thepopebot 1.2.76-beta.2 → 1.2.76-beta.21

package/lib/tools/assemblyai.js

@@ -0,0 +1,17 @@
+import { AssemblyAI } from 'assemblyai';
+import { getConfig } from '../config.js';
+
+function isAssemblyAIEnabled() {
+  return Boolean(getConfig('ASSEMBLYAI_API_KEY'));
+}
+
+async function transcribeAudio(audioBuffer) {
+  const client = new AssemblyAI({ apiKey: getConfig('ASSEMBLYAI_API_KEY') });
+  const transcript = await client.transcripts.transcribe({ audio: audioBuffer });
+  if (transcript.status === 'error') {
+    throw new Error(`AssemblyAI error: ${transcript.error}`);
+  }
+  return transcript.text;
+}
+
+export { isAssemblyAIEnabled, transcribeAudio };

package/lib/tools/create-agent-job.js

@@ -1,22 +1,23 @@
 import { v4 as uuidv4 } from 'uuid';
 import { z } from 'zod';
 import { githubApi } from './github.js';
-import { createModel } from '../ai/model.js';
+import { callHelperLlmStructured } from '../ai/helper-llm.js';
 import { getConfig } from '../config.js';
 /**
- * Generate a short descriptive title for an agent job using the LLM.
+ * Generate a short descriptive title for an agent job using the helper LLM.
  * Uses structured output to avoid thinking-token leaks with extended-thinking models.
  * @param {string} agentJobDescription - The full job description
  * @returns {Promise<string>} ~10 word title
  */
 async function generateAgentJobTitle(agentJobDescription) {
   try {
-    const model = await createModel({ maxTokens: 100 });
-    const response = await model.withStructuredOutput(z.object({ title: z.string() })).invoke([
-      ['system', 'Generate a descriptive ~10 word title for this agent job. The title should clearly describe what the job will do.'],
-      ['human', agentJobDescription],
-    ]);
-    return response.title.trim() || agentJobDescription.slice(0, 80);
+    const result = await callHelperLlmStructured({
+      system: 'Generate a descriptive ~10 word title for this agent job. The title should clearly describe what the job will do.',
+      user: agentJobDescription,
+      schema: z.object({ title: z.string() }),
+      maxTokens: 100,
+    });
+    return result?.title?.trim() || agentJobDescription.slice(0, 80);
   } catch {
     // Fallback: first line, truncated
     const firstLine = agentJobDescription.split('\n').find(l => l.trim()) || agentJobDescription;
@@ -51,6 +52,8 @@ async function createAgentJob(agentJobDescription, options = {}) {
   const config = { title, job: agentJobDescription };
   if (options.llmModel) config.llm_model = options.llmModel;
   if (options.agentBackend) config.agent_backend = options.agentBackend;
+  if (options.scope) config.scope = options.scope;
+  if (options.systemPrompt) config.system_prompt = options.systemPrompt;
 
   const treeEntries = [
     {
@@ -99,6 +102,7 @@ async function createAgentJob(agentJobDescription, options = {}) {
     description: agentJobDescription,
     codingAgent: options.agentBackend,
     llmModel: options.llmModel,
+    scope: options.scope,
   }).catch(err => {
     console.error(`[agent-job] Failed to launch container for ${agentJobId}:`, err.message);
   });

package/lib/tools/docker.js

@@ -196,9 +196,11 @@ async function runContainer({ containerName, image, env = [], workingDir, hostCo
  * @param {string} [options.featureBranch] - Feature branch to create after cloning
  * @param {string} [options.workspaceId] - Workspace ID (for bind mount)
  * @param {boolean} [options.injectSecrets] - Inject agent job secrets into container env
+ * @param {string} [options.systemPrompt] - Pre-rendered system prompt (written to volume as SYSTEM.md)
+ * @param {string} [options.scope] - Subdirectory scope within the repo (e.g., 'agents/gary-v')
  * @returns {Promise<{containerId: string, containerName: string}>}
  */
-async function runInteractiveContainer({ containerName, repo, branch, codingAgent, featureBranch, workspaceId, injectSecrets, continueSession = true }) {
+async function runInteractiveContainer({ containerName, repo, branch, codingAgent, featureBranch, workspaceId, injectSecrets, systemPrompt, continueSession = true, scope }) {
   const agent = codingAgent || getConfig('CODING_AGENT') || 'claude-code';
   const version = process.env.THEPOPEBOT_VERSION;
   const image = `stephengpope/thepopebot:coding-agent-${agent}-${version}`;
@@ -223,6 +225,9 @@ async function runInteractiveContainer({ containerName, repo, branch, codingAgen
   if (continueSession) {
     env.push(`CONTINUE_SESSION=1`);
   }
+  if (scope) {
+    env.push(`SCOPE=${scope}`);
+  }
 
   // Inject agent job secrets when running in agent chat mode
   if (injectSecrets) {
@@ -246,8 +251,16 @@ async function runInteractiveContainer({ containerName, repo, branch, codingAgen
     const dir = workspaceDir(workspaceId);
     const wsDir = path.join(dir, 'workspace');
     fs.mkdirSync(wsDir, { recursive: true });
-    fs.chownSync(dir, CODING_AGENT_UID, CODING_AGENT_UID);
-    fs.chownSync(wsDir, CODING_AGENT_UID, CODING_AGENT_UID);
+
+    // Write pre-rendered system prompt to volume (read by container setup scripts)
+    const systemPromptPath = path.join(dir, 'SYSTEM.md');
+    if (systemPrompt) {
+      fs.writeFileSync(systemPromptPath, systemPrompt, 'utf8');
+    } else {
+      // Remove stale prompt if no system prompt for this mode
+      try { fs.unlinkSync(systemPromptPath); } catch {}
+    }
+
     const hostDir = await resolveHostPath(dir);
     hostConfig.Binds = [`${hostDir}:/home/coding-agent`];
   }
@@ -397,9 +410,10 @@ function buildAgentAuthEnv(agent) {
  * @param {string} [options.systemPrompt] - Optional system prompt
  * @param {boolean} [options.continueSession] - Continue most recent session
  * @param {boolean} [options.injectSecrets] - Inject agent job secrets into container env
+ * @param {string} [options.scope] - Subdirectory scope within the repo (e.g., 'agents/gary-v')
  * @returns {Promise<{containerId: string, containerName: string}>}
  */
-async function runHeadlessContainer({ containerName, repo, branch, featureBranch, workspaceId, taskPrompt, mode = 'plan', codingAgent, systemPrompt, continueSession = true, injectSecrets }) {
+async function runHeadlessContainer({ containerName, repo, branch, featureBranch, workspaceId, taskPrompt, mode = 'plan', codingAgent, systemPrompt, continueSession = true, injectSecrets, scope }) {
   const agent = codingAgent || getConfig('CODING_AGENT') || 'claude-code';
   const version = process.env.THEPOPEBOT_VERSION;
   const image = `stephengpope/thepopebot:coding-agent-${agent}-${version}`;
@@ -418,12 +432,12 @@ async function runHeadlessContainer({ containerName, repo, branch, featureBranch
     const permission = mode === 'dangerous' ? 'code' : mode;
     env.push(`PERMISSION=${permission}`);
   }
-  if (systemPrompt) {
-    env.push(`SYSTEM_PROMPT=${systemPrompt}`);
-  }
   if (continueSession) {
     env.push(`CONTINUE_SESSION=1`);
   }
+  if (scope) {
+    env.push(`SCOPE=${scope}`);
+  }
 
   // Auth env vars based on agent type
   const { env: authEnv, backendApi } = buildAgentAuthEnv(agent);
@@ -456,8 +470,15 @@ async function runHeadlessContainer({ containerName, repo, branch, featureBranch
     const dir = workspaceDir(workspaceId);
     const wsDir = path.join(dir, 'workspace');
     fs.mkdirSync(wsDir, { recursive: true });
-    fs.chownSync(dir, CODING_AGENT_UID, CODING_AGENT_UID);
-    fs.chownSync(wsDir, CODING_AGENT_UID, CODING_AGENT_UID);
+
+    // Write pre-rendered system prompt to volume (read by container setup scripts)
+    const systemPromptPath = path.join(dir, 'SYSTEM.md');
+    if (systemPrompt) {
+      fs.writeFileSync(systemPromptPath, systemPrompt, 'utf8');
+    } else {
+      try { fs.unlinkSync(systemPromptPath); } catch {}
+    }
+
     const hostDir = await resolveHostPath(dir);
     hostConfig.Binds = [`${hostDir}:/home/coding-agent`];
   }
@@ -859,7 +880,7 @@ async function removeVolume(name) {
  * @param {string} [options.llmModel] - Model override
  * @returns {Promise<{containerId: string, containerName: string, volumeName: string}>}
  */
-async function runAgentJobContainer({ agentJobId, repo, branch, title, description, codingAgent, llmModel }) {
+async function runAgentJobContainer({ agentJobId, repo, branch, title, description, codingAgent, llmModel, scope }) {
   const agent = codingAgent || getConfig('CODING_AGENT') || 'claude-code';
   const version = process.env.THEPOPEBOT_VERSION;
   const image = `stephengpope/thepopebot:coding-agent-${agent}-${version}`;
@@ -883,6 +904,9 @@ async function runAgentJobContainer({ agentJobId, repo, branch, title, descripti
   if (llmModel) {
     env.push(`LLM_MODEL=${llmModel}`);
   }
+  if (scope) {
+    env.push(`SCOPE=${scope}`);
+  }
 
   // Auth env vars based on agent type
   const { env: authEnv, backendApi } = buildAgentAuthEnv(agent);

package/lib/tools/github.js

@@ -251,6 +251,38 @@ async function listBranches(repoFullName) {
   }));
 }
 
+/**
+ * Get the default branch name for a repository.
+ * @param {string} repoFullName - e.g. "owner/repo"
+ * @returns {Promise<string|null>}
+ */
+async function getDefaultBranch(repoFullName) {
+  if (!repoFullName) return null;
+  const [owner, repo] = repoFullName.split('/');
+  if (!owner || !repo) return null;
+  try {
+    const info = await githubApi(`/repos/${owner}/${repo}`);
+    return info?.default_branch || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Create a new repository for the authenticated user.
+ * Uses auto_init to create an initial README commit (which creates the default branch).
+ * @param {string} name - Repository name
+ * @returns {Promise<{full_name: string, default_branch: string}>}
+ */
+async function createRepository(name) {
+  const data = await githubApi('/user/repos', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ name, auto_init: true, private: true }),
+  });
+  return { full_name: data.full_name, default_branch: data.default_branch };
+}
+
 export {
   githubApi,
   getWorkflowRuns,
@@ -262,4 +294,6 @@ export {
   getOpenPullRequests,
   listRepositories,
   listBranches,
+  getDefaultBranch,
+  createRepository,
 };

package/lib/tools/telegram.js

@@ -1,9 +1,75 @@
 import { Bot } from 'grammy';
 import parseModePlugin from '@grammyjs/parse-mode';
+import { randomBytes } from 'crypto';
 const { hydrateReply } = parseModePlugin;
 
 const MAX_LENGTH = 4096;
 
+/**
+ * Validate a Telegram bot token by calling getMe.
+ * @param {string} botToken
+ * @returns {Promise<{valid: boolean, botInfo?: object, error?: string}>}
+ */
+async function validateBotToken(botToken) {
+  try {
+    const response = await fetch(`https://api.telegram.org/bot${botToken}/getMe`);
+    const result = await response.json();
+    if (result.ok) return { valid: true, botInfo: result.result };
+    return { valid: false, error: result.description };
+  } catch (err) {
+    return { valid: false, error: err.message };
+  }
+}
+
+/**
+ * Register a Telegram webhook (deletes any existing webhook first).
+ * @param {string} botToken
+ * @param {string} webhookUrl
+ * @param {string} [secretToken]
+ * @returns {Promise<object>} Telegram API response
+ */
+async function setTelegramWebhook(botToken, webhookUrl, secretToken = null) {
+  // Delete first — Telegram ignores secret_token changes if the URL is unchanged
+  await deleteTelegramWebhook(botToken);
+  const body = { url: webhookUrl };
+  if (secretToken) body.secret_token = secretToken;
+  const response = await fetch(`https://api.telegram.org/bot${botToken}/setWebhook`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  return response.json();
+}
+
+/**
+ * Get current webhook info from Telegram.
+ * @param {string} botToken
+ * @returns {Promise<object>}
+ */
+async function getTelegramWebhookInfo(botToken) {
+  const response = await fetch(`https://api.telegram.org/bot${botToken}/getWebhookInfo`);
+  return response.json();
+}
+
+/**
+ * Delete the current webhook.
+ * @param {string} botToken
+ * @returns {Promise<object>}
+ */
+async function deleteTelegramWebhook(botToken) {
+  const response = await fetch(`https://api.telegram.org/bot${botToken}/deleteWebhook`, {
+    method: 'POST',
+  });
+  return response.json();
+}
+
+/**
+ * Generate a random webhook secret (64 hex chars).
+ */
+function generateWebhookSecret() {
+  return randomBytes(32).toString('hex');
+}
+
 /**
  * Convert markdown to Telegram-compatible HTML.
  * Handles: code blocks, inline code, links, bold, italic, strikethrough, headings, lists.
@@ -278,6 +344,40 @@ function startTypingIndicator(botToken, chatId) {
   };
 }
 
+/**
+ * Format a tool call as a compact one-liner for Telegram.
+ * @param {string} toolName - e.g. 'Read', 'Edit', 'Bash', 'Grep'
+ * @param {object} args - Tool arguments
+ * @returns {string} Formatted HTML string
+ */
+function formatToolCall(toolName, args) {
+  let detail = '';
+
+  if (args.file_path) {
+    // Read, Edit, Write — show the file path (basename + parent)
+    const parts = args.file_path.split('/');
+    detail = parts.length > 2 ? parts.slice(-2).join('/') : parts.pop();
+  } else if (args.command) {
+    // Bash — show the command, truncated
+    detail = args.command.length > 60 ? args.command.slice(0, 57) + '...' : args.command;
+  } else if (args.pattern) {
+    // Grep, Glob — show the pattern
+    detail = args.pattern;
+    if (args.path) {
+      const parts = args.path.split('/');
+      detail += ` in ${parts.length > 2 ? parts.slice(-2).join('/') : parts.pop()}`;
+    }
+  } else if (args.prompt) {
+    // Agent — show truncated prompt
+    detail = args.prompt.length > 50 ? args.prompt.slice(0, 47) + '...' : args.prompt;
+  } else if (args.description) {
+    detail = args.description;
+  }
+
+  const escaped = escapeHtml(detail);
+  return `⚙️ <code>${escapeHtml(toolName)}</code>  ${escaped}`;
+}
+
 export {
   getBot,
   setWebhook,
@@ -285,8 +385,14 @@ export {
   smartSplit,
   escapeHtml,
   markdownToTelegramHtml,
+  formatToolCall,
   formatJobNotification,
   downloadFile,
   reactToMessage,
   startTypingIndicator,
+  validateBotToken,
+  setTelegramWebhook,
+  getTelegramWebhookInfo,
+  deleteTelegramWebhook,
+  generateWebhookSecret,
 };

package/lib/utils/render-md.js

@@ -2,27 +2,43 @@ import fs from 'fs';
 import path from 'path';
 import { PROJECT_ROOT } from '../paths.js';
 
-const skillsDir = path.join(PROJECT_ROOT, 'skills');
-
 const INCLUDE_PATTERN = /\{\{([^}]+\.md)\}\}/g;
 const VARIABLE_PATTERN = /\{\{(datetime|skills)\}\}/gi;
 
-// Scan skill directories under skills/active/ for SKILL.md files and extract
-// description from YAML frontmatter. Returns a bullet list of descriptions.
-function loadSkillDescriptions() {
-  const activeDir = path.join(skillsDir, 'active');
+// Default skills directory (used when no explicit skillsDir is provided)
+const defaultSkillsDir = path.join(PROJECT_ROOT, 'skills');
+
+/**
+ * Scan a skills directory for SKILL.md files and extract descriptions
+ * from YAML frontmatter. Returns a bullet list of descriptions.
+ *
+ * @param {string|null} [skillsDir] - Absolute path to skills directory.
+ *   Falls back to PROJECT_ROOT/skills if not provided.
+ * @returns {string}
+ */
+function loadSkillDescriptions(skillsDir) {
+  const dir = skillsDir || defaultSkillsDir;
   try {
-    if (!fs.existsSync(activeDir)) {
+    if (!fs.existsSync(dir)) {
       return 'No additional abilities configured.';
     }
 
-    const entries = fs.readdirSync(activeDir, { withFileTypes: true });
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
     const descriptions = [];
 
     for (const entry of entries) {
-      if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
+      // Follow symlinks — resolve to check if target is a directory
+      const entryPath = path.join(dir, entry.name);
+      let isDir = entry.isDirectory() || entry.isSymbolicLink();
+      if (entry.isSymbolicLink()) {
+        try {
+          const stat = fs.statSync(entryPath);
+          isDir = stat.isDirectory();
+        } catch { continue; } // broken symlink
+      }
+      if (!isDir) continue;
 
-      const skillMdPath = path.join(activeDir, entry.name, 'SKILL.md');
+      const skillMdPath = path.join(entryPath, 'SKILL.md');
       if (!fs.existsSync(skillMdPath)) continue;
 
       const content = fs.readFileSync(skillMdPath, 'utf8');
@@ -32,7 +48,7 @@ function loadSkillDescriptions() {
       const frontmatter = frontmatterMatch[1];
       const descMatch = frontmatter.match(/^description:\s*(.+)$/m);
       if (descMatch) {
-        descriptions.push(`- ${descMatch[1].trim()}`);
+        descriptions.push(`- **${entry.name}**: ${descMatch[1].trim()}`);
       }
     }
 
@@ -49,15 +65,17 @@ function loadSkillDescriptions() {
 /**
  * Resolve built-in variables like {{datetime}} and {{skills}}.
  * @param {string} content - Content with possible variable placeholders
+ * @param {object} [vars] - Variable overrides
+ * @param {string|null} [vars.skillsDir] - Skills directory for {{skills}} resolution
  * @returns {string} Content with variables resolved
  */
-function resolveVariables(content) {
+function resolveVariables(content, vars = {}) {
   return content.replace(VARIABLE_PATTERN, (match, variable) => {
     switch (variable.toLowerCase()) {
       case 'datetime':
         return new Date().toISOString();
       case 'skills':
-        return loadSkillDescriptions();
+        return loadSkillDescriptions(vars.skillsDir || null);
       default:
         return match;
     }
@@ -69,10 +87,18 @@ function resolveVariables(content) {
  * and {{datetime}}, {{skills}} built-in variables.
  * Referenced file paths resolve relative to the project root.
  * @param {string} filePath - Absolute path to the markdown file
- * @param {string[]} [chain=[]] - Already-resolved file paths (for circular detection)
+ * @param {object} [options] - Render options
+ * @param {string|null} [options.skillsDir] - Skills directory for {{skills}} resolution
+ * @param {string[]} [options._chain] - Internal: already-resolved file paths (circular detection)
  * @returns {string} Rendered markdown content
  */
-function render_md(filePath, chain = []) {
+function render_md(filePath, options = {}) {
+  // Support legacy positional arg: render_md(path, chain)
+  if (Array.isArray(options)) {
+    options = { _chain: options };
+  }
+
+  const chain = options._chain || [];
   const resolved = path.resolve(filePath);
 
   if (chain.includes(resolved)) {
@@ -93,10 +119,10 @@ function render_md(filePath, chain = []) {
     if (!fs.existsSync(includeResolved)) {
       return match;
     }
-    return render_md(includeResolved, currentChain);
+    return render_md(includeResolved, { ...options, _chain: currentChain });
   });
 
-  return resolveVariables(withIncludes);
+  return resolveVariables(withIncludes, { skillsDir: options.skillsDir || null });
 }
 
-export { render_md };
+export { render_md, loadSkillDescriptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thepopebot",
-  "version": "1.2.76-beta.2",
+  "version": "1.2.76-beta.21",
   "type": "module",
   "description": "Create autonomous AI agents with a two-layer architecture: Next.js Event Handler + Docker Agent.",
   "bin": {
@@ -19,6 +19,7 @@
     "./db/oauth-tokens": "./lib/db/oauth-tokens.js",
     "./chat": "./lib/chat/components/index.js",
     "./chat/actions": "./lib/chat/actions.js",
+    "./chat/telegram-profile": "./lib/chat/telegram-profile.js",
     "./code": "./lib/code/index.js",
     "./code/actions": "./lib/code/actions.js",
     "./code/ws-proxy": "./lib/code/ws-proxy.js",
@@ -67,19 +68,17 @@
   "author": "Stephen Pope",
   "license": "MIT",
   "dependencies": {
+    "@ai-sdk/anthropic": "^2.0.0",
+    "@ai-sdk/google": "^2.0.0",
+    "@ai-sdk/openai": "^2.0.0",
+    "@ai-sdk/openai-compatible": "^1.0.0",
     "@ai-sdk/react": "^2.0.0",
-    "@anthropic-ai/claude-agent-sdk": "^0.2.92",
+    "@anthropic-ai/claude-agent-sdk": "^0.2.101",
     "@clack/prompts": "^0.10.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/modifiers": "^9.0.0",
     "@dnd-kit/sortable": "^10.0.0",
     "@grammyjs/parse-mode": "^2.2.0",
-    "@langchain/anthropic": "^1.3.17",
-    "@langchain/core": "^1.1.24",
-    "@langchain/google-genai": "^2.1.18",
-    "@langchain/langgraph": "^1.1.4",
-    "@langchain/langgraph-checkpoint-sqlite": "^1.0.1",
-    "@langchain/openai": "^1.2.7",
     "@monaco-editor/react": "^4.7.0",
     "@xterm/addon-fit": "^0.10.0",
     "@xterm/addon-search": "^0.15.0",
@@ -87,6 +86,7 @@
     "@xterm/addon-web-links": "^0.11.0",
     "@xterm/xterm": "^5.5.0",
     "ai": "^5.0.0",
+    "assemblyai": "^4.30.0",
     "bcrypt-ts": "^6.0.0",
     "better-sqlite3": "^12.6.2",
     "chalk": "^5.3.0",

package/setup/CLAUDE.md

@@ -4,13 +4,19 @@ Entry point: `setup.mjs` (invoked via `thepopebot setup`).
 
 ## Wizard Steps
 
-1. **Prerequisites** — Checks Node.js (>=18), git, gh CLI (authenticated), Docker. Initializes git repo and GitHub remote if needed.
-2. **GitHub PAT** — Validates fine-grained token with required scopes (Actions, Admin, Contents, PRs, Secrets, Workflows).
-3. **App URL** — Prompts for public HTTPS URL (ngrok, VPS, PaaS). Generates webhook secret.
-4. **Sync Config** — Writes secrets/variables to GitHub and local DB via `syncConfig()`.
-5. **Build** — Runs `npm run build` with retry.
+1. **Load `.env`** — `dotenv.config()` runs first so existing values are available to subsequent steps.
+2. **Prerequisites** — Checks Node.js (>=18), git, gh CLI (authenticated), Docker. Initializes git repo and GitHub remote if needed.
+3. **GitHub PAT** — Validates fine-grained token with required scopes (Actions, Admin, Contents, PRs, Secrets, Workflows).
+4. **App URL** — Prompts for public HTTPS URL (ngrok, VPS, PaaS). Generates webhook secret.
+5. **Sync Config** — Writes secrets/variables to GitHub and local DB via `syncConfig()`.
 6. **Start Server** — Starts Docker containers, polls `/api/ping` to confirm.
 
+The setup wizard does NOT run `npm run build` — `.next` is baked into the event-handler Docker image at publish time.
+
+## Database
+
+Settings DB defaults to `data/db/thepopebot.sqlite` (relative to project root). Override via `DATABASE_PATH` in `.env`. Schema migrations run automatically on server start (`lib/db/index.js`).
+
 ## Sync Target Types
 
 Config values are synced to different targets via `lib/sync.mjs`:

package/setup/lib/providers.mjs

@@ -14,7 +14,8 @@ export const PROVIDERS = {
     builtin: true,
     oauthSupported: true,
     models: [
-      { id: 'claude-opus-4-6', name: 'Claude Opus 4.6', default: true },
+      { id: 'claude-opus-4-7', name: 'Claude Opus 4.7', default: true },
+      { id: 'claude-opus-4-6', name: 'Claude Opus 4.6' },
       { id: 'claude-sonnet-4-6', name: 'Claude Sonnet 4.6' },
       { id: 'claude-haiku-4-5-20251001', name: 'Claude Haiku 4.5' },
     ],

package/setup/lib/targets.mjs

@@ -15,24 +15,22 @@
  */
 export const CONFIG_TARGETS = {
   // Secrets → DB encrypted (never .env)
-  GH_TOKEN:              { env: true, dbSecret: true, secret: 'AGENT_GH_TOKEN' },
-  ANTHROPIC_API_KEY:     { dbSecret: true, secret: 'AGENT_ANTHROPIC_API_KEY' },
-  OPENAI_API_KEY:        { dbSecret: true, secret: 'AGENT_OPENAI_API_KEY' },
-  GOOGLE_API_KEY:        { dbSecret: true, secret: 'AGENT_GOOGLE_API_KEY' },
-  CUSTOM_API_KEY:        { dbSecret: true, secret: 'AGENT_CUSTOM_API_KEY' },
-  MOONSHOT_API_KEY:      { dbSecret: true, secret: 'AGENT_MOONSHOT_API_KEY' },
-  CLAUDE_CODE_OAUTH_TOKEN: { dbSecret: true, secret: 'AGENT_CLAUDE_CODE_OAUTH_TOKEN' },
+  GH_TOKEN:              { env: true, dbSecret: true },
+  ANTHROPIC_API_KEY:     { dbSecret: true },
+  OPENAI_API_KEY:        { dbSecret: true },
+  GOOGLE_API_KEY:        { dbSecret: true },
+  CUSTOM_API_KEY:        { dbSecret: true },
+  MOONSHOT_API_KEY:      { dbSecret: true },
+  CLAUDE_CODE_OAUTH_TOKEN: { dbSecret: true },
   GH_WEBHOOK_SECRET:     { dbSecret: true, secret: true },
   TELEGRAM_BOT_TOKEN:    { dbSecret: true },
   TELEGRAM_WEBHOOK_SECRET: { dbSecret: true },
 
   // Plain config → DB (not .env)
-  LLM_PROVIDER:          { db: true, variable: true },
-  LLM_MODEL:             { db: true, variable: true },
-  CUSTOM_OPENAI_BASE_URL: { db: true, variable: true },
-  AGENT_BACKEND:         { db: true, variable: true },
-  TELEGRAM_CHAT_ID:      { db: true },
-  TELEGRAM_VERIFICATION: { db: true },
+  LLM_PROVIDER:          { db: true },
+  LLM_MODEL:             { db: true },
+  CUSTOM_OPENAI_BASE_URL: { db: true },
+  AGENT_BACKEND:         { db: true },
 
   // Infrastructure → .env only (needed before DB is available)
   GH_OWNER:              { env: true },
@@ -40,9 +38,8 @@ export const CONFIG_TARGETS = {
   APP_URL:               { env: true, variable: true },
   APP_HOSTNAME:          { env: true },
 
-  // GitHub-only
-  BRAVE_API_KEY:         { secret: 'AGENT_LLM_BRAVE_API_KEY' },
+  // GitHub variables consumed by scaffolded workflows
   AUTO_MERGE:            { variable: true, default: 'true', firstRunOnly: true },
-  ALLOWED_PATHS:         { variable: true, default: '/logs', firstRunOnly: true },
+  ALLOWED_PATHS:         { variable: true, default: '/logs,/agents', firstRunOnly: true },
   RUNS_ON:               { variable: true },
 };