zubo 0.1.6 → 0.1.9

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <strong>Your AI agent that never forgets.</strong><br>
-  Persistent memory, 20+ tools, 6 channels, 11+ LLM providers — runs entirely on your machine.
+  Persistent memory, 25+ tools, 7 channels, 11+ LLM providers — runs entirely on your machine.
 </p>
 
 <p align="center">
@@ -27,11 +27,11 @@
 ## Features
 
 - **11+ LLM providers** — Anthropic, OpenAI, Google Gemini, Ollama, Groq, Together, OpenRouter, DeepSeek, xAI, Fireworks, LM Studio, and any OpenAI-compatible endpoint. Smart routing sends simple queries to fast models automatically.
-- **6 channels** — Telegram, Discord, Slack, WhatsApp, Signal, Web Chat
+- **7 channels** — Telegram, Discord, Slack, WhatsApp, Signal, Email, Web Chat
 - **Persistent memory** — Vector + full-text hybrid search with ONNX embeddings and FTS5. Remembers every conversation, preference, and fact — forever.
-- **20+ built-in tools** — Web search, file ops, code execution, APIs, sub-agent delegation, and automatic failover between providers.
+- **25+ built-in tools** — Web search, file ops, code execution, APIs, sub-agent delegation, knowledge graph, reminders, and automatic failover between providers.
 - **Extensible skills** — Build custom skills in TypeScript. Share them on the registry. Install community skills with one command.
-- **7 integrations** — GitHub, Google (Gmail, Calendar, Docs, Drive, Sheets), Notion, Linear, Jira, Slack, Twitter
+- **9 integrations** — GitHub, Google (Gmail, Calendar, Docs, Drive, Sheets), Notion, Linear, Jira, Slack, Twitter + Claude Code and MCP
 - **Workflows** — Multi-agent pipelines with delegation
 - **Natural language scheduling** — "Every weekday at 9am" just works. Cron jobs, heartbeat, proactive tasks.
 - **Voice** — Speech-to-text (Whisper) and text-to-speech (OpenAI, ElevenLabs)
@@ -98,6 +98,7 @@ See the full [configuration reference](https://zubo.bot/docs/config.html) for al
 | **Discord** | Add `channels.discord.botToken` from [Developer Portal](https://discord.com/developers) |
 | **Slack** | Add `channels.slack.botToken` + `appToken` (Socket Mode) |
 | **WhatsApp** | Add `channels.whatsapp`, authenticate via QR |
+| **Email** | Add `channels.email` with IMAP/SMTP settings |
 | **Signal** | Install signal-cli, add `channels.signal.phoneNumber` |
 
 ## Integrations

package/migrations/017_oauth_tokens.sql

@@ -0,0 +1,11 @@
+CREATE TABLE IF NOT EXISTS oauth_tokens (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  provider TEXT NOT NULL UNIQUE,
+  access_token TEXT NOT NULL,
+  refresh_token TEXT,
+  token_type TEXT DEFAULT 'Bearer',
+  expires_at TEXT,
+  scope TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);

package/migrations/018_cron_once.sql

@@ -0,0 +1 @@
+ALTER TABLE cron_jobs ADD COLUMN once INTEGER NOT NULL DEFAULT 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zubo",
-  "version": "0.1.6",
+  "version": "0.1.9",
   "description": "Your AI agent that never forgets. Persistent memory, 25+ tools, 7 channels, 11+ LLM providers — runs entirely on your machine.",
   "license": "MIT",
   "author": "thomaskanze",

package/site/docs/agents.html

@@ -66,6 +66,7 @@
         <div class="docs-sidebar-links">
           <a href="channels.html">Channel Setup</a>
           <a href="integrations.html">Integrations</a>
+          <a href="integrations.html#oauth">OAuth</a>
           <a href="security.html">Security &amp; Auth</a>
         </div>
       </div>
@@ -115,6 +116,65 @@ You are Zubo, a personal AI assistant for Thomas.
 - He prefers metric units and Markdown formatting.</code></pre>
       <p>The system prompt is loaded fresh on every message, so changes take effect immediately without restarting Zubo.</p>
 
+      <h2>Self-Configuration</h2>
+      <p>Zubo can modify its own configuration at runtime through the built-in <code>config_update</code> tool. You do not need to edit <code>config.json</code> by hand &mdash; just tell Zubo what you want to change in plain language and it will update the configuration file for you.</p>
+
+      <h3>What Zubo Can Change</h3>
+      <ul>
+        <li><strong>Switch LLM providers</strong> &mdash; "Use GPT-4o" updates <code>activeProvider</code> to <code>openai</code>.</li>
+        <li><strong>Set budgets</strong> &mdash; "Limit my daily spending to $5" updates <code>budget.dailyLimitUsd</code>.</li>
+        <li><strong>Enable smart routing</strong> &mdash; "Enable smart routing with Groq" updates <code>smartRouting.enabled</code> and <code>smartRouting.fastProvider</code>.</li>
+        <li><strong>Change its name</strong> &mdash; "Call yourself Jarvis" updates <code>agentName</code>.</li>
+        <li><strong>Toggle features</strong> &mdash; Enable or disable channels, change the heartbeat interval, adjust max turns, and more.</li>
+      </ul>
+
+      <h3>What It Cannot Change</h3>
+      <ul>
+        <li><strong>API keys and tokens</strong> &mdash; For security, secrets are never stored through <code>config_update</code>. Zubo uses the separate <code>secret_set</code> tool to securely store API keys, passwords, and tokens.</li>
+        <li><strong>Channel restarts</strong> &mdash; Channel configuration changes (enabling Telegram, changing a bot token) require a restart to take effect.</li>
+      </ul>
+
+      <h3>Example</h3>
+<pre><code>You: I want to switch to Claude Opus for complex tasks but use Groq for simple ones
+
+Zubo: Done! I've set your active provider to Anthropic and enabled smart
+routing with Groq as the fast provider. Simple queries like greetings
+will use Groq (fast, inexpensive), while complex tasks like code
+generation and multi-step reasoning use Claude.
+
+# Under the hood, Zubo called config_update three times:
+#   set activeProvider = "anthropic"
+#   set smartRouting.enabled = true
+#   set smartRouting.fastProvider = "groq"</code></pre>
+
+      <h2>How Zubo Learns</h2>
+      <p>Zubo's memory is organized into three complementary layers, each serving a different purpose. Together, they give the agent persistent, searchable, and structured knowledge that improves over time.</p>
+
+      <h3>1. Conversational Memory</h3>
+      <p>Every conversation session is automatically persisted. Recent messages are always included in the LLM context, so Zubo remembers what you discussed earlier in the same session without any explicit action on your part.</p>
+
+      <h3>2. Semantic Memory</h3>
+      <p>Facts, notes, and documents saved via the <code>memory_write</code> tool are chunked, embedded as 384-dimensional vectors, and indexed for full-text search. When you send a message, Zubo automatically runs a hybrid search (60% vector similarity + 40% keyword matching) to find relevant memories and inject them into the context. See the <a href="memory.html">Memory System</a> page for full details.</p>
+
+      <h3>3. Knowledge Graph</h3>
+      <p>Structured entity-relationship memory captures discrete facts in a queryable format. Entities (people, projects, organizations, concepts) are linked by labeled relationships (works_on, manages, uses). When you mention a known entity, its graph context is automatically injected into the LLM prompt.</p>
+
+      <h3>How the Layers Work Together</h3>
+<pre><code>You: I'm working with Alex on the Horizon project. He handles backend,
+     I do frontend.
+
+Zubo automatically:
+  1. Saves this to semantic memory via memory_write
+  2. Creates KG entities: You (person), Alex (person), Horizon (project)
+  3. Creates KG relations:
+       You --works_on--> Horizon
+       Alex --works_on--> Horizon
+       You --role:frontend--> Horizon
+       Alex --role:backend--> Horizon
+  4. Next time you mention "Alex" or "Horizon", this context is
+     auto-injected into the LLM prompt</code></pre>
+      <p>This means you can teach Zubo facts naturally through conversation, and it will recall them when relevant &mdash; without being asked.</p>
+
       <h2>Creating Custom Agents</h2>
       <p>Custom agents are defined as directories inside <code>~/.zubo/workspace/agents/</code>. Each directory contains a single <code>AGENT.md</code> file that specifies the agent's name, description, system prompt, and allowed tools.</p>
       <p>Here is an example <code>AGENT.md</code> for a research specialist:</p>
@@ -137,6 +197,26 @@ to ensure comprehensive coverage.
         <li><strong>Conversationally</strong> &mdash; Tell Zubo: "Create an agent called research_agent that specializes in web research and has access to web_search, url_fetch, and memory_write." Zubo will generate the <code>AGENT.md</code> for you.</li>
         <li><strong>Programmatically</strong> &mdash; Use the <code>manage_agents</code> tool to create, update, list, or delete agents.</li>
       </ul>
+      <p>Here is an example of creating and using an agent entirely through conversation:</p>
+<pre><code>You: Create an agent called "researcher" that can only search the web
+     and fetch URLs. Its job is deep research.
+
+Zubo: Created agent "researcher" with tools: web_search, url_fetch,
+      http_request. System prompt focused on thorough research and
+      source citation.
+
+You: @researcher Find the top 3 competitors to Linear and compare
+     their pricing
+
+Zubo: [delegates to researcher agent]
+
+      Here's a comparison of Linear's top competitors:
+
+      1. Jira — Free tier for up to 10 users, Standard at $8.15/user/mo...
+      2. Shortcut — Free for up to 10 members, Team at $8.50/user/mo...
+      3. Asana — Free tier available, Premium at $10.99/user/mo...
+
+      Sources: [jira.com, shortcut.com, asana.com]</code></pre>
       <p>Agents have restricted tool access &mdash; they can only use the tools explicitly listed in their <code>## Tools</code> section. This is a key security and reliability feature: a research agent does not need access to your calendar, and a writing agent does not need access to the shell.</p>
 
       <h3>Agent Fields</h3>
@@ -156,8 +236,9 @@ to ensure comprehensive coverage.
       <ul>
         <li><strong>Maximum delegation depth: 2</strong> &mdash; This prevents infinite recursion. The main agent (depth 0) can delegate to a sub-agent (depth 1), which can delegate once more (depth 2), but no further.</li>
         <li><strong>Sub-agents cannot delegate further or access the <code>manage_agents</code> or <code>delegate</code> tools</strong> &mdash; These tools are automatically stripped from sub-agent tool lists to prevent abuse.</li>
+        <li><strong>Immutable security preamble</strong> &mdash; Every sub-agent's system prompt is prefixed with an immutable set of security rules that cannot be overridden by the user-defined agent prompt. These rules prevent sub-agents from revealing secrets, bypassing tool permission levels, delegating to other agents, or modifying their own configuration.</li>
         <li><strong>Each delegation creates a separate session</strong> &mdash; This provides context isolation. The sub-agent's conversation history does not bleed into the main agent's context.</li>
-        <li><strong>Memory is shared</strong> &mdash; Sub-agents can search and write to the same memory store as the main agent, so research findings and facts persist across delegations.</li>
+        <li><strong>Memory is shared</strong> &mdash; Sub-agents share the same memory store (semantic memory and knowledge graph) as the main agent. Research findings, facts, and knowledge graph entities written by a sub-agent are immediately available to the main agent and all other sub-agents.</li>
       </ul>
       <p>Here is an example of how delegation works in practice:</p>
 <pre><code>User: "Research the latest AI news and summarize it"

package/site/docs/api.html

@@ -66,6 +66,7 @@
         <div class="docs-sidebar-links">
           <a href="channels.html">Channel Setup</a>
           <a href="integrations.html">Integrations</a>
+          <a href="integrations.html#oauth">OAuth</a>
           <a href="security.html">Security &amp; Auth</a>
         </div>
       </div>
@@ -231,9 +232,9 @@ Content-Type: application/json
   ]
 }</code></pre>
 
-      <h3>Cron Jobs</h3>
+      <h3>Cron Jobs &amp; Reminders</h3>
 <pre><code>GET /api/dashboard/cron</code></pre>
-      <p>List all configured cron jobs and their status.</p>
+      <p>List all configured cron jobs and one-shot reminders.</p>
       <p><strong>Response:</strong></p>
 <pre><code>{
   "jobs": [
@@ -242,18 +243,313 @@ Content-Type: application/json
       "schedule": "0 9 * * *",
       "task": "Send a daily briefing",
       "enabled": true,
+      "once": false,
       "last_run": "2026-02-12T09:00:00Z"
+    },
+    {
+      "name": "marketing-followup",
+      "schedule": "2026-02-14T15:30:00.000Z",
+      "task": "Hey! Have you worked on marketing yet?",
+      "enabled": true,
+      "once": true,
+      "last_run": null
     }
   ]
 }</code></pre>
+      <p>Jobs with <code>"once": true</code> are one-shot reminders that auto-delete after firing.</p>
+
+      <h3>Providers</h3>
+<pre><code>GET /api/dashboard/providers</code></pre>
+      <p>List all configured LLM providers with masked API keys, the active provider, and the failover order.</p>
+      <p><strong>Response:</strong></p>
+<pre><code>{
+  "providers": [
+    {
+      "name": "anthropic",
+      "model": "claude-sonnet-4-5-20250929",
+      "apiKey": "sk-ant-...xxxx",
+      "baseUrl": "",
+      "contextWindow": null,
+      "streaming": true
+    },
+    {
+      "name": "openai",
+      "model": "gpt-4o",
+      "apiKey": "sk-...xxxx",
+      "baseUrl": "",
+      "contextWindow": null,
+      "streaming": true
+    }
+  ],
+  "activeProvider": "anthropic",
+  "failover": ["openai"]
+}</code></pre>
+<pre><code>PUT /api/dashboard/providers/:name
+Content-Type: application/json
+
+{
+  "model": "gpt-4o",
+  "apiKey": "sk-...",
+  "baseUrl": "",
+  "streaming": true
+}</code></pre>
+      <p>Add or update a provider configuration. If this is the first provider, it is automatically set as active. Masked API key values (containing <code>...</code>) are ignored to preserve the existing key.</p>
+<pre><code>DELETE /api/dashboard/providers/:name</code></pre>
+      <p>Remove a provider. If the deleted provider was active, the first remaining provider is selected. The provider is also removed from the failover list.</p>
+<pre><code>PUT /api/dashboard/providers/active
+Content-Type: application/json
+
+{
+  "provider": "openai"
+}</code></pre>
+      <p>Set the active LLM provider. The change is hot-reloaded into the running agent &mdash; no restart is needed.</p>
+<pre><code>PUT /api/dashboard/providers/failover
+Content-Type: application/json
+
+{
+  "failover": ["openai", "anthropic"]
+}</code></pre>
+      <p>Update the provider failover order. When the active provider fails, the agent tries each failover provider in the order listed.</p>
+
+      <h3>MCP Servers</h3>
+<pre><code>GET /api/dashboard/mcp/servers</code></pre>
+      <p>List all configured MCP (Model Context Protocol) server connections with their current status and tool count.</p>
+      <p><strong>Response:</strong></p>
+<pre><code>{
+  "servers": [
+    {
+      "name": "filesystem",
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-filesystem"],
+      "env": ["HOME"],
+      "enabled": true,
+      "connected": true,
+      "tools": 5
+    }
+  ]
+}</code></pre>
+<pre><code>POST /api/dashboard/mcp/servers
+Content-Type: application/json
+
+{
+  "name": "filesystem",
+  "command": "npx",
+  "args": ["-y", "@modelcontextprotocol/server-filesystem"],
+  "env": { "HOME": "/Users/me" },
+  "enabled": true
+}</code></pre>
+      <p>Add and connect a new MCP server. If a server with the same name already exists, it is replaced. The server is hot-connected immediately if <code>enabled</code> is <code>true</code> (or omitted).</p>
+<pre><code>DELETE /api/dashboard/mcp/servers/:name</code></pre>
+      <p>Disconnect and remove an MCP server. The server process is terminated and the configuration is deleted.</p>
+<pre><code>POST /api/dashboard/mcp/servers/:name/restart</code></pre>
+      <p>Restart an MCP server connection. The server is disconnected and then reconnected using its saved configuration. Returns <code>404</code> if the server is not found.</p>
+
+      <h3>Channels Configuration</h3>
+<pre><code>GET /api/dashboard/channels/config</code></pre>
+      <p>Get all channel configurations with masked tokens and running status. Returns an object keyed by channel name (telegram, discord, slack, whatsapp, signal, email), each containing <code>enabled</code>, <code>configured</code>, <code>running</code>, and <code>config</code> fields.</p>
+<pre><code>PUT /api/dashboard/channels/:name/config
+Content-Type: application/json
+
+{
+  "botToken": "123456:ABC-DEF...",
+  "allowedUsers": ["user1"],
+  "enabled": true
+}</code></pre>
+      <p>Update a channel's configuration. Valid channel names are <code>telegram</code>, <code>discord</code>, <code>slack</code>, <code>whatsapp</code>, <code>signal</code>, and <code>email</code>. If <code>enabled</code> is <code>true</code>, the channel is hot-started immediately. If <code>false</code>, the channel is stopped. Masked token values are preserved.</p>
+<pre><code>PUT /api/dashboard/channels/:name/toggle
+Content-Type: application/json
+
+{
+  "enabled": true
+}</code></pre>
+      <p>Enable or disable a channel with immediate start or stop. The channel must already be configured.</p>
+
+      <h3>OAuth</h3>
+<pre><code>GET /api/dashboard/oauth/status</code></pre>
+      <p>Get OAuth connection status for all supported providers. Returns a list of supported providers and their current connection state, including whether each provider has credentials configured.</p>
+<pre><code>PUT /api/dashboard/oauth/:provider/config
+Content-Type: application/json
+
+{
+  "clientId": "your-client-id",
+  "clientSecret": "your-client-secret"
+}</code></pre>
+      <p>Save OAuth client credentials for a provider (e.g. <code>google</code>, <code>github</code>). These credentials are stored in the config file and used when initiating OAuth authorization flows.</p>
+<pre><code>DELETE /api/dashboard/oauth/:provider/config</code></pre>
+      <p>Remove OAuth client credentials for a provider from the configuration.</p>
+<pre><code>DELETE /api/dashboard/oauth/:provider</code></pre>
+      <p>Disconnect an OAuth provider by revoking its stored tokens. The client credentials remain in the configuration.</p>
+
+      <h3>Budget</h3>
+<pre><code>GET /api/dashboard/budget</code></pre>
+      <p>Get budget configuration and current usage, including today's spend, this month's spend, and a daily breakdown for the last 7 days.</p>
+      <p><strong>Response:</strong></p>
+<pre><code>{
+  "daily_limit_usd": 5.00,
+  "monthly_limit_usd": 100.00,
+  "alert_threshold": 0.8,
+  "paused": false,
+  "today_spend_usd": 1.2345,
+  "month_spend_usd": 42.50,
+  "daily_breakdown": [
+    { "day": "2026-02-13", "cost": 1.50, "tokens": 45000 },
+    { "day": "2026-02-14", "cost": 1.23, "tokens": 38000 }
+  ]
+}</code></pre>
+<pre><code>PUT /api/dashboard/budget
+Content-Type: application/json
+
+{
+  "daily_limit_usd": 5.00,
+  "monthly_limit_usd": 100.00,
+  "alert_threshold": 0.8
+}</code></pre>
+      <p>Update budget limits. Set a field to <code>null</code> to remove that limit. The <code>alert_threshold</code> is a fraction (0&ndash;1) of the limit at which a warning is triggered. Updating the budget also resets the <code>paused</code> state.</p>
+
+      <h3>Privacy &amp; Data</h3>
+<pre><code>GET /api/dashboard/privacy/summary</code></pre>
+      <p>Get a summary of all stored data, including counts of memories, messages, sessions, secrets, cron jobs, API calls, tool calls, and total tokens sent and received.</p>
+      <p><strong>Response:</strong></p>
+<pre><code>{
+  "memoryCount": 567,
+  "messageCount": 1234,
+  "sessionCount": 15,
+  "secretCount": 3,
+  "cronCount": 2,
+  "apiCallCount": 890,
+  "toolCallCount": 456,
+  "totalTokensSent": 1500000,
+  "totalTokensReceived": 750000,
+  "providerBreakdown": [
+    { "provider": "anthropic", "calls": 800, "tokens_sent": 1200000 }
+  ]
+}</code></pre>
+<pre><code>GET /api/dashboard/privacy/api-log?limit=50&amp;offset=0</code></pre>
+      <p>View API call history with session ID, provider, model, token counts, cost, and response time. Supports pagination via <code>limit</code> (max 100) and <code>offset</code> query parameters.</p>
+<pre><code>GET /api/dashboard/privacy/tool-log?limit=50&amp;offset=0</code></pre>
+      <p>View tool call history with tool name, session ID, duration, and success status. Supports pagination via <code>limit</code> (max 100) and <code>offset</code> query parameters.</p>
+<pre><code>POST /api/dashboard/privacy/wipe-memories
+Content-Type: application/json
+
+{ "confirm": "DELETE" }</code></pre>
+      <p>Delete all memory chunks and full-text search index. Requires <code>{ "confirm": "DELETE" }</code> in the request body.</p>
+<pre><code>POST /api/dashboard/privacy/wipe-messages
+Content-Type: application/json
+
+{ "confirm": "DELETE" }</code></pre>
+      <p>Delete all stored messages. Requires <code>{ "confirm": "DELETE" }</code> in the request body.</p>
+<pre><code>POST /api/dashboard/privacy/wipe-usage
+Content-Type: application/json
+
+{ "confirm": "DELETE" }</code></pre>
+      <p>Delete all usage analytics and tool metrics. Requires <code>{ "confirm": "DELETE" }</code> in the request body.</p>
+<pre><code>POST /api/dashboard/privacy/wipe-all
+Content-Type: application/json
+
+{ "confirm": "DELETE_ALL" }</code></pre>
+      <p>Complete data wipe: deletes all memories, messages, usage analytics, tool metrics, secrets, and cron logs. Requires <code>{ "confirm": "DELETE_ALL" }</code> in the request body.</p>
+
+      <h3>Threads</h3>
+<pre><code>GET /api/dashboard/threads</code></pre>
+      <p>List all conversation threads, ordered by most recently updated.</p>
+<pre><code>POST /api/dashboard/threads
+Content-Type: application/json
+
+{
+  "title": "Project discussion"
+}</code></pre>
+      <p>Create a new conversation thread. The <code>title</code> field is optional and defaults to "New conversation". Returns the generated thread <code>id</code> and <code>title</code>.</p>
+<pre><code>PUT /api/dashboard/threads/:id
+Content-Type: application/json
+
+{
+  "title": "Renamed thread"
+}</code></pre>
+      <p>Rename a thread by its ID.</p>
+<pre><code>DELETE /api/dashboard/threads/:id</code></pre>
+      <p>Delete a thread and its associated session file.</p>
+<pre><code>GET /api/dashboard/threads/:id/messages</code></pre>
+      <p>Get the messages in a thread (up to 100 messages). Returns the session's message array.</p>
+<pre><code>GET /api/dashboard/threads/:id/export</code></pre>
+      <p>Export a thread as a Markdown file. Returns a <code>text/markdown</code> response with a <code>Content-Disposition</code> header for download.</p>
+
+      <h3>Recipes</h3>
+<pre><code>GET /api/dashboard/recipes</code></pre>
+      <p>List all available workflow recipe templates with their install status. Each recipe includes its <code>id</code>, metadata, and an <code>installed</code> flag indicating whether it has already been added as a cron job.</p>
+<pre><code>POST /api/dashboard/recipes/install
+Content-Type: application/json
+
+{
+  "recipeId": "daily-summary"
+}</code></pre>
+      <p>Install a recipe as a cron job. The recipe is looked up by <code>recipeId</code> and inserted into the cron jobs table. Returns an error if the recipe is already installed.</p>
+<pre><code>POST /api/dashboard/recipes/uninstall
+Content-Type: application/json
+
+{
+  "recipeId": "daily-summary"
+}</code></pre>
+      <p>Uninstall a recipe by removing its cron job.</p>
+
+      <h3>Smart Routing</h3>
+<pre><code>GET /api/dashboard/smart-routing</code></pre>
+      <p>Get the current smart routing configuration. Smart routing automatically directs simple queries to a faster, cheaper model while using the primary model for complex tasks.</p>
+      <p><strong>Response:</strong></p>
+<pre><code>{
+  "enabled": false,
+  "fastProvider": "openai",
+  "fastModel": "gpt-4o-mini"
+}</code></pre>
+<pre><code>PUT /api/dashboard/smart-routing
+Content-Type: application/json
+
+{
+  "enabled": true,
+  "fastProvider": "openai",
+  "fastModel": "gpt-4o-mini"
+}</code></pre>
+      <p>Update smart routing settings. All fields are optional &mdash; only the fields you include will be updated.</p>
 
       <h3>Logs</h3>
 <pre><code>GET /api/dashboard/logs</code></pre>
       <p>Returns the last 100 log lines from the agent's log output.</p>
 
-      <h3>Config</h3>
+      <h3>Configuration</h3>
 <pre><code>GET /api/dashboard/config</code></pre>
-      <p>Returns the current configuration (sensitive values are masked).</p>
+      <p>Returns the current configuration summary with API keys masked.</p>
+      <p><strong>Response:</strong></p>
+<pre><code>{
+  "agentName": "Zubo",
+  "activeProvider": "anthropic",
+  "providers": {
+    "anthropic": { "model": "claude-sonnet-4-5-20250929", "hasApiKey": true },
+    "groq": { "model": "llama-3.3-70b-versatile", "hasApiKey": true }
+  },
+  "failover": ["groq"],
+  "channels": {
+    "webchat": { "enabled": true },
+    "telegram": { "enabled": true }
+  },
+  "smartRouting": { "enabled": true, "fastProvider": "groq" },
+  "budget": { "dailyLimitUsd": 5, "monthlyLimitUsd": 50, "alertThreshold": 0.8 },
+  "maxTurns": 50,
+  "heartbeatMinutes": 30
+}</code></pre>
+<pre><code>PUT /api/dashboard/config
+Content-Type: application/json
+
+{
+  "key": "budget.dailyLimitUsd",
+  "value": 10
+}</code></pre>
+      <p>Updates a configuration value using dot-notation paths. The value is validated against the config schema before saving. API keys and tokens cannot be set through this endpoint &mdash; use the secrets API instead.</p>
+      <p><strong>Response:</strong></p>
+<pre><code>{
+  "success": true,
+  "key": "budget.dailyLimitUsd",
+  "value": 10,
+  "message": "Config updated. Changes take effect on next restart."
+}</code></pre>
 <pre><code>PUT /api/dashboard/config/model
 Content-Type: application/json
 

package/site/docs/channels.html

@@ -4,18 +4,18 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Channel Setup — Zubo Docs</title>
-  <meta name="description" content="Connect Zubo to Telegram, Discord, Slack, WhatsApp, Signal, and Web Chat. Step-by-step setup guides for every supported messaging channel.">
+  <meta name="description" content="Connect Zubo to Telegram, Discord, Slack, WhatsApp, Signal, Email, and Web Chat. Step-by-step setup guides for every supported messaging channel.">
   <meta name="theme-color" content="#060608">
   <link rel="canonical" href="https://zubo.bot/docs/channels.html">
   <meta property="og:title" content="Channel Setup — Zubo Docs">
-  <meta property="og:description" content="Connect Zubo to Telegram, Discord, Slack, WhatsApp, Signal, and Web Chat. Step-by-step setup guides.">
+  <meta property="og:description" content="Connect Zubo to Telegram, Discord, Slack, WhatsApp, Signal, Email, and Web Chat. Step-by-step setup guides.">
   <meta property="og:type" content="article">
   <meta property="og:url" content="https://zubo.bot/docs/channels.html">
   <meta property="og:image" content="https://zubo.bot/og-image.png">
   <meta property="og:site_name" content="Zubo">
   <meta name="twitter:card" content="summary_large_image">
   <meta name="twitter:title" content="Channel Setup — Zubo Docs">
-  <meta name="twitter:description" content="Connect Zubo to Telegram, Discord, Slack, WhatsApp, Signal, and Web Chat.">
+  <meta name="twitter:description" content="Connect Zubo to Telegram, Discord, Slack, WhatsApp, Signal, Email, and Web Chat.">
   <meta name="twitter:image" content="https://zubo.bot/og-image.png">
   <meta name="twitter:creator" content="@thomaskanze">
   <link rel="preconnect" href="https://fonts.googleapis.com">
@@ -72,6 +72,7 @@
         <div class="docs-sidebar-links">
           <a href="channels.html" class="active">Channel Setup</a>
           <a href="integrations.html">Integrations</a>
+          <a href="integrations.html#oauth">OAuth</a>
           <a href="security.html">Security &amp; Auth</a>
         </div>
       </div>
@@ -285,6 +286,72 @@ brew install signal-cli
         </tbody>
       </table>
 
+      <h2>Email</h2>
+      <p>Connect Zubo to an email account via IMAP/SMTP so it can receive and reply to emails. Great for workflows like processing incoming emails, auto-replies, or email-based task management.</p>
+      <h3>Prerequisites</h3>
+      <ul>
+        <li>An email account with IMAP and SMTP access (Gmail, Outlook, FastMail, etc.)</li>
+        <li>For Gmail, an <strong>App Password</strong> is required &mdash; your regular Google account password will not work</li>
+      </ul>
+      <h3>Setup Steps</h3>
+      <ol>
+        <li>Gather your IMAP and SMTP server details from your email provider (host, port, username, password)</li>
+        <li>Add the email channel to your Zubo config:
+<pre><code>{
+  "channels": {
+    "email": {
+      "enabled": true,
+      "imap": {
+        "host": "imap.gmail.com",
+        "port": 993,
+        "user": "you@gmail.com",
+        "password": "your-app-password",
+        "tls": true
+      },
+      "smtp": {
+        "host": "smtp.gmail.com",
+        "port": 587,
+        "user": "you@gmail.com",
+        "password": "your-app-password",
+        "tls": true
+      },
+      "pollIntervalSeconds": 60,
+      "allowedSenders": ["boss@company.com", "team@company.com"],
+      "fromName": "Zubo Assistant"
+    }
+  }
+}</code></pre>
+        </li>
+        <li>Restart Zubo: <code>zubo restart</code></li>
+      </ol>
+
+      <h3>Config Fields</h3>
+      <table>
+        <thead>
+          <tr><th>Field</th><th>Type</th><th>Default</th><th>Description</th></tr>
+        </thead>
+        <tbody>
+          <tr><td><code>enabled</code></td><td>boolean</td><td><code>true</code></td><td>Enable or disable the Email channel</td></tr>
+          <tr><td><code>imap.host</code></td><td>string</td><td>&mdash;</td><td>IMAP server hostname (e.g., <code>imap.gmail.com</code>)</td></tr>
+          <tr><td><code>imap.port</code></td><td>number</td><td><code>993</code></td><td>IMAP server port</td></tr>
+          <tr><td><code>imap.user</code></td><td>string</td><td>&mdash;</td><td>IMAP login username (usually your email address)</td></tr>
+          <tr><td><code>imap.password</code></td><td>string</td><td>&mdash;</td><td>IMAP login password or app password</td></tr>
+          <tr><td><code>imap.tls</code></td><td>boolean</td><td><code>true</code></td><td>Use TLS for the IMAP connection</td></tr>
+          <tr><td><code>smtp.host</code></td><td>string</td><td>&mdash;</td><td>SMTP server hostname (e.g., <code>smtp.gmail.com</code>)</td></tr>
+          <tr><td><code>smtp.port</code></td><td>number</td><td><code>587</code></td><td>SMTP server port (587 for STARTTLS, 465 for implicit TLS)</td></tr>
+          <tr><td><code>smtp.user</code></td><td>string</td><td>&mdash;</td><td>SMTP login username (usually your email address)</td></tr>
+          <tr><td><code>smtp.password</code></td><td>string</td><td>&mdash;</td><td>SMTP login password or app password</td></tr>
+          <tr><td><code>smtp.tls</code></td><td>boolean</td><td><code>true</code></td><td>Use TLS for the SMTP connection</td></tr>
+          <tr><td><code>pollIntervalSeconds</code></td><td>number</td><td><code>60</code></td><td>How often (in seconds) to check for new emails. Minimum is 10.</td></tr>
+          <tr><td><code>allowedSenders</code></td><td>string[]</td><td>&mdash;</td><td>Email addresses allowed to message. If omitted or empty, all incoming emails are processed.</td></tr>
+          <tr><td><code>fromName</code></td><td>string</td><td><code>"Zubo"</code></td><td>Display name used in the <code>From</code> header of outgoing replies</td></tr>
+        </tbody>
+      </table>
+
+      <p><strong>Security note &mdash; <code>allowedSenders</code>:</strong> If set, only emails from the listed addresses will be processed. All other incoming emails are marked as read and skipped. If <code>allowedSenders</code> is omitted or empty, Zubo will process every incoming email &mdash; use this only for private or low-traffic mailboxes.</p>
+
+      <p><strong>Gmail setup:</strong> Gmail requires an App Password for third-party IMAP/SMTP access. To create one, go to <a href="https://myaccount.google.com/apppasswords">Google Account &rarr; Security &rarr; App Passwords</a> (requires 2-Step Verification to be enabled). Generate a new app password, then use that 16-character password in both the <code>imap.password</code> and <code>smtp.password</code> fields above.</p>
+
       <h2>Running Multiple Channels</h2>
       <p>Zubo is designed to run all channels simultaneously. There is no limit to how many channels you can enable at once.</p>
       <ul>