chore: release v0.4.0 (#124)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.claude/commands/fix-issue.md

@@ -0,0 +1,97 @@
+---
+description: Fetch a GitHub issue, create a branch, research the codebase, plan the fix, implement with tests, and commit
+disable-model-invocation: true
+allowed-tools: Bash(gh issue view:*), Bash(gh repo view:*), Bash(git fetch:*), Bash(git checkout:*), Bash(git status:*), Bash(git branch:*), Bash(git add:*), Bash(git commit:*), Bash(cargo fmt:*), Bash(cargo clippy:*), Bash(cargo test:*), Read, Edit, Write, Grep, Glob
+argument-hint: "<issue-number or github-issue-url>"
+---
+
+# Fix GitHub Issue
+
+## Step 1: Resolve the issue
+
+Parse `$ARGUMENTS` to extract the issue number:
+- If it's a URL like `https://github.com/owner/repo/issues/42`, extract `42`.
+- If it's a bare number, use it directly.
+- If empty, stop and ask the user for an issue number.
+
+Fetch the issue:
+
+```
+gh issue view {number} --json title,body,labels,assignees,comments,state
+```
+
+If the issue is closed, warn the user and ask if they still want to proceed.
+
+## Step 2: Create a branch
+
+Create a fresh branch off the latest main:
+
+1. Fetch latest: `git fetch origin`
+2. Detect default branch: `gh repo view --json defaultBranchRef --jq .defaultBranchRef.name`
+3. Create and switch to a new branch: `git checkout -b fix/{number}-{short-slug} origin/{default-branch}`
+   - `{short-slug}` is 3-5 words from the issue title, lowercase, hyphenated (e.g. `fix/42-idor-workspace-check`)
+
+If the working tree has uncommitted changes, warn the user and stop. Do not stash or discard their work.
+
+## Step 3: Understand the issue
+
+Summarize the issue in 2-3 sentences. Identify:
+- **What's broken or missing** (the symptom or feature request)
+- **Acceptance criteria** (what "done" looks like, from the issue body or comments)
+- **Constraints** (mentioned technologies, backward compatibility, performance requirements)
+
+If the issue is unclear or ambiguous, list the open questions. These will be addressed during planning.
+
+## Step 4: Research the codebase
+
+Before planning, gather context:
+
+1. **Find relevant code** - Search for files, functions, types, and patterns mentioned in the issue. Read them in full.
+2. **Trace the flow** - If the issue is about a specific behavior, trace the code path from the entry point (route handler, CLI command, etc.) through to the relevant logic.
+3. **Check existing tests** - Find tests related to the affected code. Understand what's already covered.
+4. **Check for prior art** - Look for similar patterns in the codebase that solve analogous problems. Prefer consistency with existing patterns.
+
+## Step 5: Enter planning mode
+
+Enter planning mode to design the implementation. The plan MUST cover:
+
+1. **Root cause** (for bugs) or **design approach** (for features)
+2. **Files to modify** with specific descriptions of what changes in each
+3. **New files** (if any) with justification for why they're needed
+4. **Tests to add** - every code path introduced or changed needs a test:
+   - Happy path (expected input produces expected output)
+   - Error paths (invalid input, missing data, permission denied)
+   - Edge cases (empty collections, boundary values, concurrent access)
+5. **IronClaw-specific concerns**:
+   - If the change touches persistence, both database backends must be updated (`postgres.rs` and `libsql_backend.rs`)
+   - New `Database` trait methods need implementations in both backends
+   - No `.unwrap()` or `.expect()` in production code
+   - Use `crate::` imports, not `super::`
+   - Error types via `thiserror` in `error.rs`
+6. **Migration or compatibility concerns** (if any)
+
+Follow the project's CLAUDE.md guidance for architecture decisions.
+
+Wait for user approval before implementing.
+
+## Step 6: Implement
+
+After the plan is approved:
+
+1. Implement each change from the plan.
+2. Write all planned tests.
+3. Run IronClaw's full quality gate:
+   - `cargo fmt`
+   - `cargo clippy --all --benches --tests --examples --all-features` (zero warnings)
+   - `cargo test --lib` (all tests pass)
+4. If any check fails, fix it before proceeding.
+
+Note: Integration tests (`--test workspace_integration`) require PostgreSQL and are expected to fail locally. Only `--lib` test failures are blocking.
+
+## Step 7: Commit and summarize
+
+1. Commit with a descriptive message referencing the issue (e.g. `fix: prevent IDOR in function call outputs (#42)`).
+2. Summarize what was done:
+   - Files changed with line references
+   - Tests added and what they cover
+   - Any follow-up work or open questions

.claude/commands/respond-pr.md

@@ -0,0 +1,81 @@
+---
+description: Respond to PR review comments — triage, plan fixes, implement after confirmation, push, and reply to reviewers
+disable-model-invocation: true
+allowed-tools: Bash(gh pr list:*), Bash(gh pr comment:*), Bash(gh api:*), Bash(gh repo view:*), Bash(git branch:*), Bash(git status:*), Bash(git add:*), Bash(git commit:*), Bash(git push:*), Bash(cargo fmt:*), Bash(cargo clippy:*), Bash(cargo test:*), Read, Edit, Write, Grep, Glob
+argument-hint: "[pr-number (optional, auto-detects from branch)]"
+---
+
+# Review and Address PR Comments
+
+## Step 1: Find the PR
+
+If `$ARGUMENTS` is provided, use that as the PR number. Otherwise, detect the PR for the current branch:
+
+```
+gh pr list --head $(git branch --show-current) --json number,title,url --jq '.[0]'
+```
+
+If no PR is found, tell the user and stop.
+
+## Step 2: Fetch all review comments
+
+Resolve the repo owner and name:
+
+```
+gh repo view --json owner,name --jq '"\(.owner.login)/\(.name)"'
+```
+
+Fetch the full set of review comments (not issue-level comments):
+
+```
+gh api --paginate repos/{owner}/{repo}/pulls/{number}/comments
+```
+
+Also fetch the review summaries:
+
+```
+gh api --paginate repos/{owner}/{repo}/pulls/{number}/reviews
+```
+
+Deduplicate comments that appear multiple times (bots sometimes post the same finding under different IDs). Group by the actual issue being raised, not by comment ID.
+
+## Step 3: Triage and plan
+
+For each unique issue raised in the comments:
+
+1. **Check if already addressed** - Read the current code at the referenced location. If a prior commit already fixed it, note it as "already resolved".
+2. **Assess validity** - Determine if the comment identifies a real problem or is a false positive. Be honest about false positives but explain why.
+3. **Classify severity** - Critical (security/data loss), High (bugs/broken behavior), Medium (correctness/robustness), Low (style/naming/nits).
+4. **Plan the fix** - For each valid unresolved issue, describe the specific code change needed.
+
+Present the plan as a table to the user:
+
+| # | Issue | File:Line | Severity | Status | Planned Fix |
+|---|-------|-----------|----------|--------|-------------|
+
+Wait for user confirmation before proceeding to implementation.
+
+## Step 4: Implement fixes
+
+After user confirms:
+
+1. Implement each fix in the plan.
+2. Run IronClaw's quality gate to verify nothing breaks:
+   - `cargo fmt`
+   - `cargo clippy --all --benches --tests --examples --all-features`
+   - `cargo test --lib`
+3. Commit with a descriptive message referencing the PR review.
+4. Push to the branch.
+
+## Step 5: Reply to comments
+
+For each comment addressed, reply on the PR with a short message stating what was fixed and the commit SHA. For false positives or already-resolved items, reply explaining why no change was needed.
+
+## Rules
+
+- Never guess at code you haven't read. Always read the referenced file and line before assessing a comment.
+- Group duplicate comments (same issue reported by multiple bots) and reply to all of them.
+- Do not make changes beyond what the review comments ask for. Stay focused.
+- If a comment suggests a change you disagree with, present your reasoning to the user during the planning phase rather than silently ignoring it.
+- Follow IronClaw conventions: no `.unwrap()` in production code, use `crate::` imports, `thiserror` errors.
+- If changes touch persistence, verify both database backends are updated.

.claude/commands/review-crate.md

@@ -0,0 +1,245 @@
+---
+description: Deep audit of the IronClaw crate for vulnerabilities, bugs, unfinished work, inconsistencies, and oversights
+disable-model-invocation: true
+allowed-tools: Bash(cargo fmt:*), Bash(cargo clippy:*), Bash(cargo test:*), Bash(cargo audit:*), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(wc:*), Read, Grep, Glob, Task
+argument-hint: "[path/to/crate]"
+---
+
+# Rust Crate Audit
+
+You are performing a thorough audit of a Rust crate. Your goal is to find every vulnerability, bug, unfinished piece of work, inconsistency, and oversight before it ships. Leave no stone unturned.
+
+## Step 1: Locate the crate
+
+Parse `$ARGUMENTS`:
+- If a path is provided, use it as the crate root.
+- If empty, use the current working directory.
+
+Verify it's a valid Rust crate by checking for `Cargo.toml`. If not found, stop and ask the user.
+
+## Step 2: Understand the crate
+
+Read `Cargo.toml` to understand:
+- Crate name, version, edition
+- Dependencies (look for outdated, unmaintained, or suspicious crates)
+- Feature flags and their implications
+- Build scripts (`build.rs`) if any
+
+Read `CLAUDE.md`, `README.md`, or top-level documentation if present to understand intent and architecture.
+
+Read `src/lib.rs` or `src/main.rs` to get the module tree. Then read each module's `mod.rs` or top-level file to build a mental map of the crate's structure before diving into details.
+Read all Rust files (`src/*.rs`) to make sure everything is in context when you are reasoning.
+
+## Step 3: Run the compiler's checks
+
+Run these commands and capture output. Do NOT fix anything, just collect findings:
+
+```
+cargo fmt --check 2>&1
+```
+
+```
+cargo clippy --all --benches --tests --examples --all-features -- -W clippy::all -W clippy::pedantic -W clippy::nursery 2>&1
+```
+
+```
+cargo test --lib 2>&1
+```
+
+If any of these fail, record the failures as findings. If `cargo test` has ignored tests, note which ones and why.
+
+Note: Integration tests (`--test workspace_integration`) require a PostgreSQL database and are expected to fail locally. Only report `--lib` test failures as blocking.
+
+## Step 4: Scan for unfinished work
+
+Search the entire `src/` tree for:
+
+```
+todo!
+unimplemented!
+fixme
+FIXME
+TODO
+HACK
+XXX
+SAFETY:
+stub
+placeholder
+temporary
+```
+
+For each match:
+- Is it in production code or test code?
+- Is it a genuine incomplete feature or a deliberate placeholder?
+- Is there a tracking issue referenced?
+- Could this panic at runtime?
+
+Any `todo!()` or `unimplemented!()` in non-test code is **High severity** (runtime panic).
+
+## Step 5: Audit for vulnerabilities and unsafe code
+
+### 5a. Unsafe code
+
+Search for all `unsafe` blocks. For each one:
+- Is the safety invariant documented with a `// SAFETY:` comment?
+- Is the invariant actually upheld by the surrounding code?
+- Could the unsafe block be replaced with a safe alternative?
+- Are there any pointer dereferences, transmutes, or FFI calls?
+
+### 5b. Unwrap and panic paths
+
+Search for `.unwrap()`, `.expect(`, `panic!`, `unreachable!` in non-test code. For each:
+- Can this actually panic in production?
+- Is there a code path that reaches this with None/Err?
+- Should it be replaced with proper error handling (`?`, `.ok()`, `.unwrap_or_default()`)?
+
+IronClaw convention: `.unwrap()` and `.expect()` are banned in production code. Any occurrence outside `#[cfg(test)]` blocks is a **High severity** finding.
+
+### 5c. SQL and injection vectors
+
+Search for string formatting used in SQL queries, shell commands, or HTML:
+- `format!` used near `.execute(`, `.query(`, `Command::new(`
+- String interpolation in query construction vs parameterized queries
+- User input flowing into file paths (`Path::new`, `std::fs::`)
+
+IronClaw has two database backends (PostgreSQL and libSQL). Check both for injection vectors.
+
+### 5d. Cryptographic issues
+
+If the crate uses crypto:
+- Are comparisons constant-time? (look for `==` on secrets/hashes vs `subtle::ConstantTimeEq`)
+- Is randomness from `OsRng` / `thread_rng` and not a fixed seed?
+- Are keys/secrets zeroized after use? (`secrecy`, `zeroize` crates)
+- Are deprecated algorithms used? (MD5, SHA1 for security, RC4, DES)
+
+### 5e. Resource exhaustion
+
+- Are there unbounded allocations? (`Vec` growing from user input without limits)
+- Are there unbounded loops? (retry loops without max attempts)
+- Are file reads bounded? (`std::fs::read_to_string` on user-provided paths)
+- Are timeouts set on all network operations?
+- Are there connection/resource leaks? (opened but never closed, missing `Drop`)
+
+### 5f. Error handling
+
+- Are errors swallowed silently? (`let _ = ...`, `.ok()` discarding errors that matter)
+- Do error types carry enough context to debug in production?
+- Are there error type mismatches? (returning generic `anyhow::Error` where a typed error would prevent confusion)
+- Is `thiserror` used consistently for error types (IronClaw convention)?
+
+## Step 6: Check for inconsistencies
+
+### 6a. Naming conventions
+
+- Are types, functions, modules named consistently? (e.g., mixing `get_` and `fetch_`, `create_` and `new_`)
+- Do similar operations follow the same patterns?
+
+### 6b. Duplicate or near-duplicate code
+
+Look for:
+- Functions that do nearly the same thing with minor variations (candidates for generics or shared helpers)
+- Repeated error mapping patterns that should be extracted
+- Copy-pasted SQL queries or string templates with slight differences
+- Identical struct definitions or conversion logic in different modules
+
+### 6c. API consistency
+
+- Do similar functions take arguments in the same order?
+- Are return types consistent? (e.g., some functions return `Option<T>`, similar ones return `Result<T, E>`)
+- Are visibility modifiers consistent? (`pub` where it should be `pub(crate)`, or vice versa)
+
+### 6d. Dead code and unused items
+
+- Are there functions, structs, or modules that nothing references?
+- Are there `#[allow(dead_code)]` annotations that should be investigated?
+- Are there feature-gated items where the feature is never enabled?
+
+### 6e. Import style
+
+IronClaw convention: use `crate::` imports, not `super::`. Flag any `super::` imports in non-test code.
+
+## Step 7: Inspect for change oversights
+
+### 7a. Partial refactors
+
+- Are there old patterns coexisting with new patterns?
+- Are there renamed types/functions where some call sites still use the old name via a compatibility alias?
+- Are there comments referencing behavior that no longer exists?
+
+### 7b. Trait implementation gaps
+
+- If a trait is defined, do all intended types implement it?
+- Are there `impl` blocks that look incomplete?
+- Are `Default` implementations sensible?
+
+IronClaw key traits: `Database` (~60 methods), `Channel`, `Tool`, `LlmProvider`, `SuccessEvaluator`, `EmbeddingProvider`. If any new methods were added to `Database`, verify both `postgres.rs` and `libsql_backend.rs` implement them.
+
+### 7c. Test coverage gaps
+
+- Are there public functions without any test?
+- Are there error paths without tests?
+- Are there recently-changed functions where the tests still assert old behavior?
+
+### 7d. Documentation drift
+
+- Do doc comments match actual function behavior?
+- Are examples in doc comments still valid and compilable?
+
+## Step 8: Dependency audit
+
+Review `Cargo.toml` and `Cargo.lock`:
+- Are there duplicate versions of the same crate in the lock file? (potential version conflicts)
+- Are there dependencies with known security advisories? Run `cargo audit` to check (install with `cargo install cargo-audit` if not present).
+- Are there heavy dependencies used for trivial functionality?
+- Are dependency features minimal?
+
+## Step 9: Present findings
+
+Compile all findings into a structured report. Group by severity, then by category.
+
+### Format
+
+For each finding:
+
+```
+### [Severity] Category: One-line summary
+
+**Location:** `file_path:line_number`
+**Category:** Vulnerability | Bug | Unfinished | Inconsistency | Duplicate | Oversight | Style
+
+**Description:**
+Detailed explanation of the issue, why it matters, and how it could manifest.
+
+**Suggested fix:**
+Concrete suggestion with code if applicable.
+```
+
+### Severity levels
+
+- **Critical**: Security vulnerability, data loss, or crash in production
+- **High**: Bug that causes incorrect behavior, `todo!()`/`unimplemented!()` in prod code, or missing validation on trust boundaries
+- **Medium**: Inconsistency, duplicate code, incomplete error handling, missing tests for important paths
+- **Low**: Naming inconsistency, unnecessary complexity, documentation drift, minor dead code
+- **Nit**: Style preference, optional improvement
+
+### Summary table
+
+End with a summary table:
+
+| # | Severity | Category | File:Line | Finding |
+|---|----------|----------|-----------|---------|
+
+And a final tally: X Critical, Y High, Z Medium, W Low, V Nit.
+
+## Rules
+
+- Read every file before reporting on it. Never guess about code you haven't seen.
+- Be specific. "This might have issues" is worthless. "Line 42 calls `.unwrap()` on a `Result` that returns `Err` when the DB connection is dropped" is useful.
+- Distinguish certainty levels: "this IS a bug" vs "this COULD be a bug if X".
+- Don't invent problems to look thorough. If the code is solid, say so.
+- Focus on substance over style. Don't flag formatting unless it causes real confusion.
+- Respect existing project conventions (check CLAUDE.md). Don't flag patterns the project explicitly endorses.
+- When in doubt about severity, round up.
+- For large crates (>50 files), prioritize: core logic > public API > internal utilities > tests > examples.
+- Use the Task tool to parallelize file reading across modules when the crate is large.
+- Do NOT fix anything. This is a read-only audit. Report findings for the user to action.

.claude/commands/review-pr.md

@@ -0,0 +1,170 @@
+---
+description: Paranoid architect review of a PR — fetches diff, reads changed files, deep review across 6 lenses, posts findings as GitHub comments
+disable-model-invocation: true
+allowed-tools: Bash(gh pr view:*), Bash(gh pr diff:*), Bash(gh pr comment:*), Bash(gh api:*), Bash(gh repo view:*), Bash(git diff:*), Bash(git log:*), Read, Grep, Glob
+argument-hint: "<pr-number or github-pr-url>"
+---
+
+# Paranoid Architect Code Review
+
+You are reviewing this PR as a paranoid architect. Your job is to find every bug, vulnerability, race condition, edge case, and undocumented assumption before it ships. Assume adversarial users, concurrent access, and Murphy's law.
+
+## Step 1: Resolve the PR
+
+Parse `$ARGUMENTS` to extract the PR number:
+- If it's a URL like `https://github.com/owner/repo/pull/123`, extract `123`.
+- If it's a bare number, use it directly.
+- If empty, stop and ask the user for a PR number.
+
+Fetch PR metadata (including head commit SHA for posting line comments later):
+
+```
+gh pr view {number} --json title,body,baseRefName,headRefName,headRefOid,files,additions,deletions
+```
+
+Save the `headRefOid` value, you'll need it as `commit_id` in Step 6.
+
+## Step 2: Load the full diff
+
+```
+gh pr diff {number}
+```
+
+Also get the list of changed files:
+
+```
+gh pr diff {number} --name-only
+```
+
+## Step 3: Read every changed file in full
+
+For each changed file, read the ENTIRE current file (not just the diff hunks). You need surrounding context to catch:
+- Callers of modified functions that now behave differently
+- Trait/interface contracts that the change may violate
+- Invariants established elsewhere that the diff breaks
+
+If the PR touches more than 20 files, still read all of them, but process in this priority order: service logic > routes/handlers > models/types > tests > docs. Batch reads in groups of ~20 if needed.
+
+## Step 4: Deep review
+
+Go through the changes with each of these lenses. For every finding, note the file, line range, severity, and a concrete description.
+
+### IronClaw-specific checks
+
+In addition to the general lenses below, check IronClaw conventions (see CLAUDE.md):
+- No `.unwrap()` or `.expect()` in production code (tests are fine)
+- Use `crate::` imports, not `super::`
+- Error types use `thiserror` in `error.rs`
+- If the change touches persistence, verify both database backends are updated (PostgreSQL in `postgres.rs` AND libSQL in `libsql_backend.rs`)
+- New tools must implement the `Tool` trait correctly and be registered in `registry.rs`
+- External tool output must pass through the safety layer
+
+### 4a. Correctness and bugs
+
+- Off-by-one errors, wrong comparison operators, inverted conditions
+- Unreachable code, dead branches, impossible match arms
+- Type confusion (mixing up IDs, using wrong enum variant)
+- Incorrect error propagation (swallowed errors, wrong error type/status code)
+- Broken invariants (e.g. uniqueness assumptions violated, ordering assumptions wrong)
+- Concurrency issues (TOCTOU, missing locks, race conditions between check and use)
+
+### 4b. Edge cases and failure handling
+
+- What happens with empty input, None/null, zero-length collections?
+- What happens when external services fail (DB down, HTTP timeout, malformed response)?
+- What happens at integer boundaries (overflow, underflow, i64::MAX)?
+- What happens with malformed or adversarial input (invalid UTF-8, huge payloads, deeply nested JSON)?
+- Are all error paths tested? Does every `?` propagation make sense?
+- Are partial failures handled (e.g. wrote to DB but failed to emit event)?
+
+### 4c. Security (assume a malicious actor)
+
+- **Authentication/Authorization bypass**: Can an unauthenticated user reach this? Can workspace A's user access workspace B's data? Are there IDOR vulnerabilities?
+- **Injection**: SQL injection via string interpolation? Command injection? Log injection? Header injection?
+- **Data leakage**: Are secrets, PII, or conversation content logged? Returned in error messages? Exposed in API responses?
+- **Resource exhaustion / DoS**: Can an attacker send unbounded input? Trigger expensive operations without rate limits? Cause OOM via large allocations?
+- **Financial abuse**: Can tokens/credits be consumed without being tracked? Can usage limits be bypassed?
+- **Replay / race conditions**: Can the same request be replayed for double-spend? Can concurrent requests bypass limits?
+- **Cryptographic issues**: Timing attacks on comparisons? Weak randomness? Missing HMAC verification?
+
+### 4d. Test coverage
+
+- Is every new public function/method tested?
+- Are error paths tested (not just happy paths)?
+- Are edge cases covered (empty input, boundary values, concurrent access)?
+- Do existing tests still make sense with the new changes, or do they assert stale behavior?
+- Are there integration/e2e tests for the full flow?
+- If a test is missing, describe exactly what test should be written.
+
+### 4e. Documentation and assumptions
+
+- Are new assumptions documented in comments? (e.g. "this field is always non-empty because X")
+- Are non-obvious algorithms or business rules explained?
+- Are API contracts (request/response shapes, error codes, status codes) documented?
+- Are there TODO/FIXME/HACK comments that should be tracked as issues?
+
+### 4f. Architectural concerns
+
+- Does this change follow existing patterns in the codebase, or does it introduce a new one without justification?
+- Are there unnecessary abstractions or premature generalizations?
+- Is there duplicated logic that should be extracted?
+- Are dependencies between modules clean, or does this create circular/tight coupling?
+- Will this change make future work harder?
+
+## Step 5: Present findings
+
+Summarize findings to the user as a table:
+
+| # | Severity | Category | File:Line | Finding | Suggested Fix |
+|---|----------|----------|-----------|---------|---------------|
+
+Severity levels:
+- **Critical**: Security vulnerability, data loss, or financial exploit
+- **High**: Bug that will cause incorrect behavior in production
+- **Medium**: Robustness issue, missing validation, or incomplete error handling
+- **Low**: Style, naming, documentation, or minor improvement
+- **Nit**: Optional suggestion, take-it-or-leave-it
+
+Ask the user which findings to post as PR comments. Default: all Critical, High, and Medium.
+
+## Step 6: Post comments on GitHub
+
+Resolve the repo owner and name if not already known:
+
+```
+gh repo view --json owner,name --jq '"\(.owner.login)/\(.name)"'
+```
+
+For each approved finding, post a review comment on the PR at the specific file and line. Use the `headRefOid` from Step 1 as the `commit_id`:
+
+```
+gh api repos/{owner}/{repo}/pulls/{number}/comments \
+  -f body="..." \
+  -f path="..." \
+  -f commit_id="{headRefOid}" \
+  -F line=... \
+  -f side="RIGHT"
+```
+
+For findings that span multiple locations or are architectural, post as a regular PR comment:
+
+```
+gh pr comment {number} --body "..."
+```
+
+Format each comment clearly:
+- Severity tag (e.g. `**High Severity**`)
+- One-line summary
+- Detailed explanation of the issue
+- Concrete suggestion for the fix (with code if possible)
+
+## Rules
+
+- Read every changed file in full before writing a single finding. Context matters.
+- Never post a comment about code you haven't actually read. Verify line numbers against the actual file.
+- Be specific. "This might have issues" is useless. "Line 42 returns 404 but should return 400 because X" is useful.
+- Distinguish between "this IS a bug" and "this COULD be a bug if X". Be honest about certainty.
+- Don't nitpick formatting or style unless it causes actual confusion. Focus on substance.
+- If the code is good and you find nothing, say so. Don't invent problems to look thorough.
+- Respect the project's CLAUDE.md privacy rules: never include customer data, secrets, or PII in comments.
+- When in doubt about severity, round up. It's cheaper to dismiss a false alarm than to miss a real bug.

.dockerignore

@@ -0,0 +1,8 @@
+target/
+.git/
+.env
+.env.*
+*.md
+!CLAUDE.md
+node_modules/
+tools-src/

.env.example

@@ -1,15 +1,15 @@
 # Database Configuration
-DATABASE_URL=postgres://ironclaw:password@localhost:5432/ironclaw
+DATABASE_URL=postgres://localhost/ironclaw
 DATABASE_POOL_SIZE=10
 
 # LLM Provider (NEAR AI)
 # NEAR AI provides a unified interface to all models with user authentication
-# Session token is stored in ~/.near-agent/session.json and managed automatically.
+# Session token is stored in ~/.ironclaw/session.json and managed automatically.
 # On first run, the agent will open a browser for OAuth authentication.
 NEARAI_MODEL=claude-3-5-sonnet-20241022
 NEARAI_BASE_URL=https://cloud-api.near.ai
 NEARAI_AUTH_URL=https://private.near.ai
-# NEARAI_SESSION_PATH=~/.near-agent/session.json  # optional, default shown
+# NEARAI_SESSION_PATH=~/.ironclaw/session.json  # optional, default shown
 
 # Channel Configuration
 # CLI is always enabled

.github/workflows/code_style.yml

@@ -0,0 +1,22 @@
+name: Code Style
+on:
+  pull_request:
+
+jobs:
+  codestyle:
+    name: Code Style (fmt + clippy)
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        profile: minimal
+        components: rustfmt, clippy
+    - uses: Swatinem/rust-cache@v2
+    - name: Check formatting
+      run: |
+        cargo fmt --all -- --check
+    - name: Check lints (cargo clippy)
+      run: cargo clippy -- -D warnings

.github/workflows/release-plz.yml

@@ -0,0 +1,67 @@
+name: Release-plz
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+
+  # Release unpublished packages.
+  release-plz-release:
+    if: ${{ github.repository_owner == 'nearai' }}
+    name: Release-plz release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - &checkout
+        name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - &install-rust
+        name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      # Generating a GitHub token, so that PRs and tags created by
+      # the release-plz-action can trigger actions workflows.
+      - name: Generate GitHub token
+        uses: actions/create-github-app-token@v2
+        id: generate-token
+        with:
+          # GitHub App ID secret name
+          app-id: ${{ secrets.GH_RELEASES_MANAGER_APP_ID }}
+          # GitHub App private key secret name
+          private-key: ${{ secrets.GH_RELEASES_MANAGER_APP_PRIVATE_KEY }}
+      - name: Run release-plz
+        uses: release-plz/[email protected]
+        with:
+          command: release
+        env:
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+  # Create a PR with the new versions and changelog, preparing the next release.
+  release-plz-pr:
+    if: ${{ github.repository_owner == 'nearai' }}
+    name: Release-plz PR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    concurrency:
+      group: release-plz-${{ github.ref }}
+      cancel-in-progress: false
+    steps:
+      - *checkout
+      - *install-rust
+      - uses: Swatinem/rust-cache@v2
+      - name: Run release-plz
+        uses: release-plz/[email protected]
+        with:
+          command: release-pr
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,299 @@
+# This file was autogenerated by dist: https://axodotdev.github.io/cargo-dist
+#
+# Copyright 2022-2024, axodotdev
+# SPDX-License-Identifier: MIT or Apache-2.0
+#
+# CI that:
+#
+# * checks for a Git Tag that looks like a release
+# * builds artifacts with dist (archives, installers, hashes)
+# * uploads those artifacts to temporary workflow zip
+# * on success, uploads the artifacts to a GitHub Release
+#
+# Note that the GitHub Release will be created with a generated
+# title/body based on your changelogs.
+
+name: Release
+permissions:
+  "contents": "write"
+
+# This task will run whenever you push a git tag that looks like a version
+# like "1.0.0", "v0.1.0-prerelease.1", "my-app/0.1.0", "releases/v1.0.0", etc.
+# Various formats will be parsed into a VERSION and an optional PACKAGE_NAME, where
+# PACKAGE_NAME must be the name of a Cargo package in your workspace, and VERSION
+# must be a Cargo-style SemVer Version (must have at least major.minor.patch).
+#
+# If PACKAGE_NAME is specified, then the announcement will be for that
+# package (erroring out if it doesn't have the given version or isn't dist-able).
+#
+# If PACKAGE_NAME isn't specified, then the announcement will be for all
+# (dist-able) packages in the workspace with that version (this mode is
+# intended for workspaces with only one dist-able package, or with all dist-able
+# packages versioned/released in lockstep).
+#
+# If you push multiple tags at once, separate instances of this workflow will
+# spin up, creating an independent announcement for each one. However, GitHub
+# will hard limit this to 3 tags per commit, as it will assume more tags is a
+# mistake.
+#
+# If there's a prerelease-style suffix to the version, then the release(s)
+# will be marked as a prerelease.
+on:
+  push:
+    tags:
+      - '**[0-9]+.[0-9]+.[0-9]+*'
+
+jobs:
+  # Run 'dist plan' (or host) to determine what tasks we need to do
+  plan:
+    runs-on: "ubuntu-22.04"
+    outputs:
+      val: ${{ steps.plan.outputs.manifest }}
+      tag: ${{ !github.event.pull_request && github.ref_name || '' }}
+      tag-flag: ${{ !github.event.pull_request && format('--tag={0}', github.ref_name) || '' }}
+      publishing: ${{ !github.event.pull_request }}
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install dist
+        # we specify bash to get pipefail; it guards against the `curl` command
+        # failing. otherwise `sh` won't catch that `curl` returned non-0
+        shell: bash
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.3/cargo-dist-installer.sh | sh"
+      - name: Cache dist
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/dist
+      # sure would be cool if github gave us proper conditionals...
+      # so here's a doubly-nested ternary-via-truthiness to try to provide the best possible
+      # functionality based on whether this is a pull_request, and whether it's from a fork.
+      # (PRs run on the *source* but secrets are usually on the *target* -- that's *good*
+      # but also really annoying to build CI around when it needs secrets to work right.)
+      - id: plan
+        run: |
+          dist ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }} --output-format=json > plan-dist-manifest.json
+          echo "dist ran successfully"
+          cat plan-dist-manifest.json
+          echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
+      - name: "Upload dist-manifest.json"
+        uses: actions/upload-artifact@v4
+        with:
+          name: artifacts-plan-dist-manifest
+          path: plan-dist-manifest.json
+
+  # Build and packages all the platform-specific things
+  build-local-artifacts:
+    name: build-local-artifacts (${{ join(matrix.targets, ', ') }})
+    # Let the initial task tell us to not run (currently very blunt)
+    needs:
+      - plan
+    if: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix.include != null && (needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload') }}
+    strategy:
+      fail-fast: false
+      # Target platforms/runners are computed by dist in create-release.
+      # Each member of the matrix has the following arguments:
+      #
+      # - runner: the github runner
+      # - dist-args: cli flags to pass to dist
+      # - install-dist: expression to run to install dist on the runner
+      #
+      # Typically there will be:
+      # - 1 "global" task that builds universal installers
+      # - N "local" tasks that build each platform's binaries and platform-specific installers
+      matrix: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix }}
+    runs-on: ${{ matrix.runner }}
+    container: ${{ matrix.container && matrix.container.image || null }}
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
+    steps:
+      - name: enable windows longpaths
+        run: |
+          git config --global core.longpaths true
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install Rust non-interactively if not already installed
+        if: ${{ matrix.container }}
+        run: |
+          if ! command -v cargo > /dev/null 2>&1; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+            echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+          fi
+      - uses: swatinem/rust-cache@v2
+        with:
+          key: ${{ join(matrix.targets, '-') }}
+          cache-provider: ${{ matrix.cache_provider }}
+      - name: Install dist
+        run: ${{ matrix.install_dist.run }}
+      # Get the dist-manifest
+      - name: Fetch local artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: target/distrib/
+          merge-multiple: true
+      - name: Install dependencies
+        run: |
+          ${{ matrix.packages_install }}
+      - name: Build artifacts
+        run: |
+          # Actually do builds and make zips and whatnot
+          dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
+          echo "dist ran successfully"
+      - id: cargo-dist
+        name: Post-build
+        # We force bash here just because github makes it really hard to get values up
+        # to "real" actions without writing to env-vars, and writing to env-vars has
+        # inconsistent syntax between shell and powershell.
+        shell: bash
+        run: |
+          # Parse out what we just built and upload it to scratch storage
+          echo "paths<<EOF" >> "$GITHUB_OUTPUT"
+          dist print-upload-files-from-manifest --manifest dist-manifest.json >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
+      - name: "Upload artifacts"
+        uses: actions/upload-artifact@v4
+        with:
+          name: artifacts-build-local-${{ join(matrix.targets, '_') }}
+          path: |
+            ${{ steps.cargo-dist.outputs.paths }}
+            ${{ env.BUILD_MANIFEST_NAME }}
+
+  # Build and package all the platform-agnostic(ish) things
+  build-global-artifacts:
+    needs:
+      - plan
+      - build-local-artifacts
+    runs-on: "ubuntu-22.04"
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install cached dist
+        uses: actions/download-artifact@v4
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/
+      - run: chmod +x ~/.cargo/bin/dist
+      # Get all the local artifacts for the global tasks to use (for e.g. checksums)
+      - name: Fetch local artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: target/distrib/
+          merge-multiple: true
+      - id: cargo-dist
+        shell: bash
+        run: |
+          dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
+          echo "dist ran successfully"
+
+          # Parse out what we just built and upload it to scratch storage
+          echo "paths<<EOF" >> "$GITHUB_OUTPUT"
+          jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
+      - name: "Upload artifacts"
+        uses: actions/upload-artifact@v4
+        with:
+          name: artifacts-build-global
+          path: |
+            ${{ steps.cargo-dist.outputs.paths }}
+            ${{ env.BUILD_MANIFEST_NAME }}
+  # Determines if we should publish/announce
+  host:
+    needs:
+      - plan
+      - build-local-artifacts
+      - build-global-artifacts
+    # Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
+    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    runs-on: "ubuntu-22.04"
+    outputs:
+      val: ${{ steps.host.outputs.manifest }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install cached dist
+        uses: actions/download-artifact@v4
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/
+      - run: chmod +x ~/.cargo/bin/dist
+      # Fetch artifacts from scratch-storage
+      - name: Fetch artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: target/distrib/
+          merge-multiple: true
+      - id: host
+        shell: bash
+        run: |
+          dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
+          echo "artifacts uploaded and released successfully"
+          cat dist-manifest.json
+          echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
+      - name: "Upload dist-manifest.json"
+        uses: actions/upload-artifact@v4
+        with:
+          # Overwrite the previous copy
+          name: artifacts-dist-manifest
+          path: dist-manifest.json
+      # Create a GitHub Release while uploading all files to it
+      - name: "Download GitHub Artifacts"
+        uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: artifacts
+          merge-multiple: true
+      - name: Cleanup
+        run: |
+          # Remove the granular manifests
+          rm -f artifacts/*-dist-manifest.json
+      - name: Create GitHub Release
+        env:
+          PRERELEASE_FLAG: "${{ fromJson(steps.host.outputs.manifest).announcement_is_prerelease && '--prerelease' || '' }}"
+          ANNOUNCEMENT_TITLE: "${{ fromJson(steps.host.outputs.manifest).announcement_title }}"
+          ANNOUNCEMENT_BODY: "${{ fromJson(steps.host.outputs.manifest).announcement_github_body }}"
+          RELEASE_COMMIT: "${{ github.sha }}"
+        run: |
+          # Write and read notes from a file to avoid quoting breaking things
+          echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt
+
+          gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
+
+  announce:
+    needs:
+      - plan
+      - host
+    # use "always() && ..." to allow us to wait for all publish jobs while
+    # still allowing individual publish jobs to skip themselves (for prereleases).
+    # "host" however must run to completion, no skipping allowed!
+    if: ${{ always() && needs.host.result == 'success' }}
+    runs-on: "ubuntu-22.04"
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          submodules: recursive

.github/workflows/test.yml

@@ -0,0 +1,21 @@
+name: Run Tests
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  tests:
+    name: Run Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          profile: minimal
+      - uses: Swatinem/rust-cache@v2
+      - name: Run Tests
+        run: cargo test --all-features -- --nocapture

.gitignore

@@ -1,6 +1,18 @@
 
 .env
 .env.local
+.env.*
+!.env.example
+
+# Claude Code worktrees
+.claude/worktrees/
+
+# Sidecar tool data
+.sidecar/
+.todos/
 
 target/
 
+# WASM build artifacts (loaded from disk, not bundled)
+*.wasm
+

CHANGELOG.md

@@ -0,0 +1,171 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.5.0](https://github.com/nearai/ironclaw/compare/v0.4.0...v0.5.0) - 2026-02-17
+
+### Added
+
+- add cooldown management to FailoverProvider ([#114](https://github.com/nearai/ironclaw/pull/114))
+
+## [0.4.0](https://github.com/nearai/ironclaw/compare/v0.3.0...v0.4.0) - 2026-02-17
+
+### Added
+
+- move per-invocation approval check into Tool trait ([#119](https://github.com/nearai/ironclaw/pull/119))
+- add polished boot screen on CLI startup ([#118](https://github.com/nearai/ironclaw/pull/118))
+- Add lifecycle hooks system with 6 interception points ([#18](https://github.com/nearai/ironclaw/pull/18))
+
+### Other
+
+- remove accidentally committed .sidecar and .todos directories ([#123](https://github.com/nearai/ironclaw/pull/123))
+
+## [0.3.0](https://github.com/nearai/ironclaw/compare/v0.2.0...v0.3.0) - 2026-02-17
+
+### Added
+
+- direct api key and cheap model ([#116](https://github.com/nearai/ironclaw/pull/116))
+
+## [0.2.0](https://github.com/nearai/ironclaw/compare/v0.1.3...v0.2.0) - 2026-02-16
+
+### Added
+
+- mark Ollama + OpenAI-compatible as implemented ([#102](https://github.com/nearai/ironclaw/pull/102))
+- multi-provider inference + libSQL onboarding selection ([#92](https://github.com/nearai/ironclaw/pull/92))
+- add multi-provider LLM failover with retry backoff ([#28](https://github.com/nearai/ironclaw/pull/28))
+- add libSQL/Turso embedded database backend ([#47](https://github.com/nearai/ironclaw/pull/47))
+- Move debug log truncation from agent loop to REPL channel ([#65](https://github.com/nearai/ironclaw/pull/65))
+
+### Fixed
+
+- shell destructive-command check bypassed by Value::Object arguments ([#72](https://github.com/nearai/ironclaw/pull/72))
+- propagate real tool_call_id instead of hardcoded placeholder ([#73](https://github.com/nearai/ironclaw/pull/73))
+- Fix wasm tool schemas and runtime ([#42](https://github.com/nearai/ironclaw/pull/42))
+- flatten tool messages for NEAR AI cloud-api compatibility ([#41](https://github.com/nearai/ironclaw/pull/41))
+- security hardening across all layers ([#35](https://github.com/nearai/ironclaw/pull/35))
+
+### Other
+
+- Explicitly enable cargo-dist caching for binary artifacts building
+- Skip building binary artifacts on every PR
+- add module specification rules to CLAUDE.md
+- add setup/onboarding specification (src/setup/README.md)
+- deduplicate tool code and remove dead stubs ([#98](https://github.com/nearai/ironclaw/pull/98))
+- Reformat architecture diagram in README ([#64](https://github.com/nearai/ironclaw/pull/64))
+- Add review discipline guidelines to CLAUDE.md ([#68](https://github.com/nearai/ironclaw/pull/68))
+- Bump MSRV to 1.92, add GCP deployment files ([#40](https://github.com/nearai/ironclaw/pull/40))
+- Add OpenAI-compatible HTTP API (/v1/chat/completions, /v1/models)   ([#31](https://github.com/nearai/ironclaw/pull/31))
+
+## [0.1.3](https://github.com/nearai/ironclaw/compare/v0.1.2...v0.1.3) - 2026-02-12
+
+### Other
+
+- Enabled builds caching during CI/CD
+- Disabled npm publishing as the name is already taken
+
+## [0.1.2](https://github.com/nearai/ironclaw/compare/v0.1.1...v0.1.2) - 2026-02-12
+
+### Other
+
+- Added Installation instructions for the pre-built binaries
+- Disabled Windows ARM64 builds as auto-updater [provided by cargo-dist] does not support this platform yet and it is not a common platform for us to support
+
+## [0.1.1](https://github.com/nearai/ironclaw/compare/v0.1.0...v0.1.1) - 2026-02-12
+
+### Other
+
+- Renamed the secrets in release-plz.yml to match the configuration
+- Make sure that the binaries release CD it kicking in after release-plz
+
+## [0.1.0](https://github.com/nearai/ironclaw/releases/tag/v0.1.0) - 2026-02-12
+
+### Added
+
+- Add multi-provider LLM support via rig-core adapter ([#36](https://github.com/nearai/ironclaw/pull/36))
+- Sandbox jobs ([#4](https://github.com/nearai/ironclaw/pull/4))
+- Add Google Suite & Telegram WASM tools ([#9](https://github.com/nearai/ironclaw/pull/9))
+- Improve CLI ([#5](https://github.com/nearai/ironclaw/pull/5))
+
+### Fixed
+
+- resolve runtime panic in Linux keychain integration ([#32](https://github.com/nearai/ironclaw/pull/32))
+
+### Other
+
+- Skip release-plz on forks
+- Upgraded release-plz CD pipeline
+- Added CI/CD and release pipelines ([#45](https://github.com/nearai/ironclaw/pull/45))
+- DM pairing + Telegram channel improvements ([#17](https://github.com/nearai/ironclaw/pull/17))
+- Fixes build, adds missing sse event and correct command ([#11](https://github.com/nearai/ironclaw/pull/11))
+- Codex/feature parity pr hook ([#6](https://github.com/nearai/ironclaw/pull/6))
+- Add WebSocket gateway and control plane ([#8](https://github.com/nearai/ironclaw/pull/8))
+- select bundled Telegram channel and auto-install ([#3](https://github.com/nearai/ironclaw/pull/3))
+- Adding skills for reusable work
+- Fix MCP tool calls, approval loop, shutdown, and improve web UI
+- Add auth mode, fix MCP token handling, and parallelize startup loading
+- Merge remote-tracking branch 'origin/main' into ui
+- Adding web UI
+- Rename `setup` CLI command to `onboard` for compatibility
+- Add in-chat extension discovery, auth, and activation system
+- Add Telegram typing indicator via WIT on-status callback
+- Add proactivity features: memory CLI, session pruning, self-repair notifications, slash commands, status diagnostics, context warnings
+- Add hosted MCP server support with OAuth 2.1 and token refresh
+- Add interactive setup wizard and persistent settings
+- Rebrand to IronClaw with security-first mission
+- Fix build_software tool stuck in planning mode loop
+- Enable sandbox by default
+- Fix Telegram Markdown formatting and clarify tool/memory distinctions
+- Simplify Telegram channel config with host-injected tunnel/webhook settings
+- Apply Telegram channel learnings to WhatsApp implementation
+- Merge remote-tracking branch 'origin/main'
+- Docker file for sandbox
+- Replace hardcoded intent patterns with job tools
+- Fix router test to match intentional job creation patterns
+- Add Docker execution sandbox for secure shell command isolation
+- Move setup wizard credentials to database storage
+- Add interactive setup wizard for first-run configuration
+- Add Telegram Bot API channel as WASM module
+- Add OpenClaw feature parity tracking matrix
+- Add Chat Completions API support and expand REPL debugging
+- Implementing channels to be handled in wasm
+- Support non interactive mode and model selection
+- Implement tool approval, fix tool definition refresh, and wire embeddings
+- Tool use
+- Wiring more
+- Add heartbeat integration, planning phase, and auto-repair
+- Login flow
+- Extend support for session management
+- Adding builder capability
+- Load tools at launch
+- Fix multiline message rendering in TUI
+- Parse NEAR AI alternative response format with output field
+- Handle NEAR AI plain text responses
+- Disable mouse capture to allow text selection in TUI
+- Add verbose logging to debug empty NEAR AI responses
+- Improve NEAR AI response parsing for varying response formats
+- Show status/thinking messages in chat window, debug empty responses
+- Add timeout and logging to NEAR AI provider
+- Add status updates to show agent thinking/processing state
+- Add CLI subcommands for WASM tool management
+- Fix TUI shutdown: send /shutdown message and handle in agent loop
+- Remove SimpleCliChannel, add Ctrl+D twice quit, redirect logs to TUI
+- Fix TuiChannel integration and enable in main.rs
+- Integrate Codex patterns: task scheduler, TUI, sessions, compaction
+- Adding LICENSE
+- Add README with IronClaw branding
+- Add WASM sandbox secure API extension
+- Wire database Store into agent loop
+- Implementing WASM runtime
+- Add workspace integration tests
+- Compact memory_tree output format
+- Replace memory_list with memory_tree tool
+- Simplify workspace to path-based storage, remove legacy code
+- Add NEAR AI chat-api as default LLM provider
+- Add CLAUDE.md project documentation
+- Add workspace and memory system (OpenClaw-inspired)
+- Initial implementation of the agent framework

CLAUDE.md

@@ -11,8 +11,13 @@
 - **Always available** - Multi-channel access with proactive background execution
 
 ### Features
-- **Multi-channel input**: TUI (Ratatui), HTTP webhooks, Telegram, WhatsApp, Slack (WASM channels)
+- **Multi-channel input**: TUI (Ratatui), HTTP webhooks, WASM channels (Telegram, Slack), web gateway
 - **Parallel job execution** with state machine and self-repair for stuck jobs
+- **Sandbox execution**: Docker container isolation with orchestrator/worker pattern
+- **Claude Code mode**: Delegate jobs to Claude CLI inside containers
+- **Routines**: Scheduled (cron) and reactive (event, webhook) task execution
+- **Web gateway**: Browser UI with SSE/WebSocket real-time streaming
+- **Extension management**: Install, auth, activate MCP/WASM extensions
 - **Extensible tools**: Built-in tools, WASM sandbox, MCP client, dynamic builder
 - **Persistent memory**: Workspace with hybrid search (FTS + vector via RRF)
 - **Prompt injection defense**: Sanitizer, validator, policy rules, leak detection
@@ -59,7 +64,9 @@ src/
 │   ├── context_monitor.rs # Memory pressure detection
 │   ├── undo.rs         # Turn-based undo/redo with checkpoints
 │   ├── submission.rs   # Submission parsing (undo, redo, compact, clear, etc.)
-│   └── task.rs         # Sub-task execution framework
+│   ├── task.rs         # Sub-task execution framework
+│   ├── routine.rs      # Routine types (Trigger, Action, Guardrails)
+│   └── routine_engine.rs # Routine execution (cron ticker, event matcher)
 │
 ├── channels/           # Multi-channel input
 │   ├── channel.rs      # Channel trait, IncomingMessage, OutgoingResponse
@@ -72,8 +79,33 @@ src/
 │   │   ├── overlay.rs  # Approval overlays
 │   │   └── composer.rs # Message composition
 │   ├── http.rs         # HTTP webhook (axum) with secret validation
-│   ├── slack.rs        # Stub
-│   └── telegram.rs     # Stub
+│   ├── repl.rs         # Simple REPL (for testing)
+│   ├── web/            # Web gateway (browser UI)
+│   │   ├── mod.rs      # Gateway builder, startup
+│   │   ├── server.rs   # Axum router, 40+ API endpoints
+│   │   ├── sse.rs      # SSE broadcast manager
+│   │   ├── ws.rs       # WebSocket gateway + connection tracking
+│   │   ├── types.rs    # Request/response types, SseEvent enum
+│   │   ├── auth.rs     # Bearer token auth middleware
+│   │   ├── log_layer.rs # Tracing layer for log streaming
+│   │   └── static/     # HTML, CSS, JS (single-page app)
+│   └── wasm/           # WASM channel runtime
+│       ├── mod.rs
+│       ├── bundled.rs  # Bundled channel discovery
+│       └── wrapper.rs  # Channel trait wrapper for WASM modules
+│
+├── orchestrator/       # Internal HTTP API for sandbox containers
+│   ├── mod.rs
+│   ├── api.rs          # Axum endpoints (LLM proxy, events, prompts)
+│   ├── auth.rs         # Per-job bearer token store
+│   └── job_manager.rs  # Container lifecycle (create, stop, cleanup)
+│
+├── worker/             # Runs inside Docker containers
+│   ├── mod.rs
+│   ├── runtime.rs      # Worker execution loop (tool calls, LLM)
+│   ├── claude_bridge.rs # Claude Code bridge (spawns claude CLI)
+│   ├── api.rs          # HTTP client to orchestrator
+│   └── proxy_llm.rs    # LlmProvider that proxies through orchestrator
 │
 ├── safety/             # Prompt injection defense
 │   ├── sanitizer.rs    # Pattern detection, content escaping
@@ -96,6 +128,9 @@ src/
 │   │   ├── file.rs     # ReadFile, WriteFile, ListDir, ApplyPatch
 │   │   ├── shell.rs    # Shell command execution
 │   │   ├── memory.rs   # Memory tools (search, write, read, tree)
+│   │   ├── job.rs      # CreateJob, ListJobs, JobStatus, CancelJob
+│   │   ├── routine.rs  # routine_create/list/update/delete/history
+│   │   ├── extension_tools.rs # Extension install/auth/activate/remove
 │   │   └── marketplace.rs, ecommerce.rs, taskrabbit.rs, restaurant.rs (stubs)
 │   ├── builder/        # Dynamic tool building
 │   │   ├── core.rs     # BuildRequirement, SoftwareType, Language
@@ -116,6 +151,12 @@ src/
 │       ├── rate_limiter.rs # Per-tool rate limiting
 │       └── storage.rs  # Linear memory persistence
 │
+├── db/                 # Database abstraction layer
+│   ├── mod.rs          # Database trait (~60 async methods)
+│   ├── postgres.rs     # PostgreSQL backend (delegates to Store + Repository)
+│   ├── libsql_backend.rs # libSQL/Turso backend (embedded SQLite)
+│   └── libsql_migrations.rs # SQLite-dialect schema (idempotent)
+│
 ├── workspace/          # Persistent memory system (OpenClaw-inspired)
 │   ├── mod.rs          # Workspace struct, memory operations
 │   ├── document.rs     # MemoryDocument, MemoryChunk, WorkspaceEntry
@@ -157,8 +198,9 @@ When designing new features or systems, always prefer generic/extensible archite
 
 ### Error Handling
 - Use `thiserror` for error types in `error.rs`
-- Never use `.unwrap()` in production code (tests are fine)
+- Never use `.unwrap()` or `.expect()` in production code (tests are fine)
 - Map errors with context: `.map_err(|e| SomeError::Variant { reason: e.to_string() })?`
+- Before committing, grep for `.unwrap()` and `.expect(` in changed files to catch violations mechanically
 
 ### Async
 - All I/O is async with tokio
@@ -166,6 +208,7 @@ When designing new features or systems, always prefer generic/extensible archite
 - Use `RwLock` for concurrent read/write access
 
 ### Traits for Extensibility
+- `Database` - Add new database backends (must implement all ~60 methods)
 - `Channel` - Add new input sources
 - `Tool` - Add new capabilities
 - `LlmProvider` - Add new LLM backends
@@ -213,7 +256,12 @@ Pending -> InProgress -> Completed -> Submitted -> Accepted
 
 Environment variables (see `.env.example`):
 ```bash
+# Database backend (default: postgres)
+DATABASE_BACKEND=postgres               # or "libsql" / "turso"
 DATABASE_URL=postgres://user:pass@localhost/ironclaw
+LIBSQL_PATH=~/.ironclaw/ironclaw.db    # libSQL local path (default)
+# LIBSQL_URL=libsql://xxx.turso.io    # Turso cloud (optional)
+# LIBSQL_AUTH_TOKEN=xxx                # Required with LIBSQL_URL
 
 # NEAR AI (required)
 NEARAI_SESSION_TOKEN=sess_...
@@ -236,6 +284,30 @@ HEARTBEAT_ENABLED=true
 HEARTBEAT_INTERVAL_SECS=1800            # 30 minutes
 HEARTBEAT_NOTIFY_CHANNEL=tui
 HEARTBEAT_NOTIFY_USER=default
+
+# Web gateway
+GATEWAY_ENABLED=true
+GATEWAY_HOST=127.0.0.1
+GATEWAY_PORT=3001
+GATEWAY_AUTH_TOKEN=changeme           # Required for API access
+GATEWAY_USER_ID=default
+
+# Docker sandbox
+SANDBOX_ENABLED=true
+SANDBOX_IMAGE=ironclaw-worker:latest
+SANDBOX_MEMORY_LIMIT_MB=512
+SANDBOX_TIMEOUT_SECS=1800
+
+# Claude Code mode (runs inside sandbox containers)
+CLAUDE_CODE_ENABLED=false
+CLAUDE_CODE_MODEL=claude-sonnet-4-20250514
+CLAUDE_CODE_MAX_TURNS=50
+CLAUDE_CODE_CONFIG_DIR=/home/worker/.claude
+
+# Routines (scheduled/reactive execution)
+ROUTINES_ENABLED=true
+ROUTINES_CRON_INTERVAL=60            # Tick interval in seconds
+ROUTINES_MAX_CONCURRENT=3
 ```
 
 ### NEAR AI Provider
@@ -249,7 +321,51 @@ Session tokens have the format `sess_xxx` (37 characters). They are authenticate
 
 ## Database
 
-Single migration in `migrations/V1__initial.sql`. Tables:
+IronClaw supports two database backends, selected at compile time via Cargo feature flags and at runtime via the `DATABASE_BACKEND` environment variable.
+
+**IMPORTANT: All new features that touch persistence MUST support both backends.** Implement the operation as a method on the `Database` trait in `src/db/mod.rs`, then add the implementation in both `src/db/postgres.rs` (delegate to Store/Repository) and `src/db/libsql_backend.rs` (native SQL).
+
+### Backends
+
+| Backend | Feature Flag | Default | Use Case |
+|---------|-------------|---------|----------|
+| PostgreSQL | `postgres` (default) | Yes | Production, existing deployments |
+| libSQL/Turso | `libsql` | No | Zero-dependency local mode, edge, Turso cloud |
+
+```bash
+# Build with PostgreSQL only (default)
+cargo build
+
+# Build with libSQL only
+cargo build --no-default-features --features libsql
+
+# Build with both backends available
+cargo build --features "postgres,libsql"
+```
+
+### Database Trait
+
+The `Database` trait (`src/db/mod.rs`) defines ~60 async methods covering all persistence:
+- Conversations, messages, metadata
+- Jobs, actions, LLM calls, estimation snapshots
+- Sandbox jobs, job events
+- Routines, routine runs
+- Tool failures, settings
+- Workspace: documents, chunks, hybrid search
+
+Both backends implement this trait. PostgreSQL delegates to the existing `Store` + `Repository`. libSQL implements native SQLite-dialect SQL.
+
+### Schema
+
+**PostgreSQL:** `migrations/V1__initial.sql` (351 lines). Uses pgvector for embeddings, tsvector for FTS, PL/pgSQL functions. Managed by `refinery`.
+
+**libSQL:** `src/db/libsql_migrations.rs` (consolidated schema, ~480 lines). Translates PG types:
+- `UUID` -> `TEXT`, `TIMESTAMPTZ` -> `TEXT` (ISO-8601), `JSONB` -> `TEXT`
+- `VECTOR(1536)` -> `F32_BLOB(1536)` with `libsql_vector_idx`
+- `tsvector`/`ts_rank_cd` -> FTS5 virtual table with sync triggers
+- PL/pgSQL functions -> SQLite triggers
+
+**Tables (both backends):**
 
 **Core:**
 - `conversations` - Multi-channel conversation tracking
@@ -261,12 +377,41 @@ Single migration in `migrations/V1__initial.sql`. Tables:
 
 **Workspace/Memory:**
 - `memory_documents` - Flexible path-based files (e.g., "context/vision.md", "daily/2024-01-15.md")
-- `memory_chunks` - Chunked content with FTS (tsvector) and vector (pgvector) indexes
+- `memory_chunks` - Chunked content with FTS and vector indexes
 - `heartbeat_state` - Periodic execution tracking
 
-Requires pgvector extension: `CREATE EXTENSION IF NOT EXISTS vector;`
+**Other:**
+- `routines`, `routine_runs` - Scheduled/reactive execution
+- `settings` - Per-user key-value settings
+- `tool_failures` - Self-repair tracking
+- `secrets`, `wasm_tools`, `tool_capabilities` - Extension infrastructure
 
-Run migrations: `refinery migrate -c refinery.toml`
+### Configuration
+
+```bash
+# Backend selection (default: postgres)
+DATABASE_BACKEND=libsql
+
+# PostgreSQL
+DATABASE_URL=postgres://user:pass@localhost/ironclaw
+
+# libSQL (embedded)
+LIBSQL_PATH=~/.ironclaw/ironclaw.db    # Default path
+
+# libSQL (Turso cloud sync)
+LIBSQL_URL=libsql://your-db.turso.io
+LIBSQL_AUTH_TOKEN=your-token            # Required when LIBSQL_URL is set
+```
+
+### Current Limitations (libSQL backend)
+
+- **Workspace/memory system** not yet wired through Database trait (requires Store migration)
+- **Secrets store** not yet available (still requires PostgresSecretsStore)
+- **Hybrid search** uses FTS5 only (vector search via libsql_vector_idx not yet implemented)
+- **Settings reload from DB** skipped (Config::from_db requires Store)
+- No incremental migration versioning (schema is CREATE IF NOT EXISTS, no ALTER TABLE support yet)
+- **No encryption at rest** -- The local SQLite database file stores conversation content, job data, workspace memory, and other application data in plaintext. Only secrets (API tokens, credentials) are encrypted via AES-256-GCM before storage. Users handling sensitive data should use full-disk encryption (FileVault, LUKS, BitLocker) or consider the PostgreSQL backend with TDE/encrypted storage.
+- **JSON merge patch vs path-targeted update** -- The libSQL backend uses RFC 7396 JSON Merge Patch (`json_patch`) for metadata updates, while PostgreSQL uses path-targeted `jsonb_set`. Merge patch replaces top-level keys entirely, which may drop nested keys not present in the patch. Callers should avoid relying on partial nested object updates in metadata fields.
 
 ## Safety Layer
 
@@ -297,13 +442,14 @@ Key test patterns:
 
 ## Current Limitations / TODOs
 
-1. **Slack/Telegram channels** - Stubs only, need implementation
-2. **Domain-specific tools** - `marketplace.rs`, `restaurant.rs`, `taskrabbit.rs`, `ecommerce.rs` return placeholder responses; need real API integrations
-3. **Integration tests** - Need testcontainers setup for PostgreSQL
-4. **MCP stdio transport** - Only HTTP transport implemented
-5. **WIT bindgen integration** - Auto-extract tool description/schema from WASM modules (stubbed)
-6. **Capability granting after tool build** - Built tools get empty capabilities; need UX for granting HTTP/secrets access
-7. **Tool versioning workflow** - No version tracking or rollback for dynamically built tools
+1. **Domain-specific tools** - `marketplace.rs`, `restaurant.rs`, `taskrabbit.rs`, `ecommerce.rs` return placeholder responses; need real API integrations
+2. **Integration tests** - Need testcontainers setup for PostgreSQL
+3. **MCP stdio transport** - Only HTTP transport implemented
+4. **WIT bindgen integration** - Auto-extract tool description/schema from WASM modules (stubbed)
+5. **Capability granting after tool build** - Built tools get empty capabilities; need UX for granting HTTP/secrets access
+6. **Tool versioning workflow** - No version tracking or rollback for dynamically built tools
+7. **Webhook trigger endpoint** - Routines webhook trigger not yet exposed in web gateway
+8. **Full channel status view** - Gateway status widget exists, but no per-channel connection dashboard
 
 ### Completed
 
@@ -320,6 +466,14 @@ Key test patterns:
 - ✅ **Tool approval enforcement** - Tools with `requires_approval()` (shell, http, file write/patch, build_software) now gate execution, track auto-approved tools per session
 - ✅ **Tool definition refresh** - Tool definitions refreshed each iteration so newly built tools become visible in same session
 - ✅ **Worker tool call handling** - Uses `respond_with_tools()` to properly execute tool calls when `select_tools()` returns empty
+- ✅ **Gateway control plane** - Web gateway with 40+ API endpoints, SSE/WebSocket
+- ✅ **Web Control UI** - Browser-based dashboard with chat, memory, jobs, logs, extensions, routines
+- ✅ **Slack/Telegram channels** - Implemented as WASM tools
+- ✅ **Docker sandbox** - Orchestrator/worker containers with per-job auth
+- ✅ **Claude Code mode** - Delegate jobs to Claude CLI inside containers
+- ✅ **Routines system** - Cron, event, webhook, and manual triggers with guardrails
+- ✅ **Extension management** - Install, auth, activate MCP/WASM extensions via CLI and web UI
+- ✅ **libSQL/Turso backend** - Database trait abstraction (`src/db/`), feature-gated dual backend support (postgres/libsql), embedded SQLite for zero-dependency local mode
 
 ## Adding a New Tool
 
@@ -476,6 +630,22 @@ RUST_LOG=ironclaw::agent=debug cargo run
 RUST_LOG=ironclaw=debug,tower_http=debug cargo run
 ```
 
+## Module Specifications
+
+Some modules have a `README.md` that serves as the authoritative specification
+for that module's behavior. When modifying code in a module that has a spec:
+
+1. **Read the spec first** before making changes
+2. **Code follows spec**: if the spec says X, the code must do X
+3. **Update both sides**: if you change behavior, update the spec to match;
+   if you're implementing a spec change, update the code to match
+4. **Spec is the tiebreaker**: when code and spec disagree, the spec is correct
+   (unless the spec is clearly outdated, in which case fix the spec first)
+
+| Module | Spec File |
+|--------|-----------|
+| `src/setup/` | `src/setup/README.md` |
+
 ## Code Style
 
 - Use `crate::` imports, not `super::`
@@ -484,6 +654,37 @@ RUST_LOG=ironclaw=debug,tower_http=debug cargo run
 - Keep functions focused, extract helpers when logic is reused
 - Comments for non-obvious logic only
 
+## Review & Fix Discipline
+
+Hard-won lessons from code review -- follow these when fixing bugs or addressing review feedback.
+
+### Fix the pattern, not just the instance
+When a reviewer flags a bug (e.g., TOCTOU race in INSERT + SELECT-back), search the entire codebase for all instances of that same pattern. A fix in `SecretsStore::create()` that doesn't also fix `WasmToolStore::store()` is half a fix.
+
+### Propagate architectural fixes to satellite types
+If a core type changes its concurrency model (e.g., `LibSqlBackend` switches to connection-per-operation), every type that was handed a resource from the old model (e.g., `LibSqlSecretsStore`, `LibSqlWasmToolStore` holding a single `Connection`) must also be updated. Grep for the old type across the codebase.
+
+### Schema translation is more than DDL
+When translating a database schema between backends (PostgreSQL to libSQL, etc.), check for:
+- **Indexes** -- diff `CREATE INDEX` statements between the two schemas
+- **Seed data** -- check for `INSERT INTO` in migrations (e.g., `leak_detection_patterns`)
+- **Semantic differences** -- document where SQL functions behave differently (e.g., `json_patch` vs `jsonb_set`)
+
+### Feature flag testing
+When adding feature-gated code, test compilation with each feature in isolation:
+```bash
+cargo check                                          # default features
+cargo check --no-default-features --features libsql  # libsql only
+cargo check --all-features                           # all features
+```
+Dead code behind the wrong `#[cfg]` gate will only show up when building with a single feature.
+
+### Mechanical verification before committing
+Run these checks on changed files before committing:
+- `grep -rnE '\.unwrap\(|\.expect\(' <files>` -- no panics in production
+- `grep -rn 'super::' <files>` -- use `crate::` imports
+- If you fixed a pattern bug, `grep` for other instances of that pattern across `src/`
+
 ## Workspace & Memory System
 
 Inspired by [OpenClaw](https://github.com/openclaw/openclaw), the workspace provides persistent memory for agents with a flexible filesystem-like structure.
@@ -558,7 +759,7 @@ Four tools for LLM use:
 
 ### Hybrid Search (RRF)
 
-Combines full-text search (PostgreSQL `ts_rank_cd`) and vector similarity (pgvector cosine) using Reciprocal Rank Fusion:
+Combines full-text search and vector similarity using Reciprocal Rank Fusion:
 
 ```
 score(d) = Σ 1/(k + rank(d)) for each method where d appears
@@ -566,6 +767,10 @@ score(d) = Σ 1/(k + rank(d)) for each method where d appears
 
 Default k=60. Results from both methods are combined, with documents appearing in both getting boosted scores.
 
+**Backend differences:**
+- **PostgreSQL:** `ts_rank_cd` for FTS, pgvector cosine distance for vectors, full RRF
+- **libSQL:** FTS5 for keyword search only (vector search via `libsql_vector_idx` not yet wired)
+
 ### Heartbeat System
 
 Proactive periodic execution (default: 30 minutes):

Cargo.toml

@@ -1,13 +1,27 @@
 [workspace]
-members = [".", "benchmarks"]
+exclude = [
+    "channels-src/telegram",
+    "channels-src/slack",
+    "channels-src/whatsapp",
+    "tools-src/gmail",
+]
 
 [package]
 name = "ironclaw"
-version = "0.1.0"
+version = "0.5.0"
 edition = "2024"
-rust-version = "1.85"
+rust-version = "1.92"
 description = "Secure personal AI assistant that protects your data and expands its capabilities on the fly"
+authors = ["NEAR AI <[email protected]>"]
 license = "MIT OR Apache-2.0"
+homepage = "https://github.com/nearai/ironclaw"
+repository = "https://github.com/nearai/ironclaw"
+
+[package.metadata.wix]
+upgrade-guid = "D0156E61-BA37-451E-8AB9-1A2ECCCFA48F"
+path-guid = "F90B6EA6-87F7-499B-BB19-CF55DE1EB339"
+license = false
+eula = false
 
 [dependencies]
 # Async runtime
@@ -16,17 +30,20 @@ tokio-stream = { version = "0.1", features = ["sync"] }
 futures = "0.3"
 
 # HTTP client
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots", "stream"] }
 
 # Serialization
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 
-# Database
-deadpool-postgres = "0.14"
-tokio-postgres = { version = "0.7", features = ["with-uuid-1", "with-chrono-0_4", "with-serde_json-1"] }
-postgres-types = { version = "0.2", features = ["with-serde_json-1"] }
-refinery = { version = "0.8", features = ["tokio-postgres"] }
+# Database - PostgreSQL (default, feature-gated)
+deadpool-postgres = { version = "0.14", optional = true }
+tokio-postgres = { version = "0.7", features = ["with-uuid-1", "with-chrono-0_4", "with-serde_json-1"], optional = true }
+postgres-types = { version = "0.2", features = ["with-serde_json-1"], optional = true }
+refinery = { version = "0.8", features = ["tokio-postgres"], optional = true }
+
+# Database - libSQL/Turso (optional embedded database)
+libsql = { version = "0.6", optional = true, default-features = false, features = ["core", "replication"] }
 
 # Error handling
 thiserror = "2"
@@ -42,7 +59,7 @@ dotenvy = "0.15"
 # Core types
 uuid = { version = "1", features = ["v4", "serde"] }
 chrono = { version = "0.4", features = ["serde"] }
-rust_decimal = { version = "1", features = ["serde", "serde-with-str", "db-tokio-postgres", "maths"] }
+rust_decimal = { version = "1", features = ["serde", "serde-with-str", "maths"] }
 rust_decimal_macros = "1"
 
 # Async traits
@@ -61,17 +78,22 @@ axum = { version = "0.8", features = ["ws"] }
 tower = "0.5"
 tower-http = { version = "0.6", features = ["trace", "cors"] }
 
+# Cron scheduling for routines
+cron = "0.13"
+
 # Safety/sanitization
 regex = "1"
 aho-corasick = "1"
 
 # Filesystem paths
 dirs = "6"
+fs4 = "0.6"
 
 # Secrecy for sensitive values
 secrecy = { version = "0.10", features = ["serde"] }
 
-# URL encoding for OAuth flow
+# URL parsing and encoding
+url = "2"
 urlencoding = "2"
 
 # Open URLs in browser
@@ -79,7 +101,7 @@ open = "5"
 
 # Vector embeddings for semantic search
 # The postgres feature provides ToSql/FromSql for postgres-types (shared by tokio-postgres)
-pgvector = { version = "0.4", features = ["postgres"] }
+pgvector = { version = "0.4", features = ["postgres"], optional = true }
 
 # WASM sandbox for untrusted tool execution
 wasmtime = { version = "28", features = ["component-model"] }
@@ -92,6 +114,10 @@ hkdf = "0.12"
 sha2 = "0.10"
 blake3 = "1"
 rand = "0.8"
+subtle = "2"  # Constant-time comparisons for token validation
+
+# Multi-provider LLM support
+rig-core = "0.30"
 
 # Docker sandbox
 bollard = "0.18"
@@ -102,6 +128,7 @@ hyper-util = { version = "0.1", features = ["server", "tokio", "http1", "http2"]
 http-body-util = "0.1"
 bytes = "1"
 base64 = "0.22.1"
+mime_guess = "2.0.5"
 
 # macOS keychain
 [target.'cfg(target_os = "macos")'.dependencies]
@@ -120,5 +147,61 @@ pretty_assertions = "1"
 tempfile = "3"
 
 [features]
-default = []
+default = ["postgres", "libsql"]
+postgres = [
+    "dep:deadpool-postgres",
+    "dep:tokio-postgres",
+    "dep:postgres-types",
+    "dep:refinery",
+    "dep:pgvector",
+    "rust_decimal/db-tokio-postgres",
+]
+libsql = ["dep:libsql"]
 integration = []
+
+[[example]]
+name = "test_heartbeat"
+required-features = ["postgres"]
+
+# The profile that 'cargo dist' will build with
+[profile.dist]
+inherits = "release"
+lto = "thin"
+
+# Config for 'dist'
+[workspace.metadata.dist]
+# The preferred dist version to use in CI (Cargo.toml SemVer syntax)
+cargo-dist-version = "0.30.3"
+# CI backends to support
+ci = "github"
+# The installers to generate for each app
+installers = ["shell", "powershell", "npm", "msi"]
+# Publish jobs to run in CI
+publish-jobs = []
+# Target platforms to build apps for (Rust target-triple syntax)
+targets = [
+    "aarch64-apple-darwin",
+    "aarch64-unknown-linux-gnu",
+    "x86_64-apple-darwin",
+    "x86_64-unknown-linux-gnu",
+    "x86_64-pc-windows-msvc",
+]
+# The archive format to use for windows builds (defaults .zip)
+windows-archive = ".tar.gz"
+# The archive format to use for non-windows builds (defaults .tar.xz)
+unix-archive = ".tar.gz"
+# Which actions to run on pull requests
+pr-run-mode = "skip"
+# Path that installers should place binaries in
+install-path = "CARGO_HOME"
+# Whether to install an updater program
+install-updater = true
+# Cache intermediate build artifacts to speed up the release pipelines
+cache-builds = true
+
+[workspace.metadata.dist.github-custom-runners]
+aarch64-unknown-linux-gnu = "ubuntu-24.04-arm"
+x86_64-unknown-linux-gnu = "ubuntu-22.04"
+x86_64-pc-windows-msvc = "windows-2022"
+x86_64-apple-darwin = "macos-15-intel"
+aarch64-apple-darwin = "macos-14"

Dockerfile

@@ -0,0 +1,46 @@
+# Multi-stage Dockerfile for the IronClaw agent (cloud deployment).
+#
+# Build:
+#   docker build --platform linux/amd64 -t ironclaw:latest .
+#
+# Run:
+#   docker run --env-file .env -p 3000:3000 ironclaw:latest
+
+# Stage 1: Build
+FROM rust:1.92-slim-bookworm AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config libssl-dev cmake gcc g++ \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Copy manifests first for layer caching
+COPY Cargo.toml Cargo.lock ./
+
+# Copy source and build artifacts
+COPY src/ src/
+COPY migrations/ migrations/
+COPY wit/ wit/
+
+RUN cargo build --release --bin ironclaw
+
+# Stage 2: Runtime
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /app/target/release/ironclaw /usr/local/bin/ironclaw
+COPY --from=builder /app/migrations /app/migrations
+
+# Non-root user
+RUN useradd -m -u 1000 -s /bin/bash ironclaw
+USER ironclaw
+
+EXPOSE 3000
+
+ENV RUST_LOG=ironclaw=info
+
+ENTRYPOINT ["ironclaw"]

Dockerfile.worker

@@ -0,0 +1,63 @@
+# Multi-stage Dockerfile for the IronClaw worker container.
+#
+# This image runs the ironclaw binary in worker mode inside Docker containers.
+# The orchestrator creates instances of this image for sandboxed job execution.
+#
+# Build:
+#   docker build -f Dockerfile.worker -t ironclaw-worker .
+#
+# The image includes common development tools so workers can build software,
+# run tests, and execute shell commands.
+
+FROM rust:1.92-bookworm AS builder
+
+WORKDIR /build
+COPY . .
+
+# Build only the ironclaw binary (release mode)
+RUN cargo build --release --bin ironclaw
+
+# ---
+
+FROM debian:bookworm-slim
+
+# Install common development tools
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    git \
+    build-essential \
+    pkg-config \
+    libssl-dev \
+    nodejs \
+    npm \
+    python3 \
+    python3-pip \
+    python3-venv \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Rust toolchain for the sandbox user
+ENV RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:$PATH
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.92.0 \
+    && chmod -R a+r /usr/local/rustup /usr/local/cargo
+
+# Install Claude Code CLI (for claude-bridge mode)
+RUN npm install -g @anthropic-ai/claude-code@latest
+
+# Copy the binary
+COPY --from=builder /build/target/release/ironclaw /usr/local/bin/ironclaw
+
+# Create non-root user (UID 1000 matches the orchestrator's container config)
+RUN useradd -m -u 1000 -s /bin/bash sandbox \
+    && mkdir -p /workspace \
+    && chown sandbox:sandbox /workspace \
+    && mkdir -p /home/sandbox/.claude \
+    && chown sandbox:sandbox /home/sandbox/.claude
+
+USER sandbox
+WORKDIR /workspace
+
+# The orchestrator passes the full command via Docker cmd.
+ENTRYPOINT ["ironclaw"]

FEATURE_PARITY.md

@@ -16,8 +16,8 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 | Feature | OpenClaw | IronClaw | Notes |
 |---------|----------|----------|-------|
-| Hub-and-spoke architecture | ✅ | 🚧 | IronClaw has channels but no central gateway |
-| WebSocket control plane | ✅ | ❌ | Gateway with ws://127.0.0.1:18789 |
+| Hub-and-spoke architecture | ✅ | ✅ | Web gateway as central hub |
+| WebSocket control plane | ✅ | ✅ | Gateway with WebSocket + SSE |
 | Single-user system | ✅ | ✅ | |
 | Multi-agent routing | ✅ | ❌ | Workspace isolation per-agent |
 | Session-based messaging | ✅ | ✅ | Per-sender sessions |
@@ -31,19 +31,19 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 | Feature | OpenClaw | IronClaw | Notes |
 |---------|----------|----------|-------|
-| Gateway control plane | ✅ | ❌ | Central WebSocket server |
-| HTTP endpoints for Control UI | ✅ | ❌ | Web dashboard |
-| Channel connection lifecycle | ✅ | 🚧 | ChannelManager handles streams |
+| Gateway control plane | ✅ | ✅ | Web gateway with 40+ API endpoints |
+| HTTP endpoints for Control UI | ✅ | ✅ | Web dashboard with chat, memory, jobs, logs, extensions |
+| Channel connection lifecycle | ✅ | ✅ | ChannelManager + WebSocket tracker |
 | Session management/routing | ✅ | ✅ | SessionManager exists |
 | Configuration hot-reload | ✅ | ❌ | |
 | Network modes (loopback/LAN/remote) | ✅ | 🚧 | HTTP only |
-| OpenAI-compatible HTTP API | ✅ | ❌ | /v1/chat/completions |
+| OpenAI-compatible HTTP API | ✅ | ✅ | /v1/chat/completions |
 | Canvas hosting | ✅ | ❌ | Agent-driven UI |
 | Gateway lock (PID-based) | ✅ | ❌ | |
 | launchd/systemd integration | ✅ | ❌ | |
 | Bonjour/mDNS discovery | ✅ | ❌ | |
 | Tailscale integration | ✅ | ❌ | |
-| Health check endpoints | ✅ | ❌ | |
+| Health check endpoints | ✅ | ✅ | /api/health + /api/gateway/status |
 | `doctor` diagnostics | ✅ | ❌ | |
 
 ### Owner: _Unassigned_
@@ -59,14 +59,14 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | REPL (simple) | ✅ | ✅ | - | For testing |
 | WASM channels | ❌ | ✅ | - | IronClaw innovation |
 | WhatsApp | ✅ | ❌ | P1 | Baileys (Web) |
-| Telegram | ✅ | ❌ | P1 | grammY (Bot API) |
+| Telegram | ✅ | ✅ | - | WASM channel(MTProto), DM pairing, caption, /start, bot_username |
 | Discord | ✅ | ❌ | P2 | discord.js |
 | Signal | ✅ | ❌ | P2 | signal-cli |
-| Slack | ✅ | 🚧 | P1 | Stub exists, needs implementation |
+| Slack | ✅ | ✅ | - | WASM tool |
 | iMessage | ✅ | ❌ | P3 | BlueBubbles recommended |
 | Feishu/Lark | ✅ | ❌ | P3 | |
 | LINE | ✅ | ❌ | P3 | |
-| WebChat | ✅ | ❌ | P2 | Browser-based chat |
+| WebChat | ✅ | ✅ | - | Web gateway chat |
 | Matrix | ✅ | ❌ | P3 | E2EE support |
 | Mattermost | ✅ | ❌ | P3 | |
 | Google Chat | ✅ | ❌ | P3 | |
@@ -79,13 +79,13 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 | Feature | OpenClaw | IronClaw | Notes |
 |---------|----------|----------|-------|
-| DM pairing codes | ✅ | ❌ | Verification for unknown senders |
-| Allowlist/blocklist | ✅ | ❌ | Per-channel access control |
+| DM pairing codes | ✅ | ✅ | `ironclaw pairing list/approve`, host APIs |
+| Allowlist/blocklist | ✅ | 🚧 | allow_from + pairing store |
 | Self-message bypass | ✅ | ❌ | Own messages skip pairing |
-| Mention-based activation | ✅ | ❌ | Configurable patterns |
+| Mention-based activation | ✅ | ✅ | bot_username + respond_to_all_group_messages |
 | Per-group tool policies | ✅ | ❌ | Allow/deny specific tools |
 | Thread isolation | ✅ | ✅ | Separate sessions per thread |
-| Per-channel media limits | ✅ | ❌ | |
+| Per-channel media limits | ✅ | 🚧 | Caption support for media; no size limits |
 | Typing indicators | ✅ | 🚧 | TUI shows status |
 
 ### Owner: _Unassigned_
@@ -99,20 +99,20 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | `run` (agent) | ✅ | ✅ | - | Default command |
 | `tool install/list/remove` | ✅ | ✅ | - | WASM tools |
 | `gateway start/stop` | ✅ | ❌ | P2 | |
-| `onboard` (wizard) | ✅ | ❌ | P2 | Interactive setup |
+| `onboard` (wizard) | ✅ | ✅ | - | Interactive setup |
 | `tui` | ✅ | ✅ | - | Ratatui TUI |
-| `config` | ✅ | ❌ | P2 | Read/write config |
+| `config` | ✅ | ✅ | - | Read/write config |
 | `channels` | ✅ | ❌ | P2 | Channel management |
 | `models` | ✅ | 🚧 | - | Model selector in TUI |
-| `status` | ✅ | ❌ | P2 | System status |
+| `status` | ✅ | ✅ | - | System status |
 | `agents` | ✅ | ❌ | P3 | Multi-agent management |
 | `sessions` | ✅ | ❌ | P3 | Session listing |
-| `memory` | ✅ | ❌ | P2 | Memory search CLI |
+| `memory` | ✅ | ✅ | - | Memory search CLI |
 | `skills` | ✅ | ❌ | P3 | Agent skills |
-| `pairing` | ✅ | ❌ | P3 | Node pairing |
+| `pairing` | ✅ | ✅ | - | list/approve for channel DM pairing |
 | `nodes` | ✅ | ❌ | P3 | Device management |
 | `plugins` | ✅ | ❌ | P3 | Plugin management |
-| `hooks` | ✅ | ❌ | P2 | Lifecycle hooks |
+| `hooks` | ✅ | ✅ | P2 | Lifecycle hooks |
 | `cron` | ✅ | ❌ | P2 | Scheduled jobs |
 | `webhooks` | ✅ | ❌ | P3 | Webhook config |
 | `message send` | ✅ | ❌ | P2 | Send to channels |
@@ -132,8 +132,8 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | Feature | OpenClaw | IronClaw | Notes |
 |---------|----------|----------|-------|
 | Pi agent runtime | ✅ | ➖ | IronClaw uses custom runtime |
-| RPC-based execution | ✅ | 🚧 | Worker isolation |
-| Multi-provider failover | ✅ | ❌ | Provider fallback chains |
+| RPC-based execution | ✅ | ✅ | Orchestrator/worker pattern |
+| Multi-provider failover | ✅ | ✅ | `FailoverProvider` tries providers sequentially on retryable errors |
 | Per-sender sessions | ✅ | ✅ | |
 | Global sessions | ✅ | ❌ | Optional shared context |
 | Session pruning | ✅ | ❌ | Auto cleanup old sessions |
@@ -164,7 +164,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | AWS Bedrock | ✅ | ❌ | P3 | |
 | Google Gemini | ✅ | ❌ | P3 | |
 | OpenRouter | ✅ | ❌ | P3 | |
-| Ollama (local) | ✅ | ❌ | P2 | Local models |
+| Ollama (local) | ✅ | ✅ | - | via `rig::providers::ollama` (full support) |
 | node-llama-cpp | ✅ | ➖ | - | N/A for Rust |
 | llama.cpp (native) | ❌ | 🔮 | P3 | Rust bindings |
 
@@ -173,8 +173,8 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | Feature | OpenClaw | IronClaw | Notes |
 |---------|----------|----------|-------|
 | Auto-discovery | ✅ | ❌ | |
-| Failover chains | ✅ | ❌ | Provider fallback |
-| Cooldown management | ✅ | ❌ | Skip failed providers |
+| Failover chains | ✅ | ✅ | `FailoverProvider` with configurable `fallback_model` |
+| Cooldown management | ✅ | ✅ | Lock-free per-provider cooldown in `FailoverProvider` |
 | Per-session model override | ✅ | ✅ | Model selector in TUI |
 | Model selection UI | ✅ | ✅ | TUI keyboard shortcut |
 
@@ -303,13 +303,13 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 | Feature | OpenClaw | IronClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
-| Control UI Dashboard | ✅ | ❌ | P2 | Web status/config |
-| Channel status view | ✅ | ❌ | P2 | |
+| Control UI Dashboard | ✅ | ✅ | - | Web gateway with chat, memory, jobs, logs, extensions |
+| Channel status view | ✅ | 🚧 | P2 | Gateway status widget, full channel view pending |
 | Agent management | ✅ | ❌ | P3 | |
 | Model selection | ✅ | ✅ | - | TUI only |
 | Config editing | ✅ | ❌ | P3 | |
-| Debug/logs viewer | ✅ | ❌ | P3 | |
-| WebChat interface | ✅ | ❌ | P2 | Browser chat |
+| Debug/logs viewer | ✅ | ✅ | - | Real-time log streaming with level/target filters |
+| WebChat interface | ✅ | ✅ | - | Web gateway chat with SSE/WebSocket |
 | Canvas system (A2UI) | ✅ | ❌ | P3 | Agent-driven UI |
 
 ### Owner: _Unassigned_
@@ -320,17 +320,17 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 | Feature | OpenClaw | IronClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
-| Cron jobs | ✅ | ❌ | P2 | Schedule-based tasks |
-| Timezone support | ✅ | ❌ | P2 | |
-| One-shot/recurring jobs | ✅ | ❌ | P2 | |
-| `beforeInbound` hook | ✅ | ❌ | P2 | |
-| `beforeOutbound` hook | ✅ | ❌ | P2 | |
-| `beforeToolCall` hook | ✅ | ❌ | P2 | |
-| `onMessage` hook | ✅ | ❌ | P2 | |
-| `onSessionStart` hook | ✅ | ❌ | P2 | |
-| `onSessionEnd` hook | ✅ | ❌ | P2 | |
+| Cron jobs | ✅ | ✅ | - | Routines with cron trigger |
+| Timezone support | ✅ | ✅ | - | Via cron expressions |
+| One-shot/recurring jobs | ✅ | ✅ | - | Manual + cron triggers |
+| `beforeInbound` hook | ✅ | ✅ | P2 | |
+| `beforeOutbound` hook | ✅ | ✅ | P2 | |
+| `beforeToolCall` hook | ✅ | ✅ | P2 | |
+| `onMessage` hook | ✅ | ✅ | - | Routines with event trigger |
+| `onSessionStart` hook | ✅ | ✅ | P2 | |
+| `onSessionEnd` hook | ✅ | ✅ | P2 | |
 | `transcribeAudio` hook | ✅ | ❌ | P3 | |
-| `transformResponse` hook | ✅ | ❌ | P2 | |
+| `transformResponse` hook | ✅ | ✅ | P2 | |
 | Bundled hooks | ✅ | ❌ | P2 | |
 | Plugin hooks | ✅ | ❌ | P3 | |
 | Workspace hooks | ✅ | ❌ | P2 | Inline code |
@@ -346,18 +346,18 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 | Feature | OpenClaw | IronClaw | Notes |
 |---------|----------|----------|-------|
-| Gateway token auth | ✅ | 🚧 | HTTP webhook secret |
+| Gateway token auth | ✅ | ✅ | Bearer token auth on web gateway |
 | Device pairing | ✅ | ❌ | |
 | Tailscale identity | ✅ | ❌ | |
 | OAuth flows | ✅ | 🚧 | NEAR AI OAuth |
-| DM pairing verification | ✅ | ❌ | |
-| Allowlist/blocklist | ✅ | ❌ | |
+| DM pairing verification | ✅ | ✅ | ironclaw pairing approve, host APIs |
+| Allowlist/blocklist | ✅ | 🚧 | allow_from + pairing store |
 | Per-group tool policies | ✅ | ❌ | |
 | Exec approvals | ✅ | ✅ | TUI overlay |
 | TLS 1.3 minimum | ✅ | ✅ | reqwest rustls |
 | SSRF protection | ✅ | ✅ | WASM allowlist |
 | Loopback-first | ✅ | 🚧 | HTTP binds 0.0.0.0 |
-| Docker sandbox | ✅ | ❌ | Uses WASM sandbox |
+| Docker sandbox | ✅ | ✅ | Orchestrator/worker containers |
 | WASM sandbox | ❌ | ✅ | IronClaw innovation |
 | Tool policies | ✅ | ✅ | |
 | Elevated mode | ✅ | ❌ | |
@@ -397,6 +397,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 ### P0 - Core (Already Done)
 - ✅ TUI channel with approval overlays
 - ✅ HTTP webhook channel
+- ✅ DM pairing (ironclaw pairing list/approve, host APIs)
 - ✅ WASM tool sandbox
 - ✅ Workspace/memory with hybrid search
 - ✅ Prompt injection defense
@@ -404,23 +405,28 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 - ✅ Session management
 - ✅ Context compaction
 - ✅ Model selection
+- ✅ Gateway control plane + WebSocket
+- ✅ Web Control UI (chat, memory, jobs, logs, extensions, routines)
+- ✅ WebChat channel (web gateway)
+- ✅ Slack channel (WASM tool)
+- ✅ Telegram channel (WASM tool, MTProto)
+- ✅ Docker sandbox (orchestrator/worker)
+- ✅ Cron job scheduling (routines)
+- ✅ CLI subcommands (onboard, config, status, memory)
+- ✅ Gateway token auth
 
 ### P1 - High Priority
 - ❌ Slack channel (real implementation)
-- ❌ Telegram channel
+- ✅ Telegram channel (WASM, DM pairing, caption, /start)
 - ❌ WhatsApp channel
-- ❌ Multi-provider failover
-- ❌ Gateway control plane + WebSocket
-- ❌ Hooks system (beforeInbound, beforeToolCall, etc.)
+- ✅ Multi-provider failover (`FailoverProvider` with retryable error classification)
+- ✅ Hooks system (beforeInbound, beforeToolCall, beforeOutbound, onSessionStart, onSessionEnd, transformResponse)
 
 ### P2 - Medium Priority
-- ❌ Cron job scheduling
-- ❌ Web Control UI
-- ❌ WebChat channel
 - ❌ Media handling (images, PDFs)
-- ❌ CLI subcommands (config, status, memory, doctor)
 - ❌ Ollama/local model support
 - ❌ Configuration hot-reload
+- ❌ Webhook trigger endpoint in web gateway
 
 ### P3 - Lower Priority
 - ❌ Discord channel

README.md

@@ -43,7 +43,10 @@ IronClaw is the AI assistant you can actually trust with your personal and profe
 
 ### Always Available
 
-- **Multi-channel** - REPL, HTTP webhooks, and extensible WASM channels (Telegram, Slack, and more)
+- **Multi-channel** - REPL, HTTP webhooks, WASM channels (Telegram, Slack), and web gateway
+- **Docker Sandbox** - Isolated container execution with per-job tokens and orchestrator/worker pattern
+- **Web Gateway** - Browser UI with real-time SSE/WebSocket streaming
+- **Routines** - Cron schedules, event triggers, webhook handlers for background automation
 - **Heartbeat System** - Proactive background execution for monitoring and maintenance tasks
 - **Parallel Jobs** - Handle multiple requests concurrently with isolated contexts
 - **Self-repair** - Automatic detection and recovery of stuck operations
@@ -65,10 +68,41 @@ IronClaw is the AI assistant you can actually trust with your personal and profe
 ### Prerequisites
 
 - Rust 1.85+
-- PostgreSQL 15+ with pgvector extension
+- PostgreSQL 15+ with [pgvector](https://github.com/pgvector/pgvector) extension
 - NEAR AI account (authentication handled via setup wizard)
 
-### Build
+## Download or Build
+
+Visit [Releases page](https://github.com/nearai/ironclaw/releases/) to see the latest updates.
+
+<details>
+  <summary>Install via Windows Installer (Windows)</summary>
+
+Download the [Windows Installer](https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-x86_64-pc-windows-msvc.msi) and run it.
+
+</details>
+
+<details>
+  <summary>Install via powershell script (Windows)</summary>
+
+```sh
+irm https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.ps1 | iex
+```
+
+</details>
+
+<details>
+  <summary>Install via shell script (macOS, Linux, Windows/WSL)</summary>
+
+```sh
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh
+```
+</details>
+
+<details>
+  <summary>Compile the source code (Cargo on Windows, Linux, macOS)</summary>
+
+Install it with `cargo`, just make sure you have [Rust](https://rustup.rs) installed on your computer.
 
 ```bash
 # Clone the repository
@@ -82,6 +116,10 @@ cargo build --release
 cargo test
 ```
 
+For **full release** (after modifying channel sources), run `./scripts/build-all.sh` to rebuild channels first.
+
+</details>
+
 ### Database Setup
 
 ```bash
@@ -97,7 +135,7 @@ psql ironclaw -c "CREATE EXTENSION IF NOT EXISTS vector;"
 Run the setup wizard to configure IronClaw:
 
 ```bash
-ironclaw setup
+ironclaw onboard
 ```
 
 The wizard handles database connection, NEAR AI authentication (via browser OAuth),
@@ -143,37 +181,42 @@ External content passes through multiple security layers:
 ## Architecture
 
 ```
-┌─────────────────────────────────────────────────────────────────┐
-│                         Channels                                 │
-│  ┌──────┐  ┌──────┐  ┌──────────────┐                           │
-│  │ REPL │  │ HTTP │  │ WASM Channels│                           │
-│  └──┬───┘  └──┬───┘  └──────┬───────┘                           │
-│     └─────────┴─────────────┘                                    │
-│                         │                                        │
-│                    ┌────▼────┐                                  │
-│                    │  Router │  Intent classification           │
-│                    └────┬────┘                                  │
-│                         │                                        │
-│              ┌──────────▼──────────┐                            │
-│              │     Scheduler       │  Parallel job management   │
-│              └──────────┬──────────┘                            │
-│                         │                                        │
-│         ┌───────────────┼───────────────┐                       │
-│         ▼               ▼               ▼                       │
-│    ┌─────────┐    ┌─────────┐    ┌─────────┐                   │
-│    │ Worker  │    │ Worker  │    │ Worker  │  LLM reasoning    │
-│    └────┬────┘    └────┬────┘    └────┬────┘                   │
-│         └───────────────┼───────────────┘                       │
-│                         │                                        │
-│              ┌──────────▼──────────┐                            │
-│              │   Tool Registry     │                            │
-│              │  ┌───────────────┐  │                            │
-│              │  │ Built-in      │  │                            │
-│              │  │ MCP           │  │                            │
-│              │  │ WASM Sandbox  │  │                            │
-│              │  └───────────────┘  │                            │
-│              └─────────────────────┘                            │
-└─────────────────────────────────────────────────────────────────┘
+┌────────────────────────────────────────────────────────────────┐
+│                          Channels                              │
+│  ┌──────┐  ┌──────┐   ┌─────────────┐  ┌─────────────┐         │
+│  │ REPL │  │ HTTP │   │WASM Channels│  │ Web Gateway │         │
+│  └──┬───┘  └──┬───┘   └──────┬──────┘  │ (SSE + WS)  │         │
+│     │         │              │         └──────┬──────┘         │
+│     └─────────┴──────────────┴────────────────┘                │
+│                              │                                 │
+│                    ┌─────────▼─────────┐                       │
+│                    │    Agent Loop     │  Intent routing       │
+│                    └────┬──────────┬───┘                       │
+│                         │          │                           │
+│              ┌──────────▼────┐  ┌──▼───────────────┐           │
+│              │  Scheduler    │  │ Routines Engine  │           │
+│              │(parallel jobs)│  │(cron, event, wh) │           │
+│              └──────┬────────┘  └────────┬─────────┘           │
+│                     │                    │                     │
+│       ┌─────────────┼────────────────────┘                     │
+│       │             │                                          │
+│   ┌───▼─────┐  ┌────▼────────────────┐                         │
+│   │ Local   │  │    Orchestrator     │                         │
+│   │Workers  │  │  ┌───────────────┐  │                         │
+│   │(in-proc)│  │  │ Docker Sandbox│  │                         │
+│   └───┬─────┘  │  │   Containers  │  │                         │
+│       │        │  │ ┌───────────┐ │  │                         │
+│       │        │  │ │Worker / CC│ │  │                         │
+│       │        │  │ └───────────┘ │  │                         │
+│       │        │  └───────────────┘  │                         │
+│       │        └─────────┬───────────┘                         │
+│       └──────────────────┤                                     │
+│                          │                                     │
+│              ┌───────────▼──────────┐                          │
+│              │    Tool Registry     │                          │
+│              │  Built-in, MCP, WASM │                          │
+│              └──────────────────────┘                          │
+└────────────────────────────────────────────────────────────────┘
 ```
 
 ### Core Components
@@ -184,6 +227,9 @@ External content passes through multiple security layers:
 | **Router** | Classifies user intent (command, query, task) |
 | **Scheduler** | Manages parallel job execution with priorities |
 | **Worker** | Executes jobs with LLM reasoning and tool calls |
+| **Orchestrator** | Container lifecycle, LLM proxying, per-job auth |
+| **Web Gateway** | Browser UI with chat, memory, jobs, logs, extensions, routines |
+| **Routines Engine** | Scheduled (cron) and reactive (event, webhook) background tasks |
 | **Workspace** | Persistent memory with hybrid search |
 | **Safety Layer** | Prompt injection defense and content sanitization |
 
@@ -191,7 +237,7 @@ External content passes through multiple security layers:
 
 ```bash
 # First-time setup (configures database, auth, etc.)
-ironclaw setup
+ironclaw onboard
 
 # Start interactive REPL
 cargo run
@@ -210,12 +256,16 @@ cargo fmt
 cargo clippy --all --benches --tests --examples --all-features
 
 # Run tests
+createdb ironclaw_test
 cargo test
 
 # Run specific test
 cargo test test_name
 ```
 
+- **Telegram channel**: See [docs/TELEGRAM_SETUP.md](docs/TELEGRAM_SETUP.md) for setup and DM pairing.
+- **Changing channel sources**: Run `./channels-src/telegram/build.sh` before `cargo build` so the updated WASM is bundled.
+
 ## OpenClaw Heritage
 
 IronClaw is a Rust reimplementation inspired by [OpenClaw](https://github.com/openclaw/openclaw). See [FEATURE_PARITY.md](FEATURE_PARITY.md) for the complete tracking matrix.

benchmarks/Cargo.toml

@@ -1,49 +0,0 @@
-[package]
-name = "ironclaw-bench"
-version = "0.1.0"
-edition = "2024"
-rust-version = "1.85"
-description = "Benchmarking harness for IronClaw agent"
-license = "MIT OR Apache-2.0"
-
-[[bin]]
-name = "ironclaw-bench"
-path = "src/main.rs"
-
-[dependencies]
-ironclaw = { path = ".." }
-
-# Async runtime
-tokio = { version = "1", features = ["full"] }
-tokio-stream = { version = "0.1", features = ["sync"] }
-futures = "0.3"
-
-# Serialization
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-toml = "0.8"
-
-# CLI
-clap = { version = "4", features = ["derive"] }
-
-# Core types
-uuid = { version = "1", features = ["v4", "serde"] }
-chrono = { version = "0.4", features = ["serde"] }
-rust_decimal = { version = "1", features = ["serde", "serde-with-str"] }
-
-# Error handling
-thiserror = "2"
-anyhow = "1"
-
-# Async traits
-async-trait = "0.1"
-
-# Logging
-tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter"] }
-
-# Scoring
-regex = "1"
-
-[dev-dependencies]
-tempfile = "3"

benchmarks/src/adapters/custom.rs

@@ -1,237 +0,0 @@
-use std::io::BufRead;
-use std::path::PathBuf;
-
-use async_trait::async_trait;
-use serde::Deserialize;
-
-use crate::error::BenchError;
-use crate::scoring;
-use crate::suite::{BenchScore, BenchSuite, BenchTask, TaskSubmission};
-
-/// A single entry in the custom JSONL format.
-#[derive(Debug, Deserialize)]
-struct CustomEntry {
-    id: String,
-    prompt: String,
-    #[serde(default)]
-    context: Option<String>,
-    #[serde(default)]
-    tags: Vec<String>,
-    #[serde(default)]
-    expected: Option<String>,
-    #[serde(default)]
-    expected_contains: Option<String>,
-    #[serde(default)]
-    expected_regex: Option<String>,
-    /// "exact", "contains", "regex", or "llm" (default: "exact")
-    #[serde(default = "default_scorer")]
-    scorer: String,
-}
-
-fn default_scorer() -> String {
-    "exact".to_string()
-}
-
-/// Custom JSONL benchmark suite.
-///
-/// Each line of the JSONL file is a task with `id`, `prompt`, and scoring
-/// criteria (`expected`, `expected_contains`, `expected_regex`).
-pub struct CustomSuite {
-    dataset_path: PathBuf,
-}
-
-impl CustomSuite {
-    pub fn new(dataset_path: impl Into<PathBuf>) -> Self {
-        Self {
-            dataset_path: dataset_path.into(),
-        }
-    }
-}
-
-#[async_trait]
-impl BenchSuite for CustomSuite {
-    fn name(&self) -> &str {
-        "Custom JSONL"
-    }
-
-    fn id(&self) -> &str {
-        "custom"
-    }
-
-    async fn load_tasks(&self) -> Result<Vec<BenchTask>, BenchError> {
-        let file = std::fs::File::open(&self.dataset_path).map_err(BenchError::Io)?;
-        let reader = std::io::BufReader::new(file);
-        let mut tasks = Vec::new();
-
-        for (line_num, line) in reader.lines().enumerate() {
-            let line = line?;
-            let trimmed = line.trim();
-            if trimmed.is_empty() {
-                continue;
-            }
-            let entry: CustomEntry = serde_json::from_str(trimmed)
-                .map_err(|e| BenchError::Config(format!("line {}: {}", line_num + 1, e)))?;
-
-            let mut metadata = serde_json::json!({
-                "scorer": entry.scorer,
-            });
-            if let Some(ref expected) = entry.expected {
-                metadata["expected"] = serde_json::Value::String(expected.clone());
-            }
-            if let Some(ref expected_contains) = entry.expected_contains {
-                metadata["expected_contains"] =
-                    serde_json::Value::String(expected_contains.clone());
-            }
-            if let Some(ref expected_regex) = entry.expected_regex {
-                metadata["expected_regex"] = serde_json::Value::String(expected_regex.clone());
-            }
-
-            tasks.push(BenchTask {
-                id: entry.id,
-                prompt: entry.prompt,
-                context: entry.context,
-                resources: vec![],
-                tags: entry.tags,
-                expected_turns: None,
-                timeout: None,
-                metadata,
-            });
-        }
-
-        Ok(tasks)
-    }
-
-    async fn score(
-        &self,
-        task: &BenchTask,
-        submission: &TaskSubmission,
-    ) -> Result<BenchScore, BenchError> {
-        let scorer = task
-            .metadata
-            .get("scorer")
-            .and_then(|v| v.as_str())
-            .unwrap_or("exact");
-
-        match scorer {
-            "exact" => {
-                if let Some(expected) = task.metadata.get("expected").and_then(|v| v.as_str()) {
-                    Ok(scoring::exact_match(expected, &submission.response))
-                } else {
-                    Err(BenchError::Scoring {
-                        task_id: task.id.clone(),
-                        reason: "no 'expected' field for exact scoring".to_string(),
-                    })
-                }
-            }
-            "contains" => {
-                if let Some(expected) = task
-                    .metadata
-                    .get("expected_contains")
-                    .and_then(|v| v.as_str())
-                {
-                    Ok(scoring::contains_match(expected, &submission.response))
-                } else {
-                    Err(BenchError::Scoring {
-                        task_id: task.id.clone(),
-                        reason: "no 'expected_contains' field for contains scoring".to_string(),
-                    })
-                }
-            }
-            "regex" => {
-                if let Some(pattern) = task.metadata.get("expected_regex").and_then(|v| v.as_str())
-                {
-                    Ok(scoring::regex_match(pattern, &submission.response))
-                } else {
-                    Err(BenchError::Scoring {
-                        task_id: task.id.clone(),
-                        reason: "no 'expected_regex' field for regex scoring".to_string(),
-                    })
-                }
-            }
-            "llm" => {
-                // TODO: LLM-as-judge scoring
-                Ok(BenchScore::partial(0.5, "LLM scoring not yet implemented"))
-            }
-            other => Err(BenchError::Scoring {
-                task_id: task.id.clone(),
-                reason: format!("unknown scorer: {other}"),
-            }),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::io::Write;
-
-    #[tokio::test]
-    async fn test_custom_load_tasks() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("tasks.jsonl");
-        let mut file = std::fs::File::create(&path).unwrap();
-        writeln!(
-            file,
-            r#"{{"id": "t1", "prompt": "What is 2+2?", "expected": "4"}}"#
-        )
-        .unwrap();
-        writeln!(
-            file,
-            r#"{{"id": "t2", "prompt": "Say hello", "expected_contains": "hello", "scorer": "contains"}}"#
-        )
-        .unwrap();
-
-        let suite = CustomSuite::new(&path);
-        let tasks = suite.load_tasks().await.unwrap();
-        assert_eq!(tasks.len(), 2);
-        assert_eq!(tasks[0].id, "t1");
-        assert_eq!(tasks[1].id, "t2");
-    }
-
-    #[tokio::test]
-    async fn test_custom_exact_scoring() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("tasks.jsonl");
-        let mut file = std::fs::File::create(&path).unwrap();
-        writeln!(
-            file,
-            r#"{{"id": "t1", "prompt": "What is 2+2?", "expected": "4"}}"#
-        )
-        .unwrap();
-
-        let suite = CustomSuite::new(&path);
-        let tasks = suite.load_tasks().await.unwrap();
-
-        let submission = TaskSubmission {
-            response: "4".to_string(),
-            conversation: vec![],
-            tool_calls: vec![],
-        };
-        let score = suite.score(&tasks[0], &submission).await.unwrap();
-        assert_eq!(score.value, 1.0);
-        assert_eq!(score.label, "pass");
-    }
-
-    #[tokio::test]
-    async fn test_custom_contains_scoring() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("tasks.jsonl");
-        let mut file = std::fs::File::create(&path).unwrap();
-        writeln!(
-            file,
-            r#"{{"id": "t1", "prompt": "Greet me", "expected_contains": "hello", "scorer": "contains"}}"#
-        )
-        .unwrap();
-
-        let suite = CustomSuite::new(&path);
-        let tasks = suite.load_tasks().await.unwrap();
-
-        let submission = TaskSubmission {
-            response: "Hello there!".to_string(),
-            conversation: vec![],
-            tool_calls: vec![],
-        };
-        let score = suite.score(&tasks[0], &submission).await.unwrap();
-        assert_eq!(score.value, 1.0);
-    }
-}

benchmarks/src/adapters/gaia.rs

@@ -1,183 +0,0 @@
-use std::io::BufRead;
-use std::path::PathBuf;
-
-use async_trait::async_trait;
-use serde::Deserialize;
-
-use crate::error::BenchError;
-use crate::scoring;
-use crate::suite::{BenchScore, BenchSuite, BenchTask, TaskResource, TaskSubmission};
-
-/// GAIA dataset entry (Hugging Face JSONL format).
-#[derive(Debug, Deserialize)]
-struct GaiaEntry {
-    task_id: String,
-    #[serde(alias = "Question")]
-    question: String,
-    #[serde(alias = "Final answer", alias = "final_answer")]
-    final_answer: String,
-    #[serde(alias = "Level", default)]
-    level: Option<u32>,
-    #[serde(alias = "file_name", default)]
-    file_name: Option<String>,
-    #[serde(alias = "Annotator Metadata", default)]
-    annotator_metadata: Option<serde_json::Value>,
-}
-
-/// GAIA benchmark suite.
-///
-/// Tasks are loaded from HuggingFace JSONL exports. Scoring uses normalized
-/// exact match against the `final_answer` field.
-pub struct GaiaSuite {
-    dataset_path: PathBuf,
-    attachments_dir: Option<PathBuf>,
-}
-
-impl GaiaSuite {
-    pub fn new(
-        dataset_path: impl Into<PathBuf>,
-        attachments_dir: Option<impl Into<PathBuf>>,
-    ) -> Self {
-        Self {
-            dataset_path: dataset_path.into(),
-            attachments_dir: attachments_dir.map(|d| d.into()),
-        }
-    }
-}
-
-#[async_trait]
-impl BenchSuite for GaiaSuite {
-    fn name(&self) -> &str {
-        "GAIA"
-    }
-
-    fn id(&self) -> &str {
-        "gaia"
-    }
-
-    async fn load_tasks(&self) -> Result<Vec<BenchTask>, BenchError> {
-        let file = std::fs::File::open(&self.dataset_path)?;
-        let reader = std::io::BufReader::new(file);
-        let mut tasks = Vec::new();
-
-        for (line_num, line) in reader.lines().enumerate() {
-            let line = line?;
-            let trimmed = line.trim();
-            if trimmed.is_empty() {
-                continue;
-            }
-            let entry: GaiaEntry = serde_json::from_str(trimmed)
-                .map_err(|e| BenchError::Config(format!("GAIA line {}: {}", line_num + 1, e)))?;
-
-            let mut resources = Vec::new();
-            if let Some(ref file_name) = entry.file_name {
-                if !file_name.is_empty() {
-                    if let Some(ref dir) = self.attachments_dir {
-                        resources.push(TaskResource {
-                            name: file_name.clone(),
-                            path: dir.join(file_name).to_string_lossy().to_string(),
-                            resource_type: crate::suite::ResourceType::File,
-                        });
-                    }
-                }
-            }
-
-            let mut tags = Vec::new();
-            if let Some(level) = entry.level {
-                tags.push(format!("level-{level}"));
-            }
-
-            let metadata = serde_json::json!({
-                "expected": entry.final_answer,
-                "level": entry.level,
-            });
-
-            tasks.push(BenchTask {
-                id: entry.task_id,
-                prompt: entry.question,
-                context: None,
-                resources,
-                tags,
-                expected_turns: None,
-                timeout: None,
-                metadata,
-            });
-        }
-
-        Ok(tasks)
-    }
-
-    async fn score(
-        &self,
-        task: &BenchTask,
-        submission: &TaskSubmission,
-    ) -> Result<BenchScore, BenchError> {
-        let expected = task
-            .metadata
-            .get("expected")
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| BenchError::Scoring {
-                task_id: task.id.clone(),
-                reason: "missing expected answer in metadata".to_string(),
-            })?;
-
-        Ok(scoring::exact_match(expected, &submission.response))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::io::Write;
-
-    #[tokio::test]
-    async fn test_gaia_load_tasks() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("gaia.jsonl");
-        let mut file = std::fs::File::create(&path).unwrap();
-        writeln!(
-            file,
-            r#"{{"task_id": "g1", "question": "What is the capital of France?", "final_answer": "Paris", "Level": 1}}"#
-        )
-        .unwrap();
-
-        let suite = GaiaSuite::new(&path, None::<PathBuf>);
-        let tasks = suite.load_tasks().await.unwrap();
-        assert_eq!(tasks.len(), 1);
-        assert_eq!(tasks[0].id, "g1");
-        assert!(tasks[0].tags.contains(&"level-1".to_string()));
-    }
-
-    #[tokio::test]
-    async fn test_gaia_scoring() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("gaia.jsonl");
-        let mut file = std::fs::File::create(&path).unwrap();
-        writeln!(
-            file,
-            r#"{{"task_id": "g1", "question": "Capital of France?", "final_answer": "Paris"}}"#
-        )
-        .unwrap();
-
-        let suite = GaiaSuite::new(&path, None::<PathBuf>);
-        let tasks = suite.load_tasks().await.unwrap();
-
-        // Exact match (case insensitive)
-        let submission = TaskSubmission {
-            response: "paris".to_string(),
-            conversation: vec![],
-            tool_calls: vec![],
-        };
-        let score = suite.score(&tasks[0], &submission).await.unwrap();
-        assert_eq!(score.value, 1.0);
-
-        // Wrong answer
-        let submission = TaskSubmission {
-            response: "London".to_string(),
-            conversation: vec![],
-            tool_calls: vec![],
-        };
-        let score = suite.score(&tasks[0], &submission).await.unwrap();
-        assert_eq!(score.value, 0.0);
-    }
-}

benchmarks/src/adapters/mod.rs

@@ -1,110 +0,0 @@
-pub mod custom;
-pub mod gaia;
-pub mod swe_bench;
-pub mod tau_bench;
-
-use crate::config::BenchConfig;
-use crate::error::BenchError;
-use crate::suite::BenchSuite;
-
-/// List of all known suite IDs.
-pub const KNOWN_SUITES: &[(&str, &str)] = &[
-    ("custom", "Custom JSONL tasks"),
-    ("gaia", "GAIA benchmark (knowledge & reasoning)"),
-    ("tau_bench", "Tau-bench (multi-turn tool use)"),
-    ("swe_bench", "SWE-bench Pro (software engineering)"),
-];
-
-/// Create a suite adapter by name.
-pub fn create_suite(name: &str, config: &BenchConfig) -> Result<Box<dyn BenchSuite>, BenchError> {
-    let suite_map = config.suite_config_map();
-    match name {
-        "custom" => {
-            let dataset_path = suite_map
-                .get("dataset_path")
-                .and_then(|v| v.as_str())
-                .map(|s| s.to_string())
-                .ok_or_else(|| {
-                    BenchError::Config(
-                        "suite_config.dataset_path is required for 'custom' suite".to_string(),
-                    )
-                })?;
-            Ok(Box::new(custom::CustomSuite::new(dataset_path)))
-        }
-        "gaia" => {
-            let dataset_path = suite_map
-                .get("dataset_path")
-                .and_then(|v| v.as_str())
-                .map(|s| s.to_string())
-                .ok_or_else(|| {
-                    BenchError::Config(
-                        "suite_config.dataset_path is required for 'gaia' suite".to_string(),
-                    )
-                })?;
-            let attachments_dir = suite_map
-                .get("attachments_dir")
-                .and_then(|v| v.as_str())
-                .map(|s| s.to_string());
-            Ok(Box::new(gaia::GaiaSuite::new(
-                dataset_path,
-                attachments_dir,
-            )))
-        }
-        "tau_bench" => {
-            let dataset_path = suite_map
-                .get("dataset_path")
-                .and_then(|v| v.as_str())
-                .map(|s| s.to_string())
-                .ok_or_else(|| {
-                    BenchError::Config(
-                        "suite_config.dataset_path is required for 'tau_bench' suite".to_string(),
-                    )
-                })?;
-            let domain = suite_map
-                .get("domain")
-                .and_then(|v| v.as_str())
-                .unwrap_or("retail")
-                .to_string();
-            Ok(Box::new(tau_bench::TauBenchSuite::new(
-                dataset_path,
-                domain,
-            )))
-        }
-        "swe_bench" => {
-            let dataset_path = suite_map
-                .get("dataset_path")
-                .and_then(|v| v.as_str())
-                .map(|s| s.to_string())
-                .ok_or_else(|| {
-                    BenchError::Config(
-                        "suite_config.dataset_path is required for 'swe_bench' suite".to_string(),
-                    )
-                })?;
-            let workspace_dir = suite_map
-                .get("workspace_dir")
-                .and_then(|v| v.as_str())
-                .unwrap_or("/tmp/swe-bench")
-                .to_string();
-            let use_docker = suite_map
-                .get("use_docker")
-                .and_then(|v| v.as_bool())
-                .unwrap_or(false);
-            Ok(Box::new(swe_bench::SweBenchSuite::new(
-                dataset_path,
-                workspace_dir,
-                use_docker,
-            )))
-        }
-        _ => {
-            let available = KNOWN_SUITES
-                .iter()
-                .map(|(id, _)| *id)
-                .collect::<Vec<_>>()
-                .join(", ");
-            Err(BenchError::SuiteNotFound {
-                name: name.to_string(),
-                available,
-            })
-        }
-    }
-}

benchmarks/src/adapters/swe_bench.rs

@@ -1,291 +0,0 @@
-use std::io::BufRead;
-use std::path::PathBuf;
-
-use async_trait::async_trait;
-use serde::Deserialize;
-
-use crate::error::BenchError;
-use crate::suite::{BenchScore, BenchSuite, BenchTask, TaskSubmission};
-
-/// SWE-bench dataset entry.
-#[derive(Debug, Deserialize)]
-struct SweBenchEntry {
-    instance_id: String,
-    repo: String,
-    base_commit: String,
-    #[serde(default)]
-    problem_statement: String,
-    #[serde(default)]
-    hints_text: Option<String>,
-    #[serde(default)]
-    test_patch: Option<String>,
-    #[serde(default)]
-    patch: Option<String>,
-}
-
-/// SWE-bench Pro: real-world software engineering tasks.
-///
-/// Each task clones a repo at a specific commit, presents the problem statement,
-/// and expects the agent to produce a patch. Scoring runs the test suite.
-pub struct SweBenchSuite {
-    dataset_path: PathBuf,
-    workspace_dir: PathBuf,
-    use_docker: bool,
-}
-
-impl SweBenchSuite {
-    pub fn new(
-        dataset_path: impl Into<PathBuf>,
-        workspace_dir: impl Into<PathBuf>,
-        use_docker: bool,
-    ) -> Self {
-        Self {
-            dataset_path: dataset_path.into(),
-            workspace_dir: workspace_dir.into(),
-            use_docker,
-        }
-    }
-}
-
-#[async_trait]
-impl BenchSuite for SweBenchSuite {
-    fn name(&self) -> &str {
-        "SWE-bench Pro"
-    }
-
-    fn id(&self) -> &str {
-        "swe_bench"
-    }
-
-    async fn load_tasks(&self) -> Result<Vec<BenchTask>, BenchError> {
-        let file = std::fs::File::open(&self.dataset_path)?;
-        let reader = std::io::BufReader::new(file);
-        let mut tasks = Vec::new();
-
-        for (line_num, line) in reader.lines().enumerate() {
-            let line = line?;
-            let trimmed = line.trim();
-            if trimmed.is_empty() {
-                continue;
-            }
-            let entry: SweBenchEntry = serde_json::from_str(trimmed).map_err(|e| {
-                BenchError::Config(format!("swe_bench line {}: {}", line_num + 1, e))
-            })?;
-
-            let metadata = serde_json::json!({
-                "repo": entry.repo,
-                "base_commit": entry.base_commit,
-                "test_patch": entry.test_patch,
-                "gold_patch": entry.patch,
-                "use_docker": self.use_docker,
-                "workspace_dir": self.workspace_dir.to_string_lossy(),
-            });
-
-            let prompt = if let Some(ref hints) = entry.hints_text {
-                format!("{}\n\nHints:\n{}", entry.problem_statement, hints)
-            } else {
-                entry.problem_statement
-            };
-
-            tasks.push(BenchTask {
-                id: entry.instance_id,
-                prompt,
-                context: Some(format!(
-                    "Repository: {}, Commit: {}",
-                    entry.repo, entry.base_commit
-                )),
-                resources: vec![],
-                tags: vec![format!("repo-{}", entry.repo.replace('/', "-"))],
-                expected_turns: None,
-                timeout: None,
-                metadata,
-            });
-        }
-
-        Ok(tasks)
-    }
-
-    async fn setup_task(&self, task: &BenchTask) -> Result<(), BenchError> {
-        let repo = task
-            .metadata
-            .get("repo")
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| BenchError::TaskFailed {
-                task_id: task.id.clone(),
-                reason: "missing repo in metadata".to_string(),
-            })?;
-        let base_commit = task
-            .metadata
-            .get("base_commit")
-            .and_then(|v| v.as_str())
-            .ok_or_else(|| BenchError::TaskFailed {
-                task_id: task.id.clone(),
-                reason: "missing base_commit in metadata".to_string(),
-            })?;
-
-        let task_dir = self.workspace_dir.join(&task.id);
-
-        // Clone repo if not already present
-        if !task_dir.exists() {
-            let repo_url = format!("https://github.com/{}.git", repo);
-            let output = tokio::process::Command::new("git")
-                .args([
-                    "clone",
-                    "--depth",
-                    "1",
-                    &repo_url,
-                    &task_dir.to_string_lossy(),
-                ])
-                .output()
-                .await
-                .map_err(|e| BenchError::TaskFailed {
-                    task_id: task.id.clone(),
-                    reason: format!("git clone failed: {e}"),
-                })?;
-
-            if !output.status.success() {
-                let stderr = String::from_utf8_lossy(&output.stderr);
-                return Err(BenchError::TaskFailed {
-                    task_id: task.id.clone(),
-                    reason: format!("git clone failed: {stderr}"),
-                });
-            }
-        }
-
-        // Checkout the base commit
-        let output = tokio::process::Command::new("git")
-            .args(["checkout", base_commit])
-            .current_dir(&task_dir)
-            .output()
-            .await
-            .map_err(|e| BenchError::TaskFailed {
-                task_id: task.id.clone(),
-                reason: format!("git checkout failed: {e}"),
-            })?;
-
-        if !output.status.success() {
-            // Shallow clone might not have the commit; fetch more history
-            let _ = tokio::process::Command::new("git")
-                .args(["fetch", "--unshallow"])
-                .current_dir(&task_dir)
-                .output()
-                .await;
-
-            let output = tokio::process::Command::new("git")
-                .args(["checkout", base_commit])
-                .current_dir(&task_dir)
-                .output()
-                .await
-                .map_err(|e| BenchError::TaskFailed {
-                    task_id: task.id.clone(),
-                    reason: format!("git checkout retry failed: {e}"),
-                })?;
-
-            if !output.status.success() {
-                let stderr = String::from_utf8_lossy(&output.stderr);
-                return Err(BenchError::TaskFailed {
-                    task_id: task.id.clone(),
-                    reason: format!("git checkout failed: {stderr}"),
-                });
-            }
-        }
-
-        Ok(())
-    }
-
-    async fn teardown_task(&self, task: &BenchTask) -> Result<(), BenchError> {
-        let task_dir = self.workspace_dir.join(&task.id);
-        if task_dir.exists() {
-            // Reset any changes
-            let _ = tokio::process::Command::new("git")
-                .args(["checkout", "."])
-                .current_dir(&task_dir)
-                .output()
-                .await;
-            let _ = tokio::process::Command::new("git")
-                .args(["clean", "-fdx"])
-                .current_dir(&task_dir)
-                .output()
-                .await;
-        }
-        Ok(())
-    }
-
-    async fn score(
-        &self,
-        task: &BenchTask,
-        submission: &TaskSubmission,
-    ) -> Result<BenchScore, BenchError> {
-        // For SWE-bench, scoring requires running the test patch against the agent's changes.
-        // This is a simplified version that checks if the agent produced any code changes.
-
-        let test_patch = task.metadata.get("test_patch").and_then(|v| v.as_str());
-
-        if submission.response.is_empty() {
-            return Ok(BenchScore::fail("no response from agent"));
-        }
-
-        // If we have a test patch, try to verify the submission
-        if let Some(_test_patch) = test_patch {
-            // TODO: Apply agent's patch, then apply test patch, then run tests.
-            // For now, give partial credit if the agent produced some output.
-            Ok(BenchScore::partial(
-                0.25,
-                "test execution not yet implemented; partial credit for response",
-            ))
-        } else {
-            // No test patch available; can't automatically score
-            Ok(BenchScore::partial(
-                0.25,
-                "no test_patch available for automated scoring",
-            ))
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::io::Write;
-
-    #[tokio::test]
-    async fn test_swe_bench_load() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("swe.jsonl");
-        let mut file = std::fs::File::create(&path).unwrap();
-        writeln!(
-            file,
-            r#"{{"instance_id": "django__django-12345", "repo": "django/django", "base_commit": "abc123", "problem_statement": "Fix the ORM bug"}}"#
-        )
-        .unwrap();
-
-        let suite = SweBenchSuite::new(&path, "/tmp/swe-test", false);
-        let tasks = suite.load_tasks().await.unwrap();
-        assert_eq!(tasks.len(), 1);
-        assert_eq!(tasks[0].id, "django__django-12345");
-        assert!(tasks[0].tags.contains(&"repo-django-django".to_string()));
-    }
-
-    #[tokio::test]
-    async fn test_swe_bench_scoring_no_response() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("swe.jsonl");
-        let mut file = std::fs::File::create(&path).unwrap();
-        writeln!(
-            file,
-            r#"{{"instance_id": "s1", "repo": "org/repo", "base_commit": "abc", "problem_statement": "Fix bug"}}"#
-        )
-        .unwrap();
-
-        let suite = SweBenchSuite::new(&path, "/tmp/swe-test", false);
-        let tasks = suite.load_tasks().await.unwrap();
-
-        let submission = TaskSubmission {
-            response: String::new(),
-            conversation: vec![],
-            tool_calls: vec![],
-        };
-        let score = suite.score(&tasks[0], &submission).await.unwrap();
-        assert_eq!(score.value, 0.0);
-    }
-}

benchmarks/src/adapters/tau_bench.rs

@@ -1,227 +0,0 @@
-use std::io::BufRead;
-use std::path::PathBuf;
-
-use async_trait::async_trait;
-use serde::Deserialize;
-
-use crate::error::BenchError;
-use crate::suite::{BenchScore, BenchSuite, BenchTask, ConversationTurn, TaskSubmission};
-
-/// Tau-bench task entry.
-#[derive(Debug, Deserialize)]
-struct TauBenchEntry {
-    id: String,
-    #[serde(default)]
-    domain: String,
-    instruction: String,
-    #[serde(default)]
-    user_persona: Option<String>,
-    #[serde(default)]
-    expected_state: Option<serde_json::Value>,
-    #[serde(default)]
-    expected_actions: Vec<String>,
-    #[serde(default)]
-    max_turns: Option<usize>,
-}
-
-/// Tau-bench: multi-turn tool-calling dialog benchmark.
-///
-/// Tests agent ability to handle customer service scenarios with simulated
-/// domain APIs (retail, airline). Scoring compares final state against expected.
-pub struct TauBenchSuite {
-    dataset_path: PathBuf,
-    domain: String,
-}
-
-impl TauBenchSuite {
-    pub fn new(dataset_path: impl Into<PathBuf>, domain: impl Into<String>) -> Self {
-        Self {
-            dataset_path: dataset_path.into(),
-            domain: domain.into(),
-        }
-    }
-}
-
-#[async_trait]
-impl BenchSuite for TauBenchSuite {
-    fn name(&self) -> &str {
-        "Tau-bench"
-    }
-
-    fn id(&self) -> &str {
-        "tau_bench"
-    }
-
-    async fn load_tasks(&self) -> Result<Vec<BenchTask>, BenchError> {
-        let file = std::fs::File::open(&self.dataset_path)?;
-        let reader = std::io::BufReader::new(file);
-        let mut tasks = Vec::new();
-
-        for (line_num, line) in reader.lines().enumerate() {
-            let line = line?;
-            let trimmed = line.trim();
-            if trimmed.is_empty() {
-                continue;
-            }
-            let entry: TauBenchEntry = serde_json::from_str(trimmed).map_err(|e| {
-                BenchError::Config(format!("tau_bench line {}: {}", line_num + 1, e))
-            })?;
-
-            let domain = if entry.domain.is_empty() {
-                self.domain.clone()
-            } else {
-                entry.domain.clone()
-            };
-
-            let metadata = serde_json::json!({
-                "domain": domain,
-                "user_persona": entry.user_persona,
-                "expected_state": entry.expected_state,
-                "expected_actions": entry.expected_actions,
-            });
-
-            tasks.push(BenchTask {
-                id: entry.id,
-                prompt: entry.instruction,
-                context: entry.user_persona.clone(),
-                resources: vec![],
-                tags: vec![format!("domain-{domain}")],
-                expected_turns: entry.max_turns,
-                timeout: None,
-                metadata,
-            });
-        }
-
-        Ok(tasks)
-    }
-
-    async fn score(
-        &self,
-        task: &BenchTask,
-        submission: &TaskSubmission,
-    ) -> Result<BenchScore, BenchError> {
-        // Score based on expected actions completion
-        let expected_actions: Vec<String> = task
-            .metadata
-            .get("expected_actions")
-            .and_then(|v| serde_json::from_value(v.clone()).ok())
-            .unwrap_or_default();
-
-        if expected_actions.is_empty() {
-            // No expected actions defined; score based on whether agent responded
-            if submission.response.is_empty() {
-                return Ok(BenchScore::fail("no response"));
-            }
-            return Ok(BenchScore::partial(
-                0.5,
-                "no expected_actions to evaluate against",
-            ));
-        }
-
-        // Check which expected actions were actually called
-        let called: std::collections::HashSet<&str> =
-            submission.tool_calls.iter().map(|s| s.as_str()).collect();
-        let matched = expected_actions
-            .iter()
-            .filter(|a| called.contains(a.as_str()))
-            .count();
-
-        let ratio = matched as f64 / expected_actions.len() as f64;
-        if ratio >= 1.0 {
-            Ok(BenchScore::pass())
-        } else if ratio > 0.0 {
-            Ok(BenchScore::partial(
-                ratio,
-                format!(
-                    "{}/{} expected actions completed",
-                    matched,
-                    expected_actions.len()
-                ),
-            ))
-        } else {
-            Ok(BenchScore::fail(format!(
-                "0/{} expected actions completed",
-                expected_actions.len()
-            )))
-        }
-    }
-
-    async fn next_user_message(
-        &self,
-        task: &BenchTask,
-        conversation: &[ConversationTurn],
-    ) -> Result<Option<String>, BenchError> {
-        // Check if we've exceeded max turns
-        if let Some(max) = task.expected_turns {
-            let user_turns = conversation
-                .iter()
-                .filter(|t| matches!(t.role, crate::suite::TurnRole::User))
-                .count();
-            if user_turns >= max {
-                return Ok(None);
-            }
-        }
-
-        // For now, multi-turn simulation requires an LLM (not implemented yet).
-        // Return None to end after the first turn.
-        // TODO: Use LLM to simulate customer based on user_persona.
-        Ok(None)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::io::Write;
-
-    #[tokio::test]
-    async fn test_tau_bench_load() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("tau.jsonl");
-        let mut file = std::fs::File::create(&path).unwrap();
-        writeln!(
-            file,
-            r#"{{"id": "t1", "instruction": "Return my order", "expected_actions": ["lookup_order", "process_return"], "max_turns": 3}}"#
-        )
-        .unwrap();
-
-        let suite = TauBenchSuite::new(&path, "retail");
-        let tasks = suite.load_tasks().await.unwrap();
-        assert_eq!(tasks.len(), 1);
-        assert_eq!(tasks[0].expected_turns, Some(3));
-    }
-
-    #[tokio::test]
-    async fn test_tau_bench_scoring() {
-        let dir = tempfile::tempdir().unwrap();
-        let path = dir.path().join("tau.jsonl");
-        let mut file = std::fs::File::create(&path).unwrap();
-        writeln!(
-            file,
-            r#"{{"id": "t1", "instruction": "Return order", "expected_actions": ["lookup_order", "process_return"]}}"#
-        )
-        .unwrap();
-
-        let suite = TauBenchSuite::new(&path, "retail");
-        let tasks = suite.load_tasks().await.unwrap();
-
-        // Partial completion
-        let submission = TaskSubmission {
-            response: "I found your order.".to_string(),
-            conversation: vec![],
-            tool_calls: vec!["lookup_order".to_string()],
-        };
-        let score = suite.score(&tasks[0], &submission).await.unwrap();
-        assert_eq!(score.value, 0.5);
-        assert_eq!(score.label, "partial");
-
-        // Full completion
-        let submission = TaskSubmission {
-            response: "Return processed.".to_string(),
-            conversation: vec![],
-            tool_calls: vec!["lookup_order".to_string(), "process_return".to_string()],
-        };
-        let score = suite.score(&tasks[0], &submission).await.unwrap();
-        assert_eq!(score.value, 1.0);
-    }
-}

benchmarks/src/channel.rs

@@ -1,229 +0,0 @@
-use std::sync::Arc;
-
-use async_trait::async_trait;
-use tokio::sync::{Mutex, mpsc};
-use tokio_stream::wrappers::ReceiverStream;
-
-use ironclaw::channels::{Channel, IncomingMessage, MessageStream, OutgoingResponse, StatusUpdate};
-use ironclaw::error::ChannelError;
-
-use crate::results::TraceToolCall;
-use crate::suite::ConversationTurn;
-
-/// Captured state from a benchmark channel run.
-#[derive(Debug, Default)]
-pub struct ChannelCapture {
-    /// All responses the agent sent back.
-    pub responses: Vec<String>,
-    /// Tool calls observed (name, success, duration_ms).
-    pub tool_calls: Vec<TraceToolCall>,
-    /// Full conversation turns for multi-turn scoring.
-    pub conversation: Vec<ConversationTurn>,
-    /// Status messages (for debugging).
-    pub status_log: Vec<String>,
-}
-
-/// A headless Channel implementation for benchmarking.
-///
-/// Modeled after `ReplChannel`: uses mpsc to inject messages and captures
-/// all responses and tool status events. Auto-approves tool execution
-/// so benchmarks run without user interaction.
-pub struct BenchChannel {
-    /// Sender to inject messages into the agent loop.
-    msg_tx: mpsc::Sender<IncomingMessage>,
-    /// Receiver the agent loop reads from (taken once by `start()`).
-    msg_rx: Mutex<Option<mpsc::Receiver<IncomingMessage>>>,
-    /// Accumulated capture data.
-    capture: Arc<Mutex<ChannelCapture>>,
-}
-
-impl BenchChannel {
-    pub fn new() -> (Self, mpsc::Sender<IncomingMessage>) {
-        let (tx, rx) = mpsc::channel(64);
-        let channel = Self {
-            msg_tx: tx.clone(),
-            msg_rx: Mutex::new(Some(rx)),
-            capture: Arc::new(Mutex::new(ChannelCapture::default())),
-        };
-        (channel, tx)
-    }
-
-    /// Get a handle to the capture data.
-    pub fn capture(&self) -> Arc<Mutex<ChannelCapture>> {
-        Arc::clone(&self.capture)
-    }
-
-    /// Get a clone of the message sender for injecting follow-up messages.
-    pub fn sender(&self) -> mpsc::Sender<IncomingMessage> {
-        self.msg_tx.clone()
-    }
-}
-
-#[async_trait]
-impl Channel for BenchChannel {
-    fn name(&self) -> &str {
-        "bench"
-    }
-
-    async fn start(&self) -> Result<MessageStream, ChannelError> {
-        let rx = self
-            .msg_rx
-            .lock()
-            .await
-            .take()
-            .ok_or_else(|| ChannelError::StartupFailed {
-                name: "bench".to_string(),
-                reason: "start() already called".to_string(),
-            })?;
-        Ok(Box::pin(ReceiverStream::new(rx)))
-    }
-
-    async fn respond(
-        &self,
-        _msg: &IncomingMessage,
-        response: OutgoingResponse,
-    ) -> Result<(), ChannelError> {
-        let mut cap = self.capture.lock().await;
-        cap.responses.push(response.content.clone());
-        cap.conversation.push(ConversationTurn {
-            role: crate::suite::TurnRole::Assistant,
-            content: response.content,
-        });
-        Ok(())
-    }
-
-    async fn send_status(
-        &self,
-        status: StatusUpdate,
-        _metadata: &serde_json::Value,
-    ) -> Result<(), ChannelError> {
-        let mut cap = self.capture.lock().await;
-
-        match status {
-            StatusUpdate::ToolCompleted { ref name, success } => {
-                cap.tool_calls.push(TraceToolCall {
-                    name: name.clone(),
-                    duration_ms: 0, // We don't have precise per-tool timing here
-                    success,
-                });
-                cap.status_log
-                    .push(format!("tool_completed: {name} success={success}"));
-            }
-            StatusUpdate::ApprovalNeeded { ref request_id, .. } => {
-                // Auto-approve all tools during benchmarks
-                cap.status_log.push(format!("auto_approved: {request_id}"));
-                drop(cap); // Release lock before sending
-                let approval = IncomingMessage::new("bench", "bench-user", "always");
-                let _ = self.msg_tx.send(approval).await;
-                return Ok(());
-            }
-            StatusUpdate::Thinking(ref msg) => {
-                cap.status_log.push(format!("thinking: {msg}"));
-            }
-            StatusUpdate::ToolStarted { ref name } => {
-                cap.status_log.push(format!("tool_started: {name}"));
-            }
-            StatusUpdate::ToolResult {
-                ref name,
-                ref preview,
-            } => {
-                cap.status_log.push(format!(
-                    "tool_result: {name} -> {}",
-                    &preview[..preview.len().min(100)]
-                ));
-            }
-            StatusUpdate::StreamChunk(_) => {}
-            StatusUpdate::Status(ref msg) => {
-                cap.status_log.push(format!("status: {msg}"));
-            }
-        }
-        Ok(())
-    }
-
-    async fn broadcast(
-        &self,
-        _user_id: &str,
-        response: OutgoingResponse,
-    ) -> Result<(), ChannelError> {
-        let mut cap = self.capture.lock().await;
-        cap.status_log.push(format!(
-            "broadcast: {}",
-            &response.content[..response.content.len().min(100)]
-        ));
-        Ok(())
-    }
-
-    async fn health_check(&self) -> Result<(), ChannelError> {
-        Ok(())
-    }
-
-    async fn shutdown(&self) -> Result<(), ChannelError> {
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[tokio::test]
-    async fn test_bench_channel_captures_responses() {
-        let (channel, _tx) = BenchChannel::new();
-        let capture = channel.capture();
-
-        let msg = IncomingMessage::new("bench", "user", "hello");
-        let response = OutgoingResponse::text("world");
-        channel.respond(&msg, response).await.unwrap();
-
-        let cap = capture.lock().await;
-        assert_eq!(cap.responses.len(), 1);
-        assert_eq!(cap.responses[0], "world");
-        assert_eq!(cap.conversation.len(), 1);
-    }
-
-    #[tokio::test]
-    async fn test_bench_channel_auto_approves() {
-        let (channel, _tx) = BenchChannel::new();
-        // start() to consume the receiver
-        let _stream = channel.start().await.unwrap();
-
-        let status = StatusUpdate::ApprovalNeeded {
-            request_id: "req-1".to_string(),
-            tool_name: "shell".to_string(),
-            description: "run ls".to_string(),
-            parameters: serde_json::json!({}),
-        };
-        channel
-            .send_status(status, &serde_json::Value::Null)
-            .await
-            .unwrap();
-
-        // The approval message was sent through msg_tx,
-        // which means the stream would receive it.
-        // We can't easily read from the stream in this test without
-        // consuming it, but we can verify the status log.
-        let capture_arc = channel.capture();
-        let cap = capture_arc.lock().await;
-        assert!(cap.status_log.iter().any(|s| s.contains("auto_approved")));
-    }
-
-    #[tokio::test]
-    async fn test_bench_channel_captures_tool_events() {
-        let (channel, _tx) = BenchChannel::new();
-
-        let status = StatusUpdate::ToolCompleted {
-            name: "echo".to_string(),
-            success: true,
-        };
-        channel
-            .send_status(status, &serde_json::Value::Null)
-            .await
-            .unwrap();
-
-        let capture_arc = channel.capture();
-        let cap = capture_arc.lock().await;
-        assert_eq!(cap.tool_calls.len(), 1);
-        assert_eq!(cap.tool_calls[0].name, "echo");
-        assert!(cap.tool_calls[0].success);
-    }
-}

benchmarks/src/config.rs

@@ -1,203 +0,0 @@
-use std::path::{Path, PathBuf};
-use std::time::Duration;
-
-use serde::Deserialize;
-
-use crate::error::BenchError;
-
-/// Top-level bench configuration, loaded from TOML.
-#[derive(Debug, Clone, Deserialize)]
-pub struct BenchConfig {
-    /// Where to write results. Default: "./bench-results".
-    #[serde(default = "default_results_dir")]
-    pub results_dir: PathBuf,
-
-    /// Per-task timeout. Default: "300s".
-    #[serde(
-        default = "default_task_timeout",
-        deserialize_with = "deserialize_duration"
-    )]
-    pub task_timeout: Duration,
-
-    /// Max agent iterations per task. Default: 15.
-    #[serde(default = "default_max_iterations")]
-    pub max_iterations: usize,
-
-    /// How many tasks to run in parallel. Default: 1.
-    #[serde(default = "default_parallelism")]
-    pub parallelism: usize,
-
-    /// Model/config matrix entries. At least one required.
-    #[serde(default)]
-    pub matrix: Vec<MatrixEntry>,
-
-    /// Suite-specific configuration (passed through to adapter).
-    #[serde(default = "default_suite_config")]
-    pub suite_config: toml::Value,
-}
-
-/// A single model/config combination to benchmark.
-#[derive(Debug, Clone, Deserialize)]
-pub struct MatrixEntry {
-    /// Label for this configuration (used in results).
-    pub label: String,
-
-    /// Model identifier.
-    #[serde(default)]
-    pub model: Option<String>,
-
-    /// Optional tool allowlist. If set, only these tools are available.
-    #[serde(default)]
-    pub tools: Option<Vec<String>>,
-}
-
-impl BenchConfig {
-    /// Load from a TOML file.
-    pub fn from_file(path: &Path) -> Result<Self, BenchError> {
-        if !path.exists() {
-            return Err(BenchError::ConfigNotFound {
-                path: path.to_path_buf(),
-            });
-        }
-        let content = std::fs::read_to_string(path)?;
-        let config: BenchConfig = toml::from_str(&content)?;
-        Ok(config)
-    }
-
-    /// Create a minimal config for when no config file is provided.
-    /// Uses defaults and optional CLI overrides.
-    pub fn minimal(model: Option<String>) -> Self {
-        let label = model.as_deref().unwrap_or("default").to_string();
-        Self {
-            results_dir: default_results_dir(),
-            task_timeout: default_task_timeout(),
-            max_iterations: default_max_iterations(),
-            parallelism: default_parallelism(),
-            matrix: vec![MatrixEntry {
-                label,
-                model,
-                tools: None,
-            }],
-            suite_config: toml::Value::Table(toml::map::Map::new()),
-        }
-    }
-
-    /// Get the suite_config as a generic map for adapter use.
-    pub fn suite_config_map(&self) -> toml::map::Map<String, toml::Value> {
-        match &self.suite_config {
-            toml::Value::Table(map) => map.clone(),
-            _ => toml::map::Map::new(),
-        }
-    }
-
-    /// Get a string value from suite_config.
-    pub fn suite_config_str(&self, key: &str) -> Option<String> {
-        self.suite_config_map()
-            .get(key)
-            .and_then(|v| v.as_str())
-            .map(|s| s.to_string())
-    }
-}
-
-fn default_suite_config() -> toml::Value {
-    toml::Value::Table(toml::map::Map::new())
-}
-
-fn default_results_dir() -> PathBuf {
-    PathBuf::from("./bench-results")
-}
-
-fn default_task_timeout() -> Duration {
-    Duration::from_secs(300)
-}
-
-fn default_max_iterations() -> usize {
-    15
-}
-
-fn default_parallelism() -> usize {
-    1
-}
-
-/// Deserialize a duration from a string like "300s", "5m", etc.
-fn deserialize_duration<'de, D>(deserializer: D) -> Result<Duration, D::Error>
-where
-    D: serde::Deserializer<'de>,
-{
-    let s = String::deserialize(deserializer)?;
-    parse_duration(&s).map_err(serde::de::Error::custom)
-}
-
-fn parse_duration(s: &str) -> Result<Duration, String> {
-    let s = s.trim();
-    if let Some(secs) = s.strip_suffix('s') {
-        secs.trim()
-            .parse::<u64>()
-            .map(Duration::from_secs)
-            .map_err(|e| format!("invalid seconds: {e}"))
-    } else if let Some(mins) = s.strip_suffix('m') {
-        mins.trim()
-            .parse::<u64>()
-            .map(|m| Duration::from_secs(m * 60))
-            .map_err(|e| format!("invalid minutes: {e}"))
-    } else {
-        // Assume seconds if no suffix
-        s.parse::<u64>()
-            .map(Duration::from_secs)
-            .map_err(|e| format!("invalid duration '{s}': {e}"))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_parse_duration() {
-        assert_eq!(parse_duration("300s").unwrap(), Duration::from_secs(300));
-        assert_eq!(parse_duration("5m").unwrap(), Duration::from_secs(300));
-        assert_eq!(parse_duration("60").unwrap(), Duration::from_secs(60));
-    }
-
-    #[test]
-    fn test_minimal_config() {
-        let config = BenchConfig::minimal(Some("test-model".to_string()));
-        assert_eq!(config.matrix.len(), 1);
-        assert_eq!(config.matrix[0].label, "test-model");
-        assert_eq!(config.max_iterations, 15);
-        assert_eq!(config.parallelism, 1);
-    }
-
-    #[test]
-    fn test_config_from_toml() {
-        let toml_str = r#"
-results_dir = "./my-results"
-task_timeout = "60s"
-max_iterations = 10
-parallelism = 2
-
-[[matrix]]
-label = "fast"
-model = "gpt-4o-mini"
-
-[[matrix]]
-label = "full"
-model = "claude-3-5-sonnet"
-tools = ["echo", "time"]
-
-[suite_config]
-dataset_path = "./data/test.jsonl"
-"#;
-        let config: BenchConfig = toml::from_str(toml_str).unwrap();
-        assert_eq!(config.results_dir, PathBuf::from("./my-results"));
-        assert_eq!(config.task_timeout, Duration::from_secs(60));
-        assert_eq!(config.max_iterations, 10);
-        assert_eq!(config.parallelism, 2);
-        assert_eq!(config.matrix.len(), 2);
-        assert_eq!(config.matrix[1].tools.as_ref().unwrap().len(), 2);
-        assert_eq!(
-            config.suite_config_str("dataset_path").unwrap(),
-            "./data/test.jsonl"
-        );
-    }
-}

benchmarks/src/error.rs

@@ -1,40 +0,0 @@
-use std::path::PathBuf;
-
-#[derive(Debug, thiserror::Error)]
-pub enum BenchError {
-    #[error("Config error: {0}")]
-    Config(String),
-
-    #[error("Config file not found: {path}")]
-    ConfigNotFound { path: PathBuf },
-
-    #[error("Suite {name} not found. Available: {available}")]
-    SuiteNotFound { name: String, available: String },
-
-    #[error("Task {task_id} failed: {reason}")]
-    TaskFailed { task_id: String, reason: String },
-
-    #[error("Timeout after {seconds}s for task {task_id}")]
-    Timeout { task_id: String, seconds: u64 },
-
-    #[error("Scoring error for task {task_id}: {reason}")]
-    Scoring { task_id: String, reason: String },
-
-    #[error("IO error: {0}")]
-    Io(#[from] std::io::Error),
-
-    #[error("JSON error: {0}")]
-    Json(#[from] serde_json::Error),
-
-    #[error("TOML parse error: {0}")]
-    Toml(#[from] toml::de::Error),
-
-    #[error("Agent error: {0}")]
-    Agent(#[from] ironclaw::Error),
-
-    #[error("Results directory error: {0}")]
-    ResultsDir(String),
-
-    #[error("Resume failed: no completed tasks found in {path}")]
-    ResumeEmpty { path: PathBuf },
-}

benchmarks/src/instrumented_llm.rs

@@ -1,248 +0,0 @@
-use std::sync::Arc;
-use std::sync::atomic::{AtomicU32, Ordering};
-use std::time::Instant;
-
-use async_trait::async_trait;
-use rust_decimal::Decimal;
-use tokio::sync::Mutex;
-
-use ironclaw::error::LlmError;
-use ironclaw::llm::{
-    CompletionRequest, CompletionResponse, LlmProvider, ToolCompletionRequest,
-    ToolCompletionResponse,
-};
-
-/// Recorded metrics from a single LLM call.
-#[derive(Debug, Clone)]
-pub struct LlmCallRecord {
-    pub input_tokens: u32,
-    pub output_tokens: u32,
-    pub duration_ms: u64,
-    pub had_tool_calls: bool,
-}
-
-/// Wraps an `LlmProvider` to record per-call metrics.
-///
-/// The wrapper is transparent to the agent: it delegates every call
-/// to the inner provider and captures token counts and timings.
-pub struct InstrumentedLlm {
-    inner: Arc<dyn LlmProvider>,
-    records: Mutex<Vec<LlmCallRecord>>,
-    total_input_tokens: AtomicU32,
-    total_output_tokens: AtomicU32,
-    call_count: AtomicU32,
-}
-
-impl InstrumentedLlm {
-    pub fn new(inner: Arc<dyn LlmProvider>) -> Self {
-        Self {
-            inner,
-            records: Mutex::new(Vec::new()),
-            total_input_tokens: AtomicU32::new(0),
-            total_output_tokens: AtomicU32::new(0),
-            call_count: AtomicU32::new(0),
-        }
-    }
-
-    /// Take all recorded call metrics, clearing the internal buffer.
-    pub async fn take_records(&self) -> Vec<LlmCallRecord> {
-        let mut records = self.records.lock().await;
-        std::mem::take(&mut *records)
-    }
-
-    /// Snapshot of total tokens without clearing.
-    pub fn total_input_tokens(&self) -> u32 {
-        self.total_input_tokens.load(Ordering::Relaxed)
-    }
-
-    pub fn total_output_tokens(&self) -> u32 {
-        self.total_output_tokens.load(Ordering::Relaxed)
-    }
-
-    pub fn call_count(&self) -> u32 {
-        self.call_count.load(Ordering::Relaxed)
-    }
-
-    /// Estimated cost using the inner provider's cost-per-token rates.
-    pub fn estimated_cost(&self) -> f64 {
-        let (input_rate, output_rate) = self.inner.cost_per_token();
-        let input_cost =
-            input_rate * Decimal::from(self.total_input_tokens.load(Ordering::Relaxed));
-        let output_cost =
-            output_rate * Decimal::from(self.total_output_tokens.load(Ordering::Relaxed));
-        let total = input_cost + output_cost;
-        // Convert Decimal to f64 for the trace (benchmarks don't need exact precision)
-        total.to_string().parse::<f64>().unwrap_or(0.0)
-    }
-
-    /// Reset all counters and records.
-    pub async fn reset(&self) {
-        self.records.lock().await.clear();
-        self.total_input_tokens.store(0, Ordering::Relaxed);
-        self.total_output_tokens.store(0, Ordering::Relaxed);
-        self.call_count.store(0, Ordering::Relaxed);
-    }
-
-    async fn record(
-        &self,
-        input_tokens: u32,
-        output_tokens: u32,
-        duration_ms: u64,
-        had_tool_calls: bool,
-    ) {
-        self.total_input_tokens
-            .fetch_add(input_tokens, Ordering::Relaxed);
-        self.total_output_tokens
-            .fetch_add(output_tokens, Ordering::Relaxed);
-        self.call_count.fetch_add(1, Ordering::Relaxed);
-        self.records.lock().await.push(LlmCallRecord {
-            input_tokens,
-            output_tokens,
-            duration_ms,
-            had_tool_calls,
-        });
-    }
-}
-
-#[async_trait]
-impl LlmProvider for InstrumentedLlm {
-    fn model_name(&self) -> &str {
-        self.inner.model_name()
-    }
-
-    fn cost_per_token(&self) -> (Decimal, Decimal) {
-        self.inner.cost_per_token()
-    }
-
-    async fn complete(&self, request: CompletionRequest) -> Result<CompletionResponse, LlmError> {
-        let start = Instant::now();
-        let response = self.inner.complete(request).await?;
-        let elapsed = start.elapsed().as_millis() as u64;
-        self.record(
-            response.input_tokens,
-            response.output_tokens,
-            elapsed,
-            false,
-        )
-        .await;
-        Ok(response)
-    }
-
-    async fn complete_with_tools(
-        &self,
-        request: ToolCompletionRequest,
-    ) -> Result<ToolCompletionResponse, LlmError> {
-        let start = Instant::now();
-        let response = self.inner.complete_with_tools(request).await?;
-        let elapsed = start.elapsed().as_millis() as u64;
-        let had_tool_calls = !response.tool_calls.is_empty();
-        self.record(
-            response.input_tokens,
-            response.output_tokens,
-            elapsed,
-            had_tool_calls,
-        )
-        .await;
-        Ok(response)
-    }
-
-    async fn list_models(&self) -> Result<Vec<String>, LlmError> {
-        self.inner.list_models().await
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use ironclaw::llm::{ChatMessage, CompletionRequest, CompletionResponse, FinishReason};
-
-    /// Fake LLM that returns a canned response with known token counts.
-    struct FakeLlm;
-
-    #[async_trait]
-    impl LlmProvider for FakeLlm {
-        fn model_name(&self) -> &str {
-            "fake-model"
-        }
-
-        fn cost_per_token(&self) -> (Decimal, Decimal) {
-            (
-                Decimal::new(3, 6),  // $0.000003 per input token
-                Decimal::new(15, 6), // $0.000015 per output token
-            )
-        }
-
-        async fn complete(
-            &self,
-            _request: CompletionRequest,
-        ) -> Result<CompletionResponse, LlmError> {
-            Ok(CompletionResponse {
-                content: "test response".to_string(),
-                input_tokens: 100,
-                output_tokens: 50,
-                finish_reason: FinishReason::Stop,
-            })
-        }
-
-        async fn complete_with_tools(
-            &self,
-            _request: ToolCompletionRequest,
-        ) -> Result<ToolCompletionResponse, LlmError> {
-            Ok(ToolCompletionResponse {
-                content: Some("tool response".to_string()),
-                tool_calls: vec![],
-                input_tokens: 200,
-                output_tokens: 100,
-                finish_reason: FinishReason::Stop,
-            })
-        }
-    }
-
-    #[tokio::test]
-    async fn test_instrumented_records_metrics() {
-        let inner = Arc::new(FakeLlm);
-        let instrumented = InstrumentedLlm::new(inner);
-
-        let request = CompletionRequest::new(vec![ChatMessage::user("hello")]);
-        let _ = instrumented.complete(request).await.unwrap();
-
-        assert_eq!(instrumented.call_count(), 1);
-        assert_eq!(instrumented.total_input_tokens(), 100);
-        assert_eq!(instrumented.total_output_tokens(), 50);
-
-        let records = instrumented.take_records().await;
-        assert_eq!(records.len(), 1);
-        assert_eq!(records[0].input_tokens, 100);
-        assert!(!records[0].had_tool_calls);
-    }
-
-    #[tokio::test]
-    async fn test_instrumented_cost_calculation() {
-        let inner = Arc::new(FakeLlm);
-        let instrumented = InstrumentedLlm::new(inner);
-
-        let request = CompletionRequest::new(vec![ChatMessage::user("hello")]);
-        let _ = instrumented.complete(request).await.unwrap();
-
-        // 100 * 0.000003 + 50 * 0.000015 = 0.0003 + 0.00075 = 0.00105
-        let cost = instrumented.estimated_cost();
-        assert!((cost - 0.00105).abs() < 0.0001);
-    }
-
-    #[tokio::test]
-    async fn test_instrumented_reset() {
-        let inner = Arc::new(FakeLlm);
-        let instrumented = InstrumentedLlm::new(inner);
-
-        let request = CompletionRequest::new(vec![ChatMessage::user("hello")]);
-        let _ = instrumented.complete(request).await.unwrap();
-        assert_eq!(instrumented.call_count(), 1);
-
-        instrumented.reset().await;
-        assert_eq!(instrumented.call_count(), 0);
-        assert_eq!(instrumented.total_input_tokens(), 0);
-
-        let records = instrumented.take_records().await;
-        assert!(records.is_empty());
-    }
-}

benchmarks/src/main.rs

@@ -1,314 +0,0 @@
-mod adapters;
-mod channel;
-mod config;
-mod error;
-mod instrumented_llm;
-mod results;
-mod runner;
-mod scoring;
-mod suite;
-
-use std::path::PathBuf;
-use std::sync::Arc;
-
-use clap::{Parser, Subcommand};
-use tracing_subscriber::{EnvFilter, layer::SubscriberExt, util::SubscriberInitExt};
-use uuid::Uuid;
-
-use crate::config::BenchConfig;
-
-#[derive(Parser)]
-#[command(name = "ironclaw-bench", about = "IronClaw benchmarking harness")]
-struct Cli {
-    #[command(subcommand)]
-    command: Commands,
-}
-
-#[derive(Subcommand)]
-enum Commands {
-    /// Run a benchmark suite.
-    Run {
-        /// Suite to run (custom, gaia, tau_bench, swe_bench).
-        #[arg(long)]
-        suite: String,
-
-        /// Path to bench config TOML.
-        #[arg(long)]
-        config: Option<PathBuf>,
-
-        /// Override model for all matrix entries.
-        #[arg(long)]
-        model: Option<String>,
-
-        /// Max tasks to run in parallel.
-        #[arg(long)]
-        parallelism: Option<usize>,
-
-        /// Sample N tasks from the suite (for quick testing).
-        #[arg(long)]
-        sample: Option<usize>,
-
-        /// Only run these task IDs (comma-separated).
-        #[arg(long, value_delimiter = ',')]
-        task_ids: Option<Vec<String>>,
-
-        /// Only run tasks with these tags (comma-separated).
-        #[arg(long, value_delimiter = ',')]
-        tags: Option<Vec<String>>,
-
-        /// Per-task timeout in seconds.
-        #[arg(long)]
-        timeout_secs: Option<u64>,
-
-        /// Override results directory.
-        #[arg(long)]
-        results_dir: Option<PathBuf>,
-
-        /// Resume a previous run by ID.
-        #[arg(long)]
-        resume: Option<Uuid>,
-    },
-
-    /// Show results for a run.
-    Results {
-        /// Run ID or "latest".
-        #[arg(default_value = "latest")]
-        run_id: String,
-
-        /// Output format.
-        #[arg(long, default_value = "table")]
-        format: ResultsFormat,
-
-        /// Override results directory.
-        #[arg(long)]
-        results_dir: Option<PathBuf>,
-    },
-
-    /// Compare two runs.
-    Compare {
-        /// Baseline run ID.
-        baseline: Uuid,
-
-        /// Comparison run ID.
-        comparison: Uuid,
-
-        /// Override results directory.
-        #[arg(long)]
-        results_dir: Option<PathBuf>,
-    },
-
-    /// List available benchmark suites.
-    List,
-}
-
-#[derive(Clone, Debug, clap::ValueEnum)]
-enum ResultsFormat {
-    Table,
-    Json,
-    Csv,
-}
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let cli = Cli::parse();
-
-    tracing_subscriber::registry()
-        .with(
-            EnvFilter::try_from_default_env()
-                .unwrap_or_else(|_| EnvFilter::new("ironclaw_bench=info,ironclaw=warn")),
-        )
-        .with(tracing_subscriber::fmt::layer().with_target(false))
-        .init();
-
-    match cli.command {
-        Commands::List => {
-            println!("Available benchmark suites:\n");
-            for (id, desc) in adapters::KNOWN_SUITES {
-                println!("  {:<15} {}", id, desc);
-            }
-            println!();
-        }
-        Commands::Run {
-            suite,
-            config: config_path,
-            model,
-            parallelism,
-            sample,
-            task_ids,
-            tags,
-            timeout_secs,
-            results_dir,
-            resume,
-        } => {
-            // Load or create config
-            let mut bench_config = if let Some(ref path) = config_path {
-                BenchConfig::from_file(path)?
-            } else {
-                BenchConfig::minimal(model.clone())
-            };
-
-            // Apply CLI overrides
-            if let Some(p) = parallelism {
-                bench_config.parallelism = p;
-            }
-            if let Some(t) = timeout_secs {
-                bench_config.task_timeout = std::time::Duration::from_secs(t);
-            }
-            if let Some(ref dir) = results_dir {
-                bench_config.results_dir = dir.clone();
-            }
-
-            // If model override specified and we have matrix entries, update them
-            if let Some(ref m) = model {
-                for entry in &mut bench_config.matrix {
-                    entry.model = Some(m.clone());
-                }
-            }
-
-            // Create suite
-            let bench_suite = adapters::create_suite(&suite, &bench_config)?;
-
-            // Initialize ironclaw LLM provider
-            let ironclaw_config = ironclaw::Config::from_env().map_err(|e| {
-                anyhow::anyhow!(
-                    "Failed to load ironclaw config: {}. Make sure .env is configured.",
-                    e
-                )
-            })?;
-
-            let session = ironclaw::llm::create_session_manager(ironclaw::llm::SessionConfig {
-                auth_base_url: ironclaw_config.llm.nearai.auth_base_url.clone(),
-                session_path: ironclaw_config.llm.nearai.session_path.clone(),
-                ..Default::default()
-            })
-            .await;
-            session.ensure_authenticated().await?;
-
-            let llm = ironclaw::llm::create_llm_provider(&ironclaw_config.llm, session)?;
-            let safety = Arc::new(ironclaw::safety::SafetyLayer::new(&ironclaw_config.safety));
-
-            let runner = runner::BenchRunner::new(bench_suite, bench_config.clone(), llm, safety);
-
-            // Run for each matrix entry
-            for matrix_entry in &bench_config.matrix {
-                let run_id = runner
-                    .run(
-                        matrix_entry,
-                        sample,
-                        task_ids.as_deref(),
-                        tags.as_deref(),
-                        resume,
-                    )
-                    .await?;
-                println!("Run complete: {}", run_id);
-            }
-        }
-        Commands::Results {
-            run_id,
-            format,
-            results_dir,
-        } => {
-            let base = results_dir.unwrap_or_else(|| PathBuf::from("./bench-results"));
-            let uuid = if run_id == "latest" {
-                results::find_latest_run(&base)?
-                    .ok_or_else(|| anyhow::anyhow!("No runs found in {}", base.display()))?
-            } else {
-                Uuid::parse_str(&run_id)?
-            };
-
-            let json_path = results::run_json_path(&base, uuid);
-            let jsonl_path = results::tasks_jsonl_path(&base, uuid);
-
-            let run = results::read_run_result(&json_path)?;
-            let tasks = results::read_task_results(&jsonl_path)?;
-
-            match format {
-                ResultsFormat::Table => {
-                    results::print_results_table(&tasks, &run);
-                }
-                ResultsFormat::Json => {
-                    let output = serde_json::json!({
-                        "run": run,
-                        "tasks": tasks,
-                    });
-                    println!("{}", serde_json::to_string_pretty(&output)?);
-                }
-                ResultsFormat::Csv => {
-                    println!("task_id,score,label,tokens,cost,turns,time_s");
-                    for task in &tasks {
-                        println!(
-                            "{},{:.3},{},{},{:.4},{},{:.1}",
-                            task.task_id,
-                            task.score.value,
-                            task.score.label,
-                            task.trace.input_tokens + task.trace.output_tokens,
-                            task.trace.estimated_cost_usd,
-                            task.trace.turns,
-                            task.trace.wall_time_ms as f64 / 1000.0,
-                        );
-                    }
-                }
-            }
-        }
-        Commands::Compare {
-            baseline,
-            comparison,
-            results_dir,
-        } => {
-            let base = results_dir.unwrap_or_else(|| PathBuf::from("./bench-results"));
-
-            let baseline_run = results::read_run_result(&results::run_json_path(&base, baseline))?;
-            let comparison_run =
-                results::read_run_result(&results::run_json_path(&base, comparison))?;
-
-            println!("\nComparison: {} vs {}\n", baseline, comparison);
-            println!(
-                "{:<20} {:>12} {:>12} {:>10}",
-                "Metric", "Baseline", "Comparison", "Delta"
-            );
-            println!("{}", "-".repeat(58));
-
-            let pass_delta = comparison_run.pass_rate - baseline_run.pass_rate;
-            println!(
-                "{:<20} {:>11.1}% {:>11.1}% {:>+9.1}%",
-                "Pass rate",
-                baseline_run.pass_rate * 100.0,
-                comparison_run.pass_rate * 100.0,
-                pass_delta * 100.0,
-            );
-
-            let score_delta = comparison_run.avg_score - baseline_run.avg_score;
-            println!(
-                "{:<20} {:>12.3} {:>12.3} {:>+10.3}",
-                "Avg score", baseline_run.avg_score, comparison_run.avg_score, score_delta,
-            );
-
-            let cost_delta = comparison_run.total_cost_usd - baseline_run.total_cost_usd;
-            println!(
-                "{:<20} {:>11.4}$ {:>11.4}$ {:>+9.4}$",
-                "Total cost",
-                baseline_run.total_cost_usd,
-                comparison_run.total_cost_usd,
-                cost_delta,
-            );
-
-            let time_b = baseline_run.total_wall_time_ms as f64 / 1000.0;
-            let time_c = comparison_run.total_wall_time_ms as f64 / 1000.0;
-            println!(
-                "{:<20} {:>11.1}s {:>11.1}s {:>+9.1}s",
-                "Total time",
-                time_b,
-                time_c,
-                time_c - time_b,
-            );
-
-            println!(
-                "{:<20} {:>12} {:>12}",
-                "Model", baseline_run.model, comparison_run.model,
-            );
-            println!();
-        }
-    }
-
-    Ok(())
-}

benchmarks/src/results.rs

@@ -1,392 +0,0 @@
-use std::collections::HashSet;
-use std::io::{BufRead, Write};
-use std::path::{Path, PathBuf};
-use std::time::Duration;
-
-use chrono::{DateTime, Utc};
-use uuid::Uuid;
-
-use crate::error::BenchError;
-use crate::suite::BenchScore;
-
-/// Metrics from a single task run: LLM usage, timing, tool calls.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-pub struct Trace {
-    pub wall_time_ms: u64,
-    pub llm_calls: u32,
-    pub input_tokens: u32,
-    pub output_tokens: u32,
-    pub estimated_cost_usd: f64,
-    pub tool_calls: Vec<TraceToolCall>,
-    pub turns: u32,
-    pub hit_iteration_limit: bool,
-    pub hit_timeout: bool,
-}
-
-impl Trace {
-    pub fn wall_time(&self) -> Duration {
-        Duration::from_millis(self.wall_time_ms)
-    }
-}
-
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-pub struct TraceToolCall {
-    pub name: String,
-    pub duration_ms: u64,
-    pub success: bool,
-}
-
-/// Result of running a single benchmark task.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-pub struct TaskResult {
-    pub task_id: String,
-    pub suite_id: String,
-    pub score: BenchScore,
-    pub trace: Trace,
-    pub response: String,
-    pub started_at: DateTime<Utc>,
-    pub finished_at: DateTime<Utc>,
-    pub config_label: String,
-    #[serde(default)]
-    pub error: Option<String>,
-}
-
-/// Aggregate results for a full benchmark run.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-pub struct RunResult {
-    pub run_id: Uuid,
-    pub suite_id: String,
-    pub config_label: String,
-    pub model: String,
-    pub pass_rate: f64,
-    pub avg_score: f64,
-    pub total_tasks: usize,
-    pub completed_tasks: usize,
-    pub total_cost_usd: f64,
-    pub total_wall_time_ms: u64,
-    pub started_at: DateTime<Utc>,
-    pub finished_at: DateTime<Utc>,
-}
-
-impl RunResult {
-    /// Build aggregate from individual task results.
-    pub fn from_tasks(
-        run_id: Uuid,
-        suite_id: &str,
-        config_label: &str,
-        model: &str,
-        total_tasks: usize,
-        tasks: &[TaskResult],
-        started_at: DateTime<Utc>,
-    ) -> Self {
-        let pass_count = tasks.iter().filter(|t| t.score.value >= 1.0).count();
-        let pass_rate = if tasks.is_empty() {
-            0.0
-        } else {
-            pass_count as f64 / tasks.len() as f64
-        };
-        let avg_score = if tasks.is_empty() {
-            0.0
-        } else {
-            tasks.iter().map(|t| t.score.value).sum::<f64>() / tasks.len() as f64
-        };
-        let total_cost: f64 = tasks.iter().map(|t| t.trace.estimated_cost_usd).sum();
-        let total_wall: u64 = tasks.iter().map(|t| t.trace.wall_time_ms).sum();
-
-        Self {
-            run_id,
-            suite_id: suite_id.to_string(),
-            config_label: config_label.to_string(),
-            model: model.to_string(),
-            pass_rate,
-            avg_score,
-            total_tasks,
-            completed_tasks: tasks.len(),
-            total_cost_usd: total_cost,
-            total_wall_time_ms: total_wall,
-            started_at,
-            finished_at: Utc::now(),
-        }
-    }
-
-    pub fn total_wall_time(&self) -> Duration {
-        Duration::from_millis(self.total_wall_time_ms)
-    }
-}
-
-/// Append a single task result as one JSON line to the JSONL file.
-pub fn append_task_result(path: &Path, result: &TaskResult) -> Result<(), BenchError> {
-    let mut file = std::fs::OpenOptions::new()
-        .create(true)
-        .append(true)
-        .open(path)?;
-    let line = serde_json::to_string(result)?;
-    writeln!(file, "{line}")?;
-    Ok(())
-}
-
-/// Read all task results from a JSONL file.
-pub fn read_task_results(path: &Path) -> Result<Vec<TaskResult>, BenchError> {
-    if !path.exists() {
-        return Ok(Vec::new());
-    }
-    let file = std::fs::File::open(path)?;
-    let reader = std::io::BufReader::new(file);
-    let mut results = Vec::new();
-    for line in reader.lines() {
-        let line = line?;
-        let trimmed = line.trim();
-        if trimmed.is_empty() {
-            continue;
-        }
-        let result: TaskResult = serde_json::from_str(trimmed)?;
-        results.push(result);
-    }
-    Ok(results)
-}
-
-/// Write the aggregate run result as JSON.
-pub fn write_run_result(path: &Path, result: &RunResult) -> Result<(), BenchError> {
-    let json = serde_json::to_string_pretty(result)?;
-    std::fs::write(path, json)?;
-    Ok(())
-}
-
-/// Read the aggregate run result from JSON.
-pub fn read_run_result(path: &Path) -> Result<RunResult, BenchError> {
-    let json = std::fs::read_to_string(path)?;
-    let result: RunResult = serde_json::from_str(&json)?;
-    Ok(result)
-}
-
-/// Get the set of already-completed task IDs from a JSONL file (for resume).
-pub fn completed_task_ids(path: &Path) -> Result<HashSet<String>, BenchError> {
-    let results = read_task_results(path)?;
-    Ok(results.into_iter().map(|r| r.task_id).collect())
-}
-
-/// Get the results directory for a specific run.
-pub fn run_dir(base: &Path, run_id: Uuid) -> PathBuf {
-    base.join(run_id.to_string())
-}
-
-/// Get the tasks JSONL path for a run.
-pub fn tasks_jsonl_path(base: &Path, run_id: Uuid) -> PathBuf {
-    run_dir(base, run_id).join("tasks.jsonl")
-}
-
-/// Get the run JSON path for a run.
-pub fn run_json_path(base: &Path, run_id: Uuid) -> PathBuf {
-    run_dir(base, run_id).join("run.json")
-}
-
-/// Find the latest run directory (by modification time).
-pub fn find_latest_run(base: &Path) -> Result<Option<Uuid>, BenchError> {
-    if !base.exists() {
-        return Ok(None);
-    }
-    let mut entries: Vec<_> = std::fs::read_dir(base)?
-        .filter_map(|e| e.ok())
-        .filter(|e| e.file_type().map(|ft| ft.is_dir()).unwrap_or(false))
-        .filter_map(|e| {
-            let name = e.file_name().to_string_lossy().to_string();
-            let uuid = Uuid::parse_str(&name).ok()?;
-            let modified = e.metadata().ok()?.modified().ok()?;
-            Some((uuid, modified))
-        })
-        .collect();
-    entries.sort_by(|a, b| b.1.cmp(&a.1));
-    Ok(entries.first().map(|(uuid, _)| *uuid))
-}
-
-/// Print a summary table of task results.
-pub fn print_results_table(tasks: &[TaskResult], run: &RunResult) {
-    println!();
-    println!(
-        "Run: {} | Suite: {} | Config: {} | Model: {}",
-        run.run_id, run.suite_id, run.config_label, run.model
-    );
-    println!(
-        "Pass rate: {:.1}% | Avg score: {:.3} | Tasks: {}/{} | Cost: ${:.4} | Time: {:.1}s",
-        run.pass_rate * 100.0,
-        run.avg_score,
-        run.completed_tasks,
-        run.total_tasks,
-        run.total_cost_usd,
-        run.total_wall_time_ms as f64 / 1000.0,
-    );
-    println!();
-
-    // Header
-    println!(
-        "{:<30} {:>6} {:>7} {:>8} {:>10} {:>6} {:>8}",
-        "Task ID", "Score", "Label", "Tokens", "Cost", "Turns", "Time"
-    );
-    println!("{}", "-".repeat(80));
-
-    for task in tasks {
-        let total_tokens = task.trace.input_tokens + task.trace.output_tokens;
-        let task_id_display = if task.task_id.len() > 28 {
-            format!("{}...", &task.task_id[..25])
-        } else {
-            task.task_id.clone()
-        };
-        println!(
-            "{:<30} {:>6.3} {:>7} {:>8} {:>10.4} {:>6} {:>7.1}s",
-            task_id_display,
-            task.score.value,
-            task.score.label,
-            total_tokens,
-            task.trace.estimated_cost_usd,
-            task.trace.turns,
-            task.trace.wall_time_ms as f64 / 1000.0,
-        );
-    }
-    println!();
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_run_result_from_tasks() {
-        let tasks = vec![
-            TaskResult {
-                task_id: "t1".to_string(),
-                suite_id: "custom".to_string(),
-                score: BenchScore {
-                    value: 1.0,
-                    label: "pass".to_string(),
-                    details: None,
-                },
-                trace: Trace {
-                    wall_time_ms: 1000,
-                    llm_calls: 2,
-                    input_tokens: 100,
-                    output_tokens: 50,
-                    estimated_cost_usd: 0.01,
-                    tool_calls: vec![],
-                    turns: 1,
-                    hit_iteration_limit: false,
-                    hit_timeout: false,
-                },
-                response: "answer".to_string(),
-                started_at: Utc::now(),
-                finished_at: Utc::now(),
-                config_label: "default".to_string(),
-                error: None,
-            },
-            TaskResult {
-                task_id: "t2".to_string(),
-                suite_id: "custom".to_string(),
-                score: BenchScore {
-                    value: 0.0,
-                    label: "fail".to_string(),
-                    details: Some("wrong".to_string()),
-                },
-                trace: Trace {
-                    wall_time_ms: 2000,
-                    llm_calls: 3,
-                    input_tokens: 200,
-                    output_tokens: 100,
-                    estimated_cost_usd: 0.02,
-                    tool_calls: vec![],
-                    turns: 2,
-                    hit_iteration_limit: false,
-                    hit_timeout: false,
-                },
-                response: "wrong answer".to_string(),
-                started_at: Utc::now(),
-                finished_at: Utc::now(),
-                config_label: "default".to_string(),
-                error: None,
-            },
-        ];
-
-        let run = RunResult::from_tasks(
-            Uuid::new_v4(),
-            "custom",
-            "default",
-            "test-model",
-            2,
-            &tasks,
-            Utc::now(),
-        );
-
-        assert_eq!(run.pass_rate, 0.5);
-        assert_eq!(run.avg_score, 0.5);
-        assert_eq!(run.total_tasks, 2);
-        assert_eq!(run.completed_tasks, 2);
-        assert!((run.total_cost_usd - 0.03).abs() < f64::EPSILON);
-        assert_eq!(run.total_wall_time_ms, 3000);
-    }
-
-    #[test]
-    fn test_jsonl_roundtrip() {
-        let dir = tempfile::tempdir().expect("temp dir");
-        let path = dir.path().join("tasks.jsonl");
-
-        let result = TaskResult {
-            task_id: "round-trip-test".to_string(),
-            suite_id: "custom".to_string(),
-            score: BenchScore::pass(),
-            trace: Trace {
-                wall_time_ms: 500,
-                llm_calls: 1,
-                input_tokens: 10,
-                output_tokens: 5,
-                estimated_cost_usd: 0.001,
-                tool_calls: vec![],
-                turns: 1,
-                hit_iteration_limit: false,
-                hit_timeout: false,
-            },
-            response: "hello".to_string(),
-            started_at: Utc::now(),
-            finished_at: Utc::now(),
-            config_label: "test".to_string(),
-            error: None,
-        };
-
-        append_task_result(&path, &result).expect("append");
-        append_task_result(&path, &result).expect("append");
-
-        let loaded = read_task_results(&path).expect("read");
-        assert_eq!(loaded.len(), 2);
-        assert_eq!(loaded[0].task_id, "round-trip-test");
-    }
-
-    #[test]
-    fn test_completed_task_ids() {
-        let dir = tempfile::tempdir().expect("temp dir");
-        let path = dir.path().join("tasks.jsonl");
-
-        let result = TaskResult {
-            task_id: "unique-id-1".to_string(),
-            suite_id: "custom".to_string(),
-            score: BenchScore::pass(),
-            trace: Trace {
-                wall_time_ms: 100,
-                llm_calls: 1,
-                input_tokens: 10,
-                output_tokens: 5,
-                estimated_cost_usd: 0.0,
-                tool_calls: vec![],
-                turns: 1,
-                hit_iteration_limit: false,
-                hit_timeout: false,
-            },
-            response: "x".to_string(),
-            started_at: Utc::now(),
-            finished_at: Utc::now(),
-            config_label: "test".to_string(),
-            error: None,
-        };
-        append_task_result(&path, &result).expect("append");
-
-        let ids = completed_task_ids(&path).expect("ids");
-        assert!(ids.contains("unique-id-1"));
-        assert!(!ids.contains("unique-id-2"));
-    }
-}

benchmarks/src/runner.rs

@@ -1,460 +0,0 @@
-use std::collections::HashSet;
-use std::sync::Arc;
-use std::time::Instant;
-
-use chrono::Utc;
-use tokio::sync::Mutex;
-use uuid::Uuid;
-
-use ironclaw::agent::{Agent, AgentDeps};
-use ironclaw::channels::{ChannelManager, IncomingMessage};
-use ironclaw::config::AgentConfig;
-use ironclaw::llm::LlmProvider;
-use ironclaw::safety::SafetyLayer;
-use ironclaw::tools::ToolRegistry;
-
-use crate::channel::BenchChannel;
-use crate::config::{BenchConfig, MatrixEntry};
-use crate::error::BenchError;
-use crate::instrumented_llm::InstrumentedLlm;
-use crate::results::{
-    RunResult, TaskResult, Trace, append_task_result, completed_task_ids, run_dir, run_json_path,
-    tasks_jsonl_path, write_run_result,
-};
-use crate::suite::{BenchSuite, BenchTask, ConversationTurn, TaskSubmission, TurnRole};
-
-/// Parameters for running a single task in isolation.
-struct TaskRunParams<'a> {
-    task: &'a BenchTask,
-    suite_id: &'a str,
-    config_label: &'a str,
-    llm: Arc<dyn LlmProvider>,
-    safety: Arc<SafetyLayer>,
-    timeout: std::time::Duration,
-    additional_tools: &'a [Arc<dyn ironclaw::tools::Tool>],
-}
-
-/// Orchestrates benchmark execution: loads tasks, runs agent per task,
-/// scores results, writes JSONL output.
-pub struct BenchRunner {
-    suite: Box<dyn BenchSuite>,
-    config: BenchConfig,
-    llm: Arc<dyn LlmProvider>,
-    safety: Arc<SafetyLayer>,
-}
-
-impl BenchRunner {
-    pub fn new(
-        suite: Box<dyn BenchSuite>,
-        config: BenchConfig,
-        llm: Arc<dyn LlmProvider>,
-        safety: Arc<SafetyLayer>,
-    ) -> Self {
-        Self {
-            suite,
-            config,
-            llm,
-            safety,
-        }
-    }
-
-    /// Run the benchmark for one matrix entry.
-    ///
-    /// Returns the run_id for result retrieval.
-    pub async fn run(
-        &self,
-        matrix: &MatrixEntry,
-        sample: Option<usize>,
-        task_filter: Option<&[String]>,
-        tag_filter: Option<&[String]>,
-        resume_run_id: Option<Uuid>,
-    ) -> Result<Uuid, BenchError> {
-        let run_id = resume_run_id.unwrap_or_else(Uuid::new_v4);
-        let results_base = &self.config.results_dir;
-        let dir = run_dir(results_base, run_id);
-        std::fs::create_dir_all(&dir)?;
-
-        let jsonl_path = tasks_jsonl_path(results_base, run_id);
-        let json_path = run_json_path(results_base, run_id);
-
-        // Load completed task IDs for resume support
-        let completed: HashSet<String> = if resume_run_id.is_some() {
-            completed_task_ids(&jsonl_path)?
-        } else {
-            HashSet::new()
-        };
-
-        if !completed.is_empty() {
-            tracing::info!(
-                "Resuming run {}: {} tasks already completed",
-                run_id,
-                completed.len()
-            );
-        }
-
-        // Load and filter tasks
-        let mut tasks = self.suite.load_tasks().await?;
-
-        if let Some(ids) = task_filter {
-            let id_set: HashSet<&str> = ids.iter().map(|s| s.as_str()).collect();
-            tasks.retain(|t| id_set.contains(t.id.as_str()));
-        }
-
-        if let Some(tags) = tag_filter {
-            let tag_set: HashSet<&str> = tags.iter().map(|s| s.as_str()).collect();
-            tasks.retain(|t| t.tags.iter().any(|tag| tag_set.contains(tag.as_str())));
-        }
-
-        // Filter out already-completed tasks
-        tasks.retain(|t| !completed.contains(&t.id));
-
-        // Sample if requested
-        if let Some(n) = sample {
-            tasks.truncate(n);
-        }
-
-        let total_tasks = tasks.len() + completed.len();
-        tracing::info!(
-            "Running {} tasks for suite '{}' (config: {}, run: {})",
-            tasks.len(),
-            self.suite.id(),
-            matrix.label,
-            run_id
-        );
-
-        let started_at = Utc::now();
-        let all_results: Arc<Mutex<Vec<TaskResult>>> =
-            Arc::new(Mutex::new(Vec::with_capacity(tasks.len())));
-
-        if self.config.parallelism <= 1 {
-            // Sequential execution
-            let additional_tools = self.suite.additional_tools();
-            for (i, task) in tasks.iter().enumerate() {
-                tracing::info!(
-                    "[{}/{}] Running task: {}",
-                    i + 1 + completed.len(),
-                    total_tasks,
-                    task.id
-                );
-                let params = TaskRunParams {
-                    task,
-                    suite_id: self.suite.id(),
-                    config_label: &matrix.label,
-                    llm: Arc::clone(&self.llm),
-                    safety: Arc::clone(&self.safety),
-                    timeout: task.timeout.unwrap_or(self.config.task_timeout),
-                    additional_tools: &additional_tools,
-                };
-                let result = run_task_isolated(params).await;
-                append_task_result(&jsonl_path, &result)?;
-                all_results.lock().await.push(result);
-            }
-        } else {
-            // Parallel execution with bounded concurrency
-            let semaphore = Arc::new(tokio::sync::Semaphore::new(self.config.parallelism));
-
-            let mut handles = Vec::new();
-            for (i, task) in tasks.into_iter().enumerate() {
-                let sem = Arc::clone(&semaphore);
-                let suite_id = self.suite.id().to_string();
-                let config_label = matrix.label.clone();
-                let llm = Arc::clone(&self.llm);
-                let safety = Arc::clone(&self.safety);
-                let timeout = task.timeout.unwrap_or(self.config.task_timeout);
-                let results_ref = Arc::clone(&all_results);
-                let jsonl = jsonl_path.clone();
-                let completed_count = completed.len();
-                let total = total_tasks;
-                let additional_tools = self.suite.additional_tools();
-
-                handles.push(tokio::spawn(async move {
-                    let _permit = sem.acquire().await.expect("semaphore closed");
-                    tracing::info!(
-                        "[{}/{}] Running task: {}",
-                        i + 1 + completed_count,
-                        total,
-                        task.id
-                    );
-                    let params = TaskRunParams {
-                        task: &task,
-                        suite_id: &suite_id,
-                        config_label: &config_label,
-                        llm,
-                        safety,
-                        timeout,
-                        additional_tools: &additional_tools,
-                    };
-                    let result = run_task_isolated(params).await;
-                    if let Err(e) = append_task_result(&jsonl, &result) {
-                        tracing::error!("Failed to write result for {}: {}", task.id, e);
-                    }
-                    results_ref.lock().await.push(result);
-                }));
-            }
-
-            for handle in handles {
-                if let Err(e) = handle.await {
-                    tracing::error!("Task panicked: {}", e);
-                }
-            }
-        }
-
-        // Score all results
-        let results = all_results.lock().await;
-        let mut scored: Vec<TaskResult> = Vec::with_capacity(results.len());
-        for result in results.iter() {
-            let task_opt = self
-                .suite
-                .load_tasks()
-                .await?
-                .into_iter()
-                .find(|t| t.id == result.task_id);
-
-            if let Some(task) = task_opt {
-                let submission = TaskSubmission {
-                    response: result.response.clone(),
-                    conversation: vec![],
-                    tool_calls: result
-                        .trace
-                        .tool_calls
-                        .iter()
-                        .map(|tc| tc.name.clone())
-                        .collect(),
-                };
-                match self.suite.score(&task, &submission).await {
-                    Ok(score) => {
-                        let mut scored_result = result.clone();
-                        scored_result.score = score;
-                        scored.push(scored_result);
-                    }
-                    Err(e) => {
-                        tracing::warn!("Scoring failed for {}: {}", result.task_id, e);
-                        scored.push(result.clone());
-                    }
-                }
-            } else {
-                scored.push(result.clone());
-            }
-        }
-
-        // Combine with any previously completed results for the aggregate
-        let mut all_for_aggregate = crate::results::read_task_results(&jsonl_path)?;
-        // De-duplicate (prefer the newer scored versions)
-        let scored_ids: HashSet<String> = scored.iter().map(|r| r.task_id.clone()).collect();
-        all_for_aggregate.retain(|r| !scored_ids.contains(&r.task_id));
-        all_for_aggregate.extend(scored);
-
-        let model_name = matrix.model.as_deref().unwrap_or(self.llm.model_name());
-
-        let run_result = RunResult::from_tasks(
-            run_id,
-            self.suite.id(),
-            &matrix.label,
-            model_name,
-            total_tasks,
-            &all_for_aggregate,
-            started_at,
-        );
-
-        write_run_result(&json_path, &run_result)?;
-
-        tracing::info!(
-            "Run {} complete: {:.1}% pass rate, {:.3} avg score, ${:.4} cost",
-            run_id,
-            run_result.pass_rate * 100.0,
-            run_result.avg_score,
-            run_result.total_cost_usd,
-        );
-
-        Ok(run_id)
-    }
-}
-
-/// Run a single benchmark task in complete isolation.
-///
-/// Creates a fresh Agent + BenchChannel + InstrumentedLlm for the task,
-/// injects the prompt, waits for the response, and returns the result.
-async fn run_task_isolated(params: TaskRunParams<'_>) -> TaskResult {
-    let TaskRunParams {
-        task,
-        suite_id,
-        config_label,
-        llm,
-        safety,
-        timeout,
-        additional_tools,
-    } = params;
-
-    let started_at = Utc::now();
-    let start = Instant::now();
-
-    // Wrap LLM with instrumentation
-    let instrumented = Arc::new(InstrumentedLlm::new(llm));
-
-    // Create bench channel
-    let (bench_channel, msg_tx) = BenchChannel::new();
-    let capture = bench_channel.capture();
-
-    // Build tool registry
-    let tools = Arc::new(ToolRegistry::new());
-    tools.register_builtin_tools();
-
-    // Register additional suite-specific tools
-    for tool in additional_tools {
-        tools.register(Arc::clone(tool)).await;
-    }
-
-    // Build agent config (minimal, headless)
-    let agent_config = AgentConfig {
-        name: format!("bench-{}", task.id),
-        max_parallel_jobs: 1,
-        job_timeout: timeout,
-        stuck_threshold: timeout,
-        repair_check_interval: timeout + std::time::Duration::from_secs(999),
-        max_repair_attempts: 0,
-        use_planning: false,
-        session_idle_timeout: timeout,
-    };
-
-    let deps = AgentDeps {
-        store: None,
-        llm: instrumented.clone() as Arc<dyn LlmProvider>,
-        safety,
-        tools,
-        workspace: None,
-        extension_manager: None,
-    };
-
-    let mut channels = ChannelManager::new();
-    channels.add(Box::new(bench_channel));
-
-    let agent = Agent::new(agent_config, deps, channels, None, None, None);
-
-    // Build the full prompt with context
-    let full_prompt = if let Some(ref ctx) = task.context {
-        format!("{}\n\nContext:\n{}", task.prompt, ctx)
-    } else {
-        task.prompt.clone()
-    };
-
-    // Inject the task prompt
-    let incoming = IncomingMessage::new("bench", "bench-user", &full_prompt);
-    if msg_tx.send(incoming).await.is_err() {
-        return make_error_result(
-            task,
-            suite_id,
-            config_label,
-            started_at,
-            "failed to send prompt",
-        );
-    }
-
-    // Record prompt in conversation
-    {
-        let mut cap = capture.lock().await;
-        cap.conversation.push(ConversationTurn {
-            role: TurnRole::User,
-            content: full_prompt,
-        });
-    }
-
-    // Run agent with timeout.
-    // After the first response, send /quit to end the session.
-    let quit_tx = msg_tx.clone();
-    let capture_for_quit = Arc::clone(&capture);
-    let quit_handle = tokio::spawn(async move {
-        // Poll for first response
-        loop {
-            tokio::time::sleep(std::time::Duration::from_millis(100)).await;
-            let cap = capture_for_quit.lock().await;
-            if !cap.responses.is_empty() {
-                break;
-            }
-        }
-        // Give a small grace period for any final status events
-        tokio::time::sleep(std::time::Duration::from_millis(200)).await;
-        let quit = IncomingMessage::new("bench", "bench-user", "/quit");
-        let _ = quit_tx.send(quit).await;
-    });
-
-    let agent_result = tokio::time::timeout(timeout, agent.run()).await;
-
-    quit_handle.abort();
-
-    let wall_time = start.elapsed();
-    let hit_timeout = agent_result.is_err();
-
-    if let Ok(Err(e)) = &agent_result {
-        tracing::warn!("Agent error for task {}: {}", task.id, e);
-    }
-
-    // Extract results from capture
-    let cap = capture.lock().await;
-    let response = cap.responses.last().cloned().unwrap_or_default();
-
-    let trace = Trace {
-        wall_time_ms: wall_time.as_millis() as u64,
-        llm_calls: instrumented.call_count(),
-        input_tokens: instrumented.total_input_tokens(),
-        output_tokens: instrumented.total_output_tokens(),
-        estimated_cost_usd: instrumented.estimated_cost(),
-        tool_calls: cap.tool_calls.clone(),
-        turns: cap.responses.len() as u32,
-        hit_iteration_limit: false,
-        hit_timeout,
-    };
-
-    let error = if hit_timeout {
-        Some(format!("timeout after {}s", timeout.as_secs()))
-    } else if let Ok(Err(e)) = &agent_result {
-        Some(e.to_string())
-    } else {
-        None
-    };
-
-    TaskResult {
-        task_id: task.id.clone(),
-        suite_id: suite_id.to_string(),
-        score: crate::suite::BenchScore {
-            value: 0.0,
-            label: "pending".to_string(),
-            details: None,
-        },
-        trace,
-        response,
-        started_at,
-        finished_at: Utc::now(),
-        config_label: config_label.to_string(),
-        error,
-    }
-}
-
-fn make_error_result(
-    task: &BenchTask,
-    suite_id: &str,
-    config_label: &str,
-    started_at: chrono::DateTime<Utc>,
-    reason: &str,
-) -> TaskResult {
-    TaskResult {
-        task_id: task.id.clone(),
-        suite_id: suite_id.to_string(),
-        score: crate::suite::BenchScore::fail(reason),
-        trace: Trace {
-            wall_time_ms: 0,
-            llm_calls: 0,
-            input_tokens: 0,
-            output_tokens: 0,
-            estimated_cost_usd: 0.0,
-            tool_calls: vec![],
-            turns: 0,
-            hit_iteration_limit: false,
-            hit_timeout: false,
-        },
-        response: String::new(),
-        started_at,
-        finished_at: Utc::now(),
-        config_label: config_label.to_string(),
-        error: Some(reason.to_string()),
-    }
-}

benchmarks/src/scoring.rs

@@ -1,113 +0,0 @@
-use regex::Regex;
-
-use crate::suite::BenchScore;
-
-/// Normalize an answer string for comparison: lowercase, trim whitespace,
-/// strip trailing punctuation, collapse internal whitespace.
-pub fn normalize_answer(s: &str) -> String {
-    let trimmed = s.trim().to_lowercase();
-    let collapsed: String = trimmed.split_whitespace().collect::<Vec<_>>().join(" ");
-    collapsed.trim_end_matches(['.', ',', ';', '!']).to_string()
-}
-
-/// Exact match after normalization.
-pub fn exact_match(expected: &str, actual: &str) -> BenchScore {
-    let norm_expected = normalize_answer(expected);
-    let norm_actual = normalize_answer(actual);
-    if norm_expected == norm_actual {
-        BenchScore::pass()
-    } else {
-        BenchScore::fail(format!(
-            "expected \"{norm_expected}\", got \"{norm_actual}\""
-        ))
-    }
-}
-
-/// Check if the actual answer contains the expected substring (normalized).
-pub fn contains_match(expected_substring: &str, actual: &str) -> BenchScore {
-    let norm_expected = normalize_answer(expected_substring);
-    let norm_actual = normalize_answer(actual);
-    if norm_actual.contains(&norm_expected) {
-        BenchScore::pass()
-    } else {
-        BenchScore::fail(format!("response does not contain \"{norm_expected}\""))
-    }
-}
-
-/// Check if the actual answer matches a regex pattern.
-pub fn regex_match(pattern: &str, actual: &str) -> BenchScore {
-    match Regex::new(pattern) {
-        Ok(re) => {
-            if re.is_match(actual) {
-                BenchScore::pass()
-            } else {
-                BenchScore::fail(format!("response does not match pattern /{pattern}/"))
-            }
-        }
-        Err(e) => BenchScore::fail(format!("invalid regex pattern: {e}")),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_normalize_answer() {
-        assert_eq!(normalize_answer("  Hello   World.  "), "hello world");
-        assert_eq!(normalize_answer("Yes!"), "yes");
-        assert_eq!(normalize_answer("42"), "42");
-        assert_eq!(normalize_answer("  "), "");
-    }
-
-    #[test]
-    fn test_exact_match_pass() {
-        let score = exact_match("Hello World", "  hello   world.  ");
-        assert_eq!(score.value, 1.0);
-        assert_eq!(score.label, "pass");
-    }
-
-    #[test]
-    fn test_exact_match_fail() {
-        let score = exact_match("hello", "world");
-        assert_eq!(score.value, 0.0);
-        assert_eq!(score.label, "fail");
-    }
-
-    #[test]
-    fn test_contains_match_pass() {
-        let score = contains_match("world", "Hello World!");
-        assert_eq!(score.value, 1.0);
-    }
-
-    #[test]
-    fn test_contains_match_fail() {
-        let score = contains_match("xyz", "Hello World!");
-        assert_eq!(score.value, 0.0);
-    }
-
-    #[test]
-    fn test_regex_match_pass() {
-        let score = regex_match(r"\d{4}", "The year is 2024.");
-        assert_eq!(score.value, 1.0);
-    }
-
-    #[test]
-    fn test_regex_match_fail() {
-        let score = regex_match(r"\d{4}", "No numbers here.");
-        assert_eq!(score.value, 0.0);
-    }
-
-    #[test]
-    fn test_regex_match_invalid_pattern() {
-        let score = regex_match(r"[invalid", "anything");
-        assert_eq!(score.value, 0.0);
-        assert!(
-            score
-                .details
-                .as_deref()
-                .unwrap_or("")
-                .contains("invalid regex")
-        );
-    }
-}

benchmarks/src/suite.rs

@@ -1,156 +0,0 @@
-use std::sync::Arc;
-use std::time::Duration;
-
-use async_trait::async_trait;
-
-use crate::error::BenchError;
-
-/// A single task in a benchmark suite.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-pub struct BenchTask {
-    pub id: String,
-    pub prompt: String,
-    #[serde(default)]
-    pub context: Option<String>,
-    #[serde(default)]
-    pub resources: Vec<TaskResource>,
-    #[serde(default)]
-    pub tags: Vec<String>,
-    #[serde(default)]
-    pub expected_turns: Option<usize>,
-    #[serde(default)]
-    pub timeout: Option<Duration>,
-    #[serde(default)]
-    pub metadata: serde_json::Value,
-}
-
-/// A resource attached to a benchmark task (file, URL, etc.).
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-pub struct TaskResource {
-    pub name: String,
-    pub path: String,
-    #[serde(default)]
-    pub resource_type: ResourceType,
-}
-
-#[derive(Debug, Clone, Default, serde::Serialize, serde::Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum ResourceType {
-    #[default]
-    File,
-    Url,
-    Directory,
-}
-
-/// What the agent produced for scoring.
-#[derive(Debug, Clone)]
-pub struct TaskSubmission {
-    pub response: String,
-    pub conversation: Vec<ConversationTurn>,
-    pub tool_calls: Vec<String>,
-}
-
-/// A single turn in a multi-turn conversation.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-pub struct ConversationTurn {
-    pub role: TurnRole,
-    pub content: String,
-}
-
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum TurnRole {
-    User,
-    Assistant,
-    System,
-}
-
-/// Score for a single task.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-pub struct BenchScore {
-    /// 0.0 to 1.0 (1.0 = perfect).
-    pub value: f64,
-    /// "pass" / "fail" / "partial".
-    pub label: String,
-    #[serde(default)]
-    pub details: Option<String>,
-}
-
-impl BenchScore {
-    pub fn pass() -> Self {
-        Self {
-            value: 1.0,
-            label: "pass".to_string(),
-            details: None,
-        }
-    }
-
-    pub fn fail(details: impl Into<String>) -> Self {
-        Self {
-            value: 0.0,
-            label: "fail".to_string(),
-            details: Some(details.into()),
-        }
-    }
-
-    pub fn partial(value: f64, details: impl Into<String>) -> Self {
-        Self {
-            value: value.clamp(0.0, 1.0),
-            label: "partial".to_string(),
-            details: Some(details.into()),
-        }
-    }
-}
-
-/// Trait for benchmark suite adapters.
-///
-/// Each suite (GAIA, Tau-bench, custom, etc.) implements this trait
-/// to provide task loading, scoring, and optional lifecycle hooks.
-#[async_trait]
-pub trait BenchSuite: Send + Sync {
-    /// Human-readable name (e.g., "GAIA Validation").
-    fn name(&self) -> &str;
-
-    /// Machine ID (e.g., "gaia").
-    fn id(&self) -> &str;
-
-    /// Load all tasks from the suite's data source.
-    async fn load_tasks(&self) -> Result<Vec<BenchTask>, BenchError>;
-
-    /// Score the agent's submission against the expected answer.
-    async fn score(
-        &self,
-        task: &BenchTask,
-        submission: &TaskSubmission,
-    ) -> Result<BenchScore, BenchError>;
-
-    /// Optional: set up environment before running a task (clone repo, init DB, etc.).
-    async fn setup_task(&self, _task: &BenchTask) -> Result<(), BenchError> {
-        Ok(())
-    }
-
-    /// Optional: tear down environment after a task completes.
-    async fn teardown_task(&self, _task: &BenchTask) -> Result<(), BenchError> {
-        Ok(())
-    }
-
-    /// Optional: additional tools to register for this suite's tasks.
-    fn additional_tools(&self) -> Vec<Arc<dyn ironclaw::tools::Tool>> {
-        vec![]
-    }
-
-    /// Optional: restrict which tools the agent can use (allowlist).
-    fn tool_whitelist(&self) -> Option<Vec<String>> {
-        None
-    }
-
-    /// Multi-turn: generate next simulated user message based on conversation so far.
-    /// Return `None` to end the conversation.
-    async fn next_user_message(
-        &self,
-        _task: &BenchTask,
-        _conversation: &[ConversationTurn],
-    ) -> Result<Option<String>, BenchError> {
-        Ok(None)
-    }
-}

build.rs

@@ -0,0 +1,106 @@
+//! Build script: compile Telegram channel WASM from source.
+//!
+//! Do not commit compiled WASM binaries — they are a supply chain risk.
+//! This script builds telegram.wasm from channels-src/telegram before the main crate compiles.
+//!
+//! Reproducible build:
+//!   cargo build --release
+//! (build.rs invokes the channel build automatically)
+//!
+//! Prerequisites: rustup target add wasm32-wasip2, cargo install wasm-tools
+
+use std::env;
+use std::path::PathBuf;
+use std::process::Command;
+
+fn main() {
+    let manifest_dir = env::var("CARGO_MANIFEST_DIR").unwrap();
+    let root = PathBuf::from(&manifest_dir);
+    let channel_dir = root.join("channels-src/telegram");
+    let wasm_out = channel_dir.join("telegram.wasm");
+
+    // Rerun when channel source or build script changes
+    println!("cargo:rerun-if-changed=channels-src/telegram/src");
+    println!("cargo:rerun-if-changed=channels-src/telegram/Cargo.toml");
+    println!("cargo:rerun-if-changed=wit/channel.wit");
+
+    if !channel_dir.is_dir() {
+        return;
+    }
+
+    // Build WASM module
+    let status = match Command::new("cargo")
+        .args([
+            "build",
+            "--release",
+            "--target",
+            "wasm32-wasip2",
+            "--manifest-path",
+            channel_dir.join("Cargo.toml").to_str().unwrap(),
+        ])
+        .current_dir(&root)
+        .status()
+    {
+        Ok(s) => s,
+        Err(_) => {
+            eprintln!(
+                "cargo:warning=Telegram channel build failed. Run: ./channels-src/telegram/build.sh"
+            );
+            return;
+        }
+    };
+
+    if !status.success() {
+        eprintln!(
+            "cargo:warning=Telegram channel build failed. Run: ./channels-src/telegram/build.sh"
+        );
+        return;
+    }
+
+    let raw_wasm = channel_dir.join("target/wasm32-wasip2/release/telegram_channel.wasm");
+    if !raw_wasm.exists() {
+        eprintln!(
+            "cargo:warning=Telegram WASM output not found at {:?}",
+            raw_wasm
+        );
+        return;
+    }
+
+    // Convert to component and strip (wasm-tools)
+    let component_ok = Command::new("wasm-tools")
+        .args([
+            "component",
+            "new",
+            raw_wasm.to_str().unwrap(),
+            "-o",
+            wasm_out.to_str().unwrap(),
+        ])
+        .current_dir(&root)
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false);
+
+    if !component_ok {
+        // Fallback: copy raw module if wasm-tools unavailable
+        if std::fs::copy(&raw_wasm, &wasm_out).is_err() {
+            eprintln!("cargo:warning=wasm-tools not found. Run: cargo install wasm-tools");
+        }
+    } else {
+        // Strip debug info (use temp file to avoid clobbering)
+        let stripped = wasm_out.with_extension("wasm.stripped");
+        let strip_ok = Command::new("wasm-tools")
+            .args([
+                "strip",
+                wasm_out.to_str().unwrap(),
+                "-o",
+                stripped.to_str().unwrap(),
+            ])
+            .current_dir(&root)
+            .status()
+            .map(|s| s.success())
+            .unwrap_or(false);
+        if strip_ok {
+            let _ = std::fs::rename(&stripped, &wasm_out);
+        }
+    }
+}

channels-src/discord/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "discord-channel"
+version = "0.1.0"
+edition = "2021"
+description = "Discord channel for IronClaw"
+license = "MIT OR Apache-2.0"
+publish = false
+
+[dependencies]
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+wit-bindgen = "0.41.0"
+
+[lib]
+crate-type = ["cdylib"]
+
+[profile.release]
+strip = true
+opt-level = "s"
+lto = true
+codegen-units = 1
+
+

channels-src/discord/README.md

@@ -0,0 +1,121 @@
+# Discord Channel for IronClaw
+
+WASM channel for Discord integration - handle slash commands and button interactions via webhooks.
+
+## Features
+
+- **Slash Commands** - Process Discord slash commands
+- **Button Interactions** - Handle button clicks
+- **Thread Support** - Respond in threads
+- **DM Support** - Handle direct messages
+
+## Setup
+
+1. Create a Discord Application at <https://discord.com/developers/applications>
+2. Create a Bot and get the token
+3. Set up Interactions URL to point to your IronClaw instance
+4. Copy the Application ID and Public Key
+5. Store in IronClaw secrets:
+
+   ```bash
+   ironclaw secret set discord_bot_token YOUR_BOT_TOKEN
+   ```
+
+   **Note:** The `discord_bot_token` secret is the only value read directly by this
+   Discord channel WASM component. The `discord_app_id` and `discord_public_key`
+   secrets are used by the IronClaw host (for example, to verify Discord
+   interaction signatures and manage slash command registration) and are not
+   accessed from the WASM module itself.
+
+## Discord Configuration
+
+### Register Slash Commands
+
+```bash
+curl -X POST \
+  -H "Authorization: Bot YOUR_BOT_TOKEN" \
+  -H "Content-Type: application/json" \
+  https://discord.com/api/v10/applications/YOUR_APP_ID/commands \
+  -d '{
+    "name": "ask",
+    "description": "Ask the AI agent",
+    "options": [{
+      "name": "question",
+      "description": "Your question",
+      "type": 3,
+      "required": true
+    }]
+  }'
+```
+
+### Set Interactions Endpoint
+
+In your Discord app settings, set:
+
+- Interactions Endpoint URL: `https://your-ironclaw.com/webhook/discord`
+
+## Usage Examples
+
+### Slash Command
+
+User types: `/ask question: What is the weather?`
+
+The agent receives:
+
+```text
+User: @username
+Content: /ask question: What is the weather?
+```
+
+### Button Click
+
+When a user clicks a button in a message, the agent receives:
+
+```text
+User: @username
+Content: [Button clicked] Original message content
+```
+
+## Error Handling
+
+If an internal error occurs (e.g., metadata serialization failure), the tool attempts to send an ephemeral message to the user:
+
+```text
+❌ Internal Error: Failed to process command metadata.
+```
+
+Check the host logs for detailed error information.
+
+## Advanced Usage
+
+### Embeds
+
+To send embeds, include an `embeds` array in the `metadata_json` field of the agent's response. The structure should match the Discord API `embed` object.
+
+## Troubleshooting
+
+### "Invalid Signature"
+
+- Check that `discord_public_key` is set correctly in IronClaw secrets.
+- This validation happens on the host before reaching the WASM.
+
+### "401 Unauthorized"
+
+- Check that `discord_bot_token` is set correctly in IronClaw secrets.
+- Ensure the bot is added to the server.
+
+### "Interaction Failed"
+
+- The interaction might have timed out (Discord requires a response within 3 seconds).
+- The `interactions_endpoint_url` might be unreachable.
+
+## Building
+
+```bash
+cd channels-src/discord
+cargo build --target wasm32-wasi --release
+```
+
+## License
+
+MIT/Apache-2.0

channels-src/discord/discord.capabilities.json

@@ -0,0 +1,39 @@
+{
+  "type": "channel",
+  "name": "discord",
+  "description": "Discord Gateway/Webhook channel for handling slash commands, buttons, and messages",
+  "capabilities": {
+    "http": {
+      "allowlist": [
+        { "host": "discord.com", "path_prefix": "/api/v10" }
+      ],
+      "credentials": {
+        "discord_bot_token": {
+          "secret_name": "discord_bot_token",
+          "location": { "type": "header", "header_name": "Authorization", "prefix": "Bot " },
+          "host_patterns": ["discord.com"]
+        }
+      },
+      "rate_limit": {
+        "requests_per_minute": 60,
+        "requests_per_hour": 3600
+      }
+    },
+    "secrets": {
+      "allowed_names": ["discord_bot_token", "discord_*"]
+    },
+    "channel": {
+      "allowed_paths": ["/webhook/discord"],
+      "allow_polling": false,
+      "callback_timeout_secs": 45,
+      "workspace_prefix": "channels/discord/",
+      "emit_rate_limit": {
+        "messages_per_minute": 100,
+        "messages_per_hour": 5000
+      }
+    }
+  },
+  "config": {
+    "require_signature_verification": true
+  }
+}

channels-src/discord/src/lib.rs

@@ -0,0 +1,476 @@
+//! Discord Gateway/Webhook channel for IronClaw.
+//!
+//! This WASM component implements the channel interface for handling Discord
+//! interactions via webhooks and sending messages back to Discord.
+//!
+//! # Features
+//!
+//! - URL verification for Discord interactions
+//! - Slash command handling
+//! - Message event parsing (@mentions, DMs)
+//! - Thread support for conversations
+//! - Response posting via Discord Web API
+//! - Automatic message truncation (> 2000 chars)
+//!
+//! # Security
+//!
+//! - Signature validation is handled by the host (webhook secrets)
+//! - Bot token is injected by host during HTTP requests
+//! - WASM never sees raw credentials
+
+wit_bindgen::generate!({
+    world: "sandboxed-channel",
+    path: "../../wit/channel.wit",
+});
+
+use serde::{Deserialize, Serialize};
+
+use exports::near::agent::channel::{
+    AgentResponse, ChannelConfig, Guest, HttpEndpointConfig, IncomingHttpRequest,
+    OutgoingHttpResponse, StatusUpdate,
+};
+use near::agent::channel_host::{self, EmittedMessage};
+
+/// Discord interaction wrapper.
+#[derive(Debug, Deserialize)]
+struct DiscordInteraction {
+    /// Interaction type (1=Ping, 2=ApplicationCommand, 3=MessageComponent)
+    #[serde(rename = "type")]
+    interaction_type: u8,
+
+    /// Interaction ID
+    id: String,
+
+    /// Application ID
+    application_id: String,
+
+    /// Guild ID (if in server)
+    #[allow(dead_code)] // Part of API payload, currently unused
+    guild_id: Option<String>,
+
+    /// Channel ID
+    channel_id: Option<String>,
+
+    /// Member info (if in server)
+    member: Option<DiscordMember>,
+
+    /// User info (if DM)
+    user: Option<DiscordUser>,
+
+    /// Command data (for slash commands)
+    data: Option<DiscordCommandData>,
+
+    /// Message (for component interactions)
+    message: Option<DiscordMessage>,
+
+    /// Token for responding
+    token: String,
+}
+
+#[derive(Debug, Deserialize, Clone)]
+struct DiscordMember {
+    user: DiscordUser,
+    #[allow(dead_code)] // Part of API payload, currently unused
+    nick: Option<String>,
+}
+
+#[derive(Debug, Deserialize, Clone)]
+struct DiscordUser {
+    id: String,
+    username: String,
+    global_name: Option<String>,
+}
+
+#[derive(Debug, Deserialize, Clone)]
+struct DiscordCommandData {
+    #[allow(dead_code)] // Part of API payload, currently unused
+    id: String,
+    name: String,
+    options: Option<Vec<DiscordCommandOption>>,
+}
+
+#[derive(Debug, Deserialize, Clone)]
+struct DiscordCommandOption {
+    name: String,
+    value: serde_json::Value,
+}
+
+#[derive(Debug, Deserialize, Clone)]
+struct DiscordMessage {
+    #[allow(dead_code)] // Part of API payload, currently unused
+    id: String,
+    content: String,
+    channel_id: String,
+    #[allow(dead_code)] // Part of API payload, currently unused
+    author: DiscordUser,
+}
+
+/// Metadata stored with emitted messages for response routing.
+#[derive(Debug, Serialize, Deserialize)]
+struct DiscordMessageMetadata {
+    /// Discord channel ID
+    channel_id: String,
+
+    /// Interaction ID for followups
+    interaction_id: String,
+
+    /// Interaction token for responding
+    token: String,
+
+    /// Application ID
+    application_id: String,
+
+    /// Thread ID (for forum threads)
+    thread_id: Option<String>,
+}
+
+struct DiscordChannel;
+
+impl Guest for DiscordChannel {
+    fn on_start(_config_json: String) -> Result<ChannelConfig, String> {
+        channel_host::log(channel_host::LogLevel::Info, "Discord channel starting");
+
+        Ok(ChannelConfig {
+            display_name: "Discord".to_string(),
+            http_endpoints: vec![HttpEndpointConfig {
+                path: "/webhook/discord".to_string(),
+                methods: vec!["POST".to_string()],
+                require_secret: true,
+            }],
+            poll: None,
+        })
+    }
+
+    fn on_http_request(req: IncomingHttpRequest) -> OutgoingHttpResponse {
+        let body_str = match std::str::from_utf8(&req.body) {
+            Ok(s) => s,
+            Err(_) => {
+                return json_response(400, serde_json::json!({"error": "Invalid UTF-8 body"}));
+            }
+        };
+
+        let interaction: DiscordInteraction = match serde_json::from_str(body_str) {
+            Ok(i) => i,
+            Err(e) => {
+                channel_host::log(
+                    channel_host::LogLevel::Error,
+                    &format!("Failed to parse Discord interaction: {}", e),
+                );
+                return json_response(400, serde_json::json!({"error": "Invalid interaction"}));
+            }
+        };
+
+        match interaction.interaction_type {
+            // Ping - Discord verification
+            1 => {
+                channel_host::log(channel_host::LogLevel::Info, "Responding to Discord ping");
+                json_response(200, serde_json::json!({"type": 1}))
+            }
+
+            // Application Command (slash command)
+            2 => {
+                handle_slash_command(&interaction);
+                json_response(
+                    200,
+                    serde_json::json!({
+                        "type": 5,
+                        "data": {
+                            "content": "🤔 Thinking..."
+                        }
+                    }),
+                )
+            }
+
+            // Message Component (buttons, selects)
+            3 => {
+                if let Some(ref message) = interaction.message {
+                    handle_message_component(&interaction, message);
+                }
+                json_response(200, serde_json::json!({"type": 6}))
+            }
+
+            _ => {
+                channel_host::log(
+                    channel_host::LogLevel::Warn,
+                    &format!(
+                        "Unknown Discord interaction type: {}",
+                        interaction.interaction_type
+                    ),
+                );
+                json_response(200, serde_json::json!({"type": 6}))
+            }
+        }
+    }
+
+    fn on_poll() {}
+
+    fn on_respond(response: AgentResponse) -> Result<(), String> {
+        let metadata: DiscordMessageMetadata = serde_json::from_str(&response.metadata_json)
+            .map_err(|e| format!("Failed to parse metadata: {}", e))?;
+
+        // Use webhook endpoint for followup
+        let url = format!(
+            "https://discord.com/api/v10/webhooks/{}/{}",
+            metadata.application_id, metadata.token
+        );
+
+        // Truncate content to 2000 characters to comply with Discord limits
+        let content = truncate_message(&response.content);
+
+        let mut payload = serde_json::json!({
+            "content": content,
+        });
+
+        // Check for embeds in metadata
+        if let Ok(meta_json) = serde_json::from_str::<serde_json::Value>(&response.metadata_json) {
+            if let Some(embeds) = meta_json.get("embeds") {
+                payload["embeds"] = embeds.clone();
+            }
+        }
+
+        let payload_bytes =
+            serde_json::to_vec(&payload).map_err(|e| format!("Failed to serialize: {}", e))?;
+
+        let headers = serde_json::json!({
+            "Content-Type": "application/json"
+        });
+
+        let result = channel_host::http_request(
+            "POST",
+            &url,
+            &headers.to_string(),
+            Some(&payload_bytes),
+            None,
+        );
+
+        match result {
+            Ok(http_response) => {
+                if http_response.status >= 200 && http_response.status < 300 {
+                    channel_host::log(channel_host::LogLevel::Debug, "Posted followup to Discord");
+                    Ok(())
+                } else {
+                    let body_str = String::from_utf8_lossy(&http_response.body);
+                    Err(format!(
+                        "Discord API error: {} - {}",
+                        http_response.status, body_str
+                    ))
+                }
+            }
+            Err(e) => Err(format!("HTTP request failed: {}", e)),
+        }
+    }
+
+    fn on_status(_update: StatusUpdate) {}
+
+    fn on_shutdown() {
+        channel_host::log(
+            channel_host::LogLevel::Info,
+            "Discord channel shutting down",
+        );
+    }
+}
+
+fn handle_slash_command(interaction: &DiscordInteraction) {
+    let user = interaction
+        .member
+        .as_ref()
+        .map(|m| &m.user)
+        .or(interaction.user.as_ref());
+    let user_id = user.map(|u| u.id.clone()).unwrap_or_default();
+    let user_name = user
+        .map(|u| {
+            u.global_name
+                .as_ref()
+                .filter(|s| !s.is_empty())
+                .unwrap_or(&u.username)
+                .clone()
+        })
+        .unwrap_or_default();
+
+    let channel_id = interaction.channel_id.clone().unwrap_or_default();
+
+    let command_name = interaction
+        .data
+        .as_ref()
+        .map(|d| d.name.clone())
+        .unwrap_or_default();
+    let options = interaction.data.as_ref().and_then(|d| d.options.clone());
+
+    let content = if let Some(opts) = options {
+        let opt_str = opts
+            .iter()
+            .map(|o| format!("{}: {}", o.name, o.value))
+            .collect::<Vec<_>>()
+            .join(", ");
+        format!("/{} {}", command_name, opt_str)
+    } else {
+        format!("/{}", command_name)
+    };
+
+    let metadata = DiscordMessageMetadata {
+        channel_id: channel_id.clone(),
+        interaction_id: interaction.id.clone(),
+        token: interaction.token.clone(),
+        application_id: interaction.application_id.clone(),
+        thread_id: None,
+    };
+
+    let metadata_json = match serde_json::to_string(&metadata) {
+        Ok(json) => json,
+        Err(e) => {
+            channel_host::log(
+                channel_host::LogLevel::Error,
+                &format!("Failed to serialize metadata: {}", e),
+            );
+            // Attempt to notify user of internal error
+            let url = format!(
+                "https://discord.com/api/v10/webhooks/{}/{}",
+                interaction.application_id, interaction.token
+            );
+            let payload = serde_json::json!({
+                "content": "❌ Internal Error: Failed to process command metadata.",
+                "flags": 64 // Ephemeral
+            });
+            let _ = channel_host::http_request(
+                "POST",
+                &url,
+                &serde_json::json!({"Content-Type": "application/json"}).to_string(),
+                Some(&serde_json::to_vec(&payload).unwrap_or_default()),
+                None,
+            );
+            return;
+        }
+    };
+
+    channel_host::emit_message(&EmittedMessage {
+        user_id,
+        user_name: Some(user_name),
+        content,
+        thread_id: None,
+        metadata_json,
+    });
+}
+
+fn handle_message_component(interaction: &DiscordInteraction, message: &DiscordMessage) {
+    // Check member first (for server contexts), then user (for DMs)
+    let user = interaction
+        .member
+        .as_ref()
+        .map(|m| &m.user)
+        .or(interaction.user.as_ref());
+    let user_id = user.map(|u| u.id.clone()).unwrap_or_default();
+    let user_name = user
+        .map(|u| {
+            u.global_name
+                .as_ref()
+                .filter(|s| !s.is_empty())
+                .unwrap_or(&u.username)
+                .clone()
+        })
+        .unwrap_or_default();
+
+    let channel_id = message.channel_id.clone();
+
+    let metadata = DiscordMessageMetadata {
+        channel_id: channel_id.clone(),
+        interaction_id: interaction.id.clone(),
+        token: interaction.token.clone(),
+        application_id: interaction.application_id.clone(),
+        thread_id: None,
+    };
+
+    let metadata_json = match serde_json::to_string(&metadata) {
+        Ok(json) => json,
+        Err(e) => {
+            channel_host::log(
+                channel_host::LogLevel::Error,
+                &format!("Failed to serialize metadata: {}", e),
+            );
+            return; // Don't emit message if metadata can't be serialized
+        }
+    };
+
+    channel_host::emit_message(&EmittedMessage {
+        user_id,
+        user_name: Some(user_name),
+        content: format!("[Button clicked] {}", message.content),
+        thread_id: None,
+        metadata_json,
+    });
+}
+
+fn json_response(status: u16, value: serde_json::Value) -> OutgoingHttpResponse {
+    let body = serde_json::to_vec(&value).unwrap_or_default();
+    let headers = serde_json::json!({"Content-Type": "application/json"});
+
+    OutgoingHttpResponse {
+        status,
+        headers_json: headers.to_string(),
+        body,
+    }
+}
+
+export!(DiscordChannel);
+
+fn truncate_message(content: &str) -> String {
+    if content.len() <= 2000 {
+        content.to_string()
+    } else {
+        let max_bytes = 1990;
+        let cutoff = content
+            .char_indices()
+            .map(|(i, c)| i + c.len_utf8())
+            .take_while(|&end| end <= max_bytes)
+            .last()
+            .unwrap_or(0);
+        let mut truncated = content[..cutoff].to_string();
+        truncated.push_str("\n... (truncated)");
+        truncated
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_truncate_message() {
+        let short = "Hello world";
+        assert_eq!(truncate_message(short), short);
+
+        let long = "a".repeat(2005);
+        let truncated = truncate_message(&long);
+        assert_eq!(truncated.len(), 2006); // 1990 + 16 chars suffix
+        assert!(truncated.ends_with("\n... (truncated)"));
+
+        // Test with multibyte characters (Euro sign is 3 bytes)
+        // 1000 chars * 3 bytes = 3000 bytes
+        let multi = "€".repeat(1000);
+        let truncated_multi = truncate_message(&multi);
+
+        // 1990 bytes limit. 1990 / 3 = 663 with remainder 1.
+        // Should truncate at 663 chars (1989 bytes).
+        // Suffix is 16 bytes. Total: 1989 + 16 = 2005 bytes.
+        assert!(truncated_multi.len() <= 2006);
+        assert!(truncated_multi.len() >= 2006 - 4); // Allow for max utf8 char width variance
+        assert!(truncated_multi.ends_with("\n... (truncated)"));
+
+        let content_part = &truncated_multi[..truncated_multi.len() - 16];
+        assert!(content_part.chars().all(|c| c == '€'));
+    }
+
+    #[test]
+    fn test_metadata_serialization() {
+        let metadata = DiscordMessageMetadata {
+            channel_id: "123".into(),
+            interaction_id: "456".into(),
+            token: "abc".into(),
+            application_id: "789".into(),
+            thread_id: None,
+        };
+        let json = serde_json::to_string(&metadata).unwrap();
+        let parsed: DiscordMessageMetadata = serde_json::from_str(&json).unwrap();
+        assert_eq!(parsed.channel_id, "123");
+        assert_eq!(parsed.interaction_id, "456");
+    }
+}

channels-src/slack/build.sh

@@ -30,7 +30,7 @@ if [ -f "$WASM_PATH" ]; then
     wasm-tools strip slack.wasm -o slack.wasm
 
     echo "Built: slack.wasm ($(du -h slack.wasm | cut -f1))"
-    echo "Copy slack.wasm and slack.capabilities.json to ~/.near-agent/channels/"
+    echo "Copy slack.wasm and slack.capabilities.json to ~/.ironclaw/channels/"
 else
     echo "Error: WASM output not found at $WASM_PATH"
     exit 1

channels-src/slack/src/lib.rs

@@ -108,7 +108,10 @@ struct SlackPostMessageResponse {
 #[derive(Debug, Deserialize)]
 struct SlackConfig {
     /// Name of secret containing signing secret (for verification by host).
+    /// Parsed from config for forward compatibility; not yet used in WASM
+    /// (host handles signature verification).
     #[serde(default = "default_signing_secret_name")]
+    #[allow(dead_code)]
     signing_secret_name: String,
 }
 
@@ -175,11 +178,7 @@ impl Guest for SlackChannel {
             // Actual event callback
             "event_callback" => {
                 if let Some(event) = event_wrapper.event {
-                    handle_slack_event(
-                        event,
-                        event_wrapper.team_id,
-                        event_wrapper.event_id,
-                    );
+                    handle_slack_event(event, event_wrapper.team_id, event_wrapper.event_id);
                 }
                 // Always respond 200 quickly to Slack (they have a 3s timeout)
                 json_response(200, serde_json::json!({"ok": true}))
@@ -230,6 +229,7 @@ impl Guest for SlackChannel {
             "https://slack.com/api/chat.postMessage",
             &headers.to_string(),
             Some(&payload_bytes),
+            None,
         );
 
         match result {
@@ -243,14 +243,15 @@ impl Guest for SlackChannel {
 
                 // Parse Slack response
                 let slack_response: SlackPostMessageResponse =
-                    serde_json::from_slice(&http_response.body).map_err(|e| {
-                        format!("Failed to parse Slack response: {}", e)
-                    })?;
+                    serde_json::from_slice(&http_response.body)
+                        .map_err(|e| format!("Failed to parse Slack response: {}", e))?;
 
                 if !slack_response.ok {
                     return Err(format!(
                         "Slack API error: {}",
-                        slack_response.error.unwrap_or_else(|| "unknown".to_string())
+                        slack_response
+                            .error
+                            .unwrap_or_else(|| "unknown".to_string())
                     ));
                 }
 
@@ -277,17 +278,16 @@ impl Guest for SlackChannel {
 }
 
 /// Handle a Slack event and emit message if applicable.
-fn handle_slack_event(
-    event: SlackEvent,
-    team_id: Option<String>,
-    _event_id: Option<String>,
-) {
+fn handle_slack_event(event: SlackEvent, team_id: Option<String>, _event_id: Option<String>) {
     match event.event_type.as_str() {
         // Direct mention of the bot
         "app_mention" => {
-            if let (Some(user), Some(channel), Some(text), Some(ts)) =
-                (event.user, event.channel.clone(), event.text, event.ts.clone())
-            {
+            if let (Some(user), Some(channel), Some(text), Some(ts)) = (
+                event.user,
+                event.channel.clone(),
+                event.text,
+                event.ts.clone(),
+            ) {
                 emit_message(user, text, channel, event.thread_ts.or(Some(ts)), team_id);
             }
         }
@@ -299,9 +299,12 @@ fn handle_slack_event(
                 return;
             }
 
-            if let (Some(user), Some(channel), Some(text), Some(ts)) =
-                (event.user, event.channel.clone(), event.text, event.ts.clone())
-            {
+            if let (Some(user), Some(channel), Some(text), Some(ts)) = (
+                event.user,
+                event.channel.clone(),
+                event.text,
+                event.ts.clone(),
+            ) {
                 // Only process DMs (channel IDs starting with D)
                 if channel.starts_with('D') {
                     emit_message(user, text, channel, event.thread_ts.or(Some(ts)), team_id);
@@ -335,8 +338,13 @@ fn emit_message(
         team_id,
     };
 
-    let metadata_json =
-        serde_json::to_string(&metadata).unwrap_or_else(|_| "{}".to_string());
+    let metadata_json = serde_json::to_string(&metadata).unwrap_or_else(|e| {
+        channel_host::log(
+            channel_host::LogLevel::Error,
+            &format!("Failed to serialize Slack metadata: {}", e),
+        );
+        "{}".to_string()
+    });
 
     // Strip @ mentions of the bot from the text for cleaner messages
     let cleaned_text = strip_bot_mention(&text);
@@ -364,7 +372,13 @@ fn strip_bot_mention(text: &str) -> String {
 
 /// Create a JSON HTTP response.
 fn json_response(status: u16, value: serde_json::Value) -> OutgoingHttpResponse {
-    let body = serde_json::to_vec(&value).unwrap_or_default();
+    let body = serde_json::to_vec(&value).unwrap_or_else(|e| {
+        channel_host::log(
+            channel_host::LogLevel::Error,
+            &format!("Failed to serialize JSON response: {}", e),
+        );
+        Vec::new()
+    });
     let headers = serde_json::json!({"Content-Type": "application/json"});
 
     OutgoingHttpResponse {

channels-src/telegram/build.sh

@@ -32,8 +32,8 @@ if [ -f "$WASM_PATH" ]; then
     echo "Built: telegram.wasm ($(du -h telegram.wasm | cut -f1))"
     echo ""
     echo "To install:"
-    echo "  mkdir -p ~/.near-agent/channels"
-    echo "  cp telegram.wasm telegram.capabilities.json ~/.near-agent/channels/"
+    echo "  mkdir -p ~/.ironclaw/channels"
+    echo "  cp telegram.wasm telegram.capabilities.json ~/.ironclaw/channels/"
     echo ""
     echo "Then add your bot token to secrets:"
     echo "  # Set TELEGRAM_BOT_TOKEN in your environment or secrets store"

channels-src/telegram/src/lib.rs

@@ -72,6 +72,10 @@ struct TelegramMessage {
     /// Message text.
     text: Option<String>,
 
+    /// Caption for media (photo, video, document, etc.).
+    #[serde(default)]
+    caption: Option<String>,
+
     /// Original message if this is a reply.
     reply_to_message: Option<Box<TelegramMessage>>,
 
@@ -160,6 +164,21 @@ const POLLING_STATE_PATH: &str = "state/last_update_id";
 /// Workspace path for persisting owner_id across WASM callbacks.
 const OWNER_ID_PATH: &str = "state/owner_id";
 
+/// Workspace path for persisting dm_policy across WASM callbacks.
+const DM_POLICY_PATH: &str = "state/dm_policy";
+
+/// Workspace path for persisting allow_from (JSON array) across WASM callbacks.
+const ALLOW_FROM_PATH: &str = "state/allow_from";
+
+/// Channel name for pairing store (used by pairing host APIs).
+const CHANNEL_NAME: &str = "telegram";
+
+/// Workspace path for persisting bot_username for mention detection in groups.
+const BOT_USERNAME_PATH: &str = "state/bot_username";
+
+/// Workspace path for persisting respond_to_all_group_messages flag.
+const RESPOND_TO_ALL_GROUP_PATH: &str = "state/respond_to_all_group_messages";
+
 // ============================================================================
 // Channel Metadata
 // ============================================================================
@@ -196,6 +215,14 @@ struct TelegramConfig {
     #[serde(default)]
     owner_id: Option<i64>,
 
+    /// DM policy: "pairing" (default), "allowlist", or "open".
+    #[serde(default)]
+    dm_policy: Option<String>,
+
+    /// Allowed sender IDs/usernames from config (merged with pairing-approved store).
+    #[serde(default)]
+    allow_from: Option<Vec<String>>,
+
     /// Whether to respond to all group messages (not just mentions).
     #[serde(default)]
     respond_to_all_group_messages: bool,
@@ -257,6 +284,24 @@ impl Guest for TelegramChannel {
             );
         }
 
+        // Persist dm_policy and allow_from for DM pairing in handle_message
+        let dm_policy = config.dm_policy.as_deref().unwrap_or("pairing").to_string();
+        let _ = channel_host::workspace_write(DM_POLICY_PATH, &dm_policy);
+
+        let allow_from_json = serde_json::to_string(&config.allow_from.unwrap_or_default())
+            .unwrap_or_else(|_| "[]".to_string());
+        let _ = channel_host::workspace_write(ALLOW_FROM_PATH, &allow_from_json);
+
+        // Persist bot_username and respond_to_all_group_messages for group handling
+        let _ = channel_host::workspace_write(
+            BOT_USERNAME_PATH,
+            &config.bot_username.unwrap_or_default(),
+        );
+        let _ = channel_host::workspace_write(
+            RESPOND_TO_ALL_GROUP_PATH,
+            &config.respond_to_all_group_messages.to_string(),
+        );
+
         // Mode is determined by whether the host injected a tunnel_url
         // If tunnel is configured, use webhooks. Otherwise, use polling.
         let webhook_mode = config.tunnel_url.is_some();
@@ -388,7 +433,9 @@ impl Guest for TelegramChannel {
 
         let headers = serde_json::json!({});
 
-        let result = channel_host::http_request("GET", &url, &headers.to_string(), None);
+        // 35s HTTP timeout outlives Telegram's 30s server-side long-poll
+        let result =
+            channel_host::http_request("GET", &url, &headers.to_string(), None, Some(35_000));
 
         match result {
             Ok(response) => {
@@ -461,72 +508,52 @@ impl Guest for TelegramChannel {
     }
 
     fn on_respond(response: AgentResponse) -> Result<(), String> {
-        // Parse metadata to get chat info
         let metadata: TelegramMessageMetadata = serde_json::from_str(&response.metadata_json)
             .map_err(|e| format!("Failed to parse metadata: {}", e))?;
 
-        // Build sendMessage payload
-        let mut payload = serde_json::json!({
-            "chat_id": metadata.chat_id,
-            "text": response.content,
-            "parse_mode": "Markdown",
-        });
-
-        // Reply to the original message for context
-        payload["reply_to_message_id"] = serde_json::Value::Number(metadata.message_id.into());
-
-        let payload_bytes = serde_json::to_vec(&payload)
-            .map_err(|e| format!("Failed to serialize payload: {}", e))?;
-
-        // Make HTTP request to Telegram API
-        // The bot token is injected into the URL by the host
-        let headers = serde_json::json!({
-            "Content-Type": "application/json"
-        });
-
-        let result = channel_host::http_request(
-            "POST",
-            "https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage",
-            &headers.to_string(),
-            Some(&payload_bytes),
+        // Try sending with Markdown first; fall back to plain text if Telegram
+        // can't parse the entities (e.g. model leaked <tool_call> with underscores).
+        let result = send_message(
+            metadata.chat_id,
+            &response.content,
+            metadata.message_id,
+            Some("Markdown"),
         );
 
         match result {
-            Ok(http_response) => {
-                if http_response.status != 200 {
-                    let body_str = String::from_utf8_lossy(&http_response.body);
-                    return Err(format!(
-                        "Telegram API returned status {}: {}",
-                        http_response.status, body_str
-                    ));
-                }
-
-                // Parse Telegram response
-                let api_response: TelegramApiResponse<SentMessage> =
-                    serde_json::from_slice(&http_response.body)
-                        .map_err(|e| format!("Failed to parse Telegram response: {}", e))?;
-
-                if !api_response.ok {
-                    return Err(format!(
-                        "Telegram API error: {}",
-                        api_response
-                            .description
-                            .unwrap_or_else(|| "unknown".to_string())
-                    ));
-                }
-
+            Ok(msg_id) => {
                 channel_host::log(
                     channel_host::LogLevel::Debug,
                     &format!(
                         "Sent message to chat {}: message_id={}",
-                        metadata.chat_id,
-                        api_response.result.map(|r| r.message_id).unwrap_or(0)
+                        metadata.chat_id, msg_id
                     ),
                 );
-
                 Ok(())
             }
-            Err(e) => Err(format!("HTTP request failed: {}", e)),
+            Err(SendError::ParseEntities(detail)) => {
+                channel_host::log(
+                    channel_host::LogLevel::Warn,
+                    &format!("Markdown parse failed ({}), retrying as plain text", detail),
+                );
+                let msg_id = send_message(
+                    metadata.chat_id,
+                    &response.content,
+                    metadata.message_id,
+                    None,
+                )
+                .map_err(|e| format!("Plain-text retry also failed: {}", e))?;
+
+                channel_host::log(
+                    channel_host::LogLevel::Debug,
+                    &format!(
+                        "Sent plain-text message to chat {}: message_id={}",
+                        metadata.chat_id, msg_id
+                    ),
+                );
+                Ok(())
+            }
+            Err(e) => Err(e.to_string()),
         }
     }
 
@@ -568,6 +595,7 @@ impl Guest for TelegramChannel {
             "https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendChatAction",
             &headers.to_string(),
             Some(&payload_bytes),
+            None,
         );
 
         if let Err(e) = result {
@@ -586,6 +614,101 @@ impl Guest for TelegramChannel {
     }
 }
 
+// ============================================================================
+// Send Message Helper
+// ============================================================================
+
+/// Errors from send_message, split so callers can match on parse-entity failures.
+enum SendError {
+    /// Telegram returned 400 with "can't parse entities" (Markdown issue).
+    ParseEntities(String),
+    /// Any other failure.
+    Other(String),
+}
+
+impl std::fmt::Display for SendError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            SendError::ParseEntities(detail) => write!(f, "parse entities error: {}", detail),
+            SendError::Other(msg) => write!(f, "{}", msg),
+        }
+    }
+}
+
+/// Send a message via the Telegram Bot API.
+///
+/// Returns the sent message_id on success. When `parse_mode` is set and
+/// Telegram returns a 400 "can't parse entities" error, returns
+/// `SendError::ParseEntities` so the caller can retry without formatting.
+fn send_message(
+    chat_id: i64,
+    text: &str,
+    reply_to_message_id: i64,
+    parse_mode: Option<&str>,
+) -> Result<i64, SendError> {
+    let mut payload = serde_json::json!({
+        "chat_id": chat_id,
+        "text": text,
+        "reply_to_message_id": reply_to_message_id,
+    });
+
+    if let Some(mode) = parse_mode {
+        payload["parse_mode"] = serde_json::Value::String(mode.to_string());
+    }
+
+    let payload_bytes = serde_json::to_vec(&payload)
+        .map_err(|e| SendError::Other(format!("Failed to serialize payload: {}", e)))?;
+
+    let headers = serde_json::json!({ "Content-Type": "application/json" });
+
+    let result = channel_host::http_request(
+        "POST",
+        "https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage",
+        &headers.to_string(),
+        Some(&payload_bytes),
+        None,
+    );
+
+    match result {
+        Ok(http_response) => {
+            if http_response.status == 400 {
+                let body_str = String::from_utf8_lossy(&http_response.body);
+                if body_str.contains("can't parse entities") {
+                    return Err(SendError::ParseEntities(body_str.to_string()));
+                }
+                return Err(SendError::Other(format!(
+                    "Telegram API returned 400: {}",
+                    body_str
+                )));
+            }
+
+            if http_response.status != 200 {
+                let body_str = String::from_utf8_lossy(&http_response.body);
+                return Err(SendError::Other(format!(
+                    "Telegram API returned status {}: {}",
+                    http_response.status, body_str
+                )));
+            }
+
+            let api_response: TelegramApiResponse<SentMessage> =
+                serde_json::from_slice(&http_response.body)
+                    .map_err(|e| SendError::Other(format!("Failed to parse response: {}", e)))?;
+
+            if !api_response.ok {
+                return Err(SendError::Other(format!(
+                    "Telegram API error: {}",
+                    api_response
+                        .description
+                        .unwrap_or_else(|| "unknown".to_string())
+                )));
+            }
+
+            Ok(api_response.result.map(|r| r.message_id).unwrap_or(0))
+        }
+        Err(e) => Err(SendError::Other(format!("HTTP request failed: {}", e))),
+    }
+}
+
 // ============================================================================
 // Webhook Management
 // ============================================================================
@@ -604,6 +727,7 @@ fn delete_webhook() -> Result<(), String> {
         "https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/deleteWebhook",
         &headers.to_string(),
         None,
+        None,
     );
 
     match result {
@@ -666,6 +790,7 @@ fn register_webhook(tunnel_url: &str, webhook_secret: Option<&str>) -> Result<()
         "https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/setWebhook",
         &headers.to_string(),
         Some(&body_bytes),
+        None,
     );
 
     match result {
@@ -700,6 +825,48 @@ fn register_webhook(tunnel_url: &str, webhook_secret: Option<&str>) -> Result<()
     }
 }
 
+// ============================================================================
+// Pairing Reply
+// ============================================================================
+
+/// Send a pairing code message to a chat. Used when an unknown user DMs the bot.
+fn send_pairing_reply(chat_id: i64, code: &str) -> Result<(), String> {
+    let payload = serde_json::json!({
+        "chat_id": chat_id,
+        "text": format!(
+            "To pair with this bot, run: `ironclaw pairing approve telegram {}`",
+            code
+        ),
+        "parse_mode": "Markdown",
+    });
+
+    let payload_bytes =
+        serde_json::to_vec(&payload).map_err(|e| format!("Failed to serialize payload: {}", e))?;
+
+    let headers = serde_json::json!({
+        "Content-Type": "application/json"
+    });
+
+    let result = channel_host::http_request(
+        "POST",
+        "https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage",
+        &headers.to_string(),
+        Some(&payload_bytes),
+        None,
+    );
+
+    match result {
+        Ok(response) => {
+            if response.status != 200 {
+                let body_str = String::from_utf8_lossy(&response.body);
+                return Err(format!("HTTP {}: {}", response.status, body_str));
+            }
+            Ok(())
+        }
+        Err(e) => Err(format!("HTTP request failed: {}", e)),
+    }
+}
+
 // ============================================================================
 // Update Handling
 // ============================================================================
@@ -719,11 +886,16 @@ fn handle_update(update: TelegramUpdate) {
 
 /// Process a single message.
 fn handle_message(message: TelegramMessage) {
-    // Skip messages without text
-    let text = match message.text {
-        Some(t) if !t.is_empty() => t,
-        _ => return,
-    };
+    // Use text or caption (for media messages)
+    let content = message
+        .text
+        .filter(|t| !t.is_empty())
+        .or_else(|| message.caption.filter(|c| !c.is_empty()))
+        .unwrap_or_default();
+
+    if content.is_empty() {
+        return;
+    }
 
     // Skip messages without a sender (channel posts)
     let from = match message.from {
@@ -736,41 +908,105 @@ fn handle_message(message: TelegramMessage) {
         return;
     }
 
-    // Owner validation: silently drop messages from non-owner users
-    if let Some(owner_id_str) = channel_host::workspace_read(OWNER_ID_PATH) {
-        if !owner_id_str.is_empty() {
-            if let Ok(owner_id) = owner_id_str.parse::<i64>() {
-                if from.id != owner_id {
-                    channel_host::log(
-                        channel_host::LogLevel::Debug,
-                        &format!(
-                            "Dropping message from non-owner user {} (owner: {})",
-                            from.id, owner_id
-                        ),
-                    );
-                    return;
+    let is_private = message.chat.chat_type == "private";
+
+    // Owner validation: when owner_id is set, only that user can message
+    let owner_id_str = channel_host::workspace_read(OWNER_ID_PATH).filter(|s| !s.is_empty());
+
+    if let Some(ref id_str) = owner_id_str {
+        if let Ok(owner_id) = id_str.parse::<i64>() {
+            if from.id != owner_id {
+                channel_host::log(
+                    channel_host::LogLevel::Debug,
+                    &format!(
+                        "Dropping message from non-owner user {} (owner: {})",
+                        from.id, owner_id
+                    ),
+                );
+                return;
+            }
+        }
+    } else if is_private {
+        // No owner_id: apply dm_policy for private chats
+        let dm_policy =
+            channel_host::workspace_read(DM_POLICY_PATH).unwrap_or_else(|| "pairing".to_string());
+
+        if dm_policy != "open" {
+            // Build effective allow list: config allow_from + pairing store
+            let mut allowed: Vec<String> = channel_host::workspace_read(ALLOW_FROM_PATH)
+                .and_then(|s| serde_json::from_str(&s).ok())
+                .unwrap_or_default();
+
+            if let Ok(store_allowed) = channel_host::pairing_read_allow_from(CHANNEL_NAME) {
+                allowed.extend(store_allowed);
+            }
+
+            let id_str = from.id.to_string();
+            let username_opt = from.username.as_deref();
+            let is_allowed = allowed.contains(&"*".to_string())
+                || allowed.contains(&id_str)
+                || username_opt.map_or(false, |u| allowed.contains(&u.to_string()));
+
+            if !is_allowed {
+                if dm_policy == "pairing" {
+                    // Upsert pairing request and send reply
+                    let meta = serde_json::json!({
+                        "chat_id": message.chat.id,
+                        "user_id": from.id,
+                        "username": username_opt,
+                    })
+                    .to_string();
+
+                    match channel_host::pairing_upsert_request(CHANNEL_NAME, &id_str, &meta) {
+                        Ok(result) => {
+                            channel_host::log(
+                                channel_host::LogLevel::Info,
+                                &format!(
+                                    "Pairing request for user {} (chat {}): code {}",
+                                    from.id, message.chat.id, result.code
+                                ),
+                            );
+                            if result.created {
+                                let _ = send_pairing_reply(message.chat.id, &result.code);
+                            }
+                        }
+                        Err(e) => {
+                            channel_host::log(
+                                channel_host::LogLevel::Error,
+                                &format!("Pairing upsert failed: {}", e),
+                            );
+                        }
+                    }
                 }
+                return;
             }
         }
     }
 
-    let is_private = message.chat.chat_type == "private";
-
-    // For group chats, check if the bot was mentioned
-    // TODO: Read bot_username from config and check mentions
-    // For now, process all messages in private chats and groups
+    // For group chats, only respond if bot was mentioned or respond_to_all is enabled
     if !is_private {
-        // In groups, only respond if there's a bot mention or command
-        // This is a simplified check - proper implementation would use entities
-        let has_command = text.starts_with('/');
-        let has_mention = text.contains('@');
+        let respond_to_all = channel_host::workspace_read(RESPOND_TO_ALL_GROUP_PATH)
+            .as_deref()
+            .unwrap_or("false")
+            == "true";
 
-        if !has_command && !has_mention {
-            channel_host::log(
-                channel_host::LogLevel::Debug,
-                &format!("Ignoring group message without mention: {}", text),
-            );
-            return;
+        if !respond_to_all {
+            let has_command = content.starts_with('/');
+            let bot_username = channel_host::workspace_read(BOT_USERNAME_PATH).unwrap_or_default();
+            let has_bot_mention = if bot_username.is_empty() {
+                content.contains('@')
+            } else {
+                let mention = format!("@{}", bot_username);
+                content.to_lowercase().contains(&mention.to_lowercase())
+            };
+
+            if !has_command && !has_bot_mention {
+                channel_host::log(
+                    channel_host::LogLevel::Debug,
+                    &format!("Ignoring group message without mention: {}", content),
+                );
+                return;
+            }
         }
     }
 
@@ -792,17 +1028,30 @@ fn handle_message(message: TelegramMessage) {
     let metadata_json = serde_json::to_string(&metadata).unwrap_or_else(|_| "{}".to_string());
 
     // Clean the message text (strip bot mentions and commands)
-    let cleaned_text = clean_message_text(&text);
+    let bot_username = channel_host::workspace_read(BOT_USERNAME_PATH).unwrap_or_default();
+    let cleaned_text = clean_message_text(
+        &content,
+        if bot_username.is_empty() {
+            None
+        } else {
+            Some(bot_username.as_str())
+        },
+    );
 
-    if cleaned_text.is_empty() {
+    // For /start with no args, emit placeholder so agent can respond with welcome
+    let content_to_emit = if cleaned_text.is_empty() && content.trim().starts_with('/') {
+        "[User started the bot]".to_string()
+    } else if cleaned_text.is_empty() {
         return;
-    }
+    } else {
+        cleaned_text
+    };
 
     // Emit the message to the agent
     channel_host::emit_message(&EmittedMessage {
         user_id: from.id.to_string(),
         user_name: Some(user_name),
-        content: cleaned_text,
+        content: content_to_emit,
         thread_id: None, // Telegram doesn't have threads in the same way
         metadata_json,
     });
@@ -817,7 +1066,8 @@ fn handle_message(message: TelegramMessage) {
 }
 
 /// Clean message text by removing bot commands and @mentions at the start.
-fn clean_message_text(text: &str) -> String {
+/// When bot_username is set, only strips that specific mention; otherwise strips any leading @mention.
+fn clean_message_text(text: &str, bot_username: Option<&str>) -> String {
     let mut result = text.trim().to_string();
 
     // Remove leading /command
@@ -832,11 +1082,30 @@ fn clean_message_text(text: &str) -> String {
 
     // Remove leading @mention
     if result.starts_with('@') {
-        if let Some(space_idx) = result.find(' ') {
-            result = result[space_idx..].trim_start().to_string();
+        if let Some(bot) = bot_username {
+            let mention = format!("@{}", bot);
+            let mention_lower = mention.to_lowercase();
+            let result_lower = result.to_lowercase();
+            if result_lower.starts_with(&mention_lower) {
+                let rest = result[mention.len()..].trim_start();
+                if rest.is_empty() {
+                    return String::new();
+                }
+                result = rest.to_string();
+            } else if let Some(space_idx) = result.find(' ') {
+                // Different leading @mention - only strip if it's the bot
+                let first_word = &result[..space_idx];
+                if first_word.eq_ignore_ascii_case(&mention) {
+                    result = result[space_idx..].trim_start().to_string();
+                }
+            }
         } else {
-            // Just a mention with no text
-            return String::new();
+            // No bot_username: strip any leading @mention
+            if let Some(space_idx) = result.find(' ') {
+                result = result[space_idx..].trim_start().to_string();
+            } else {
+                return String::new();
+            }
         }
     }
 
@@ -872,12 +1141,22 @@ mod tests {
 
     #[test]
     fn test_clean_message_text() {
-        assert_eq!(clean_message_text("/start hello"), "hello");
-        assert_eq!(clean_message_text("@bot hello world"), "hello world");
-        assert_eq!(clean_message_text("/start"), "");
-        assert_eq!(clean_message_text("@botname"), "");
-        assert_eq!(clean_message_text("just text"), "just text");
-        assert_eq!(clean_message_text("  spaced  "), "spaced");
+        // Without bot_username: strips any leading @mention
+        assert_eq!(clean_message_text("/start hello", None), "hello");
+        assert_eq!(clean_message_text("@bot hello world", None), "hello world");
+        assert_eq!(clean_message_text("/start", None), "");
+        assert_eq!(clean_message_text("@botname", None), "");
+        assert_eq!(clean_message_text("just text", None), "just text");
+        assert_eq!(clean_message_text("  spaced  ", None), "spaced");
+
+        // With bot_username: only strips @MyBot, not @alice
+        assert_eq!(clean_message_text("@MyBot hello", Some("MyBot")), "hello");
+        assert_eq!(clean_message_text("@mybot hi", Some("MyBot")), "hi");
+        assert_eq!(
+            clean_message_text("@alice hello", Some("MyBot")),
+            "@alice hello"
+        );
+        assert_eq!(clean_message_text("@MyBot", Some("MyBot")), "");
     }
 
     #[test]
@@ -945,4 +1224,17 @@ mod tests {
         assert_eq!(from.id, 789);
         assert_eq!(from.first_name, "John");
     }
+
+    #[test]
+    fn test_parse_message_with_caption() {
+        let json = r#"{
+            "message_id": 1,
+            "from": {"id": 1, "is_bot": false, "first_name": "A"},
+            "chat": {"id": 1, "type": "private"},
+            "caption": "What's in this image?"
+        }"#;
+        let msg: TelegramMessage = serde_json::from_str(json).unwrap();
+        assert_eq!(msg.text, None);
+        assert_eq!(msg.caption.as_deref(), Some("What's in this image?"));
+    }
 }

channels-src/telegram/telegram.capabilities.json

@@ -1,43 +1 @@
-{
-  "type": "channel",
-  "name": "telegram",
-  "description": "Telegram Bot API channel for receiving and responding to Telegram messages",
-  "capabilities": {
-    "http": {
-      "allowlist": [
-        { "host": "api.telegram.org", "path_prefix": "/bot" }
-      ],
-      "credentials": {
-        "telegram_bot": {
-          "secret_name": "telegram_bot_token",
-          "location": { "type": "url_path", "placeholder": "{TELEGRAM_BOT_TOKEN}" },
-          "host_patterns": ["api.telegram.org"]
-        }
-      },
-      "rate_limit": {
-        "requests_per_minute": 30,
-        "requests_per_hour": 1000
-      }
-    },
-    "secrets": {
-      "allowed_names": ["telegram_*"]
-    },
-    "channel": {
-      "allowed_paths": ["/webhook/telegram"],
-      "allow_polling": true,
-      "min_poll_interval_ms": 30000,
-      "workspace_prefix": "channels/telegram/",
-      "emit_rate_limit": {
-        "messages_per_minute": 100,
-        "messages_per_hour": 5000
-      }
-    }
-  },
-  "config": {
-    "bot_username": null,
-    "owner_id": null,
-    "respond_to_all_group_messages": false,
-    "polling_enabled": false,
-    "poll_interval_ms": 30000
-  }
-}
+{"type":"channel","name":"telegram","description":"Telegram Bot API channel for receiving and responding to Telegram messages","capabilities":{"http":{"allowlist":[{"host":"api.telegram.org","path_prefix":"/bot"}],"credentials":{"telegram_bot":{"secret_name":"telegram_bot_token","location":{"type":"url_path","placeholder":"{TELEGRAM_BOT_TOKEN}"},"host_patterns":["api.telegram.org"]}},"rate_limit":{"requests_per_minute":30,"requests_per_hour":1000}},"secrets":{"allowed_names":["telegram_*"]},"channel":{"allowed_paths":["/webhook/telegram"],"allow_polling":true,"min_poll_interval_ms":30000,"workspace_prefix":"channels/telegram/","emit_rate_limit":{"messages_per_minute":100,"messages_per_hour":5000}}},"config":{"bot_username":null,"owner_id":null,"respond_to_all_group_messages":false,"polling_enabled":false,"poll_interval_ms":30000,"dm_policy":"pairing","allow_from":[]}}

channels-src/whatsapp/src/lib.rs

@@ -254,10 +254,19 @@ struct WhatsAppChannel;
 
 impl Guest for WhatsAppChannel {
     fn on_start(config_json: String) -> Result<ChannelConfig, String> {
-        let config: WhatsAppConfig = serde_json::from_str(&config_json).unwrap_or(WhatsAppConfig {
-            api_version: default_api_version(),
-            reply_to_message: default_reply_to_message(),
-        });
+        let config: WhatsAppConfig = match serde_json::from_str(&config_json) {
+            Ok(c) => c,
+            Err(e) => {
+                channel_host::log(
+                    channel_host::LogLevel::Warn,
+                    &format!("Failed to parse WhatsApp config, using defaults: {}", e),
+                );
+                WhatsAppConfig {
+                    api_version: default_api_version(),
+                    reply_to_message: default_reply_to_message(),
+                }
+            }
+        };
 
         channel_host::log(
             channel_host::LogLevel::Info,
@@ -267,6 +276,9 @@ impl Guest for WhatsAppChannel {
             ),
         );
 
+        // Persist api_version in workspace so on_respond() can read it
+        let _ = channel_host::workspace_write("channels/whatsapp/api_version", &config.api_version);
+
         // WhatsApp Cloud API is webhook-only, no polling available
         Ok(ChannelConfig {
             display_name: "WhatsApp".to_string(),
@@ -327,11 +339,16 @@ impl Guest for WhatsAppChannel {
         let metadata: WhatsAppMessageMetadata = serde_json::from_str(&response.metadata_json)
             .map_err(|e| format!("Failed to parse metadata: {}", e))?;
 
+        // Read api_version from workspace (set during on_start), fallback to default
+        let api_version = channel_host::workspace_read("channels/whatsapp/api_version")
+            .filter(|s| !s.is_empty())
+            .unwrap_or_else(|| "v18.0".to_string());
+
         // Build WhatsApp API URL with token placeholder
         // Host will replace {WHATSAPP_ACCESS_TOKEN} with actual token in Authorization header
         let api_url = format!(
-            "https://graph.facebook.com/v18.0/{}/messages",
-            metadata.phone_number_id
+            "https://graph.facebook.com/{}/{}/messages",
+            api_version, metadata.phone_number_id
         );
 
         // Build sendMessage payload
@@ -361,6 +378,7 @@ impl Guest for WhatsAppChannel {
             &api_url,
             &headers.to_string(),
             Some(&payload_bytes),
+            None,
         );
 
         match result {

deploy/cloud-sql-proxy.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Cloud SQL Auth Proxy
+After=network.target
+
+[Service]
+Type=simple
+DynamicUser=yes
+ExecStart=/usr/local/bin/cloud-sql-proxy ironclaw-prod:us-central1:ironclaw-db --port=5432
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

deploy/env.example

@@ -0,0 +1,27 @@
+# WARNING: Replace all CHANGE_ME values before deploying.
+# Do not use placeholder passwords in production.
+DATABASE_URL=postgres://ironclaw:CHANGE_ME@localhost:5432/ironclaw
+
+# NEAR AI
+NEARAI_SESSION_TOKEN=CHANGE_ME
+NEARAI_MODEL=claude-3-5-sonnet-20241022
+NEARAI_BASE_URL=https://cloud-api.near.ai
+NEARAI_AUTH_URL=https://private.near.ai
+NEARAI_API_MODE=chat_completions
+
+# Agent
+AGENT_NAME=ironclaw
+CLI_ENABLED=false
+
+# Web Gateway
+GATEWAY_ENABLED=true
+# 0.0.0.0 binds to all interfaces (required for Docker --network=host).
+# Use 127.0.0.1 if running outside Docker or for local-only access.
+GATEWAY_HOST=0.0.0.0
+GATEWAY_PORT=3000
+GATEWAY_AUTH_TOKEN=CHANGE_ME
+
+# Disabled for initial deploy
+SANDBOX_ENABLED=false
+HEARTBEAT_ENABLED=false
+EMBEDDING_ENABLED=false

deploy/ironclaw.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=IronClaw AI Assistant
+After=cloud-sql-proxy.service docker.service
+Requires=cloud-sql-proxy.service
+
+[Service]
+Type=simple
+ExecStartPre=/usr/bin/docker pull us-central1-docker.pkg.dev/ironclaw-prod/ironclaw/agent:latest
+ExecStart=/usr/bin/docker run --rm \
+  --name ironclaw \
+  --env-file /opt/ironclaw/.env \
+  --network=host \
+  us-central1-docker.pkg.dev/ironclaw-prod/ironclaw/agent:latest \
+  --no-onboard
+ExecStop=/usr/bin/docker stop ironclaw
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

deploy/setup.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# VM bootstrap script for IronClaw on GCP Compute Engine.
+#
+# Run on a fresh Debian 12 VM after SSH:
+#   sudo bash setup.sh
+#
+# Prerequisites:
+#   - VM has the ironclaw-vm service account attached
+#   - Cloud SQL Auth Proxy accessible via IAM
+#   - Artifact Registry image pushed
+
+set -euo pipefail
+
+# Must run as root
+if [ "$(id -u)" -ne 0 ]; then
+  echo "ERROR: This script must be run as root (sudo bash setup.sh)"
+  exit 1
+fi
+
+echo "==> Installing Docker"
+apt-get update
+apt-get install -y docker.io
+systemctl enable docker
+systemctl start docker
+
+echo "==> Installing Cloud SQL Auth Proxy"
+curl -fsSL -o /usr/local/bin/cloud-sql-proxy \
+  https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.14.3/cloud-sql-proxy.linux.amd64
+chmod +x /usr/local/bin/cloud-sql-proxy
+
+echo "==> Installing systemd services"
+cp /tmp/deploy/cloud-sql-proxy.service /etc/systemd/system/
+cp /tmp/deploy/ironclaw.service /etc/systemd/system/
+systemctl daemon-reload
+
+echo "==> Starting Cloud SQL Auth Proxy"
+systemctl enable cloud-sql-proxy
+systemctl start cloud-sql-proxy
+
+echo "==> Configuring Docker registry auth"
+# The VM service account provides Artifact Registry access
+gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+echo "==> Creating config directory"
+# Owned by root, readable only by root. Docker reads --env-file as root
+# before dropping to uid 1000 (ironclaw) inside the container.
+mkdir -p /opt/ironclaw
+chmod 700 /opt/ironclaw
+
+if [ ! -f /opt/ironclaw/.env ]; then
+  echo "WARNING: /opt/ironclaw/.env does not exist."
+  echo "Create it with your configuration before starting IronClaw."
+  echo "See deploy/env.example for the required variables."
+  echo ""
+  echo "Then run: systemctl enable ironclaw && systemctl start ironclaw"
+else
+  chmod 600 /opt/ironclaw/.env
+  echo "==> Starting IronClaw"
+  systemctl enable ironclaw
+  systemctl start ironclaw
+fi
+
+echo "==> Setup complete"
+echo ""
+echo "Verify with:"
+echo "  systemctl status cloud-sql-proxy"
+echo "  systemctl status ironclaw"
+echo "  docker logs ironclaw"

docker-compose.yml

@@ -0,0 +1,20 @@
+# Local development only — do NOT use these credentials in production.
+services:
+  postgres:
+    image: pgvector/pgvector:pg16
+    ports:
+      - "5432:5432"
+    environment:
+      POSTGRES_DB: ironclaw
+      POSTGRES_USER: ironclaw
+      POSTGRES_PASSWORD: ironclaw  # dev-only, change for any non-local deployment
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ironclaw"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+
+volumes:
+  pgdata:

docs/BUILDING_CHANNELS.md

@@ -246,13 +246,46 @@ Create `my-channel.capabilities.json`:
 
 ## Building and Deploying
 
+### Supply Chain Security: No Committed Binaries
+
+**Do not commit compiled WASM binaries.** They are a supply chain risk — the binary in a PR may not match the source. IronClaw builds channels from source:
+
+- `cargo build` automatically builds `telegram.wasm` via `build.rs`
+- The built binary is in `.gitignore` and is not committed
+- CI should run `cargo build` (or `./scripts/build-all.sh`) to produce releases
+
+**Reproducible build:**
+```bash
+cargo build --release
+```
+
+Prerequisites: `rustup target add wasm32-wasip2`, `cargo install wasm-tools` (optional; fallback copies raw WASM if unavailable).
+
+### Telegram Channel (Manual Build)
+
+```bash
+# Add WASM target if needed
+rustup target add wasm32-wasip2
+
+# Build Telegram channel
+./channels-src/telegram/build.sh
+
+# Install (or use ironclaw onboard to install bundled channel)
+mkdir -p ~/.ironclaw/channels
+cp channels-src/telegram/telegram.wasm channels-src/telegram/telegram.capabilities.json ~/.ironclaw/channels/
+```
+
+**Note**: The main IronClaw binary bundles `telegram.wasm` via `include_bytes!`. When modifying the Telegram channel source, run `./channels-src/telegram/build.sh` **before** building the main crate, so the updated WASM is included.
+
+### Other Channels
+
 ```bash
 # Build the WASM component
-cd channels/my-channel
-cargo component build --release
+cd channels-src/my-channel
+cargo build --release --target wasm32-wasip2
 
 # Deploy to ~/.ironclaw/channels/
-cp target/wasm32-wasip1/release/my_channel.wasm ~/.ironclaw/channels/my-channel.wasm
+cp target/wasm32-wasip2/release/my_channel.wasm ~/.ironclaw/channels/my-channel.wasm
 cp my-channel.capabilities.json ~/.ironclaw/channels/
 ```
 

docs/TELEGRAM_SETUP.md

@@ -0,0 +1,135 @@
+# Telegram Channel Setup
+
+This guide covers configuring the Telegram channel for IronClaw, including DM pairing for access control.
+
+## Overview
+
+The Telegram channel lets you interact with IronClaw via Telegram DMs and groups. It supports:
+
+- **Webhook mode** (recommended): Instant delivery via tunnel
+- **Polling mode**: No tunnel required; ~30s delay
+- **DM pairing**: Approve unknown users before they can message the agent
+- **Group mentions**: `@YourBot` or `/command` to trigger in groups
+
+## Prerequisites
+
+- IronClaw installed and configured (`ironclaw onboard`)
+- A Telegram bot token from [@BotFather](https://t.me/BotFather)
+
+## Quick Start
+
+### 1. Create a Bot
+
+1. Message [@BotFather](https://t.me/BotFather) on Telegram
+2. Send `/newbot` and follow the prompts
+3. Copy the bot token (e.g., `123456789:ABCdefGHIjklMNOpqrsTUVwxyz`)
+
+### 2. Configure via Setup Wizard
+
+```bash
+ironclaw onboard
+```
+
+When prompted, enable the Telegram channel and paste your bot token. The wizard will:
+
+- Validate the token
+- Optionally configure a webhook secret
+- Set up tunnel (if you want webhook mode)
+
+### 3. (Optional) Configure Tunnel for Webhooks
+
+For instant message delivery, expose your agent via a tunnel:
+
+```bash
+# ngrok
+ngrok http 8080
+
+# Cloudflare
+cloudflared tunnel --url http://localhost:8080
+```
+
+Set the tunnel URL in settings or via `TUNNEL_URL` env var. Without a tunnel, the channel uses polling (~30s delay).
+
+## DM Pairing
+
+When an unknown user DMs your bot, they receive a pairing code. You must approve them before they can message the agent.
+
+### Flow
+
+1. Unknown user sends a message to your bot
+2. Bot replies: `To pair with this bot, run: ironclaw pairing approve telegram ABC12345`
+3. You run: `ironclaw pairing approve telegram ABC12345`
+4. User is added to the allow list; future messages are delivered
+
+### Commands
+
+```bash
+# List pending pairing requests
+ironclaw pairing list telegram
+
+# List as JSON
+ironclaw pairing list telegram --json
+
+# Approve a user by code
+ironclaw pairing approve telegram ABC12345
+```
+
+### Configuration
+
+Edit `~/.ironclaw/channels/telegram.capabilities.json` (or the config injected by the host):
+
+| Option | Values | Default | Description |
+|--------|--------|---------|-------------|
+| `dm_policy` | `open`, `allowlist`, `pairing` | `pairing` | `open` = allow all; `allowlist` = config + approved only; `pairing` = allowlist + send pairing reply to unknown |
+| `allow_from` | `["user_id", "username", "*"]` | `[]` | Pre-approved IDs/usernames. `*` allows everyone. |
+| `owner_id` | Telegram user ID | `null` | When set, only this user can message (overrides dm_policy) |
+| `bot_username` | Bot username (no @) | `null` | Used for mention detection in groups; when set, only strips this mention from messages |
+| `respond_to_all_group_messages` | `true`/`false` | `false` | When true, respond to all group messages; when false, only @mentions and /commands |
+
+## Manual Installation
+
+If the channel isn't installed via the wizard:
+
+```bash
+# Build the Telegram channel (requires wasm32-wasip2 target)
+rustup target add wasm32-wasip2
+./channels-src/telegram/build.sh
+
+# Install
+mkdir -p ~/.ironclaw/channels
+cp channels-src/telegram/telegram.wasm channels-src/telegram/telegram.capabilities.json ~/.ironclaw/channels/
+```
+
+## Secrets
+
+The channel expects a secret named `telegram_bot_token`. Configure via:
+
+- **Setup wizard**: Saves to encrypted secrets store
+- **Environment**: `TELEGRAM_BOT_TOKEN=your_token`
+- **Secrets store**: `ironclaw` CLI (if available)
+
+## Webhook Secret (Optional)
+
+For webhook validation, set `telegram_webhook_secret` in secrets. Telegram will send `X-Telegram-Bot-Api-Secret-Token` with each request; the host validates it before forwarding.
+
+## Troubleshooting
+
+### Messages not delivered
+
+- **Polling mode**: Check logs for `getUpdates` errors. Ensure the bot token is valid.
+- **Webhook mode**: Verify tunnel is running and `TUNNEL_URL` is correct. Telegram requires HTTPS.
+
+### Pairing code not received
+
+- Verify the channel can send messages (HTTP allowlist includes `api.telegram.org`)
+- Check `dm_policy` is `pairing` (not `allowlist` which blocks without reply)
+
+### Group mentions not working
+
+- Set `bot_username` in config to your bot's username (e.g., `MyIronClawBot`)
+- Ensure the message contains `@YourBot` or starts with `/`
+
+### "Connection refused" when starting
+
+- For webhook mode: Start your tunnel before `ironclaw run`
+- For polling only: No tunnel needed; ignore tunnel-related warnings

examples/test_heartbeat.rs

@@ -0,0 +1,121 @@
+//! Standalone heartbeat test.
+//!
+//! Exercises the heartbeat system in isolation: connects to the real
+//! database, reads the real HEARTBEAT.md, calls the real LLM, and prints
+//! every step so you can see exactly where it breaks.
+//!
+//! Usage:
+//!   cargo run --example test_heartbeat
+
+use std::sync::Arc;
+
+use ironclaw::{
+    agent::HeartbeatRunner,
+    config::Config,
+    history::Store,
+    llm::{SessionConfig, create_llm_provider, create_session_manager},
+    workspace::Workspace,
+};
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    // Load .env and set up logging
+    let _ = dotenvy::dotenv();
+    tracing_subscriber::fmt()
+        .with_env_filter("ironclaw=debug")
+        .init();
+
+    println!("=== Heartbeat Integration Test ===\n");
+
+    // 1. Load config
+    let config = Config::from_env()
+        .await
+        .map_err(|e| anyhow::anyhow!("Config: {}", e))?;
+    println!("[1/6] Config loaded");
+    println!("  heartbeat.enabled = {}", config.heartbeat.enabled);
+    println!(
+        "  heartbeat.interval_secs = {}",
+        config.heartbeat.interval_secs
+    );
+    println!(
+        "  heartbeat.notify_channel = {:?}",
+        config.heartbeat.notify_channel
+    );
+    println!(
+        "  heartbeat.notify_user = {:?}",
+        config.heartbeat.notify_user
+    );
+
+    // 2. Connect to database
+    let store = Store::new(&config.database).await?;
+    store.run_migrations().await?;
+    println!("[2/6] Database connected");
+
+    // 3. Create workspace
+    let workspace = Arc::new(Workspace::new("default", store.pool()));
+    println!("[3/6] Workspace created");
+
+    // 4. Read HEARTBEAT.md
+    let checklist = workspace.heartbeat_checklist().await;
+    match &checklist {
+        Ok(Some(content)) => {
+            let preview: String = content.chars().take(200).collect();
+            println!("[4/6] HEARTBEAT.md found ({} chars)", content.len());
+            println!("  Preview: {}...", preview);
+        }
+        Ok(None) => {
+            println!("[4/6] HEARTBEAT.md is None (no file, no seed fallback)");
+            println!("  Heartbeat will return Skipped.");
+        }
+        Err(e) => {
+            println!("[4/6] HEARTBEAT.md read error: {}", e);
+        }
+    }
+
+    // Check if the checklist would be considered "effectively empty"
+    if let Ok(Some(_)) = checklist {
+        println!("  (Will verify via runner below)");
+    }
+
+    // 5. Create LLM provider
+    let session = create_session_manager(SessionConfig {
+        auth_base_url: config.llm.nearai.auth_base_url.clone(),
+        session_path: config.llm.nearai.session_path.clone(),
+    })
+    .await;
+    let llm = create_llm_provider(&config.llm, session)?;
+    println!("[5/6] LLM provider created (model: {})", llm.model_name());
+
+    // 6. Run heartbeat check
+    println!("[6/6] Running check_heartbeat()...\n");
+
+    let hb_config = ironclaw::agent::HeartbeatConfig::default();
+    let runner = HeartbeatRunner::new(hb_config, workspace, llm);
+
+    let result = runner.check_heartbeat().await;
+
+    println!("=== Result ===\n");
+    match &result {
+        ironclaw::agent::HeartbeatResult::Ok => {
+            println!("HeartbeatResult::Ok");
+            println!("  LLM responded HEARTBEAT_OK, nothing needs attention.");
+        }
+        ironclaw::agent::HeartbeatResult::NeedsAttention(msg) => {
+            println!("HeartbeatResult::NeedsAttention");
+            println!("  Message:\n{}", msg);
+        }
+        ironclaw::agent::HeartbeatResult::Skipped => {
+            println!("HeartbeatResult::Skipped");
+            println!("  No checklist found, or checklist was effectively empty.");
+            println!("  This means the HEARTBEAT.md either:");
+            println!("    - Does not exist in the workspace database");
+            println!("    - Contains only headers, comments, and empty checkboxes");
+        }
+        ironclaw::agent::HeartbeatResult::Failed(err) => {
+            println!("HeartbeatResult::Failed");
+            println!("  Error: {}", err);
+        }
+    }
+
+    Ok(())
+}

migrations/V4__sandbox_columns.sql

@@ -0,0 +1,10 @@
+-- Add project_dir and user_id columns for sandbox job tracking.
+-- user_id was previously hardcoded to "default" in the Rust layer;
+-- now it's persisted so we can filter per-user.
+
+ALTER TABLE agent_jobs ADD COLUMN IF NOT EXISTS project_dir TEXT;
+ALTER TABLE agent_jobs ADD COLUMN IF NOT EXISTS user_id TEXT NOT NULL DEFAULT 'default';
+
+CREATE INDEX IF NOT EXISTS idx_agent_jobs_source ON agent_jobs(source);
+CREATE INDEX IF NOT EXISTS idx_agent_jobs_user ON agent_jobs(user_id);
+CREATE INDEX IF NOT EXISTS idx_agent_jobs_created ON agent_jobs(created_at DESC);

migrations/V5__claude_code.sql

@@ -0,0 +1,14 @@
+-- Track which mode a sandbox job uses (worker vs claude_code).
+ALTER TABLE agent_jobs ADD COLUMN IF NOT EXISTS job_mode TEXT NOT NULL DEFAULT 'worker';
+
+-- Persist Claude Code streaming events so they survive restarts and can be
+-- loaded when the frontend opens a job detail view after the fact.
+CREATE TABLE IF NOT EXISTS claude_code_events (
+    id BIGSERIAL PRIMARY KEY,
+    job_id UUID NOT NULL REFERENCES agent_jobs(id),
+    event_type TEXT NOT NULL,
+    data JSONB NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_cc_events_job ON claude_code_events(job_id, id);

migrations/V6__routines.sql

@@ -0,0 +1,73 @@
+-- Routines: scheduled and reactive job system.
+--
+-- A routine is a named, persistent, user-owned task with a trigger and an action.
+-- Triggers fire independently (cron, event, webhook, manual) so only the
+-- relevant routine's prompt hits the LLM, not the whole checklist.
+
+CREATE TABLE routines (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    name TEXT NOT NULL,
+    description TEXT NOT NULL DEFAULT '',
+    user_id TEXT NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT true,
+
+    -- Trigger definition
+    trigger_type TEXT NOT NULL,          -- 'cron', 'event', 'webhook', 'manual'
+    trigger_config JSONB NOT NULL,       -- type-specific config (schedule, pattern, etc.)
+
+    -- Action definition
+    action_type TEXT NOT NULL,           -- 'lightweight', 'full_job'
+    action_config JSONB NOT NULL,        -- prompt, context_paths, max_tokens / title, max_iterations
+
+    -- Guardrails
+    cooldown_secs INTEGER NOT NULL DEFAULT 300,
+    max_concurrent INTEGER NOT NULL DEFAULT 1,
+    dedup_window_secs INTEGER,           -- NULL = no dedup
+
+    -- Notification preferences
+    notify_channel TEXT,                 -- NULL = use default
+    notify_user TEXT NOT NULL DEFAULT 'default',
+    notify_on_success BOOLEAN NOT NULL DEFAULT false,
+    notify_on_failure BOOLEAN NOT NULL DEFAULT true,
+    notify_on_attention BOOLEAN NOT NULL DEFAULT true,
+
+    -- Runtime state (updated by engine)
+    state JSONB NOT NULL DEFAULT '{}',
+    last_run_at TIMESTAMPTZ,
+    next_fire_at TIMESTAMPTZ,            -- pre-computed for cron triggers
+    run_count BIGINT NOT NULL DEFAULT 0,
+    consecutive_failures INTEGER NOT NULL DEFAULT 0,
+
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+
+    UNIQUE (user_id, name)
+);
+
+-- Fast lookup: "which cron routines need to fire right now?"
+CREATE INDEX idx_routines_next_fire
+    ON routines (next_fire_at)
+    WHERE enabled AND next_fire_at IS NOT NULL;
+
+-- Fast lookup: event triggers for a user
+CREATE INDEX idx_routines_event_triggers
+    ON routines (user_id)
+    WHERE enabled AND trigger_type = 'event';
+
+-- Audit log of individual routine executions.
+CREATE TABLE routine_runs (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    routine_id UUID NOT NULL REFERENCES routines(id) ON DELETE CASCADE,
+    trigger_type TEXT NOT NULL,
+    trigger_detail TEXT,                  -- e.g. matched message preview, cron expression
+    started_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    completed_at TIMESTAMPTZ,
+    status TEXT NOT NULL DEFAULT 'running',  -- running, ok, attention, failed
+    result_summary TEXT,
+    tokens_used INTEGER,
+    job_id UUID REFERENCES agent_jobs(id),   -- non-NULL for full_job runs
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX idx_routine_runs_routine ON routine_runs (routine_id);
+CREATE INDEX idx_routine_runs_status ON routine_runs (status) WHERE status = 'running';

migrations/V7__rename_events.sql

@@ -0,0 +1,3 @@
+-- Rename claude_code_events to job_events (generic for all sandbox job types).
+ALTER TABLE claude_code_events RENAME TO job_events;
+ALTER INDEX idx_cc_events_job RENAME TO idx_job_events_job;

migrations/V8__settings.sql

@@ -0,0 +1,16 @@
+-- Settings table: key-value store for all user configuration.
+--
+-- Replaces ~/.ironclaw/settings.json, session.json, and mcp-servers.json.
+-- Keys use dotted paths matching the existing Settings.get()/set() convention
+-- (e.g., "agent.name", "sandbox.enabled", "mcp_servers").
+-- One row per setting so individual values can be updated atomically.
+
+CREATE TABLE IF NOT EXISTS settings (
+    user_id    TEXT        NOT NULL,
+    key        TEXT        NOT NULL,
+    value      JSONB       NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (user_id, key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_settings_user ON settings (user_id);

release-plz.toml

@@ -0,0 +1,2 @@
+[workspace]
+git_release_enable = false

scripts/build-all.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Build IronClaw and all bundled channels.
+#
+# Run this before release or when channel sources have changed.
+# The main binary bundles telegram.wasm via include_bytes!; it must exist.
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+echo "Building bundled channels..."
+if [ -d "channels-src/telegram" ]; then
+    ./channels-src/telegram/build.sh
+fi
+
+echo ""
+echo "Building IronClaw..."
+cargo build --release
+
+echo ""
+echo "Done. Binary: target/release/ironclaw"

src/agent/heartbeat.rs

@@ -29,7 +29,7 @@ use std::time::Duration;
 use tokio::sync::mpsc;
 
 use crate::channels::OutgoingResponse;
-use crate::llm::{ChatMessage, CompletionRequest, LlmProvider};
+use crate::llm::{ChatMessage, CompletionRequest, FinishReason, LlmProvider};
 use crate::workspace::Workspace;
 
 /// Configuration for the heartbeat runner.
@@ -217,9 +217,26 @@ impl HeartbeatRunner {
             ]
         };
 
+        // Use the model's context_length to set max_tokens. The API returns
+        // the total context window; we cap output at half of that (the rest is
+        // the prompt) with a floor of 4096.
+        let max_tokens = match self.llm.model_metadata().await {
+            Ok(meta) => {
+                let from_api = meta.context_length.map(|ctx| ctx / 2).unwrap_or(4096);
+                from_api.max(4096)
+            }
+            Err(e) => {
+                tracing::warn!(
+                    "Could not fetch model metadata, using default max_tokens: {}",
+                    e
+                );
+                4096
+            }
+        };
+
         let request = CompletionRequest::new(messages)
-            .with_max_tokens(1024)
-            .with_temperature(0.3); // Lower temperature for more focused responses
+            .with_max_tokens(max_tokens)
+            .with_temperature(0.3);
 
         let response = match self.llm.complete(request).await {
             Ok(r) => r,
@@ -228,6 +245,20 @@ impl HeartbeatRunner {
 
         let content = response.content.trim();
 
+        // Guard against empty content. Reasoning models (e.g. GLM-4.7) may
+        // burn all output tokens on chain-of-thought and return content: null.
+        if content.is_empty() {
+            return if response.finish_reason == FinishReason::Length {
+                HeartbeatResult::Failed(
+                    "LLM response was truncated (finish_reason=length) with no content. \
+                     The model may have exhausted its token budget on reasoning."
+                        .to_string(),
+                )
+            } else {
+                HeartbeatResult::Failed("LLM returned empty content.".to_string())
+            };
+        }
+
         // Check if nothing needs attention
         if content == "HEARTBEAT_OK" || content.contains("HEARTBEAT_OK") {
             return HeartbeatResult::Ok;

src/agent/mod.rs

@@ -6,6 +6,7 @@
 //! - Tool invocation with safety
 //! - Self-repair for stuck jobs
 //! - Proactive heartbeat execution
+//! - Routine-based scheduled and reactive jobs
 //! - Turn-based session management with undo
 //! - Context compaction for long conversations
 
@@ -14,6 +15,8 @@ pub mod compaction;
 pub mod context_monitor;
 mod heartbeat;
 mod router;
+pub mod routine;
+pub mod routine_engine;
 mod scheduler;
 mod self_repair;
 pub mod session;
@@ -23,11 +26,14 @@ pub mod task;
 pub mod undo;
 pub mod worker;
 
+pub(crate) use agent_loop::truncate_for_preview;
 pub use agent_loop::{Agent, AgentDeps};
 pub use compaction::{CompactionResult, ContextCompactor};
 pub use context_monitor::{CompactionStrategy, ContextBreakdown, ContextMonitor};
 pub use heartbeat::{HeartbeatConfig, HeartbeatResult, HeartbeatRunner, spawn_heartbeat};
 pub use router::{MessageIntent, Router};
+pub use routine::{Routine, RoutineAction, RoutineRun, Trigger};
+pub use routine_engine::RoutineEngine;
 pub use scheduler::Scheduler;
 pub use self_repair::{BrokenTool, RepairResult, RepairTask, SelfRepair, StuckJob};
 pub use session::{PendingApproval, PendingAuth, Session, Thread, ThreadState, Turn, TurnState};

src/agent/routine.rs

@@ -0,0 +1,509 @@
+//! Core types for the routines system.
+//!
+//! A routine is a named, persistent, user-owned task with a trigger and an action.
+//! Each routine fires independently when its trigger condition is met, with only
+//! that routine's prompt and context sent to the LLM.
+//!
+//! ```text
+//! ┌──────────┐     ┌─────────┐     ┌──────────────────┐
+//! │  Trigger  │────▶│ Engine  │────▶│  Execution Mode  │
+//! │ cron/event│     │guardrail│     │lightweight│full_job│
+//! │ webhook   │     │ check   │     └──────────────────┘
+//! │ manual    │     └─────────┘              │
+//! └──────────┘                               ▼
+//!                                     ┌──────────────┐
+//!                                     │  Notify user │
+//!                                     │  if needed   │
+//!                                     └──────────────┘
+//! ```
+
+use std::collections::hash_map::DefaultHasher;
+use std::hash::{Hash, Hasher};
+use std::str::FromStr;
+use std::time::Duration;
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+/// A routine is a named, persistent, user-owned task with a trigger and an action.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Routine {
+    pub id: Uuid,
+    pub name: String,
+    pub description: String,
+    pub user_id: String,
+    pub enabled: bool,
+    pub trigger: Trigger,
+    pub action: RoutineAction,
+    pub guardrails: RoutineGuardrails,
+    pub notify: NotifyConfig,
+
+    // Runtime state (DB-managed)
+    pub last_run_at: Option<DateTime<Utc>>,
+    pub next_fire_at: Option<DateTime<Utc>>,
+    pub run_count: u64,
+    pub consecutive_failures: u32,
+    pub state: serde_json::Value,
+
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+}
+
+/// When a routine should fire.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum Trigger {
+    /// Fire on a cron schedule (e.g. "0 9 * * MON-FRI" or "every 2h").
+    Cron { schedule: String },
+    /// Fire when a channel message matches a pattern.
+    Event {
+        /// Optional channel filter (e.g. "telegram", "slack").
+        channel: Option<String>,
+        /// Regex pattern to match against message content.
+        pattern: String,
+    },
+    /// Fire on incoming webhook POST to /hooks/routine/{id}.
+    Webhook {
+        /// Optional webhook path suffix (defaults to routine id).
+        path: Option<String>,
+        /// Optional shared secret for HMAC validation.
+        secret: Option<String>,
+    },
+    /// Only fires via tool call or CLI.
+    Manual,
+}
+
+impl Trigger {
+    /// The string tag stored in the DB trigger_type column.
+    pub fn type_tag(&self) -> &'static str {
+        match self {
+            Trigger::Cron { .. } => "cron",
+            Trigger::Event { .. } => "event",
+            Trigger::Webhook { .. } => "webhook",
+            Trigger::Manual => "manual",
+        }
+    }
+
+    /// Parse a trigger from its DB representation.
+    pub fn from_db(trigger_type: &str, config: serde_json::Value) -> Result<Self, String> {
+        match trigger_type {
+            "cron" => {
+                let schedule = config
+                    .get("schedule")
+                    .and_then(|v| v.as_str())
+                    .ok_or("cron trigger missing 'schedule'")?
+                    .to_string();
+                Ok(Trigger::Cron { schedule })
+            }
+            "event" => {
+                let pattern = config
+                    .get("pattern")
+                    .and_then(|v| v.as_str())
+                    .ok_or("event trigger missing 'pattern'")?
+                    .to_string();
+                let channel = config
+                    .get("channel")
+                    .and_then(|v| v.as_str())
+                    .map(String::from);
+                Ok(Trigger::Event { channel, pattern })
+            }
+            "webhook" => {
+                let path = config
+                    .get("path")
+                    .and_then(|v| v.as_str())
+                    .map(String::from);
+                let secret = config
+                    .get("secret")
+                    .and_then(|v| v.as_str())
+                    .map(String::from);
+                Ok(Trigger::Webhook { path, secret })
+            }
+            "manual" => Ok(Trigger::Manual),
+            other => Err(format!("unknown trigger type: {other}")),
+        }
+    }
+
+    /// Serialize trigger-specific config to JSON for DB storage.
+    pub fn to_config_json(&self) -> serde_json::Value {
+        match self {
+            Trigger::Cron { schedule } => serde_json::json!({ "schedule": schedule }),
+            Trigger::Event { channel, pattern } => serde_json::json!({
+                "pattern": pattern,
+                "channel": channel,
+            }),
+            Trigger::Webhook { path, secret } => serde_json::json!({
+                "path": path,
+                "secret": secret,
+            }),
+            Trigger::Manual => serde_json::json!({}),
+        }
+    }
+}
+
+/// What happens when a routine fires.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum RoutineAction {
+    /// Single LLM call, no tools. Cheap and fast.
+    Lightweight {
+        /// The prompt sent to the LLM.
+        prompt: String,
+        /// Workspace paths to load as context (e.g. ["context/priorities.md"]).
+        #[serde(default)]
+        context_paths: Vec<String>,
+        /// Max output tokens (default: 4096).
+        #[serde(default = "default_max_tokens")]
+        max_tokens: u32,
+    },
+    /// Full multi-turn worker job with tool access.
+    FullJob {
+        /// Job title for the scheduler.
+        title: String,
+        /// Job description / initial prompt.
+        description: String,
+        /// Max reasoning iterations (default: 10).
+        #[serde(default = "default_max_iterations")]
+        max_iterations: u32,
+    },
+}
+
+fn default_max_tokens() -> u32 {
+    4096
+}
+
+fn default_max_iterations() -> u32 {
+    10
+}
+
+impl RoutineAction {
+    /// The string tag stored in the DB action_type column.
+    pub fn type_tag(&self) -> &'static str {
+        match self {
+            RoutineAction::Lightweight { .. } => "lightweight",
+            RoutineAction::FullJob { .. } => "full_job",
+        }
+    }
+
+    /// Parse an action from its DB representation.
+    pub fn from_db(action_type: &str, config: serde_json::Value) -> Result<Self, String> {
+        match action_type {
+            "lightweight" => {
+                let prompt = config
+                    .get("prompt")
+                    .and_then(|v| v.as_str())
+                    .ok_or("lightweight action missing 'prompt'")?
+                    .to_string();
+                let context_paths = config
+                    .get("context_paths")
+                    .and_then(|v| v.as_array())
+                    .map(|arr| {
+                        arr.iter()
+                            .filter_map(|v| v.as_str().map(String::from))
+                            .collect()
+                    })
+                    .unwrap_or_default();
+                let max_tokens = config
+                    .get("max_tokens")
+                    .and_then(|v| v.as_u64())
+                    .unwrap_or(default_max_tokens() as u64) as u32;
+                Ok(RoutineAction::Lightweight {
+                    prompt,
+                    context_paths,
+                    max_tokens,
+                })
+            }
+            "full_job" => {
+                let title = config
+                    .get("title")
+                    .and_then(|v| v.as_str())
+                    .ok_or("full_job action missing 'title'")?
+                    .to_string();
+                let description = config
+                    .get("description")
+                    .and_then(|v| v.as_str())
+                    .ok_or("full_job action missing 'description'")?
+                    .to_string();
+                let max_iterations = config
+                    .get("max_iterations")
+                    .and_then(|v| v.as_u64())
+                    .unwrap_or(default_max_iterations() as u64)
+                    as u32;
+                Ok(RoutineAction::FullJob {
+                    title,
+                    description,
+                    max_iterations,
+                })
+            }
+            other => Err(format!("unknown action type: {other}")),
+        }
+    }
+
+    /// Serialize action config to JSON for DB storage.
+    pub fn to_config_json(&self) -> serde_json::Value {
+        match self {
+            RoutineAction::Lightweight {
+                prompt,
+                context_paths,
+                max_tokens,
+            } => serde_json::json!({
+                "prompt": prompt,
+                "context_paths": context_paths,
+                "max_tokens": max_tokens,
+            }),
+            RoutineAction::FullJob {
+                title,
+                description,
+                max_iterations,
+            } => serde_json::json!({
+                "title": title,
+                "description": description,
+                "max_iterations": max_iterations,
+            }),
+        }
+    }
+}
+
+/// Guardrails to prevent runaway execution.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RoutineGuardrails {
+    /// Minimum time between fires.
+    pub cooldown: Duration,
+    /// Max simultaneous runs of this routine.
+    pub max_concurrent: u32,
+    /// Window for content-hash dedup (event triggers). None = no dedup.
+    pub dedup_window: Option<Duration>,
+}
+
+impl Default for RoutineGuardrails {
+    fn default() -> Self {
+        Self {
+            cooldown: Duration::from_secs(300),
+            max_concurrent: 1,
+            dedup_window: None,
+        }
+    }
+}
+
+/// Notification preferences for a routine.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct NotifyConfig {
+    /// Channel to notify on (None = default/broadcast all).
+    pub channel: Option<String>,
+    /// User to notify.
+    pub user: String,
+    /// Notify when routine produces actionable output.
+    pub on_attention: bool,
+    /// Notify when routine errors.
+    pub on_failure: bool,
+    /// Notify when routine runs with no findings.
+    pub on_success: bool,
+}
+
+impl Default for NotifyConfig {
+    fn default() -> Self {
+        Self {
+            channel: None,
+            user: "default".to_string(),
+            on_attention: true,
+            on_failure: true,
+            on_success: false,
+        }
+    }
+}
+
+/// Status of a routine run.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RunStatus {
+    Running,
+    Ok,
+    Attention,
+    Failed,
+}
+
+impl std::fmt::Display for RunStatus {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            RunStatus::Running => write!(f, "running"),
+            RunStatus::Ok => write!(f, "ok"),
+            RunStatus::Attention => write!(f, "attention"),
+            RunStatus::Failed => write!(f, "failed"),
+        }
+    }
+}
+
+impl FromStr for RunStatus {
+    type Err = String;
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match s {
+            "running" => Ok(RunStatus::Running),
+            "ok" => Ok(RunStatus::Ok),
+            "attention" => Ok(RunStatus::Attention),
+            "failed" => Ok(RunStatus::Failed),
+            other => Err(format!("unknown run status: {other}")),
+        }
+    }
+}
+
+/// A single execution of a routine.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RoutineRun {
+    pub id: Uuid,
+    pub routine_id: Uuid,
+    pub trigger_type: String,
+    pub trigger_detail: Option<String>,
+    pub started_at: DateTime<Utc>,
+    pub completed_at: Option<DateTime<Utc>>,
+    pub status: RunStatus,
+    pub result_summary: Option<String>,
+    pub tokens_used: Option<i32>,
+    pub job_id: Option<Uuid>,
+    pub created_at: DateTime<Utc>,
+}
+
+/// Compute a content hash for event dedup.
+pub fn content_hash(content: &str) -> u64 {
+    let mut hasher = DefaultHasher::new();
+    content.hash(&mut hasher);
+    hasher.finish()
+}
+
+/// Parse a cron expression and compute the next fire time from now.
+pub fn next_cron_fire(schedule: &str) -> Result<Option<DateTime<Utc>>, String> {
+    let cron_schedule =
+        cron::Schedule::from_str(schedule).map_err(|e| format!("invalid cron: {e}"))?;
+    Ok(cron_schedule.upcoming(Utc).next())
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::agent::routine::{
+        RoutineAction, RoutineGuardrails, RunStatus, Trigger, content_hash, next_cron_fire,
+    };
+
+    #[test]
+    fn test_trigger_roundtrip() {
+        let trigger = Trigger::Cron {
+            schedule: "0 9 * * MON-FRI".to_string(),
+        };
+        let json = trigger.to_config_json();
+        let parsed = Trigger::from_db("cron", json).expect("parse cron");
+        assert!(matches!(parsed, Trigger::Cron { schedule } if schedule == "0 9 * * MON-FRI"));
+    }
+
+    #[test]
+    fn test_event_trigger_roundtrip() {
+        let trigger = Trigger::Event {
+            channel: Some("telegram".to_string()),
+            pattern: r"deploy\s+\w+".to_string(),
+        };
+        let json = trigger.to_config_json();
+        let parsed = Trigger::from_db("event", json).expect("parse event");
+        assert!(matches!(parsed, Trigger::Event { channel, pattern }
+            if channel == Some("telegram".to_string()) && pattern == r"deploy\s+\w+"));
+    }
+
+    #[test]
+    fn test_action_lightweight_roundtrip() {
+        let action = RoutineAction::Lightweight {
+            prompt: "Check PRs".to_string(),
+            context_paths: vec!["context/priorities.md".to_string()],
+            max_tokens: 2048,
+        };
+        let json = action.to_config_json();
+        let parsed = RoutineAction::from_db("lightweight", json).expect("parse lightweight");
+        assert!(
+            matches!(parsed, RoutineAction::Lightweight { prompt, context_paths, max_tokens }
+            if prompt == "Check PRs" && context_paths.len() == 1 && max_tokens == 2048)
+        );
+    }
+
+    #[test]
+    fn test_action_full_job_roundtrip() {
+        let action = RoutineAction::FullJob {
+            title: "Deploy review".to_string(),
+            description: "Review and deploy pending changes".to_string(),
+            max_iterations: 5,
+        };
+        let json = action.to_config_json();
+        let parsed = RoutineAction::from_db("full_job", json).expect("parse full_job");
+        assert!(
+            matches!(parsed, RoutineAction::FullJob { title, max_iterations, .. }
+            if title == "Deploy review" && max_iterations == 5)
+        );
+    }
+
+    #[test]
+    fn test_run_status_display_parse() {
+        for status in [
+            RunStatus::Running,
+            RunStatus::Ok,
+            RunStatus::Attention,
+            RunStatus::Failed,
+        ] {
+            let s = status.to_string();
+            let parsed: RunStatus = s.parse().expect("parse status");
+            assert_eq!(parsed, status);
+        }
+    }
+
+    #[test]
+    fn test_content_hash_deterministic() {
+        let h1 = content_hash("deploy production");
+        let h2 = content_hash("deploy production");
+        assert_eq!(h1, h2);
+
+        let h3 = content_hash("deploy staging");
+        assert_ne!(h1, h3);
+    }
+
+    #[test]
+    fn test_next_cron_fire_valid() {
+        // Every minute should always have a next fire
+        let next = next_cron_fire("* * * * * *").expect("valid cron");
+        assert!(next.is_some());
+    }
+
+    #[test]
+    fn test_next_cron_fire_invalid() {
+        let result = next_cron_fire("not a cron");
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_guardrails_default() {
+        let g = RoutineGuardrails::default();
+        assert_eq!(g.cooldown.as_secs(), 300);
+        assert_eq!(g.max_concurrent, 1);
+        assert!(g.dedup_window.is_none());
+    }
+
+    #[test]
+    fn test_trigger_type_tag() {
+        assert_eq!(
+            Trigger::Cron {
+                schedule: String::new()
+            }
+            .type_tag(),
+            "cron"
+        );
+        assert_eq!(
+            Trigger::Event {
+                channel: None,
+                pattern: String::new()
+            }
+            .type_tag(),
+            "event"
+        );
+        assert_eq!(
+            Trigger::Webhook {
+                path: None,
+                secret: None
+            }
+            .type_tag(),
+            "webhook"
+        );
+        assert_eq!(Trigger::Manual.type_tag(), "manual");
+    }
+}

src/agent/routine_engine.rs

@@ -0,0 +1,601 @@
+//! Routine execution engine.
+//!
+//! Handles loading routines, checking triggers, enforcing guardrails,
+//! and executing both lightweight (single LLM call) and full-job routines.
+//!
+//! The engine runs two independent loops:
+//! - A **cron ticker** that polls the DB every N seconds for due cron routines
+//! - An **event matcher** called synchronously from the agent main loop
+//!
+//! Lightweight routines execute inline (single LLM call, no scheduler slot).
+//! Full-job routines are delegated to the existing `Scheduler`.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::time::Duration;
+
+use chrono::Utc;
+use regex::Regex;
+use tokio::sync::{RwLock, mpsc};
+use uuid::Uuid;
+
+use crate::agent::routine::{
+    NotifyConfig, Routine, RoutineAction, RoutineRun, RunStatus, Trigger, next_cron_fire,
+};
+use crate::channels::{IncomingMessage, OutgoingResponse};
+use crate::config::RoutineConfig;
+use crate::db::Database;
+use crate::llm::{ChatMessage, CompletionRequest, FinishReason, LlmProvider};
+use crate::workspace::Workspace;
+
+/// The routine execution engine.
+pub struct RoutineEngine {
+    config: RoutineConfig,
+    store: Arc<dyn Database>,
+    llm: Arc<dyn LlmProvider>,
+    workspace: Arc<Workspace>,
+    /// Sender for notifications (routed to channel manager).
+    notify_tx: mpsc::Sender<OutgoingResponse>,
+    /// Currently running routine count (across all routines).
+    running_count: Arc<AtomicUsize>,
+    /// Compiled event regex cache: routine_id -> compiled regex.
+    event_cache: Arc<RwLock<Vec<(Uuid, Routine, Regex)>>>,
+}
+
+impl RoutineEngine {
+    pub fn new(
+        config: RoutineConfig,
+        store: Arc<dyn Database>,
+        llm: Arc<dyn LlmProvider>,
+        workspace: Arc<Workspace>,
+        notify_tx: mpsc::Sender<OutgoingResponse>,
+    ) -> Self {
+        Self {
+            config,
+            store,
+            llm,
+            workspace,
+            notify_tx,
+            running_count: Arc::new(AtomicUsize::new(0)),
+            event_cache: Arc::new(RwLock::new(Vec::new())),
+        }
+    }
+
+    /// Refresh the in-memory event trigger cache from DB.
+    pub async fn refresh_event_cache(&self) {
+        match self.store.list_event_routines().await {
+            Ok(routines) => {
+                let mut cache = Vec::new();
+                for routine in routines {
+                    if let Trigger::Event { ref pattern, .. } = routine.trigger {
+                        match Regex::new(pattern) {
+                            Ok(re) => cache.push((routine.id, routine.clone(), re)),
+                            Err(e) => {
+                                tracing::warn!(
+                                    routine = %routine.name,
+                                    "Invalid event regex '{}': {}",
+                                    pattern, e
+                                );
+                            }
+                        }
+                    }
+                }
+                let count = cache.len();
+                *self.event_cache.write().await = cache;
+                tracing::debug!("Refreshed event cache: {} routines", count);
+            }
+            Err(e) => {
+                tracing::error!("Failed to refresh event cache: {}", e);
+            }
+        }
+    }
+
+    /// Check incoming message against event triggers. Returns number of routines fired.
+    ///
+    /// Called synchronously from the main loop after handle_message(). The actual
+    /// execution is spawned async so this returns quickly.
+    pub async fn check_event_triggers(&self, message: &IncomingMessage) -> usize {
+        let cache = self.event_cache.read().await;
+        let mut fired = 0;
+
+        for (_, routine, re) in cache.iter() {
+            // Channel filter
+            if let Trigger::Event {
+                channel: Some(ch), ..
+            } = &routine.trigger
+                && ch != &message.channel
+            {
+                continue;
+            }
+
+            // Regex match
+            if !re.is_match(&message.content) {
+                continue;
+            }
+
+            // Cooldown check
+            if !self.check_cooldown(routine) {
+                tracing::debug!(routine = %routine.name, "Skipped: cooldown active");
+                continue;
+            }
+
+            // Concurrent run check
+            if !self.check_concurrent(routine).await {
+                tracing::debug!(routine = %routine.name, "Skipped: max concurrent reached");
+                continue;
+            }
+
+            // Global capacity check
+            if self.running_count.load(Ordering::Relaxed) >= self.config.max_concurrent_routines {
+                tracing::warn!(routine = %routine.name, "Skipped: global max concurrent reached");
+                continue;
+            }
+
+            let detail = truncate(&message.content, 200);
+            self.spawn_fire(routine.clone(), "event", Some(detail));
+            fired += 1;
+        }
+
+        fired
+    }
+
+    /// Check all due cron routines and fire them. Called by the cron ticker.
+    pub async fn check_cron_triggers(&self) {
+        let routines = match self.store.list_due_cron_routines().await {
+            Ok(r) => r,
+            Err(e) => {
+                tracing::error!("Failed to load due cron routines: {}", e);
+                return;
+            }
+        };
+
+        for routine in routines {
+            if self.running_count.load(Ordering::Relaxed) >= self.config.max_concurrent_routines {
+                tracing::warn!("Global max concurrent routines reached, skipping remaining");
+                break;
+            }
+
+            if !self.check_cooldown(&routine) {
+                continue;
+            }
+
+            if !self.check_concurrent(&routine).await {
+                continue;
+            }
+
+            let detail = if let Trigger::Cron { ref schedule } = routine.trigger {
+                Some(schedule.clone())
+            } else {
+                None
+            };
+
+            self.spawn_fire(routine, "cron", detail);
+        }
+    }
+
+    /// Fire a routine manually (from tool call or CLI).
+    pub async fn fire_manual(&self, routine_id: Uuid) -> Result<Uuid, String> {
+        let routine = self
+            .store
+            .get_routine(routine_id)
+            .await
+            .map_err(|e| format!("DB error: {e}"))?
+            .ok_or_else(|| format!("routine {routine_id} not found"))?;
+
+        if !routine.enabled {
+            return Err(format!("routine '{}' is disabled", routine.name));
+        }
+
+        if !self.check_concurrent(&routine).await {
+            return Err(format!(
+                "routine '{}' already at max concurrent runs",
+                routine.name
+            ));
+        }
+
+        let run_id = Uuid::new_v4();
+        let run = RoutineRun {
+            id: run_id,
+            routine_id: routine.id,
+            trigger_type: "manual".to_string(),
+            trigger_detail: None,
+            started_at: Utc::now(),
+            completed_at: None,
+            status: RunStatus::Running,
+            result_summary: None,
+            tokens_used: None,
+            job_id: None,
+            created_at: Utc::now(),
+        };
+
+        if let Err(e) = self.store.create_routine_run(&run).await {
+            return Err(format!("failed to create run record: {e}"));
+        }
+
+        // Execute inline for manual triggers (caller wants to wait)
+        let engine = EngineContext {
+            store: self.store.clone(),
+            llm: self.llm.clone(),
+            workspace: self.workspace.clone(),
+            notify_tx: self.notify_tx.clone(),
+            running_count: self.running_count.clone(),
+            max_lightweight_tokens: self.config.max_lightweight_tokens,
+        };
+
+        tokio::spawn(async move {
+            execute_routine(engine, routine, run).await;
+        });
+
+        Ok(run_id)
+    }
+
+    /// Spawn a fire in a background task.
+    fn spawn_fire(&self, routine: Routine, trigger_type: &str, trigger_detail: Option<String>) {
+        let run = RoutineRun {
+            id: Uuid::new_v4(),
+            routine_id: routine.id,
+            trigger_type: trigger_type.to_string(),
+            trigger_detail,
+            started_at: Utc::now(),
+            completed_at: None,
+            status: RunStatus::Running,
+            result_summary: None,
+            tokens_used: None,
+            job_id: None,
+            created_at: Utc::now(),
+        };
+
+        let engine = EngineContext {
+            store: self.store.clone(),
+            llm: self.llm.clone(),
+            workspace: self.workspace.clone(),
+            notify_tx: self.notify_tx.clone(),
+            running_count: self.running_count.clone(),
+            max_lightweight_tokens: self.config.max_lightweight_tokens,
+        };
+
+        // Record the run in DB, then spawn execution
+        let store = self.store.clone();
+        tokio::spawn(async move {
+            if let Err(e) = store.create_routine_run(&run).await {
+                tracing::error!(routine = %routine.name, "Failed to record run: {}", e);
+                return;
+            }
+            execute_routine(engine, routine, run).await;
+        });
+    }
+
+    fn check_cooldown(&self, routine: &Routine) -> bool {
+        if let Some(last_run) = routine.last_run_at {
+            let elapsed = Utc::now().signed_duration_since(last_run);
+            let cooldown = chrono::Duration::from_std(routine.guardrails.cooldown)
+                .unwrap_or(chrono::Duration::seconds(300));
+            if elapsed < cooldown {
+                return false;
+            }
+        }
+        true
+    }
+
+    async fn check_concurrent(&self, routine: &Routine) -> bool {
+        match self.store.count_running_routine_runs(routine.id).await {
+            Ok(count) => count < routine.guardrails.max_concurrent as i64,
+            Err(e) => {
+                tracing::error!(
+                    routine = %routine.name,
+                    "Failed to check concurrent runs: {}", e
+                );
+                false
+            }
+        }
+    }
+}
+
+/// Shared context passed to the execution function.
+struct EngineContext {
+    store: Arc<dyn Database>,
+    llm: Arc<dyn LlmProvider>,
+    workspace: Arc<Workspace>,
+    notify_tx: mpsc::Sender<OutgoingResponse>,
+    running_count: Arc<AtomicUsize>,
+    max_lightweight_tokens: u32,
+}
+
+/// Execute a routine run. Handles both lightweight and full_job modes.
+async fn execute_routine(ctx: EngineContext, routine: Routine, run: RoutineRun) {
+    // Increment running count (atomic: survives panics in the execution below)
+    ctx.running_count.fetch_add(1, Ordering::Relaxed);
+
+    let result = match &routine.action {
+        RoutineAction::Lightweight {
+            prompt,
+            context_paths,
+            max_tokens,
+        } => execute_lightweight(&ctx, &routine, prompt, context_paths, *max_tokens).await,
+        RoutineAction::FullJob { description, .. } => {
+            // Full job mode: for now, execute as lightweight with the description
+            // as prompt. Full scheduler integration will come as a follow-up.
+            tracing::info!(
+                routine = %routine.name,
+                "FullJob mode executing as lightweight (scheduler integration pending)"
+            );
+            execute_lightweight(&ctx, &routine, description, &[], ctx.max_lightweight_tokens).await
+        }
+    };
+
+    // Decrement running count
+    ctx.running_count.fetch_sub(1, Ordering::Relaxed);
+
+    // Process result
+    let (status, summary, tokens) = match result {
+        Ok(execution) => execution,
+        Err(e) => {
+            tracing::error!(routine = %routine.name, "Execution failed: {}", e);
+            (RunStatus::Failed, Some(e), None)
+        }
+    };
+
+    // Complete the run record
+    if let Err(e) = ctx
+        .store
+        .complete_routine_run(run.id, status, summary.as_deref(), tokens)
+        .await
+    {
+        tracing::error!(routine = %routine.name, "Failed to complete run record: {}", e);
+    }
+
+    // Update routine runtime state
+    let now = Utc::now();
+    let next_fire = if let Trigger::Cron { ref schedule } = routine.trigger {
+        next_cron_fire(schedule).unwrap_or(None)
+    } else {
+        None
+    };
+
+    let new_failures = if status == RunStatus::Failed {
+        routine.consecutive_failures + 1
+    } else {
+        0
+    };
+
+    if let Err(e) = ctx
+        .store
+        .update_routine_runtime(
+            routine.id,
+            now,
+            next_fire,
+            routine.run_count + 1,
+            new_failures,
+            &routine.state,
+        )
+        .await
+    {
+        tracing::error!(routine = %routine.name, "Failed to update runtime state: {}", e);
+    }
+
+    // Send notifications based on config
+    send_notification(
+        &ctx.notify_tx,
+        &routine.notify,
+        &routine.name,
+        status,
+        summary.as_deref(),
+    )
+    .await;
+}
+
+/// Execute a lightweight routine (single LLM call).
+async fn execute_lightweight(
+    ctx: &EngineContext,
+    routine: &Routine,
+    prompt: &str,
+    context_paths: &[String],
+    max_tokens: u32,
+) -> Result<(RunStatus, Option<String>, Option<i32>), String> {
+    // Load context from workspace
+    let mut context_parts = Vec::new();
+    for path in context_paths {
+        match ctx.workspace.read(path).await {
+            Ok(doc) => {
+                context_parts.push(format!("## {}\n\n{}", path, doc.content));
+            }
+            Err(e) => {
+                tracing::debug!(
+                    routine = %routine.name,
+                    "Failed to read context path {}: {}", path, e
+                );
+            }
+        }
+    }
+
+    // Load routine state from workspace
+    let state_path = format!("routines/{}/state.md", routine.name);
+    let state_content = match ctx.workspace.read(&state_path).await {
+        Ok(doc) => Some(doc.content),
+        Err(_) => None,
+    };
+
+    // Build the prompt
+    let mut full_prompt = String::new();
+    full_prompt.push_str(prompt);
+
+    if !context_parts.is_empty() {
+        full_prompt.push_str("\n\n---\n\n# Context\n\n");
+        full_prompt.push_str(&context_parts.join("\n\n"));
+    }
+
+    if let Some(state) = &state_content {
+        full_prompt.push_str("\n\n---\n\n# Previous State\n\n");
+        full_prompt.push_str(state);
+    }
+
+    full_prompt.push_str(
+        "\n\n---\n\nIf nothing needs attention, reply EXACTLY with: ROUTINE_OK\n\
+         If something needs attention, provide a concise summary.",
+    );
+
+    // Get system prompt
+    let system_prompt = match ctx.workspace.system_prompt().await {
+        Ok(p) => p,
+        Err(e) => {
+            tracing::warn!(routine = %routine.name, "Failed to get system prompt: {}", e);
+            String::new()
+        }
+    };
+
+    let messages = if system_prompt.is_empty() {
+        vec![ChatMessage::user(&full_prompt)]
+    } else {
+        vec![
+            ChatMessage::system(&system_prompt),
+            ChatMessage::user(&full_prompt),
+        ]
+    };
+
+    // Determine max_tokens from model metadata with fallback
+    let effective_max_tokens = match ctx.llm.model_metadata().await {
+        Ok(meta) => {
+            let from_api = meta.context_length.map(|ctx| ctx / 2).unwrap_or(max_tokens);
+            from_api.max(max_tokens)
+        }
+        Err(_) => max_tokens,
+    };
+
+    let request = CompletionRequest::new(messages)
+        .with_max_tokens(effective_max_tokens)
+        .with_temperature(0.3);
+
+    let response = ctx
+        .llm
+        .complete(request)
+        .await
+        .map_err(|e| format!("LLM call failed: {e}"))?;
+
+    let content = response.content.trim();
+    let tokens_used = Some((response.input_tokens + response.output_tokens) as i32);
+
+    // Empty content guard (same as heartbeat)
+    if content.is_empty() {
+        return if response.finish_reason == FinishReason::Length {
+            Err(
+                "LLM response truncated (finish_reason=length) with no content. \
+                 Model may have exhausted token budget on reasoning."
+                    .to_string(),
+            )
+        } else {
+            Err("LLM returned empty content.".to_string())
+        };
+    }
+
+    // Check for the "nothing to do" sentinel
+    if content == "ROUTINE_OK" || content.contains("ROUTINE_OK") {
+        return Ok((RunStatus::Ok, None, tokens_used));
+    }
+
+    Ok((RunStatus::Attention, Some(content.to_string()), tokens_used))
+}
+
+/// Send a notification based on the routine's notify config and run status.
+async fn send_notification(
+    tx: &mpsc::Sender<OutgoingResponse>,
+    notify: &NotifyConfig,
+    routine_name: &str,
+    status: RunStatus,
+    summary: Option<&str>,
+) {
+    let should_notify = match status {
+        RunStatus::Ok => notify.on_success,
+        RunStatus::Attention => notify.on_attention,
+        RunStatus::Failed => notify.on_failure,
+        RunStatus::Running => false,
+    };
+
+    if !should_notify {
+        return;
+    }
+
+    let icon = match status {
+        RunStatus::Ok => "✅",
+        RunStatus::Attention => "🔔",
+        RunStatus::Failed => "❌",
+        RunStatus::Running => "⏳",
+    };
+
+    let message = match summary {
+        Some(s) => format!("{} *Routine '{}'*: {}\n\n{}", icon, routine_name, status, s),
+        None => format!("{} *Routine '{}'*: {}", icon, routine_name, status),
+    };
+
+    let response = OutgoingResponse {
+        content: message,
+        thread_id: None,
+        metadata: serde_json::json!({
+            "source": "routine",
+            "routine_name": routine_name,
+            "status": status.to_string(),
+        }),
+    };
+
+    if let Err(e) = tx.send(response).await {
+        tracing::error!(routine = %routine_name, "Failed to send notification: {}", e);
+    }
+}
+
+/// Spawn the cron ticker background task.
+pub fn spawn_cron_ticker(
+    engine: Arc<RoutineEngine>,
+    interval: Duration,
+) -> tokio::task::JoinHandle<()> {
+    tokio::spawn(async move {
+        let mut ticker = tokio::time::interval(interval);
+        // Skip immediate first tick
+        ticker.tick().await;
+
+        loop {
+            ticker.tick().await;
+            engine.check_cron_triggers().await;
+        }
+    })
+}
+
+fn truncate(s: &str, max: usize) -> String {
+    if s.len() <= max {
+        s.to_string()
+    } else {
+        let end = crate::util::floor_char_boundary(s, max);
+        format!("{}...", &s[..end])
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::agent::routine::{NotifyConfig, RunStatus};
+
+    #[test]
+    fn test_notification_gating() {
+        let config = NotifyConfig {
+            on_success: false,
+            on_failure: true,
+            on_attention: true,
+            ..Default::default()
+        };
+
+        // on_success = false means Ok status should not notify
+        assert!(!config.on_success);
+        assert!(config.on_failure);
+        assert!(config.on_attention);
+    }
+
+    #[test]
+    fn test_run_status_icons() {
+        // Just verify the mapping doesn't panic
+        for status in [
+            RunStatus::Ok,
+            RunStatus::Attention,
+            RunStatus::Failed,
+            RunStatus::Running,
+        ] {
+            let _ = status.to_string();
+        }
+    }
+}

src/agent/scheduler.rs

@@ -12,8 +12,9 @@ use crate::agent::task::{Task, TaskContext, TaskOutput};
 use crate::agent::worker::{Worker, WorkerDeps};
 use crate::config::AgentConfig;
 use crate::context::{ContextManager, JobContext, JobState};
+use crate::db::Database;
 use crate::error::{Error, JobError};
-use crate::history::Store;
+use crate::hooks::HookRegistry;
 use crate::llm::LlmProvider;
 use crate::safety::SafetyLayer;
 use crate::tools::ToolRegistry;
@@ -48,7 +49,8 @@ pub struct Scheduler {
     llm: Arc<dyn LlmProvider>,
     safety: Arc<SafetyLayer>,
     tools: Arc<ToolRegistry>,
-    store: Option<Arc<Store>>,
+    store: Option<Arc<dyn Database>>,
+    hooks: Arc<HookRegistry>,
     /// Running jobs (main LLM-driven jobs).
     jobs: Arc<RwLock<HashMap<Uuid, ScheduledJob>>>,
     /// Running sub-tasks (tool executions, background tasks).
@@ -63,7 +65,8 @@ impl Scheduler {
         llm: Arc<dyn LlmProvider>,
         safety: Arc<SafetyLayer>,
         tools: Arc<ToolRegistry>,
-        store: Option<Arc<Store>>,
+        store: Option<Arc<dyn Database>>,
+        hooks: Arc<HookRegistry>,
     ) -> Self {
         Self {
             config,
@@ -72,6 +75,7 @@ impl Scheduler {
             safety,
             tools,
             store,
+            hooks,
             jobs: Arc::new(RwLock::new(HashMap::new())),
             subtasks: Arc::new(RwLock::new(HashMap::new())),
         }
@@ -79,63 +83,64 @@ impl Scheduler {
 
     /// Schedule a job for execution.
     pub async fn schedule(&self, job_id: Uuid) -> Result<(), JobError> {
-        // Check if already scheduled
-        if self.jobs.read().await.contains_key(&job_id) {
-            return Ok(());
-        }
+        // Hold write lock for the entire check-insert sequence to prevent
+        // TOCTOU races where two concurrent calls both pass the checks.
+        {
+            let mut jobs = self.jobs.write().await;
 
-        // Check capacity
-        let current_count = self.jobs.read().await.len();
-        if current_count >= self.config.max_parallel_jobs {
-            return Err(JobError::MaxJobsExceeded {
-                max: self.config.max_parallel_jobs,
-            });
-        }
-
-        // Transition job to in_progress
-        self.context_manager
-            .update_context(job_id, |ctx| {
-                ctx.transition_to(
-                    JobState::InProgress,
-                    Some("Scheduled for execution".to_string()),
-                )
-            })
-            .await?
-            .map_err(|s| JobError::ContextError {
-                id: job_id,
-                reason: s,
-            })?;
-
-        // Create worker channel
-        let (tx, rx) = mpsc::channel(16);
-
-        // Create worker with shared dependencies
-        let deps = WorkerDeps {
-            context_manager: self.context_manager.clone(),
-            llm: self.llm.clone(),
-            safety: self.safety.clone(),
-            tools: self.tools.clone(),
-            store: self.store.clone(),
-            timeout: self.config.job_timeout,
-            use_planning: self.config.use_planning,
-        };
-        let worker = Worker::new(job_id, deps);
-
-        // Spawn worker task
-        let handle = tokio::spawn(async move {
-            if let Err(e) = worker.run(rx).await {
-                tracing::error!("Worker for job {} failed: {}", job_id, e);
+            if jobs.contains_key(&job_id) {
+                return Ok(());
             }
-        });
 
-        // Start the worker
-        let _ = tx.send(WorkerMessage::Start).await;
+            if jobs.len() >= self.config.max_parallel_jobs {
+                return Err(JobError::MaxJobsExceeded {
+                    max: self.config.max_parallel_jobs,
+                });
+            }
 
-        // Store the scheduled job
-        self.jobs
-            .write()
-            .await
-            .insert(job_id, ScheduledJob { handle, tx });
+            // Transition job to in_progress
+            self.context_manager
+                .update_context(job_id, |ctx| {
+                    ctx.transition_to(
+                        JobState::InProgress,
+                        Some("Scheduled for execution".to_string()),
+                    )
+                })
+                .await?
+                .map_err(|s| JobError::ContextError {
+                    id: job_id,
+                    reason: s,
+                })?;
+
+            // Create worker channel
+            let (tx, rx) = mpsc::channel(16);
+
+            // Create worker with shared dependencies
+            let deps = WorkerDeps {
+                context_manager: self.context_manager.clone(),
+                llm: self.llm.clone(),
+                safety: self.safety.clone(),
+                tools: self.tools.clone(),
+                store: self.store.clone(),
+                hooks: self.hooks.clone(),
+                timeout: self.config.job_timeout,
+                use_planning: self.config.use_planning,
+            };
+            let worker = Worker::new(job_id, deps);
+
+            // Spawn worker task
+            let handle = tokio::spawn(async move {
+                if let Err(e) = worker.run(rx).await {
+                    tracing::error!("Worker for job {} failed: {}", job_id, e);
+                }
+            });
+
+            // Start the worker
+            let _ = tx.send(WorkerMessage::Start).await;
+
+            // Insert while still holding the write lock
+            jobs.insert(job_id, ScheduledJob { handle, tx });
+        }
 
         // Cleanup task for this job to avoid capacity leaks
         let jobs = Arc::clone(&self.jobs);
@@ -373,23 +378,23 @@ impl Scheduler {
             .into());
         }
 
-        // Execute with timeout
-        let result = tokio::time::timeout(Duration::from_secs(60), async {
-            tool.execute(params, &job_ctx).await
-        })
-        .await
-        .map_err(|_| {
-            Error::Tool(crate::error::ToolError::Timeout {
-                name: tool_name.to_string(),
-                timeout: Duration::from_secs(60),
-            })
-        })?
-        .map_err(|e| {
-            Error::Tool(crate::error::ToolError::ExecutionFailed {
-                name: tool_name.to_string(),
-                reason: e.to_string(),
-            })
-        })?;
+        // Execute with per-tool timeout
+        let tool_timeout = tool.execution_timeout();
+        let result =
+            tokio::time::timeout(tool_timeout, async { tool.execute(params, &job_ctx).await })
+                .await
+                .map_err(|_| {
+                    Error::Tool(crate::error::ToolError::Timeout {
+                        name: tool_name.to_string(),
+                        timeout: tool_timeout,
+                    })
+                })?
+                .map_err(|e| {
+                    Error::Tool(crate::error::ToolError::ExecutionFailed {
+                        name: tool_name.to_string(),
+                        reason: e.to_string(),
+                    })
+                })?;
 
         Ok(TaskOutput::new(result.result, start.elapsed()))
     }

src/agent/self_repair.rs

@@ -8,8 +8,8 @@ use chrono::{DateTime, Utc};
 use uuid::Uuid;
 
 use crate::context::{ContextManager, JobState};
+use crate::db::Database;
 use crate::error::RepairError;
-use crate::history::Store;
 use crate::tools::{BuildRequirement, Language, SoftwareBuilder, SoftwareType, ToolRegistry};
 
 /// A job that has been detected as stuck.
@@ -69,7 +69,7 @@ pub struct DefaultSelfRepair {
     #[allow(dead_code)] // Will be used for time-based stuck detection
     stuck_threshold: Duration,
     max_repair_attempts: u32,
-    store: Option<Arc<Store>>,
+    store: Option<Arc<dyn Database>>,
     builder: Option<Arc<dyn SoftwareBuilder>>,
     #[allow(dead_code)] // Will be used for tool hot-reload after repair
     tools: Option<Arc<ToolRegistry>>,
@@ -94,7 +94,7 @@ impl DefaultSelfRepair {
 
     /// Add a Store for tool failure tracking.
     #[allow(dead_code)] // Public API for configuring repair with persistence
-    pub fn with_store(mut self, store: Arc<Store>) -> Self {
+    pub fn with_store(mut self, store: Arc<dyn Database>) -> Self {
         self.store = Some(store);
         self
     }
@@ -119,25 +119,25 @@ impl SelfRepair for DefaultSelfRepair {
         let mut stuck_jobs = Vec::new();
 
         for job_id in stuck_ids {
-            if let Ok(ctx) = self.context_manager.get_context(job_id).await {
-                if ctx.state == JobState::Stuck {
-                    let stuck_duration = ctx
-                        .started_at
-                        .map(|start| {
-                            let now = Utc::now();
-                            let duration = now.signed_duration_since(start);
-                            Duration::from_secs(duration.num_seconds().max(0) as u64)
-                        })
-                        .unwrap_or_default();
+            if let Ok(ctx) = self.context_manager.get_context(job_id).await
+                && ctx.state == JobState::Stuck
+            {
+                let stuck_duration = ctx
+                    .started_at
+                    .map(|start| {
+                        let now = Utc::now();
+                        let duration = now.signed_duration_since(start);
+                        Duration::from_secs(duration.num_seconds().max(0) as u64)
+                    })
+                    .unwrap_or_default();
 
-                    stuck_jobs.push(StuckJob {
-                        job_id,
-                        last_activity: ctx.started_at.unwrap_or(ctx.created_at),
-                        stuck_duration,
-                        last_error: None,
-                        repair_attempts: ctx.repair_attempts,
-                    });
-                }
+                stuck_jobs.push(StuckJob {
+                    job_id,
+                    last_activity: ctx.started_at.unwrap_or(ctx.created_at),
+                    stuck_duration,
+                    last_error: None,
+                    repair_attempts: ctx.repair_attempts,
+                });
             }
         }
 

src/agent/session.rs

@@ -173,6 +173,10 @@ pub struct Thread {
     /// Pending auth token request (thread is in auth mode).
     #[serde(default)]
     pub pending_auth: Option<PendingAuth>,
+    /// Last NEAR AI response ID for response chaining. Persisted to DB
+    /// metadata so we can resume chaining across restarts.
+    #[serde(default)]
+    pub last_response_id: Option<String>,
 }
 
 impl Thread {
@@ -189,6 +193,24 @@ impl Thread {
             metadata: serde_json::Value::Null,
             pending_approval: None,
             pending_auth: None,
+            last_response_id: None,
+        }
+    }
+
+    /// Create a thread with a specific ID (for DB hydration).
+    pub fn with_id(id: Uuid, session_id: Uuid) -> Self {
+        let now = Utc::now();
+        Self {
+            id,
+            session_id,
+            state: ThreadState::Idle,
+            turns: Vec::new(),
+            created_at: now,
+            updated_at: now,
+            metadata: serde_json::Value::Null,
+            pending_approval: None,
+            pending_auth: None,
+            last_response_id: None,
         }
     }
 
@@ -324,11 +346,11 @@ impl Thread {
                 let mut turn = Turn::new(turn_number, &msg.content);
 
                 // Check if next is assistant response
-                if let Some(next) = iter.peek() {
-                    if next.role == crate::llm::Role::Assistant {
-                        let response = iter.next().expect("peeked");
-                        turn.complete(&response.content);
-                    }
+                if let Some(next) = iter.peek()
+                    && next.role == crate::llm::Role::Assistant
+                {
+                    let response = iter.next().expect("peeked");
+                    turn.complete(&response.content);
                 }
 
                 self.turns.push(turn);
@@ -593,4 +615,386 @@ mod tests {
         let restored: Thread = serde_json::from_str(&json).expect("should deserialize");
         assert!(restored.pending_auth.is_none());
     }
+
+    #[test]
+    fn test_thread_with_id() {
+        let specific_id = Uuid::new_v4();
+        let session_id = Uuid::new_v4();
+        let thread = Thread::with_id(specific_id, session_id);
+
+        assert_eq!(thread.id, specific_id);
+        assert_eq!(thread.session_id, session_id);
+        assert_eq!(thread.state, ThreadState::Idle);
+        assert!(thread.turns.is_empty());
+    }
+
+    #[test]
+    fn test_thread_with_id_restore_messages() {
+        let thread_id = Uuid::new_v4();
+        let session_id = Uuid::new_v4();
+        let mut thread = Thread::with_id(thread_id, session_id);
+
+        let messages = vec![
+            ChatMessage::user("Hello from DB"),
+            ChatMessage::assistant("Restored response"),
+        ];
+        thread.restore_from_messages(messages);
+
+        assert_eq!(thread.id, thread_id);
+        assert_eq!(thread.turns.len(), 1);
+        assert_eq!(thread.turns[0].user_input, "Hello from DB");
+        assert_eq!(
+            thread.turns[0].response,
+            Some("Restored response".to_string())
+        );
+    }
+
+    #[test]
+    fn test_restore_from_messages_empty() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        // Add a turn first, then restore with empty vec
+        thread.start_turn("hello");
+        thread.complete_turn("hi");
+        assert_eq!(thread.turns.len(), 1);
+
+        thread.restore_from_messages(Vec::new());
+
+        // Should clear all turns and stay idle
+        assert!(thread.turns.is_empty());
+        assert_eq!(thread.state, ThreadState::Idle);
+    }
+
+    #[test]
+    fn test_restore_from_messages_only_assistant_messages() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        // Only assistant messages (no user messages to anchor turns)
+        let messages = vec![
+            ChatMessage::assistant("I'm here"),
+            ChatMessage::assistant("Still here"),
+        ];
+
+        thread.restore_from_messages(messages);
+
+        // Assistant-only messages have no user turn to attach to, so
+        // they should be skipped entirely.
+        assert!(thread.turns.is_empty());
+    }
+
+    #[test]
+    fn test_restore_from_messages_multiple_user_messages_in_a_row() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        // Two user messages with no assistant response between them
+        let messages = vec![
+            ChatMessage::user("first"),
+            ChatMessage::user("second"),
+            ChatMessage::assistant("reply to second"),
+        ];
+
+        thread.restore_from_messages(messages);
+
+        // First user message becomes a turn with no response,
+        // second user message pairs with the assistant response.
+        assert_eq!(thread.turns.len(), 2);
+        assert_eq!(thread.turns[0].user_input, "first");
+        assert!(thread.turns[0].response.is_none());
+        assert_eq!(thread.turns[1].user_input, "second");
+        assert_eq!(
+            thread.turns[1].response,
+            Some("reply to second".to_string())
+        );
+    }
+
+    #[test]
+    fn test_thread_switch() {
+        let mut session = Session::new("user-1");
+
+        let t1_id = session.create_thread().id;
+        let t2_id = session.create_thread().id;
+
+        // After creating two threads, active should be the last one
+        assert_eq!(session.active_thread, Some(t2_id));
+
+        // Switch back to the first
+        assert!(session.switch_thread(t1_id));
+        assert_eq!(session.active_thread, Some(t1_id));
+
+        // Switching to a nonexistent thread should fail
+        let fake_id = Uuid::new_v4();
+        assert!(!session.switch_thread(fake_id));
+        // Active thread should remain unchanged
+        assert_eq!(session.active_thread, Some(t1_id));
+    }
+
+    #[test]
+    fn test_get_or_create_thread_idempotent() {
+        let mut session = Session::new("user-1");
+
+        let tid1 = session.get_or_create_thread().id;
+        let tid2 = session.get_or_create_thread().id;
+
+        // Should return the same thread (not create a new one each time)
+        assert_eq!(tid1, tid2);
+        assert_eq!(session.threads.len(), 1);
+    }
+
+    #[test]
+    fn test_truncate_turns() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        for i in 0..5 {
+            thread.start_turn(format!("msg-{}", i));
+            thread.complete_turn(format!("resp-{}", i));
+        }
+        assert_eq!(thread.turns.len(), 5);
+
+        thread.truncate_turns(3);
+        assert_eq!(thread.turns.len(), 3);
+
+        // Should keep the most recent turns
+        assert_eq!(thread.turns[0].user_input, "msg-2");
+        assert_eq!(thread.turns[1].user_input, "msg-3");
+        assert_eq!(thread.turns[2].user_input, "msg-4");
+
+        // Turn numbers should be re-indexed
+        assert_eq!(thread.turns[0].turn_number, 0);
+        assert_eq!(thread.turns[1].turn_number, 1);
+        assert_eq!(thread.turns[2].turn_number, 2);
+    }
+
+    #[test]
+    fn test_truncate_turns_noop_when_fewer() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        thread.start_turn("only one");
+        thread.complete_turn("response");
+
+        thread.truncate_turns(10);
+        assert_eq!(thread.turns.len(), 1);
+        assert_eq!(thread.turns[0].user_input, "only one");
+    }
+
+    #[test]
+    fn test_thread_interrupt_and_resume() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        thread.start_turn("do something");
+        assert_eq!(thread.state, ThreadState::Processing);
+
+        thread.interrupt();
+        assert_eq!(thread.state, ThreadState::Interrupted);
+
+        let last_turn = thread.last_turn().unwrap();
+        assert_eq!(last_turn.state, TurnState::Interrupted);
+        assert!(last_turn.completed_at.is_some());
+
+        thread.resume();
+        assert_eq!(thread.state, ThreadState::Idle);
+    }
+
+    #[test]
+    fn test_resume_only_from_interrupted() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        // Idle thread: resume should be a no-op
+        assert_eq!(thread.state, ThreadState::Idle);
+        thread.resume();
+        assert_eq!(thread.state, ThreadState::Idle);
+
+        // Processing thread: resume should not change state
+        thread.start_turn("work");
+        assert_eq!(thread.state, ThreadState::Processing);
+        thread.resume();
+        assert_eq!(thread.state, ThreadState::Processing);
+    }
+
+    #[test]
+    fn test_turn_fail() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        thread.start_turn("risky operation");
+        thread.fail_turn("connection timed out");
+
+        assert_eq!(thread.state, ThreadState::Idle);
+
+        let turn = thread.last_turn().unwrap();
+        assert_eq!(turn.state, TurnState::Failed);
+        assert_eq!(turn.error, Some("connection timed out".to_string()));
+        assert!(turn.response.is_none());
+        assert!(turn.completed_at.is_some());
+    }
+
+    #[test]
+    fn test_messages_with_incomplete_last_turn() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        thread.start_turn("first");
+        thread.complete_turn("first reply");
+        thread.start_turn("second (in progress)");
+
+        let messages = thread.messages();
+        // Should have 3 messages: user, assistant, user (no assistant for in-progress)
+        assert_eq!(messages.len(), 3);
+        assert_eq!(messages[0].content, "first");
+        assert_eq!(messages[1].content, "first reply");
+        assert_eq!(messages[2].content, "second (in progress)");
+    }
+
+    #[test]
+    fn test_thread_serialization_round_trip() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        thread.start_turn("hello");
+        thread.complete_turn("world");
+        thread.last_response_id = Some("resp_abc123".to_string());
+
+        let json = serde_json::to_string(&thread).unwrap();
+        let restored: Thread = serde_json::from_str(&json).unwrap();
+
+        assert_eq!(restored.id, thread.id);
+        assert_eq!(restored.session_id, thread.session_id);
+        assert_eq!(restored.turns.len(), 1);
+        assert_eq!(restored.turns[0].user_input, "hello");
+        assert_eq!(restored.turns[0].response, Some("world".to_string()));
+        assert_eq!(restored.last_response_id, Some("resp_abc123".to_string()));
+    }
+
+    #[test]
+    fn test_session_serialization_round_trip() {
+        let mut session = Session::new("user-ser");
+        session.create_thread();
+        session.auto_approve_tool("echo");
+
+        let json = serde_json::to_string(&session).unwrap();
+        let restored: Session = serde_json::from_str(&json).unwrap();
+
+        assert_eq!(restored.user_id, "user-ser");
+        assert_eq!(restored.threads.len(), 1);
+        assert!(restored.is_tool_auto_approved("echo"));
+        assert!(!restored.is_tool_auto_approved("shell"));
+    }
+
+    #[test]
+    fn test_auto_approved_tools() {
+        let mut session = Session::new("user-1");
+
+        assert!(!session.is_tool_auto_approved("shell"));
+        session.auto_approve_tool("shell");
+        assert!(session.is_tool_auto_approved("shell"));
+
+        // Idempotent
+        session.auto_approve_tool("shell");
+        assert_eq!(session.auto_approved_tools.len(), 1);
+    }
+
+    #[test]
+    fn test_turn_tool_call_error() {
+        let mut turn = Turn::new(0, "test");
+        turn.record_tool_call("http", serde_json::json!({"url": "example.com"}));
+        turn.record_tool_error("timeout");
+
+        assert_eq!(turn.tool_calls.len(), 1);
+        assert_eq!(turn.tool_calls[0].error, Some("timeout".to_string()));
+        assert!(turn.tool_calls[0].result.is_none());
+    }
+
+    #[test]
+    fn test_turn_number_increments() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        // Before any turns, turn_number() is 1 (1-indexed for display)
+        assert_eq!(thread.turn_number(), 1);
+
+        thread.start_turn("first");
+        thread.complete_turn("done");
+        assert_eq!(thread.turn_number(), 2);
+
+        thread.start_turn("second");
+        assert_eq!(thread.turn_number(), 3);
+    }
+
+    #[test]
+    fn test_complete_turn_on_empty_thread() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        // Completing a turn when there are no turns should be a safe no-op
+        thread.complete_turn("phantom response");
+        assert_eq!(thread.state, ThreadState::Idle);
+        assert!(thread.turns.is_empty());
+    }
+
+    #[test]
+    fn test_fail_turn_on_empty_thread() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        // Failing a turn when there are no turns should be a safe no-op
+        thread.fail_turn("phantom error");
+        assert_eq!(thread.state, ThreadState::Idle);
+        assert!(thread.turns.is_empty());
+    }
+
+    #[test]
+    fn test_pending_approval_flow() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        let approval = PendingApproval {
+            request_id: Uuid::new_v4(),
+            tool_name: "shell".to_string(),
+            parameters: serde_json::json!({"command": "rm -rf /"}),
+            description: "dangerous command".to_string(),
+            tool_call_id: "call_123".to_string(),
+            context_messages: vec![ChatMessage::user("do it")],
+        };
+
+        thread.await_approval(approval);
+        assert_eq!(thread.state, ThreadState::AwaitingApproval);
+        assert!(thread.pending_approval.is_some());
+
+        let taken = thread.take_pending_approval();
+        assert!(taken.is_some());
+        assert_eq!(taken.unwrap().tool_name, "shell");
+        assert!(thread.pending_approval.is_none());
+    }
+
+    #[test]
+    fn test_clear_pending_approval() {
+        let mut thread = Thread::new(Uuid::new_v4());
+
+        let approval = PendingApproval {
+            request_id: Uuid::new_v4(),
+            tool_name: "http".to_string(),
+            parameters: serde_json::json!({}),
+            description: "test".to_string(),
+            tool_call_id: "call_456".to_string(),
+            context_messages: vec![],
+        };
+
+        thread.await_approval(approval);
+        thread.clear_pending_approval();
+
+        assert_eq!(thread.state, ThreadState::Idle);
+        assert!(thread.pending_approval.is_none());
+    }
+
+    #[test]
+    fn test_active_thread_accessors() {
+        let mut session = Session::new("user-1");
+
+        assert!(session.active_thread().is_none());
+        assert!(session.active_thread_mut().is_none());
+
+        let tid = session.create_thread().id;
+
+        assert!(session.active_thread().is_some());
+        assert_eq!(session.active_thread().unwrap().id, tid);
+
+        // Mutably modify through accessor
+        session.active_thread_mut().unwrap().start_turn("test");
+        assert_eq!(
+            session.active_thread().unwrap().state,
+            ThreadState::Processing
+        );
+    }
 }

src/agent/session_manager.rs

@@ -11,6 +11,7 @@ use uuid::Uuid;
 
 use crate::agent::session::Session;
 use crate::agent::undo::UndoManager;
+use crate::hooks::HookRegistry;
 
 /// Key for mapping external thread IDs to internal ones.
 #[derive(Clone, Hash, Eq, PartialEq)]
@@ -25,6 +26,7 @@ pub struct SessionManager {
     sessions: RwLock<HashMap<String, Arc<Mutex<Session>>>>,
     thread_map: RwLock<HashMap<ThreadKey, Uuid>>,
     undo_managers: RwLock<HashMap<Uuid, Arc<Mutex<UndoManager>>>>,
+    hooks: Option<Arc<HookRegistry>>,
 }
 
 impl SessionManager {
@@ -34,9 +36,16 @@ impl SessionManager {
             sessions: RwLock::new(HashMap::new()),
             thread_map: RwLock::new(HashMap::new()),
             undo_managers: RwLock::new(HashMap::new()),
+            hooks: None,
         }
     }
 
+    /// Attach a hook registry for session lifecycle events.
+    pub fn with_hooks(mut self, hooks: Arc<HookRegistry>) -> Self {
+        self.hooks = Some(hooks);
+        self
+    }
+
     /// Get or create a session for a user.
     pub async fn get_or_create_session(&self, user_id: &str) -> Arc<Mutex<Session>> {
         // Fast path: check if session exists
@@ -54,8 +63,28 @@ impl SessionManager {
             return Arc::clone(session);
         }
 
-        let session = Arc::new(Mutex::new(Session::new(user_id)));
+        let new_session = Session::new(user_id);
+        let session_id = new_session.id.to_string();
+        let session = Arc::new(Mutex::new(new_session));
         sessions.insert(user_id.to_string(), Arc::clone(&session));
+
+        // Fire OnSessionStart hook (fire-and-forget)
+        if let Some(ref hooks) = self.hooks {
+            let hooks = hooks.clone();
+            let uid = user_id.to_string();
+            let sid = session_id;
+            tokio::spawn(async move {
+                use crate::hooks::HookEvent;
+                let event = HookEvent::SessionStart {
+                    user_id: uid,
+                    session_id: sid,
+                };
+                if let Err(e) = hooks.run(&event).await {
+                    tracing::warn!("OnSessionStart hook error: {}", e);
+                }
+            });
+        }
+
         session
     }
 
@@ -110,6 +139,41 @@ impl SessionManager {
         (session, thread_id)
     }
 
+    /// Register a hydrated thread so subsequent `resolve_thread` calls find it.
+    ///
+    /// Inserts into the thread_map and creates an undo manager for the thread.
+    pub async fn register_thread(
+        &self,
+        user_id: &str,
+        channel: &str,
+        thread_id: Uuid,
+        session: Arc<Mutex<Session>>,
+    ) {
+        let key = ThreadKey {
+            user_id: user_id.to_string(),
+            channel: channel.to_string(),
+            external_thread_id: Some(thread_id.to_string()),
+        };
+
+        {
+            let mut thread_map = self.thread_map.write().await;
+            thread_map.insert(key, thread_id);
+        }
+
+        {
+            let mut undo_managers = self.undo_managers.write().await;
+            undo_managers
+                .entry(thread_id)
+                .or_insert_with(|| Arc::new(Mutex::new(UndoManager::new())));
+        }
+
+        // Ensure the session is tracked
+        {
+            let mut sessions = self.sessions.write().await;
+            sessions.entry(user_id.to_string()).or_insert(session);
+        }
+    }
+
     /// Get undo manager for a thread.
     pub async fn get_undo_manager(&self, thread_id: Uuid) -> Arc<Mutex<UndoManager>> {
         // Fast path
@@ -138,8 +202,8 @@ impl SessionManager {
     pub async fn prune_stale_sessions(&self, max_idle: std::time::Duration) -> usize {
         let cutoff = chrono::Utc::now() - chrono::TimeDelta::seconds(max_idle.as_secs() as i64);
 
-        // Find stale session user_ids
-        let stale_users: Vec<String> = {
+        // Find stale sessions (user_id + session_id)
+        let stale_sessions: Vec<(String, String)> = {
             let sessions = self.sessions.read().await;
             sessions
                 .iter()
@@ -147,7 +211,7 @@ impl SessionManager {
                     // Try to lock; skip if contended (someone is actively using it)
                     let sess = session.try_lock().ok()?;
                     if sess.last_active_at < cutoff {
-                        Some(user_id.clone())
+                        Some((user_id.clone(), sess.id.to_string()))
                     } else {
                         None
                     }
@@ -155,6 +219,11 @@ impl SessionManager {
                 .collect()
         };
 
+        let stale_users: Vec<String> = stale_sessions
+            .iter()
+            .map(|(user_id, _)| user_id.clone())
+            .collect();
+
         if stale_users.is_empty() {
             return 0;
         }
@@ -164,14 +233,33 @@ impl SessionManager {
         {
             let sessions = self.sessions.read().await;
             for user_id in &stale_users {
-                if let Some(session) = sessions.get(user_id) {
-                    if let Ok(sess) = session.try_lock() {
-                        stale_thread_ids.extend(sess.threads.keys());
-                    }
+                if let Some(session) = sessions.get(user_id)
+                    && let Ok(sess) = session.try_lock()
+                {
+                    stale_thread_ids.extend(sess.threads.keys());
                 }
             }
         }
 
+        // Fire OnSessionEnd hooks for stale sessions (fire-and-forget)
+        if let Some(ref hooks) = self.hooks {
+            for (user_id, session_id) in &stale_sessions {
+                let hooks = hooks.clone();
+                let uid = user_id.clone();
+                let sid = session_id.clone();
+                tokio::spawn(async move {
+                    use crate::hooks::HookEvent;
+                    let event = HookEvent::SessionEnd {
+                        user_id: uid,
+                        session_id: sid,
+                    };
+                    if let Err(e) = hooks.run(&event).await {
+                        tracing::warn!("OnSessionEnd hook error: {}", e);
+                    }
+                });
+            }
+        }
+
         // Remove sessions
         let count = {
             let mut sessions = self.sessions.write().await;
@@ -296,4 +384,344 @@ mod tests {
             .await;
         assert_eq!(pruned, 0);
     }
+
+    #[tokio::test]
+    async fn test_register_thread() {
+        use crate::agent::session::{Session, Thread};
+
+        let manager = SessionManager::new();
+        let thread_id = Uuid::new_v4();
+
+        // Create a session with a hydrated thread
+        let session = Arc::new(Mutex::new(Session::new("user-hydrate")));
+        {
+            let mut sess = session.lock().await;
+            let thread = Thread::with_id(thread_id, sess.id);
+            sess.threads.insert(thread_id, thread);
+            sess.active_thread = Some(thread_id);
+        }
+
+        // Register the thread
+        manager
+            .register_thread("user-hydrate", "gateway", thread_id, Arc::clone(&session))
+            .await;
+
+        // resolve_thread should find it (using the UUID as external_thread_id)
+        let (resolved_session, resolved_tid) = manager
+            .resolve_thread("user-hydrate", "gateway", Some(&thread_id.to_string()))
+            .await;
+        assert_eq!(resolved_tid, thread_id);
+
+        // Should be the same session object
+        let sess = resolved_session.lock().await;
+        assert!(sess.threads.contains_key(&thread_id));
+    }
+
+    #[tokio::test]
+    async fn test_resolve_thread_with_explicit_external_id() {
+        let manager = SessionManager::new();
+
+        // Two calls with the same explicit external thread ID should resolve
+        // to the same internal thread.
+        let (_, t1) = manager
+            .resolve_thread("user-1", "gateway", Some("ext-abc"))
+            .await;
+        let (_, t2) = manager
+            .resolve_thread("user-1", "gateway", Some("ext-abc"))
+            .await;
+        assert_eq!(t1, t2);
+
+        // A different external ID on the same channel/user gets a new thread.
+        let (_, t3) = manager
+            .resolve_thread("user-1", "gateway", Some("ext-xyz"))
+            .await;
+        assert_ne!(t1, t3);
+    }
+
+    #[tokio::test]
+    async fn test_resolve_thread_none_vs_some_external_id() {
+        let manager = SessionManager::new();
+
+        // None external_thread_id is a distinct key from Some("ext-1").
+        let (_, t_none) = manager.resolve_thread("user-1", "cli", None).await;
+        let (_, t_some) = manager.resolve_thread("user-1", "cli", Some("ext-1")).await;
+        assert_ne!(t_none, t_some);
+    }
+
+    #[tokio::test]
+    async fn test_resolve_thread_different_users_isolated() {
+        let manager = SessionManager::new();
+
+        let (_, t1) = manager
+            .resolve_thread("user-a", "gateway", Some("same-ext"))
+            .await;
+        let (_, t2) = manager
+            .resolve_thread("user-b", "gateway", Some("same-ext"))
+            .await;
+
+        // Same channel + same external ID but different users = different threads
+        assert_ne!(t1, t2);
+    }
+
+    #[tokio::test]
+    async fn test_resolve_thread_different_channels_isolated() {
+        let manager = SessionManager::new();
+
+        let (_, t1) = manager
+            .resolve_thread("user-1", "gateway", Some("thread-x"))
+            .await;
+        let (_, t2) = manager
+            .resolve_thread("user-1", "telegram", Some("thread-x"))
+            .await;
+
+        // Same user + same external ID but different channels = different threads
+        assert_ne!(t1, t2);
+    }
+
+    #[tokio::test]
+    async fn test_resolve_thread_stale_mapping_creates_new_thread() {
+        let manager = SessionManager::new();
+
+        // Create a thread normally
+        let (session, original_tid) = manager
+            .resolve_thread("user-1", "gateway", Some("ext-1"))
+            .await;
+
+        // Simulate the thread being removed from the session (e.g. pruned)
+        {
+            let mut sess = session.lock().await;
+            sess.threads.remove(&original_tid);
+        }
+
+        // Next resolve should detect the stale mapping and create a fresh thread
+        let (_, new_tid) = manager
+            .resolve_thread("user-1", "gateway", Some("ext-1"))
+            .await;
+        assert_ne!(original_tid, new_tid);
+
+        // The new thread should actually exist in the session
+        let sess = session.lock().await;
+        assert!(sess.threads.contains_key(&new_tid));
+    }
+
+    #[tokio::test]
+    async fn test_register_thread_preserves_uuid_on_resolve() {
+        use crate::agent::session::{Session, Thread};
+
+        let manager = SessionManager::new();
+        let known_uuid = Uuid::new_v4();
+
+        let session = Arc::new(Mutex::new(Session::new("user-web")));
+        let session_id = {
+            let sess = session.lock().await;
+            sess.id
+        };
+
+        // Simulate hydration: create thread with a known UUID
+        {
+            let mut sess = session.lock().await;
+            let thread = Thread::with_id(known_uuid, session_id);
+            sess.threads.insert(known_uuid, thread);
+        }
+
+        // Register it
+        manager
+            .register_thread("user-web", "gateway", known_uuid, Arc::clone(&session))
+            .await;
+
+        // resolve_thread with UUID as external_thread_id MUST return the same UUID,
+        // not mint a new one (this was the root cause of the "wrong conversation" bug)
+        let (_, resolved) = manager
+            .resolve_thread("user-web", "gateway", Some(&known_uuid.to_string()))
+            .await;
+        assert_eq!(resolved, known_uuid);
+    }
+
+    #[tokio::test]
+    async fn test_register_thread_idempotent() {
+        use crate::agent::session::{Session, Thread};
+
+        let manager = SessionManager::new();
+        let tid = Uuid::new_v4();
+
+        let session = Arc::new(Mutex::new(Session::new("user-idem")));
+        {
+            let mut sess = session.lock().await;
+            let thread = Thread::with_id(tid, sess.id);
+            sess.threads.insert(tid, thread);
+        }
+
+        // Register twice
+        manager
+            .register_thread("user-idem", "gateway", tid, Arc::clone(&session))
+            .await;
+        manager
+            .register_thread("user-idem", "gateway", tid, Arc::clone(&session))
+            .await;
+
+        // Should still resolve to the same thread
+        let (_, resolved) = manager
+            .resolve_thread("user-idem", "gateway", Some(&tid.to_string()))
+            .await;
+        assert_eq!(resolved, tid);
+    }
+
+    #[tokio::test]
+    async fn test_register_thread_creates_undo_manager() {
+        use crate::agent::session::{Session, Thread};
+
+        let manager = SessionManager::new();
+        let tid = Uuid::new_v4();
+
+        let session = Arc::new(Mutex::new(Session::new("user-undo")));
+        {
+            let mut sess = session.lock().await;
+            let thread = Thread::with_id(tid, sess.id);
+            sess.threads.insert(tid, thread);
+        }
+
+        manager
+            .register_thread("user-undo", "gateway", tid, Arc::clone(&session))
+            .await;
+
+        // Undo manager should exist for the registered thread
+        let undo = manager.get_undo_manager(tid).await;
+        let undo2 = manager.get_undo_manager(tid).await;
+        assert!(Arc::ptr_eq(&undo, &undo2));
+    }
+
+    #[tokio::test]
+    async fn test_register_thread_stores_session() {
+        use crate::agent::session::{Session, Thread};
+
+        let manager = SessionManager::new();
+        let tid = Uuid::new_v4();
+
+        let session = Arc::new(Mutex::new(Session::new("user-new")));
+        {
+            let mut sess = session.lock().await;
+            let thread = Thread::with_id(tid, sess.id);
+            sess.threads.insert(tid, thread);
+        }
+
+        // The user has no session yet in the manager
+        {
+            let sessions = manager.sessions.read().await;
+            assert!(!sessions.contains_key("user-new"));
+        }
+
+        manager
+            .register_thread("user-new", "gateway", tid, Arc::clone(&session))
+            .await;
+
+        // Now the session should be tracked
+        {
+            let sessions = manager.sessions.read().await;
+            assert!(sessions.contains_key("user-new"));
+        }
+    }
+
+    #[tokio::test]
+    async fn test_multiple_threads_per_user() {
+        let manager = SessionManager::new();
+
+        let (_, t1) = manager
+            .resolve_thread("user-1", "gateway", Some("thread-a"))
+            .await;
+        let (_, t2) = manager
+            .resolve_thread("user-1", "gateway", Some("thread-b"))
+            .await;
+        let (session, t3) = manager
+            .resolve_thread("user-1", "gateway", Some("thread-c"))
+            .await;
+
+        // All three should be distinct
+        assert_ne!(t1, t2);
+        assert_ne!(t2, t3);
+        assert_ne!(t1, t3);
+
+        // All three should exist in the same session
+        let sess = session.lock().await;
+        assert!(sess.threads.contains_key(&t1));
+        assert!(sess.threads.contains_key(&t2));
+        assert!(sess.threads.contains_key(&t3));
+    }
+
+    #[tokio::test]
+    async fn test_prune_cleans_thread_map_and_undo_managers() {
+        let manager = SessionManager::new();
+
+        let (stale_session, stale_tid) = manager.resolve_thread("user-stale", "cli", None).await;
+
+        // Backdate the session
+        {
+            let mut sess = stale_session.lock().await;
+            sess.last_active_at = chrono::Utc::now() - chrono::TimeDelta::seconds(86400 * 30);
+        }
+
+        // Verify thread_map and undo_managers have entries
+        {
+            let tm = manager.thread_map.read().await;
+            assert!(!tm.is_empty());
+        }
+        {
+            let um = manager.undo_managers.read().await;
+            assert!(um.contains_key(&stale_tid));
+        }
+
+        let pruned = manager
+            .prune_stale_sessions(std::time::Duration::from_secs(86400 * 7))
+            .await;
+        assert_eq!(pruned, 1);
+
+        // Thread map and undo managers should be cleaned up
+        {
+            let tm = manager.thread_map.read().await;
+            assert!(tm.is_empty());
+        }
+        {
+            let um = manager.undo_managers.read().await;
+            assert!(!um.contains_key(&stale_tid));
+        }
+    }
+
+    #[tokio::test]
+    async fn test_resolve_thread_active_thread_set() {
+        let manager = SessionManager::new();
+
+        let (session, thread_id) = manager
+            .resolve_thread("user-1", "gateway", Some("ext-1"))
+            .await;
+
+        // The resolved thread should be set as the active thread
+        let sess = session.lock().await;
+        assert_eq!(sess.active_thread, Some(thread_id));
+    }
+
+    #[tokio::test]
+    async fn test_register_then_resolve_different_channel_creates_new() {
+        use crate::agent::session::{Session, Thread};
+
+        let manager = SessionManager::new();
+        let tid = Uuid::new_v4();
+
+        let session = Arc::new(Mutex::new(Session::new("user-cross")));
+        {
+            let mut sess = session.lock().await;
+            let thread = Thread::with_id(tid, sess.id);
+            sess.threads.insert(tid, thread);
+        }
+
+        // Register on "gateway" channel
+        manager
+            .register_thread("user-cross", "gateway", tid, Arc::clone(&session))
+            .await;
+
+        // Resolve on a different channel with the same UUID string should NOT
+        // find the registered thread (channel is part of the key)
+        let (_, resolved) = manager
+            .resolve_thread("user-cross", "telegram", Some(&tid.to_string()))
+            .await;
+        assert_ne!(resolved, tid);
+    }
 }

src/agent/submission.rs

@@ -43,6 +43,49 @@ impl SubmissionParser {
         if lower == "/thread new" || lower == "/new" {
             return Submission::NewThread;
         }
+        // System commands (bypass thread-state checks)
+        if lower == "/help" || lower == "/?" {
+            return Submission::SystemCommand {
+                command: "help".to_string(),
+                args: vec![],
+            };
+        }
+        if lower == "/version" {
+            return Submission::SystemCommand {
+                command: "version".to_string(),
+                args: vec![],
+            };
+        }
+        if lower == "/tools" {
+            return Submission::SystemCommand {
+                command: "tools".to_string(),
+                args: vec![],
+            };
+        }
+        if lower == "/ping" {
+            return Submission::SystemCommand {
+                command: "ping".to_string(),
+                args: vec![],
+            };
+        }
+        if lower == "/debug" {
+            return Submission::SystemCommand {
+                command: "debug".to_string(),
+                args: vec![],
+            };
+        }
+        if lower.starts_with("/model") {
+            let args: Vec<String> = trimmed
+                .split_whitespace()
+                .skip(1)
+                .map(|s| s.to_string())
+                .collect();
+            return Submission::SystemCommand {
+                command: "model".to_string(),
+                args,
+            };
+        }
+
         if lower == "/quit" || lower == "/exit" || lower == "/shutdown" {
             return Submission::Quit;
         }
@@ -50,27 +93,26 @@ impl SubmissionParser {
         // /thread <uuid> - switch thread
         if let Some(rest) = lower.strip_prefix("/thread ") {
             let rest = rest.trim();
-            if rest != "new" {
-                if let Ok(id) = Uuid::parse_str(rest) {
-                    return Submission::SwitchThread { thread_id: id };
-                }
+            if rest != "new"
+                && let Ok(id) = Uuid::parse_str(rest)
+            {
+                return Submission::SwitchThread { thread_id: id };
             }
         }
 
         // /resume <uuid> - resume from checkpoint
-        if let Some(rest) = lower.strip_prefix("/resume ") {
-            if let Ok(id) = Uuid::parse_str(rest.trim()) {
-                return Submission::Resume { checkpoint_id: id };
-            }
+        if let Some(rest) = lower.strip_prefix("/resume ")
+            && let Ok(id) = Uuid::parse_str(rest.trim())
+        {
+            return Submission::Resume { checkpoint_id: id };
         }
 
         // Try structured JSON approval (from web gateway's /api/chat/approval endpoint)
-        if trimmed.starts_with('{') {
-            if let Ok(submission) = serde_json::from_str::<Submission>(trimmed) {
-                if matches!(submission, Submission::ExecApproval { .. }) {
-                    return submission;
-                }
-            }
+        if trimmed.starts_with('{')
+            && let Ok(submission) = serde_json::from_str::<Submission>(trimmed)
+            && matches!(submission, Submission::ExecApproval { .. })
+        {
+            return submission;
         }
 
         // Approval responses (simple yes/no/always for pending approvals)
@@ -172,6 +214,15 @@ pub enum Submission {
 
     /// Quit the agent. Bypasses thread-state checks.
     Quit,
+
+    /// System command (help, model, version, tools, ping, debug).
+    /// Bypasses thread-state checks and safety validation.
+    SystemCommand {
+        /// The command name (e.g. "help", "model", "version").
+        command: String,
+        /// Arguments to the command.
+        args: Vec<String>,
+    },
 }
 
 impl Submission {
@@ -238,6 +289,7 @@ impl Submission {
                 | Self::Heartbeat
                 | Self::Summarize
                 | Self::Suggest
+                | Self::SystemCommand { .. }
         )
     }
 }
@@ -504,6 +556,84 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_parser_system_command_help() {
+        let submission = SubmissionParser::parse("/help");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, args } if command == "help" && args.is_empty())
+        );
+
+        let submission = SubmissionParser::parse("/?");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, .. } if command == "help")
+        );
+
+        let submission = SubmissionParser::parse("/HELP");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, .. } if command == "help")
+        );
+    }
+
+    #[test]
+    fn test_parser_system_command_model() {
+        // No args: show current model
+        let submission = SubmissionParser::parse("/model");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, args } if command == "model" && args.is_empty())
+        );
+
+        // With args: switch model
+        let submission = SubmissionParser::parse("/model gpt-4o");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, args } if command == "model" && args == vec!["gpt-4o"])
+        );
+
+        // Case insensitive command, preserves arg case
+        let submission = SubmissionParser::parse("/MODEL Claude-3.5");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, args } if command == "model" && args == vec!["Claude-3.5"])
+        );
+    }
+
+    #[test]
+    fn test_parser_system_command_version() {
+        let submission = SubmissionParser::parse("/version");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, args } if command == "version" && args.is_empty())
+        );
+    }
+
+    #[test]
+    fn test_parser_system_command_tools() {
+        let submission = SubmissionParser::parse("/tools");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, args } if command == "tools" && args.is_empty())
+        );
+    }
+
+    #[test]
+    fn test_parser_system_command_ping() {
+        let submission = SubmissionParser::parse("/ping");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, args } if command == "ping" && args.is_empty())
+        );
+    }
+
+    #[test]
+    fn test_parser_system_command_debug() {
+        let submission = SubmissionParser::parse("/debug");
+        assert!(
+            matches!(submission, Submission::SystemCommand { command, args } if command == "debug" && args.is_empty())
+        );
+    }
+
+    #[test]
+    fn test_parser_system_command_is_control() {
+        let submission = SubmissionParser::parse("/help");
+        assert!(submission.is_control());
+        assert!(!submission.starts_turn());
+    }
+
     #[test]
     fn test_parser_quit() {
         assert!(matches!(SubmissionParser::parse("/quit"), Submission::Quit));

src/agent/undo.rs

@@ -43,6 +43,10 @@ impl Checkpoint {
 }
 
 /// Manager for undo/redo functionality.
+///
+/// Each undo/redo operation pops from one stack and pushes the current state
+/// onto the other, so `undo_count() + redo_count()` stays constant across
+/// undo/redo cycles (only `checkpoint()` and `clear()` change the total).
 pub struct UndoManager {
     /// Stack of past checkpoints (for undo).
     undo_stack: VecDeque<Checkpoint>,
@@ -68,6 +72,14 @@ impl UndoManager {
         self
     }
 
+    /// Push a checkpoint onto the undo stack, trimming oldest entries if over limit.
+    fn push_undo(&mut self, checkpoint: Checkpoint) {
+        self.undo_stack.push_back(checkpoint);
+        while self.undo_stack.len() > self.max_checkpoints {
+            self.undo_stack.pop_front();
+        }
+    }
+
     /// Create a checkpoint at the current state.
     ///
     /// This clears the redo stack since we're creating a new history branch.
@@ -80,24 +92,23 @@ impl UndoManager {
         // Clear redo stack (new branch of history)
         self.redo_stack.clear();
 
-        // Create and push checkpoint
         let checkpoint = Checkpoint::new(turn_number, messages, description);
-        self.undo_stack.push_back(checkpoint);
-
-        // Trim if over limit
-        while self.undo_stack.len() > self.max_checkpoints {
-            self.undo_stack.pop_front();
-        }
+        self.push_undo(checkpoint);
     }
 
     /// Undo: pop the last checkpoint and return it.
     ///
-    /// The current state should be saved to redo stack before calling this.
+    /// Saves the current state to the redo stack and pops the most recent
+    /// checkpoint from the undo stack so that repeated undos walk backwards
+    /// through history.
+    ///
+    /// Takes ownership of `current_messages`; callers must clone first if
+    /// they need to retain a copy.
     pub fn undo(
         &mut self,
         current_turn: usize,
         current_messages: Vec<ChatMessage>,
-    ) -> Option<&Checkpoint> {
+    ) -> Option<Checkpoint> {
         if self.undo_stack.is_empty() {
             return None;
         }
@@ -110,9 +121,8 @@ impl UndoManager {
         );
         self.redo_stack.push(current);
 
-        // Return the most recent checkpoint without removing it
-        // (we keep it so multiple undos can work)
-        self.undo_stack.back()
+        // Pop and return the most recent checkpoint
+        self.undo_stack.pop_back()
     }
 
     /// Pop the last checkpoint from the undo stack.
@@ -121,7 +131,29 @@ impl UndoManager {
     }
 
     /// Redo: restore a previously undone state.
-    pub fn redo(&mut self) -> Option<Checkpoint> {
+    ///
+    /// Saves the current state to the undo stack and pops the most recent
+    /// checkpoint from the redo stack.
+    ///
+    /// Takes ownership of `current_messages`; callers must clone first if
+    /// they need to retain a copy.
+    pub fn redo(
+        &mut self,
+        current_turn: usize,
+        current_messages: Vec<ChatMessage>,
+    ) -> Option<Checkpoint> {
+        if self.redo_stack.is_empty() {
+            return None;
+        }
+
+        // Save current state to undo stack
+        let current = Checkpoint::new(
+            current_turn,
+            current_messages,
+            format!("Turn {}", current_turn),
+        );
+        self.push_undo(current);
+
         self.redo_stack.pop()
     }
 
@@ -214,14 +246,16 @@ mod tests {
         assert!(manager.can_undo());
         assert!(!manager.can_redo());
 
-        // Undo
+        // Undo - returns owned Checkpoint now
         let current = vec![ChatMessage::user("Hello"), ChatMessage::assistant("Hi")];
         let checkpoint = manager.undo(2, current);
         assert!(checkpoint.is_some());
+        let checkpoint = checkpoint.unwrap();
+        assert_eq!(checkpoint.turn_number, 1);
         assert!(manager.can_redo());
 
-        // Redo
-        let restored = manager.redo();
+        // Redo - now requires current state parameters
+        let restored = manager.redo(checkpoint.turn_number, checkpoint.messages);
         assert!(restored.is_some());
     }
 
@@ -249,4 +283,90 @@ mod tests {
         assert!(restored.is_some());
         assert_eq!(manager.undo_count(), 0);
     }
+
+    #[test]
+    fn test_repeated_undo_advances_through_stack() {
+        let mut manager = UndoManager::new();
+
+        // Create 3 checkpoints at turns 0, 1, 2
+        manager.checkpoint(0, vec![], "Turn 0");
+        manager.checkpoint(1, vec![ChatMessage::user("msg1")], "Turn 1");
+        manager.checkpoint(2, vec![ChatMessage::user("msg2")], "Turn 2");
+        assert_eq!(manager.undo_count(), 3);
+
+        // First undo: should return turn 2 checkpoint, stack shrinks to 2
+        let cp1 = manager
+            .undo(3, vec![ChatMessage::user("msg3")])
+            .expect("first undo should succeed");
+        assert_eq!(cp1.turn_number, 2);
+        assert_eq!(manager.undo_count(), 2);
+
+        // Second undo: should return turn 1 checkpoint (different!), stack shrinks to 1
+        let cp2 = manager
+            .undo(cp1.turn_number, cp1.messages)
+            .expect("second undo should succeed");
+        assert_eq!(cp2.turn_number, 1);
+        assert_eq!(manager.undo_count(), 1);
+
+        // Verify we walked backwards through distinct checkpoints
+        assert_ne!(cp1.turn_number, cp2.turn_number);
+    }
+
+    #[test]
+    fn test_undo_redo_cycle_preserves_state() {
+        let mut manager = UndoManager::new();
+
+        let msgs_t0: Vec<ChatMessage> = vec![];
+        let msgs_t1 = vec![ChatMessage::user("hello")];
+        let msgs_t2 = vec![ChatMessage::user("hello"), ChatMessage::assistant("hi")];
+
+        manager.checkpoint(0, msgs_t0, "Turn 0");
+        manager.checkpoint(1, msgs_t1, "Turn 1");
+
+        // Undo from turn 2 -> get turn 1 checkpoint
+        let cp_undo1 = manager
+            .undo(2, msgs_t2.clone())
+            .expect("undo should succeed");
+        assert_eq!(cp_undo1.turn_number, 1);
+
+        // Redo from turn 1 -> get turn 2 state back
+        let cp_redo = manager
+            .redo(cp_undo1.turn_number, cp_undo1.messages)
+            .expect("redo should succeed");
+        assert_eq!(cp_redo.turn_number, 2);
+        assert_eq!(cp_redo.messages.len(), 2);
+
+        // Undo again from turn 2 -> should go back to turn 1 again
+        let cp_undo2 = manager
+            .undo(cp_redo.turn_number, cp_redo.messages)
+            .expect("second undo should succeed");
+        assert_eq!(cp_undo2.turn_number, 1);
+    }
+
+    #[test]
+    fn test_undo_redo_stack_sizes_consistent() {
+        let mut manager = UndoManager::new();
+
+        manager.checkpoint(0, vec![], "Turn 0");
+        manager.checkpoint(1, vec![ChatMessage::user("a")], "Turn 1");
+        manager.checkpoint(2, vec![ChatMessage::user("b")], "Turn 2");
+
+        // Start: undo=3, redo=0, total=3
+        let total = manager.undo_count() + manager.redo_count();
+        assert_eq!(total, 3);
+
+        // After undo: total should still be 3 (one moved from undo to redo,
+        // plus the current state pushed to redo)
+        // Actually: undo pops one (3->2), pushes current to redo (0->1), total=3
+        let cp = manager.undo(3, vec![]).unwrap();
+        assert_eq!(manager.undo_count() + manager.redo_count(), 3);
+
+        // After redo: redo pops one (1->0), pushes current to undo (2->3), total=3
+        let cp2 = manager.redo(cp.turn_number, cp.messages).unwrap();
+        assert_eq!(manager.undo_count() + manager.redo_count(), 3);
+
+        // After another undo: same invariant
+        let _cp3 = manager.undo(cp2.turn_number, cp2.messages).unwrap();
+        assert_eq!(manager.undo_count() + manager.redo_count(), 3);
+    }
 }

src/agent/worker.rs

@@ -10,8 +10,9 @@ use uuid::Uuid;
 use crate::agent::scheduler::WorkerMessage;
 use crate::agent::task::TaskOutput;
 use crate::context::{ContextManager, JobState};
+use crate::db::Database;
 use crate::error::Error;
-use crate::history::Store;
+use crate::hooks::HookRegistry;
 use crate::llm::{
     ActionPlan, ChatMessage, LlmProvider, Reasoning, ReasoningContext, RespondResult, ToolSelection,
 };
@@ -28,7 +29,8 @@ pub struct WorkerDeps {
     pub llm: Arc<dyn LlmProvider>,
     pub safety: Arc<SafetyLayer>,
     pub tools: Arc<ToolRegistry>,
-    pub store: Option<Arc<Store>>,
+    pub store: Option<Arc<dyn Database>>,
+    pub hooks: Arc<HookRegistry>,
     pub timeout: Duration,
     pub use_planning: bool,
 }
@@ -67,7 +69,7 @@ impl Worker {
         &self.deps.tools
     }
 
-    fn store(&self) -> Option<&Arc<Store>> {
+    fn store(&self) -> Option<&Arc<dyn Database>> {
         self.deps.store.as_ref()
     }
 
@@ -227,11 +229,11 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
             }
 
             // Check for cancellation
-            if let Ok(ctx) = self.context_manager().get_context(self.job_id).await {
-                if ctx.state == JobState::Cancelled {
-                    tracing::info!("Worker for job {} detected cancellation", self.job_id);
-                    return Ok(());
-                }
+            if let Ok(ctx) = self.context_manager().get_context(self.job_id).await
+                && ctx.state == JobState::Cancelled
+            {
+                tracing::info!("Worker for job {} detected cancellation", self.job_id);
+                return Ok(());
             }
 
             iteration += 1;
@@ -248,16 +250,15 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
 
             if selections.is_empty() {
                 // No tools from select_tools, ask LLM directly (may still return tool calls)
-                let respond_result = reasoning.respond_with_tools(reason_ctx).await?;
+                let respond_output = reasoning.respond_with_tools(reason_ctx).await?;
 
-                match respond_result {
+                match respond_output.result {
                     RespondResult::Text(response) => {
-                        // Check for completion keywords
-                        let response_lower = response.to_lowercase();
-                        if response_lower.contains("complete")
-                            || response_lower.contains("finished")
-                            || response_lower.contains("done")
-                        {
+                        // Check for explicit completion phrases. Use word-boundary
+                        // aware checks to avoid false positives like "incomplete",
+                        // "not done", or "unfinished". Only the LLM's own response
+                        // (not tool output) can trigger this.
+                        if crate::util::llm_signals_completion(&response) {
                             self.mark_completed().await?;
                             return Ok(());
                         }
@@ -272,7 +273,10 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                             ));
                         }
                     }
-                    RespondResult::ToolCalls(tool_calls) => {
+                    RespondResult::ToolCalls {
+                        tool_calls,
+                        content,
+                    } => {
                         // Model returned tool calls - execute them
                         tracing::debug!(
                             "Job {} respond_with_tools returned {} tool calls",
@@ -280,6 +284,14 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                             tool_calls.len()
                         );
 
+                        // Add assistant message with tool_calls (OpenAI protocol)
+                        reason_ctx
+                            .messages
+                            .push(ChatMessage::assistant_with_tool_calls(
+                                content,
+                                tool_calls.clone(),
+                            ));
+
                         for tc in tool_calls {
                             let result = self.execute_tool(&tc.name, &tc.arguments).await;
 
@@ -289,6 +301,7 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                                 parameters: tc.arguments.clone(),
                                 reasoning: String::new(),
                                 alternatives: vec![],
+                                tool_call_id: tc.id.clone(),
                             };
 
                             self.process_tool_result(reason_ctx, &selection, result)
@@ -341,23 +354,11 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
             .map(|selection| {
                 let tool_name = selection.tool_name.clone();
                 let params = selection.parameters.clone();
-                let tools = self.tools().clone();
-                let context_manager = self.context_manager().clone();
-                let safety = self.safety().clone();
+                let deps = self.deps.clone();
                 let job_id = self.job_id;
-                let store = self.deps.store.clone();
 
                 async move {
-                    let result = Self::execute_tool_inner(
-                        tools,
-                        context_manager,
-                        safety,
-                        store,
-                        job_id,
-                        &tool_name,
-                        &params,
-                    )
-                    .await;
+                    let result = Self::execute_tool_inner(&deps, job_id, &tool_name, &params).await;
                     ToolExecResult { result }
                 }
             })
@@ -368,20 +369,18 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
 
     /// Inner tool execution logic that can be called from both single and parallel paths.
     async fn execute_tool_inner(
-        tools: Arc<ToolRegistry>,
-        context_manager: Arc<ContextManager>,
-        safety: Arc<SafetyLayer>,
-        store: Option<Arc<Store>>,
+        deps: &WorkerDeps,
         job_id: Uuid,
         tool_name: &str,
         params: &serde_json::Value,
     ) -> Result<String, Error> {
-        let tool = tools
-            .get(tool_name)
-            .await
-            .ok_or_else(|| crate::error::ToolError::NotFound {
-                name: tool_name.to_string(),
-            })?;
+        let tool =
+            deps.tools
+                .get(tool_name)
+                .await
+                .ok_or_else(|| crate::error::ToolError::NotFound {
+                    name: tool_name.to_string(),
+                })?;
 
         // Tools requiring approval are blocked in autonomous jobs
         if tool.requires_approval() {
@@ -391,8 +390,46 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
             .into());
         }
 
-        // Get job context for the tool
-        let job_ctx = context_manager.get_context(job_id).await?;
+        // Fetch job context early so we have the real user_id for hooks
+        let job_ctx = deps.context_manager.get_context(job_id).await?;
+
+        // Run BeforeToolCall hook
+        let params = {
+            use crate::hooks::{HookError, HookEvent, HookOutcome};
+            let event = HookEvent::ToolCall {
+                tool_name: tool_name.to_string(),
+                parameters: params.clone(),
+                user_id: job_ctx.user_id.clone(),
+                context: format!("job:{}", job_id),
+            };
+            match deps.hooks.run(&event).await {
+                Err(HookError::Rejected { reason }) => {
+                    return Err(crate::error::ToolError::ExecutionFailed {
+                        name: tool_name.to_string(),
+                        reason: format!("Blocked by hook: {}", reason),
+                    }
+                    .into());
+                }
+                Err(err) => {
+                    return Err(crate::error::ToolError::ExecutionFailed {
+                        name: tool_name.to_string(),
+                        reason: format!("Blocked by hook failure mode: {}", err),
+                    }
+                    .into());
+                }
+                Ok(HookOutcome::Continue {
+                    modified: Some(new_params),
+                }) => serde_json::from_str(&new_params).unwrap_or_else(|e| {
+                    tracing::warn!(
+                        tool = %tool_name,
+                        "Hook returned non-JSON modification for ToolCall, ignoring: {}",
+                        e
+                    );
+                    params.clone()
+                }),
+                _ => params.clone(),
+            }
+        };
         if job_ctx.state == JobState::Cancelled {
             return Err(crate::error::ToolError::ExecutionFailed {
                 name: tool_name.to_string(),
@@ -402,7 +439,7 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
         }
 
         // Validate tool parameters
-        let validation = safety.validator().validate_tool_params(params);
+        let validation = deps.safety.validator().validate_tool_params(&params);
         if !validation.is_valid {
             let details = validation
                 .errors
@@ -417,21 +454,58 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
             .into());
         }
 
-        // Execute with timeout and timing
+        tracing::debug!(
+            tool = %tool_name,
+            params = %params,
+            job = %job_id,
+            "Tool call started"
+        );
+
+        // Execute with per-tool timeout and timing
+        let tool_timeout = tool.execution_timeout();
         let start = std::time::Instant::now();
-        let result = tokio::time::timeout(Duration::from_secs(60), async {
+        let result = tokio::time::timeout(tool_timeout, async {
             tool.execute(params.clone(), &job_ctx).await
         })
         .await;
         let elapsed = start.elapsed();
 
+        match &result {
+            Ok(Ok(output)) => {
+                let result_str = serde_json::to_string(&output.result)
+                    .unwrap_or_else(|_| "<serialize error>".to_string());
+                tracing::debug!(
+                    tool = %tool_name,
+                    elapsed_ms = elapsed.as_millis() as u64,
+                    result = %result_str,
+                    "Tool call succeeded"
+                );
+            }
+            Ok(Err(e)) => {
+                tracing::debug!(
+                    tool = %tool_name,
+                    elapsed_ms = elapsed.as_millis() as u64,
+                    error = %e,
+                    "Tool call failed"
+                );
+            }
+            Err(_) => {
+                tracing::debug!(
+                    tool = %tool_name,
+                    elapsed_ms = elapsed.as_millis() as u64,
+                    timeout_secs = tool_timeout.as_secs(),
+                    "Tool call timed out"
+                );
+            }
+        }
+
         // Record action in memory and get the ActionRecord for persistence
         let action = match &result {
             Ok(Ok(output)) => {
                 let output_str = serde_json::to_string_pretty(&output.result)
                     .ok()
-                    .map(|s| safety.sanitize_tool_output(tool_name, &s).content);
-                context_manager
+                    .map(|s| deps.safety.sanitize_tool_output(tool_name, &s).content);
+                deps.context_manager
                     .update_memory(job_id, |mem| {
                         let rec = mem.create_action(tool_name, params.clone()).succeed(
                             output_str.clone(),
@@ -444,7 +518,8 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                     .await
                     .ok()
             }
-            Ok(Err(e)) => context_manager
+            Ok(Err(e)) => deps
+                .context_manager
                 .update_memory(job_id, |mem| {
                     let rec = mem
                         .create_action(tool_name, params.clone())
@@ -454,7 +529,8 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                 })
                 .await
                 .ok(),
-            Err(_) => context_manager
+            Err(_) => deps
+                .context_manager
                 .update_memory(job_id, |mem| {
                     let rec = mem
                         .create_action(tool_name, params.clone())
@@ -467,7 +543,7 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
         };
 
         // Persist action to database (fire-and-forget)
-        if let (Some(action), Some(store)) = (action, store) {
+        if let (Some(action), Some(store)) = (action, deps.store.clone()) {
             tokio::spawn(async move {
                 if let Err(e) = store.save_action(job_id, &action).await {
                     tracing::warn!("Failed to persist action for job {}: {}", job_id, e);
@@ -479,7 +555,7 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
         let output = result
             .map_err(|_| crate::error::ToolError::Timeout {
                 name: tool_name.to_string(),
-                timeout: Duration::from_secs(60),
+                timeout: tool_timeout,
             })?
             .map_err(|e| crate::error::ToolError::ExecutionFailed {
                 name: tool_name.to_string(),
@@ -518,17 +594,14 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                 );
 
                 reason_ctx.messages.push(ChatMessage::tool_result(
-                    "tool_call_id",
+                    &selection.tool_call_id,
                     &selection.tool_name,
                     wrapped,
                 ));
 
-                // Check if job is complete
-                if output.contains("TASK_COMPLETE") || output.contains("JOB_DONE") {
-                    self.mark_completed().await?;
-                    return Ok(true);
-                }
-
+                // Tool output never drives job completion. A malicious tool could
+                // emit "TASK_COMPLETE" to force premature completion. Only the LLM's
+                // own structured response (in execution_loop) can mark a job done.
                 Ok(false)
             }
             Err(e) => {
@@ -553,7 +626,7 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                 }
 
                 reason_ctx.messages.push(ChatMessage::tool_result(
-                    "tool_call_id",
+                    &selection.tool_call_id,
                     &selection.tool_name,
                     format!("Error: {}", e),
                 ));
@@ -603,12 +676,15 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                 .execute_tool(&action.tool_name, &action.parameters)
                 .await;
 
-            // Create a synthetic ToolSelection for process_tool_result
+            // Create a synthetic ToolSelection for process_tool_result.
+            // Plan actions don't originate from an LLM tool_call response so
+            // there is no real tool_call_id; generate a unique one.
             let selection = ToolSelection {
                 tool_name: action.tool_name.clone(),
                 parameters: action.parameters.clone(),
                 reasoning: action.reasoning.clone(),
                 alternatives: vec![],
+                tool_call_id: format!("plan_{}_{}", self.job_id, i),
             };
 
             // Process the result
@@ -632,11 +708,7 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
         let response = reasoning.respond(reason_ctx).await?;
         reason_ctx.messages.push(ChatMessage::assistant(&response));
 
-        let response_lower = response.to_lowercase();
-        if response_lower.contains("complete")
-            || response_lower.contains("finished")
-            || response_lower.contains("done")
-        {
+        if crate::util::llm_signals_completion(&response) {
             self.mark_completed().await?;
         } else {
             // Job not complete, could re-plan or fall back to direct selection
@@ -657,16 +729,7 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
         tool_name: &str,
         params: &serde_json::Value,
     ) -> Result<String, Error> {
-        Self::execute_tool_inner(
-            self.tools().clone(),
-            self.context_manager().clone(),
-            self.safety().clone(),
-            self.deps.store.clone(),
-            self.job_id,
-            tool_name,
-            params,
-        )
-        .await
+        Self::execute_tool_inner(&self.deps, self.job_id, tool_name, params).await
     }
 
     async fn mark_completed(&self) -> Result<(), Error> {
@@ -731,3 +794,86 @@ impl From<TaskOutput> for Result<String, Error> {
         })
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::llm::ToolSelection;
+    use crate::util::llm_signals_completion;
+
+    #[test]
+    fn test_tool_selection_preserves_call_id() {
+        let selection = ToolSelection {
+            tool_name: "memory_search".to_string(),
+            parameters: serde_json::json!({"query": "test"}),
+            reasoning: "Need to search memory".to_string(),
+            alternatives: vec![],
+            tool_call_id: "call_abc123".to_string(),
+        };
+
+        assert_eq!(selection.tool_call_id, "call_abc123");
+        assert_ne!(
+            selection.tool_call_id, "tool_call_id",
+            "tool_call_id must not be the hardcoded placeholder string"
+        );
+    }
+
+    #[test]
+    fn test_completion_positive_signals() {
+        assert!(llm_signals_completion("The job is complete."));
+        assert!(llm_signals_completion(
+            "I have completed the task successfully."
+        ));
+        assert!(llm_signals_completion("The task is done."));
+        assert!(llm_signals_completion("The task is finished."));
+        assert!(llm_signals_completion(
+            "All steps are complete and verified."
+        ));
+        assert!(llm_signals_completion(
+            "I've done all the work. The work is done."
+        ));
+        assert!(llm_signals_completion(
+            "Successfully completed the migration."
+        ));
+    }
+
+    #[test]
+    fn test_completion_negative_signals_block_false_positives() {
+        // These contain completion keywords but also negation, should NOT trigger.
+        assert!(!llm_signals_completion("The task is not complete yet."));
+        assert!(!llm_signals_completion("This is not done."));
+        assert!(!llm_signals_completion("The work is incomplete."));
+        assert!(!llm_signals_completion(
+            "The migration is not yet finished."
+        ));
+        assert!(!llm_signals_completion("The job isn't done yet."));
+        assert!(!llm_signals_completion("This remains unfinished."));
+    }
+
+    #[test]
+    fn test_completion_does_not_match_bare_substrings() {
+        // Bare words embedded in other text should NOT trigger completion.
+        assert!(!llm_signals_completion(
+            "I need to complete more work first."
+        ));
+        assert!(!llm_signals_completion(
+            "Let me finish the remaining steps."
+        ));
+        assert!(!llm_signals_completion(
+            "I'm done analyzing, now let me fix it."
+        ));
+        assert!(!llm_signals_completion(
+            "I completed step 1 but step 2 remains."
+        ));
+    }
+
+    #[test]
+    fn test_completion_tool_output_injection() {
+        // A malicious tool output echoed by the LLM should not trigger
+        // completion unless it forms a genuine completion phrase.
+        assert!(!llm_signals_completion("TASK_COMPLETE"));
+        assert!(!llm_signals_completion("JOB_DONE"));
+        assert!(!llm_signals_completion(
+            "The tool returned: TASK_COMPLETE signal"
+        ));
+    }
+}

src/boot_screen.rs

@@ -0,0 +1,208 @@
+//! Boot screen displayed after all initialization completes.
+//!
+//! Shows a polished ANSI-styled status panel summarizing the agent's runtime
+//! state: model, database, tool count, enabled features, active channels,
+//! and the gateway URL.
+
+/// All displayable fields for the boot screen.
+pub struct BootInfo {
+    pub version: String,
+    pub agent_name: String,
+    pub llm_backend: String,
+    pub llm_model: String,
+    pub cheap_model: Option<String>,
+    pub db_backend: String,
+    pub db_connected: bool,
+    pub tool_count: usize,
+    pub gateway_url: Option<String>,
+    pub embeddings_enabled: bool,
+    pub embeddings_provider: Option<String>,
+    pub heartbeat_enabled: bool,
+    pub heartbeat_interval_secs: u64,
+    pub sandbox_enabled: bool,
+    pub claude_code_enabled: bool,
+    pub routines_enabled: bool,
+    pub channels: Vec<String>,
+}
+
+/// Print the boot screen to stdout.
+pub fn print_boot_screen(info: &BootInfo) {
+    // ANSI codes matching existing REPL palette
+    let bold = "\x1b[1m";
+    let cyan = "\x1b[36m";
+    let dim = "\x1b[90m";
+    let yellow_underline = "\x1b[33;4m";
+    let reset = "\x1b[0m";
+
+    let border = format!("  {dim}{}{reset}", "\u{2576}".repeat(58));
+
+    println!();
+    println!("{border}");
+    println!();
+    println!("  {bold}{}{reset} v{}", info.agent_name, info.version);
+    println!();
+
+    // Model line
+    let model_display = if let Some(ref cheap) = info.cheap_model {
+        format!(
+            "{cyan}{}{reset}  {dim}cheap{reset} {cyan}{}{reset}",
+            info.llm_model, cheap
+        )
+    } else {
+        format!("{cyan}{}{reset}", info.llm_model)
+    };
+    println!(
+        "  {dim}model{reset}     {model_display}  {dim}via {}{reset}",
+        info.llm_backend
+    );
+
+    // Database line
+    let db_status = if info.db_connected {
+        "connected"
+    } else {
+        "none"
+    };
+    println!(
+        "  {dim}database{reset}  {cyan}{}{reset} {dim}({db_status}){reset}",
+        info.db_backend
+    );
+
+    // Tools line
+    println!(
+        "  {dim}tools{reset}     {cyan}{}{reset} {dim}registered{reset}",
+        info.tool_count
+    );
+
+    // Features line
+    let mut features = Vec::new();
+    if info.embeddings_enabled {
+        if let Some(ref provider) = info.embeddings_provider {
+            features.push(format!("embeddings ({provider})"));
+        } else {
+            features.push("embeddings".to_string());
+        }
+    }
+    if info.heartbeat_enabled {
+        let mins = info.heartbeat_interval_secs / 60;
+        features.push(format!("heartbeat ({mins}m)"));
+    }
+    if info.sandbox_enabled {
+        features.push("sandbox".to_string());
+    }
+    if info.claude_code_enabled {
+        features.push("claude-code".to_string());
+    }
+    if info.routines_enabled {
+        features.push("routines".to_string());
+    }
+    if !features.is_empty() {
+        println!(
+            "  {dim}features{reset}  {cyan}{}{reset}",
+            features.join("  ")
+        );
+    }
+
+    // Channels line
+    if !info.channels.is_empty() {
+        println!(
+            "  {dim}channels{reset}  {cyan}{}{reset}",
+            info.channels.join("  ")
+        );
+    }
+
+    // Gateway URL (highlighted)
+    if let Some(ref url) = info.gateway_url {
+        println!();
+        println!("  {dim}gateway{reset}   {yellow_underline}{url}{reset}");
+    }
+
+    println!();
+    println!("{border}");
+    println!();
+    println!("  /help for commands, /quit to exit");
+    println!();
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_print_boot_screen_full() {
+        let info = BootInfo {
+            version: "0.2.0".to_string(),
+            agent_name: "ironclaw".to_string(),
+            llm_backend: "nearai".to_string(),
+            llm_model: "claude-3-5-sonnet-20241022".to_string(),
+            cheap_model: Some("gpt-4o-mini".to_string()),
+            db_backend: "libsql".to_string(),
+            db_connected: true,
+            tool_count: 24,
+            gateway_url: Some("http://127.0.0.1:3001/?token=abc123".to_string()),
+            embeddings_enabled: true,
+            embeddings_provider: Some("openai".to_string()),
+            heartbeat_enabled: true,
+            heartbeat_interval_secs: 1800,
+            sandbox_enabled: true,
+            claude_code_enabled: false,
+            routines_enabled: true,
+            channels: vec![
+                "repl".to_string(),
+                "gateway".to_string(),
+                "telegram".to_string(),
+            ],
+        };
+        // Should not panic
+        print_boot_screen(&info);
+    }
+
+    #[test]
+    fn test_print_boot_screen_minimal() {
+        let info = BootInfo {
+            version: "0.2.0".to_string(),
+            agent_name: "ironclaw".to_string(),
+            llm_backend: "nearai".to_string(),
+            llm_model: "gpt-4o".to_string(),
+            cheap_model: None,
+            db_backend: "none".to_string(),
+            db_connected: false,
+            tool_count: 5,
+            gateway_url: None,
+            embeddings_enabled: false,
+            embeddings_provider: None,
+            heartbeat_enabled: false,
+            heartbeat_interval_secs: 0,
+            sandbox_enabled: false,
+            claude_code_enabled: false,
+            routines_enabled: false,
+            channels: vec![],
+        };
+        // Should not panic
+        print_boot_screen(&info);
+    }
+
+    #[test]
+    fn test_print_boot_screen_no_features() {
+        let info = BootInfo {
+            version: "0.1.0".to_string(),
+            agent_name: "test".to_string(),
+            llm_backend: "openai".to_string(),
+            llm_model: "gpt-4o".to_string(),
+            cheap_model: None,
+            db_backend: "postgres".to_string(),
+            db_connected: true,
+            tool_count: 10,
+            gateway_url: None,
+            embeddings_enabled: false,
+            embeddings_provider: None,
+            heartbeat_enabled: false,
+            heartbeat_interval_secs: 0,
+            sandbox_enabled: false,
+            claude_code_enabled: false,
+            routines_enabled: false,
+            channels: vec!["repl".to_string()],
+        };
+        // Should not panic
+        print_boot_screen(&info);
+    }
+}

src/bootstrap.rs

@@ -0,0 +1,464 @@
+//! Bootstrap helpers for IronClaw.
+//!
+//! The only setting that truly needs disk persistence before the database is
+//! available is `DATABASE_URL` (chicken-and-egg: can't connect to DB without
+//! it). Everything else is auto-detected or read from env vars.
+//!
+//! File: `~/.ironclaw/.env` (standard dotenvy format)
+
+use std::path::PathBuf;
+
+/// Path to the IronClaw-specific `.env` file: `~/.ironclaw/.env`.
+pub fn ironclaw_env_path() -> PathBuf {
+    dirs::home_dir()
+        .unwrap_or_else(|| PathBuf::from("."))
+        .join(".ironclaw")
+        .join(".env")
+}
+
+/// Load env vars from `~/.ironclaw/.env` (in addition to the standard `.env`).
+///
+/// Call this **after** `dotenvy::dotenv()` so that the standard `./.env`
+/// takes priority over `~/.ironclaw/.env`. dotenvy never overwrites
+/// existing env vars, so the effective priority is:
+///
+///   explicit env vars > `./.env` > `~/.ironclaw/.env`
+///
+/// If `~/.ironclaw/.env` doesn't exist but the legacy `bootstrap.json` does,
+/// extracts `DATABASE_URL` from it and writes the `.env` file (one-time
+/// upgrade from the old config format).
+pub fn load_ironclaw_env() {
+    let path = ironclaw_env_path();
+
+    if !path.exists() {
+        // One-time upgrade: extract DATABASE_URL from legacy bootstrap.json
+        migrate_bootstrap_json_to_env(&path);
+    }
+
+    if path.exists() {
+        let _ = dotenvy::from_path(&path);
+    }
+}
+
+/// If `bootstrap.json` exists, pull `database_url` out of it and write `.env`.
+fn migrate_bootstrap_json_to_env(env_path: &std::path::Path) {
+    let ironclaw_dir = env_path
+        .parent()
+        .unwrap_or_else(|| std::path::Path::new("."));
+    let bootstrap_path = ironclaw_dir.join("bootstrap.json");
+
+    if !bootstrap_path.exists() {
+        return;
+    }
+
+    let content = match std::fs::read_to_string(&bootstrap_path) {
+        Ok(c) => c,
+        Err(_) => return,
+    };
+
+    // Minimal parse: just grab database_url from the JSON
+    let parsed: serde_json::Value = match serde_json::from_str(&content) {
+        Ok(v) => v,
+        Err(_) => return,
+    };
+
+    if let Some(url) = parsed.get("database_url").and_then(|v| v.as_str()) {
+        if let Some(parent) = env_path.parent()
+            && let Err(e) = std::fs::create_dir_all(parent)
+        {
+            eprintln!("Warning: failed to create {}: {}", parent.display(), e);
+            return;
+        }
+        if let Err(e) = std::fs::write(env_path, format!("DATABASE_URL=\"{}\"\n", url)) {
+            eprintln!("Warning: failed to migrate bootstrap.json to .env: {}", e);
+            return;
+        }
+        rename_to_migrated(&bootstrap_path);
+        eprintln!(
+            "Migrated DATABASE_URL from bootstrap.json to {}",
+            env_path.display()
+        );
+    }
+}
+
+/// Write database bootstrap vars to `~/.ironclaw/.env`.
+///
+/// These settings form the chicken-and-egg layer: they must be available
+/// from the filesystem (env vars) BEFORE any database connection, because
+/// they determine which database to connect to. Everything else is stored
+/// in the database itself.
+///
+/// Creates the parent directory if it doesn't exist.
+/// Values are double-quoted so that `#` (common in URL-encoded passwords)
+/// and other shell-special characters are preserved by dotenvy.
+pub fn save_bootstrap_env(vars: &[(&str, &str)]) -> std::io::Result<()> {
+    let path = ironclaw_env_path();
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    let mut content = String::new();
+    for (key, value) in vars {
+        content.push_str(&format!("{}=\"{}\"\n", key, value));
+    }
+    std::fs::write(&path, content)
+}
+
+/// Write `DATABASE_URL` to `~/.ironclaw/.env`.
+///
+/// Convenience wrapper around `save_bootstrap_env` for single-value migration
+/// paths. Prefer `save_bootstrap_env` for new code.
+pub fn save_database_url(url: &str) -> std::io::Result<()> {
+    save_bootstrap_env(&[("DATABASE_URL", url)])
+}
+
+/// One-time migration of legacy `~/.ironclaw/settings.json` into the database.
+///
+/// Only runs when a `settings.json` exists on disk AND the DB has no settings
+/// yet. After the wizard writes directly to the DB, this path is only hit by
+/// users upgrading from the old disk-only configuration.
+///
+/// After syncing, renames `settings.json` to `.migrated` so it won't trigger again.
+pub async fn migrate_disk_to_db(
+    store: &dyn crate::db::Database,
+    user_id: &str,
+) -> Result<(), MigrationError> {
+    let ironclaw_dir = dirs::home_dir()
+        .unwrap_or_else(|| PathBuf::from("."))
+        .join(".ironclaw");
+    let legacy_settings_path = ironclaw_dir.join("settings.json");
+
+    if !legacy_settings_path.exists() {
+        tracing::debug!("No legacy settings.json found, skipping disk-to-DB migration");
+        return Ok(());
+    }
+
+    // If DB already has settings, this is not a first boot, the wizard already
+    // wrote directly to the DB. Just clean up the stale file.
+    let has_settings = store.has_settings(user_id).await.map_err(|e| {
+        MigrationError::Database(format!("Failed to check existing settings: {}", e))
+    })?;
+    if has_settings {
+        tracing::info!("DB already has settings, renaming stale settings.json");
+        rename_to_migrated(&legacy_settings_path);
+        return Ok(());
+    }
+
+    tracing::info!("Migrating disk settings to database...");
+
+    // 1. Load and migrate settings.json
+    let settings = crate::settings::Settings::load_from(&legacy_settings_path);
+    let db_map = settings.to_db_map();
+    if !db_map.is_empty() {
+        store
+            .set_all_settings(user_id, &db_map)
+            .await
+            .map_err(|e| {
+                MigrationError::Database(format!("Failed to write settings to DB: {}", e))
+            })?;
+        tracing::info!("Migrated {} settings to database", db_map.len());
+    }
+
+    // 2. Write DATABASE_URL to ~/.ironclaw/.env
+    if let Some(ref url) = settings.database_url {
+        save_database_url(url)
+            .map_err(|e| MigrationError::Io(format!("Failed to write .env: {}", e)))?;
+        tracing::info!("Wrote DATABASE_URL to {}", ironclaw_env_path().display());
+    }
+
+    // 3. Migrate mcp-servers.json if it exists
+    let mcp_path = ironclaw_dir.join("mcp-servers.json");
+    if mcp_path.exists() {
+        match std::fs::read_to_string(&mcp_path) {
+            Ok(content) => match serde_json::from_str::<serde_json::Value>(&content) {
+                Ok(value) => {
+                    store
+                        .set_setting(user_id, "mcp_servers", &value)
+                        .await
+                        .map_err(|e| {
+                            MigrationError::Database(format!(
+                                "Failed to write MCP servers to DB: {}",
+                                e
+                            ))
+                        })?;
+                    tracing::info!("Migrated mcp-servers.json to database");
+
+                    rename_to_migrated(&mcp_path);
+                }
+                Err(e) => {
+                    tracing::warn!("Failed to parse mcp-servers.json: {}", e);
+                }
+            },
+            Err(e) => {
+                tracing::warn!("Failed to read mcp-servers.json: {}", e);
+            }
+        }
+    }
+
+    // 4. Migrate session.json if it exists
+    let session_path = ironclaw_dir.join("session.json");
+    if session_path.exists() {
+        match std::fs::read_to_string(&session_path) {
+            Ok(content) => match serde_json::from_str::<serde_json::Value>(&content) {
+                Ok(value) => {
+                    store
+                        .set_setting(user_id, "nearai.session_token", &value)
+                        .await
+                        .map_err(|e| {
+                            MigrationError::Database(format!(
+                                "Failed to write session to DB: {}",
+                                e
+                            ))
+                        })?;
+                    tracing::info!("Migrated session.json to database");
+
+                    rename_to_migrated(&session_path);
+                }
+                Err(e) => {
+                    tracing::warn!("Failed to parse session.json: {}", e);
+                }
+            },
+            Err(e) => {
+                tracing::warn!("Failed to read session.json: {}", e);
+            }
+        }
+    }
+
+    // 5. Rename settings.json to .migrated (don't delete, safety net)
+    rename_to_migrated(&legacy_settings_path);
+
+    // 6. Clean up old bootstrap.json if it exists (superseded by .env)
+    let old_bootstrap = ironclaw_dir.join("bootstrap.json");
+    if old_bootstrap.exists() {
+        rename_to_migrated(&old_bootstrap);
+        tracing::info!("Renamed old bootstrap.json to .migrated");
+    }
+
+    tracing::info!("Disk-to-DB migration complete");
+    Ok(())
+}
+
+/// Rename a file to `<name>.migrated` as a safety net.
+fn rename_to_migrated(path: &std::path::Path) {
+    let mut migrated = path.as_os_str().to_owned();
+    migrated.push(".migrated");
+    if let Err(e) = std::fs::rename(path, &migrated) {
+        tracing::warn!("Failed to rename {} to .migrated: {}", path.display(), e);
+    }
+}
+
+/// Errors that can occur during disk-to-DB migration.
+#[derive(Debug, thiserror::Error)]
+pub enum MigrationError {
+    #[error("Database error: {0}")]
+    Database(String),
+    #[error("IO error: {0}")]
+    Io(String),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn test_save_and_load_database_url() {
+        let dir = tempdir().unwrap();
+        let env_path = dir.path().join(".env");
+
+        // Write in the quoted format that save_database_url uses
+        let url = "postgres://localhost:5432/ironclaw_test";
+        std::fs::write(&env_path, format!("DATABASE_URL=\"{}\"\n", url)).unwrap();
+
+        // Verify the content is a valid dotenv line (quoted)
+        let content = std::fs::read_to_string(&env_path).unwrap();
+        assert_eq!(
+            content,
+            "DATABASE_URL=\"postgres://localhost:5432/ironclaw_test\"\n"
+        );
+
+        // Verify dotenvy can parse it (strips quotes automatically)
+        let parsed: Vec<(String, String)> = dotenvy::from_path_iter(&env_path)
+            .unwrap()
+            .filter_map(|r| r.ok())
+            .collect();
+        assert_eq!(parsed.len(), 1);
+        assert_eq!(parsed[0].0, "DATABASE_URL");
+        assert_eq!(parsed[0].1, url);
+    }
+
+    #[test]
+    fn test_save_database_url_with_hash_in_password() {
+        let dir = tempdir().unwrap();
+        let env_path = dir.path().join(".env");
+
+        // URLs with # in the password are common (URL-encoded special chars).
+        // Without quoting, dotenvy treats # as a comment delimiter.
+        let url = "postgres://user:p%23ss@localhost:5432/ironclaw";
+        std::fs::write(&env_path, format!("DATABASE_URL=\"{}\"\n", url)).unwrap();
+
+        let parsed: Vec<(String, String)> = dotenvy::from_path_iter(&env_path)
+            .unwrap()
+            .filter_map(|r| r.ok())
+            .collect();
+        assert_eq!(parsed.len(), 1);
+        assert_eq!(parsed[0].0, "DATABASE_URL");
+        assert_eq!(parsed[0].1, url);
+    }
+
+    #[test]
+    fn test_save_database_url_creates_parent_dirs() {
+        let dir = tempdir().unwrap();
+        let nested = dir.path().join("deep").join("nested");
+        let env_path = nested.join(".env");
+
+        // Parent doesn't exist yet
+        assert!(!nested.exists());
+
+        // The global function uses a fixed path, so we test the logic directly
+        std::fs::create_dir_all(&nested).unwrap();
+        std::fs::write(&env_path, "DATABASE_URL=postgres://test\n").unwrap();
+
+        assert!(env_path.exists());
+        let content = std::fs::read_to_string(&env_path).unwrap();
+        assert!(content.contains("DATABASE_URL=postgres://test"));
+    }
+
+    #[test]
+    fn test_ironclaw_env_path() {
+        let path = ironclaw_env_path();
+        assert!(path.ends_with(".ironclaw/.env"));
+    }
+
+    #[test]
+    fn test_migrate_bootstrap_json_to_env() {
+        let dir = tempdir().unwrap();
+        let env_path = dir.path().join(".env");
+        let bootstrap_path = dir.path().join("bootstrap.json");
+
+        // Write a legacy bootstrap.json
+        let bootstrap_json = serde_json::json!({
+            "database_url": "postgres://localhost/ironclaw_upgrade",
+            "database_pool_size": 5,
+            "secrets_master_key_source": "keychain",
+            "onboard_completed": true
+        });
+        std::fs::write(
+            &bootstrap_path,
+            serde_json::to_string_pretty(&bootstrap_json).unwrap(),
+        )
+        .unwrap();
+
+        assert!(!env_path.exists());
+        assert!(bootstrap_path.exists());
+
+        // Run the migration
+        migrate_bootstrap_json_to_env(&env_path);
+
+        // .env should now exist with DATABASE_URL
+        assert!(env_path.exists());
+        let content = std::fs::read_to_string(&env_path).unwrap();
+        assert_eq!(
+            content,
+            "DATABASE_URL=\"postgres://localhost/ironclaw_upgrade\"\n"
+        );
+
+        // bootstrap.json should be renamed to .migrated
+        assert!(!bootstrap_path.exists());
+        assert!(dir.path().join("bootstrap.json.migrated").exists());
+    }
+
+    #[test]
+    fn test_migrate_bootstrap_json_no_database_url() {
+        let dir = tempdir().unwrap();
+        let env_path = dir.path().join(".env");
+        let bootstrap_path = dir.path().join("bootstrap.json");
+
+        // bootstrap.json with no database_url
+        let bootstrap_json = serde_json::json!({
+            "onboard_completed": false
+        });
+        std::fs::write(
+            &bootstrap_path,
+            serde_json::to_string_pretty(&bootstrap_json).unwrap(),
+        )
+        .unwrap();
+
+        migrate_bootstrap_json_to_env(&env_path);
+
+        // .env should NOT be created
+        assert!(!env_path.exists());
+        // bootstrap.json should remain (no migration happened)
+        assert!(bootstrap_path.exists());
+    }
+
+    #[test]
+    fn test_migrate_bootstrap_json_missing() {
+        let dir = tempdir().unwrap();
+        let env_path = dir.path().join(".env");
+
+        // No bootstrap.json at all
+        migrate_bootstrap_json_to_env(&env_path);
+
+        // Nothing should happen
+        assert!(!env_path.exists());
+    }
+
+    #[test]
+    fn test_save_bootstrap_env_multiple_vars() {
+        let dir = tempdir().unwrap();
+        let env_path = dir.path().join("nested").join(".env");
+
+        std::fs::create_dir_all(env_path.parent().unwrap()).unwrap();
+
+        let vars = [
+            ("DATABASE_BACKEND", "libsql"),
+            ("LIBSQL_PATH", "/home/user/.ironclaw/ironclaw.db"),
+        ];
+
+        // Write manually to the temp path (save_bootstrap_env uses the global path)
+        let mut content = String::new();
+        for (key, value) in &vars {
+            content.push_str(&format!("{}=\"{}\"\n", key, value));
+        }
+        std::fs::write(&env_path, &content).unwrap();
+
+        // Verify dotenvy can parse all entries
+        let parsed: Vec<(String, String)> = dotenvy::from_path_iter(&env_path)
+            .unwrap()
+            .filter_map(|r| r.ok())
+            .collect();
+        assert_eq!(parsed.len(), 2);
+        assert_eq!(
+            parsed[0],
+            ("DATABASE_BACKEND".to_string(), "libsql".to_string())
+        );
+        assert_eq!(
+            parsed[1],
+            (
+                "LIBSQL_PATH".to_string(),
+                "/home/user/.ironclaw/ironclaw.db".to_string()
+            )
+        );
+    }
+
+    #[test]
+    fn test_save_bootstrap_env_overwrites_previous() {
+        let dir = tempdir().unwrap();
+        let env_path = dir.path().join(".env");
+
+        // Write initial content
+        std::fs::write(&env_path, "DATABASE_URL=\"postgres://old\"\n").unwrap();
+
+        // Overwrite with new vars (simulating save_bootstrap_env behavior)
+        let content = "DATABASE_BACKEND=\"libsql\"\nLIBSQL_PATH=\"/new/path.db\"\n";
+        std::fs::write(&env_path, content).unwrap();
+
+        let parsed: Vec<(String, String)> = dotenvy::from_path_iter(&env_path)
+            .unwrap()
+            .filter_map(|r| r.ok())
+            .collect();
+        // Old DATABASE_URL should be gone
+        assert_eq!(parsed.len(), 2);
+        assert!(parsed.iter().all(|(k, _)| k != "DATABASE_URL"));
+    }
+}

src/channels/channel.rs

@@ -114,6 +114,12 @@ pub enum StatusUpdate {
     StreamChunk(String),
     /// General status message.
     Status(String),
+    /// A sandbox job has started (shown as a clickable card in the UI).
+    JobStarted {
+        job_id: String,
+        title: String,
+        browse_url: String,
+    },
     /// Tool requires user approval before execution.
     ApprovalNeeded {
         request_id: String,
@@ -121,6 +127,19 @@ pub enum StatusUpdate {
         description: String,
         parameters: serde_json::Value,
     },
+    /// Extension needs user authentication (token or OAuth).
+    AuthRequired {
+        extension_name: String,
+        instructions: Option<String>,
+        auth_url: Option<String>,
+        setup_url: Option<String>,
+    },
+    /// Extension authentication completed.
+    AuthCompleted {
+        extension_name: String,
+        success: bool,
+        message: String,
+    },
 }
 
 /// Trait for message channels.

src/channels/repl.rs

@@ -33,21 +33,41 @@ use termimad::MadSkin;
 use tokio::sync::mpsc;
 use tokio_stream::wrappers::ReceiverStream;
 
+use crate::agent::truncate_for_preview;
 use crate::channels::{Channel, IncomingMessage, MessageStream, OutgoingResponse, StatusUpdate};
 use crate::error::ChannelError;
 
+/// Max characters for tool result previews in the terminal.
+const CLI_TOOL_RESULT_MAX: usize = 200;
+
+/// Max characters for thinking/status messages in the terminal.
+const CLI_STATUS_MAX: usize = 200;
+
 /// Slash commands available in the REPL.
 const SLASH_COMMANDS: &[&str] = &[
     "/help",
     "/quit",
     "/exit",
     "/debug",
+    "/model",
     "/undo",
     "/redo",
     "/clear",
     "/compact",
     "/new",
     "/interrupt",
+    "/version",
+    "/tools",
+    "/ping",
+    "/job",
+    "/status",
+    "/cancel",
+    "/list",
+    "/heartbeat",
+    "/summarize",
+    "/suggest",
+    "/thread",
+    "/resume",
 ];
 
 /// Rustyline helper for slash-command tab completion.
@@ -164,6 +184,8 @@ pub struct ReplChannel {
     debug_mode: Arc<AtomicBool>,
     /// Whether we're currently streaming (chunks have been printed without a trailing newline).
     is_streaming: Arc<AtomicBool>,
+    /// When true, the one-liner startup banner is suppressed (boot screen shown instead).
+    suppress_banner: Arc<AtomicBool>,
 }
 
 impl ReplChannel {
@@ -173,6 +195,7 @@ impl ReplChannel {
             single_message: None,
             debug_mode: Arc::new(AtomicBool::new(false)),
             is_streaming: Arc::new(AtomicBool::new(false)),
+            suppress_banner: Arc::new(AtomicBool::new(false)),
         }
     }
 
@@ -182,9 +205,15 @@ impl ReplChannel {
             single_message: Some(message),
             debug_mode: Arc::new(AtomicBool::new(false)),
             is_streaming: Arc::new(AtomicBool::new(false)),
+            suppress_banner: Arc::new(AtomicBool::new(false)),
         }
     }
 
+    /// Suppress the one-liner startup banner (boot screen will be shown instead).
+    pub fn suppress_banner(&self) {
+        self.suppress_banner.store(true, Ordering::Relaxed);
+    }
+
     fn is_debug(&self) -> bool {
         self.debug_mode.load(Ordering::Relaxed)
     }
@@ -244,11 +273,12 @@ impl Channel for ReplChannel {
         let (tx, rx) = mpsc::channel(32);
         let single_message = self.single_message.clone();
         let debug_mode = Arc::clone(&self.debug_mode);
+        let suppress_banner = Arc::clone(&self.suppress_banner);
 
         std::thread::spawn(move || {
             // Single message mode: send it and return
             if let Some(msg) = single_message {
-                let incoming = IncomingMessage::new("repl", "user", &msg);
+                let incoming = IncomingMessage::new("repl", "default", &msg);
                 let _ = tx.blocking_send(incoming);
                 return;
             }
@@ -278,8 +308,10 @@ impl Channel for ReplChannel {
             }
             let _ = rl.load_history(&hist_path);
 
-            println!("\x1b[1mIronClaw\x1b[0m  /help for commands, /quit to exit");
-            println!();
+            if !suppress_banner.load(Ordering::Relaxed) {
+                println!("\x1b[1mIronClaw\x1b[0m  /help for commands, /quit to exit");
+                println!();
+            }
 
             loop {
                 let prompt = if debug_mode.load(Ordering::Relaxed) {
@@ -295,10 +327,11 @@ impl Channel for ReplChannel {
                             continue;
                         }
 
-                        // Handle local REPL commands
+                        // Handle local REPL commands (only commands that need
+                        // immediate local handling stay here)
                         match line.to_lowercase().as_str() {
                             "/quit" | "/exit" => break,
-                            "/help" | "/?" => {
+                            "/help" => {
                                 print_help();
                                 continue;
                             }
@@ -315,21 +348,21 @@ impl Channel for ReplChannel {
                             _ => {}
                         }
 
-                        let msg = IncomingMessage::new("repl", "user", line);
+                        let msg = IncomingMessage::new("repl", "default", line);
                         if tx.blocking_send(msg).is_err() {
                             break;
                         }
                     }
                     Err(ReadlineError::Interrupted) => {
                         // Ctrl+C: send /interrupt
-                        let msg = IncomingMessage::new("repl", "user", "/interrupt");
+                        let msg = IncomingMessage::new("repl", "default", "/interrupt");
                         if tx.blocking_send(msg).is_err() {
                             break;
                         }
                     }
                     Err(ReadlineError::Eof) => {
                         // Ctrl+D: send /quit so the agent loop runs graceful shutdown
-                        let msg = IncomingMessage::new("repl", "user", "/quit");
+                        let msg = IncomingMessage::new("repl", "default", "/quit");
                         let _ = tx.blocking_send(msg);
                         break;
                     }
@@ -386,7 +419,8 @@ impl Channel for ReplChannel {
 
         match status {
             StatusUpdate::Thinking(msg) => {
-                eprintln!("  \x1b[90m\u{25CB} {msg}\x1b[0m");
+                let display = truncate_for_preview(&msg, CLI_STATUS_MAX);
+                eprintln!("  \x1b[90m\u{25CB} {display}\x1b[0m");
             }
             StatusUpdate::ToolStarted { name } => {
                 eprintln!("  \x1b[33m\u{25CB} {name}\x1b[0m");
@@ -399,7 +433,8 @@ impl Channel for ReplChannel {
                 }
             }
             StatusUpdate::ToolResult { name: _, preview } => {
-                eprintln!("    \x1b[90m{preview}\x1b[0m");
+                let display = truncate_for_preview(&preview, CLI_TOOL_RESULT_MAX);
+                eprintln!("    \x1b[90m{display}\x1b[0m");
             }
             StatusUpdate::StreamChunk(chunk) => {
                 // Print separator on the false-to-true transition
@@ -413,9 +448,19 @@ impl Channel for ReplChannel {
                 print!("{chunk}");
                 let _ = io::stdout().flush();
             }
+            StatusUpdate::JobStarted {
+                job_id,
+                title,
+                browse_url,
+            } => {
+                eprintln!(
+                    "  \x1b[36m[job]\x1b[0m {title} \x1b[90m({job_id})\x1b[0m \x1b[4m{browse_url}\x1b[0m"
+                );
+            }
             StatusUpdate::Status(msg) => {
                 if debug || msg.contains("approval") || msg.contains("Approval") {
-                    eprintln!("  \x1b[90m{msg}\x1b[0m");
+                    let display = truncate_for_preview(&msg, CLI_STATUS_MAX);
+                    eprintln!("  \x1b[90m{display}\x1b[0m");
                 }
             }
             StatusUpdate::ApprovalNeeded {
@@ -472,6 +517,33 @@ impl Channel for ReplChannel {
                 eprintln!("  {bot_border}");
                 eprintln!();
             }
+            StatusUpdate::AuthRequired {
+                extension_name,
+                instructions,
+                setup_url,
+                ..
+            } => {
+                eprintln!();
+                eprintln!("\x1b[33m  Authentication required for {extension_name}\x1b[0m");
+                if let Some(ref instr) = instructions {
+                    eprintln!("  {instr}");
+                }
+                if let Some(ref url) = setup_url {
+                    eprintln!("  \x1b[4m{url}\x1b[0m");
+                }
+                eprintln!();
+            }
+            StatusUpdate::AuthCompleted {
+                extension_name,
+                success,
+                message,
+            } => {
+                if success {
+                    eprintln!("\x1b[32m  {extension_name}: {message}\x1b[0m");
+                } else {
+                    eprintln!("\x1b[31m  {extension_name}: {message}\x1b[0m");
+                }
+            }
         }
         Ok(())
     }

src/channels/wasm/bundled.rs

@@ -1,68 +1,125 @@
-//! Bundled WASM channels that can be installed locally.
+//! Known WASM channels that can be installed from build artifacts.
+//!
+//! Instead of embedding WASM binaries in the host binary via include_bytes!,
+//! channels are compiled separately and installed from their build output
+//! directories during onboarding.
+//!
+//! Channel source layout:
+//!   channels-src/<name>/
+//!     target/wasm32-wasip2/release/<name>_channel.wasm
+//!     <name>.capabilities.json
 
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use tokio::fs;
 
-#[derive(Clone, Copy)]
-struct BundledChannel {
-    name: &'static str,
-    wasm: &'static [u8],
-    capabilities: &'static [u8],
+/// Compile-time project root, used to locate channels-src/ in dev builds.
+const CARGO_MANIFEST_DIR: &str = env!("CARGO_MANIFEST_DIR");
+
+/// Known channel names and their crate names (for locating build artifacts).
+const KNOWN_CHANNELS: &[(&str, &str)] = &[
+    ("telegram", "telegram_channel"),
+    ("slack", "slack_channel"),
+    ("whatsapp", "whatsapp_channel"),
+];
+
+/// Names of known channels that can be installed.
+pub fn bundled_channel_names() -> Vec<&'static str> {
+    KNOWN_CHANNELS.iter().map(|(name, _)| *name).collect()
 }
 
-/// Names of bundled channels shipped with IronClaw.
-pub fn bundled_channel_names() -> &'static [&'static str] {
-    &["telegram"]
+/// Resolve the channels source directory.
+///
+/// Checks (in order):
+/// 1. `IRONCLAW_CHANNELS_SRC` env var
+/// 2. `<CARGO_MANIFEST_DIR>/channels-src/` (dev builds)
+fn channels_src_dir() -> PathBuf {
+    if let Ok(dir) = std::env::var("IRONCLAW_CHANNELS_SRC") {
+        return PathBuf::from(dir);
+    }
+    PathBuf::from(CARGO_MANIFEST_DIR).join("channels-src")
 }
 
-/// Install a bundled channel into a channels directory.
+/// Locate the build artifacts for a channel.
+///
+/// Returns (wasm_path, capabilities_path) or an error if files are missing.
+fn locate_channel_artifacts(name: &str) -> Result<(PathBuf, PathBuf), String> {
+    let (_, crate_name) = KNOWN_CHANNELS
+        .iter()
+        .find(|(n, _)| *n == name)
+        .ok_or_else(|| format!("Unknown channel '{}'", name))?;
+
+    let src_dir = channels_src_dir();
+    let channel_dir = src_dir.join(name);
+
+    let wasm_path = channel_dir
+        .join("target/wasm32-wasip2/release")
+        .join(format!("{}.wasm", crate_name));
+
+    let caps_path = channel_dir.join(format!("{}.capabilities.json", name));
+
+    if !wasm_path.exists() {
+        return Err(format!(
+            "Channel '{}' WASM not found at {}. Build it first:\n  \
+             cd {} && cargo build --target wasm32-wasip2 --release",
+            name,
+            wasm_path.display(),
+            channel_dir.display()
+        ));
+    }
+
+    if !caps_path.exists() {
+        return Err(format!(
+            "Channel '{}' capabilities not found at {}",
+            name,
+            caps_path.display()
+        ));
+    }
+
+    Ok((wasm_path, caps_path))
+}
+
+/// Install a channel from build artifacts into the channels directory.
 pub async fn install_bundled_channel(
     name: &str,
     target_dir: &Path,
     force: bool,
 ) -> Result<(), String> {
-    let channel = bundled_channel(name)
-        .ok_or_else(|| format!("Unknown bundled channel '{}'", name.to_lowercase()))?;
+    let (wasm_src, caps_src) = locate_channel_artifacts(name)?;
 
     fs::create_dir_all(target_dir)
         .await
         .map_err(|e| format!("Failed to create channels directory: {}", e))?;
 
-    let wasm_path = target_dir.join(format!("{}.wasm", channel.name));
-    let caps_path = target_dir.join(format!("{}.capabilities.json", channel.name));
+    let wasm_dst = target_dir.join(format!("{}.wasm", name));
+    let caps_dst = target_dir.join(format!("{}.capabilities.json", name));
 
-    let has_existing = wasm_path.exists() || caps_path.exists();
+    let has_existing = wasm_dst.exists() || caps_dst.exists();
     if has_existing && !force {
         return Err(format!(
             "Channel '{}' already exists at {}",
-            channel.name,
+            name,
             target_dir.display()
         ));
     }
 
-    fs::write(&wasm_path, channel.wasm)
+    fs::copy(&wasm_src, &wasm_dst)
         .await
-        .map_err(|e| format!("Failed to write {}: {}", wasm_path.display(), e))?;
-    fs::write(&caps_path, channel.capabilities)
+        .map_err(|e| format!("Failed to copy {}: {}", wasm_src.display(), e))?;
+    fs::copy(&caps_src, &caps_dst)
         .await
-        .map_err(|e| format!("Failed to write {}: {}", caps_path.display(), e))?;
+        .map_err(|e| format!("Failed to copy {}: {}", caps_src.display(), e))?;
 
     Ok(())
 }
 
-fn bundled_channel(name: &str) -> Option<BundledChannel> {
-    if name.eq_ignore_ascii_case("telegram") {
-        Some(BundledChannel {
-            name: "telegram",
-            wasm: include_bytes!("../../../channels-src/telegram/telegram.wasm"),
-            capabilities: include_bytes!(
-                "../../../channels-src/telegram/telegram.capabilities.json"
-            ),
-        })
-    } else {
-        None
-    }
+/// Check which known channels have build artifacts available.
+pub fn available_channel_names() -> Vec<&'static str> {
+    KNOWN_CHANNELS
+        .iter()
+        .filter(|(name, _)| locate_channel_artifacts(name).is_ok())
+        .map(|(name, _)| *name)
+        .collect()
 }
 
 #[cfg(test)]
@@ -73,31 +130,35 @@ mod tests {
     use super::*;
 
     #[test]
-    fn test_bundled_channel_names_contains_telegram() {
-        assert!(bundled_channel_names().contains(&"telegram"));
+    fn test_known_channels_includes_all_three() {
+        let names = bundled_channel_names();
+        assert!(names.contains(&"telegram"));
+        assert!(names.contains(&"slack"));
+        assert!(names.contains(&"whatsapp"));
+    }
+
+    #[test]
+    fn test_channels_src_dir_default() {
+        let dir = channels_src_dir();
+        assert!(dir.ends_with("channels-src"));
+    }
+
+    #[test]
+    fn test_locate_unknown_channel_errors() {
+        assert!(locate_channel_artifacts("nonexistent").is_err());
     }
 
     #[tokio::test]
-    async fn test_install_bundled_channel_writes_files() {
-        let dir = tempdir().unwrap();
-
-        install_bundled_channel("telegram", dir.path(), false)
-            .await
-            .unwrap();
-
-        assert!(dir.path().join("telegram.wasm").exists());
-        assert!(dir.path().join("telegram.capabilities.json").exists());
-    }
-
-    #[tokio::test]
-    async fn test_install_bundled_channel_refuses_overwrite_without_force() {
+    async fn test_install_refuses_overwrite_without_force() {
         let dir = tempdir().unwrap();
         let wasm_path = dir.path().join("telegram.wasm");
         fs::write(&wasm_path, b"custom").await.unwrap();
 
         let result = install_bundled_channel("telegram", dir.path(), false).await;
+        // Either fails because artifacts missing OR because file exists
         assert!(result.is_err());
 
+        // Original file should be untouched
         let existing = fs::read(&wasm_path).await.unwrap();
         assert_eq!(existing, b"custom");
     }

src/channels/wasm/loader.rs

@@ -16,16 +16,21 @@ use crate::channels::wasm::error::WasmChannelError;
 use crate::channels::wasm::runtime::WasmChannelRuntime;
 use crate::channels::wasm::schema::ChannelCapabilitiesFile;
 use crate::channels::wasm::wrapper::WasmChannel;
+use crate::pairing::PairingStore;
 
 /// Loads WASM channels from the filesystem.
 pub struct WasmChannelLoader {
     runtime: Arc<WasmChannelRuntime>,
+    pairing_store: Arc<PairingStore>,
 }
 
 impl WasmChannelLoader {
-    /// Create a new loader with the given runtime.
-    pub fn new(runtime: Arc<WasmChannelRuntime>) -> Self {
-        Self { runtime }
+    /// Create a new loader with the given runtime and pairing store.
+    pub fn new(runtime: Arc<WasmChannelRuntime>, pairing_store: Arc<PairingStore>) -> Self {
+        Self {
+            runtime,
+            pairing_store,
+        }
     }
 
     /// Load a single WASM channel from a file pair.
@@ -114,7 +119,13 @@ impl WasmChannelLoader {
             .await?;
 
         // Create the channel
-        let channel = WasmChannel::new(self.runtime.clone(), prepared, capabilities, config_json);
+        let channel = WasmChannel::new(
+            self.runtime.clone(),
+            prepared,
+            capabilities,
+            config_json,
+            self.pairing_store.clone(),
+        );
 
         tracing::info!(
             name = name,
@@ -352,6 +363,7 @@ mod tests {
 
     use crate::channels::wasm::loader::{WasmChannelLoader, discover_channels};
     use crate::channels::wasm::runtime::{WasmChannelRuntime, WasmChannelRuntimeConfig};
+    use crate::pairing::PairingStore;
     use std::sync::Arc;
 
     #[tokio::test]
@@ -408,7 +420,7 @@ mod tests {
     async fn test_loader_invalid_name() {
         let config = WasmChannelRuntimeConfig::for_testing();
         let runtime = Arc::new(WasmChannelRuntime::new(config).unwrap());
-        let loader = WasmChannelLoader::new(runtime);
+        let loader = WasmChannelLoader::new(runtime, Arc::new(PairingStore::new()));
 
         let dir = TempDir::new().unwrap();
         let wasm_path = dir.path().join("test.wasm");

src/channels/wasm/mod.rs

@@ -89,7 +89,7 @@ mod schema;
 mod wrapper;
 
 // Core types
-pub use bundled::{bundled_channel_names, install_bundled_channel};
+pub use bundled::{available_channel_names, bundled_channel_names, install_bundled_channel};
 pub use capabilities::{ChannelCapabilities, EmitRateLimitConfig, HttpEndpointConfig, PollConfig};
 pub use error::WasmChannelError;
 pub use host::{ChannelEmitRateLimiter, ChannelHostState, EmittedMessage};

src/channels/wasm/router.rs

@@ -478,6 +478,7 @@ mod tests {
         PreparedChannelModule, WasmChannelRuntime, WasmChannelRuntimeConfig,
     };
     use crate::channels::wasm::wrapper::WasmChannel;
+    use crate::pairing::PairingStore;
     use crate::tools::wasm::ResourceLimits;
 
     fn create_test_channel(name: &str) -> Arc<WasmChannel> {
@@ -499,6 +500,7 @@ mod tests {
             prepared,
             capabilities,
             "{}".to_string(),
+            Arc::new(PairingStore::new()),
         ))
     }
 

src/channels/wasm/wrapper.rs

@@ -48,6 +48,7 @@ use crate::channels::wasm::runtime::{PreparedChannelModule, WasmChannelRuntime};
 use crate::channels::wasm::schema::ChannelConfig;
 use crate::channels::{Channel, IncomingMessage, MessageStream, OutgoingResponse, StatusUpdate};
 use crate::error::ChannelError;
+use crate::pairing::PairingStore;
 use crate::safety::LeakDetector;
 use crate::tools::wasm::LogLevel;
 use crate::tools::wasm::WasmResourceLimiter;
@@ -73,6 +74,11 @@ struct ChannelStoreData {
     /// Injected credentials for URL substitution (e.g., bot tokens).
     /// Keys are placeholder names like "TELEGRAM_BOT_TOKEN".
     credentials: HashMap<String, String>,
+    /// Pairing store for DM pairing (guest access control).
+    pairing_store: Arc<PairingStore>,
+    /// Dedicated tokio runtime for HTTP requests, lazily initialized.
+    /// Reused across multiple `http_request` calls within one execution.
+    http_runtime: Option<tokio::runtime::Runtime>,
 }
 
 impl ChannelStoreData {
@@ -81,6 +87,7 @@ impl ChannelStoreData {
         channel_name: &str,
         capabilities: ChannelCapabilities,
         credentials: HashMap<String, String>,
+        pairing_store: Arc<PairingStore>,
     ) -> Self {
         // Create a minimal WASI context (no filesystem, no env vars for security)
         let wasi = WasiCtxBuilder::new().build();
@@ -91,6 +98,8 @@ impl ChannelStoreData {
             wasi,
             table: ResourceTable::new(),
             credentials,
+            pairing_store,
+            http_runtime: None,
         }
     }
 
@@ -129,18 +138,34 @@ impl ChannelStoreData {
         if result.contains('{') && result.contains('}') {
             // Only warn if it looks like an unresolved placeholder (not JSON braces)
             let brace_pattern = regex::Regex::new(r"\{[A-Z_]+\}").ok();
-            if let Some(re) = brace_pattern {
-                if re.is_match(&result) {
-                    tracing::warn!(
-                        context = %context,
-                        "String may contain unresolved credential placeholders"
-                    );
-                }
+            if let Some(re) = brace_pattern
+                && re.is_match(&result)
+            {
+                tracing::warn!(
+                    context = %context,
+                    "String may contain unresolved credential placeholders"
+                );
             }
         }
 
         result
     }
+
+    /// Replace injected credential values with `[REDACTED]` in text.
+    ///
+    /// Prevents credentials from leaking through error messages, logs, or
+    /// return values to WASM. reqwest::Error includes the full URL in its
+    /// Display output, so any error from an injected-URL request will
+    /// contain the raw credential unless we scrub it.
+    fn redact_credentials(&self, text: &str) -> String {
+        let mut result = text.to_string();
+        for (name, value) in &self.credentials {
+            if !value.is_empty() {
+                result = result.replace(value, &format!("[REDACTED:{}]", name));
+            }
+        }
+        result
+    }
 }
 
 // Implement WasiView to provide WASI context and resource table
@@ -187,6 +212,7 @@ impl near::agent::channel_host::Host for ChannelStoreData {
         url: String,
         headers_json: String,
         body: Option<Vec<u8>>,
+        timeout_ms: Option<u32>,
     ) -> Result<near::agent::channel_host::HttpResponse, String> {
         tracing::info!(
             method = %method,
@@ -251,10 +277,35 @@ impl near::agent::channel_host::Host for ChannelStoreData {
             .scan_http_request(&url, &header_vec, body.as_deref())
             .map_err(|e| format!("Potential secret leak blocked: {}", e))?;
 
-        // Make the HTTP request using blocking I/O
-        // We're already in a spawn_blocking context, so we can use block_on
-        let result = tokio::runtime::Handle::current().block_on(async {
-            let client = reqwest::Client::new();
+        // Get the max response size from capabilities (default 10MB).
+        let max_response_bytes = self
+            .host_state
+            .capabilities()
+            .tool_capabilities
+            .http
+            .as_ref()
+            .map(|h| h.max_response_bytes)
+            .unwrap_or(10 * 1024 * 1024);
+
+        // Make the HTTP request using a dedicated single-threaded runtime.
+        // We're inside spawn_blocking, so we can't rely on the main runtime's
+        // I/O driver (it may be busy with WASM compilation or other startup work).
+        // A dedicated runtime gives us our own I/O driver and avoids contention.
+        // The runtime is lazily created and reused across calls within one execution.
+        if self.http_runtime.is_none() {
+            self.http_runtime = Some(
+                tokio::runtime::Builder::new_current_thread()
+                    .enable_all()
+                    .build()
+                    .map_err(|e| format!("Failed to create HTTP runtime: {e}"))?,
+            );
+        }
+        let rt = self.http_runtime.as_ref().expect("just initialized");
+        let result = rt.block_on(async {
+            let client = reqwest::Client::builder()
+                .connect_timeout(std::time::Duration::from_secs(10))
+                .build()
+                .map_err(|e| format!("Failed to build HTTP client: {e}"))?;
 
             let mut request = match method.to_uppercase().as_str() {
                 "GET" => client.get(&url),
@@ -276,12 +327,21 @@ impl near::agent::channel_host::Host for ChannelStoreData {
                 request = request.body(body_bytes);
             }
 
-            // Send request with timeout
-            let response = request
-                .timeout(std::time::Duration::from_secs(30))
-                .send()
-                .await
-                .map_err(|e| format!("HTTP request failed: {}", e))?;
+            // Send request with caller-specified timeout (default 30s, max 5min).
+            let timeout_ms = timeout_ms.unwrap_or(30_000).min(300_000) as u64;
+            let timeout = std::time::Duration::from_millis(timeout_ms);
+            let response = request.timeout(timeout).send().await.map_err(|e| {
+                // Walk the full error chain so we get the actual root cause
+                // (DNS, TLS, connection refused, etc.) instead of just
+                // "error sending request for url (...)".
+                let mut chain = format!("HTTP request failed: {}", e);
+                let mut source = std::error::Error::source(&e);
+                while let Some(cause) = source {
+                    chain.push_str(&format!(" -> {}", cause));
+                    source = cause.source();
+                }
+                chain
+            })?;
 
             let status = response.status().as_u16();
             let response_headers: std::collections::HashMap<String, String> = response
@@ -294,11 +354,29 @@ impl near::agent::channel_host::Host for ChannelStoreData {
                 })
                 .collect();
             let headers_json = serde_json::to_string(&response_headers).unwrap_or_default();
+
+            // Enforce max response body size to prevent memory exhaustion.
+            let max_response = max_response_bytes;
+            if let Some(cl) = response.content_length()
+                && cl as usize > max_response
+            {
+                return Err(format!(
+                    "Response body too large: {} bytes exceeds limit of {} bytes",
+                    cl, max_response
+                ));
+            }
             let body = response
                 .bytes()
                 .await
-                .map_err(|e| format!("Failed to read response body: {}", e))?
-                .to_vec();
+                .map_err(|e| format!("Failed to read response body: {}", e))?;
+            if body.len() > max_response {
+                return Err(format!(
+                    "Response body too large: {} bytes exceeds limit of {} bytes",
+                    body.len(),
+                    max_response
+                ));
+            }
+            let body = body.to_vec();
 
             tracing::info!(
                 status = status,
@@ -330,6 +408,11 @@ impl near::agent::channel_host::Host for ChannelStoreData {
             })
         });
 
+        // Scrub credential values from error messages before logging or returning
+        // to WASM. reqwest::Error includes the full URL (with injected credentials)
+        // in its Display output.
+        let result = result.map_err(|e| self.redact_credentials(&e));
+
         match &result {
             Ok(resp) => {
                 tracing::info!(status = resp.status, "http_request completed successfully");
@@ -372,6 +455,43 @@ impl near::agent::channel_host::Host for ChannelStoreData {
             }
         }
     }
+
+    fn pairing_upsert_request(
+        &mut self,
+        channel: String,
+        id: String,
+        meta_json: String,
+    ) -> Result<near::agent::channel_host::PairingUpsertResult, String> {
+        let meta = if meta_json.is_empty() {
+            None
+        } else {
+            serde_json::from_str(&meta_json).ok()
+        };
+        match self.pairing_store.upsert_request(&channel, &id, meta) {
+            Ok(r) => Ok(near::agent::channel_host::PairingUpsertResult {
+                code: r.code,
+                created: r.created,
+            }),
+            Err(e) => Err(e.to_string()),
+        }
+    }
+
+    fn pairing_is_allowed(
+        &mut self,
+        channel: String,
+        id: String,
+        username: Option<String>,
+    ) -> Result<bool, String> {
+        self.pairing_store
+            .is_sender_allowed(&channel, &id, username.as_deref())
+            .map_err(|e| e.to_string())
+    }
+
+    fn pairing_read_allow_from(&mut self, channel: String) -> Result<Vec<String>, String> {
+        self.pairing_store
+            .read_allow_from(&channel)
+            .map_err(|e| e.to_string())
+    }
 }
 
 /// A WASM-based channel implementing the Channel trait.
@@ -424,6 +544,9 @@ pub struct WasmChannel {
     /// Background task that repeats typing indicators every 4 seconds.
     /// Telegram's "typing..." indicator expires after ~5s, so we refresh it.
     typing_task: RwLock<Option<tokio::task::JoinHandle<()>>>,
+
+    /// Pairing store for DM pairing (guest access control).
+    pairing_store: Arc<PairingStore>,
 }
 
 impl WasmChannel {
@@ -433,6 +556,7 @@ impl WasmChannel {
         prepared: Arc<PreparedChannelModule>,
         capabilities: ChannelCapabilities,
         config_json: String,
+        pairing_store: Arc<PairingStore>,
     ) -> Self {
         let name = prepared.name.clone();
         let rate_limiter = ChannelEmitRateLimiter::new(capabilities.emit_rate_limit.clone());
@@ -452,6 +576,7 @@ impl WasmChannel {
             endpoints: RwLock::new(Vec::new()),
             credentials: Arc::new(RwLock::new(HashMap::new())),
             typing_task: RwLock::new(None),
+            pairing_store,
         }
     }
 
@@ -533,6 +658,7 @@ impl WasmChannel {
         prepared: &PreparedChannelModule,
         capabilities: &ChannelCapabilities,
         credentials: HashMap<String, String>,
+        pairing_store: Arc<PairingStore>,
     ) -> Result<Store<ChannelStoreData>, WasmChannelError> {
         let engine = runtime.engine();
         let limits = &prepared.limits;
@@ -543,6 +669,7 @@ impl WasmChannel {
             &prepared.name,
             capabilities.clone(),
             credentials,
+            pairing_store,
         );
         let mut store = Store::new(engine, store_data);
 
@@ -643,12 +770,18 @@ impl WasmChannel {
         let timeout = self.runtime.config().callback_timeout;
         let channel_name = self.name.clone();
         let credentials = self.get_credentials().await;
+        let pairing_store = self.pairing_store.clone();
 
         // Execute in blocking task with timeout
         let result = tokio::time::timeout(timeout, async move {
             tokio::task::spawn_blocking(move || {
-                let mut store =
-                    Self::create_store(&runtime, &prepared, &capabilities, credentials)?;
+                let mut store = Self::create_store(
+                    &runtime,
+                    &prepared,
+                    &capabilities,
+                    credentials,
+                    pairing_store,
+                )?;
                 let instance = Self::instantiate_component(&runtime, &prepared, &mut store)?;
 
                 // Call on_start using the generated typed interface
@@ -681,7 +814,21 @@ impl WasmChannel {
         .await;
 
         match result {
-            Ok(Ok((config, _host_state))) => {
+            Ok(Ok((config, mut host_state))) => {
+                // Surface WASM guest logs (errors/warnings from webhook setup, etc.)
+                for entry in host_state.take_logs() {
+                    match entry.level {
+                        crate::tools::wasm::LogLevel::Error => {
+                            tracing::error!(channel = %self.name, "{}", entry.message);
+                        }
+                        crate::tools::wasm::LogLevel::Warn => {
+                            tracing::warn!(channel = %self.name, "{}", entry.message);
+                        }
+                        _ => {
+                            tracing::debug!(channel = %self.name, "{}", entry.message);
+                        }
+                    }
+                }
                 tracing::info!(
                     channel = %self.name,
                     display_name = %config.display_name,
@@ -753,6 +900,7 @@ impl WasmChannel {
         let capabilities = self.capabilities.clone();
         let timeout = self.runtime.config().callback_timeout;
         let credentials = self.get_credentials().await;
+        let pairing_store = self.pairing_store.clone();
 
         // Prepare request data
         let method = method.to_string();
@@ -766,8 +914,13 @@ impl WasmChannel {
         // Execute in blocking task with timeout
         let result = tokio::time::timeout(timeout, async move {
             tokio::task::spawn_blocking(move || {
-                let mut store =
-                    Self::create_store(&runtime, &prepared, &capabilities, credentials)?;
+                let mut store = Self::create_store(
+                    &runtime,
+                    &prepared,
+                    &capabilities,
+                    credentials,
+                    pairing_store,
+                )?;
                 let instance = Self::instantiate_component(&runtime, &prepared, &mut store)?;
 
                 // Build the WIT request type
@@ -840,12 +993,18 @@ impl WasmChannel {
         let timeout = self.runtime.config().callback_timeout;
         let channel_name = self.name.clone();
         let credentials = self.get_credentials().await;
+        let pairing_store = self.pairing_store.clone();
 
         // Execute in blocking task with timeout
         let result = tokio::time::timeout(timeout, async move {
             tokio::task::spawn_blocking(move || {
-                let mut store =
-                    Self::create_store(&runtime, &prepared, &capabilities, credentials)?;
+                let mut store = Self::create_store(
+                    &runtime,
+                    &prepared,
+                    &capabilities,
+                    credentials,
+                    pairing_store,
+                )?;
                 let instance = Self::instantiate_component(&runtime, &prepared, &mut store)?;
 
                 // Call on_poll using the generated typed interface
@@ -929,6 +1088,7 @@ impl WasmChannel {
         let timeout = self.runtime.config().callback_timeout;
         let channel_name = self.name.clone();
         let credentials = self.get_credentials().await;
+        let pairing_store = self.pairing_store.clone();
 
         // Prepare response data
         let message_id_str = message_id.to_string();
@@ -942,8 +1102,13 @@ impl WasmChannel {
         let result = tokio::time::timeout(timeout, async move {
             tokio::task::spawn_blocking(move || {
                 tracing::info!("Creating WASM store for on_respond");
-                let mut store =
-                    Self::create_store(&runtime, &prepared, &capabilities, credentials)?;
+                let mut store = Self::create_store(
+                    &runtime,
+                    &prepared,
+                    &capabilities,
+                    credentials,
+                    pairing_store,
+                )?;
 
                 tracing::info!("Instantiating WASM component for on_respond");
                 let instance = Self::instantiate_component(&runtime, &prepared, &mut store)?;
@@ -1036,13 +1201,19 @@ impl WasmChannel {
         let timeout = self.runtime.config().callback_timeout;
         let channel_name = self.name.clone();
         let credentials = self.get_credentials().await;
+        let pairing_store = self.pairing_store.clone();
 
         let wit_update = status_to_wit(status, metadata);
 
         let result = tokio::time::timeout(timeout, async move {
             tokio::task::spawn_blocking(move || {
-                let mut store =
-                    Self::create_store(&runtime, &prepared, &capabilities, credentials)?;
+                let mut store = Self::create_store(
+                    &runtime,
+                    &prepared,
+                    &capabilities,
+                    credentials,
+                    pairing_store,
+                )?;
                 let instance = Self::instantiate_component(&runtime, &prepared, &mut store)?;
 
                 let channel_iface = instance.near_agent_channel();
@@ -1080,12 +1251,14 @@ impl WasmChannel {
     ///
     /// Static method for use by the background typing repeat task (which
     /// doesn't have access to `&self`).
+    #[allow(clippy::too_many_arguments)]
     async fn execute_status(
         channel_name: &str,
         runtime: &Arc<WasmChannelRuntime>,
         prepared: &Arc<PreparedChannelModule>,
         capabilities: &ChannelCapabilities,
         credentials: &RwLock<HashMap<String, String>>,
+        pairing_store: Arc<PairingStore>,
         timeout: Duration,
         wit_update: wit_channel::StatusUpdate,
     ) -> Result<(), WasmChannelError> {
@@ -1101,8 +1274,13 @@ impl WasmChannel {
 
         let result = tokio::time::timeout(timeout, async move {
             tokio::task::spawn_blocking(move || {
-                let mut store =
-                    Self::create_store(&runtime, &prepared, &capabilities, credentials_snapshot)?;
+                let mut store = Self::create_store(
+                    &runtime,
+                    &prepared,
+                    &capabilities,
+                    credentials_snapshot,
+                    pairing_store,
+                )?;
                 let instance = Self::instantiate_component(&runtime, &prepared, &mut store)?;
 
                 let channel_iface = instance.near_agent_channel();
@@ -1170,6 +1348,7 @@ impl WasmChannel {
                 let prepared = Arc::clone(&self.prepared);
                 let capabilities = self.capabilities.clone();
                 let credentials = self.credentials.clone();
+                let pairing_store = self.pairing_store.clone();
                 let callback_timeout = self.runtime.config().callback_timeout;
                 let wit_update = status_to_wit(&status, metadata);
 
@@ -1189,6 +1368,7 @@ impl WasmChannel {
                             &prepared,
                             &capabilities,
                             &credentials,
+                            pairing_store.clone(),
                             callback_timeout,
                             wit_update_clone,
                         )
@@ -1319,6 +1499,7 @@ impl WasmChannel {
         let message_tx = self.message_tx.clone();
         let rate_limiter = self.rate_limiter.clone();
         let credentials = self.credentials.clone();
+        let pairing_store = self.pairing_store.clone();
         let callback_timeout = self.runtime.config().callback_timeout;
 
         tokio::spawn(async move {
@@ -1340,14 +1521,15 @@ impl WasmChannel {
                             &prepared,
                             &capabilities,
                             &credentials,
+                            pairing_store.clone(),
                             callback_timeout,
                         ).await;
 
                         match result {
                             Ok(emitted_messages) => {
                                 // Process any emitted messages
-                                if !emitted_messages.is_empty() {
-                                    if let Err(e) = Self::dispatch_emitted_messages(
+                                if !emitted_messages.is_empty()
+                                    && let Err(e) = Self::dispatch_emitted_messages(
                                         &channel_name,
                                         emitted_messages,
                                         &message_tx,
@@ -1359,7 +1541,6 @@ impl WasmChannel {
                                             "Failed to dispatch emitted messages from poll"
                                         );
                                     }
-                                }
                             }
                             Err(e) => {
                                 tracing::warn!(
@@ -1391,6 +1572,7 @@ impl WasmChannel {
         prepared: &Arc<PreparedChannelModule>,
         capabilities: &ChannelCapabilities,
         credentials: &RwLock<HashMap<String, String>>,
+        pairing_store: Arc<PairingStore>,
         timeout: Duration,
     ) -> Result<Vec<EmittedMessage>, WasmChannelError> {
         // Skip if no WASM bytes (testing mode)
@@ -1411,8 +1593,13 @@ impl WasmChannel {
         // Execute in blocking task with timeout
         let result = tokio::time::timeout(timeout, async move {
             tokio::task::spawn_blocking(move || {
-                let mut store =
-                    Self::create_store(&runtime, &prepared, &capabilities, credentials_snapshot)?;
+                let mut store = Self::create_store(
+                    &runtime,
+                    &prepared,
+                    &capabilities,
+                    credentials_snapshot,
+                    pairing_store,
+                )?;
                 let instance = Self::instantiate_component(&runtime, &prepared, &mut store)?;
 
                 // Call on_poll using the generated typed interface
@@ -1583,22 +1770,22 @@ impl Channel for WasmChannel {
         *self.endpoints.write().await = endpoints;
 
         // Start polling if configured
-        if let Some(poll_config) = &config.poll {
-            if poll_config.enabled {
-                let interval = self
-                    .capabilities
-                    .validate_poll_interval(poll_config.interval_ms)
-                    .map_err(|e| ChannelError::StartupFailed {
-                        name: self.name.clone(),
-                        reason: e,
-                    })?;
+        if let Some(poll_config) = &config.poll
+            && poll_config.enabled
+        {
+            let interval = self
+                .capabilities
+                .validate_poll_interval(poll_config.interval_ms)
+                .map_err(|e| ChannelError::StartupFailed {
+                    name: self.name.clone(),
+                    reason: e,
+                })?;
 
-                // Create shutdown channel for polling and store the sender to keep it alive
-                let (poll_shutdown_tx, poll_shutdown_rx) = oneshot::channel();
-                *self.poll_shutdown_tx.write().await = Some(poll_shutdown_tx);
+            // Create shutdown channel for polling and store the sender to keep it alive
+            let (poll_shutdown_tx, poll_shutdown_rx) = oneshot::channel();
+            *self.poll_shutdown_tx.write().await = Some(poll_shutdown_tx);
 
-                self.start_polling(Duration::from_millis(interval as u64), poll_shutdown_rx);
-            }
+            self.start_polling(Duration::from_millis(interval as u64), poll_shutdown_rx);
         }
 
         tracing::info!(
@@ -1858,6 +2045,29 @@ fn status_to_wit(status: &StatusUpdate, metadata: &serde_json::Value) -> wit_cha
             message: format!("Approval needed: {} - {}", tool_name, description),
             metadata_json,
         },
+        StatusUpdate::JobStarted { job_id, title, .. } => wit_channel::StatusUpdate {
+            status: wit_channel::StatusType::Thinking,
+            message: format!("Job started: {} ({})", title, job_id),
+            metadata_json,
+        },
+        StatusUpdate::AuthRequired { extension_name, .. } => wit_channel::StatusUpdate {
+            status: wit_channel::StatusType::Thinking,
+            message: format!("Auth required: {}", extension_name),
+            metadata_json,
+        },
+        StatusUpdate::AuthCompleted {
+            extension_name,
+            success,
+            ..
+        } => wit_channel::StatusUpdate {
+            status: wit_channel::StatusType::Thinking,
+            message: format!(
+                "Auth {}: {}",
+                if *success { "completed" } else { "failed" },
+                extension_name
+            ),
+            metadata_json,
+        },
     }
 }
 
@@ -1929,6 +2139,7 @@ mod tests {
         PreparedChannelModule, WasmChannelRuntime, WasmChannelRuntimeConfig,
     };
     use crate::channels::wasm::wrapper::{HttpResponse, WasmChannel};
+    use crate::pairing::PairingStore;
     use crate::tools::wasm::ResourceLimits;
 
     fn create_test_channel() -> WasmChannel {
@@ -1944,7 +2155,13 @@ mod tests {
 
         let capabilities = ChannelCapabilities::for_channel("test").with_path("/webhook/test");
 
-        WasmChannel::new(runtime, prepared, capabilities, "{}".to_string())
+        WasmChannel::new(
+            runtime,
+            prepared,
+            capabilities,
+            "{}".to_string(),
+            Arc::new(PairingStore::new()),
+        )
     }
 
     #[test]
@@ -2019,6 +2236,7 @@ mod tests {
             &prepared,
             &capabilities,
             &credentials,
+            Arc::new(PairingStore::new()),
             timeout,
         )
         .await;
@@ -2112,7 +2330,13 @@ mod tests {
             .with_path("/webhook/poll")
             .with_polling(1000);
 
-        let channel = WasmChannel::new(runtime, prepared, capabilities, "{}".to_string());
+        let channel = WasmChannel::new(
+            runtime,
+            prepared,
+            capabilities,
+            "{}".to_string(),
+            Arc::new(PairingStore::new()),
+        );
 
         // Start the channel
         let _stream = channel.start().await.expect("Channel should start");
@@ -2350,4 +2574,126 @@ mod tests {
         assert_eq!(cloned.message, "hello");
         assert_eq!(cloned.metadata_json, "{\"a\":1}");
     }
+
+    #[test]
+    fn test_redact_credentials_replaces_values() {
+        use super::ChannelStoreData;
+
+        let mut creds = std::collections::HashMap::new();
+        creds.insert(
+            "TELEGRAM_BOT_TOKEN".to_string(),
+            "8218490433:AAEZeUxwqZ5OO3mOCXv7fKvpdhDgsmBBNis".to_string(),
+        );
+        creds.insert("OTHER_SECRET".to_string(), "s3cret".to_string());
+
+        let store = ChannelStoreData::new(
+            1024 * 1024,
+            "test",
+            ChannelCapabilities::default(),
+            creds,
+            Arc::new(PairingStore::new()),
+        );
+
+        let error = "HTTP request failed: error sending request for url \
+            (https://api.telegram.org/bot8218490433:AAEZeUxwqZ5OO3mOCXv7fKvpdhDgsmBBNis/getUpdates)";
+
+        let redacted = store.redact_credentials(error);
+
+        assert!(
+            !redacted.contains("8218490433:AAEZeUxwqZ5OO3mOCXv7fKvpdhDgsmBBNis"),
+            "credential value should be redacted"
+        );
+        assert!(
+            redacted.contains("[REDACTED:TELEGRAM_BOT_TOKEN]"),
+            "redacted text should contain placeholder name"
+        );
+        assert!(
+            !redacted.contains("s3cret"),
+            "other credentials should also be redacted"
+        );
+    }
+
+    #[test]
+    fn test_redact_credentials_no_op_without_credentials() {
+        use super::ChannelStoreData;
+
+        let store = ChannelStoreData::new(
+            1024 * 1024,
+            "test",
+            ChannelCapabilities::default(),
+            std::collections::HashMap::new(),
+            Arc::new(PairingStore::new()),
+        );
+
+        let input = "some error message";
+        assert_eq!(store.redact_credentials(input), input);
+    }
+
+    #[test]
+    fn test_redact_credentials_skips_empty_values() {
+        use super::ChannelStoreData;
+
+        let mut creds = std::collections::HashMap::new();
+        creds.insert("EMPTY_TOKEN".to_string(), String::new());
+
+        let store = ChannelStoreData::new(
+            1024 * 1024,
+            "test",
+            ChannelCapabilities::default(),
+            creds,
+            Arc::new(PairingStore::new()),
+        );
+
+        let input = "should not match anything";
+        assert_eq!(store.redact_credentials(input), input);
+    }
+
+    /// Verify that WASM HTTP host functions work using a dedicated
+    /// current-thread runtime inside spawn_blocking.
+    #[tokio::test]
+    async fn test_dedicated_runtime_inside_spawn_blocking() {
+        let result = tokio::task::spawn_blocking(|| {
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .expect("failed to build runtime");
+            rt.block_on(async { 42 })
+        })
+        .await
+        .expect("spawn_blocking panicked");
+        assert_eq!(result, 42);
+    }
+
+    /// Verify a real HTTP request works using the dedicated-runtime pattern.
+    /// This catches DNS, TLS, and I/O driver issues that trivial tests miss.
+    #[tokio::test]
+    #[ignore] // requires network
+    async fn test_dedicated_runtime_real_http() {
+        let result = tokio::task::spawn_blocking(|| {
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .expect("failed to build runtime");
+            rt.block_on(async {
+                let client = reqwest::Client::builder()
+                    .connect_timeout(std::time::Duration::from_secs(10))
+                    .build()
+                    .expect("failed to build client");
+                let resp = client
+                    .get("https://api.telegram.org/bot000/getMe")
+                    .timeout(std::time::Duration::from_secs(10))
+                    .send()
+                    .await;
+                match resp {
+                    Ok(r) => r.status().as_u16(),
+                    Err(e) if e.is_timeout() => panic!("request timed out: {e}"),
+                    Err(e) => panic!("unexpected error: {e}"),
+                }
+            })
+        })
+        .await
+        .expect("spawn_blocking panicked");
+        // 404 because "000" is not a valid bot token
+        assert_eq!(result, 404);
+    }
 }

src/channels/web/auth.rs

@@ -6,6 +6,7 @@ use axum::{
     middleware::Next,
     response::{IntoResponse, Response},
 };
+use subtle::ConstantTimeEq;
 
 /// Shared auth state injected via axum middleware state.
 #[derive(Clone)]
@@ -23,24 +24,22 @@ pub async fn auth_middleware(
     request: Request,
     next: Next,
 ) -> Response {
-    // Try Authorization header first
-    if let Some(auth_header) = headers.get("authorization") {
-        if let Ok(value) = auth_header.to_str() {
-            if let Some(token) = value.strip_prefix("Bearer ") {
-                if token == auth.token {
-                    return next.run(request).await;
-                }
-            }
-        }
+    // Try Authorization header first (constant-time comparison)
+    if let Some(auth_header) = headers.get("authorization")
+        && let Ok(value) = auth_header.to_str()
+        && let Some(token) = value.strip_prefix("Bearer ")
+        && bool::from(token.as_bytes().ct_eq(auth.token.as_bytes()))
+    {
+        return next.run(request).await;
     }
 
-    // Fall back to query parameter (for SSE EventSource)
+    // Fall back to query parameter for SSE EventSource (constant-time comparison)
     if let Some(query) = request.uri().query() {
         for pair in query.split('&') {
-            if let Some(token) = pair.strip_prefix("token=") {
-                if token == auth.token {
-                    return next.run(request).await;
-                }
+            if let Some(token) = pair.strip_prefix("token=")
+                && bool::from(token.as_bytes().ct_eq(auth.token.as_bytes()))
+            {
+                return next.run(request).await;
             }
         }
     }

src/channels/web/log_layer.rs

@@ -24,6 +24,8 @@ use tokio::sync::broadcast;
 use tracing::field::{Field, Visit};
 use tracing_subscriber::Layer;
 
+use crate::safety::LeakDetector;
+
 /// Maximum number of recent log entries kept for late-joining SSE subscribers.
 const HISTORY_CAP: usize = 500;
 
@@ -46,6 +48,8 @@ pub struct LogEntry {
 pub struct LogBroadcaster {
     tx: broadcast::Sender<LogEntry>,
     recent: Mutex<VecDeque<LogEntry>>,
+    /// Scrubs secrets from log messages before broadcasting to SSE clients.
+    leak_detector: LeakDetector,
 }
 
 impl LogBroadcaster {
@@ -54,10 +58,19 @@ impl LogBroadcaster {
         Self {
             tx,
             recent: Mutex::new(VecDeque::with_capacity(HISTORY_CAP)),
+            leak_detector: LeakDetector::new(),
         }
     }
 
-    pub fn send(&self, entry: LogEntry) {
+    pub fn send(&self, mut entry: LogEntry) {
+        // Scrub secrets from the message before it reaches any subscriber.
+        // This is defense-in-depth: even if code elsewhere accidentally logs
+        // a secret, it won't be broadcast to SSE clients.
+        entry.message = self
+            .leak_detector
+            .scan_and_clean(&entry.message)
+            .unwrap_or_else(|_| "[log message redacted: contained blocked secret]".to_string());
+
         // Stash in ring buffer (for late joiners)
         if let Ok(mut buf) = self.recent.lock() {
             if buf.len() >= HISTORY_CAP {
@@ -145,6 +158,9 @@ impl Visit for MessageVisitor {
 ///
 /// Only forwards DEBUG and above. Attach to the tracing subscriber
 /// alongside the existing fmt layer.
+///
+/// Log messages are scrubbed through `LeakDetector` in `LogBroadcaster::send()`
+/// (the single funnel point for all log output, including late-joiner history).
 pub struct WebLogLayer {
     broadcaster: Arc<LogBroadcaster>,
 }
@@ -178,6 +194,7 @@ impl<S: tracing::Subscriber> Layer<S> for WebLogLayer {
             timestamp: chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Millis, true),
         };
 
+        // LeakDetector scrubbing happens inside broadcaster.send()
         self.broadcaster.send(entry);
     }
 }
@@ -313,4 +330,29 @@ mod tests {
         let v = MessageVisitor::new();
         assert_eq!(v.finish(), "");
     }
+
+    #[test]
+    fn test_broadcaster_has_leak_detector() {
+        let broadcaster = LogBroadcaster::new();
+        // Verify the leak detector is initialized with default patterns
+        assert!(broadcaster.leak_detector.pattern_count() > 0);
+    }
+
+    #[test]
+    fn test_leak_detector_scrubs_api_key_in_log() {
+        let detector = crate::safety::LeakDetector::new();
+        let msg = "Connecting with token sk-proj-test1234567890abcdefghij";
+        let result = detector.scan_and_clean(msg);
+        // Should be blocked (OpenAI key pattern)
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_leak_detector_passes_clean_log() {
+        let detector = crate::safety::LeakDetector::new();
+        let msg = "Request completed status=200 url=https://api.example.com/data";
+        let result = detector.scan_and_clean(msg);
+        assert!(result.is_ok());
+        assert_eq!(result.unwrap(), msg);
+    }
 }

src/channels/web/mod.rs

@@ -10,12 +10,13 @@
 //!         ◄── GET  /api/chat/events ── SSE stream
 //!         ─── GET  /api/chat/ws ─────► WebSocket (bidirectional)
 //!         ─── GET  /api/memory/* ────► Workspace
-//!         ─── GET  /api/jobs/* ──────► ContextManager
+//!         ─── GET  /api/jobs/* ──────► Database
 //!         ◄── GET  / ───────────────── Static HTML/CSS/JS
 //! ```
 
 pub mod auth;
 pub mod log_layer;
+pub mod openai_compat;
 pub mod server;
 pub mod sse;
 pub mod types;
@@ -31,9 +32,10 @@ use tokio_stream::wrappers::ReceiverStream;
 use crate::agent::SessionManager;
 use crate::channels::{Channel, IncomingMessage, MessageStream, OutgoingResponse, StatusUpdate};
 use crate::config::GatewayConfig;
-use crate::context::ContextManager;
+use crate::db::Database;
 use crate::error::ChannelError;
 use crate::extensions::ExtensionManager;
+use crate::orchestrator::job_manager::ContainerJobManager;
 use crate::tools::ToolRegistry;
 use crate::workspace::Workspace;
 
@@ -70,14 +72,18 @@ impl GatewayChannel {
             msg_tx: tokio::sync::RwLock::new(None),
             sse: SseManager::new(),
             workspace: None,
-            context_manager: None,
             session_manager: None,
             log_broadcaster: None,
             extension_manager: None,
             tool_registry: None,
+            store: None,
+            job_manager: None,
+            prompt_queue: None,
             user_id: config.user_id.clone(),
             shutdown_tx: tokio::sync::RwLock::new(None),
             ws_tracker: Some(Arc::new(ws::WsConnectionTracker::new())),
+            llm_provider: None,
+            chat_rate_limiter: server::RateLimiter::new(30, 60),
         });
 
         Self {
@@ -93,14 +99,18 @@ impl GatewayChannel {
             msg_tx: tokio::sync::RwLock::new(None),
             sse: SseManager::new(),
             workspace: self.state.workspace.clone(),
-            context_manager: self.state.context_manager.clone(),
             session_manager: self.state.session_manager.clone(),
             log_broadcaster: self.state.log_broadcaster.clone(),
             extension_manager: self.state.extension_manager.clone(),
             tool_registry: self.state.tool_registry.clone(),
+            store: self.state.store.clone(),
+            job_manager: self.state.job_manager.clone(),
+            prompt_queue: self.state.prompt_queue.clone(),
             user_id: self.state.user_id.clone(),
             shutdown_tx: tokio::sync::RwLock::new(None),
             ws_tracker: self.state.ws_tracker.clone(),
+            llm_provider: self.state.llm_provider.clone(),
+            chat_rate_limiter: server::RateLimiter::new(30, 60),
         };
         mutate(&mut new_state);
         self.state = Arc::new(new_state);
@@ -112,12 +122,6 @@ impl GatewayChannel {
         self
     }
 
-    /// Inject the context manager for the jobs API.
-    pub fn with_context_manager(mut self, cm: Arc<ContextManager>) -> Self {
-        self.rebuild_state(|s| s.context_manager = Some(cm));
-        self
-    }
-
     /// Inject the session manager for thread/session info.
     pub fn with_session_manager(mut self, sm: Arc<SessionManager>) -> Self {
         self.rebuild_state(|s| s.session_manager = Some(sm));
@@ -142,6 +146,40 @@ impl GatewayChannel {
         self
     }
 
+    /// Inject the database store for sandbox job persistence.
+    pub fn with_store(mut self, store: Arc<dyn Database>) -> Self {
+        self.rebuild_state(|s| s.store = Some(store));
+        self
+    }
+
+    /// Inject the container job manager for sandbox operations.
+    pub fn with_job_manager(mut self, jm: Arc<ContainerJobManager>) -> Self {
+        self.rebuild_state(|s| s.job_manager = Some(jm));
+        self
+    }
+
+    /// Inject the prompt queue for Claude Code follow-up prompts.
+    pub fn with_prompt_queue(
+        mut self,
+        pq: Arc<
+            tokio::sync::Mutex<
+                std::collections::HashMap<
+                    uuid::Uuid,
+                    std::collections::VecDeque<crate::orchestrator::api::PendingPrompt>,
+                >,
+            >,
+        >,
+    ) -> Self {
+        self.rebuild_state(|s| s.prompt_queue = Some(pq));
+        self
+    }
+
+    /// Inject the LLM provider for OpenAI-compatible API proxy.
+    pub fn with_llm_provider(mut self, llm: Arc<dyn crate::llm::LlmProvider>) -> Self {
+        self.rebuild_state(|s| s.llm_provider = Some(llm));
+        self
+    }
+
     /// Get the auth token (for printing to console on startup).
     pub fn auth_token(&self) -> &str {
         &self.auth_token
@@ -173,11 +211,7 @@ impl Channel for GatewayChannel {
                 ),
             })?;
 
-        let bound_addr =
-            server::start_server(addr, self.state.clone(), self.auth_token.clone()).await?;
-
-        tracing::info!("Web gateway listening on http://{}", bound_addr);
-        tracing::info!("Auth token: {}", self.auth_token);
+        server::start_server(addr, self.state.clone(), self.auth_token.clone()).await?;
 
         Ok(Box::pin(ReceiverStream::new(rx)))
     }
@@ -200,17 +234,48 @@ impl Channel for GatewayChannel {
     async fn send_status(
         &self,
         status: StatusUpdate,
-        _metadata: &serde_json::Value,
+        metadata: &serde_json::Value,
     ) -> Result<(), ChannelError> {
+        let thread_id = metadata
+            .get("thread_id")
+            .and_then(|v| v.as_str())
+            .map(String::from);
         let event = match status {
-            StatusUpdate::Thinking(msg) => SseEvent::Thinking { message: msg },
-            StatusUpdate::ToolStarted { name } => SseEvent::ToolStarted { name },
-            StatusUpdate::ToolCompleted { name, success } => {
-                SseEvent::ToolCompleted { name, success }
-            }
-            StatusUpdate::ToolResult { name, preview } => SseEvent::ToolResult { name, preview },
-            StatusUpdate::StreamChunk(content) => SseEvent::StreamChunk { content },
-            StatusUpdate::Status(msg) => SseEvent::Status { message: msg },
+            StatusUpdate::Thinking(msg) => SseEvent::Thinking {
+                message: msg,
+                thread_id: thread_id.clone(),
+            },
+            StatusUpdate::ToolStarted { name } => SseEvent::ToolStarted {
+                name,
+                thread_id: thread_id.clone(),
+            },
+            StatusUpdate::ToolCompleted { name, success } => SseEvent::ToolCompleted {
+                name,
+                success,
+                thread_id: thread_id.clone(),
+            },
+            StatusUpdate::ToolResult { name, preview } => SseEvent::ToolResult {
+                name,
+                preview,
+                thread_id: thread_id.clone(),
+            },
+            StatusUpdate::StreamChunk(content) => SseEvent::StreamChunk {
+                content,
+                thread_id: thread_id.clone(),
+            },
+            StatusUpdate::Status(msg) => SseEvent::Status {
+                message: msg,
+                thread_id: thread_id.clone(),
+            },
+            StatusUpdate::JobStarted {
+                job_id,
+                title,
+                browse_url,
+            } => SseEvent::JobStarted {
+                job_id,
+                title,
+                browse_url,
+            },
             StatusUpdate::ApprovalNeeded {
                 request_id,
                 tool_name,
@@ -223,6 +288,26 @@ impl Channel for GatewayChannel {
                 parameters: serde_json::to_string_pretty(&parameters)
                     .unwrap_or_else(|_| parameters.to_string()),
             },
+            StatusUpdate::AuthRequired {
+                extension_name,
+                instructions,
+                auth_url,
+                setup_url,
+            } => SseEvent::AuthRequired {
+                extension_name,
+                instructions,
+                auth_url,
+                setup_url,
+            },
+            StatusUpdate::AuthCompleted {
+                extension_name,
+                success,
+                message,
+            } => SseEvent::AuthCompleted {
+                extension_name,
+                success,
+                message,
+            },
         };
 
         self.state.sse.broadcast(event);

src/channels/web/sse.rs

@@ -13,10 +13,15 @@ use tokio_stream::wrappers::BroadcastStream;
 
 use crate::channels::web::types::SseEvent;
 
+/// Maximum number of concurrent SSE/WebSocket connections.
+/// Prevents resource exhaustion from connection flooding.
+const MAX_CONNECTIONS: u64 = 100;
+
 /// Manages SSE broadcast to all connected browser tabs.
 pub struct SseManager {
     tx: broadcast::Sender<SseEvent>,
     connection_count: Arc<AtomicU64>,
+    max_connections: u64,
 }
 
 impl SseManager {
@@ -27,6 +32,7 @@ impl SseManager {
         Self {
             tx,
             connection_count: Arc::new(AtomicU64::new(0)),
+            max_connections: MAX_CONNECTIONS,
         }
     }
 
@@ -45,25 +51,50 @@ impl SseManager {
     ///
     /// Returns a stream of `SseEvent` values and increments/decrements the
     /// connection counter on creation/drop, just like `subscribe()` does for SSE.
-    pub fn subscribe_raw(&self) -> impl Stream<Item = SseEvent> + Send + 'static + use<> {
+    ///
+    /// Returns `None` if the maximum connection limit has been reached.
+    pub fn subscribe_raw(&self) -> Option<impl Stream<Item = SseEvent> + Send + 'static + use<>> {
+        // Atomically increment only if below the limit. This prevents
+        // concurrent callers from overshooting max_connections.
         let counter = Arc::clone(&self.connection_count);
-        counter.fetch_add(1, Ordering::Relaxed);
+        let max = self.max_connections;
+        counter
+            .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |current| {
+                if current < max {
+                    Some(current + 1)
+                } else {
+                    None
+                }
+            })
+            .ok()?;
         let rx = self.tx.subscribe();
 
         let stream = BroadcastStream::new(rx).filter_map(|result| result.ok());
 
-        CountedStream {
+        Some(CountedStream {
             inner: stream,
             counter,
-        }
+        })
     }
 
     /// Create a new SSE stream for a client connection.
+    ///
+    /// Returns `None` if the maximum connection limit has been reached.
     pub fn subscribe(
         &self,
-    ) -> Sse<impl Stream<Item = Result<Event, Infallible>> + Send + 'static + use<>> {
+    ) -> Option<Sse<impl Stream<Item = Result<Event, Infallible>> + Send + 'static + use<>>> {
+        // Atomically increment only if below the limit.
         let counter = Arc::clone(&self.connection_count);
-        counter.fetch_add(1, Ordering::Relaxed);
+        let max = self.max_connections;
+        counter
+            .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |current| {
+                if current < max {
+                    Some(current + 1)
+                } else {
+                    None
+                }
+            })
+            .ok()?;
         let rx = self.tx.subscribe();
 
         let stream = BroadcastStream::new(rx)
@@ -79,7 +110,15 @@ impl SseManager {
                     SseEvent::StreamChunk { .. } => "stream_chunk",
                     SseEvent::Status { .. } => "status",
                     SseEvent::ApprovalNeeded { .. } => "approval_needed",
+                    SseEvent::AuthRequired { .. } => "auth_required",
+                    SseEvent::AuthCompleted { .. } => "auth_completed",
                     SseEvent::Error { .. } => "error",
+                    SseEvent::JobStarted { .. } => "job_started",
+                    SseEvent::JobMessage { .. } => "job_message",
+                    SseEvent::JobToolUse { .. } => "job_tool_use",
+                    SseEvent::JobToolResult { .. } => "job_tool_result",
+                    SseEvent::JobStatus { .. } => "job_status",
+                    SseEvent::JobResult { .. } => "job_result",
                     SseEvent::Heartbeat => "heartbeat",
                 };
                 Ok(Event::default().event(event_type).data(data))
@@ -91,8 +130,10 @@ impl SseManager {
             counter,
         };
 
-        Sse::new(counted_stream)
-            .keep_alive(KeepAlive::new().interval(Duration::from_secs(30)).text(""))
+        Some(
+            Sse::new(counted_stream)
+                .keep_alive(KeepAlive::new().interval(Duration::from_secs(30)).text("")),
+        )
     }
 }
 
@@ -152,13 +193,14 @@ mod tests {
 
         manager.broadcast(SseEvent::Status {
             message: "test".to_string(),
+            thread_id: None,
         });
 
         let event = rx.next().await;
         assert!(event.is_some());
         let event = event.unwrap().unwrap();
         match event {
-            SseEvent::Status { message } => assert_eq!(message, "test"),
+            SseEvent::Status { message, .. } => assert_eq!(message, "test"),
             _ => panic!("unexpected event type"),
         }
     }
@@ -166,17 +208,18 @@ mod tests {
     #[tokio::test]
     async fn test_subscribe_raw_receives_events() {
         let manager = SseManager::new();
-        let mut stream = Box::pin(manager.subscribe_raw());
+        let mut stream = Box::pin(manager.subscribe_raw().expect("should subscribe"));
 
         assert_eq!(manager.connection_count(), 1);
 
         manager.broadcast(SseEvent::Thinking {
             message: "working".to_string(),
+            thread_id: None,
         });
 
         let event = stream.next().await.unwrap();
         match event {
-            SseEvent::Thinking { message } => assert_eq!(message, "working"),
+            SseEvent::Thinking { message, .. } => assert_eq!(message, "working"),
             _ => panic!("Expected Thinking event"),
         }
     }
@@ -185,7 +228,7 @@ mod tests {
     async fn test_subscribe_raw_decrements_on_drop() {
         let manager = SseManager::new();
         {
-            let _stream = Box::pin(manager.subscribe_raw());
+            let _stream = Box::pin(manager.subscribe_raw().expect("should subscribe"));
             assert_eq!(manager.connection_count(), 1);
         }
         // Stream dropped, counter should decrement
@@ -195,8 +238,8 @@ mod tests {
     #[tokio::test]
     async fn test_subscribe_raw_multiple_subscribers() {
         let manager = SseManager::new();
-        let mut s1 = Box::pin(manager.subscribe_raw());
-        let mut s2 = Box::pin(manager.subscribe_raw());
+        let mut s1 = Box::pin(manager.subscribe_raw().expect("should subscribe"));
+        let mut s2 = Box::pin(manager.subscribe_raw().expect("should subscribe"));
         assert_eq!(manager.connection_count(), 2);
 
         manager.broadcast(SseEvent::Heartbeat);
@@ -211,4 +254,18 @@ mod tests {
         drop(s2);
         assert_eq!(manager.connection_count(), 0);
     }
+
+    #[tokio::test]
+    async fn test_subscribe_raw_rejects_over_limit() {
+        let mut manager = SseManager::new();
+        manager.max_connections = 2; // Low limit for testing
+
+        let _s1 = Box::pin(manager.subscribe_raw().expect("first should succeed"));
+        let _s2 = Box::pin(manager.subscribe_raw().expect("second should succeed"));
+        assert_eq!(manager.connection_count(), 2);
+
+        // Third should be rejected
+        assert!(manager.subscribe_raw().is_none());
+        assert!(manager.subscribe().is_none());
+    }
 }

src/channels/web/static/index.html

@@ -5,17 +5,28 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>IronClaw</title>
   <link rel="stylesheet" href="/style.css">
-  <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+  <script
+    src="https://cdn.jsdelivr.net/npm/[email protected]/lib/marked.umd.min.js"
+    integrity="sha384-pN9zSKOnTZwXRtYZAu0PBPEgR2B7DOC1aeLxQ33oJ0oy5iN1we6gm57xldM2irDG"
+    crossorigin="anonymous"
+  ></script>
 </head>
 <body>
   <!-- Auth Screen -->
   <div id="auth-screen">
-    <h1>IronClaw</h1>
-    <div class="auth-form">
-      <input type="password" id="token-input" placeholder="Auth token" autofocus>
-      <button onclick="authenticate()">Connect</button>
+    <div class="auth-card-login">
+      <div class="auth-brand">
+        <h1>IronClaw</h1>
+        <p class="auth-tagline">Secure AI Assistant</p>
+      </div>
+      <div class="auth-form">
+        <label for="token-input">Gateway Token</label>
+        <input type="password" id="token-input" placeholder="Paste your auth token" autofocus>
+        <button onclick="authenticate()">Connect</button>
+      </div>
+      <div id="auth-error"></div>
+      <p class="auth-hint">Enter the GATEWAY_AUTH_TOKEN from your .env configuration.</p>
     </div>
-    <div id="auth-error"></div>
   </div>
 
   <!-- Main App (hidden until authenticated) -->
@@ -26,16 +37,33 @@
       <button data-tab="memory">Memory</button>
       <button data-tab="jobs">Jobs</button>
       <button data-tab="logs">Logs</button>
+      <button data-tab="routines">Routines</button>
       <button data-tab="extensions">Extensions</button>
       <div class="spacer"></div>
-      <div class="status">
+      <div class="status" id="gateway-status-trigger">
         <div class="dot" id="sse-dot"></div>
         <span id="sse-status">Connected</span>
+        <div class="gateway-popover" id="gateway-popover"></div>
       </div>
     </div>
 
     <!-- Chat Tab -->
     <div class="tab-panel active" id="tab-chat">
+      <div class="thread-sidebar" id="thread-sidebar">
+        <div class="thread-sidebar-header">
+          <span>Threads</span>
+          <button class="thread-new-btn" onclick="createNewThread()" title="New thread (Ctrl/Cmd+N)">+</button>
+          <button class="thread-toggle-btn" id="thread-toggle-btn" onclick="toggleThreadSidebar()" title="Toggle sidebar">&laquo;</button>
+        </div>
+        <div class="assistant-item" id="assistant-thread" onclick="switchToAssistant()">
+          <span class="assistant-label">Assistant</span>
+          <span class="assistant-meta" id="assistant-meta"></span>
+        </div>
+        <div class="threads-section-header">
+          <span>Conversations</span>
+        </div>
+        <div class="thread-list" id="thread-list"></div>
+      </div>
       <div class="chat-container">
         <div class="chat-messages" id="chat-messages"></div>
         <div class="chat-status" id="chat-status"></div>
@@ -56,10 +84,20 @@
           <div class="memory-tree" id="memory-tree"></div>
         </div>
         <div class="memory-content">
-          <div class="memory-breadcrumb" id="memory-breadcrumb">workspace /</div>
+          <div class="memory-breadcrumb" id="memory-breadcrumb">
+            <span id="memory-breadcrumb-path">workspace /</span>
+            <button class="memory-edit-btn" id="memory-edit-btn" style="display:none" onclick="startMemoryEdit()">Edit</button>
+          </div>
           <div class="memory-viewer" id="memory-viewer">
             <div class="empty">Select a file to view its contents</div>
           </div>
+          <div class="memory-editor" id="memory-editor" style="display:none">
+            <textarea id="memory-edit-textarea"></textarea>
+            <div class="memory-editor-actions">
+              <button class="btn-save" onclick="saveMemoryEdit()">Save</button>
+              <button class="btn-cancel-edit" onclick="cancelMemoryEdit()">Cancel</button>
+            </div>
+          </div>
         </div>
       </div>
     </div>
@@ -73,6 +111,7 @@
             <tr>
               <th>ID</th>
               <th>Title</th>
+              <th>Source</th>
               <th>Status</th>
               <th>Created</th>
               <th>Actions</th>
@@ -104,9 +143,48 @@
       </div>
     </div>
 
+    <!-- Routines Tab -->
+    <div class="tab-panel" id="tab-routines">
+      <div class="routines-container">
+        <div class="routines-summary" id="routines-summary"></div>
+        <table class="routines-table" id="routines-table">
+          <thead>
+            <tr>
+              <th>Name</th>
+              <th>Trigger</th>
+              <th>Action</th>
+              <th>Last Run</th>
+              <th>Next Run</th>
+              <th>Runs</th>
+              <th>Status</th>
+              <th>Actions</th>
+            </tr>
+          </thead>
+          <tbody id="routines-tbody"></tbody>
+        </table>
+        <div class="empty-state" id="routines-empty" style="display:none">
+          No routines configured. Ask the assistant to create one.
+        </div>
+        <div class="routine-detail" id="routine-detail" style="display:none"></div>
+      </div>
+    </div>
+
     <!-- Extensions Tab -->
     <div class="tab-panel" id="tab-extensions">
       <div class="extensions-container">
+        <div class="extensions-section">
+          <h3>Install Extension</h3>
+          <div class="ext-install-form" id="ext-install-form">
+            <input type="text" id="ext-install-name" placeholder="Extension name (required)">
+            <input type="text" id="ext-install-url" placeholder="URL (optional)">
+            <select id="ext-install-kind">
+              <option value="mcp_server">MCP Server</option>
+              <option value="wasm_tool">WASM Tool</option>
+              <option value="wasm_channel">WASM Channel</option>
+            </select>
+            <button onclick="installExtension()">Install</button>
+          </div>
+        </div>
         <div class="extensions-section">
           <h3>Installed Extensions</h3>
           <div class="extensions-list" id="extensions-list">
@@ -130,6 +208,7 @@
     </div>
   </div>
 
+  <div id="toasts"></div>
   <script src="/app.js"></script>
 </body>
 </html>

src/channels/web/types.rs

@@ -24,10 +24,17 @@ pub struct ThreadInfo {
     pub turn_count: usize,
     pub created_at: String,
     pub updated_at: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub thread_type: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
 pub struct ThreadListResponse {
+    /// The pinned assistant thread (always present after first load).
+    pub assistant_thread: Option<ThreadInfo>,
+    /// Regular conversation threads.
     pub threads: Vec<ThreadInfo>,
     pub active_thread: Option<Uuid>,
 }
@@ -54,6 +61,12 @@ pub struct ToolCallInfo {
 pub struct HistoryResponse {
     pub thread_id: Uuid,
     pub turns: Vec<TurnInfo>,
+    /// Whether there are older messages available.
+    #[serde(default)]
+    pub has_more: bool,
+    /// Cursor for the next page (ISO8601 timestamp of the oldest message returned).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub oldest_timestamp: Option<String>,
 }
 
 // --- Approval ---
@@ -63,6 +76,8 @@ pub struct ApprovalRequest {
     pub request_id: String,
     /// "approve", "always", or "deny"
     pub action: String,
+    /// Thread that owns the pending approval (so the agent loop finds the right session).
+    pub thread_id: Option<String>,
 }
 
 // --- SSE Event Types ---
@@ -73,17 +88,49 @@ pub enum SseEvent {
     #[serde(rename = "response")]
     Response { content: String, thread_id: String },
     #[serde(rename = "thinking")]
-    Thinking { message: String },
+    Thinking {
+        message: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
     #[serde(rename = "tool_started")]
-    ToolStarted { name: String },
+    ToolStarted {
+        name: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
     #[serde(rename = "tool_completed")]
-    ToolCompleted { name: String, success: bool },
+    ToolCompleted {
+        name: String,
+        success: bool,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
     #[serde(rename = "tool_result")]
-    ToolResult { name: String, preview: String },
+    ToolResult {
+        name: String,
+        preview: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
     #[serde(rename = "stream_chunk")]
-    StreamChunk { content: String },
+    StreamChunk {
+        content: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
     #[serde(rename = "status")]
-    Status { message: String },
+    Status {
+        message: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
+    #[serde(rename = "job_started")]
+    JobStarted {
+        job_id: String,
+        title: String,
+        browse_url: String,
+    },
     #[serde(rename = "approval_needed")]
     ApprovalNeeded {
         request_id: String,
@@ -91,10 +138,59 @@ pub enum SseEvent {
         description: String,
         parameters: String,
     },
+    #[serde(rename = "auth_required")]
+    AuthRequired {
+        extension_name: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        instructions: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        auth_url: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        setup_url: Option<String>,
+    },
+    #[serde(rename = "auth_completed")]
+    AuthCompleted {
+        extension_name: String,
+        success: bool,
+        message: String,
+    },
     #[serde(rename = "error")]
-    Error { message: String },
+    Error {
+        message: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        thread_id: Option<String>,
+    },
     #[serde(rename = "heartbeat")]
     Heartbeat,
+
+    // Sandbox job streaming events (worker + Claude Code bridge)
+    #[serde(rename = "job_message")]
+    JobMessage {
+        job_id: String,
+        role: String,
+        content: String,
+    },
+    #[serde(rename = "job_tool_use")]
+    JobToolUse {
+        job_id: String,
+        tool_name: String,
+        input: serde_json::Value,
+    },
+    #[serde(rename = "job_tool_result")]
+    JobToolResult {
+        job_id: String,
+        tool_name: String,
+        output: String,
+    },
+    #[serde(rename = "job_status")]
+    JobStatus { job_id: String, message: String },
+    #[serde(rename = "job_result")]
+    JobResult {
+        job_id: String,
+        status: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        session_id: Option<String>,
+    },
 }
 
 // --- Memory ---
@@ -188,6 +284,54 @@ pub struct JobSummaryResponse {
     pub stuck: usize,
 }
 
+#[derive(Debug, Serialize)]
+pub struct JobDetailResponse {
+    pub id: Uuid,
+    pub title: String,
+    pub description: String,
+    pub state: String,
+    pub user_id: String,
+    pub created_at: String,
+    pub started_at: Option<String>,
+    pub completed_at: Option<String>,
+    pub elapsed_secs: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_dir: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub browse_url: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub job_mode: Option<String>,
+    pub transitions: Vec<TransitionInfo>,
+}
+
+// --- Project Files ---
+
+#[derive(Debug, Serialize)]
+pub struct ProjectFileEntry {
+    pub name: String,
+    pub path: String,
+    pub is_dir: bool,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ProjectFilesResponse {
+    pub entries: Vec<ProjectFileEntry>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ProjectFileReadResponse {
+    pub path: String,
+    pub content: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct TransitionInfo {
+    pub from: String,
+    pub to: String,
+    pub timestamp: String,
+    pub reason: Option<String>,
+}
+
 // --- Extensions ---
 
 #[derive(Debug, Serialize)]
@@ -262,6 +406,21 @@ impl ActionResponse {
     }
 }
 
+// --- Auth Token ---
+
+/// Request to submit an auth token for an extension (dedicated endpoint).
+#[derive(Debug, Deserialize)]
+pub struct AuthTokenRequest {
+    pub extension_name: String,
+    pub token: String,
+}
+
+/// Request to cancel an in-progress auth flow.
+#[derive(Debug, Deserialize)]
+pub struct AuthCancelRequest {
+    pub extension_name: String,
+}
+
 // --- WebSocket ---
 
 /// Message sent by a WebSocket client to the server.
@@ -280,7 +439,18 @@ pub enum WsClientMessage {
         request_id: String,
         /// "approve", "always", or "deny"
         action: String,
+        /// Thread that owns the pending approval.
+        thread_id: Option<String>,
     },
+    /// Submit an auth token for an extension (bypasses message pipeline).
+    #[serde(rename = "auth_token")]
+    AuthToken {
+        extension_name: String,
+        token: String,
+    },
+    /// Cancel an in-progress auth flow.
+    #[serde(rename = "auth_cancel")]
+    AuthCancel { extension_name: String },
     /// Client heartbeat ping.
     #[serde(rename = "ping")]
     Ping,
@@ -317,9 +487,17 @@ impl WsServerMessage {
             SseEvent::ToolResult { .. } => "tool_result",
             SseEvent::StreamChunk { .. } => "stream_chunk",
             SseEvent::Status { .. } => "status",
+            SseEvent::JobStarted { .. } => "job_started",
             SseEvent::ApprovalNeeded { .. } => "approval_needed",
+            SseEvent::AuthRequired { .. } => "auth_required",
+            SseEvent::AuthCompleted { .. } => "auth_completed",
             SseEvent::Error { .. } => "error",
             SseEvent::Heartbeat => "heartbeat",
+            SseEvent::JobMessage { .. } => "job_message",
+            SseEvent::JobToolUse { .. } => "job_tool_use",
+            SseEvent::JobToolResult { .. } => "job_tool_result",
+            SseEvent::JobStatus { .. } => "job_status",
+            SseEvent::JobResult { .. } => "job_result",
         };
         let data = serde_json::to_value(event).unwrap_or(serde_json::Value::Null);
         WsServerMessage::Event {
@@ -329,6 +507,96 @@ impl WsServerMessage {
     }
 }
 
+// --- Routines ---
+
+#[derive(Debug, Serialize)]
+pub struct RoutineInfo {
+    pub id: Uuid,
+    pub name: String,
+    pub description: String,
+    pub enabled: bool,
+    pub trigger_type: String,
+    pub trigger_summary: String,
+    pub action_type: String,
+    pub last_run_at: Option<String>,
+    pub next_fire_at: Option<String>,
+    pub run_count: u64,
+    pub consecutive_failures: u32,
+    pub status: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct RoutineListResponse {
+    pub routines: Vec<RoutineInfo>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct RoutineSummaryResponse {
+    pub total: u64,
+    pub enabled: u64,
+    pub disabled: u64,
+    pub failing: u64,
+    pub runs_today: u64,
+}
+
+#[derive(Debug, Serialize)]
+pub struct RoutineDetailResponse {
+    pub id: Uuid,
+    pub name: String,
+    pub description: String,
+    pub enabled: bool,
+    pub trigger: serde_json::Value,
+    pub action: serde_json::Value,
+    pub guardrails: serde_json::Value,
+    pub notify: serde_json::Value,
+    pub last_run_at: Option<String>,
+    pub next_fire_at: Option<String>,
+    pub run_count: u64,
+    pub consecutive_failures: u32,
+    pub created_at: String,
+    pub recent_runs: Vec<RoutineRunInfo>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct RoutineRunInfo {
+    pub id: Uuid,
+    pub trigger_type: String,
+    pub started_at: String,
+    pub completed_at: Option<String>,
+    pub status: String,
+    pub result_summary: Option<String>,
+    pub tokens_used: Option<i32>,
+}
+
+// --- Settings ---
+
+#[derive(Debug, Serialize)]
+pub struct SettingResponse {
+    pub key: String,
+    pub value: serde_json::Value,
+    pub updated_at: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct SettingsListResponse {
+    pub settings: Vec<SettingResponse>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct SettingWriteRequest {
+    pub value: serde_json::Value,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct SettingsImportRequest {
+    pub settings: std::collections::HashMap<String, serde_json::Value>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct SettingsExportResponse {
+    pub settings: std::collections::HashMap<String, serde_json::Value>,
+}
+
 // --- Health ---
 
 #[derive(Debug, Serialize)]
@@ -371,12 +639,36 @@ mod tests {
 
     #[test]
     fn test_ws_client_approval_parse() {
-        let json = r#"{"type":"approval","request_id":"abc-123","action":"approve"}"#;
+        let json =
+            r#"{"type":"approval","request_id":"abc-123","action":"approve","thread_id":"t1"}"#;
         let msg: WsClientMessage = serde_json::from_str(json).unwrap();
         match msg {
-            WsClientMessage::Approval { request_id, action } => {
+            WsClientMessage::Approval {
+                request_id,
+                action,
+                thread_id,
+            } => {
                 assert_eq!(request_id, "abc-123");
                 assert_eq!(action, "approve");
+                assert_eq!(thread_id.as_deref(), Some("t1"));
+            }
+            _ => panic!("Expected Approval variant"),
+        }
+    }
+
+    #[test]
+    fn test_ws_client_approval_parse_no_thread() {
+        let json = r#"{"type":"approval","request_id":"abc-123","action":"deny"}"#;
+        let msg: WsClientMessage = serde_json::from_str(json).unwrap();
+        match msg {
+            WsClientMessage::Approval {
+                request_id,
+                action,
+                thread_id,
+            } => {
+                assert_eq!(request_id, "abc-123");
+                assert_eq!(action, "deny");
+                assert!(thread_id.is_none());
             }
             _ => panic!("Expected Approval variant"),
         }
@@ -437,6 +729,7 @@ mod tests {
     fn test_ws_server_from_sse_thinking() {
         let sse = SseEvent::Thinking {
             message: "reasoning...".to_string(),
+            thread_id: None,
         };
         let ws = WsServerMessage::from_sse_event(&sse);
         match ws {
@@ -477,4 +770,115 @@ mod tests {
             _ => panic!("Expected Event variant"),
         }
     }
+
+    // ---- Auth type tests ----
+
+    #[test]
+    fn test_ws_client_auth_token_parse() {
+        let json = r#"{"type":"auth_token","extension_name":"notion","token":"sk-123"}"#;
+        let msg: WsClientMessage = serde_json::from_str(json).unwrap();
+        match msg {
+            WsClientMessage::AuthToken {
+                extension_name,
+                token,
+            } => {
+                assert_eq!(extension_name, "notion");
+                assert_eq!(token, "sk-123");
+            }
+            _ => panic!("Expected AuthToken variant"),
+        }
+    }
+
+    #[test]
+    fn test_ws_client_auth_cancel_parse() {
+        let json = r#"{"type":"auth_cancel","extension_name":"notion"}"#;
+        let msg: WsClientMessage = serde_json::from_str(json).unwrap();
+        match msg {
+            WsClientMessage::AuthCancel { extension_name } => {
+                assert_eq!(extension_name, "notion");
+            }
+            _ => panic!("Expected AuthCancel variant"),
+        }
+    }
+
+    #[test]
+    fn test_sse_auth_required_serialize() {
+        let event = SseEvent::AuthRequired {
+            extension_name: "notion".to_string(),
+            instructions: Some("Get your token from...".to_string()),
+            auth_url: None,
+            setup_url: Some("https://notion.so/integrations".to_string()),
+        };
+        let json = serde_json::to_string(&event).unwrap();
+        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
+        assert_eq!(parsed["type"], "auth_required");
+        assert_eq!(parsed["extension_name"], "notion");
+        assert_eq!(parsed["instructions"], "Get your token from...");
+        assert!(parsed.get("auth_url").is_none());
+        assert_eq!(parsed["setup_url"], "https://notion.so/integrations");
+    }
+
+    #[test]
+    fn test_sse_auth_completed_serialize() {
+        let event = SseEvent::AuthCompleted {
+            extension_name: "notion".to_string(),
+            success: true,
+            message: "notion authenticated (3 tools loaded)".to_string(),
+        };
+        let json = serde_json::to_string(&event).unwrap();
+        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
+        assert_eq!(parsed["type"], "auth_completed");
+        assert_eq!(parsed["extension_name"], "notion");
+        assert_eq!(parsed["success"], true);
+    }
+
+    #[test]
+    fn test_ws_server_from_sse_auth_required() {
+        let sse = SseEvent::AuthRequired {
+            extension_name: "openai".to_string(),
+            instructions: Some("Enter API key".to_string()),
+            auth_url: None,
+            setup_url: None,
+        };
+        let ws = WsServerMessage::from_sse_event(&sse);
+        match ws {
+            WsServerMessage::Event { event_type, data } => {
+                assert_eq!(event_type, "auth_required");
+                assert_eq!(data["extension_name"], "openai");
+            }
+            _ => panic!("Expected Event variant"),
+        }
+    }
+
+    #[test]
+    fn test_ws_server_from_sse_auth_completed() {
+        let sse = SseEvent::AuthCompleted {
+            extension_name: "slack".to_string(),
+            success: false,
+            message: "Invalid token".to_string(),
+        };
+        let ws = WsServerMessage::from_sse_event(&sse);
+        match ws {
+            WsServerMessage::Event { event_type, data } => {
+                assert_eq!(event_type, "auth_completed");
+                assert_eq!(data["success"], false);
+            }
+            _ => panic!("Expected Event variant"),
+        }
+    }
+
+    #[test]
+    fn test_auth_token_request_deserialize() {
+        let json = r#"{"extension_name":"telegram","token":"bot12345"}"#;
+        let req: AuthTokenRequest = serde_json::from_str(json).unwrap();
+        assert_eq!(req.extension_name, "telegram");
+        assert_eq!(req.token, "bot12345");
+    }
+
+    #[test]
+    fn test_auth_cancel_request_deserialize() {
+        let json = r#"{"extension_name":"telegram"}"#;
+        let req: AuthCancelRequest = serde_json::from_str(json).unwrap();
+        assert_eq!(req.extension_name, "telegram");
+    }
 }

src/channels/web/ws.rs

@@ -71,8 +71,17 @@ pub async fn handle_ws_connection(socket: WebSocket, state: Arc<GatewayState>) {
     }
     let tracker_for_drop = state.ws_tracker.clone();
 
-    // Subscribe to broadcast events (same source as SSE)
-    let mut event_stream = Box::pin(state.sse.subscribe_raw());
+    // Subscribe to broadcast events (same source as SSE).
+    // Reject if we've hit the connection limit.
+    let Some(raw_stream) = state.sse.subscribe_raw() else {
+        tracing::warn!("WebSocket rejected: too many connections");
+        // Decrement the WS tracker we already incremented above.
+        if let Some(ref tracker) = tracker_for_drop {
+            tracker.decrement();
+        }
+        return;
+    };
+    let mut event_stream = Box::pin(raw_stream);
 
     // Channel for the sender task to receive messages from both
     // the broadcast stream and any direct sends (like Pong)
@@ -170,7 +179,11 @@ async fn handle_client_message(
                     .await;
             }
         }
-        WsClientMessage::Approval { request_id, action } => {
+        WsClientMessage::Approval {
+            request_id,
+            action,
+            thread_id,
+        } => {
             let (approved, always) = match action.as_str() {
                 "approve" => (true, false),
                 "always" => (true, true),
@@ -214,12 +227,71 @@ async fn handle_client_message(
                 }
             };
 
-            let msg = IncomingMessage::new("gateway", user_id, content);
+            let mut msg = IncomingMessage::new("gateway", user_id, content);
+            if let Some(ref tid) = thread_id {
+                msg = msg.with_thread(tid);
+            }
             let tx_guard = state.msg_tx.read().await;
             if let Some(ref tx) = *tx_guard {
                 let _ = tx.send(msg).await;
             }
         }
+        WsClientMessage::AuthToken {
+            extension_name,
+            token,
+        } => {
+            if let Some(ref ext_mgr) = state.extension_manager {
+                match ext_mgr.auth(&extension_name, Some(&token)).await {
+                    Ok(result) if result.status == "authenticated" => {
+                        let msg = match ext_mgr.activate(&extension_name).await {
+                            Ok(r) => format!(
+                                "{} authenticated ({} tools loaded)",
+                                extension_name,
+                                r.tools_loaded.len()
+                            ),
+                            Err(e) => format!(
+                                "{} authenticated but activation failed: {}",
+                                extension_name, e
+                            ),
+                        };
+                        crate::channels::web::server::clear_auth_mode(state).await;
+                        state
+                            .sse
+                            .broadcast(crate::channels::web::types::SseEvent::AuthCompleted {
+                                extension_name,
+                                success: true,
+                                message: msg,
+                            });
+                    }
+                    Ok(result) => {
+                        state
+                            .sse
+                            .broadcast(crate::channels::web::types::SseEvent::AuthRequired {
+                                extension_name,
+                                instructions: result.instructions,
+                                auth_url: result.auth_url,
+                                setup_url: result.setup_url,
+                            });
+                    }
+                    Err(e) => {
+                        let _ = direct_tx
+                            .send(WsServerMessage::Error {
+                                message: format!("Auth failed: {}", e),
+                            })
+                            .await;
+                    }
+                }
+            } else {
+                let _ = direct_tx
+                    .send(WsServerMessage::Error {
+                        message: "Extension manager not available".to_string(),
+                    })
+                    .await;
+            }
+        }
+        WsClientMessage::AuthCancel { .. } => {
+            crate::channels::web::server::clear_auth_mode(state).await;
+        }
         WsClientMessage::Ping => {
             let _ = direct_tx.send(WsServerMessage::Pong).await;
         }
@@ -328,6 +400,7 @@ mod tests {
             WsClientMessage::Approval {
                 request_id: request_id.to_string(),
                 action: "approve".to_string(),
+                thread_id: Some("thread-42".to_string()),
             },
             &state,
             "user1",
@@ -338,6 +411,8 @@ mod tests {
         let incoming = agent_rx.recv().await.unwrap();
         // The content should be a serialized ExecApproval
         assert!(incoming.content.contains("ExecApproval"));
+        // Thread should be forwarded onto the IncomingMessage.
+        assert_eq!(incoming.thread_id.as_deref(), Some("thread-42"));
     }
 
     #[tokio::test]
@@ -349,6 +424,7 @@ mod tests {
             WsClientMessage::Approval {
                 request_id: Uuid::new_v4().to_string(),
                 action: "maybe".to_string(),
+                thread_id: None,
             },
             &state,
             "user1",
@@ -374,6 +450,7 @@ mod tests {
             WsClientMessage::Approval {
                 request_id: "not-a-uuid".to_string(),
                 action: "approve".to_string(),
+                thread_id: None,
             },
             &state,
             "user1",
@@ -398,14 +475,18 @@ mod tests {
             msg_tx: tokio::sync::RwLock::new(msg_tx),
             sse: SseManager::new(),
             workspace: None,
-            context_manager: None,
             session_manager: None,
             log_broadcaster: None,
             extension_manager: None,
             tool_registry: None,
+            store: None,
+            job_manager: None,
+            prompt_queue: None,
             user_id: "test".to_string(),
             shutdown_tx: tokio::sync::RwLock::new(None),
             ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
+            llm_provider: None,
+            chat_rate_limiter: crate::channels::web::server::RateLimiter::new(30, 60),
         }
     }
 }

src/cli/config.rs

@@ -1,6 +1,9 @@
 //! Configuration management CLI commands.
 //!
 //! Commands for viewing and modifying settings.
+//! Settings are stored in the database (env > DB > default).
+
+use std::sync::Arc;
 
 use clap::Subcommand;
 
@@ -36,41 +39,81 @@ pub enum ConfigCommand {
         path: String,
     },
 
-    /// Show the settings file path
+    /// Show the settings storage info
     Path,
 }
 
 /// Run a config command.
-pub fn run_config_command(cmd: ConfigCommand) -> anyhow::Result<()> {
+///
+/// Connects to the database to read/write settings. Falls back to disk
+/// if the database is not available.
+pub async fn run_config_command(cmd: ConfigCommand) -> anyhow::Result<()> {
+    // Try to connect to the DB for settings access
+    let db: Option<Arc<dyn crate::db::Database>> = match connect_db().await {
+        Ok(d) => Some(d),
+        Err(e) => {
+            eprintln!(
+                "Warning: Could not connect to database ({}), using disk fallback",
+                e
+            );
+            None
+        }
+    };
+
+    let db_ref = db.as_deref();
     match cmd {
-        ConfigCommand::List { filter } => list_settings(filter),
-        ConfigCommand::Get { path } => get_setting(&path),
-        ConfigCommand::Set { path, value } => set_setting(&path, &value),
-        ConfigCommand::Reset { path } => reset_setting(&path),
-        ConfigCommand::Path => show_path(),
+        ConfigCommand::List { filter } => list_settings(db_ref, filter).await,
+        ConfigCommand::Get { path } => get_setting(db_ref, &path).await,
+        ConfigCommand::Set { path, value } => set_setting(db_ref, &path, &value).await,
+        ConfigCommand::Reset { path } => reset_setting(db_ref, &path).await,
+        ConfigCommand::Path => show_path(db_ref.is_some()),
     }
 }
 
+/// Bootstrap a DB connection for config commands (backend-agnostic).
+async fn connect_db() -> anyhow::Result<Arc<dyn crate::db::Database>> {
+    let config = crate::config::Config::from_env()
+        .await
+        .map_err(|e| anyhow::anyhow!("{}", e))?;
+    crate::db::connect_from_config(&config.database)
+        .await
+        .map_err(|e| anyhow::anyhow!("{}", e))
+}
+
+const DEFAULT_USER_ID: &str = "default";
+
+/// Load settings: DB if available, else disk.
+async fn load_settings(store: Option<&dyn crate::db::Database>) -> Settings {
+    if let Some(store) = store {
+        match store.get_all_settings(DEFAULT_USER_ID).await {
+            Ok(map) if !map.is_empty() => return Settings::from_db_map(&map),
+            _ => {}
+        }
+    }
+    Settings::default()
+}
+
 /// List all settings.
-fn list_settings(filter: Option<String>) -> anyhow::Result<()> {
-    let settings = Settings::load();
+async fn list_settings(
+    store: Option<&dyn crate::db::Database>,
+    filter: Option<String>,
+) -> anyhow::Result<()> {
+    let settings = load_settings(store).await;
     let all = settings.list();
 
-    // Find the longest key for alignment
     let max_key_len = all.iter().map(|(k, _)| k.len()).max().unwrap_or(0);
 
-    println!("Settings:");
+    let source = if store.is_some() { "database" } else { "disk" };
+    println!("Settings (source: {}):", source);
     println!();
 
     for (key, value) in all {
-        // Skip if filter is set and doesn't match
-        if let Some(ref f) = filter {
-            if !key.starts_with(f) {
-                continue;
-            }
+        if let Some(ref f) = filter
+            && !key.starts_with(f)
+        {
+            continue;
         }
 
-        // Truncate long values for display
         let display_value = if value.len() > 60 {
             format!("{}...", &value[..57])
         } else {
@@ -84,8 +127,8 @@ fn list_settings(filter: Option<String>) -> anyhow::Result<()> {
 }
 
 /// Get a specific setting.
-fn get_setting(path: &str) -> anyhow::Result<()> {
-    let settings = Settings::load();
+async fn get_setting(store: Option<&dyn crate::db::Database>, path: &str) -> anyhow::Result<()> {
+    let settings = load_settings(store).await;
 
     match settings.get(path) {
         Some(value) => {
@@ -99,68 +142,63 @@ fn get_setting(path: &str) -> anyhow::Result<()> {
 }
 
 /// Set a setting value.
-fn set_setting(path: &str, value: &str) -> anyhow::Result<()> {
-    let mut settings = Settings::load();
+async fn set_setting(
+    store: Option<&dyn crate::db::Database>,
+    path: &str,
+    value: &str,
+) -> anyhow::Result<()> {
+    let mut settings = load_settings(store).await;
 
-    // Try to set the value
     settings
         .set(path, value)
         .map_err(|e| anyhow::anyhow!("{}", e))?;
 
-    // Save to disk
-    settings.save()?;
+    let store = store.ok_or_else(|| {
+        anyhow::anyhow!("Database connection required to save settings. Check DATABASE_URL.")
+    })?;
+    let json_value = match serde_json::from_str::<serde_json::Value>(value) {
+        Ok(v) => v,
+        Err(_) => serde_json::Value::String(value.to_string()),
+    };
+    store
+        .set_setting(DEFAULT_USER_ID, path, &json_value)
+        .await
+        .map_err(|e| anyhow::anyhow!("Failed to save to database: {}", e))?;
 
     println!("Set {} = {}", path, value);
     Ok(())
 }
 
 /// Reset a setting to default.
-fn reset_setting(path: &str) -> anyhow::Result<()> {
-    let mut settings = Settings::load();
-
-    // Get the default value for display
+async fn reset_setting(store: Option<&dyn crate::db::Database>, path: &str) -> anyhow::Result<()> {
     let default = Settings::default();
     let default_value = default
         .get(path)
         .ok_or_else(|| anyhow::anyhow!("Unknown setting: {}", path))?;
 
-    // Reset it
-    settings.reset(path).map_err(|e| anyhow::anyhow!("{}", e))?;
-
-    // Save to disk
-    settings.save()?;
+    let store = store.ok_or_else(|| {
+        anyhow::anyhow!("Database connection required to reset settings. Check DATABASE_URL.")
+    })?;
+    store
+        .delete_setting(DEFAULT_USER_ID, path)
+        .await
+        .map_err(|e| anyhow::anyhow!("Failed to delete setting from database: {}", e))?;
 
     println!("Reset {} to default: {}", path, default_value);
     Ok(())
 }
 
-/// Show the settings file path.
-fn show_path() -> anyhow::Result<()> {
-    let path = Settings::default_path();
-    println!("{}", path.display());
-
-    if path.exists() {
-        let metadata = std::fs::metadata(&path)?;
-        println!("  Size: {} bytes", metadata.len());
-        if let Ok(modified) = metadata.modified() {
-            use std::time::SystemTime;
-            let duration = SystemTime::now()
-                .duration_since(modified)
-                .unwrap_or_default();
-            let secs = duration.as_secs();
-            if secs < 60 {
-                println!("  Modified: {} seconds ago", secs);
-            } else if secs < 3600 {
-                println!("  Modified: {} minutes ago", secs / 60);
-            } else if secs < 86400 {
-                println!("  Modified: {} hours ago", secs / 3600);
-            } else {
-                println!("  Modified: {} days ago", secs / 86400);
-            }
-        }
+/// Show the settings storage info.
+fn show_path(has_db: bool) -> anyhow::Result<()> {
+    if has_db {
+        println!("Settings stored in: database (settings table)");
     } else {
-        println!("  (does not exist, using defaults)");
+        println!("Settings stored in: PostgreSQL (not connected, using defaults)");
     }
+    println!(
+        "Env config:         {}",
+        crate::bootstrap::ironclaw_env_path().display()
+    );
 
     Ok(())
 }

src/cli/mcp.rs

@@ -8,14 +8,14 @@ use std::sync::Arc;
 use clap::Subcommand;
 
 use crate::config::Config;
-use crate::history::Store;
-use crate::secrets::{PostgresSecretsStore, SecretsCrypto, SecretsStore};
+use crate::db::Database;
+#[cfg(feature = "postgres")]
+use crate::secrets::PostgresSecretsStore;
+use crate::secrets::{SecretsCrypto, SecretsStore};
 use crate::tools::mcp::{
     McpClient, McpServerConfig, McpSessionManager, OAuthConfig,
     auth::{authorize_mcp_server, is_authenticated},
-    config::{
-        add_mcp_server, get_mcp_server, load_mcp_servers, remove_mcp_server, save_mcp_servers,
-    },
+    config::{self, McpServersFile},
 };
 
 #[derive(Subcommand, Debug, Clone)]
@@ -173,8 +173,11 @@ async fn add_server(
     // Validate
     config.validate()?;
 
-    // Save
-    add_mcp_server(config).await?;
+    // Save (DB if available, else disk)
+    let db = connect_db().await;
+    let mut servers = load_servers(db.as_deref()).await?;
+    servers.upsert(config);
+    save_servers(db.as_deref(), &servers).await?;
 
     println!();
     println!("  ✓ Added MCP server '{}'", name);
@@ -192,7 +195,12 @@ async fn add_server(
 
 /// Remove an MCP server.
 async fn remove_server(name: String) -> anyhow::Result<()> {
-    remove_mcp_server(&name).await?;
+    let db = connect_db().await;
+    let mut servers = load_servers(db.as_deref()).await?;
+    if !servers.remove(&name) {
+        anyhow::bail!("Server '{}' not found", name);
+    }
+    save_servers(db.as_deref(), &servers).await?;
 
     println!();
     println!("  ✓ Removed MCP server '{}'", name);
@@ -203,7 +211,8 @@ async fn remove_server(name: String) -> anyhow::Result<()> {
 
 /// List configured MCP servers.
 async fn list_servers(verbose: bool) -> anyhow::Result<()> {
-    let servers = load_mcp_servers().await?;
+    let db = connect_db().await;
+    let servers = load_servers(db.as_deref()).await?;
 
     if servers.servers.is_empty() {
         println!();
@@ -261,7 +270,12 @@ async fn list_servers(verbose: bool) -> anyhow::Result<()> {
 /// Authenticate with an MCP server.
 async fn auth_server(name: String, user_id: String) -> anyhow::Result<()> {
     // Get server config
-    let server = get_mcp_server(&name).await?;
+    let db = connect_db().await;
+    let servers = load_servers(db.as_deref()).await?;
+    let server = servers
+        .get(&name)
+        .cloned()
+        .ok_or_else(|| anyhow::anyhow!("Server '{}' not found", name))?;
 
     // Initialize secrets store
     let secrets = get_secrets_store().await?;
@@ -329,7 +343,12 @@ async fn auth_server(name: String, user_id: String) -> anyhow::Result<()> {
 /// Test connection to an MCP server.
 async fn test_server(name: String, user_id: String) -> anyhow::Result<()> {
     // Get server config
-    let server = get_mcp_server(&name).await?;
+    let db = connect_db().await;
+    let servers = load_servers(db.as_deref()).await?;
+    let server = servers
+        .get(&name)
+        .cloned()
+        .ok_or_else(|| anyhow::anyhow!("Server '{}' not found", name))?;
 
     println!();
     println!("  Testing connection to '{}'...", name);
@@ -420,7 +439,8 @@ async fn test_server(name: String, user_id: String) -> anyhow::Result<()> {
 
 /// Toggle server enabled/disabled state.
 async fn toggle_server(name: String, enable: bool, disable: bool) -> anyhow::Result<()> {
-    let mut servers = load_mcp_servers().await?;
+    let db = connect_db().await;
+    let mut servers = load_servers(db.as_deref()).await?;
 
     let server = servers
         .get_mut(&name)
@@ -435,7 +455,7 @@ async fn toggle_server(name: String, enable: bool, disable: bool) -> anyhow::Res
     };
 
     server.enabled = new_state;
-    save_mcp_servers(&servers).await?;
+    save_servers(db.as_deref(), &servers).await?;
 
     let status = if new_state { "enabled" } else { "disabled" };
     println!();
@@ -445,9 +465,38 @@ async fn toggle_server(name: String, enable: bool, disable: bool) -> anyhow::Res
     Ok(())
 }
 
+const DEFAULT_USER_ID: &str = "default";
+
+/// Try to connect to the database (backend-agnostic).
+async fn connect_db() -> Option<Arc<dyn Database>> {
+    let config = Config::from_env().await.ok()?;
+    crate::db::connect_from_config(&config.database).await.ok()
+}
+
+/// Load MCP servers (DB if available, else disk).
+async fn load_servers(db: Option<&dyn Database>) -> Result<McpServersFile, config::ConfigError> {
+    if let Some(db) = db {
+        config::load_mcp_servers_from_db(db, DEFAULT_USER_ID).await
+    } else {
+        config::load_mcp_servers().await
+    }
+}
+
+/// Save MCP servers (DB if available, else disk).
+async fn save_servers(
+    db: Option<&dyn Database>,
+    servers: &McpServersFile,
+) -> Result<(), config::ConfigError> {
+    if let Some(db) = db {
+        config::save_mcp_servers_to_db(db, DEFAULT_USER_ID, servers).await
+    } else {
+        config::save_mcp_servers(servers).await
+    }
+}
+
 /// Initialize and return the secrets store.
 async fn get_secrets_store() -> anyhow::Result<Arc<dyn SecretsStore + Send + Sync>> {
-    let config = Config::from_env()?;
+    let config = Config::from_env().await?;
 
     let master_key = config.secrets.master_key().ok_or_else(|| {
         anyhow::anyhow!(
@@ -455,14 +504,61 @@ async fn get_secrets_store() -> anyhow::Result<Arc<dyn SecretsStore + Send + Syn
         )
     })?;
 
-    let store = Store::new(&config.database).await?;
-    store.run_migrations().await?;
-
     let crypto = SecretsCrypto::new(master_key.clone())?;
-    Ok(Arc::new(PostgresSecretsStore::new(
-        store.pool(),
-        Arc::new(crypto),
-    )))
+
+    #[cfg(feature = "postgres")]
+    {
+        let store = crate::history::Store::new(&config.database).await?;
+        store.run_migrations().await?;
+        Ok(Arc::new(PostgresSecretsStore::new(
+            store.pool(),
+            Arc::new(crypto),
+        )))
+    }
+
+    #[cfg(all(feature = "libsql", not(feature = "postgres")))]
+    {
+        use crate::db::Database as _;
+        use crate::db::libsql_backend::LibSqlBackend;
+        use secrecy::ExposeSecret as _;
+
+        let default_path = crate::config::default_libsql_path();
+        let db_path = config
+            .database
+            .libsql_path
+            .as_deref()
+            .unwrap_or(&default_path);
+
+        let backend = if let Some(ref url) = config.database.libsql_url {
+            let token = config.database.libsql_auth_token.as_ref().ok_or_else(|| {
+                anyhow::anyhow!("LIBSQL_AUTH_TOKEN is required when LIBSQL_URL is set")
+            })?;
+            LibSqlBackend::new_remote_replica(db_path, url, token.expose_secret())
+                .await
+                .map_err(|e| anyhow::anyhow!("{}", e))?
+        } else {
+            LibSqlBackend::new_local(db_path)
+                .await
+                .map_err(|e| anyhow::anyhow!("{}", e))?
+        };
+        backend
+            .run_migrations()
+            .await
+            .map_err(|e| anyhow::anyhow!("{}", e))?;
+
+        return Ok(Arc::new(crate::secrets::LibSqlSecretsStore::new(
+            backend.shared_db(),
+            Arc::new(crypto),
+        )));
+    }
+
+    #[cfg(not(any(feature = "postgres", feature = "libsql")))]
+    {
+        let _ = crypto;
+        anyhow::bail!(
+            "No database backend available for secrets. Enable 'postgres' or 'libsql' feature."
+        );
+    }
 }
 
 #[cfg(test)]

src/cli/memory.rs

@@ -9,6 +9,30 @@ use clap::Subcommand;
 
 use crate::workspace::{EmbeddingProvider, SearchConfig, Workspace};
 
+/// Run a memory command using the Database trait (works with any backend).
+pub async fn run_memory_command_with_db(
+    cmd: MemoryCommand,
+    db: std::sync::Arc<dyn crate::db::Database>,
+    embeddings: Option<Arc<dyn EmbeddingProvider>>,
+) -> anyhow::Result<()> {
+    let mut workspace = Workspace::new_with_db("default", db);
+    if let Some(emb) = embeddings {
+        workspace = workspace.with_embeddings(emb);
+    }
+
+    match cmd {
+        MemoryCommand::Search { query, limit } => search(&workspace, &query, limit).await,
+        MemoryCommand::Read { path } => read(&workspace, &path).await,
+        MemoryCommand::Write {
+            path,
+            content,
+            append,
+        } => write(&workspace, &path, content, append).await,
+        MemoryCommand::Tree { path, depth } => tree(&workspace, &path, depth).await,
+        MemoryCommand::Status => status(&workspace).await,
+    }
+}
+
 #[derive(Subcommand, Debug, Clone)]
 pub enum MemoryCommand {
     /// Search workspace memory (hybrid full-text + semantic)
@@ -55,7 +79,8 @@ pub enum MemoryCommand {
     Status,
 }
 
-/// Run a memory command.
+/// Run a memory command (PostgreSQL backend).
+#[cfg(feature = "postgres")]
 pub async fn run_memory_command(
     cmd: MemoryCommand,
     pool: deadpool_postgres::Pool,

src/cli/mod.rs

@@ -12,12 +12,18 @@
 mod config;
 mod mcp;
 pub mod memory;
+pub mod oauth_defaults;
+mod pairing;
 pub mod status;
 mod tool;
 
 pub use config::{ConfigCommand, run_config_command};
 pub use mcp::{McpCommand, run_mcp_command};
-pub use memory::{MemoryCommand, run_memory_command};
+pub use memory::MemoryCommand;
+#[cfg(feature = "postgres")]
+pub use memory::run_memory_command;
+pub use memory::run_memory_command_with_db;
+pub use pairing::{PairingCommand, run_pairing_command, run_pairing_command_with_store};
 pub use status::run_status_command;
 pub use tool::{ToolCommand, run_tool_command};
 
@@ -86,8 +92,48 @@ pub enum Command {
     #[command(subcommand)]
     Memory(MemoryCommand),
 
+    /// DM pairing (approve inbound requests from unknown senders)
+    #[command(subcommand)]
+    Pairing(PairingCommand),
+
     /// Show system health and diagnostics
     Status,
+
+    /// Run as a sandboxed worker inside a Docker container (internal use).
+    /// This is invoked automatically by the orchestrator, not by users directly.
+    Worker {
+        /// Job ID to execute.
+        #[arg(long)]
+        job_id: uuid::Uuid,
+
+        /// URL of the orchestrator's internal API.
+        #[arg(long, default_value = "http://host.docker.internal:50051")]
+        orchestrator_url: String,
+
+        /// Maximum iterations before stopping.
+        #[arg(long, default_value = "50")]
+        max_iterations: u32,
+    },
+
+    /// Run as a Claude Code bridge inside a Docker container (internal use).
+    /// Spawns the `claude` CLI and streams output back to the orchestrator.
+    ClaudeBridge {
+        /// Job ID to execute.
+        #[arg(long)]
+        job_id: uuid::Uuid,
+
+        /// URL of the orchestrator's internal API.
+        #[arg(long, default_value = "http://host.docker.internal:50051")]
+        orchestrator_url: String,
+
+        /// Maximum agentic turns for Claude Code.
+        #[arg(long, default_value = "50")]
+        max_turns: u32,
+
+        /// Claude model to use (e.g. "sonnet", "opus").
+        #[arg(long, default_value = "sonnet")]
+        model: String,
+    },
 }
 
 impl Cli {

src/cli/oauth_defaults.rs

@@ -0,0 +1,342 @@
+//! Shared OAuth infrastructure: built-in credentials, callback server, landing pages.
+//!
+//! Every OAuth flow in the codebase (WASM tool auth, MCP server auth, NEAR AI login)
+//! uses the same callback port, landing page, and listener logic from this module.
+//!
+//! # Built-in Credentials
+//!
+//! Many CLI tools (gcloud, rclone, gdrive) ship with default OAuth credentials
+//! so users don't need to register their own OAuth app. Google explicitly
+//! documents that client_secret for "Desktop App" / "Installed App" types
+//! is NOT actually secret.
+//!
+//! Default credentials are hardcoded below. They can be overridden at:
+//!
+//! - **Compile time**: Set IRONCLAW_GOOGLE_CLIENT_ID / IRONCLAW_GOOGLE_CLIENT_SECRET
+//!   env vars before building to replace the hardcoded defaults.
+//! - **Runtime**: Users can set GOOGLE_OAUTH_CLIENT_ID / GOOGLE_OAUTH_CLIENT_SECRET
+//!   env vars, which take priority over built-in defaults.
+
+use std::time::Duration;
+
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::TcpListener;
+
+// ── Built-in credentials ────────────────────────────────────────────────
+
+pub struct OAuthCredentials {
+    pub client_id: &'static str,
+    pub client_secret: &'static str,
+}
+
+/// Google OAuth "Desktop App" credentials, shared across all Google tools.
+/// Compile-time env vars override the hardcoded defaults below.
+const GOOGLE_CLIENT_ID: &str = match option_env!("IRONCLAW_GOOGLE_CLIENT_ID") {
+    Some(v) => v,
+    None => "564604149681-efo25d43rs85v0tibdepsmdv5dsrhhr0.apps.googleusercontent.com",
+};
+const GOOGLE_CLIENT_SECRET: &str = match option_env!("IRONCLAW_GOOGLE_CLIENT_SECRET") {
+    Some(v) => v,
+    None => "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",
+};
+
+/// Returns built-in OAuth credentials for a provider, keyed by secret_name.
+///
+/// The secret_name comes from the tool's capabilities.json `auth.secret_name` field.
+/// Returns `None` if no built-in credentials are configured for that provider.
+pub fn builtin_credentials(secret_name: &str) -> Option<OAuthCredentials> {
+    match secret_name {
+        "google_oauth_token" => Some(OAuthCredentials {
+            client_id: GOOGLE_CLIENT_ID,
+            client_secret: GOOGLE_CLIENT_SECRET,
+        }),
+        _ => None,
+    }
+}
+
+// ── Shared callback server ──────────────────────────────────────────────
+
+/// Fixed port for all OAuth callbacks.
+///
+/// Every redirect URI registered with providers must use this port:
+/// `http://localhost:9876/callback` (or `/auth/callback` for NEAR AI).
+pub const OAUTH_CALLBACK_PORT: u16 = 9876;
+
+/// Error from the OAuth callback listener.
+#[derive(Debug, thiserror::Error)]
+pub enum OAuthCallbackError {
+    #[error("Port {0} is in use (another auth flow running?): {1}")]
+    PortInUse(u16, String),
+
+    #[error("Authorization denied by user")]
+    Denied,
+
+    #[error("Timed out waiting for authorization")]
+    Timeout,
+
+    #[error("IO error: {0}")]
+    Io(String),
+}
+
+/// Bind the OAuth callback listener on the fixed port.
+///
+/// Binds to IPv4 `127.0.0.1` first because callback URLs use `127.0.0.1`
+/// explicitly (e.g., NEAR AI redirects to `http://127.0.0.1:9876/auth/callback`).
+/// Falls back to IPv6 `[::1]` only if IPv4 binding fails for a reason other
+/// than `AddrInUse`. If the port is already occupied, fails immediately.
+pub async fn bind_callback_listener() -> Result<TcpListener, OAuthCallbackError> {
+    let ipv4_addr = format!("127.0.0.1:{}", OAUTH_CALLBACK_PORT);
+    match TcpListener::bind(&ipv4_addr).await {
+        Ok(listener) => return Ok(listener),
+        Err(e) if e.kind() == std::io::ErrorKind::AddrInUse => {
+            return Err(OAuthCallbackError::PortInUse(
+                OAUTH_CALLBACK_PORT,
+                e.to_string(),
+            ));
+        }
+        Err(_) => {
+            // IPv4 not available, fall back to IPv6
+        }
+    }
+    TcpListener::bind(format!("[::1]:{}", OAUTH_CALLBACK_PORT))
+        .await
+        .map_err(|e| {
+            if e.kind() == std::io::ErrorKind::AddrInUse {
+                OAuthCallbackError::PortInUse(OAUTH_CALLBACK_PORT, e.to_string())
+            } else {
+                OAuthCallbackError::Io(e.to_string())
+            }
+        })
+}
+
+/// Wait for an OAuth callback and extract a query parameter value.
+///
+/// Listens for a GET request matching `path_prefix` (e.g., "/callback" or "/auth/callback"),
+/// extracts the value of `param_name` (e.g., "code" or "token"), and shows a branded
+/// landing page using `display_name` (e.g., "Google", "Notion", "NEAR AI").
+///
+/// Times out after 5 minutes.
+pub async fn wait_for_callback(
+    listener: TcpListener,
+    path_prefix: &str,
+    param_name: &str,
+    display_name: &str,
+) -> Result<String, OAuthCallbackError> {
+    let path_prefix = path_prefix.to_string();
+    let param_name = param_name.to_string();
+    let display_name = display_name.to_string();
+
+    tokio::time::timeout(Duration::from_secs(300), async move {
+        loop {
+            let (mut socket, _) = listener
+                .accept()
+                .await
+                .map_err(|e| OAuthCallbackError::Io(e.to_string()))?;
+
+            let mut reader = BufReader::new(&mut socket);
+            let mut request_line = String::new();
+            reader
+                .read_line(&mut request_line)
+                .await
+                .map_err(|e| OAuthCallbackError::Io(e.to_string()))?;
+
+            if let Some(path) = request_line.split_whitespace().nth(1)
+                && path.starts_with(&path_prefix)
+                && let Some(query) = path.split('?').nth(1)
+            {
+                // Check for error first
+                if query.contains("error=") {
+                    let html = landing_html(&display_name, false);
+                    let response = format!(
+                        "HTTP/1.1 400 Bad Request\r\n\
+                         Content-Type: text/html; charset=utf-8\r\n\
+                         Connection: close\r\n\
+                         \r\n\
+                         {}",
+                        html
+                    );
+                    let _ = socket.write_all(response.as_bytes()).await;
+                    return Err(OAuthCallbackError::Denied);
+                }
+
+                // Look for the target parameter
+                for param in query.split('&') {
+                    let parts: Vec<&str> = param.splitn(2, '=').collect();
+                    if parts.len() == 2 && parts[0] == param_name {
+                        let value = urlencoding::decode(parts[1])
+                            .unwrap_or_else(|_| parts[1].into())
+                            .into_owned();
+
+                        let html = landing_html(&display_name, true);
+                        let response = format!(
+                            "HTTP/1.1 200 OK\r\n\
+                             Content-Type: text/html; charset=utf-8\r\n\
+                             Connection: close\r\n\
+                             \r\n\
+                             {}",
+                            html
+                        );
+                        let _ = socket.write_all(response.as_bytes()).await;
+                        let _ = socket.shutdown().await;
+
+                        return Ok(value);
+                    }
+                }
+            }
+
+            // Not the callback we're looking for
+            let response = "HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n";
+            let _ = socket.write_all(response.as_bytes()).await;
+        }
+    })
+    .await
+    .map_err(|_| OAuthCallbackError::Timeout)?
+}
+
+/// Escape a string for safe interpolation into HTML content.
+fn html_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&#x27;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+/// HTML landing page shown in the browser after an OAuth redirect.
+pub fn landing_html(provider_name: &str, success: bool) -> String {
+    let safe_name = html_escape(provider_name);
+    let (icon, heading, subtitle, accent) = if success {
+        (
+            r##"<div style="width:64px;height:64px;border-radius:50%;background:#22c55e;display:flex;align-items:center;justify-content:center;margin:0 auto 24px">
+                <svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="#fff" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"><polyline points="20 6 9 17 4 12"/></svg>
+              </div>"##,
+            format!("{} Connected", safe_name),
+            "You can close this window and return to your terminal.",
+            "#22c55e",
+        )
+    } else {
+        (
+            r##"<div style="width:64px;height:64px;border-radius:50%;background:#ef4444;display:flex;align-items:center;justify-content:center;margin:0 auto 24px">
+                <svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="#fff" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+              </div>"##,
+            "Authorization Failed".to_string(),
+            "The request was denied. You can close this window and try again.",
+            "#ef4444",
+        )
+    };
+
+    format!(
+        r#"<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>IronClaw - {heading}</title>
+<style>
+  * {{ margin:0; padding:0; box-sizing:border-box }}
+  body {{
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+    background: #0a0a0a;
+    color: #e5e5e5;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    min-height: 100vh;
+  }}
+  .card {{
+    text-align: center;
+    padding: 48px 40px;
+    max-width: 420px;
+    border: 1px solid #262626;
+    border-radius: 16px;
+    background: #141414;
+  }}
+  h1 {{
+    font-size: 22px;
+    font-weight: 600;
+    margin-bottom: 8px;
+    color: #fafafa;
+  }}
+  p {{
+    font-size: 14px;
+    color: #a3a3a3;
+    line-height: 1.5;
+  }}
+  .accent {{ color: {accent}; }}
+  .brand {{
+    margin-top: 32px;
+    font-size: 12px;
+    color: #525252;
+    letter-spacing: 0.5px;
+    text-transform: uppercase;
+  }}
+</style>
+</head>
+<body>
+  <div class="card">
+    {icon}
+    <h1>{heading}</h1>
+    <p>{subtitle}</p>
+    <div class="brand">IronClaw</div>
+  </div>
+</body>
+</html>"#,
+        heading = heading,
+        icon = icon,
+        subtitle = subtitle,
+        accent = accent,
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::cli::oauth_defaults::{builtin_credentials, landing_html};
+
+    #[test]
+    fn test_unknown_provider_returns_none() {
+        assert!(builtin_credentials("unknown_token").is_none());
+    }
+
+    #[test]
+    fn test_google_returns_based_on_compile_env() {
+        let creds = builtin_credentials("google_oauth_token");
+        assert!(creds.is_some());
+        let creds = creds.unwrap();
+        assert!(!creds.client_id.is_empty());
+        assert!(!creds.client_secret.is_empty());
+    }
+
+    #[test]
+    fn test_landing_html_success_contains_key_elements() {
+        let html = landing_html("Google", true);
+        assert!(html.contains("Google Connected"));
+        assert!(html.contains("charset"));
+        assert!(html.contains("IronClaw"));
+        assert!(html.contains("#22c55e")); // green accent
+        assert!(!html.contains("Failed"));
+    }
+
+    #[test]
+    fn test_landing_html_escapes_provider_name() {
+        let html = landing_html("<script>alert(1)</script>", true);
+        assert!(!html.contains("<script>"));
+        assert!(html.contains("&lt;script&gt;"));
+    }
+
+    #[test]
+    fn test_landing_html_error_contains_key_elements() {
+        let html = landing_html("Notion", false);
+        assert!(html.contains("Authorization Failed"));
+        assert!(html.contains("charset"));
+        assert!(html.contains("IronClaw"));
+        assert!(html.contains("#ef4444")); // red accent
+        assert!(!html.contains("Connected"));
+    }
+}

src/cli/pairing.rs

@@ -0,0 +1,187 @@
+//! DM pairing CLI commands.
+//!
+//! Manage pairing requests for channels (Telegram, Slack, etc.).
+
+use clap::Subcommand;
+
+use crate::pairing::PairingStore;
+
+/// Pairing subcommands.
+#[derive(Subcommand, Debug, Clone)]
+pub enum PairingCommand {
+    /// List pending pairing requests
+    List {
+        /// Channel name (e.g., telegram, slack)
+        #[arg(required = true)]
+        channel: String,
+
+        /// Output as JSON
+        #[arg(long)]
+        json: bool,
+    },
+
+    /// Approve a pairing request by code
+    Approve {
+        /// Channel name (e.g., telegram, slack)
+        #[arg(required = true)]
+        channel: String,
+
+        /// Pairing code (e.g., ABC12345)
+        #[arg(required = true)]
+        code: String,
+    },
+}
+
+/// Run pairing CLI command.
+pub fn run_pairing_command(cmd: PairingCommand) -> Result<(), String> {
+    run_pairing_command_with_store(&PairingStore::new(), cmd)
+}
+
+/// Run pairing CLI command with a given store (for testing).
+pub fn run_pairing_command_with_store(
+    store: &PairingStore,
+    cmd: PairingCommand,
+) -> Result<(), String> {
+    match cmd {
+        PairingCommand::List { channel, json } => run_list(store, &channel, json),
+        PairingCommand::Approve { channel, code } => run_approve(store, &channel, &code),
+    }
+}
+
+fn run_list(store: &PairingStore, channel: &str, json: bool) -> Result<(), String> {
+    let requests = store.list_pending(channel).map_err(|e| e.to_string())?;
+
+    if json {
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&requests).map_err(|e| e.to_string())?
+        );
+        return Ok(());
+    }
+
+    if requests.is_empty() {
+        println!("No pending {} pairing requests.", channel);
+        return Ok(());
+    }
+
+    println!("Pairing requests ({}):", requests.len());
+    for r in &requests {
+        let meta = r
+            .meta
+            .as_ref()
+            .and_then(|m| m.as_object())
+            .map(|o| {
+                o.iter()
+                    .filter_map(|(k, v)| v.as_str().map(|s| format!("{}={}", k, s)))
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            })
+            .unwrap_or_default();
+        println!("  {}  {}  {}  {}", r.code, r.id, meta, r.created_at);
+    }
+
+    Ok(())
+}
+
+fn run_approve(store: &PairingStore, channel: &str, code: &str) -> Result<(), String> {
+    match store.approve(channel, code) {
+        Ok(Some(entry)) => {
+            println!("Approved {} sender {}.", channel, entry.id);
+            Ok(())
+        }
+        Ok(None) => Err(format!(
+            "No pending pairing request found for code: {}",
+            code
+        )),
+        Err(crate::pairing::PairingStoreError::ApproveRateLimited) => Err(
+            "Too many failed approve attempts. Wait a few minutes before trying again.".to_string(),
+        ),
+        Err(e) => Err(e.to_string()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    fn test_store() -> (PairingStore, TempDir) {
+        let dir = TempDir::new().unwrap();
+        let store = PairingStore::with_base_dir(dir.path().to_path_buf());
+        (store, dir)
+    }
+
+    #[test]
+    fn test_list_empty_returns_ok() {
+        let (store, _) = test_store();
+        let result = run_pairing_command_with_store(
+            &store,
+            PairingCommand::List {
+                channel: "telegram".to_string(),
+                json: false,
+            },
+        );
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_list_json_empty_returns_ok() {
+        let (store, _) = test_store();
+        let result = run_pairing_command_with_store(
+            &store,
+            PairingCommand::List {
+                channel: "telegram".to_string(),
+                json: true,
+            },
+        );
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_approve_invalid_code_returns_err() {
+        let (store, _) = test_store();
+        // Create a pending request so the pairing file exists, then approve with wrong code
+        store.upsert_request("telegram", "user1", None).unwrap();
+
+        let result = run_pairing_command_with_store(
+            &store,
+            PairingCommand::Approve {
+                channel: "telegram".to_string(),
+                code: "BADCODE1".to_string(),
+            },
+        );
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("No pending pairing request"));
+    }
+
+    #[test]
+    fn test_approve_valid_code_returns_ok() {
+        let (store, _) = test_store();
+        let r = store.upsert_request("telegram", "user1", None).unwrap();
+        assert!(r.created);
+
+        let result = run_pairing_command_with_store(
+            &store,
+            PairingCommand::Approve {
+                channel: "telegram".to_string(),
+                code: r.code,
+            },
+        );
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_list_with_pending_returns_ok() {
+        let (store, _) = test_store();
+        store.upsert_request("telegram", "user1", None).unwrap();
+
+        let result = run_pairing_command_with_store(
+            &store,
+            PairingCommand::List {
+                channel: "telegram".to_string(),
+                json: false,
+            },
+        );
+        assert!(result.is_ok());
+    }
+}

src/cli/status.rs

@@ -9,7 +9,7 @@ use crate::settings::Settings;
 
 /// Run the status command, printing system health info.
 pub async fn run_status_command() -> anyhow::Result<()> {
-    let settings = Settings::load();
+    let settings = Settings::default();
 
     println!("IronClaw Status");
     println!("===============\n");
@@ -22,16 +22,36 @@ pub async fn run_status_command() -> anyhow::Result<()> {
     );
 
     // Database
-    let db_url_set = settings.database_url.is_some() || std::env::var("DATABASE_URL").is_ok();
     print!("  Database:    ");
-    if db_url_set {
-        // Try to connect
-        match check_database().await {
-            Ok(()) => println!("connected"),
-            Err(e) => println!("error ({})", e),
+    let db_backend = std::env::var("DATABASE_BACKEND")
+        .ok()
+        .unwrap_or_else(|| "postgres".to_string());
+    match db_backend.as_str() {
+        "libsql" | "turso" | "sqlite" => {
+            let path = std::env::var("LIBSQL_PATH")
+                .map(std::path::PathBuf::from)
+                .unwrap_or_else(|_| crate::config::default_libsql_path());
+            if path.exists() {
+                let turso = if std::env::var("LIBSQL_URL").is_ok() {
+                    " + Turso sync"
+                } else {
+                    ""
+                };
+                println!("libSQL ({}{})", path.display(), turso);
+            } else {
+                println!("libSQL (file missing: {})", path.display());
+            }
+        }
+        _ => {
+            if std::env::var("DATABASE_URL").is_ok() {
+                match check_database().await {
+                    Ok(()) => println!("connected (PostgreSQL)"),
+                    Err(e) => println!("error ({})", e),
+                }
+            } else {
+                println!("not configured");
+            }
         }
-    } else {
-        println!("not configured");
     }
 
     // Session / Auth
@@ -43,15 +63,17 @@ pub async fn run_status_command() -> anyhow::Result<()> {
         println!("not found (run `ironclaw onboard`)");
     }
 
-    // Secrets
+    // Secrets (auto-detect from env only; skip keychain probe to avoid
+    // triggering macOS system password dialogs on a simple status check)
     print!("  Secrets:     ");
-    let secrets_configured = settings.secrets_master_key_source != crate::settings::KeySource::None
-        || std::env::var("SECRETS_MASTER_KEY").is_ok()
-        || crate::secrets::keychain::has_master_key();
-    if secrets_configured {
-        println!("configured ({:?})", settings.secrets_master_key_source);
+    if std::env::var("SECRETS_MASTER_KEY").is_ok() {
+        println!("configured (env)");
     } else {
-        println!("not configured");
+        // We don't probe the keychain here because get_generic_password()
+        // triggers macOS unlock+authorization dialogs, which is bad UX for
+        // a read-only status command. If onboarding completed with keychain
+        // storage, the key is there; we just can't cheaply verify it.
+        println!("env not set (keychain may be configured)");
     }
 
     // Embeddings
@@ -129,19 +151,18 @@ pub async fn run_status_command() -> anyhow::Result<()> {
         Err(_) => println!("none configured"),
     }
 
-    // Settings path
-    println!("\n  Settings:    {}", Settings::default_path().display());
+    // Config path
+    println!(
+        "\n  Config:      {}",
+        crate::bootstrap::ironclaw_env_path().display()
+    );
 
     Ok(())
 }
 
+#[cfg(feature = "postgres")]
 async fn check_database() -> anyhow::Result<()> {
-    let _ = dotenvy::dotenv();
-    let settings = Settings::load();
-    let url = std::env::var("DATABASE_URL")
-        .ok()
-        .or(settings.database_url)
-        .ok_or_else(|| anyhow::anyhow!("no URL"))?;
+    let url = std::env::var("DATABASE_URL").map_err(|_| anyhow::anyhow!("DATABASE_URL not set"))?;
 
     let config: deadpool_postgres::Config = deadpool_postgres::Config {
         url: Some(url),
@@ -167,6 +188,12 @@ async fn check_database() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[cfg(not(feature = "postgres"))]
+async fn check_database() -> anyhow::Result<()> {
+    // For non-postgres backends, just report configured
+    Ok(())
+}
+
 fn count_wasm_files(dir: &std::path::Path) -> usize {
     std::fs::read_dir(dir)
         .map(|entries| {