, children: safeReaddirAll(path.join(userDir, entry.name)) });
+        // Unknown root dir — move to apps/ (likely a project/repo)
+        issues.push({ type: 'dir', name: entry.name, dest: 'apps', children: safeReaddirAll(path.join(userDir, entry.name)) });
       }
     } else if (entry.isFile()) {
-      if (!ALLOWED_FILES.has(entry.name) && !ALLOWED_PATTERNS.some(p => p.test(entry.name))) {
-        rogueItems.push({ type: 'file', name: entry.name });
+      if (!ALLOWED_ROOT_FILES.has(entry.name) && !entry.name.startsWith('.')) {
+        const dest = guessDestination(entry.name);
+        issues.push({ type: 'file', name: entry.name, dest });
       }
     }
   }
 
-  for (const [dir, allowedExts] of Object.entries(DIR_FILE_RULES)) {
+  // Check md-only dirs for non-.md files
+  for (const dir of MD_ONLY_DIRS) {
     const dirPath = path.join(userDir, dir);
     if (!fs.existsSync(dirPath)) continue;
     for (const file of safeReaddir(dirPath)) {
-      const ext = path.extname(file);
-      if (ext && !allowedExts.includes(ext)) {
-        rogueItems.push({ type: 'misplaced', name: file, currentDir: dir });
-      }
-    }
-  }
-
-  return rogueItems;
-}
-
-/**
- * @param {Array} rogueItems
- * @param {object} claudeClient - Anthropic client instance
- * @returns {Promise<Array<{path: string, action: string, dest?: string}>|null>}
- */
-async function resolveWithLlm(rogueItems, claudeClient) {
-  const itemList = rogueItems.map(item => {
-    if (item.type === 'dir') {
-      return `- Directory "${item.name}/" containing: ${item.children.length ? item.children.join(', ') : '(empty)'}`;
-    }
-    if (item.type === 'misplaced') {
-      return `- File "${item.currentDir}/${item.name}" (wrong location for its type)`;
-    }
-    return `- File "${item.name}" at root level`;
-  }).join('\n');
-
-  const prompt = `You are organizing a workspace directory. The valid structure is:
-- personality/ — .md files (soul, personality config)
-- scripts/ — .js and .sh scripts
-- tests/ — test files (test-*.js, test_*.js, *.test.js)
-- commands/ — .md command definitions
-- apps/ — application subdirectories
-- logs/ — log files
-- assets/ — media and binary assets
-
-These items don't belong in their current location:
-${itemList}
-
-For each item, decide: "move" to a valid directory, or "delete" if truly rogue/irrelevant.
-Respond ONLY with a JSON array, no explanation:
-[{"path":"item-name","action":"move|delete","dest":"destination-dir"}]
-For directories use "dirname/", for misplaced files use "currentDir/filename".`;
-
-  const response = await claudeClient.messages.create({
-    model: 'claude-haiku-4-5-20251001',
-    max_tokens: 1024,
-    messages: [{ role: 'user', content: prompt }],
-  });
-
-  const text = response.content[0]?.text || '[]';
-  const match = text.match(/\[[\s\S]*\]/);
-  if (!match) return null;
-  try {
-    return JSON.parse(match[0]);
-  } catch {
-    return null;
-  }
-}
-
-/**
- * @param {string} userDir
- * @param {Array} rogueItems
- * @param {Array} decisions
- * @returns {{issues: Array, errors: Array}}
- */
-function applyDecisions(userDir, rogueItems, decisions) {
-  const issues = [];
-  const errors = [];
-
-  for (const decision of decisions) {
-    const item = rogueItems.find(r => {
-      if (r.type === 'dir') return decision.path === r.name + '/';
-      if (r.type === 'misplaced') return decision.path === `${r.currentDir}/${r.name}`;
-      return decision.path === r.name;
-    });
-    if (!item) continue;
-
-    const srcPath = item.type === 'misplaced'
-      ? path.join(userDir, item.currentDir, item.name)
-      : path.join(userDir, item.name);
-
-    if (decision.action === 'delete') {
-      try {
-        fs.rmSync(srcPath, { recursive: true, force: true });
-        issues.push({ path: decision.path, action: 'deleted' });
-      } catch (e) {
-        errors.push(`Failed to delete ${decision.path}: ${e.message}`);
-      }
-    } else if (decision.action === 'move' && decision.dest) {
-      const destDir = path.join(userDir, decision.dest);
-      const destPath = path.join(destDir, item.name);
-      try {
-        fs.mkdirSync(destDir, { recursive: true });
-        fs.renameSync(srcPath, destPath);
-        issues.push({ path: decision.path, action: `moved → ${decision.dest}/${item.name}` });
-      } catch (e) {
-        errors.push(`Failed to move ${decision.path}: ${e.message}`);
+      if (file.startsWith('.')) continue;
+      if (path.extname(file).toLowerCase() !== '.md' && !MD_DIR_EXCEPTIONS[dir]?.has(file)) {
+        const dest = guessDestination(file);
+        issues.push({ type: 'misplaced', name: file, currentDir: dir, dest });
       }
     }
   }
 
-  return { issues, errors };
+  return issues;
 }
 
 /**
- * @param {string} userDir
- * @param {Array} rogueItems
+ * @param {string} baseDir
+ * @param {Array} issues
  * @returns {{issues: Array, errors: Array}}
  */
-function applyHeuristics(userDir, rogueItems) {
-  const issues = [];
+function applyIssues(baseDir, issues) {
+  const applied = [];
   const errors = [];
 
-  for (const item of rogueItems) {
+  for (const item of issues) {
     if (item.type === 'dir') {
-      const fullPath = path.join(userDir, item.name);
-      const files = safeReaddir(fullPath);
-
+      const src = path.join(baseDir, item.name);
       if (item.children.length === 0) {
         try {
-          fs.rmSync(fullPath, { recursive: true, force: true });
-          issues.push({ path: item.name + '/', action: 'deleted (empty rogue dir)' });
+          fs.rmSync(src, { recursive: true, force: true });
+          applied.push({ path: item.name + '/', action: 'deleted (empty dir)' });
         } catch (e) {
-          errors.push(`Failed to remove ${item.name}/: ${e.message}`);
+          errors.push(`Failed to delete ${item.name}/: ${e.message}`);
         }
       } else {
-        for (const file of files) {
-          const dest = guessDestination(file);
-          if (dest) {
-            try {
-              const destPath = path.join(userDir, dest, file);
-              fs.mkdirSync(path.join(userDir, dest), { recursive: true });
-              fs.renameSync(path.join(fullPath, file), destPath);
-              issues.push({ path: `${item.name}/${file}`, action: `moved → ${dest}/${file}` });
-            } catch (e) {
-              errors.push(`Failed to move ${item.name}/${file}: ${e.message}`);
-            }
-          } else {
-            try {
-              fs.unlinkSync(path.join(fullPath, file));
-              issues.push({ path: `${item.name}/${file}`, action: 'deleted (unknown type)' });
-            } catch (e) {
-              errors.push(`Failed to delete ${item.name}/${file}: ${e.message}`);
-            }
-          }
-        }
+        const dest = path.join(baseDir, 'apps', item.name);
         try {
-          fs.rmSync(fullPath, { recursive: true, force: true });
-          issues.push({ path: item.name + '/', action: 'deleted (rogue dir cleared)' });
-        } catch {}
+          fs.mkdirSync(path.join(baseDir, 'apps'), { recursive: true });
+          fs.renameSync(src, dest);
+          applied.push({ path: item.name + '/', action: `moved → apps/${item.name}/` });
+        } catch (e) {
+          errors.push(`Failed to move ${item.name}/: ${e.message}`);
+        }
       }
     } else if (item.type === 'file') {
-      const dest = guessDestination(item.name);
-      const fullPath = path.join(userDir, item.name);
-      if (dest) {
+      const src = path.join(baseDir, item.name);
+      if (item.dest) {
+        const destDir = path.join(baseDir, item.dest);
         try {
-          const destPath = path.join(userDir, dest, item.name);
-          fs.mkdirSync(path.join(userDir, dest), { recursive: true });
-          fs.renameSync(fullPath, destPath);
-          issues.push({ path: item.name, action: `moved → ${dest}/${item.name}` });
+          fs.mkdirSync(destDir, { recursive: true });
+          fs.renameSync(src, path.join(destDir, item.name));
+          applied.push({ path: item.name, action: `moved → ${item.dest}/${item.name}` });
         } catch (e) {
           errors.push(`Failed to move ${item.name}: ${e.message}`);
         }
       } else {
-        try {
-          fs.unlinkSync(fullPath);
-          issues.push({ path: item.name, action: 'deleted (unknown file at root)' });
-        } catch (e) {
-          errors.push(`Failed to delete ${item.name}: ${e.message}`);
-        }
+        errors.push(`Don't know where to put ${item.name} — move it manually`);
       }
     } else if (item.type === 'misplaced') {
-      const dest = guessDestination(item.name);
-      if (dest && dest !== item.currentDir) {
-        const src = path.join(userDir, item.currentDir, item.name);
+      const src = path.join(baseDir, item.currentDir, item.name);
+      if (item.dest && item.dest !== item.currentDir) {
+        const destDir = path.join(baseDir, item.dest);
         try {
-          const destPath = path.join(userDir, dest, item.name);
-          fs.mkdirSync(path.join(userDir, dest), { recursive: true });
-          fs.renameSync(src, destPath);
-          issues.push({ path: `${item.currentDir}/${item.name}`, action: `moved → ${dest}/${item.name}` });
+          fs.mkdirSync(destDir, { recursive: true });
+          fs.renameSync(src, path.join(destDir, item.name));
+          applied.push({ path: `${item.currentDir}/${item.name}`, action: `moved → ${item.dest}/${item.name}` });
         } catch (e) {
           errors.push(`Failed to move ${item.currentDir}/${item.name}: ${e.message}`);
         }
+      } else {
+        errors.push(`Don't know where to put ${item.currentDir}/${item.name} — move it manually`);
       }
     }
   }
 
-  return { issues, errors };
+  return { issues: applied, errors };
 }
 
 /**
  * @param {string} userDir
- * @param {object|null} claudeClient - optional Anthropic client for LLM-based resolution
- * @returns {Promise<{issues: Array, errors: Array}>}
+ * @returns {Promise<{baseDir: string, issues: Array}>}
  */
-async function cleanWorkspace(userDir, claudeClient = null) {
+async function planClean(userDir) {
   const baseDir = userDir || OBOL_DIR;
-  if (!fs.existsSync(baseDir)) {
-    return { issues: [], errors: ['Directory does not exist'] };
-  }
-
-  const rogueItems = scanWorkspace(baseDir);
-  if (rogueItems.length === 0) return { issues: [], errors: [] };
+  if (!fs.existsSync(baseDir)) return { baseDir, issues: [] };
+  return { baseDir, issues: scanWorkspace(baseDir) };
+}
 
-  if (claudeClient) {
-    try {
-      const decisions = await resolveWithLlm(rogueItems, claudeClient);
-      if (decisions) return applyDecisions(baseDir, rogueItems, decisions);
-    } catch (e) {
-      console.error('[clean] LLM resolution failed, falling back to heuristics:', e.message);
-    }
-  }
+/**
+ * @param {string} baseDir
+ * @param {Array} issues
+ * @returns {{issues: Array, errors: Array}}
+ */
+function applyPlan(baseDir, issues) {
+  return applyIssues(baseDir, issues);
+}
 
-  return applyHeuristics(baseDir, rogueItems);
+/**
+ * Convenience wrapper: plan + apply in one call.
+ * @param {string} userDir
+ * @returns {Promise<{issues: Array, errors: Array}>}
+ */
+async function cleanWorkspace(userDir) {
+  const plan = await planClean(userDir);
+  if (plan.issues.length === 0) return { issues: [], errors: [] };
+  return applyPlan(plan.baseDir, plan.issues);
 }
 
-module.exports = { cleanWorkspace };
+module.exports = { planClean, applyPlan, cleanWorkspace };

package/src/config.js

@@ -150,7 +150,7 @@ function getUserDir(userId) {
 
 function ensureUserDir(userId) {
   const dir = getUserDir(userId);
-  for (const sub of ['personality', 'scripts', 'tests', 'commands', 'apps', 'logs', 'assets']) {
+  for (const sub of ['personality', 'scripts', 'tests', 'commands', 'apps', 'logs', 'assets', 'library']) {
     fs.mkdirSync(path.join(dir, sub), { recursive: true });
   }
   const defaultAgents = path.join(__dirname, 'defaults', 'AGENTS.md');

package/src/telegram/bot.js

@@ -25,7 +25,7 @@ function createBot(telegramConfig, config) {
   const processedUpdates = new Map();
   let askIdCounter = 0;
 
-  function createAsk(ctx, message, options, timeoutSecs = 60) {
+  function createAsk(ctx, message, options, timeoutSecs = 120) {
     return new Promise((resolve) => {
       const askId = ++askIdCounter;
       const keyboard = new InlineKeyboard();
@@ -33,14 +33,22 @@ function createBot(telegramConfig, config) {
         keyboard.text(opt, `ask:${askId}:${i}`);
         if ((i + 1) % 3 === 0 && i < options.length - 1) keyboard.row();
       });
+      let sentMsgId = null;
       const timer = setTimeout(() => {
         if (pendingAsks.has(askId)) {
           pendingAsks.delete(askId);
+          if (sentMsgId) {
+            ctx.api.editMessageReplyMarkup(ctx.chat.id, sentMsgId, {
+              reply_markup: { inline_keyboard: [] },
+            }).catch(() => {});
+          }
           resolve('timeout');
         }
       }, timeoutSecs * 1000);
       pendingAsks.set(askId, { resolve, options, timer });
-      sendHtml(ctx, message, { reply_markup: keyboard }).catch(() => {
+      sendHtml(ctx, message, { reply_markup: keyboard }).then((msg) => {
+        sentMsgId = msg.message_id;
+      }).catch(() => {
         clearTimeout(timer);
         pendingAsks.delete(askId);
         resolve('error');
@@ -49,7 +57,8 @@ function createBot(telegramConfig, config) {
   }
 
   bot.use(sequentialize((ctx) => {
-    if (ctx.callbackQuery?.data?.startsWith('stop:') || ctx.callbackQuery?.data?.startsWith('force:')) return undefined;
+    const cbData = ctx.callbackQuery?.data;
+    if (cbData?.startsWith('stop:') || cbData?.startsWith('force:') || cbData?.startsWith('ask:')) return undefined;
     return ctx.chat?.id.toString();
   }));
 
@@ -100,7 +109,7 @@ function createBot(telegramConfig, config) {
   conversationCommands.register(bot, config);
   memoryCommands.register(bot, config);
   statusCommands.register(bot, config);
-  adminCommands.register(bot, config);
+  adminCommands.register(bot, config, createAsk);
   traitsCommands.register(bot, config);
   secretsCommands.register(bot, config);
   toolsCommands.register(bot, config);

package/src/telegram/commands/admin.js

@@ -4,9 +4,11 @@ const { execSync } = require('child_process');
 const { getTenant } = require('../../tenant');
 const { loadConfig } = require('../../config');
 const { getMaxToolIterations, setMaxToolIterations } = require('../../claude');
+const { createChatContext, createStatusTracker } = require('../handlers/text');
+const { sendHtml, splitMessage, startTyping } = require('../utils');
 const pkg = require('../../../package.json');
 
-function register(bot, config) {
+function register(bot, config, createAsk) {
   bot.command('backup', async (ctx) => {
     if (!ctx.from) return;
     try {
@@ -25,17 +27,87 @@ function register(bot, config) {
   bot.command('clean', async (ctx) => {
     if (!ctx.from) return;
     const tenant = await getTenant(ctx.from.id, config);
-    const { cleanWorkspace } = require('../../clean');
+    const { planClean } = require('../../clean');
     await ctx.replyWithChatAction('typing');
     try {
-      const result = await cleanWorkspace(tenant.userDir, tenant.claude.client);
-      if (result.issues.length === 0) {
+      const plan = await planClean(tenant.userDir);
+      const testsDir = path.join(plan.baseDir, 'tests');
+      const scriptsDir = path.join(plan.baseDir, 'scripts');
+      const hasTests = fs.existsSync(testsDir) && fs.readdirSync(testsDir).filter(f => !f.startsWith('.')).length > 0;
+      const hasScripts = fs.existsSync(scriptsDir) && fs.readdirSync(scriptsDir).filter(f => !f.startsWith('.')).length > 0;
+
+      if (plan.issues.length === 0 && (hasTests || !hasScripts)) {
         await ctx.reply('✨ Workspace is clean. Nothing out of place.');
-      } else {
-        const text = `🧹 Found ${result.issues.length} issue(s):\n\n` +
-          result.issues.map(i => `${i.action === 'deleted' ? '🗑️' : '📦'} ${i.path} → ${i.action}`).join('\n') +
-          (result.errors.length > 0 ? `\n\n⚠️ ${result.errors.length} error(s):\n${result.errors.join('\n')}` : '');
-        await ctx.reply(text);
+        return;
+      }
+
+      const promptParts = [];
+
+      if (plan.issues.length > 0) {
+        const issueLines = plan.issues.map(i => {
+          const src = i.type === 'misplaced' ? `${i.currentDir}/${i.name}` : (i.type === 'dir' ? i.name + '/' : i.name);
+          return i.dest ? `- ${src} → ${i.dest}/` : `- ${src} (unknown type)`;
+        }).join('\n');
+
+        promptParts.push(`Clean up the obol workspace located at: ${plan.baseDir}
+
+## Workspace Structure
+Allowed root directories: personality/, scripts/, tests/, commands/, apps/, logs/, assets/
+Allowed root files: config.json, secrets.json, .evolution-state.json, .first-run-done, .post-setup-done
+- personality/ and commands/ only contain .md files (except personality/traits.json which must stay)
+- Unknown directories at the root should be moved into apps/
+- Script files (.js, .ts, .sh, etc.) go into scripts/
+- Asset files (images, audio, pdf, etc.) go into assets/
+- .DS_Store and other dotfiles should be deleted
+- secrets.json and personality/traits.json must NOT be moved
+
+## Issues Found
+${issueLines}
+
+Resolve all of these issues. Use the exec tool to run shell commands (mv, rm, mkdir) to move or delete files as appropriate.`);
+      }
+
+      promptParts.push(`## Secret Hygiene
+Read every script in ${plan.baseDir}/scripts/. If any script has hardcoded API keys, passwords, tokens, or credentials (e.g. API_KEY = "sk-...", PASSWORD = "..."), refactor it:
+1. Use \`store_secret\` to save each hardcoded value under a descriptive key (e.g. "deepseek-api-key")
+2. Rewrite the script to accept a JSON secrets object as its first argument:
+   \`\`\`python
+   import json, sys
+   secrets = json.loads(sys.argv[1])
+   api_key = secrets.get('deepseek-api-key', '').strip()
+   \`\`\`
+3. Never leave plaintext secrets in script files
+
+## Tests
+Check the tests/ folder at ${plan.baseDir}/tests/. If it has test files, run them — fix any failures and re-run until all pass. If tests/ is empty or missing, read the scripts in ${plan.baseDir}/scripts/ and write a test file for each script, then run them all.
+Summarize what was cleaned, secrets migrated, and final test results.`);
+
+      const taskPrompt = promptParts.join('\n\n');
+
+      const stopTyping = startTyping(ctx);
+      const status = createStatusTracker(ctx);
+      const chatContext = createChatContext(ctx, tenant, config, { allowedUsers: new Set(), bot, createAsk });
+      chatContext._model = 'claude-sonnet-4-6';
+      chatContext._onRouteDecision = (info) => { status.setRouteInfo(info); status.start(); };
+      chatContext._onToolStart = (toolName, inputSummary) => {
+        status.setStatusText('Cleaning');
+        status.start();
+      };
+
+      try {
+        const { text: response } = await tenant.claude.chat(taskPrompt, chatContext);
+        status.stopTimer();
+        status.updateFormatting();
+        stopTyping();
+        status.deleteMsg();
+        if (response?.trim()) {
+          const chunks = splitMessage(response, 4096);
+          for (const chunk of chunks) await sendHtml(ctx, chunk).catch(() => {});
+        }
+      } catch (e) {
+        status.clear();
+        stopTyping();
+        await ctx.reply(`⚠️ Clean failed: ${e.message}`).catch(() => {});
       }
     } catch (e) {
       await ctx.reply(`⚠️ Clean failed: ${e.message}`);

package/src/telegram/handlers/callbacks.js

@@ -1,4 +1,3 @@
-const { markdownToTelegramHtml } = require('../utils');
 const { handleToolCallback } = require('../commands/tools');
 const { handleVoiceCallback } = require('../voice');
 
@@ -108,8 +107,7 @@ function registerCallbackHandler(bot, { config, pendingAsks, getTenant }) {
     await answer({ text: selected });
     clearTimeout(pending.timer);
     pendingAsks.delete(askId);
-    const confirmHtml = markdownToTelegramHtml(`${ctx.callbackQuery.message.text}\n\n✓ _${selected}_`);
-    ctx.editMessageText(confirmHtml, { parse_mode: 'HTML', reply_markup: { inline_keyboard: [] } }).catch(() => {});
+    ctx.deleteMessage().catch(() => {});
     pending.resolve(selected);
   });
 }