pllan 2026.3.47 → 2026.3.49

package/docs/nb/gateway/configuration-reference.md

@@ -8,7 +8,7 @@ read_when:
 
 # Configuration Reference
 
-Every field available in `~/.pllan/pllan.json`. For a task-oriented overview, see [Configuration](/gateway/configuration).
+Every field available in `~/.pllan/pllan.json`. For a task-oriented overview, see [Configuration](/nb/gateway/configuration).
 
 Config format is **JSON5** (comments + trailing commas allowed). All fields are optional — Pllan uses safe defaults when omitted.
 
@@ -206,9 +206,9 @@ WhatsApp runs through the gateway's web channel (Baileys Web). It starts automat
 - Optional `channels.telegram.defaultAccount` overrides default account selection when it matches a configured account id.
 - In multi-account setups (2+ account ids), set an explicit default (`channels.telegram.defaultAccount` or `channels.telegram.accounts.default`) to avoid fallback routing; `pllan doctor` warns when this is missing or invalid.
 - `configWrites: false` blocks Telegram-initiated config writes (supergroup ID migrations, `/config set|unset`).
-- Top-level `bindings[]` entries with `type: "acp"` configure persistent ACP bindings for forum topics (use canonical `chatId:topic:topicId` in `match.peer.id`). Field semantics are shared in [ACP Agents](/tools/acp-agents#channel-specific-settings).
+- Top-level `bindings[]` entries with `type: "acp"` configure persistent ACP bindings for forum topics (use canonical `chatId:topic:topicId` in `match.peer.id`). Field semantics are shared in [ACP Agents](/nb/tools/acp-agents#channel-specific-settings).
 - Telegram stream previews use `sendMessage` + `editMessageText` (works in direct and group chats).
-- Retry policy: see [Retry policy](/concepts/retry).
+- Retry policy: see [Retry policy](/nb/concepts/retry).
 
 ### Discord
 
@@ -315,7 +315,7 @@ WhatsApp runs through the gateway's web channel (Baileys Web). It starts automat
   - `idleHours`: Discord override for inactivity auto-unfocus in hours (`0` disables)
   - `maxAgeHours`: Discord override for hard max age in hours (`0` disables)
   - `spawnSubagentSessions`: opt-in switch for `sessions_spawn({ thread: true })` auto thread creation/binding
-- Top-level `bindings[]` entries with `type: "acp"` configure persistent ACP bindings for channels and threads (use channel/thread id in `match.peer.id`). Field semantics are shared in [ACP Agents](/tools/acp-agents#channel-specific-settings).
+- Top-level `bindings[]` entries with `type: "acp"` configure persistent ACP bindings for channels and threads (use channel/thread id in `match.peer.id`). Field semantics are shared in [ACP Agents](/nb/tools/acp-agents#channel-specific-settings).
 - `channels.discord.ui.components.accentColor` sets the accent color for Discord components v2 containers.
 - `channels.discord.voice` enables Discord voice channel conversations and optional auto-join + TTS overrides.
 - `channels.discord.voice.daveEncryption` and `channels.discord.voice.decryptionFailureTolerance` pass through to `@discordjs/voice` DAVE options (`true` and `24` by default).
@@ -523,7 +523,7 @@ BlueBubbles is the recommended iMessage path (plugin-backed, configured under `c
 
 - Core key paths covered here: `channels.bluebubbles`, `channels.bluebubbles.dmPolicy`.
 - Optional `channels.bluebubbles.defaultAccount` overrides default account selection when it matches a configured account id.
-- Full BlueBubbles channel configuration is documented in [BlueBubbles](/channels/bluebubbles).
+- Full BlueBubbles channel configuration is documented in [BlueBubbles](/nb/channels/bluebubbles).
 
 ### iMessage
 
@@ -587,7 +587,7 @@ Microsoft Teams is extension-backed and configured under `channels.msteams`.
 ```
 
 - Core key paths covered here: `channels.msteams`, `channels.msteams.configWrites`.
-- Full Teams config (credentials, webhook, DM/group policy, per-team/per-channel overrides) is documented in [Microsoft Teams](/channels/msteams).
+- Full Teams config (credentials, webhook, DM/group policy, per-team/per-channel overrides) is documented in [Microsoft Teams](/nb/channels/msteams).
 
 ### IRC
 
@@ -614,7 +614,7 @@ IRC is extension-backed and configured under `channels.irc`.
 
 - Core key paths covered here: `channels.irc`, `channels.irc.dmPolicy`, `channels.irc.configWrites`, `channels.irc.nickserv.*`.
 - Optional `channels.irc.defaultAccount` overrides default account selection when it matches a configured account id.
-- Full IRC channel configuration (host/port/TLS/channels/allowlists/mention gating) is documented in [IRC](/channels/irc).
+- Full IRC channel configuration (host/port/TLS/channels/allowlists/mention gating) is documented in [IRC](/nb/channels/irc).
 
 ### Multi-account (all channels)
 
@@ -650,7 +650,7 @@ Run multiple accounts per channel (each with its own `accountId`):
 ### Other extension channels
 
 Many extension channels are configured as `channels.<id>` and documented in their dedicated channel pages (for example Feishu, Matrix, LINE, Nostr, Zalo, Nextcloud Talk, Synology Chat, and Twitch).
-See the full channel index: [Channels](/channels).
+See the full channel index: [Channels](/nb/channels).
 
 ### Group chat mention gating
 
@@ -1031,7 +1031,7 @@ Periodic heartbeat runs.
 }
 ```
 
-- `mode`: `default` or `safeguard` (chunked summarization for long histories). See [Compaction](/concepts/compaction).
+- `mode`: `default` or `safeguard` (chunked summarization for long histories). See [Compaction](/nb/concepts/compaction).
 - `timeoutSeconds`: maximum seconds allowed for a single compaction operation before Pllan aborts it. Default: `900`.
 - `identifierPolicy`: `strict` (default), `off`, or `custom`. `strict` prepends built-in opaque identifier retention guidance during compaction summarization.
 - `identifierInstructions`: optional custom identifier-preservation text used when `identifierPolicy=custom`.
@@ -1081,7 +1081,7 @@ Notes:
 
 </Accordion>
 
-See [Session Pruning](/concepts/session-pruning) for behavior details.
+See [Session Pruning](/nb/concepts/session-pruning) for behavior details.
 
 ### Block streaming
 
@@ -1103,7 +1103,7 @@ See [Session Pruning](/concepts/session-pruning) for behavior details.
 - Channel overrides: `channels.<channel>.blockStreamingCoalesce` (and per-account variants). Signal/Slack/Discord/Google Chat default `minChars: 1500`.
 - `humanDelay`: randomized pause between block replies. `natural` = 800–2500ms. Per-agent override: `agents.list[].humanDelay`.
 
-See [Streaming](/concepts/streaming) for behavior + chunking details.
+See [Streaming](/nb/concepts/streaming) for behavior + chunking details.
 
 ### Typing indicators
 
@@ -1121,11 +1121,11 @@ See [Streaming](/concepts/streaming) for behavior + chunking details.
 - Defaults: `instant` for direct chats/mentions, `message` for unmentioned group chats.
 - Per-session overrides: `session.typingMode`, `session.typingIntervalSeconds`.
 
-See [Typing Indicators](/concepts/typing-indicators).
+See [Typing Indicators](/nb/concepts/typing-indicators).
 
 ### `agents.defaults.sandbox`
 
-Optional sandboxing for the embedded agent. See [Sandboxing](/gateway/sandboxing) for the full guide.
+Optional sandboxing for the embedded agent. See [Sandboxing](/nb/gateway/sandboxing) for the full guide.
 
 ```json5
 {
@@ -1417,7 +1417,7 @@ scripts/sandbox-browser-setup.sh   # optional browser image
 
 ## Multi-agent routing
 
-Run multiple isolated agents inside one Gateway. See [Multi-Agent](/concepts/multi-agent).
+Run multiple isolated agents inside one Gateway. See [Multi-Agent](/nb/concepts/multi-agent).
 
 ```json5
 {
@@ -1551,7 +1551,7 @@ For `type: "acp"` entries, Pllan resolves by exact conversation identity (`match
 
 </Accordion>
 
-See [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools) for precedence details.
+See [Multi-Agent Sandbox & Tools](/nb/tools/multi-agent-sandbox-tools) for precedence details.
 
 ---
 
@@ -2354,7 +2354,7 @@ Set `MINIMAX_API_KEY`. Shortcut: `pllan onboard --auth-choice minimax-api`.
 
 <Accordion title="Local models (LM Studio)">
 
-See [Local Models](/gateway/local-models). TL;DR: run MiniMax M2.5 via LM Studio Responses API on serious hardware; keep hosted models merged for fallback.
+See [Local Models](/nb/gateway/local-models). TL;DR: run MiniMax M2.5 via LM Studio Responses API on serious hardware; keep hosted models merged for fallback.
 
 </Accordion>
 
@@ -2432,7 +2432,7 @@ See [Local Models](/gateway/local-models). TL;DR: run MiniMax M2.5 via LM Studio
   - Includes `source`, `spec`, `sourcePath`, `installPath`, `version`, `resolvedName`, `resolvedVersion`, `resolvedSpec`, `integrity`, `shasum`, `resolvedAt`, `installedAt`.
   - Treat `plugins.installs.*` as managed state; prefer CLI commands over manual edits.
 
-See [Plugins](/tools/plugin).
+See [Plugins](/nb/tools/plugin).
 
 ---
 
@@ -2579,7 +2579,7 @@ See [Plugins](/tools/plugin).
 - **Auth**: required by default. Non-loopback binds require a shared token/password. Onboarding wizard generates a token by default.
 - If both `gateway.auth.token` and `gateway.auth.password` are configured (including SecretRefs), set `gateway.auth.mode` explicitly to `token` or `password`. Startup and service install/repair flows fail when both are configured and mode is unset.
 - `gateway.auth.mode: "none"`: explicit no-auth mode. Use only for trusted local loopback setups; this is intentionally not offered by onboarding prompts.
-- `gateway.auth.mode: "trusted-proxy"`: delegate auth to an identity-aware reverse proxy and trust identity headers from `gateway.trustedProxies` (see [Trusted Proxy Auth](/gateway/trusted-proxy-auth)).
+- `gateway.auth.mode: "trusted-proxy"`: delegate auth to an identity-aware reverse proxy and trust identity headers from `gateway.trustedProxies` (see [Trusted Proxy Auth](/nb/gateway/trusted-proxy-auth)).
 - `gateway.auth.allowTailscale`: when `true`, Tailscale Serve identity headers can satisfy Control UI/WebSocket auth (verified via `tailscale whois`); HTTP API endpoints still require token/password auth. This tokenless flow assumes the gateway host is trusted. Defaults to `true` when `tailscale.mode = "serve"`.
 - `gateway.auth.rateLimit`: optional failed-auth limiter. Applies per client IP and per auth scope (shared-secret and device-token are tracked independently). Blocked attempts return `429` + `Retry-After`.
   - `gateway.auth.rateLimit.exemptLoopback` defaults to `true`; set `false` when you intentionally want localhost traffic rate-limited too (for test setups or strict proxy deployments).
@@ -2620,7 +2620,7 @@ See [Plugins](/tools/plugin).
     Empty allowlists are treated as unset; use `gateway.http.endpoints.responses.files.allowUrl=false`
     and/or `gateway.http.endpoints.responses.images.allowUrl=false` to disable URL fetching.
 - Optional response hardening header:
-  - `gateway.http.securityHeaders.strictTransportSecurity` (set only for HTTPS origins you control; see [Trusted Proxy Auth](/gateway/trusted-proxy-auth#tls-termination-and-hsts))
+  - `gateway.http.securityHeaders.strictTransportSecurity` (set only for HTTPS origins you control; see [Trusted Proxy Auth](/nb/gateway/trusted-proxy-auth#tls-termination-and-hsts))
 
 ### Multi-instance isolation
 
@@ -2634,7 +2634,7 @@ pllan gateway --port 19001
 
 Convenience flags: `--dev` (uses `~/.pllan-dev` + port `19001`), `--profile <name>` (uses `~/.pllan-<name>`).
 
-See [Multiple Gateways](/gateway/multiple-gateways).
+See [Multiple Gateways](/nb/gateway/multiple-gateways).
 
 ---
 
@@ -2808,7 +2808,7 @@ Setup: `pllan dns setup --apply`.
 - Inline env vars are only applied if the process env is missing the key.
 - `.env` files: CWD `.env` + `~/.pllan/.env` (neither overrides existing vars).
 - `shellEnv`: imports missing expected keys from your login shell profile.
-- See [Environment](/help/environment) for full precedence.
+- See [Environment](/nb/help/environment) for full precedence.
 
 ### Env var substitution
 
@@ -2851,7 +2851,7 @@ Validation:
 
 ### Supported credential surface
 
-- Canonical matrix: [SecretRef Credential Surface](/reference/secretref-credential-surface)
+- Canonical matrix: [SecretRef Credential Surface](/nb/reference/secretref-credential-surface)
 - `secrets apply` targets supported `pllan.json` credential paths.
 - `auth-profiles.json` refs are included in runtime resolution and audit coverage.
 
@@ -2915,8 +2915,8 @@ Notes:
 - `auth-profiles.json` supports value-level refs (`keyRef` for `api_key`, `tokenRef` for `token`).
 - Static runtime credentials come from in-memory resolved snapshots; legacy static `auth.json` entries are scrubbed when discovered.
 - Legacy OAuth imports from `~/.pllan/credentials/oauth.json`.
-- See [OAuth](/concepts/oauth).
-- Secrets runtime behavior and `audit/configure/apply` tooling: [Secrets Management](/gateway/secrets).
+- See [OAuth](/nb/concepts/oauth).
+- Secrets runtime behavior and `audit/configure/apply` tooling: [Secrets Management](/nb/gateway/secrets).
 
 ---
 
@@ -3055,7 +3055,7 @@ Current builds no longer include the TCP bridge. Nodes connect over the Gateway
 - `webhookToken`: bearer token used for cron webhook POST delivery (`delivery.mode = "webhook"`), if omitted no auth header is sent.
 - `webhook`: deprecated legacy fallback webhook URL (http/https) used only for stored jobs that still have `notify: true`.
 
-See [Cron Jobs](/automation/cron-jobs).
+See [Cron Jobs](/nb/automation/cron-jobs).
 
 ---
 
@@ -3114,4 +3114,4 @@ Split config into multiple files:
 
 ---
 
-_Related: [Configuration](/gateway/configuration) · [Configuration Examples](/gateway/configuration-examples) · [Doctor](/gateway/doctor)_
+_Related: [Configuration](/nb/gateway/configuration) · [Configuration Examples](/nb/gateway/configuration-examples) · [Doctor](/nb/gateway/doctor)_

package/docs/nb/gateway/configuration.md

@@ -17,10 +17,10 @@ If the file is missing, Pllan uses safe defaults. Common reasons to add a config
 - Set models, tools, sandboxing, or automation (cron, hooks)
 - Tune sessions, media, networking, or UI
 
-See the [full reference](/gateway/configuration-reference) for every available field.
+See the [full reference](/nb/gateway/configuration-reference) for every available field.
 
 <Tip>
-**New to configuration?** Start with `pllan onboard` for interactive setup, or check out the [Configuration Examples](/gateway/configuration-examples) guide for complete copy-paste configs.
+**New to configuration?** Start with `pllan onboard` for interactive setup, or check out the [Configuration Examples](/nb/gateway/configuration-examples) guide for complete copy-paste configs.
 </Tip>
 
 ## Minimal config
@@ -77,15 +77,15 @@ When validation fails:
   <Accordion title="Set up a channel (WhatsApp, Telegram, Discord, etc.)">
     Each channel has its own config section under `channels.<provider>`. See the dedicated channel page for setup steps:
 
-    - [WhatsApp](/channels/whatsapp) — `channels.whatsapp`
-    - [Telegram](/channels/telegram) — `channels.telegram`
-    - [Discord](/channels/discord) — `channels.discord`
-    - [Slack](/channels/slack) — `channels.slack`
-    - [Signal](/channels/signal) — `channels.signal`
-    - [iMessage](/channels/imessage) — `channels.imessage`
-    - [Google Chat](/channels/googlechat) — `channels.googlechat`
-    - [Mattermost](/channels/mattermost) — `channels.mattermost`
-    - [Microsoft Teams](/channels/msteams) — `channels.msteams`
+    - [WhatsApp](/nb/channels/whatsapp) — `channels.whatsapp`
+    - [Telegram](/nb/channels/telegram) — `channels.telegram`
+    - [Discord](/nb/channels/discord) — `channels.discord`
+    - [Slack](/nb/channels/slack) — `channels.slack`
+    - [Signal](/nb/channels/signal) — `channels.signal`
+    - [iMessage](/nb/channels/imessage) — `channels.imessage`
+    - [Google Chat](/nb/channels/googlechat) — `channels.googlechat`
+    - [Mattermost](/nb/channels/mattermost) — `channels.mattermost`
+    - [Microsoft Teams](/nb/channels/msteams) — `channels.msteams`
 
     All channels share the same DM policy pattern:
 
@@ -127,8 +127,8 @@ When validation fails:
     - `agents.defaults.models` defines the model catalog and acts as the allowlist for `/model`.
     - Model refs use `provider/model` format (e.g. `anthropic/claude-opus-4-6`).
     - `agents.defaults.imageMaxDimensionPx` controls transcript/tool image downscaling (default `1200`); lower values usually reduce vision-token usage on screenshot-heavy runs.
-    - See [Models CLI](/concepts/models) for switching models in chat and [Model Failover](/concepts/model-failover) for auth rotation and fallback behavior.
-    - For custom/self-hosted providers, see [Custom providers](/gateway/configuration-reference#custom-providers-and-base-urls) in the reference.
+    - See [Models CLI](/nb/concepts/models) for switching models in chat and [Model Failover](/nb/concepts/model-failover) for auth rotation and fallback behavior.
+    - For custom/self-hosted providers, see [Custom providers](/nb/gateway/configuration-reference#custom-providers-and-base-urls) in the reference.
 
   </Accordion>
 
@@ -142,7 +142,7 @@ When validation fails:
 
     For groups, use `groupPolicy` + `groupAllowFrom` or channel-specific allowlists.
 
-    See the [full reference](/gateway/configuration-reference#dm-and-group-access) for per-channel details.
+    See the [full reference](/nb/gateway/configuration-reference#dm-and-group-access) for per-channel details.
 
   </Accordion>
 
@@ -171,7 +171,7 @@ When validation fails:
 
     - **Metadata mentions**: native @-mentions (WhatsApp tap-to-mention, Telegram @bot, etc.)
     - **Text patterns**: safe regex patterns in `mentionPatterns`
-    - See [full reference](/gateway/configuration-reference#group-chat-mention-gating) for per-channel overrides and self-chat mode.
+    - See [full reference](/nb/gateway/configuration-reference#group-chat-mention-gating) for per-channel overrides and self-chat mode.
 
   </Accordion>
 
@@ -201,7 +201,7 @@ When validation fails:
     - Set `gateway.channelHealthCheckMinutes: 0` to disable health-monitor restarts globally.
     - `channelStaleEventThresholdMinutes` should be greater than or equal to the check interval.
     - Use `channels.<provider>.healthMonitor.enabled` or `channels.<provider>.accounts.<id>.healthMonitor.enabled` to disable auto-restarts for one channel or account without disabling the global monitor.
-    - See [Health Checks](/gateway/health) for operational debugging and the [full reference](/gateway/configuration-reference#gateway) for all fields.
+    - See [Health Checks](/nb/gateway/health) for operational debugging and the [full reference](/nb/gateway/configuration-reference#gateway) for all fields.
 
   </Accordion>
 
@@ -228,8 +228,8 @@ When validation fails:
 
     - `dmScope`: `main` (shared) | `per-peer` | `per-channel-peer` | `per-account-channel-peer`
     - `threadBindings`: global defaults for thread-bound session routing (Discord supports `/focus`, `/unfocus`, `/agents`, `/session idle`, and `/session max-age`).
-    - See [Session Management](/concepts/session) for scoping, identity links, and send policy.
-    - See [full reference](/gateway/configuration-reference#session) for all fields.
+    - See [Session Management](/nb/concepts/session) for scoping, identity links, and send policy.
+    - See [full reference](/nb/gateway/configuration-reference#session) for all fields.
 
   </Accordion>
 
@@ -251,7 +251,7 @@ When validation fails:
 
     Build the image first: `scripts/sandbox-setup.sh`
 
-    See [Sandboxing](/gateway/sandboxing) for the full guide and [full reference](/gateway/configuration-reference#agents-defaults-sandbox) for all options.
+    See [Sandboxing](/nb/gateway/sandboxing) for the full guide and [full reference](/nb/gateway/configuration-reference#agents-defaults-sandbox) for all options.
 
   </Accordion>
 
@@ -308,7 +308,7 @@ When validation fails:
     - `PLLAN_APNS_RELAY_BASE_URL` and `PLLAN_APNS_RELAY_TIMEOUT_MS` still work as temporary env overrides.
     - `PLLAN_APNS_RELAY_ALLOW_HTTP=true` remains a loopback-only development escape hatch; do not persist HTTP relay URLs in config.
 
-    See [iOS App](/platforms/ios#relay-backed-push-for-official-builds) for the end-to-end flow and [Authentication and trust flow](/platforms/ios#authentication-and-trust-flow) for the relay security model.
+    See [iOS App](/nb/platforms/ios#relay-backed-push-for-official-builds) for the end-to-end flow and [Authentication and trust flow](/nb/platforms/ios#authentication-and-trust-flow) for the relay security model.
 
   </Accordion>
 
@@ -329,7 +329,7 @@ When validation fails:
     - `every`: duration string (`30m`, `2h`). Set `0m` to disable.
     - `target`: `last` | `whatsapp` | `telegram` | `discord` | `none`
     - `directPolicy`: `allow` (default) or `block` for DM-style heartbeat targets
-    - See [Heartbeat](/gateway/heartbeat) for the full guide.
+    - See [Heartbeat](/nb/gateway/heartbeat) for the full guide.
 
   </Accordion>
 
@@ -350,7 +350,7 @@ When validation fails:
 
     - `sessionRetention`: prune completed isolated run sessions from `sessions.json` (default `24h`; set `false` to disable).
     - `runLog`: prune `cron/runs/<jobId>.jsonl` by size and retained lines.
-    - See [Cron jobs](/automation/cron-jobs) for feature overview and CLI examples.
+    - See [Cron jobs](/nb/automation/cron-jobs) for feature overview and CLI examples.
 
   </Accordion>
 
@@ -383,7 +383,7 @@ When validation fails:
     - Keep unsafe-content bypass flags disabled (`hooks.gmail.allowUnsafeExternalContent`, `hooks.mappings[].allowUnsafeExternalContent`) unless doing tightly scoped debugging.
     - For hook-driven agents, prefer strong modern model tiers and strict tool policy (for example messaging-only plus sandboxing where possible).
 
-    See [full reference](/gateway/configuration-reference#hooks) for all mapping options and Gmail integration.
+    See [full reference](/nb/gateway/configuration-reference#hooks) for all mapping options and Gmail integration.
 
   </Accordion>
 
@@ -405,7 +405,7 @@ When validation fails:
     }
     ```
 
-    See [Multi-Agent](/concepts/multi-agent) and [full reference](/gateway/configuration-reference#multi-agent-routing) for binding rules and per-agent access profiles.
+    See [Multi-Agent](/nb/concepts/multi-agent) and [full reference](/nb/gateway/configuration-reference#multi-agent-routing) for binding rules and per-agent access profiles.
 
   </Accordion>
 
@@ -618,16 +618,16 @@ Rules:
 }
 ```
 
-SecretRef details (including `secrets.providers` for `env`/`file`/`exec`) are in [Secrets Management](/gateway/secrets).
-Supported credential paths are listed in [SecretRef Credential Surface](/reference/secretref-credential-surface).
+SecretRef details (including `secrets.providers` for `env`/`file`/`exec`) are in [Secrets Management](/nb/gateway/secrets).
+Supported credential paths are listed in [SecretRef Credential Surface](/nb/reference/secretref-credential-surface).
 </Accordion>
 
-See [Environment](/help/environment) for full precedence and sources.
+See [Environment](/nb/help/environment) for full precedence and sources.
 
 ## Full reference
 
-For the complete field-by-field reference, see **[Configuration Reference](/gateway/configuration-reference)**.
+For the complete field-by-field reference, see **[Configuration Reference](/nb/gateway/configuration-reference)**.
 
 ---
 
-_Related: [Configuration Examples](/gateway/configuration-examples) · [Configuration Reference](/gateway/configuration-reference) · [Doctor](/gateway/doctor)_
+_Related: [Configuration Examples](/nb/gateway/configuration-examples) · [Configuration Reference](/nb/gateway/configuration-reference) · [Doctor](/nb/gateway/doctor)_

package/docs/nb/gateway/discovery.md

@@ -22,12 +22,12 @@ The design goal is to keep all network discovery/advertising in the **Node Gatew
 - **Gateway WS (control plane)**: the WebSocket endpoint on `127.0.0.1:18789` by default; can be bound to LAN/tailnet via `gateway.bind`.
 - **Direct WS transport**: a LAN/tailnet-facing Gateway WS endpoint (no SSH).
 - **SSH transport (fallback)**: remote control by forwarding `127.0.0.1:18789` over SSH.
-- **Legacy TCP bridge (deprecated/removed)**: older node transport (see [Bridge protocol](/gateway/bridge-protocol)); no longer advertised for discovery.
+- **Legacy TCP bridge (deprecated/removed)**: older node transport (see [Bridge protocol](/nb/gateway/bridge-protocol)); no longer advertised for discovery.
 
 Protocol details:
 
-- [Gateway protocol](/gateway/protocol)
-- [Bridge protocol (legacy)](/gateway/bridge-protocol)
+- [Gateway protocol](/nb/gateway/protocol)
+- [Bridge protocol (legacy)](/nb/gateway/bridge-protocol)
 
 ## Why we keep both "direct" and SSH
 
@@ -51,7 +51,7 @@ Target direction:
 - The **gateway** advertises its WS endpoint via Bonjour.
 - Clients browse and show a “pick a gateway” list, then store the chosen endpoint.
 
-Troubleshooting and beacon details: [Bonjour](/gateway/bonjour).
+Troubleshooting and beacon details: [Bonjour](/nb/gateway/bonjour).
 
 #### Service beacon details
 
@@ -95,7 +95,7 @@ If the gateway can detect it is running under Tailscale, it publishes `tailnetDn
 
 When there is no direct route (or direct is disabled), clients can always connect via SSH by forwarding the loopback gateway port.
 
-See [Remote access](/gateway/remote).
+See [Remote access](/nb/gateway/remote).
 
 ## Transport selection (client policy)
 
@@ -110,7 +110,7 @@ Recommended client behavior:
 
 The gateway is the source of truth for node/client admission.
 
-- Pairing requests are created/approved/rejected in the gateway (see [Gateway pairing](/gateway/pairing)).
+- Pairing requests are created/approved/rejected in the gateway (see [Gateway pairing](/nb/gateway/pairing)).
 - The gateway enforces:
   - auth (token / keypair)
   - scopes/ACLs (the gateway is not a raw proxy to every method)

package/docs/nb/gateway/doctor.md

@@ -358,5 +358,5 @@ doctor run.
 Doctor suggests a workspace memory system when missing and prints a backup tip
 if the workspace is not already under git.
 
-See [/concepts/agent-workspace](/concepts/agent-workspace) for a full guide to
+See [/concepts/agent-workspace](/nb/concepts/agent-workspace) for a full guide to
 workspace structure and git backup (recommended private GitHub or GitLab).

package/docs/nb/gateway/heartbeat.md

@@ -8,12 +8,12 @@ title: "Heartbeat"
 
 # Heartbeat (Gateway)
 
-> **Heartbeat vs Cron?** See [Cron vs Heartbeat](/automation/cron-vs-heartbeat) for guidance on when to use each.
+> **Heartbeat vs Cron?** See [Cron vs Heartbeat](/nb/automation/cron-vs-heartbeat) for guidance on when to use each.
 
 Heartbeat runs **periodic agent turns** in the main session so the model can
 surface anything that needs attention without spamming you.
 
-Troubleshooting: [/automation/troubleshooting](/automation/troubleshooting)
+Troubleshooting: [/automation/troubleshooting](/nb/automation/troubleshooting)
 
 ## Quick start (beginner)
 
@@ -63,7 +63,7 @@ The default prompt is intentionally broad:
   follow-ups (inbox, calendar, reminders, queued work) and surface anything urgent.
 - **Human check-in**: “Checkup sometimes on your human during day time” nudges an
   occasional lightweight “anything you need?” message, but avoids night-time spam
-  by using your configured local timezone (see [/concepts/timezone](/concepts/timezone)).
+  by using your configured local timezone (see [/concepts/timezone](/nb/concepts/timezone)).
 
 If you want a heartbeat to do something very specific (e.g. “check Gmail PubSub
 stats” or “verify gateway health”), set `agents.defaults.heartbeat.prompt` (or
@@ -218,8 +218,8 @@ Use `accountId` to target a specific account on multi-account channels like Tele
 - `isolatedSession`: when true, each heartbeat runs in a fresh session with no prior conversation history. Uses the same isolation pattern as cron `sessionTarget: "isolated"`. Dramatically reduces per-heartbeat token cost. Combine with `lightContext: true` for maximum savings. Delivery routing still uses the main session context.
 - `session`: optional session key for heartbeat runs.
   - `main` (default): agent main session.
-  - Explicit session key (copy from `pllan sessions --json` or the [sessions CLI](/cli/sessions)).
-  - Session key formats: see [Sessions](/concepts/session) and [Groups](/channels/groups).
+  - Explicit session key (copy from `pllan sessions --json` or the [sessions CLI](/nb/cli/sessions)).
+  - Session key formats: see [Sessions](/nb/concepts/session) and [Groups](/nb/channels/groups).
 - `target`:
   - `last`: deliver to the last used external channel.
   - explicit channel: `whatsapp` / `telegram` / `discord` / `googlechat` / `slack` / `msteams` / `signal` / `imessage`.

package/docs/nb/gateway/index.md

@@ -10,16 +10,16 @@ title: "Gateway-handbok"
 Bruk denne siden for dag 1-oppstart og dag 2-drift av Gateway-tjenesten.
 
 <CardGroup cols={2}>
-  <Card title="Dypere feilsoking" icon="siren" href="/gateway/troubleshooting">
+  <Card title="Dypere feilsoking" icon="siren" href="/nb/gateway/troubleshooting">
     Symptomforst-diagnostikk med noyaktige kommandostiger og loggsignaturer.
   </Card>
-  <Card title="Konfigurasjon" icon="sliders" href="/gateway/configuration">
+  <Card title="Konfigurasjon" icon="sliders" href="/nb/gateway/configuration">
     Oppgaveorientert oppsettguide + fullstendig konfigurasjonsreferanse.
   </Card>
-  <Card title="Hemmelighetshindtering" icon="key-round" href="/gateway/secrets">
+  <Card title="Hemmelighetshindtering" icon="key-round" href="/nb/gateway/secrets">
     SecretRef-kontrakt, kjoringstidsbildeoppforsel og migrer/last-pa-nytt-operasjoner.
   </Card>
-  <Card title="Hemmelighetsplankontrakt" icon="shield-check" href="/gateway/secrets-plan-contract">
+  <Card title="Hemmelighetsplankontrakt" icon="shield-check" href="/nb/gateway/secrets-plan-contract">
     Noyaktige `secrets apply` mal/sti-regler og ref-kun autentiseringsprofil-oppforsel.
   </Card>
 </CardGroup>
@@ -120,7 +120,7 @@ Koble deretter klienter til `ws://127.0.0.1:18789` lokalt.
 Hvis gateway-autentisering er konfigurert, ma klienter fortsatt sende autentisering (`token`/`password`) selv over SSH-tunneler.
 </Warning>
 
-Se: [Fjerngateway](/gateway/remote), [Autentisering](/gateway/authentication), [Tailscale](/gateway/tailscale).
+Se: [Fjerngateway](/nb/gateway/remote), [Autentisering](/nb/gateway/authentication), [Tailscale](/nb/gateway/tailscale).
 
 ## Overvaking og tjenestelivssyklus
 
@@ -187,7 +187,7 @@ PLLAN_CONFIG_PATH=~/.pllan/a.json PLLAN_STATE_DIR=~/.pllan-a pllan gateway --por
 PLLAN_CONFIG_PATH=~/.pllan/b.json PLLAN_STATE_DIR=~/.pllan-b pllan gateway --port 19002
 ```
 
-Se: [Flere gateways](/gateway/multiple-gateways).
+Se: [Flere gateways](/nb/gateway/multiple-gateways).
 
 ## Vanlige feilsignaturer
 
@@ -198,7 +198,7 @@ Se: [Flere gateways](/gateway/multiple-gateways).
 | `Gateway start blocked: set gateway.mode=local`                | Konfig satt til fjernmodus                |
 | `unauthorized` under tilkobling                                | Autentiseringsmismatch mellom klient og gateway |
 
-For fullstendige diagnosestiger, bruk [Gateway-feilsoking](/gateway/troubleshooting).
+For fullstendige diagnosestiger, bruk [Gateway-feilsoking](/nb/gateway/troubleshooting).
 
 ## Sikkerhetsgarantier
 
@@ -210,9 +210,9 @@ For fullstendige diagnosestiger, bruk [Gateway-feilsoking](/gateway/troubleshoot
 
 Relatert:
 
-- [Feilsoking](/gateway/troubleshooting)
-- [Bakgrunnsprosess](/gateway/background-process)
-- [Konfigurasjon](/gateway/configuration)
-- [Helse](/gateway/health)
-- [Doktor](/gateway/doctor)
-- [Autentisering](/gateway/authentication)
+- [Feilsoking](/nb/gateway/troubleshooting)
+- [Bakgrunnsprosess](/nb/gateway/background-process)
+- [Konfigurasjon](/nb/gateway/configuration)
+- [Helse](/nb/gateway/health)
+- [Doktor](/nb/gateway/doctor)
+- [Autentisering](/nb/gateway/authentication)

package/docs/nb/gateway/local-models.md

@@ -9,9 +9,9 @@ title: "Local Models"
 
 # Local models
 
-Local is doable, but Pllan expects large context + strong defenses against prompt injection. Small cards truncate context and leak safety. Aim high: **≥2 maxed-out Mac Studios or equivalent GPU rig (~$30k+)**. A single **24 GB** GPU works only for lighter prompts with higher latency. Use the **largest / full-size model variant you can run**; aggressively quantized or “small” checkpoints raise prompt-injection risk (see [Security](/gateway/security)).
+Local is doable, but Pllan expects large context + strong defenses against prompt injection. Small cards truncate context and leak safety. Aim high: **≥2 maxed-out Mac Studios or equivalent GPU rig (~$30k+)**. A single **24 GB** GPU works only for lighter prompts with higher latency. Use the **largest / full-size model variant you can run**; aggressively quantized or “small” checkpoints raise prompt-injection risk (see [Security](/nb/gateway/security)).
 
-If you want the lowest-friction local setup, start with [Ollama](/providers/ollama) and `pllan onboard`. This page is the opinionated guide for higher-end local stacks and custom OpenAI-compatible local servers.
+If you want the lowest-friction local setup, start with [Ollama](/nb/providers/ollama) and `pllan onboard`. This page is the opinionated guide for higher-end local stacks and custom OpenAI-compatible local servers.
 
 ## Recommended: LM Studio + MiniMax M2.5 (Responses API, full-size)
 

package/docs/nb/gateway/logging.md

@@ -8,7 +8,7 @@ title: "Logging"
 
 # Logging
 
-For a user-facing overview (CLI + Control UI + config), see [/logging](/logging).
+For a user-facing overview (CLI + Control UI + config), see [/logging](/nb/logging).
 
 Pllan has two log “surfaces”:
 

package/docs/nb/gateway/network-model.md

@@ -12,11 +12,11 @@ process that owns channel connections and the WebSocket control plane.
 
 ## Core rules
 
-- One Gateway per host is recommended. It is the only process allowed to own the WhatsApp Web session. For rescue bots or strict isolation, run multiple gateways with isolated profiles and ports. See [Multiple gateways](/gateway/multiple-gateways).
+- One Gateway per host is recommended. It is the only process allowed to own the WhatsApp Web session. For rescue bots or strict isolation, run multiple gateways with isolated profiles and ports. See [Multiple gateways](/nb/gateway/multiple-gateways).
 - Loopback first: the Gateway WS defaults to `ws://127.0.0.1:18789`. The wizard generates a gateway token by default, even for loopback. For tailnet access, run `pllan gateway --bind tailnet --token ...` because tokens are required for non-loopback binds.
 - Nodes connect to the Gateway WS over LAN, tailnet, or SSH as needed. The legacy TCP bridge is deprecated.
 - Canvas host is served by the Gateway HTTP server on the **same port** as the Gateway (default `18789`):
   - `/__pllan__/canvas/`
   - `/__pllan__/a2ui/`
-    When `gateway.auth` is configured and the Gateway binds beyond loopback, these routes are protected by Gateway auth. Node clients use node-scoped capability URLs tied to their active WS session. See [Gateway configuration](/gateway/configuration) (`canvasHost`, `gateway`).
-- Remote use is typically SSH tunnel or tailnet VPN. See [Remote access](/gateway/remote) and [Discovery](/gateway/discovery).
+    When `gateway.auth` is configured and the Gateway binds beyond loopback, these routes are protected by Gateway auth. Node clients use node-scoped capability URLs tied to their active WS session. See [Gateway configuration](/nb/gateway/configuration) (`canvasHost`, `gateway`).
+- Remote use is typically SSH tunnel or tailnet VPN. See [Remote access](/nb/gateway/remote) and [Discovery](/nb/gateway/discovery).

package/docs/nb/gateway/openai-http-api.md

@@ -39,7 +39,7 @@ Treat this endpoint as a **full operator-access** surface for the gateway instan
 - If the target agent policy allows sensitive tools, this endpoint can use them.
 - Keep this endpoint on loopback/tailnet/private ingress only; do not expose it directly to the public internet.
 
-See [Security](/gateway/security) and [Remote access](/gateway/remote).
+See [Security](/nb/gateway/security) and [Remote access](/nb/gateway/remote).
 
 ## Choosing an agent
 

package/docs/nb/gateway/openresponses-http-api.md

@@ -20,7 +20,7 @@ Under the hood, requests are executed as a normal Gateway agent run (same codepa
 
 ## Authentication, security, and routing
 
-Operational behavior matches [OpenAI Chat Completions](/gateway/openai-http-api):
+Operational behavior matches [OpenAI Chat Completions](/nb/gateway/openai-http-api):
 
 - use `Authorization: Bearer <token>` with the normal Gateway auth config
 - treat the endpoint as full operator access for the gateway instance
@@ -224,7 +224,7 @@ Security note:
 - URL allowlists are enforced before fetch and on redirect hops.
 - Allowlisting a hostname does not bypass private/internal IP blocking.
 - For internet-exposed gateways, apply network egress controls in addition to app-level guards.
-  See [Security](/gateway/security).
+  See [Security](/nb/gateway/security).
 
 ## Streaming (SSE)
 

package/docs/nb/gateway/openshell.md

@@ -14,7 +14,7 @@ containers locally, Pllan delegates sandbox lifecycle to the `openshell` CLI,
 which provisions remote environments with SSH-based command execution.
 
 The OpenShell plugin reuses the same core SSH transport and remote filesystem
-bridge as the generic [SSH backend](/gateway/sandboxing#ssh-backend). It adds
+bridge as the generic [SSH backend](/nb/gateway/sandboxing#ssh-backend). It adds
 OpenShell-specific lifecycle (`sandbox create/get/delete`, `sandbox ssh-config`)
 and an optional `mirror` workspace mode.
 
@@ -147,7 +147,7 @@ All OpenShell config lives under `plugins.entries.openshell.config`:
 
 Sandbox-level settings (`mode`, `scope`, `workspaceAccess`) are configured under
 `agents.defaults.sandbox` as with any backend. See
-[Sandboxing](/gateway/sandboxing) for the full matrix.
+[Sandboxing](/nb/gateway/sandboxing) for the full matrix.
 
 ## Examples
 
@@ -301,7 +301,7 @@ pllan sandbox recreate --all
 
 ## See also
 
-- [Sandboxing](/gateway/sandboxing) -- modes, scopes, and backend comparison
-- [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging blocked tools
-- [Multi-Agent Sandbox and Tools](/tools/multi-agent-sandbox-tools) -- per-agent overrides
-- [Sandbox CLI](/cli/sandbox) -- `pllan sandbox` commands
+- [Sandboxing](/nb/gateway/sandboxing) -- modes, scopes, and backend comparison
+- [Sandbox vs Tool Policy vs Elevated](/nb/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging blocked tools
+- [Multi-Agent Sandbox and Tools](/nb/tools/multi-agent-sandbox-tools) -- per-agent overrides
+- [Sandbox CLI](/nb/cli/sandbox) -- `pllan sandbox` commands