omnius 1.0.18 → 1.0.19

package/dist/index.js

@@ -84452,7 +84452,7 @@ var require_mime_types = __commonJS({
   "../node_modules/mime-types/index.js"(exports) {
     "use strict";
     var db = require_mime_db();
-    var extname15 = __require("path").extname;
+    var extname16 = __require("path").extname;
     var EXTRACT_TYPE_REGEXP = /^\s*([^;\s]*)(?:;|\s|$)/;
     var TEXT_TYPE_REGEXP = /^text\//i;
     exports.charset = charset;
@@ -84506,7 +84506,7 @@ var require_mime_types = __commonJS({
       if (!path11 || typeof path11 !== "string") {
         return false;
       }
-      var extension4 = extname15("x." + path11).toLowerCase().substr(1);
+      var extension4 = extname16("x." + path11).toLowerCase().substr(1);
       if (!extension4) {
         return false;
       }
@@ -477005,7 +477005,7 @@ var require_path_browserify = __commonJS({
           return path11.slice(start2, end);
         }
       },
-      extname: function extname15(path11) {
+      extname: function extname16(path11) {
         assertPath(path11);
         var startDot = -1;
         var startPart = 0;
@@ -507302,12 +507302,23 @@ function ensureGeneratedVoiceDir() {
   mkdirSync16(generatedVoiceDir(), { recursive: true });
 }
 function ttsOutputPath(args, backend) {
-  const output = typeof args["output"] === "string" ? args["output"] : typeof args["output_path"] === "string" ? args["output_path"] : "";
-  if (output.trim())
-    return resolvePath(output.trim());
+  for (const key of ["output", "output_path", "path", "file_path", "file"]) {
+    const output = args[key];
+    if (typeof output === "string" && output.trim()) {
+      return resolvePath(output.trim());
+    }
+  }
   ensureGeneratedVoiceDir();
   return join58(generatedVoiceDir(), `tts-${backend}-${Date.now()}-${Math.random().toString(36).slice(2, 7)}.wav`);
 }
+function ttsTextArg(args) {
+  for (const key of ["text", "input", "prompt", "content", "message"]) {
+    const value2 = args[key];
+    if (typeof value2 === "string" && value2.trim())
+      return value2.trim();
+  }
+  return "";
+}
 function listCloneRefs() {
   try {
     return readdirSync14(cloneRefsDir()).filter((file) => /\.(wav|mp3|flac|ogg|m4a)$/i.test(file) && existsSync40(join58(cloneRefsDir(), file))).sort((a2, b) => a2.localeCompare(b));
@@ -507348,6 +507359,12 @@ function supertonicInferScript() {
 function mlxVenvPy() {
   return process.platform === "win32" ? join58(voiceDir(), "mlx-venv", "Scripts", "python.exe") : join58(voiceDir(), "mlx-venv", "bin", "python3");
 }
+function piperVenvDir() {
+  return join58(voiceDir(), "piper-venv");
+}
+function piperVenvBin() {
+  return process.platform === "win32" ? join58(piperVenvDir(), "Scripts", "piper.exe") : join58(piperVenvDir(), "bin", "piper");
+}
 function ensureSupertonicInstalled() {
   const venvPy = supertonicVenvPy();
   if (!existsSync40(venvPy)) {
@@ -507385,6 +507402,25 @@ function ensureMlxInstalled() {
   }
   return venvPy;
 }
+function ensurePiperInstalled() {
+  if (hasCommand3("piper"))
+    return "piper";
+  const bin = piperVenvBin();
+  if (!existsSync40(bin)) {
+    const py = findPython32();
+    if (!py)
+      throw new Error("python3 is required to set up Piper TTS.");
+    mkdirSync16(voiceDir(), { recursive: true });
+    execFileSync2(py, ["-m", "venv", piperVenvDir()], { stdio: "pipe", timeout: 18e4 });
+    const venvPy = process.platform === "win32" ? join58(piperVenvDir(), "Scripts", "python.exe") : join58(piperVenvDir(), "bin", "python3");
+    execFileSync2(venvPy, ["-m", "pip", "install", "--quiet", "--upgrade", "pip"], { stdio: "pipe", timeout: 12e4 });
+    execFileSync2(venvPy, ["-m", "pip", "install", "--quiet", "piper-tts"], { stdio: "pipe", timeout: 6e5 });
+  }
+  if (!existsSync40(bin)) {
+    throw new Error("Piper TTS installed but the piper executable was not found in the managed venv.");
+  }
+  return bin;
+}
 function saveCloneRefFromSample(sample, cloneName) {
   const source = resolvePath(sample);
   if (!existsSync40(source))
@@ -507552,7 +507588,7 @@ except Exception as exc:
 `;
     AudioPlaybackTool = class {
       name = "audio_playback";
-      description = "Play audio through speakers, synthesize text-to-speech, and manage TTS clone voices. Actions: 'play' to play an audio file (WAV/MP3/OGG — including recordings from memory episodes), 'speak' to synthesize and play text, 'synthesize' to save TTS to a WAV file, 'clone' to register a voice-clone sample, 'list_voices' to inspect available clone refs/backends, 'volume' to get or set system volume, 'list' to enumerate audio output devices. TTS backends are explicit: auto, luxtts, supertonic, mlx, onnx/piper, or espeak. Use generate_tts when the task is specifically to create a TTS file.";
+      description = "Play audio through speakers, synthesize text-to-speech, and manage TTS clone voices. Actions: 'play' to play an audio file (WAV/MP3/OGG — including recordings from memory episodes), 'speak' to synthesize and play text, 'synthesize' to save TTS to a WAV file, 'clone' to register a voice-clone sample, 'list_voices' to inspect available clone refs/backends, 'volume' to get or set system volume, 'list' to enumerate audio output devices. TTS backends are explicit: auto, luxtts, supertonic, mlx, onnx/piper, or espeak. Neural TTS backends self-provision into ~/.omnius/voice on first use where supported. Use generate_tts when the task is specifically to create a TTS file; do not use shell speech commands or generate_audio for spoken TTS.";
       parameters = {
         type: "object",
         properties: {
@@ -507569,6 +507605,14 @@ except Exception as exc:
             type: "string",
             description: "Text to speak or synthesize"
           },
+          input: {
+            type: "string",
+            description: "Alias for text."
+          },
+          prompt: {
+            type: "string",
+            description: "Alias for text."
+          },
           backend: {
             type: "string",
             enum: ["auto", "luxtts", "supertonic", "mlx", "onnx", "piper", "espeak"],
@@ -507598,6 +507642,10 @@ except Exception as exc:
             type: "string",
             description: "Backend model id or raw ONNX/Piper model path. MLX default is mlx-community/Kokoro-82M-bf16."
           },
+          strict_backend: {
+            type: "boolean",
+            description: "When true, fail instead of falling back if the requested TTS backend is unavailable. Defaults false."
+          },
           volume: {
             type: "number",
             description: "Volume level 0-100 (for 'volume' action to SET volume)"
@@ -507693,7 +507741,7 @@ except Exception as exc:
           `  luxtts: ${existsSync40(join58(voiceDir(), "luxtts-venv", "bin", "python3")) ? "installed" : "not installed"}; clone refs: ${refs.length}`,
           `  supertonic: ${existsSync40(supertonicVenvPy()) ? "installed" : "not installed"}; voices include M1, M2, M3, M4 when package assets are available`,
           `  mlx: ${existsSync40(mlxVenvPy()) ? "installed" : "not installed"}; Apple Silicon only; default model mlx-community/Kokoro-82M-bf16`,
-          `  piper/onnx: ${hasCommand3("piper") ? "available" : "not found"}; pass model=<path.onnx> for raw ONNX voices`,
+          `  piper/onnx: ${hasCommand3("piper") || existsSync40(piperVenvBin()) ? "available" : "not installed"}; first use installs piper-tts into ${piperVenvDir()}; pass model=<path.onnx> for raw ONNX voices`,
           `  espeak: ${hasCommand3("espeak-ng") ? "available" : "not found"}`,
           "",
           "Registered clone refs:",
@@ -507702,16 +507750,18 @@ except Exception as exc:
         return { success: true, output: lines.join("\n"), durationMs: performance.now() - start2 };
       }
       async synthesizeText(args, start2, speakDefault) {
-        const text = typeof args["text"] === "string" ? args["text"].trim() : "";
+        const text = ttsTextArg(args);
         if (!text) {
           return { success: false, output: "", error: "Missing 'text' parameter. Provide text to synthesize.", durationMs: performance.now() - start2 };
         }
         const requestedBackend = normalizeTtsBackend(args["backend"]);
+        const strictBackend = boolArg(args["strict_backend"] ?? args["strictBackend"], false);
         const playback = playbackArg(args, speakDefault);
         const outputPath2 = ttsOutputPath(args, requestedBackend);
         const device = typeof args["device"] === "string" ? args["device"] : "default";
         const tried = [];
-        const candidates = requestedBackend === "auto" ? ["luxtts", "supertonic", ...process.platform === "darwin" && process.arch === "arm64" ? ["mlx"] : [], "piper", "espeak"] : [requestedBackend];
+        const autoCandidates = ["luxtts", "supertonic", ...process.platform === "darwin" && process.arch === "arm64" ? ["mlx"] : [], "piper", "espeak"];
+        const candidates = requestedBackend === "auto" ? autoCandidates : strictBackend ? [requestedBackend] : [requestedBackend, ...autoCandidates.filter((backend) => backend !== requestedBackend)];
         let usedBackend = "";
         let voiceSummary = "";
         for (const backend of candidates) {
@@ -507734,7 +507784,7 @@ except Exception as exc:
           } catch (err) {
             const message2 = err instanceof Error ? err.message : String(err);
             tried.push(`${backend}: ${message2.slice(0, 300)}`);
-            if (requestedBackend !== "auto") {
+            if (requestedBackend !== "auto" && strictBackend) {
               return { success: false, output: "", error: `${backend} TTS failed: ${message2}`, durationMs: performance.now() - start2 };
             }
           }
@@ -507754,11 +507804,13 @@ ${tried.map((line) => `- ${line}`).join("\n")}`,
         })() : "  Playback: disabled";
         const size = Math.round(statSync18(outputPath2).size / 1024);
         const preview = text.length > 140 ? `${text.slice(0, 137)}...` : text;
+        const fallbackLine = requestedBackend !== "auto" && usedBackend !== requestedBackend ? `  Fallback: requested ${requestedBackend}; ${tried[0] ?? "requested backend unavailable"}` : "";
         return {
           success: true,
           output: [
             `TTS generated: ${outputPath2}`,
             `  Backend: ${usedBackend}`,
+            fallbackLine,
             voiceSummary ? `  Voice: ${voiceSummary}` : "",
             `  Size: ${size}KB`,
             playbackLine,
@@ -507783,8 +507835,9 @@ ${tried.map((line) => `- ${line}`).join("\n")}`,
         }
         const venvPy = join58(voiceDir(), "luxtts-venv", "bin", "python3");
         const repoDir = join58(voiceDir(), "LuxTTS");
-        if (!existsSync40(venvPy) || !existsSync40(repoDir))
-          throw new Error("LuxTTS is not installed. Run /voice model luxtts or set up the LuxTTS voice backend first.");
+        if (!existsSync40(venvPy) || !existsSync40(repoDir)) {
+          throw new Error("LuxTTS is not installed in the managed voice environment yet.");
+        }
         const pyScript = [
           "import json, sys, wave",
           "import numpy as np, torch",
@@ -507842,8 +507895,7 @@ ${tried.map((line) => `- ${line}`).join("\n")}`,
         return `${voice} (${model})`;
       }
       synthesizePiper(text, outputPath2, args, requireModel) {
-        if (!hasCommand3("piper"))
-          throw new Error("piper command not found. Install Piper for ONNX TTS.");
+        const piper = ensurePiperInstalled();
         const rawModel = typeof args["model"] === "string" ? args["model"] : typeof args["voice"] === "string" && /\.(onnx|onnx\.json)$/i.test(args["voice"]) ? args["voice"] : "";
         const argv = ["--output_file", outputPath2];
         let summary = "default piper voice";
@@ -507853,10 +507905,10 @@ ${tried.map((line) => `- ${line}`).join("\n")}`,
             throw new Error(`Piper/ONNX model file not found: ${rawModel}`);
           argv.unshift("--model", modelPath);
           summary = basename12(modelPath);
-        } else if (requireModel) {
-          throw new Error("Raw ONNX TTS requires model=<path.onnx> or voice=<path.onnx>.");
+        } else {
+          throw new Error(`${requireModel ? "Raw ONNX" : "Piper"} TTS requires model=<path.onnx> or voice=<path.onnx>.`);
         }
-        execFileSync2("piper", argv, { input: text, stdio: ["pipe", "pipe", "pipe"], timeout: 12e4 });
+        execFileSync2(piper, argv, { input: text, stdio: ["pipe", "pipe", "pipe"], timeout: 12e4 });
         return summary;
       }
       synthesizeEspeak(text, outputPath2, args) {
@@ -507943,14 +507995,18 @@ ${devices.join("\n")}`,
     };
     TtsGenerateTool = class {
       name = "generate_tts";
-      description = "Generate text-to-speech audio as a WAV file, optionally playing it after synthesis. Supports explicit backends: auto, luxtts voice cloning, supertonic, mlx, onnx/piper, and espeak. Use clone_ref to select a registered LuxTTS voice, sample+clone_name to register a clone sample via audio_playback action=clone, and playback=false for silent file generation.";
+      description = "Generate text-to-speech audio as a WAV file, optionally playing it after synthesis. Supports explicit backends: auto, luxtts voice cloning, supertonic, mlx, onnx/piper, and espeak. Neural TTS backends self-provision into ~/.omnius/voice on first use where supported. Use clone_ref to select a registered LuxTTS voice, sample+clone_name to register a clone sample via audio_playback action=clone, and playback=false for silent file generation. Use this tool for speech/TTS requests; do not use shell commands or generate_audio as a TTS fallback.";
       parameters = {
         type: "object",
         properties: {
           text: { type: "string", description: "Text to synthesize" },
+          input: { type: "string", description: "Alias for text." },
+          prompt: { type: "string", description: "Alias for text." },
           backend: { type: "string", enum: ["auto", "luxtts", "supertonic", "mlx", "onnx", "piper", "espeak"] },
           output: { type: "string", description: "Output WAV path. Defaults to ~/.omnius/voice/generated/tts-*.wav." },
+          path: { type: "string", description: "Alias for output." },
           playback: { type: "boolean", description: "Whether to play after generating. Defaults false for generate_tts." },
+          strict_backend: { type: "boolean", description: "When true, fail instead of falling back if the requested backend is unavailable. Defaults false." },
           voice: { type: "string", description: "Voice id/name, or raw Piper/ONNX path when backend=onnx/piper." },
           clone_ref: { type: "string", description: "LuxTTS clone reference path, filename, or registered clone name." },
           model: { type: "string", description: "Backend model id or raw ONNX/Piper model path." },
@@ -507958,7 +508014,7 @@ ${devices.join("\n")}`,
           speed: { type: "number", description: "Speech speed multiplier or backend-specific rate." },
           device: { type: "string", description: "Playback output device when playback=true." }
         },
-        required: ["text"]
+        required: []
       };
       async execute(args) {
         const tool = new AudioPlaybackTool();
@@ -534492,7 +534548,7 @@ Respond with your assessment, then take action.`;
           } catch {
           }
         }
-        if (!this.options.disablePersistentMemory && !this.options.disableCodebaseMap && process.env["OMNIUS_DISABLE_CODEBASE_MAP"] !== "1" && this._episodeStore && this._workingDirectory) {
+        if (!this.options.disablePersistentMemory && !this.options.disableCodebaseMap && !this.options.subAgent && !this.options.stateDir && process.env["OMNIUS_DISABLE_CODEBASE_MAP"] !== "1" && this._episodeStore && this._workingDirectory) {
           try {
             const memMod = await Promise.resolve().then(() => (init_dist7(), dist_exports2));
             let commitSha = "no-commit";
@@ -596290,6 +596346,8 @@ var init_tool_policy = __esm({
       "glob_find",
       "list_directory",
       "code_sandbox",
+      "full_sub_agent",
+      "telegram_sandbox_handoff",
       "codebase_map",
       "diagnostic",
       "git_info",
@@ -596324,7 +596382,6 @@ var init_tool_policy = __esm({
       "generate_tts",
       "create_audio_file",
       "telegram_send_file",
-      "telegram_sandbox_handoff",
       "task_complete"
     ]);
     SAFE_GROUP_ADMIN_TOOLS = /* @__PURE__ */ new Set([
@@ -596341,7 +596398,6 @@ var init_tool_policy = __esm({
       "generate_tts",
       "create_audio_file",
       "telegram_send_file",
-      "telegram_sandbox_handoff",
       "task_complete"
     ]);
   }
@@ -596359,6 +596415,7 @@ import { mkdir as mkdir17 } from "node:fs/promises";
 import {
   basename as basename22,
   dirname as dirname33,
+  extname as extname14,
   isAbsolute as isAbsolute6,
   join as join119,
   relative as relative12,
@@ -596377,11 +596434,26 @@ function formatTelegramCreativeWorkspacePrompt(root) {
     "Public/group creative workspace is enabled.",
     `Workspace root: ${root}`,
     "Creative file tools are scoped to that folder only.",
-    "Allowed: create new files, read/list files in this workspace, and edit/patch files already created in this workspace.",
-    "Forbidden: delete files, access paths outside this workspace, mutate the project tree, run shell commands, or touch system state.",
+    "Allowed: create and send non-executable creative artifacts in this workspace.",
+    "Forbidden: delete files, create scripts/executables, access paths outside this workspace, mutate the project tree, run shell/Python/code commands, or touch system state.",
     "When a user asks for an artifact to be sent, create it here and then call telegram_send_file. The bridge also auto-attaches recorded artifacts as a fallback. Refer to the attachment naturally; do not expose filesystem paths unless the admin explicitly asks."
   ].join("\n");
 }
+function publicCreativeArtifactPolicyError(path11) {
+  const ext = extname14(path11).toLowerCase();
+  if (PUBLIC_EXECUTABLE_ARTIFACT_EXTENSIONS.has(ext)) {
+    return `Public Telegram creative work cannot create or send executable/script/code artifacts (${ext || "no extension"}). Use a non-executable artifact such as .md, .txt, .json, image, audio, or PDF.`;
+  }
+  return null;
+}
+function publicCreativeContentPolicyError(args) {
+  const content = args["content"] ?? args["text"] ?? args["data"];
+  if (typeof content !== "string") return null;
+  if (/^\s*#!/.test(content)) {
+    return "Public Telegram creative work cannot create executable scripts or shebang files.";
+  }
+  return null;
+}
 function collectGeneratedArtifactPathsFromText(text, root) {
   const rootAbs = resolve38(root);
   const paths = /* @__PURE__ */ new Set();
@@ -596461,6 +596533,10 @@ function scopedTool(base3, root, mode) {
       if (pathKey) {
         const guarded = guardPath(rootAbs, String(next[pathKey]));
         if (!guarded.ok) return denied(guarded.error);
+        const pathPolicyError = publicCreativeArtifactPolicyError(guarded.path.abs);
+        if (pathPolicyError) return denied(pathPolicyError);
+        const contentPolicyError = mode === "create" || mode === "edit" ? publicCreativeContentPolicyError(next) : null;
+        if (contentPolicyError) return denied(contentPolicyError);
         if (mode === "edit" && !manifestHas(rootAbs, guarded.path.rel)) {
           return denied(`Public Telegram creative tools can only edit files created in this chat workspace: ${guarded.path.rel}`);
         }
@@ -596573,7 +596649,7 @@ function denied(error) {
     mutatedFiles: []
   };
 }
-var MANIFEST_FILE, PATH_KEYS, MEDIA_PATH_RE, CreativeAudioFileTool;
+var MANIFEST_FILE, PATH_KEYS, MEDIA_PATH_RE, PUBLIC_EXECUTABLE_ARTIFACT_EXTENSIONS, CreativeAudioFileTool;
 var init_telegram_creative_tools = __esm({
   "packages/cli/src/tui/telegram-creative-tools.ts"() {
     "use strict";
@@ -596582,6 +596658,65 @@ var init_telegram_creative_tools = __esm({
     MANIFEST_FILE = ".omnius-creative-manifest.json";
     PATH_KEYS = ["path", "file", "file_path", "filename", "filepath", "filePath"];
     MEDIA_PATH_RE = /(?:^|[\s([])(\/[^\s<>"')\]]+\.[A-Za-z0-9]{1,12})(?:$|[\s),.\]])/g;
+    PUBLIC_EXECUTABLE_ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Set([
+      ".sh",
+      ".bash",
+      ".zsh",
+      ".fish",
+      ".ksh",
+      ".csh",
+      ".py",
+      ".pyw",
+      ".pyc",
+      ".pyo",
+      ".ipynb",
+      ".js",
+      ".mjs",
+      ".cjs",
+      ".ts",
+      ".tsx",
+      ".jsx",
+      ".rb",
+      ".pl",
+      ".pm",
+      ".php",
+      ".lua",
+      ".r",
+      ".jl",
+      ".ps1",
+      ".psm1",
+      ".bat",
+      ".cmd",
+      ".com",
+      ".exe",
+      ".msi",
+      ".jar",
+      ".class",
+      ".war",
+      ".ear",
+      ".go",
+      ".rs",
+      ".c",
+      ".cc",
+      ".cpp",
+      ".cxx",
+      ".h",
+      ".hpp",
+      ".java",
+      ".kt",
+      ".kts",
+      ".scala",
+      ".swift",
+      ".cs",
+      ".vb",
+      ".fs",
+      ".so",
+      ".dylib",
+      ".dll",
+      ".app",
+      ".appimage",
+      ".desktop"
+    ]);
     CreativeAudioFileTool = class {
       constructor(root) {
         this.root = root;
@@ -596593,6 +596728,8 @@ var init_telegram_creative_tools = __esm({
         type: "object",
         properties: {
           text: { type: "string", description: "Text to synthesize into speech" },
+          input: { type: "string", description: "Alias for text" },
+          prompt: { type: "string", description: "Alias for text" },
           path: { type: "string", description: "Output .wav path inside the creative workspace" },
           backend: { type: "string", enum: ["auto", "luxtts", "supertonic", "mlx", "onnx", "piper", "espeak"], description: "TTS backend. Defaults to auto." },
           voice: { type: "string", description: "Voice id/name for the selected TTS backend" },
@@ -596600,11 +596737,11 @@ var init_telegram_creative_tools = __esm({
           model: { type: "string", description: "Optional backend model id or raw Piper/ONNX path" },
           speed: { type: "number", description: "Speech speed multiplier or backend-specific rate" }
         },
-        required: ["text", "path"]
+        required: []
       };
       async execute(args) {
         const start2 = performance.now();
-        const text = typeof args["text"] === "string" ? args["text"].trim() : "";
+        const text = typeof args["text"] === "string" && args["text"].trim() ? args["text"].trim() : typeof args["input"] === "string" && args["input"].trim() ? args["input"].trim() : typeof args["prompt"] === "string" && args["prompt"].trim() ? args["prompt"].trim() : "";
         if (!text) return { success: false, output: "", error: "text is required", durationMs: performance.now() - start2 };
         const rawPath = typeof args["path"] === "string" && args["path"].trim() ? String(args["path"]) : `speech-${Date.now()}.wav`;
         const guarded = guardPath(this.root, rawPath);
@@ -597122,7 +597259,8 @@ function telegramSyntheticHelpSignatures() {
   return [
     { signature: "/help", description: "Show Telegram command help" },
     { signature: "/start", description: "Show Telegram bridge status and authentication instructions" },
-    { signature: "/auth <code>", description: "Authenticate this Telegram user as bot admin using the TUI code" }
+    { signature: "/auth <code>", description: "Authenticate this Telegram user as bot admin using the TUI code" },
+    { signature: "/call", description: "Get the active voice call link when a call session is running" }
   ];
 }
 function telegramHelpCommandAllowed(cmd, scope) {
@@ -597626,7 +597764,8 @@ path and target. Do not search for Telegram bot tokens, environment secrets, or
 credentials; upload authorization is encapsulated by telegram_send_file.
 
 When asked to generate speech, narration, or TTS, use generate_tts or audio_playback.
-Do not fall back to shell commands for speech synthesis while those tools are available.
+Those tools handle first-use backend setup where supported. Do not fall back to shell
+commands or generic audio generation for speech synthesis while those tools are available.
 
 Keep responses concise for Telegram but don't withhold information from the admin.
 `.trim();
@@ -599550,6 +599689,9 @@ ${mediaContext}` : ""}`
         runner.onEvent((event) => {
           if (subAgent.aborted) return;
           let suppressExternalEvent = false;
+          if (!isAdminDM && event.type === "status") {
+            suppressExternalEvent = true;
+          }
           if (event.type === "tool_call" && event.toolName) {
             if (event.toolName === "task_complete") {
               subAgent.completionBoundarySeen = true;
@@ -599585,7 +599727,9 @@ ${mediaContext}` : ""}`
               }
             }
           } else if (event.type === "status" && event.content) {
-            this.subAgentViewCallbacks?.onWrite(subAgent.viewId, `status: ${event.content}`);
+            if (isAdminDM) {
+              this.subAgentViewCallbacks?.onWrite(subAgent.viewId, `status: ${event.content}`);
+            }
           } else if (event.type === "assistant_text" && event.content && event.source !== "task_complete_summary") {
             subAgent.assistantText = event.content;
           } else if (event.type === "stream_start") {
@@ -600056,10 +600200,27 @@ Scoped workspace: ${scopedRoot}`,
           ).map((tool) => adaptTool5(tool, todoSessionId));
           adaptedTools.push(...creativeTools);
           adaptedTools.push(adaptTool5(this.buildTelegramSendFileTool(context2, repoRoot, chatId, msg), todoSessionId));
-          adaptedTools.push(adaptTool5(this.buildTelegramSandboxHandoffTool(context2, repoRoot, `chat:${String(chatId ?? "unknown")}`, chatId), todoSessionId));
+          adaptedTools = this.filterNonAdminTelegramTools(adaptedTools);
         }
         return [...adaptedTools, taskComplete];
       }
+      filterNonAdminTelegramTools(tools) {
+        const blocked = /* @__PURE__ */ new Set([
+          "shell",
+          "code_sandbox",
+          "background_run",
+          "task_output",
+          "task_status",
+          "task_stop",
+          "full_sub_agent",
+          "telegram_sandbox_handoff",
+          "create_tool",
+          "manage_tools",
+          "aiwg_setup",
+          "aiwg_workflow"
+        ]);
+        return tools.filter((tool) => !blocked.has(tool.name));
+      }
       imageGenerationDefaultsForRepo(repoRoot) {
         const settings = resolveSettings(repoRoot);
         return {
@@ -600221,6 +600382,10 @@ ${knownList}` : "Private-user telegram_send_file target must be this DM or a kno
         if (scopedRoot && !isPathInside(base3, abs)) {
           return { ok: false, error: `Public/group telegram_send_file can only send files inside ${base3}.` };
         }
+        if (scopedRoot) {
+          const policyError = publicCreativeArtifactPolicyError(abs);
+          if (policyError) return { ok: false, error: policyError };
+        }
         if (!existsSync106(abs)) return { ok: false, error: `File does not exist: ${trimmed}` };
         if (!statSync36(abs).isFile()) return { ok: false, error: `Path is not a file: ${trimmed}` };
         return { ok: true, path: abs };
@@ -625026,7 +625191,7 @@ var init_clipboard_media = __esm({
 
 // packages/cli/src/tui/interactive.ts
 import { cwd } from "node:process";
-import { resolve as resolve44, join as join137, dirname as dirname38, extname as extname14, relative as relative14 } from "node:path";
+import { resolve as resolve44, join as join137, dirname as dirname38, extname as extname15, relative as relative14 } from "node:path";
 import { createRequire as createRequire8 } from "node:module";
 import { fileURLToPath as fileURLToPath18 } from "node:url";
 import {
@@ -632328,7 +632493,7 @@ Execute this skill now. Follow the behavioral guidance above.`;
           const imgPath = resolve44(repoRoot, cleanPath);
           const imgBuffer = readFileSync100(imgPath);
           const base642 = imgBuffer.toString("base64");
-          const ext = extname14(cleanPath).toLowerCase();
+          const ext = extname15(cleanPath).toLowerCase();
           const mime = ext === ".png" ? "image/png" : ext === ".gif" ? "image/gif" : ext === ".webp" ? "image/webp" : "image/jpeg";
           const asciiContext = await renderAsciiPreviewForImage(
             imgPath,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.18",
+      "version": "1.0.19",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",