refactor: centralize cli manager cleanup

Co-authored-by: Nicholas Spisak <jsnsdirect@gmail.com>

CHANGELOG.md

@@ -2,15 +2,6 @@
 
 Docs: https://docs.clawd.bot
 
-## 2026.1.18-1
-
-### Changes
-- Tools: allow `sessions_spawn` to override thinking level for sub-agent runs.
-- Models: add Qwen Portal OAuth provider support. (#1120) — thanks @mukhtharcm.
-
-### Fixes
-- Memory: apply OpenAI batch defaults even without explicit remote config.
-
 ## 2026.1.17-3
 
 ### Changes

docs/channels/discord.md

@@ -58,7 +58,7 @@ Minimal config:
     - The `discord` tool is only exposed when the current channel is Discord.
 13. Native commands use isolated session keys (`agent:<agentId>:discord:slash:<userId>`) rather than the shared `main` session.
 
-Note: Name → id resolution uses guild member search and requires Server Members Intent; if the bot can’t search members, use ids or `<@id>` mentions.
+Note: Discord does not provide a simple username → id lookup without extra guild context, so prefer ids or `<@id>` mentions for DM delivery targets.
 Note: Slugs are lowercase with spaces replaced by `-`. Channel names are slugged without the leading `#`.
 Note: Guild context `[from:]` lines include `author.tag` + `id` to make ping-ready replies easy.
 
@@ -175,7 +175,6 @@ Notes:
 - `agents.list[].groupChat.mentionPatterns` (or `messages.groupChat.mentionPatterns`) also count as mentions for guild messages.
 - Multi-agent override: set per-agent patterns on `agents.list[].groupChat.mentionPatterns`.
 - If `channels` is present, any channel not listed is denied by default.
-- Threads inherit parent channel config (allowlist, `requireMention`, skills, prompts, etc.) unless you add the thread id explicitly.
 - Bot-authored messages are ignored by default; set `channels.discord.allowBots=true` to allow them (own messages remain filtered).
 - Warning: If you allow replies to other bots (`channels.discord.allowBots=true`), prevent bot-to-bot reply loops with `requireMention`, `channels.discord.guilds.*.channels.<id>.users` allowlists, and/or clear guardrails in `AGENTS.md` and `SOUL.md`.
 
@@ -193,11 +192,8 @@ Notes:
   - Your config requires mentions and you didn’t mention it, or
   - Your guild/channel allowlist denies the channel/user.
 - **`requireMention: false` but still no replies**:
-- `channels.discord.groupPolicy` defaults to **allowlist**; set it to `"open"` or add a guild entry under `channels.discord.guilds` (optionally list channels under `channels.discord.guilds.<id>.channels` to restrict).
-  - If you only set `DISCORD_BOT_TOKEN` and never create a `channels.discord` section, the runtime
-    defaults `groupPolicy` to `open`. Add `channels.discord.groupPolicy`,
-    `channels.defaults.groupPolicy`, or a guild/channel allowlist to lock it down.
-- `requireMention` must live under `channels.discord.guilds` (or a specific channel). `channels.discord.requireMention` at the top level is ignored.
+  - `channels.discord.groupPolicy` defaults to **allowlist**; set it to `"open"` or add a guild entry under `channels.discord.guilds` (optionally list channels under `channels.discord.guilds.<id>.channels` to restrict).
+  - `requireMention` must live under `channels.discord.guilds` (or a specific channel). `channels.discord.requireMention` at the top level is ignored.
 - **Permission audits** (`channels status --probe`) only check numeric channel IDs. If you use slugs/names as `channels.discord.guilds.*.channels` keys, the audit can’t verify permissions.
 - **DMs don’t work**: `channels.discord.dm.enabled=false`, `channels.discord.dm.policy="disabled"`, or you haven’t been approved yet (`channels.discord.dm.policy="pairing"`).
 
@@ -365,10 +361,6 @@ Allowlist matching notes:
 - Use `*` to allow any sender/channel.
 - When `guilds.<id>.channels` is present, channels not listed are denied by default.
 - When `guilds.<id>.channels` is omitted, all channels in the allowlisted guild are allowed.
-- To allow **no channels**, set `channels.discord.groupPolicy: "disabled"` (or keep an empty allowlist).
-- The configure wizard accepts `Guild/Channel` names (public + private) and resolves them to IDs when possible.
-- On startup, Clawdbot resolves channel/user names in allowlists to IDs (when the bot can search members)
-  and logs the mapping; unresolved entries are kept as typed.
 
 Native command notes:
 - The registered commands mirror Clawdbot’s chat commands.

docs/channels/matrix.md

@@ -70,10 +70,9 @@ Matrix is an open messaging protocol. Clawdbot connects as a Matrix user and lis
   - `clawdbot pairing list matrix`
   - `clawdbot pairing approve matrix <CODE>`
 - Public DMs: `channels.matrix.dm.policy="open"` plus `channels.matrix.dm.allowFrom=["*"]`.
-- `channels.matrix.dm.allowFrom` accepts user IDs or display names (resolved at startup when directory search is available).
 
 ## Rooms (groups)
-- Default: `channels.matrix.groupPolicy = "allowlist"` (mention-gated). Use `channels.defaults.groupPolicy` to override the default when unset.
+- Default: `channels.matrix.groupPolicy = "allowlist"` (mention-gated).
 - Allowlist rooms with `channels.matrix.rooms`:
 ```json5
 {
@@ -87,9 +86,6 @@ Matrix is an open messaging protocol. Clawdbot connects as a Matrix user and lis
 }
 ```
 - `requireMention: false` enables auto-reply in that room.
-- The configure wizard prompts for room allowlists (room IDs, aliases, or names) and resolves names when possible.
-- On startup, Clawdbot resolves room/user names in allowlists to IDs and logs the mapping; unresolved entries are kept as typed.
-- To allow **no rooms**, set `channels.matrix.groupPolicy: "disabled"` (or keep an empty allowlist).
 
 ## Threads
 - Reply threading is supported.

docs/channels/msteams.md

@@ -76,13 +76,12 @@ Disable with:
 
 **DM access**
 - Default: `channels.msteams.dmPolicy = "pairing"`. Unknown senders are ignored until approved.
-- `channels.msteams.allowFrom` accepts AAD object IDs, UPNs, or display names (resolved at startup when Graph allows).
+- `channels.msteams.allowFrom` accepts AAD object IDs or UPNs.
 
 **Group access**
-- Default: `channels.msteams.groupPolicy = "allowlist"` (blocked unless you add `groupAllowFrom`). Use `channels.defaults.groupPolicy` to override the default when unset.
+- Default: `channels.msteams.groupPolicy = "allowlist"` (blocked unless you add `groupAllowFrom`).
 - `channels.msteams.groupAllowFrom` controls which senders can trigger in group chats/channels (falls back to `channels.msteams.allowFrom`).
 - Set `groupPolicy: "open"` to allow any member (still mention‑gated by default).
-- To allow **no channels**, set `channels.msteams.groupPolicy: "disabled"`.
 
 Example:
 ```json5
@@ -96,32 +95,6 @@ Example:
 }
 ```
 
-**Teams + channel allowlist**
-- Scope group/channel replies by listing teams and channels under `channels.msteams.teams`.
-- Keys can be team IDs or names; channel keys can be conversation IDs or names.
-- When `groupPolicy="allowlist"` and a teams allowlist is present, only listed teams/channels are accepted (mention‑gated).
-- The configure wizard accepts `Team/Channel` entries and stores them for you.
-- On startup, Clawdbot resolves team/channel and user allowlist names to IDs (when Graph permissions allow)
-  and logs the mapping; unresolved entries are kept as typed.
-
-Example:
-```json5
-{
-  channels: {
-    msteams: {
-      groupPolicy: "allowlist",
-      teams: {
-        "My Team": {
-          channels: {
-            "General": { requireMention: true }
-          }
-        }
-      }
-    }
-  }
-}
-```
-
 ## How it works
 1. Install the Microsoft Teams plugin.
 2. Create an **Azure Bot** (App ID + secret + tenant ID).

docs/channels/slack.md

@@ -343,19 +343,10 @@ For fine-grained control, use these tags in agent responses:
 - Default: `channels.slack.dm.policy="pairing"` — unknown DM senders get a pairing code (expires after 1 hour).
 - Approve via: `clawdbot pairing approve slack <code>`.
 - To allow anyone: set `channels.slack.dm.policy="open"` and `channels.slack.dm.allowFrom=["*"]`.
-- `channels.slack.dm.allowFrom` accepts user IDs, @handles, or emails (resolved at startup when tokens allow).
 
 ## Group policy
 - `channels.slack.groupPolicy` controls channel handling (`open|disabled|allowlist`).
 - `allowlist` requires channels to be listed in `channels.slack.channels`.
- - If you only set `SLACK_BOT_TOKEN`/`SLACK_APP_TOKEN` and never create a `channels.slack` section,
-   the runtime defaults `groupPolicy` to `open`. Add `channels.slack.groupPolicy`,
-   `channels.defaults.groupPolicy`, or a channel allowlist to lock it down.
- - The configure wizard accepts `#channel` names and resolves them to IDs when possible
-   (public + private); if multiple matches exist, it prefers the active channel.
- - On startup, Clawdbot resolves channel/user names in allowlists to IDs (when tokens allow)
-   and logs the mapping; unresolved entries are kept as typed.
- - To allow **no channels**, set `channels.slack.groupPolicy: "disabled"` (or keep an empty allowlist).
 
 Channel options (`channels.slack.channels.<id>` or `channels.slack.channels.<name>`):
 - `allow`: allow/deny the channel when `groupPolicy="allowlist"`.

docs/channels/telegram.md

@@ -216,7 +216,6 @@ Telegram forum topics include a `message_thread_id` per message. Clawdbot:
 - General topic (thread id `1`) is special: message sends omit `message_thread_id` (Telegram rejects it), but typing indicators still include it.
 - Exposes `MessageThreadId` + `IsForum` in template context for routing/templating.
 - Topic-specific configuration is available under `channels.telegram.groups.<chatId>.topics.<threadId>` (skills, allowlists, auto-reply, system prompts, disable).
-- Topic configs inherit group settings (requireMention, allowlists, skills, prompts, enabled) unless overridden per topic.
 
 Private chats can include `message_thread_id` in some edge cases. Clawdbot keeps the DM session key unchanged, but still uses the thread id for replies/draft streaming when it is present.
 

docs/channels/zalouser.md

@@ -66,36 +66,11 @@ clawdbot directory groups list --channel zalouser --query "work"
 
 ## Access control (DMs)
 `channels.zalouser.dmPolicy` supports: `pairing | allowlist | open | disabled` (default: `pairing`).
-`channels.zalouser.allowFrom` accepts user IDs or names (resolved at startup when available).
 
 Approve via:
 - `clawdbot pairing list zalouser`
 - `clawdbot pairing approve zalouser <code>`
 
-## Group access (optional)
-- Default: `channels.zalouser.groupPolicy = "open"` (groups allowed). Use `channels.defaults.groupPolicy` to override the default when unset.
-- Restrict to an allowlist with:
-  - `channels.zalouser.groupPolicy = "allowlist"`
-  - `channels.zalouser.groups` (keys are group IDs or names)
-- Block all groups: `channels.zalouser.groupPolicy = "disabled"`.
-- The configure wizard can prompt for group allowlists.
-- On startup, Clawdbot resolves group/user names in allowlists to IDs and logs the mapping; unresolved entries are kept as typed.
-
-Example:
-```json5
-{
-  channels: {
-    zalouser: {
-      groupPolicy: "allowlist",
-      groups: {
-        "123456789": { allow: true },
-        "Work Chat": { allow: true }
-      }
-    }
-  }
-}
-```
-
 ## Multi-account
 Accounts map to zca profiles. Example:
 

docs/cli/channels.md

@@ -20,7 +20,6 @@ clawdbot channels list
 clawdbot channels status
 clawdbot channels capabilities
 clawdbot channels capabilities --channel discord --target channel:123
-clawdbot channels resolve --channel slack "#general" "@jane"
 clawdbot channels logs --channel all
 ```
 
@@ -58,17 +57,3 @@ Notes:
 - `--channel` is optional; omit it to list every channel (including extensions).
 - `--target` accepts `channel:<id>` or a raw numeric channel id and only applies to Discord.
 - Probes are provider-specific: Discord intents + optional channel permissions; Slack bot + user scopes; Telegram bot flags + webhook; Signal daemon version; MS Teams app token + Graph roles/scopes (annotated where known). Channels without probes report `Probe: unavailable`.
-
-## Resolve names to IDs
-
-Resolve channel/user names to IDs using the provider directory:
-
-```bash
-clawdbot channels resolve --channel slack "#general" "@jane"
-clawdbot channels resolve --channel discord "My Server/#support" "@someone"
-clawdbot channels resolve --channel matrix "Project Room"
-```
-
-Notes:
-- Use `--kind user|group|auto` to force the target type.
-- Resolution prefers active matches when multiple entries share the same name.

docs/cli/configure.md

@@ -17,7 +17,6 @@ Related:
 
 Notes:
 - Choosing where the Gateway runs always updates `gateway.mode`. You can select "Continue" without other sections if that is all you need.
-- Channel-oriented services (Slack/Discord/Matrix/Microsoft Teams) prompt for channel/room allowlists during setup. You can enter names or IDs; the wizard resolves names to IDs when possible.
 
 ## Examples
 

docs/concepts/memory.md

@@ -151,7 +151,6 @@ Local mode:
 - File type: Markdown only (`MEMORY.md`, `memory/**/*.md`).
 - Index storage: per-agent SQLite at `~/.clawdbot/state/memory/<agentId>.sqlite` (configurable via `agents.defaults.memorySearch.store.path`, supports `{agentId}` token).
 - Freshness: watcher on `MEMORY.md` + `memory/` marks the index dirty (debounce 1.5s). Sync runs on session start, on first search when dirty, and optionally on an interval. Reindex triggers when embedding model/provider or chunk sizes change.
-- Model changes: the index stores the embedding **model + provider + chunking params**. If any of those change, Clawdbot automatically resets and reindexes the entire store.
 
 ### Session memory search (experimental)
 

docs/concepts/model-providers.md

@@ -183,22 +183,6 @@ Kimi Code uses a dedicated endpoint and key (separate from Moonshot):
 }
 ```
 
-### Qwen OAuth (free tier)
-
-Qwen provides OAuth access to Qwen Coder + Vision via a device-code flow.
-Enable the bundled plugin, then log in:
-
-```bash
-clawdbot plugins enable qwen-portal-auth
-clawdbot models auth login --provider qwen-portal --set-default
-```
-
-Model refs:
-- `qwen-portal/coder-model`
-- `qwen-portal/vision-model`
-
-See [/providers/qwen](/providers/qwen) for setup details and notes.
-
 ### Synthetic
 
 Synthetic provides Anthropic-compatible models behind the `synthetic` provider:

docs/gateway/configuration.md

@@ -678,11 +678,10 @@ Notes:
 - `"open"`: groups bypass allowlists; mention-gating still applies.
 - `"disabled"`: block all group/room messages.
 - `"allowlist"`: only allow groups/rooms that match the configured allowlist.
-- `channels.defaults.groupPolicy` sets the default when a provider’s `groupPolicy` is unset.
 - WhatsApp/Telegram/Signal/iMessage/Microsoft Teams use `groupAllowFrom` (fallback: explicit `allowFrom`).
 - Discord/Slack use channel allowlists (`channels.discord.guilds.*.channels`, `channels.slack.channels`).
 - Group DMs (Discord/Slack) are still controlled by `dm.groupEnabled` + `dm.groupChannels`.
-- Default is `groupPolicy: "allowlist"` (unless overridden by `channels.defaults.groupPolicy`); if no allowlist is configured, group messages are blocked.
+- Default is `groupPolicy: "allowlist"`; if no allowlist is configured, group messages are blocked.
 
 ### Multi-agent routing (`agents.list` + `bindings`)
 

docs/plugin.md

@@ -43,7 +43,6 @@ See [Voice Call](/plugins/voice-call) for a concrete example plugin.
 - [Microsoft Teams](/channels/msteams) — `@clawdbot/msteams`
 - Google Antigravity OAuth (provider auth) — bundled as `google-antigravity-auth` (disabled by default)
 - Gemini CLI OAuth (provider auth) — bundled as `google-gemini-cli-auth` (disabled by default)
-- Qwen OAuth (provider auth) — bundled as `qwen-portal-auth` (disabled by default)
 - Copilot Proxy (provider auth) — bundled as `copilot-proxy` (disabled by default)
 
 Clawdbot plugins are **TypeScript modules** loaded at runtime via jiti. They can

docs/providers/github-copilot.md

@@ -1,49 +0,0 @@
----
-summary: "Sign in to GitHub Copilot from Clawdbot using the device flow"
-read_when:
-  - You want to use GitHub Copilot as a model provider
-  - You need the `clawdbot models auth login-github-copilot` flow
----
-# Github Copilot
-
-Use GitHub Copilot as a model provider (`github-copilot`). The login command runs
-the GitHub device flow, saves an auth profile, and updates your config to use that
-profile.
-
-## CLI setup
-
-```bash
-clawdbot models auth login-github-copilot
-```
-
-You'll be prompted to visit a URL and enter a one-time code. Keep the terminal
-open until it completes.
-
-### Optional flags
-
-```bash
-clawdbot models auth login-github-copilot --profile-id github-copilot:work
-clawdbot models auth login-github-copilot --yes
-```
-
-## Set a default model
-
-```bash
-clawdbot models set github-copilot/gpt-4o
-```
-
-### Config snippet
-
-```json5
-{
-  agents: { defaults: { model: { primary: "github-copilot/gpt-4o" } } }
-}
-```
-
-## Notes
-
-- Requires an interactive TTY; run it directly in a terminal.
-- Copilot model availability depends on your plan; if a model is rejected, try
-  another ID (for example `github-copilot/gpt-4.1`).
-- The login stores a GitHub token in the auth profile store and exchanges it for a
-  Copilot API token when Clawdbot runs.

docs/providers/index.md

@@ -26,7 +26,6 @@ Looking for chat channel docs (WhatsApp/Telegram/Discord/Slack/etc.)? See [Chann
 
 - [OpenAI (API + Codex)](/providers/openai)
 - [Anthropic (API + Claude Code CLI)](/providers/anthropic)
-- [Qwen (OAuth)](/providers/qwen)
 - [OpenRouter](/providers/openrouter)
 - [Vercel AI Gateway](/providers/vercel-ai-gateway)
 - [Moonshot AI (Kimi + Kimi Code)](/providers/moonshot)

docs/providers/qwen.md

@@ -1,51 +0,0 @@
----
-summary: "Use Qwen OAuth (free tier) in Clawdbot"
-read_when:
-  - You want to use Qwen with Clawdbot
-  - You want free-tier OAuth access to Qwen Coder
----
-# Qwen
-
-Qwen provides a free-tier OAuth flow for Qwen Coder and Qwen Vision models
-(2,000 requests/day, subject to Qwen rate limits).
-
-## Enable the plugin
-
-```bash
-clawdbot plugins enable qwen-portal-auth
-```
-
-Restart the Gateway after enabling.
-
-## Authenticate
-
-```bash
-clawdbot models auth login --provider qwen-portal --set-default
-```
-
-This runs the Qwen device-code OAuth flow and writes a provider entry to your
-`models.json` (plus a `qwen` alias for quick switching).
-
-## Model IDs
-
-- `qwen-portal/coder-model`
-- `qwen-portal/vision-model`
-
-Switch models with:
-
-```bash
-clawdbot models set qwen-portal/coder-model
-```
-
-## Reuse Qwen Code CLI login
-
-If you already logged in with the Qwen Code CLI, Clawdbot will sync credentials
-from `~/.qwen/oauth_creds.json` when it loads the auth store. You still need a
-`models.providers.qwen-portal` entry (use the login command above to create one).
-
-## Notes
-
-- Tokens auto-refresh; re-run the login command if refresh fails or access is revoked.
-- Default base URL: `https://portal.qwen.ai/v1` (override with
-  `models.providers.qwen-portal.baseUrl` if Qwen provides a different endpoint).
-- See [Model providers](/concepts/model-providers) for provider-wide rules.

docs/start/wizard.md

@@ -293,7 +293,6 @@ Typical fields in `~/.clawdbot/clawdbot.json`:
 - `agents.defaults.model` / `models.providers` (if Minimax chosen)
 - `gateway.*` (mode, bind, auth, tailscale)
 - `channels.telegram.botToken`, `channels.discord.token`, `channels.signal.*`, `channels.imessage.*`
-- Channel allowlists (Slack/Discord/Matrix/Microsoft Teams) when you opt in during the prompts (names resolve to IDs when possible).
 - `skills.install.nodeManager`
 - `wizard.lastRunAt`
 - `wizard.lastRunVersion`

docs/tools/subagents.md

@@ -27,7 +27,6 @@ Tool params:
 - `label?` (optional)
 - `agentId?` (optional; spawn under another agent id if allowed)
 - `model?` (optional; overrides the sub-agent model; invalid values are skipped and the sub-agent runs on the default model with a warning in the tool result)
-- `thinking?` (optional; overrides thinking level for the sub-agent run)
 - `runTimeoutSeconds?` (default `0`; when set, the sub-agent run is aborted after N seconds)
 - `cleanup?` (`delete|keep`, default `keep`)
 

extensions/matrix/src/channel.ts

@@ -25,11 +25,6 @@ import { probeMatrix } from "./matrix/probe.js";
 import { sendMessageMatrix } from "./matrix/send.js";
 import { matrixOnboardingAdapter } from "./onboarding.js";
 import { matrixOutbound } from "./outbound.js";
-import { resolveMatrixTargets } from "./resolve-targets.js";
-import {
-  listMatrixDirectoryGroupsLive,
-  listMatrixDirectoryPeersLive,
-} from "./directory-live.js";
 
 const meta = {
   id: "matrix",
@@ -152,9 +147,8 @@ export const matrixPlugin: ChannelPlugin<ResolvedMatrixAccount> = {
       approveHint: formatPairingApproveHint("matrix"),
       normalizeEntry: (raw) => raw.replace(/^matrix:/i, "").trim().toLowerCase(),
     }),
-    collectWarnings: ({ account, cfg }) => {
-      const defaultGroupPolicy = (cfg as CoreConfig).channels?.defaults?.groupPolicy;
-      const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+    collectWarnings: ({ account }) => {
+      const groupPolicy = account.config.groupPolicy ?? "allowlist";
       if (groupPolicy !== "open") return [];
       return [
         "- Matrix rooms: groupPolicy=\"open\" allows any room to trigger (mention-gated). Set channels.matrix.groupPolicy=\"allowlist\" + channels.matrix.rooms to restrict rooms.",
@@ -240,14 +234,6 @@ export const matrixPlugin: ChannelPlugin<ResolvedMatrixAccount> = {
         .map((id) => ({ kind: "group", id }) as const);
       return ids;
     },
-    listPeersLive: async ({ cfg, query, limit }) =>
-      listMatrixDirectoryPeersLive({ cfg, query, limit }),
-    listGroupsLive: async ({ cfg, query, limit }) =>
-      listMatrixDirectoryGroupsLive({ cfg, query, limit }),
-  },
-  resolver: {
-    resolveTargets: async ({ cfg, inputs, kind, runtime }) =>
-      resolveMatrixTargets({ cfg, inputs, kind, runtime }),
   },
   actions: matrixMessageActions,
   setup: {

extensions/matrix/src/directory-live.ts

@@ -1,175 +0,0 @@
-import type { ChannelDirectoryEntry } from "../../../src/channels/plugins/types.js";
-
-import { resolveMatrixAuth } from "./matrix/client.js";
-
-type MatrixUserResult = {
-  user_id?: string;
-  display_name?: string;
-};
-
-type MatrixUserDirectoryResponse = {
-  results?: MatrixUserResult[];
-};
-
-type MatrixJoinedRoomsResponse = {
-  joined_rooms?: string[];
-};
-
-type MatrixRoomNameState = {
-  name?: string;
-};
-
-type MatrixAliasLookup = {
-  room_id?: string;
-};
-
-async function fetchMatrixJson<T>(params: {
-  homeserver: string;
-  path: string;
-  accessToken: string;
-  method?: "GET" | "POST";
-  body?: unknown;
-}): Promise<T> {
-  const res = await fetch(`${params.homeserver}${params.path}`, {
-    method: params.method ?? "GET",
-    headers: {
-      Authorization: `Bearer ${params.accessToken}`,
-      "Content-Type": "application/json",
-    },
-    body: params.body ? JSON.stringify(params.body) : undefined,
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Matrix API ${params.path} failed (${res.status}): ${text || "unknown error"}`);
-  }
-  return (await res.json()) as T;
-}
-
-function normalizeQuery(value?: string | null): string {
-  return value?.trim().toLowerCase() ?? "";
-}
-
-export async function listMatrixDirectoryPeersLive(params: {
-  cfg: unknown;
-  query?: string | null;
-  limit?: number | null;
-}): Promise<ChannelDirectoryEntry[]> {
-  const query = normalizeQuery(params.query);
-  if (!query) return [];
-  const auth = await resolveMatrixAuth({ cfg: params.cfg as never });
-  const res = await fetchMatrixJson<MatrixUserDirectoryResponse>({
-    homeserver: auth.homeserver,
-    accessToken: auth.accessToken,
-    path: "/_matrix/client/v3/user_directory/search",
-    method: "POST",
-    body: {
-      search_term: query,
-      limit: typeof params.limit === "number" && params.limit > 0 ? params.limit : 20,
-    },
-  });
-  const results = res.results ?? [];
-  return results
-    .map((entry) => {
-      const userId = entry.user_id?.trim();
-      if (!userId) return null;
-      return {
-        kind: "user",
-        id: userId,
-        name: entry.display_name?.trim() || undefined,
-        handle: entry.display_name ? `@${entry.display_name.trim()}` : undefined,
-        raw: entry,
-      } satisfies ChannelDirectoryEntry;
-    })
-    .filter(Boolean) as ChannelDirectoryEntry[];
-}
-
-async function resolveMatrixRoomAlias(
-  homeserver: string,
-  accessToken: string,
-  alias: string,
-): Promise<string | null> {
-  try {
-    const res = await fetchMatrixJson<MatrixAliasLookup>({
-      homeserver,
-      accessToken,
-      path: `/_matrix/client/v3/directory/room/${encodeURIComponent(alias)}`,
-    });
-    return res.room_id?.trim() || null;
-  } catch {
-    return null;
-  }
-}
-
-async function fetchMatrixRoomName(
-  homeserver: string,
-  accessToken: string,
-  roomId: string,
-): Promise<string | null> {
-  try {
-    const res = await fetchMatrixJson<MatrixRoomNameState>({
-      homeserver,
-      accessToken,
-      path: `/_matrix/client/v3/rooms/${encodeURIComponent(roomId)}/state/m.room.name`,
-    });
-    return res.name?.trim() || null;
-  } catch {
-    return null;
-  }
-}
-
-export async function listMatrixDirectoryGroupsLive(params: {
-  cfg: unknown;
-  query?: string | null;
-  limit?: number | null;
-}): Promise<ChannelDirectoryEntry[]> {
-  const query = normalizeQuery(params.query);
-  if (!query) return [];
-  const auth = await resolveMatrixAuth({ cfg: params.cfg as never });
-  const limit = typeof params.limit === "number" && params.limit > 0 ? params.limit : 20;
-
-  if (query.startsWith("#")) {
-    const roomId = await resolveMatrixRoomAlias(auth.homeserver, auth.accessToken, query);
-    if (!roomId) return [];
-    return [
-      {
-        kind: "group",
-        id: roomId,
-        name: query,
-        handle: query,
-      } satisfies ChannelDirectoryEntry,
-    ];
-  }
-
-  if (query.startsWith("!")) {
-    return [
-      {
-        kind: "group",
-        id: query,
-        name: query,
-      } satisfies ChannelDirectoryEntry,
-    ];
-  }
-
-  const joined = await fetchMatrixJson<MatrixJoinedRoomsResponse>({
-    homeserver: auth.homeserver,
-    accessToken: auth.accessToken,
-    path: "/_matrix/client/v3/joined_rooms",
-  });
-  const rooms = joined.joined_rooms ?? [];
-  const results: ChannelDirectoryEntry[] = [];
-
-  for (const roomId of rooms) {
-    const name = await fetchMatrixRoomName(auth.homeserver, auth.accessToken, roomId);
-    if (!name) continue;
-    if (!name.toLowerCase().includes(query)) continue;
-    results.push({
-      kind: "group",
-      id: roomId,
-      name,
-      handle: `#${name}`,
-    });
-    if (results.length >= limit) break;
-  }
-
-  return results;
-}

extensions/matrix/src/matrix/monitor/allowlist.ts

@@ -10,49 +10,23 @@ function normalizeMatrixUser(raw?: string | null): string {
   return (raw ?? "").trim().toLowerCase();
 }
 
-export type MatrixAllowListMatch = {
-  allowed: boolean;
-  matchKey?: string;
-  matchSource?: "wildcard" | "id" | "prefixed-id" | "prefixed-user" | "name" | "localpart";
-};
-
-export function resolveMatrixAllowListMatch(params: {
-  allowList: string[];
-  userId?: string;
-  userName?: string;
-}): MatrixAllowListMatch {
-  const allowList = params.allowList;
-  if (allowList.length === 0) return { allowed: false };
-  if (allowList.includes("*")) {
-    return { allowed: true, matchKey: "*", matchSource: "wildcard" };
-  }
-  const userId = normalizeMatrixUser(params.userId);
-  const userName = normalizeMatrixUser(params.userName);
-  const localPart = userId.startsWith("@") ? (userId.slice(1).split(":")[0] ?? "") : "";
-  const candidates: Array<{ value?: string; source: MatrixAllowListMatch["matchSource"] }> = [
-    { value: userId, source: "id" },
-    { value: userId ? `matrix:${userId}` : "", source: "prefixed-id" },
-    { value: userId ? `user:${userId}` : "", source: "prefixed-user" },
-    { value: userName, source: "name" },
-    { value: localPart, source: "localpart" },
-  ];
-  for (const candidate of candidates) {
-    if (!candidate.value) continue;
-    if (allowList.includes(candidate.value)) {
-      return {
-        allowed: true,
-        matchKey: candidate.value,
-        matchSource: candidate.source,
-      };
-    }
-  }
-  return { allowed: false };
-}
-
 export function resolveMatrixAllowListMatches(params: {
   allowList: string[];
   userId?: string;
   userName?: string;
 }) {
-  return resolveMatrixAllowListMatch(params).allowed;
+  const allowList = params.allowList;
+  if (allowList.length === 0) return false;
+  if (allowList.includes("*")) return true;
+  const userId = normalizeMatrixUser(params.userId);
+  const userName = normalizeMatrixUser(params.userName);
+  const localPart = userId.startsWith("@") ? (userId.slice(1).split(":")[0] ?? "") : "";
+  const candidates = [
+    userId,
+    userId ? `matrix:${userId}` : "",
+    userId ? `user:${userId}` : "",
+    userName,
+    localPart,
+  ].filter(Boolean);
+  return candidates.some((value) => allowList.includes(value));
 }

extensions/matrix/src/matrix/monitor/index.ts

@@ -41,12 +41,7 @@ import {
   parsePollStartContent,
 } from "../poll-types.js";
 import { reactMatrixMessage, sendMessageMatrix, sendTypingMatrix } from "../send.js";
-import {
-  resolveMatrixAllowListMatch,
-  resolveMatrixAllowListMatches,
-  normalizeAllowListLower,
-} from "./allowlist.js";
-import { mergeAllowlist, summarizeMapping } from "../../../../../src/channels/allowlists/resolve-utils.js";
+import { resolveMatrixAllowListMatches, normalizeAllowListLower } from "./allowlist.js";
 import { registerMatrixAutoJoin } from "./auto-join.js";
 import { createDirectRoomTracker } from "./direct.js";
 import { downloadMatrixMedia } from "./media.js";
@@ -54,7 +49,6 @@ import { resolveMentions } from "./mentions.js";
 import { deliverMatrixReplies } from "./replies.js";
 import { resolveMatrixRoomConfig } from "./rooms.js";
 import { resolveMatrixThreadRootId, resolveMatrixThreadTarget } from "./threads.js";
-import { resolveMatrixTargets } from "../../resolve-targets.js";
 
 export type MonitorMatrixOpts = {
   runtime?: RuntimeEnv;
@@ -70,7 +64,7 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
   if (isBunRuntime()) {
     throw new Error("Matrix provider requires Node (bun runtime not supported)");
   }
-  let cfg = loadConfig() as CoreConfig;
+  const cfg = loadConfig() as CoreConfig;
   if (cfg.channels?.matrix?.enabled === false) return;
 
   const runtime: RuntimeEnv = opts.runtime ?? {
@@ -81,110 +75,6 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
     },
   };
 
-  const normalizeUserEntry = (raw: string) =>
-    raw.replace(/^matrix:/i, "").replace(/^user:/i, "").trim();
-  const normalizeRoomEntry = (raw: string) =>
-    raw.replace(/^matrix:/i, "").replace(/^(room|channel):/i, "").trim();
-  const isMatrixUserId = (value: string) => value.startsWith("@") && value.includes(":");
-
-  let allowFrom = cfg.channels?.matrix?.dm?.allowFrom ?? [];
-  let roomsConfig = cfg.channels?.matrix?.rooms;
-
-  if (allowFrom.length > 0) {
-    const entries = allowFrom
-      .map((entry) => normalizeUserEntry(String(entry)))
-      .filter((entry) => entry && entry !== "*");
-    if (entries.length > 0) {
-      const mapping: string[] = [];
-      const unresolved: string[] = [];
-      const additions: string[] = [];
-      const pending: string[] = [];
-      for (const entry of entries) {
-        if (isMatrixUserId(entry)) {
-          additions.push(entry);
-          continue;
-        }
-        pending.push(entry);
-      }
-      if (pending.length > 0) {
-        const resolved = await resolveMatrixTargets({
-          cfg,
-          inputs: pending,
-          kind: "user",
-          runtime,
-        });
-        for (const entry of resolved) {
-          if (entry.resolved && entry.id) {
-            additions.push(entry.id);
-            mapping.push(`${entry.input}→${entry.id}`);
-          } else {
-            unresolved.push(entry.input);
-          }
-        }
-      }
-      allowFrom = mergeAllowlist({ existing: allowFrom, additions });
-      summarizeMapping("matrix users", mapping, unresolved, runtime);
-    }
-  }
-
-  if (roomsConfig && Object.keys(roomsConfig).length > 0) {
-    const entries = Object.keys(roomsConfig).filter((key) => key !== "*");
-    const mapping: string[] = [];
-    const unresolved: string[] = [];
-    const nextRooms = { ...roomsConfig };
-    const pending: Array<{ input: string; query: string }> = [];
-    for (const entry of entries) {
-      const trimmed = entry.trim();
-      if (!trimmed) continue;
-      const cleaned = normalizeRoomEntry(trimmed);
-      if (cleaned.startsWith("!") && cleaned.includes(":")) {
-        if (!nextRooms[cleaned]) {
-          nextRooms[cleaned] = roomsConfig[entry];
-        }
-        mapping.push(`${entry}→${cleaned}`);
-        continue;
-      }
-      pending.push({ input: entry, query: trimmed });
-    }
-    if (pending.length > 0) {
-      const resolved = await resolveMatrixTargets({
-        cfg,
-        inputs: pending.map((entry) => entry.query),
-        kind: "group",
-        runtime,
-      });
-      resolved.forEach((entry, index) => {
-        const source = pending[index];
-        if (!source) return;
-        if (entry.resolved && entry.id) {
-          if (!nextRooms[entry.id]) {
-            nextRooms[entry.id] = roomsConfig[source.input];
-          }
-          mapping.push(`${source.input}→${entry.id}`);
-        } else {
-          unresolved.push(source.input);
-        }
-      });
-    }
-    roomsConfig = nextRooms;
-    summarizeMapping("matrix rooms", mapping, unresolved, runtime);
-  }
-
-  cfg = {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      matrix: {
-        ...cfg.channels?.matrix,
-        dm: {
-          ...cfg.channels?.matrix?.dm,
-          allowFrom,
-        },
-        rooms: roomsConfig,
-      },
-    },
-  };
-
   const auth = await resolveMatrixAuth({ cfg });
   const resolvedInitialSyncLimit =
     typeof opts.initialSyncLimit === "number"
@@ -204,8 +94,7 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
   const mentionRegexes = buildMentionRegexes(cfg);
   const logger = getChildLogger({ module: "matrix-auto-reply" });
   const allowlistOnly = cfg.channels?.matrix?.allowlistOnly === true;
-  const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-  const groupPolicyRaw = cfg.channels?.matrix?.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+  const groupPolicyRaw = cfg.channels?.matrix?.groupPolicy ?? "allowlist";
   const groupPolicy = allowlistOnly && groupPolicyRaw === "open" ? "allowlist" : groupPolicyRaw;
   const replyToMode = opts.replyToMode ?? cfg.channels?.matrix?.replyToMode ?? "off";
   const threadReplies = cfg.channels?.matrix?.threadReplies ?? "inbound";
@@ -295,21 +184,18 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
         aliases: roomAliases,
         name: roomName,
       });
-      const roomMatchMeta = `matchKey=${roomConfigInfo.matchKey ?? "none"} matchSource=${
-        roomConfigInfo.matchSource ?? "none"
-      }`;
 
       if (roomConfigInfo.config && !roomConfigInfo.allowed) {
-        logVerbose(`matrix: room disabled room=${roomId} (${roomMatchMeta})`);
+        logVerbose(`matrix: room disabled room=${roomId}`);
         return;
       }
       if (groupPolicy === "allowlist") {
         if (!roomConfigInfo.allowlistConfigured) {
-          logVerbose(`matrix: drop room message (no allowlist, ${roomMatchMeta})`);
+          logVerbose("matrix: drop room message (no allowlist)");
           return;
         }
         if (!roomConfigInfo.config) {
-          logVerbose(`matrix: drop room message (not in allowlist, ${roomMatchMeta})`);
+          logVerbose("matrix: drop room message (not in allowlist)");
           return;
         }
       }
@@ -321,15 +207,14 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
       if (isDirectMessage) {
         if (!dmEnabled || dmPolicy === "disabled") return;
         if (dmPolicy !== "open") {
-          const allowMatch = resolveMatrixAllowListMatch({
-            allowList: effectiveAllowFrom,
-            userId: senderId,
-            userName: senderName,
-          });
-          const allowMatchMeta = `matchKey=${allowMatch.matchKey ?? "none"} matchSource=${
-            allowMatch.matchSource ?? "none"
-          }`;
-          if (!allowMatch.allowed) {
+          const permitted =
+            effectiveAllowFrom.length > 0 &&
+            resolveMatrixAllowListMatches({
+              allowList: effectiveAllowFrom,
+              userId: senderId,
+              userName: senderName,
+            });
+          if (!permitted) {
             if (dmPolicy === "pairing") {
               const { code, created } = await upsertChannelPairingRequest({
                 channel: "matrix",
@@ -337,9 +222,6 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
                 meta: { name: senderName },
               });
               if (created) {
-                logVerbose(
-                  `matrix pairing request sender=${senderId} name=${senderName ?? "unknown"} (${allowMatchMeta})`,
-                );
                 try {
                   await sendMessageMatrix(
                     `room:${roomId}`,
@@ -358,11 +240,6 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
                 }
               }
             }
-            if (dmPolicy !== "pairing") {
-              logVerbose(
-                `matrix: blocked dm sender ${senderId} (dmPolicy=${dmPolicy}, ${allowMatchMeta})`,
-              );
-            }
             return;
           }
         }
@@ -375,15 +252,10 @@ export async function monitorMatrixProvider(opts: MonitorMatrixOpts = {}): Promi
           userName: senderName,
         });
         if (!userAllowed) {
-          logVerbose(
-            `matrix: blocked sender ${senderId} (room users allowlist, ${roomMatchMeta})`,
-          );
+          logVerbose(`matrix: blocked sender ${senderId} (room users allowlist)`);
           return;
         }
       }
-      if (isRoom) {
-        logVerbose(`matrix: allow room ${roomId} (${roomMatchMeta})`);
-      }
 
       const rawBody = content.body.trim();
       let media: {

extensions/matrix/src/matrix/monitor/rooms.ts

@@ -1,15 +1,9 @@
 import type { MatrixConfig, MatrixRoomConfig } from "../../types.js";
-import {
-  buildChannelKeyCandidates,
-  resolveChannelEntryMatch,
-} from "../../../../../src/channels/plugins/channel-config.js";
 
 export type MatrixRoomConfigResolved = {
   allowed: boolean;
   allowlistConfigured: boolean;
   config?: MatrixRoomConfig;
-  matchKey?: string;
-  matchSource?: "direct" | "wildcard";
 };
 
 export function resolveMatrixRoomConfig(params: {
@@ -21,26 +15,22 @@ export function resolveMatrixRoomConfig(params: {
   const rooms = params.rooms ?? {};
   const keys = Object.keys(rooms);
   const allowlistConfigured = keys.length > 0;
-  const candidates = buildChannelKeyCandidates(
+  const candidates = [
     params.roomId,
     `room:${params.roomId}`,
     ...params.aliases,
     params.name ?? "",
-  );
-  const { entry: matched, key: matchedKey, wildcardEntry, wildcardKey } = resolveChannelEntryMatch({
-    entries: rooms,
-    keys: candidates,
-    wildcardKey: "*",
-  });
-  const resolved = matched ?? wildcardEntry;
-  const allowed = resolved ? resolved.enabled !== false && resolved.allow !== false : false;
-  const matchKey = matchedKey ?? wildcardKey;
-  const matchSource = matched ? "direct" : wildcardEntry ? "wildcard" : undefined;
-  return {
-    allowed,
-    allowlistConfigured,
-    config: resolved,
-    matchKey,
-    matchSource,
-  };
+  ].filter(Boolean);
+  let matched: MatrixRoomConfigResolved["config"] | undefined;
+  for (const candidate of candidates) {
+    if (rooms[candidate]) {
+      matched = rooms[candidate];
+      break;
+    }
+  }
+  if (!matched && rooms["*"]) {
+    matched = rooms["*"];
+  }
+  const allowed = matched ? matched.enabled !== false && matched.allow !== false : false;
+  return { allowed, allowlistConfigured, config: matched };
 }

extensions/matrix/src/onboarding.ts

@@ -3,10 +3,8 @@ import type {
   ChannelOnboardingAdapter,
   ChannelOnboardingDmPolicy,
 } from "../../../src/channels/plugins/onboarding-types.js";
-import { promptChannelAccessConfig } from "../../../src/channels/plugins/onboarding/channel-access.js";
 import { formatDocsLink } from "../../../src/terminal/links.js";
 import type { WizardPrompter } from "../../../src/wizard/prompts.js";
-import { listMatrixDirectoryGroupsLive } from "./directory-live.js";
 import { resolveMatrixAccount } from "./matrix/accounts.js";
 import { ensureMatrixSdkInstalled, isMatrixSdkAvailable } from "./matrix/deps.js";
 import type { CoreConfig, DmPolicy } from "./types.js";
@@ -85,35 +83,6 @@ async function promptMatrixAllowFrom(params: {
   };
 }
 
-function setMatrixGroupPolicy(cfg: CoreConfig, groupPolicy: "open" | "allowlist" | "disabled") {
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      matrix: {
-        ...cfg.channels?.matrix,
-        enabled: true,
-        groupPolicy,
-      },
-    },
-  };
-}
-
-function setMatrixRoomAllowlist(cfg: CoreConfig, roomKeys: string[]) {
-  const rooms = Object.fromEntries(roomKeys.map((key) => [key, { allow: true }]));
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      matrix: {
-        ...cfg.channels?.matrix,
-        enabled: true,
-        rooms,
-      },
-    },
-  };
-}
-
 const dmPolicy: ChannelOnboardingDmPolicy = {
   label: "Matrix",
   channel,
@@ -285,75 +254,6 @@ export const matrixOnboardingAdapter: ChannelOnboardingAdapter = {
       next = await promptMatrixAllowFrom({ cfg: next, prompter });
     }
 
-    const accessConfig = await promptChannelAccessConfig({
-      prompter,
-      label: "Matrix rooms",
-      currentPolicy: next.channels?.matrix?.groupPolicy ?? "allowlist",
-      currentEntries: Object.keys(next.channels?.matrix?.rooms ?? {}),
-      placeholder: "!roomId:server, #alias:server, Project Room",
-      updatePrompt: Boolean(next.channels?.matrix?.rooms),
-    });
-    if (accessConfig) {
-      if (accessConfig.policy !== "allowlist") {
-        next = setMatrixGroupPolicy(next, accessConfig.policy);
-      } else {
-        let roomKeys = accessConfig.entries;
-        if (accessConfig.entries.length > 0) {
-          try {
-            const resolvedIds: string[] = [];
-            const unresolved: string[] = [];
-            for (const entry of accessConfig.entries) {
-              const trimmed = entry.trim();
-              if (!trimmed) continue;
-              const cleaned = trimmed.replace(/^(room|channel):/i, "").trim();
-              if (cleaned.startsWith("!") && cleaned.includes(":")) {
-                resolvedIds.push(cleaned);
-                continue;
-              }
-              const matches = await listMatrixDirectoryGroupsLive({
-                cfg: next,
-                query: trimmed,
-                limit: 10,
-              });
-              const exact = matches.find(
-                (match) => (match.name ?? "").toLowerCase() === trimmed.toLowerCase(),
-              );
-              const best = exact ?? matches[0];
-              if (best?.id) {
-                resolvedIds.push(best.id);
-              } else {
-                unresolved.push(entry);
-              }
-            }
-            roomKeys = [
-              ...resolvedIds,
-              ...unresolved.map((entry) => entry.trim()).filter(Boolean),
-            ];
-            if (resolvedIds.length > 0 || unresolved.length > 0) {
-              await prompter.note(
-                [
-                  resolvedIds.length > 0 ? `Resolved: ${resolvedIds.join(", ")}` : undefined,
-                  unresolved.length > 0
-                    ? `Unresolved (kept as typed): ${unresolved.join(", ")}`
-                    : undefined,
-                ]
-                  .filter(Boolean)
-                  .join("\n"),
-                "Matrix rooms",
-              );
-            }
-          } catch (err) {
-            await prompter.note(
-              `Room lookup failed; keeping entries as typed. ${String(err)}`,
-              "Matrix rooms",
-            );
-          }
-        }
-        next = setMatrixGroupPolicy(next, "allowlist");
-        next = setMatrixRoomAllowlist(next, roomKeys);
-      }
-    }
-
     return { cfg: next };
   },
   dmPolicy,

extensions/matrix/src/resolve-targets.ts

@@ -1,89 +0,0 @@
-import type {
-  ChannelDirectoryEntry,
-  ChannelResolveKind,
-  ChannelResolveResult,
-} from "../../../src/channels/plugins/types.js";
-import type { RuntimeEnv } from "../../../src/runtime.js";
-
-import {
-  listMatrixDirectoryGroupsLive,
-  listMatrixDirectoryPeersLive,
-} from "./directory-live.js";
-
-function pickBestGroupMatch(
-  matches: ChannelDirectoryEntry[],
-  query: string,
-): ChannelDirectoryEntry | undefined {
-  if (matches.length === 0) return undefined;
-  const normalized = query.trim().toLowerCase();
-  if (normalized) {
-    const exact = matches.find((match) => {
-      const name = match.name?.trim().toLowerCase();
-      const handle = match.handle?.trim().toLowerCase();
-      const id = match.id.trim().toLowerCase();
-      return name === normalized || handle === normalized || id === normalized;
-    });
-    if (exact) return exact;
-  }
-  return matches[0];
-}
-
-export async function resolveMatrixTargets(params: {
-  cfg: unknown;
-  inputs: string[];
-  kind: ChannelResolveKind;
-  runtime?: RuntimeEnv;
-}): Promise<ChannelResolveResult[]> {
-  const results: ChannelResolveResult[] = [];
-  for (const input of params.inputs) {
-    const trimmed = input.trim();
-    if (!trimmed) {
-      results.push({ input, resolved: false, note: "empty input" });
-      continue;
-    }
-    if (params.kind === "user") {
-      if (trimmed.startsWith("@") && trimmed.includes(":")) {
-        results.push({ input, resolved: true, id: trimmed });
-        continue;
-      }
-      try {
-        const matches = await listMatrixDirectoryPeersLive({
-          cfg: params.cfg,
-          query: trimmed,
-          limit: 5,
-        });
-        const best = matches[0];
-        results.push({
-          input,
-          resolved: Boolean(best?.id),
-          id: best?.id,
-          name: best?.name,
-          note: matches.length > 1 ? "multiple matches; chose first" : undefined,
-        });
-      } catch (err) {
-        params.runtime?.error?.(`matrix resolve failed: ${String(err)}`);
-        results.push({ input, resolved: false, note: "lookup failed" });
-      }
-      continue;
-    }
-    try {
-      const matches = await listMatrixDirectoryGroupsLive({
-        cfg: params.cfg,
-        query: trimmed,
-        limit: 5,
-      });
-      const best = pickBestGroupMatch(matches, trimmed);
-      results.push({
-        input,
-        resolved: Boolean(best?.id),
-        id: best?.id,
-        name: best?.name,
-        note: matches.length > 1 ? "multiple matches; chose first" : undefined,
-      });
-    } catch (err) {
-      params.runtime?.error?.(`matrix resolve failed: ${String(err)}`);
-      results.push({ input, resolved: false, note: "lookup failed" });
-    }
-  }
-  return results;
-}

extensions/msteams/src/channel.ts

@@ -8,20 +8,8 @@ import { DEFAULT_ACCOUNT_ID } from "../../../src/routing/session-key.js";
 import { msteamsOnboardingAdapter } from "./onboarding.js";
 import { msteamsOutbound } from "./outbound.js";
 import { probeMSTeams } from "./probe.js";
-import {
-  normalizeMSTeamsMessagingTarget,
-  normalizeMSTeamsUserInput,
-  parseMSTeamsConversationId,
-  parseMSTeamsTeamChannelInput,
-  resolveMSTeamsChannelAllowlist,
-  resolveMSTeamsUserAllowlist,
-} from "./resolve-allowlist.js";
 import { sendMessageMSTeams } from "./send.js";
 import { resolveMSTeamsCredentials } from "./token.js";
-import {
-  listMSTeamsDirectoryGroupsLive,
-  listMSTeamsDirectoryPeersLive,
-} from "./directory-live.js";
 
 type ResolvedMSTeamsAccount = {
   accountId: string;
@@ -40,6 +28,21 @@ const meta = {
   order: 60,
 } as const;
 
+function normalizeMSTeamsMessagingTarget(raw: string): string | undefined {
+  let trimmed = raw.trim();
+  if (!trimmed) return undefined;
+  if (/^(msteams|teams):/i.test(trimmed)) {
+    trimmed = trimmed.replace(/^(msteams|teams):/i, "");
+  }
+  if (/^conversation:/i.test(trimmed)) {
+    return `conversation:${trimmed.slice("conversation:".length).trim()}`;
+  }
+  if (/^user:/i.test(trimmed)) {
+    return `user:${trimmed.slice("user:".length).trim()}`;
+  }
+  return trimmed;
+}
+
 export const msteamsPlugin: ChannelPlugin<ResolvedMSTeamsAccount> = {
   id: "msteams",
   meta: {
@@ -109,8 +112,7 @@ export const msteamsPlugin: ChannelPlugin<ResolvedMSTeamsAccount> = {
   },
   security: {
     collectWarnings: ({ cfg }) => {
-      const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-      const groupPolicy = cfg.channels?.msteams?.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+      const groupPolicy = cfg.channels?.msteams?.groupPolicy ?? "allowlist";
       if (groupPolicy !== "open") return [];
       return [
         `- MS Teams groups: groupPolicy="open" allows any member to trigger (mention-gated). Set channels.msteams.groupPolicy="allowlist" + channels.msteams.groupAllowFrom to restrict senders.`,
@@ -187,129 +189,6 @@ export const msteamsPlugin: ChannelPlugin<ResolvedMSTeamsAccount> = {
         .slice(0, limit && limit > 0 ? limit : undefined)
         .map((id) => ({ kind: "group", id }) as const);
     },
-    listPeersLive: async ({ cfg, query, limit }) =>
-      listMSTeamsDirectoryPeersLive({ cfg, query, limit }),
-    listGroupsLive: async ({ cfg, query, limit }) =>
-      listMSTeamsDirectoryGroupsLive({ cfg, query, limit }),
-  },
-  resolver: {
-    resolveTargets: async ({ cfg, inputs, kind, runtime }) => {
-      const results = inputs.map((input) => ({
-        input,
-        resolved: false,
-        id: undefined as string | undefined,
-        name: undefined as string | undefined,
-        note: undefined as string | undefined,
-      }));
-
-      const stripPrefix = (value: string) =>
-        normalizeMSTeamsUserInput(value);
-
-      if (kind === "user") {
-        const pending: Array<{ input: string; query: string; index: number }> = [];
-        results.forEach((entry, index) => {
-          const trimmed = entry.input.trim();
-          if (!trimmed) {
-            entry.note = "empty input";
-            return;
-          }
-          const cleaned = stripPrefix(trimmed);
-          if (/^[0-9a-fA-F-]{16,}$/.test(cleaned) || cleaned.includes("@")) {
-            entry.resolved = true;
-            entry.id = cleaned;
-            return;
-          }
-          pending.push({ input: entry.input, query: cleaned, index });
-        });
-
-        if (pending.length > 0) {
-          try {
-            const resolved = await resolveMSTeamsUserAllowlist({
-              cfg,
-              entries: pending.map((entry) => entry.query),
-            });
-            resolved.forEach((entry, idx) => {
-              const target = results[pending[idx]?.index ?? -1];
-              if (!target) return;
-              target.resolved = entry.resolved;
-              target.id = entry.id;
-              target.name = entry.name;
-              target.note = entry.note;
-            });
-          } catch (err) {
-            runtime.error?.(`msteams resolve failed: ${String(err)}`);
-            pending.forEach(({ index }) => {
-              const entry = results[index];
-              if (entry) entry.note = "lookup failed";
-            });
-          }
-        }
-
-        return results;
-      }
-
-      const pending: Array<{ input: string; query: string; index: number }> = [];
-      results.forEach((entry, index) => {
-        const trimmed = entry.input.trim();
-        if (!trimmed) {
-          entry.note = "empty input";
-          return;
-        }
-        const conversationId = parseMSTeamsConversationId(trimmed);
-        if (conversationId !== null) {
-          entry.resolved = Boolean(conversationId);
-          entry.id = conversationId || undefined;
-          entry.note = conversationId ? "conversation id" : "empty conversation id";
-          return;
-        }
-        const parsed = parseMSTeamsTeamChannelInput(trimmed);
-        if (!parsed.team) {
-          entry.note = "missing team";
-          return;
-        }
-        const query = parsed.channel ? `${parsed.team}/${parsed.channel}` : parsed.team;
-        pending.push({ input: entry.input, query, index });
-      });
-
-      if (pending.length > 0) {
-        try {
-          const resolved = await resolveMSTeamsChannelAllowlist({
-            cfg,
-            entries: pending.map((entry) => entry.query),
-          });
-          resolved.forEach((entry, idx) => {
-            const target = results[pending[idx]?.index ?? -1];
-            if (!target) return;
-            if (!entry.resolved || !entry.teamId) {
-              target.resolved = false;
-              target.note = entry.note;
-              return;
-            }
-            target.resolved = true;
-            if (entry.channelId) {
-              target.id = `${entry.teamId}/${entry.channelId}`;
-              target.name =
-                entry.channelName && entry.teamName
-                  ? `${entry.teamName}/${entry.channelName}`
-                  : entry.channelName ?? entry.teamName;
-            } else {
-              target.id = entry.teamId;
-              target.name = entry.teamName;
-              target.note = "team id";
-            }
-            if (entry.note) target.note = entry.note;
-          });
-        } catch (err) {
-          runtime.error?.(`msteams resolve failed: ${String(err)}`);
-          pending.forEach(({ index }) => {
-            const entry = results[index];
-            if (entry) entry.note = "lookup failed";
-          });
-        }
-      }
-
-      return results;
-    },
   },
   actions: {
     listActions: ({ cfg }) => {

extensions/msteams/src/directory-live.ts

@@ -1,179 +0,0 @@
-import type { ChannelDirectoryEntry } from "../../../src/channels/plugins/types.js";
-
-import { GRAPH_ROOT } from "./attachments/shared.js";
-import { loadMSTeamsSdkWithAuth } from "./sdk.js";
-import { resolveMSTeamsCredentials } from "./token.js";
-
-type GraphUser = {
-  id?: string;
-  displayName?: string;
-  userPrincipalName?: string;
-  mail?: string;
-};
-
-type GraphGroup = {
-  id?: string;
-  displayName?: string;
-};
-
-type GraphChannel = {
-  id?: string;
-  displayName?: string;
-};
-
-type GraphResponse<T> = { value?: T[] };
-
-function readAccessToken(value: unknown): string | null {
-  if (typeof value === "string") return value;
-  if (value && typeof value === "object") {
-    const token =
-      (value as { accessToken?: unknown }).accessToken ?? (value as { token?: unknown }).token;
-    return typeof token === "string" ? token : null;
-  }
-  return null;
-}
-
-function normalizeQuery(value?: string | null): string {
-  return value?.trim() ?? "";
-}
-
-function escapeOData(value: string): string {
-  return value.replace(/'/g, "''");
-}
-
-async function fetchGraphJson<T>(params: {
-  token: string;
-  path: string;
-  headers?: Record<string, string>;
-}): Promise<T> {
-  const res = await fetch(`${GRAPH_ROOT}${params.path}`, {
-    headers: {
-      Authorization: `Bearer ${params.token}`,
-      ...(params.headers ?? {}),
-    },
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Graph ${params.path} failed (${res.status}): ${text || "unknown error"}`);
-  }
-  return (await res.json()) as T;
-}
-
-async function resolveGraphToken(cfg: unknown): Promise<string> {
-  const creds = resolveMSTeamsCredentials((cfg as { channels?: { msteams?: unknown } })?.channels?.msteams);
-  if (!creds) throw new Error("MS Teams credentials missing");
-  const { sdk, authConfig } = await loadMSTeamsSdkWithAuth(creds);
-  const tokenProvider = new sdk.MsalTokenProvider(authConfig);
-  const token = await tokenProvider.getAccessToken("https://graph.microsoft.com/.default");
-  const accessToken = readAccessToken(token);
-  if (!accessToken) throw new Error("MS Teams graph token unavailable");
-  return accessToken;
-}
-
-async function listTeamsByName(token: string, query: string): Promise<GraphGroup[]> {
-  const escaped = escapeOData(query);
-  const filter = `resourceProvisioningOptions/Any(x:x eq 'Team') and startsWith(displayName,'${escaped}')`;
-  const path = `/groups?$filter=${encodeURIComponent(filter)}&$select=id,displayName`;
-  const res = await fetchGraphJson<GraphResponse<GraphGroup>>({ token, path });
-  return res.value ?? [];
-}
-
-async function listChannelsForTeam(token: string, teamId: string): Promise<GraphChannel[]> {
-  const path = `/teams/${encodeURIComponent(teamId)}/channels?$select=id,displayName`;
-  const res = await fetchGraphJson<GraphResponse<GraphChannel>>({ token, path });
-  return res.value ?? [];
-}
-
-export async function listMSTeamsDirectoryPeersLive(params: {
-  cfg: unknown;
-  query?: string | null;
-  limit?: number | null;
-}): Promise<ChannelDirectoryEntry[]> {
-  const query = normalizeQuery(params.query);
-  if (!query) return [];
-  const token = await resolveGraphToken(params.cfg);
-  const limit = typeof params.limit === "number" && params.limit > 0 ? params.limit : 20;
-
-  let users: GraphUser[] = [];
-  if (query.includes("@")) {
-    const escaped = escapeOData(query);
-    const filter = `(mail eq '${escaped}' or userPrincipalName eq '${escaped}')`;
-    const path = `/users?$filter=${encodeURIComponent(filter)}&$select=id,displayName,mail,userPrincipalName`;
-    const res = await fetchGraphJson<GraphResponse<GraphUser>>({ token, path });
-    users = res.value ?? [];
-  } else {
-    const path = `/users?$search=${encodeURIComponent(`"displayName:${query}"`)}&$select=id,displayName,mail,userPrincipalName&$top=${limit}`;
-    const res = await fetchGraphJson<GraphResponse<GraphUser>>({
-      token,
-      path,
-      headers: { ConsistencyLevel: "eventual" },
-    });
-    users = res.value ?? [];
-  }
-
-  return users
-    .map((user) => {
-      const id = user.id?.trim();
-      if (!id) return null;
-      const name = user.displayName?.trim();
-      const handle = user.userPrincipalName?.trim() || user.mail?.trim();
-      return {
-        kind: "user",
-        id: `user:${id}`,
-        name: name || undefined,
-        handle: handle ? `@${handle}` : undefined,
-        raw: user,
-      } satisfies ChannelDirectoryEntry;
-    })
-    .filter(Boolean) as ChannelDirectoryEntry[];
-}
-
-export async function listMSTeamsDirectoryGroupsLive(params: {
-  cfg: unknown;
-  query?: string | null;
-  limit?: number | null;
-}): Promise<ChannelDirectoryEntry[]> {
-  const rawQuery = normalizeQuery(params.query);
-  if (!rawQuery) return [];
-  const token = await resolveGraphToken(params.cfg);
-  const limit = typeof params.limit === "number" && params.limit > 0 ? params.limit : 20;
-  const [teamQuery, channelQuery] = rawQuery.includes("/")
-    ? rawQuery.split("/", 2).map((part) => part.trim()).filter(Boolean)
-    : [rawQuery, null];
-
-  const teams = await listTeamsByName(token, teamQuery);
-  const results: ChannelDirectoryEntry[] = [];
-
-  for (const team of teams) {
-    const teamId = team.id?.trim();
-    if (!teamId) continue;
-    const teamName = team.displayName?.trim() || teamQuery;
-    if (!channelQuery) {
-      results.push({
-        kind: "group",
-        id: `team:${teamId}`,
-        name: teamName,
-        handle: teamName ? `#${teamName}` : undefined,
-        raw: team,
-      });
-      if (results.length >= limit) return results;
-      continue;
-    }
-    const channels = await listChannelsForTeam(token, teamId);
-    for (const channel of channels) {
-      const name = channel.displayName?.trim();
-      if (!name) continue;
-      if (!name.toLowerCase().includes(channelQuery.toLowerCase())) continue;
-      results.push({
-        kind: "group",
-        id: `conversation:${channel.id}`,
-        name: `${teamName}/${name}`,
-        handle: `#${name}`,
-        raw: channel,
-      });
-      if (results.length >= limit) return results;
-    }
-  }
-
-  return results;
-}

extensions/msteams/src/monitor-handler/message-handler.ts

@@ -176,11 +176,7 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
       }
     }
 
-    const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-    const groupPolicy =
-      !isDirectMessage && msteamsCfg
-        ? (msteamsCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist")
-        : "disabled";
+    const groupPolicy = !isDirectMessage && msteamsCfg ? (msteamsCfg.groupPolicy ?? "allowlist") : "disabled";
     const groupAllowFrom =
       !isDirectMessage && msteamsCfg
         ? (msteamsCfg.groupAllowFrom ??
@@ -190,16 +186,6 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
       !isDirectMessage && msteamsCfg
         ? [...groupAllowFrom.map((v) => String(v)), ...storedAllowFrom]
         : [];
-    const teamId = activity.channelData?.team?.id;
-    const teamName = activity.channelData?.team?.name;
-    const channelName = activity.channelData?.channel?.name;
-    const channelGate = resolveMSTeamsRouteConfig({
-      cfg: msteamsCfg,
-      teamId,
-      teamName,
-      conversationId,
-      channelName,
-    });
 
     if (!isDirectMessage && msteamsCfg) {
       if (groupPolicy === "disabled") {
@@ -210,33 +196,25 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
       }
 
       if (groupPolicy === "allowlist") {
-        if (channelGate.allowlistConfigured && !channelGate.allowed) {
-          log.debug("dropping group message (not in team/channel allowlist)", {
+        if (effectiveGroupAllowFrom.length === 0) {
+          log.debug("dropping group message (groupPolicy: allowlist, no groupAllowFrom)", {
             conversationId,
           });
           return;
         }
-        if (effectiveGroupAllowFrom.length === 0 && !channelGate.allowlistConfigured) {
-          log.debug("dropping group message (groupPolicy: allowlist, no allowlist)", {
-            conversationId,
+        const allowed = isMSTeamsGroupAllowed({
+          groupPolicy,
+          allowFrom: effectiveGroupAllowFrom,
+          senderId,
+          senderName,
+        });
+        if (!allowed) {
+          log.debug("dropping group message (not in groupAllowFrom)", {
+            sender: senderId,
+            label: senderName,
           });
           return;
         }
-        if (effectiveGroupAllowFrom.length > 0) {
-          const allowed = isMSTeamsGroupAllowed({
-            groupPolicy,
-            allowFrom: effectiveGroupAllowFrom,
-            senderId,
-            senderName,
-          });
-          if (!allowed) {
-            log.debug("dropping group message (not in groupAllowFrom)", {
-              sender: senderId,
-              label: senderName,
-            });
-            return;
-          }
-        }
       }
     }
 
@@ -266,6 +244,7 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
 
     // Build conversation reference for proactive replies.
     const agent = activity.recipient;
+    const teamId = activity.channelData?.team?.id;
     const conversationRef: StoredConversationReference = {
       activityId: activity.id,
       user: { id: from.id, name: from.name, aadObjectId: from.aadObjectId },
@@ -347,7 +326,11 @@ export function createMSTeamsMessageHandler(deps: MSTeamsMessageHandlerDeps) {
     });
 
     const channelId = conversationId;
-    const { teamConfig, channelConfig } = channelGate;
+    const { teamConfig, channelConfig } = resolveMSTeamsRouteConfig({
+      cfg: msteamsCfg,
+      teamId,
+      conversationId: channelId,
+    });
     const { requireMention, replyStyle } = resolveMSTeamsReplyPolicy({
       isDirectMessage,
       globalConfig: msteamsCfg,

extensions/msteams/src/monitor.ts

@@ -1,6 +1,5 @@
 import type { Request, Response } from "express";
 import { resolveTextChunkLimit } from "../../../src/auto-reply/chunk.js";
-import { mergeAllowlist, summarizeMapping } from "../../../src/channels/allowlists/resolve-utils.js";
 import type { ClawdbotConfig } from "../../../src/config/types.js";
 import { getChildLogger } from "../../../src/logging.js";
 import type { RuntimeEnv } from "../../../src/runtime.js";
@@ -10,10 +9,6 @@ import { formatUnknownError } from "./errors.js";
 import type { MSTeamsAdapter } from "./messenger.js";
 import { registerMSTeamsHandlers } from "./monitor-handler.js";
 import { createMSTeamsPollStoreFs, type MSTeamsPollStore } from "./polls.js";
-import {
-  resolveMSTeamsChannelAllowlist,
-  resolveMSTeamsUserAllowlist,
-} from "./resolve-allowlist.js";
 import { createMSTeamsAdapter, loadMSTeamsSdkWithAuth } from "./sdk.js";
 import { resolveMSTeamsCredentials } from "./token.js";
 
@@ -35,8 +30,8 @@ export type MonitorMSTeamsResult = {
 export async function monitorMSTeamsProvider(
   opts: MonitorMSTeamsOpts,
 ): Promise<MonitorMSTeamsResult> {
-  let cfg = opts.cfg;
-  let msteamsCfg = cfg.channels?.msteams;
+  const cfg = opts.cfg;
+  const msteamsCfg = cfg.channels?.msteams;
   if (!msteamsCfg?.enabled) {
     log.debug("msteams provider disabled");
     return { app: null, shutdown: async () => {} };
@@ -57,142 +52,6 @@ export async function monitorMSTeamsProvider(
     },
   };
 
-  let allowFrom = msteamsCfg.allowFrom;
-  let groupAllowFrom = msteamsCfg.groupAllowFrom;
-  let teamsConfig = msteamsCfg.teams;
-
-  const cleanAllowEntry = (entry: string) =>
-    entry
-      .replace(/^(msteams|teams):/i, "")
-      .replace(/^user:/i, "")
-      .trim();
-
-  const resolveAllowlistUsers = async (label: string, entries: string[]) => {
-    if (entries.length === 0) return { additions: [], unresolved: [] };
-    const resolved = await resolveMSTeamsUserAllowlist({ cfg, entries });
-    const additions: string[] = [];
-    const unresolved: string[] = [];
-    for (const entry of resolved) {
-      if (entry.resolved && entry.id) {
-        additions.push(entry.id);
-      } else {
-        unresolved.push(entry.input);
-      }
-    }
-    const mapping = resolved
-      .filter((entry) => entry.resolved && entry.id)
-      .map((entry) => `${entry.input}→${entry.id}`);
-    summarizeMapping(label, mapping, unresolved, runtime);
-    return { additions, unresolved };
-  };
-
-  try {
-    const allowEntries =
-      allowFrom?.map((entry) => cleanAllowEntry(String(entry))).filter(
-        (entry) => entry && entry !== "*",
-      ) ?? [];
-    if (allowEntries.length > 0) {
-      const { additions } = await resolveAllowlistUsers("msteams users", allowEntries);
-      allowFrom = mergeAllowlist({ existing: allowFrom, additions });
-    }
-
-    if (Array.isArray(groupAllowFrom) && groupAllowFrom.length > 0) {
-      const groupEntries = groupAllowFrom
-        .map((entry) => cleanAllowEntry(String(entry)))
-        .filter((entry) => entry && entry !== "*");
-      if (groupEntries.length > 0) {
-        const { additions } = await resolveAllowlistUsers("msteams group users", groupEntries);
-        groupAllowFrom = mergeAllowlist({ existing: groupAllowFrom, additions });
-      }
-    }
-
-    if (teamsConfig && Object.keys(teamsConfig).length > 0) {
-      const entries: Array<{ input: string; teamKey: string; channelKey?: string }> = [];
-      for (const [teamKey, teamCfg] of Object.entries(teamsConfig)) {
-        if (teamKey === "*") continue;
-        const channels = teamCfg?.channels ?? {};
-        const channelKeys = Object.keys(channels).filter((key) => key !== "*");
-        if (channelKeys.length === 0) {
-          entries.push({ input: teamKey, teamKey });
-          continue;
-        }
-        for (const channelKey of channelKeys) {
-          entries.push({
-            input: `${teamKey}/${channelKey}`,
-            teamKey,
-            channelKey,
-          });
-        }
-      }
-
-      if (entries.length > 0) {
-        const resolved = await resolveMSTeamsChannelAllowlist({
-          cfg,
-          entries: entries.map((entry) => entry.input),
-        });
-        const mapping: string[] = [];
-        const unresolved: string[] = [];
-        const nextTeams = { ...(teamsConfig ?? {}) };
-
-        resolved.forEach((entry, idx) => {
-          const source = entries[idx];
-          if (!source) return;
-          const sourceTeam = teamsConfig?.[source.teamKey] ?? {};
-          if (!entry.resolved || !entry.teamId) {
-            unresolved.push(entry.input);
-            return;
-          }
-          mapping.push(
-            entry.channelId
-              ? `${entry.input}→${entry.teamId}/${entry.channelId}`
-              : `${entry.input}→${entry.teamId}`,
-          );
-          const existing = nextTeams[entry.teamId] ?? {};
-          const mergedChannels = {
-            ...(sourceTeam.channels ?? {}),
-            ...(existing.channels ?? {}),
-          };
-          const mergedTeam = { ...sourceTeam, ...existing, channels: mergedChannels };
-          nextTeams[entry.teamId] = mergedTeam;
-          if (source.channelKey && entry.channelId) {
-            const sourceChannel = sourceTeam.channels?.[source.channelKey];
-            if (sourceChannel) {
-              nextTeams[entry.teamId] = {
-                ...mergedTeam,
-                channels: {
-                  ...mergedChannels,
-                  [entry.channelId]: {
-                    ...sourceChannel,
-                    ...(mergedChannels?.[entry.channelId] ?? {}),
-                  },
-                },
-              };
-            }
-          }
-        });
-
-        teamsConfig = nextTeams;
-        summarizeMapping("msteams channels", mapping, unresolved, runtime);
-      }
-    }
-  } catch (err) {
-    runtime.log?.(`msteams resolve failed; using config entries. ${String(err)}`);
-  }
-
-  msteamsCfg = {
-    ...msteamsCfg,
-    allowFrom,
-    groupAllowFrom,
-    teams: teamsConfig,
-  };
-  cfg = {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      msteams: msteamsCfg,
-    },
-  };
-
   const port = msteamsCfg.webhook?.port ?? 3978;
   const textLimit = resolveTextChunkLimit(cfg, "msteams");
   const MB = 1024 * 1024;

extensions/msteams/src/onboarding.ts

@@ -7,14 +7,9 @@ import type {
   ChannelOnboardingAdapter,
   ChannelOnboardingDmPolicy,
 } from "../../../src/channels/plugins/onboarding-types.js";
-import { promptChannelAccessConfig } from "../../../src/channels/plugins/onboarding/channel-access.js";
 import { addWildcardAllowFrom } from "../../../src/channels/plugins/onboarding/helpers.js";
 
 import { resolveMSTeamsCredentials } from "./token.js";
-import {
-  parseMSTeamsTeamEntry,
-  resolveMSTeamsChannelAllowlist,
-} from "./resolve-allowlist.js";
 
 const channel = "msteams" as const;
 
@@ -49,54 +44,6 @@ async function noteMSTeamsCredentialHelp(prompter: WizardPrompter): Promise<void
   );
 }
 
-function setMSTeamsGroupPolicy(
-  cfg: ClawdbotConfig,
-  groupPolicy: "open" | "allowlist" | "disabled",
-): ClawdbotConfig {
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      msteams: {
-        ...cfg.channels?.msteams,
-        enabled: true,
-        groupPolicy,
-      },
-    },
-  };
-}
-
-function setMSTeamsTeamsAllowlist(
-  cfg: ClawdbotConfig,
-  entries: Array<{ teamKey: string; channelKey?: string }>,
-): ClawdbotConfig {
-  const baseTeams = cfg.channels?.msteams?.teams ?? {};
-  const teams: Record<string, { channels?: Record<string, unknown> }> = { ...baseTeams };
-  for (const entry of entries) {
-    const teamKey = entry.teamKey;
-    if (!teamKey) continue;
-    const existing = teams[teamKey] ?? {};
-    if (entry.channelKey) {
-      const channels = { ...(existing.channels ?? {}) };
-      channels[entry.channelKey] = channels[entry.channelKey] ?? {};
-      teams[teamKey] = { ...existing, channels };
-    } else {
-      teams[teamKey] = existing;
-    }
-  }
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      msteams: {
-        ...cfg.channels?.msteams,
-        enabled: true,
-        teams,
-      },
-    },
-  };
-}
-
 const dmPolicy: ChannelOnboardingDmPolicy = {
   label: "MS Teams",
   channel,
@@ -237,93 +184,6 @@ export const msteamsOnboardingAdapter: ChannelOnboardingAdapter = {
       };
     }
 
-    const currentEntries = Object.entries(next.channels?.msteams?.teams ?? {}).flatMap(
-      ([teamKey, value]) => {
-        const channels = value?.channels ?? {};
-        const channelKeys = Object.keys(channels);
-        if (channelKeys.length === 0) return [teamKey];
-        return channelKeys.map((channelKey) => `${teamKey}/${channelKey}`);
-      },
-    );
-    const accessConfig = await promptChannelAccessConfig({
-      prompter,
-      label: "MS Teams channels",
-      currentPolicy: next.channels?.msteams?.groupPolicy ?? "allowlist",
-      currentEntries,
-      placeholder: "Team Name/Channel Name, teamId/conversationId",
-      updatePrompt: Boolean(next.channels?.msteams?.teams),
-    });
-    if (accessConfig) {
-      if (accessConfig.policy !== "allowlist") {
-        next = setMSTeamsGroupPolicy(next, accessConfig.policy);
-      } else {
-        let entries = accessConfig.entries
-          .map((entry) => parseMSTeamsTeamEntry(entry))
-          .filter(Boolean) as Array<{ teamKey: string; channelKey?: string }>;
-        if (accessConfig.entries.length > 0 && resolveMSTeamsCredentials(next.channels?.msteams)) {
-          try {
-            const resolved = await resolveMSTeamsChannelAllowlist({
-              cfg: next,
-              entries: accessConfig.entries,
-            });
-            const resolvedChannels = resolved.filter(
-              (entry) => entry.resolved && entry.teamId && entry.channelId,
-            );
-            const resolvedTeams = resolved.filter(
-              (entry) => entry.resolved && entry.teamId && !entry.channelId,
-            );
-            const unresolved = resolved
-              .filter((entry) => !entry.resolved)
-              .map((entry) => entry.input);
-
-            entries = [
-              ...resolvedChannels.map((entry) => ({
-                teamKey: entry.teamId as string,
-                channelKey: entry.channelId as string,
-              })),
-              ...resolvedTeams.map((entry) => ({
-                teamKey: entry.teamId as string,
-              })),
-              ...unresolved
-                .map((entry) => parseMSTeamsTeamEntry(entry))
-                .filter(Boolean),
-            ] as Array<{ teamKey: string; channelKey?: string }>;
-
-            if (resolvedChannels.length > 0 || resolvedTeams.length > 0 || unresolved.length > 0) {
-              const summary: string[] = [];
-              if (resolvedChannels.length > 0) {
-                summary.push(
-                  `Resolved channels: ${resolvedChannels
-                    .map((entry) => entry.channelId)
-                    .filter(Boolean)
-                    .join(", ")}`,
-                );
-              }
-              if (resolvedTeams.length > 0) {
-                summary.push(
-                  `Resolved teams: ${resolvedTeams
-                    .map((entry) => entry.teamId)
-                    .filter(Boolean)
-                    .join(", ")}`,
-                );
-              }
-              if (unresolved.length > 0) {
-                summary.push(`Unresolved (kept as typed): ${unresolved.join(", ")}`);
-              }
-              await prompter.note(summary.join("\n"), "MS Teams channels");
-            }
-          } catch (err) {
-            await prompter.note(
-              `Channel lookup failed; keeping entries as typed. ${String(err)}`,
-              "MS Teams channels",
-            );
-          }
-        }
-        next = setMSTeamsGroupPolicy(next, "allowlist");
-        next = setMSTeamsTeamsAllowlist(next, entries);
-      }
-    }
-
     return { cfg: next, accountId: DEFAULT_ACCOUNT_ID };
   },
   dmPolicy,

extensions/msteams/src/policy.test.ts

@@ -29,8 +29,6 @@ describe("msteams policy", () => {
 
       expect(res.teamConfig?.requireMention).toBe(false);
       expect(res.channelConfig?.requireMention).toBe(true);
-      expect(res.allowlistConfigured).toBe(true);
-      expect(res.allowed).toBe(true);
     });
 
     it("returns undefined configs when teamId is missing", () => {
@@ -45,32 +43,6 @@ describe("msteams policy", () => {
       });
       expect(res.teamConfig).toBeUndefined();
       expect(res.channelConfig).toBeUndefined();
-      expect(res.allowlistConfigured).toBe(true);
-      expect(res.allowed).toBe(false);
-    });
-
-    it("matches team and channel by name", () => {
-      const cfg: MSTeamsConfig = {
-        teams: {
-          "My Team": {
-            requireMention: true,
-            channels: {
-              "General Chat": { requireMention: false },
-            },
-          },
-        },
-      };
-
-      const res = resolveMSTeamsRouteConfig({
-        cfg,
-        teamName: "My Team",
-        channelName: "General Chat",
-        conversationId: "ignored",
-      });
-
-      expect(res.teamConfig?.requireMention).toBe(true);
-      expect(res.channelConfig?.requireMention).toBe(false);
-      expect(res.allowed).toBe(true);
     });
   });
 
@@ -117,18 +89,6 @@ describe("msteams policy", () => {
       });
     });
 
-    it("inherits team mention settings when channel config is missing", () => {
-      const policy = resolveMSTeamsReplyPolicy({
-        isDirectMessage: false,
-        globalConfig: { requireMention: true },
-        teamConfig: { requireMention: false },
-      });
-      expect(policy).toEqual({
-        requireMention: false,
-        replyStyle: "top-level",
-      });
-    });
-
     it("uses explicit replyStyle even when requireMention defaults would differ", () => {
       const policy = resolveMSTeamsReplyPolicy({
         isDirectMessage: false,

extensions/msteams/src/policy.ts

@@ -9,73 +9,19 @@ import type {
 export type MSTeamsResolvedRouteConfig = {
   teamConfig?: MSTeamsTeamConfig;
   channelConfig?: MSTeamsChannelConfig;
-  allowlistConfigured: boolean;
-  allowed: boolean;
-  teamKey?: string;
-  channelKey?: string;
 };
 
 export function resolveMSTeamsRouteConfig(params: {
   cfg?: MSTeamsConfig;
   teamId?: string | null | undefined;
-  teamName?: string | null | undefined;
   conversationId?: string | null | undefined;
-  channelName?: string | null | undefined;
 }): MSTeamsResolvedRouteConfig {
   const teamId = params.teamId?.trim();
-  const teamName = params.teamName?.trim();
   const conversationId = params.conversationId?.trim();
-  const channelName = params.channelName?.trim();
-  const teams = params.cfg?.teams ?? {};
-  const teamKeys = Object.keys(teams);
-  const allowlistConfigured = teamKeys.length > 0;
-
-  const normalize = (value: string) =>
-    value
-      .trim()
-      .toLowerCase()
-      .replace(/^#/, "")
-      .replace(/[^a-z0-9]+/g, "-")
-      .replace(/^-+|-+$/g, "");
-
-  let teamKey: string | undefined;
-  if (teamId && teams[teamId]) teamKey = teamId;
-  if (!teamKey && teamName) {
-    const slug = normalize(teamName);
-    if (slug) {
-      teamKey = teamKeys.find((key) => normalize(key) === slug);
-    }
-  }
-  if (!teamKey && teams["*"]) teamKey = "*";
-
-  const teamConfig = teamKey ? teams[teamKey] : undefined;
-  const channels = teamConfig?.channels ?? {};
-  const channelKeys = Object.keys(channels);
-
-  let channelKey: string | undefined;
-  if (conversationId && channels[conversationId]) channelKey = conversationId;
-  if (!channelKey && channelName) {
-    const slug = normalize(channelName);
-    if (slug) {
-      channelKey = channelKeys.find((key) => normalize(key) === slug);
-    }
-  }
-  if (!channelKey && channels["*"]) channelKey = "*";
-  const channelConfig = channelKey ? channels[channelKey] : undefined;
-  const channelAllowlistConfigured = channelKeys.length > 0;
-
-  const allowed = !allowlistConfigured
-    ? true
-    : Boolean(teamConfig) && (!channelAllowlistConfigured || Boolean(channelConfig));
-
-  return {
-    teamConfig,
-    channelConfig,
-    allowlistConfigured,
-    allowed,
-    teamKey,
-    channelKey,
-  };
+  const teamConfig = teamId ? params.cfg?.teams?.[teamId] : undefined;
+  const channelConfig =
+    teamConfig && conversationId ? teamConfig.channels?.[conversationId] : undefined;
+  return { teamConfig, channelConfig };
 }
 
 export type MSTeamsReplyPolicy = {

extensions/msteams/src/resolve-allowlist.ts

@@ -1,277 +0,0 @@
-import { GRAPH_ROOT } from "./attachments/shared.js";
-import { loadMSTeamsSdkWithAuth } from "./sdk.js";
-import { resolveMSTeamsCredentials } from "./token.js";
-
-type GraphUser = {
-  id?: string;
-  displayName?: string;
-  userPrincipalName?: string;
-  mail?: string;
-};
-
-type GraphGroup = {
-  id?: string;
-  displayName?: string;
-};
-
-type GraphChannel = {
-  id?: string;
-  displayName?: string;
-};
-
-type GraphResponse<T> = { value?: T[] };
-
-export type MSTeamsChannelResolution = {
-  input: string;
-  resolved: boolean;
-  teamId?: string;
-  teamName?: string;
-  channelId?: string;
-  channelName?: string;
-  note?: string;
-};
-
-export type MSTeamsUserResolution = {
-  input: string;
-  resolved: boolean;
-  id?: string;
-  name?: string;
-  note?: string;
-};
-
-function readAccessToken(value: unknown): string | null {
-  if (typeof value === "string") return value;
-  if (value && typeof value === "object") {
-    const token =
-      (value as { accessToken?: unknown }).accessToken ?? (value as { token?: unknown }).token;
-    return typeof token === "string" ? token : null;
-  }
-  return null;
-}
-
-function stripProviderPrefix(raw: string): string {
-  return raw.replace(/^(msteams|teams):/i, "");
-}
-
-export function normalizeMSTeamsMessagingTarget(raw: string): string | undefined {
-  let trimmed = raw.trim();
-  if (!trimmed) return undefined;
-  trimmed = stripProviderPrefix(trimmed).trim();
-  if (/^conversation:/i.test(trimmed)) {
-    const id = trimmed.slice("conversation:".length).trim();
-    return id ? `conversation:${id}` : undefined;
-  }
-  if (/^user:/i.test(trimmed)) {
-    const id = trimmed.slice("user:".length).trim();
-    return id ? `user:${id}` : undefined;
-  }
-  return trimmed || undefined;
-}
-
-export function normalizeMSTeamsUserInput(raw: string): string {
-  return stripProviderPrefix(raw).replace(/^(user|conversation):/i, "").trim();
-}
-
-export function parseMSTeamsConversationId(raw: string): string | null {
-  const trimmed = stripProviderPrefix(raw).trim();
-  if (!/^conversation:/i.test(trimmed)) return null;
-  const id = trimmed.slice("conversation:".length).trim();
-  return id;
-}
-
-function normalizeMSTeamsTeamKey(raw: string): string | undefined {
-  const trimmed = stripProviderPrefix(raw).replace(/^team:/i, "").trim();
-  return trimmed || undefined;
-}
-
-function normalizeMSTeamsChannelKey(raw?: string | null): string | undefined {
-  const trimmed = raw?.trim().replace(/^#/, "").trim() ?? "";
-  return trimmed || undefined;
-}
-
-export function parseMSTeamsTeamChannelInput(raw: string): { team?: string; channel?: string } {
-  const trimmed = stripProviderPrefix(raw).trim();
-  if (!trimmed) return {};
-  const parts = trimmed.split("/");
-  const team = normalizeMSTeamsTeamKey(parts[0] ?? "");
-  const channel = parts.length > 1 ? normalizeMSTeamsChannelKey(parts.slice(1).join("/")) : undefined;
-  return {
-    ...(team ? { team } : {}),
-    ...(channel ? { channel } : {}),
-  };
-}
-
-export function parseMSTeamsTeamEntry(
-  raw: string,
-): { teamKey: string; channelKey?: string } | null {
-  const { team, channel } = parseMSTeamsTeamChannelInput(raw);
-  if (!team) return null;
-  return {
-    teamKey: team,
-    ...(channel ? { channelKey: channel } : {}),
-  };
-}
-
-function normalizeQuery(value?: string | null): string {
-  return value?.trim() ?? "";
-}
-
-function escapeOData(value: string): string {
-  return value.replace(/'/g, "''");
-}
-
-async function fetchGraphJson<T>(params: {
-  token: string;
-  path: string;
-  headers?: Record<string, string>;
-}): Promise<T> {
-  const res = await fetch(`${GRAPH_ROOT}${params.path}`, {
-    headers: {
-      Authorization: `Bearer ${params.token}`,
-      ...(params.headers ?? {}),
-    },
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Graph ${params.path} failed (${res.status}): ${text || "unknown error"}`);
-  }
-  return (await res.json()) as T;
-}
-
-async function resolveGraphToken(cfg: unknown): Promise<string> {
-  const creds = resolveMSTeamsCredentials((cfg as { channels?: { msteams?: unknown } })?.channels?.msteams);
-  if (!creds) throw new Error("MS Teams credentials missing");
-  const { sdk, authConfig } = await loadMSTeamsSdkWithAuth(creds);
-  const tokenProvider = new sdk.MsalTokenProvider(authConfig);
-  const token = await tokenProvider.getAccessToken("https://graph.microsoft.com/.default");
-  const accessToken = readAccessToken(token);
-  if (!accessToken) throw new Error("MS Teams graph token unavailable");
-  return accessToken;
-}
-
-async function listTeamsByName(token: string, query: string): Promise<GraphGroup[]> {
-  const escaped = escapeOData(query);
-  const filter = `resourceProvisioningOptions/Any(x:x eq 'Team') and startsWith(displayName,'${escaped}')`;
-  const path = `/groups?$filter=${encodeURIComponent(filter)}&$select=id,displayName`;
-  const res = await fetchGraphJson<GraphResponse<GraphGroup>>({ token, path });
-  return res.value ?? [];
-}
-
-async function listChannelsForTeam(token: string, teamId: string): Promise<GraphChannel[]> {
-  const path = `/teams/${encodeURIComponent(teamId)}/channels?$select=id,displayName`;
-  const res = await fetchGraphJson<GraphResponse<GraphChannel>>({ token, path });
-  return res.value ?? [];
-}
-
-export async function resolveMSTeamsChannelAllowlist(params: {
-  cfg: unknown;
-  entries: string[];
-}): Promise<MSTeamsChannelResolution[]> {
-  const token = await resolveGraphToken(params.cfg);
-  const results: MSTeamsChannelResolution[] = [];
-
-  for (const input of params.entries) {
-    const { team, channel } = parseMSTeamsTeamChannelInput(input);
-    if (!team) {
-      results.push({ input, resolved: false });
-      continue;
-    }
-    const teams =
-      /^[0-9a-fA-F-]{16,}$/.test(team) ? [{ id: team, displayName: team }] : await listTeamsByName(token, team);
-    if (teams.length === 0) {
-      results.push({ input, resolved: false, note: "team not found" });
-      continue;
-    }
-    const teamMatch = teams[0];
-    const teamId = teamMatch.id?.trim();
-    const teamName = teamMatch.displayName?.trim() || team;
-    if (!teamId) {
-      results.push({ input, resolved: false, note: "team id missing" });
-      continue;
-    }
-    if (!channel) {
-      results.push({
-        input,
-        resolved: true,
-        teamId,
-        teamName,
-        note: teams.length > 1 ? "multiple teams; chose first" : undefined,
-      });
-      continue;
-    }
-    const channels = await listChannelsForTeam(token, teamId);
-    const channelMatch =
-      channels.find((item) => item.id === channel) ??
-      channels.find(
-        (item) => item.displayName?.toLowerCase() === channel.toLowerCase(),
-      ) ??
-      channels.find(
-        (item) => item.displayName?.toLowerCase().includes(channel.toLowerCase() ?? ""),
-      );
-    if (!channelMatch?.id) {
-      results.push({ input, resolved: false, note: "channel not found" });
-      continue;
-    }
-    results.push({
-      input,
-      resolved: true,
-      teamId,
-      teamName,
-      channelId: channelMatch.id,
-      channelName: channelMatch.displayName ?? channel,
-      note: channels.length > 1 ? "multiple channels; chose first" : undefined,
-    });
-  }
-
-  return results;
-}
-
-export async function resolveMSTeamsUserAllowlist(params: {
-  cfg: unknown;
-  entries: string[];
-}): Promise<MSTeamsUserResolution[]> {
-  const token = await resolveGraphToken(params.cfg);
-  const results: MSTeamsUserResolution[] = [];
-
-  for (const input of params.entries) {
-    const query = normalizeQuery(normalizeMSTeamsUserInput(input));
-    if (!query) {
-      results.push({ input, resolved: false });
-      continue;
-    }
-    if (/^[0-9a-fA-F-]{16,}$/.test(query)) {
-      results.push({ input, resolved: true, id: query });
-      continue;
-    }
-    let users: GraphUser[] = [];
-    if (query.includes("@")) {
-      const escaped = escapeOData(query);
-      const filter = `(mail eq '${escaped}' or userPrincipalName eq '${escaped}')`;
-      const path = `/users?$filter=${encodeURIComponent(filter)}&$select=id,displayName,mail,userPrincipalName`;
-      const res = await fetchGraphJson<GraphResponse<GraphUser>>({ token, path });
-      users = res.value ?? [];
-    } else {
-      const path = `/users?$search=${encodeURIComponent(`"displayName:${query}"`)}&$select=id,displayName,mail,userPrincipalName&$top=10`;
-      const res = await fetchGraphJson<GraphResponse<GraphUser>>({
-        token,
-        path,
-        headers: { ConsistencyLevel: "eventual" },
-      });
-      users = res.value ?? [];
-    }
-    const match = users[0];
-    if (!match?.id) {
-      results.push({ input, resolved: false });
-      continue;
-    }
-    results.push({
-      input,
-      resolved: true,
-      id: match.id,
-      name: match.displayName ?? undefined,
-      note: users.length > 1 ? "multiple matches; chose first" : undefined,
-    });
-  }
-
-  return results;
-}

extensions/qwen-portal-auth/README.md

@@ -1,24 +0,0 @@
-# Qwen OAuth (Clawdbot plugin)
-
-OAuth provider plugin for **Qwen** (free-tier OAuth).
-
-## Enable
-
-Bundled plugins are disabled by default. Enable this one:
-
-```bash
-clawdbot plugins enable qwen-portal-auth
-```
-
-Restart the Gateway after enabling.
-
-## Authenticate
-
-```bash
-clawdbot models auth login --provider qwen-portal --set-default
-```
-
-## Notes
-
-- Qwen OAuth uses a device-code login flow.
-- Tokens auto-refresh; re-run login if refresh fails or access is revoked.

extensions/qwen-portal-auth/index.ts

@@ -1,124 +0,0 @@
-import { loginQwenPortalOAuth } from "./oauth.js";
-
-const PROVIDER_ID = "qwen-portal";
-const PROVIDER_LABEL = "Qwen";
-const DEFAULT_MODEL = "qwen-portal/coder-model";
-const DEFAULT_BASE_URL = "https://portal.qwen.ai/v1";
-const DEFAULT_CONTEXT_WINDOW = 128000;
-const DEFAULT_MAX_TOKENS = 8192;
-const OAUTH_PLACEHOLDER = "qwen-oauth";
-
-function normalizeBaseUrl(value: string | undefined): string {
-  const raw = value?.trim() || DEFAULT_BASE_URL;
-  const withProtocol = raw.startsWith("http") ? raw : `https://${raw}`;
-  return withProtocol.endsWith("/v1") ? withProtocol : `${withProtocol.replace(/\/+$/, "")}/v1`;
-}
-
-function buildModelDefinition(params: { id: string; name: string; input: Array<"text" | "image"> }) {
-  return {
-    id: params.id,
-    name: params.name,
-    reasoning: false,
-    input: params.input,
-    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-    contextWindow: DEFAULT_CONTEXT_WINDOW,
-    maxTokens: DEFAULT_MAX_TOKENS,
-  };
-}
-
-const qwenPortalPlugin = {
-  id: "qwen-portal-auth",
-  name: "Qwen OAuth",
-  description: "OAuth flow for Qwen (free-tier) models",
-  register(api) {
-    api.registerProvider({
-      id: PROVIDER_ID,
-      label: PROVIDER_LABEL,
-      docsPath: "/providers/qwen",
-      aliases: ["qwen"],
-      auth: [
-        {
-          id: "device",
-          label: "Qwen OAuth",
-          hint: "Device code login",
-          kind: "device_code",
-          run: async (ctx) => {
-            const progress = ctx.prompter.progress("Starting Qwen OAuth…");
-            try {
-              const result = await loginQwenPortalOAuth({
-                openUrl: ctx.openUrl,
-                note: ctx.prompter.note,
-                progress,
-              });
-
-              progress.stop("Qwen OAuth complete");
-
-              const profileId = `${PROVIDER_ID}:default`;
-              const baseUrl = normalizeBaseUrl(result.resourceUrl);
-
-              return {
-                profiles: [
-                  {
-                    profileId,
-                    credential: {
-                      type: "oauth",
-                      provider: PROVIDER_ID,
-                      access: result.access,
-                      refresh: result.refresh,
-                      expires: result.expires,
-                    },
-                  },
-                ],
-                configPatch: {
-                  models: {
-                    providers: {
-                      [PROVIDER_ID]: {
-                        baseUrl,
-                        apiKey: OAUTH_PLACEHOLDER,
-                        api: "openai-completions",
-                        models: [
-                          buildModelDefinition({
-                            id: "coder-model",
-                            name: "Qwen Coder",
-                            input: ["text"],
-                          }),
-                          buildModelDefinition({
-                            id: "vision-model",
-                            name: "Qwen Vision",
-                            input: ["text", "image"],
-                          }),
-                        ],
-                      },
-                    },
-                  },
-                  agents: {
-                    defaults: {
-                      models: {
-                        "qwen-portal/coder-model": { alias: "qwen" },
-                        "qwen-portal/vision-model": {},
-                      },
-                    },
-                  },
-                },
-                defaultModel: DEFAULT_MODEL,
-                notes: [
-                  "Qwen OAuth tokens auto-refresh. Re-run login if refresh fails or access is revoked.",
-                  `Base URL defaults to ${DEFAULT_BASE_URL}. Override models.providers.${PROVIDER_ID}.baseUrl if needed.`,
-                ],
-              };
-            } catch (err) {
-              progress.stop("Qwen OAuth failed");
-              await ctx.prompter.note(
-                "If OAuth fails, verify your Qwen account has portal access and try again.",
-                "Qwen OAuth",
-              );
-              throw err;
-            }
-          },
-        },
-      ],
-    });
-  },
-};
-
-export default qwenPortalPlugin;

extensions/qwen-portal-auth/oauth.ts

@@ -1,190 +0,0 @@
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-
-const QWEN_OAUTH_BASE_URL = "https://chat.qwen.ai";
-const QWEN_OAUTH_DEVICE_CODE_ENDPOINT = `${QWEN_OAUTH_BASE_URL}/api/v1/oauth2/device/code`;
-const QWEN_OAUTH_TOKEN_ENDPOINT = `${QWEN_OAUTH_BASE_URL}/api/v1/oauth2/token`;
-const QWEN_OAUTH_CLIENT_ID = "f0304373b74a44d2b584a3fb70ca9e56";
-const QWEN_OAUTH_SCOPE = "openid profile email model.completion";
-const QWEN_OAUTH_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-
-export type QwenDeviceAuthorization = {
-  device_code: string;
-  user_code: string;
-  verification_uri: string;
-  verification_uri_complete?: string;
-  expires_in: number;
-  interval?: number;
-};
-
-export type QwenOAuthToken = {
-  access: string;
-  refresh: string;
-  expires: number;
-  resourceUrl?: string;
-};
-
-type TokenPending = { status: "pending"; slowDown?: boolean };
-
-type DeviceTokenResult =
-  | { status: "success"; token: QwenOAuthToken }
-  | TokenPending
-  | { status: "error"; message: string };
-
-function toFormUrlEncoded(data: Record<string, string>): string {
-  return Object.entries(data)
-    .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
-    .join("&");
-}
-
-function generatePkce(): { verifier: string; challenge: string } {
-  const verifier = randomBytes(32).toString("base64url");
-  const challenge = createHash("sha256").update(verifier).digest("base64url");
-  return { verifier, challenge };
-}
-
-async function requestDeviceCode(params: { challenge: string }): Promise<QwenDeviceAuthorization> {
-  const response = await fetch(QWEN_OAUTH_DEVICE_CODE_ENDPOINT, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-      "x-request-id": randomUUID(),
-    },
-    body: toFormUrlEncoded({
-      client_id: QWEN_OAUTH_CLIENT_ID,
-      scope: QWEN_OAUTH_SCOPE,
-      code_challenge: params.challenge,
-      code_challenge_method: "S256",
-    }),
-  });
-
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Qwen device authorization failed: ${text || response.statusText}`);
-  }
-
-  const payload = (await response.json()) as QwenDeviceAuthorization & { error?: string };
-  if (!payload.device_code || !payload.user_code || !payload.verification_uri) {
-    throw new Error(
-      payload.error ??
-        "Qwen device authorization returned an incomplete payload (missing user_code or verification_uri).",
-    );
-  }
-  return payload;
-}
-
-async function pollDeviceToken(params: {
-  deviceCode: string;
-  verifier: string;
-}): Promise<DeviceTokenResult> {
-  const response = await fetch(QWEN_OAUTH_TOKEN_ENDPOINT, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-    },
-    body: toFormUrlEncoded({
-      grant_type: QWEN_OAUTH_GRANT_TYPE,
-      client_id: QWEN_OAUTH_CLIENT_ID,
-      device_code: params.deviceCode,
-      code_verifier: params.verifier,
-    }),
-  });
-
-  if (!response.ok) {
-    let payload: { error?: string; error_description?: string } | undefined;
-    try {
-      payload = (await response.json()) as { error?: string; error_description?: string };
-    } catch {
-      const text = await response.text();
-      return { status: "error", message: text || response.statusText };
-    }
-
-    if (payload?.error === "authorization_pending") {
-      return { status: "pending" };
-    }
-
-    if (payload?.error === "slow_down") {
-      return { status: "pending", slowDown: true };
-    }
-
-    return {
-      status: "error",
-      message: payload?.error_description || payload?.error || response.statusText,
-    };
-  }
-
-  const tokenPayload = (await response.json()) as {
-    access_token?: string | null;
-    refresh_token?: string | null;
-    expires_in?: number | null;
-    token_type?: string;
-    resource_url?: string;
-  };
-
-  if (!tokenPayload.access_token || !tokenPayload.refresh_token || !tokenPayload.expires_in) {
-    return { status: "error", message: "Qwen OAuth returned incomplete token payload." };
-  }
-
-  return {
-    status: "success",
-    token: {
-      access: tokenPayload.access_token,
-      refresh: tokenPayload.refresh_token,
-      expires: Date.now() + tokenPayload.expires_in * 1000,
-      resourceUrl: tokenPayload.resource_url,
-    },
-  };
-}
-
-export async function loginQwenPortalOAuth(params: {
-  openUrl: (url: string) => Promise<void>;
-  note: (message: string, title?: string) => Promise<void>;
-  progress: { update: (message: string) => void; stop: (message?: string) => void };
-}): Promise<QwenOAuthToken> {
-  const { verifier, challenge } = generatePkce();
-  const device = await requestDeviceCode({ challenge });
-  const verificationUrl = device.verification_uri_complete || device.verification_uri;
-
-  await params.note(
-    [
-      `Open ${verificationUrl} to approve access.`,
-      `If prompted, enter the code ${device.user_code}.`,
-    ].join("\n"),
-    "Qwen OAuth",
-  );
-
-  try {
-    await params.openUrl(verificationUrl);
-  } catch {
-    // Fall back to manual copy/paste if browser open fails.
-  }
-
-  const start = Date.now();
-  let pollIntervalMs = device.interval ? device.interval * 1000 : 2000;
-  const timeoutMs = device.expires_in * 1000;
-
-  while (Date.now() - start < timeoutMs) {
-    params.progress.update("Waiting for Qwen OAuth approval…");
-    const result = await pollDeviceToken({
-      deviceCode: device.device_code,
-      verifier,
-    });
-
-    if (result.status === "success") {
-      return result.token;
-    }
-
-    if (result.status === "error") {
-      throw new Error(`Qwen OAuth failed: ${result.message}`);
-    }
-
-    if (result.status === "pending" && result.slowDown) {
-      pollIntervalMs = Math.min(pollIntervalMs * 1.5, 10000);
-    }
-
-    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
-  }
-
-  throw new Error("Qwen OAuth timed out waiting for authorization.");
-}

extensions/zalouser/src/channel.ts

@@ -324,73 +324,6 @@ export const zalouserPlugin: ChannelPlugin<ResolvedZalouserAccount> = {
       return sliced as ChannelDirectoryEntry[];
     },
   },
-  resolver: {
-    resolveTargets: async ({ cfg, accountId, inputs, kind, runtime }) => {
-      const results = [];
-      for (const input of inputs) {
-        const trimmed = input.trim();
-        if (!trimmed) {
-          results.push({ input, resolved: false, note: "empty input" });
-          continue;
-        }
-        if (/^\d+$/.test(trimmed)) {
-          results.push({ input, resolved: true, id: trimmed });
-          continue;
-        }
-        try {
-          const account = resolveZalouserAccountSync({
-            cfg: cfg as CoreConfig,
-            accountId: accountId ?? DEFAULT_ACCOUNT_ID,
-          });
-          const args =
-            kind === "user"
-              ? trimmed
-                ? ["friend", "find", trimmed]
-                : ["friend", "list", "-j"]
-              : ["group", "list", "-j"];
-          const result = await runZca(args, { profile: account.profile, timeout: 15000 });
-          if (!result.ok) throw new Error(result.stderr || "zca lookup failed");
-          if (kind === "user") {
-            const parsed = parseJsonOutput<ZcaFriend[]>(result.stdout) ?? [];
-            const matches = Array.isArray(parsed)
-              ? parsed.map((f) => ({
-                  id: String(f.userId),
-                  name: f.displayName ?? undefined,
-                }))
-              : [];
-            const best = matches[0];
-            results.push({
-              input,
-              resolved: Boolean(best?.id),
-              id: best?.id,
-              name: best?.name,
-              note: matches.length > 1 ? "multiple matches; chose first" : undefined,
-            });
-          } else {
-            const parsed = parseJsonOutput<ZcaGroup[]>(result.stdout) ?? [];
-            const matches = Array.isArray(parsed)
-              ? parsed.map((g) => ({
-                  id: String(g.groupId),
-                  name: g.name ?? undefined,
-                }))
-              : [];
-            const best = matches.find((g) => g.name?.toLowerCase() === trimmed.toLowerCase()) ?? matches[0];
-            results.push({
-              input,
-              resolved: Boolean(best?.id),
-              id: best?.id,
-              name: best?.name,
-              note: matches.length > 1 ? "multiple matches; chose first" : undefined,
-            });
-          }
-        } catch (err) {
-          runtime.error?.(`zalouser resolve failed: ${String(err)}`);
-          results.push({ input, resolved: false, note: "lookup failed" });
-        }
-      }
-      return results;
-    },
-  },
   pairing: {
     idLabel: "zalouserUserId",
     normalizeAllowEntry: (entry) => entry.replace(/^(zalouser|zlu):/i, ""),

extensions/zalouser/src/monitor.ts

@@ -5,19 +5,12 @@ import {
   isControlCommandMessage,
   shouldComputeCommandAuthorized,
 } from "../../../src/auto-reply/command-detection.js";
-import { mergeAllowlist, summarizeMapping } from "../../../src/channels/allowlists/resolve-utils.js";
 import { finalizeInboundContext } from "../../../src/auto-reply/reply/inbound-context.js";
 import { resolveCommandAuthorizedFromAuthorizers } from "../../../src/channels/command-gating.js";
 import { loadCoreChannelDeps, type CoreChannelDeps } from "./core-bridge.js";
 import { sendMessageZalouser } from "./send.js";
-import type {
-  CoreConfig,
-  ResolvedZalouserAccount,
-  ZcaFriend,
-  ZcaGroup,
-  ZcaMessage,
-} from "./types.js";
-import { parseJsonOutput, runZca, runZcaStreaming } from "./zca.js";
+import type { CoreConfig, ResolvedZalouserAccount, ZcaMessage } from "./types.js";
+import { runZcaStreaming } from "./zca.js";
 
 export type ZalouserMonitorOptions = {
   account: ResolvedZalouserAccount;
@@ -33,25 +26,6 @@ export type ZalouserMonitorResult = {
 
 const ZALOUSER_TEXT_LIMIT = 2000;
 
-function normalizeZalouserEntry(entry: string): string {
-  return entry.replace(/^(zalouser|zlu):/i, "").trim();
-}
-
-function buildNameIndex<T>(
-  items: T[],
-  nameFn: (item: T) => string | undefined,
-): Map<string, T[]> {
-  const index = new Map<string, T[]>();
-  for (const item of items) {
-    const name = nameFn(item)?.trim().toLowerCase();
-    if (!name) continue;
-    const list = index.get(name) ?? [];
-    list.push(item);
-    index.set(name, list);
-  }
-  return index;
-}
-
 function logVerbose(deps: CoreChannelDeps, runtime: RuntimeEnv, message: string): void {
   if (deps.shouldLogVerbose()) {
     runtime.log(`[zalouser] ${message}`);
@@ -67,39 +41,6 @@ function isSenderAllowed(senderId: string, allowFrom: string[]): boolean {
   });
 }
 
-function normalizeGroupSlug(raw?: string | null): string {
-  const trimmed = raw?.trim().toLowerCase() ?? "";
-  if (!trimmed) return "";
-  return trimmed
-    .replace(/^#/, "")
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-}
-
-function isGroupAllowed(params: {
-  groupId: string;
-  groupName?: string | null;
-  groups: Record<string, { allow?: boolean; enabled?: boolean }>;
-}): boolean {
-  const groups = params.groups ?? {};
-  const keys = Object.keys(groups);
-  if (keys.length === 0) return false;
-  const candidates = [
-    params.groupId,
-    `group:${params.groupId}`,
-    params.groupName ?? "",
-    normalizeGroupSlug(params.groupName ?? ""),
-  ].filter(Boolean);
-  for (const candidate of candidates) {
-    const entry = groups[candidate];
-    if (!entry) continue;
-    return entry.allow !== false && entry.enabled !== false;
-  }
-  const wildcard = groups["*"];
-  if (wildcard) return wildcard.allow !== false && wildcard.enabled !== false;
-  return false;
-}
-
 function startZcaListener(
   runtime: RuntimeEnv,
   profile: string,
@@ -165,26 +106,8 @@ async function processMessage(
   const isGroup = metadata?.isGroup ?? false;
   const senderId = metadata?.fromId ?? threadId;
   const senderName = metadata?.senderName ?? "";
-  const groupName = metadata?.threadName ?? "";
   const chatId = threadId;
 
-  const defaultGroupPolicy = config.channels?.defaults?.groupPolicy;
-  const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "open";
-  const groups = account.config.groups ?? {};
-  if (isGroup) {
-    if (groupPolicy === "disabled") {
-      logVerbose(deps, runtime, `zalouser: drop group ${chatId} (groupPolicy=disabled)`);
-      return;
-    }
-    if (groupPolicy === "allowlist") {
-      const allowed = isGroupAllowed({ groupId: chatId, groupName, groups });
-      if (!allowed) {
-        logVerbose(deps, runtime, `zalouser: drop group ${chatId} (not allowlisted)`);
-        return;
-      }
-    }
-  }
-
   const dmPolicy = account.config.dmPolicy ?? "pairing";
   const configAllowFrom = (account.config.allowFrom ?? []).map((v) => String(v));
   const rawBody = content.trim();
@@ -271,10 +194,11 @@ async function processMessage(
     },
   });
 
-  const fromLabel = isGroup ? `group:${chatId}` : senderName || `user:${senderId}`;
-  const body = deps.formatAgentEnvelope({
-    channel: "Zalo Personal",
-    from: fromLabel,
+	  const rawBody = content.trim();
+	  const fromLabel = isGroup ? `group:${chatId}` : senderName || `user:${senderId}`;
+	  const body = deps.formatAgentEnvelope({
+	    channel: "Zalo Personal",
+	    from: fromLabel,
     timestamp: timestamp ? timestamp * 1000 : undefined,
     body: rawBody,
   });
@@ -377,8 +301,7 @@ async function deliverZalouserReply(params: {
 export async function monitorZalouserProvider(
   options: ZalouserMonitorOptions,
 ): Promise<ZalouserMonitorResult> {
-  let { account, config } = options;
-  const { abortSignal, statusSink, runtime } = options;
+  const { account, config, abortSignal, statusSink, runtime } = options;
 
   const deps = await loadCoreChannelDeps();
   let stopped = false;
@@ -386,92 +309,6 @@ export async function monitorZalouserProvider(
   let restartTimer: ReturnType<typeof setTimeout> | null = null;
   let resolveRunning: (() => void) | null = null;
 
-  try {
-    const profile = account.profile;
-    const allowFromEntries = (account.config.allowFrom ?? [])
-      .map((entry) => normalizeZalouserEntry(String(entry)))
-      .filter((entry) => entry && entry !== "*");
-
-    if (allowFromEntries.length > 0) {
-      const result = await runZca(["friend", "list", "-j"], { profile, timeout: 15000 });
-      if (result.ok) {
-        const friends = parseJsonOutput<ZcaFriend[]>(result.stdout) ?? [];
-        const byName = buildNameIndex(friends, (friend) => friend.displayName);
-        const additions: string[] = [];
-        const mapping: string[] = [];
-        const unresolved: string[] = [];
-        for (const entry of allowFromEntries) {
-          if (/^\d+$/.test(entry)) {
-            additions.push(entry);
-            continue;
-          }
-          const matches = byName.get(entry.toLowerCase()) ?? [];
-          const match = matches[0];
-          const id = match?.userId ? String(match.userId) : undefined;
-          if (id) {
-            additions.push(id);
-            mapping.push(`${entry}→${id}`);
-          } else {
-            unresolved.push(entry);
-          }
-        }
-        const allowFrom = mergeAllowlist({ existing: account.config.allowFrom, additions });
-        account = {
-          ...account,
-          config: {
-            ...account.config,
-            allowFrom,
-          },
-        };
-        summarizeMapping("zalouser users", mapping, unresolved, runtime);
-      } else {
-        runtime.log?.(`zalouser user resolve failed; using config entries. ${result.stderr}`);
-      }
-    }
-
-    const groupsConfig = account.config.groups ?? {};
-    const groupKeys = Object.keys(groupsConfig).filter((key) => key !== "*");
-    if (groupKeys.length > 0) {
-      const result = await runZca(["group", "list", "-j"], { profile, timeout: 15000 });
-      if (result.ok) {
-        const groups = parseJsonOutput<ZcaGroup[]>(result.stdout) ?? [];
-        const byName = buildNameIndex(groups, (group) => group.name);
-        const mapping: string[] = [];
-        const unresolved: string[] = [];
-        const nextGroups = { ...groupsConfig };
-        for (const entry of groupKeys) {
-          const cleaned = normalizeZalouserEntry(entry);
-          if (/^\d+$/.test(cleaned)) {
-            if (!nextGroups[cleaned]) nextGroups[cleaned] = groupsConfig[entry];
-            mapping.push(`${entry}→${cleaned}`);
-            continue;
-          }
-          const matches = byName.get(cleaned.toLowerCase()) ?? [];
-          const match = matches[0];
-          const id = match?.groupId ? String(match.groupId) : undefined;
-          if (id) {
-            if (!nextGroups[id]) nextGroups[id] = groupsConfig[entry];
-            mapping.push(`${entry}→${id}`);
-          } else {
-            unresolved.push(entry);
-          }
-        }
-        account = {
-          ...account,
-          config: {
-            ...account.config,
-            groups: nextGroups,
-          },
-        };
-        summarizeMapping("zalouser groups", mapping, unresolved, runtime);
-      } else {
-        runtime.log?.(`zalouser group resolve failed; using config entries. ${result.stderr}`);
-      }
-    }
-  } catch (err) {
-    runtime.log?.(`zalouser resolve failed; using config entries. ${String(err)}`);
-  }
-
   const stop = () => {
     stopped = true;
     if (restartTimer) {

extensions/zalouser/src/onboarding.ts

@@ -1,6 +1,5 @@
 import type { ChannelOnboardingAdapter, ChannelOnboardingDmPolicy } from "../../../src/channels/plugins/onboarding-types.js";
 import type { WizardPrompter } from "../../../src/wizard/prompts.js";
-import { promptChannelAccessConfig } from "../../../src/channels/plugins/onboarding/channel-access.js";
 
 import {
   listZalouserAccountIds,
@@ -9,8 +8,8 @@ import {
   normalizeAccountId,
   checkZcaAuthenticated,
 } from "./accounts.js";
-import { runZca, runZcaInteractive, checkZcaInstalled, parseJsonOutput } from "./zca.js";
-import { DEFAULT_ACCOUNT_ID, type CoreConfig, type ZcaGroup } from "./types.js";
+import { runZcaInteractive, checkZcaInstalled } from "./zca.js";
+import { DEFAULT_ACCOUNT_ID, type CoreConfig } from "./types.js";
 
 const channel = "zalouser" as const;
 
@@ -114,115 +113,6 @@ async function promptZalouserAllowFrom(params: {
   } as CoreConfig;
 }
 
-function setZalouserGroupPolicy(
-  cfg: CoreConfig,
-  accountId: string,
-  groupPolicy: "open" | "allowlist" | "disabled",
-): CoreConfig {
-  if (accountId === DEFAULT_ACCOUNT_ID) {
-    return {
-      ...cfg,
-      channels: {
-        ...cfg.channels,
-        zalouser: {
-          ...cfg.channels?.zalouser,
-          enabled: true,
-          groupPolicy,
-        },
-      },
-    } as CoreConfig;
-  }
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      zalouser: {
-        ...cfg.channels?.zalouser,
-        enabled: true,
-        accounts: {
-          ...(cfg.channels?.zalouser?.accounts ?? {}),
-          [accountId]: {
-            ...(cfg.channels?.zalouser?.accounts?.[accountId] ?? {}),
-            enabled: cfg.channels?.zalouser?.accounts?.[accountId]?.enabled ?? true,
-            groupPolicy,
-          },
-        },
-      },
-    },
-  } as CoreConfig;
-}
-
-function setZalouserGroupAllowlist(
-  cfg: CoreConfig,
-  accountId: string,
-  groupKeys: string[],
-): CoreConfig {
-  const groups = Object.fromEntries(groupKeys.map((key) => [key, { allow: true }]));
-  if (accountId === DEFAULT_ACCOUNT_ID) {
-    return {
-      ...cfg,
-      channels: {
-        ...cfg.channels,
-        zalouser: {
-          ...cfg.channels?.zalouser,
-          enabled: true,
-          groups,
-        },
-      },
-    } as CoreConfig;
-  }
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      zalouser: {
-        ...cfg.channels?.zalouser,
-        enabled: true,
-        accounts: {
-          ...(cfg.channels?.zalouser?.accounts ?? {}),
-          [accountId]: {
-            ...(cfg.channels?.zalouser?.accounts?.[accountId] ?? {}),
-            enabled: cfg.channels?.zalouser?.accounts?.[accountId]?.enabled ?? true,
-            groups,
-          },
-        },
-      },
-    },
-  } as CoreConfig;
-}
-
-async function resolveZalouserGroups(params: {
-  cfg: CoreConfig;
-  accountId: string;
-  entries: string[];
-}): Promise<Array<{ input: string; resolved: boolean; id?: string }>> {
-  const account = resolveZalouserAccountSync({ cfg: params.cfg, accountId: params.accountId });
-  const result = await runZca(["group", "list", "-j"], { profile: account.profile, timeout: 15000 });
-  if (!result.ok) throw new Error(result.stderr || "Failed to list groups");
-  const groups = (parseJsonOutput<ZcaGroup[]>(result.stdout) ?? []).filter(
-    (group) => Boolean(group.groupId),
-  );
-  const byName = new Map<string, ZcaGroup[]>();
-  for (const group of groups) {
-    const name = group.name?.trim().toLowerCase();
-    if (!name) continue;
-    const list = byName.get(name) ?? [];
-    list.push(group);
-    byName.set(name, list);
-  }
-
-  return params.entries.map((input) => {
-    const trimmed = input.trim();
-    if (!trimmed) return { input, resolved: false };
-    if (/^\d+$/.test(trimmed)) return { input, resolved: true, id: trimmed };
-    const matches = byName.get(trimmed.toLowerCase()) ?? [];
-    const match = matches[0];
-    return match?.groupId
-      ? { input, resolved: true, id: String(match.groupId) }
-      : { input, resolved: false };
-  });
-}
-
 async function promptAccountId(params: {
   cfg: CoreConfig;
   prompter: WizardPrompter;
@@ -417,61 +307,6 @@ export const zalouserOnboardingAdapter: ChannelOnboardingAdapter = {
       });
     }
 
-    const accessConfig = await promptChannelAccessConfig({
-      prompter,
-      label: "Zalo groups",
-      currentPolicy: account.config.groupPolicy ?? "open",
-      currentEntries: Object.keys(account.config.groups ?? {}),
-      placeholder: "Family, Work, 123456789",
-      updatePrompt: Boolean(account.config.groups),
-    });
-    if (accessConfig) {
-      if (accessConfig.policy !== "allowlist") {
-        next = setZalouserGroupPolicy(next, accountId, accessConfig.policy);
-      } else {
-        let keys = accessConfig.entries;
-        if (accessConfig.entries.length > 0) {
-          try {
-            const resolved = await resolveZalouserGroups({
-              cfg: next,
-              accountId,
-              entries: accessConfig.entries,
-            });
-            const resolvedIds = resolved
-              .filter((entry) => entry.resolved && entry.id)
-              .map((entry) => entry.id as string);
-            const unresolved = resolved
-              .filter((entry) => !entry.resolved)
-              .map((entry) => entry.input);
-            keys = [
-              ...resolvedIds,
-              ...unresolved.map((entry) => entry.trim()).filter(Boolean),
-            ];
-            if (resolvedIds.length > 0 || unresolved.length > 0) {
-              await prompter.note(
-                [
-                  resolvedIds.length > 0 ? `Resolved: ${resolvedIds.join(", ")}` : undefined,
-                  unresolved.length > 0
-                    ? `Unresolved (kept as typed): ${unresolved.join(", ")}`
-                    : undefined,
-                ]
-                  .filter(Boolean)
-                  .join("\n"),
-                "Zalo groups",
-              );
-            }
-          } catch (err) {
-            await prompter.note(
-              `Group lookup failed; keeping entries as typed. ${String(err)}`,
-              "Zalo groups",
-            );
-          }
-        }
-        next = setZalouserGroupPolicy(next, accountId, "allowlist");
-        next = setZalouserGroupAllowlist(next, accountId, keys);
-      }
-    }
-
     return { cfg: next, accountId };
   },
 };

extensions/zalouser/src/types.ts

@@ -77,8 +77,6 @@ export type ZalouserAccountConfig = {
   profile?: string;
   dmPolicy?: "pairing" | "allowlist" | "open" | "disabled";
   allowFrom?: Array<string | number>;
-  groupPolicy?: "open" | "allowlist" | "disabled";
-  groups?: Record<string, { allow?: boolean; enabled?: boolean }>;
   messagePrefix?: string;
 };
 
@@ -89,8 +87,6 @@ export type ZalouserConfig = {
   defaultAccount?: string;
   dmPolicy?: "pairing" | "allowlist" | "open" | "disabled";
   allowFrom?: Array<string | number>;
-  groupPolicy?: "open" | "allowlist" | "disabled";
-  groups?: Record<string, { allow?: boolean; enabled?: boolean }>;
   messagePrefix?: string;
   accounts?: Record<string, ZalouserAccountConfig>;
 };

src/agents/auth-profiles/constants.ts

@@ -6,7 +6,6 @@ export const LEGACY_AUTH_FILENAME = "auth.json";
 
 export const CLAUDE_CLI_PROFILE_ID = "anthropic:claude-cli";
 export const CODEX_CLI_PROFILE_ID = "openai-codex:codex-cli";
-export const QWEN_CLI_PROFILE_ID = "qwen-portal:qwen-cli";
 
 export const AUTH_STORE_LOCK_OPTIONS = {
   retries: {

src/agents/auth-profiles/external-cli-sync.ts

@@ -1,14 +1,12 @@
 import {
   readClaudeCliCredentialsCached,
   readCodexCliCredentialsCached,
-  readQwenCliCredentialsCached,
 } from "../cli-credentials.js";
 import {
   CLAUDE_CLI_PROFILE_ID,
   CODEX_CLI_PROFILE_ID,
   EXTERNAL_CLI_NEAR_EXPIRY_MS,
   EXTERNAL_CLI_SYNC_TTL_MS,
-  QWEN_CLI_PROFILE_ID,
   log,
 } from "./constants.js";
 import type {
@@ -47,11 +45,7 @@ function shallowEqualTokenCredentials(a: TokenCredential | undefined, b: TokenCr
 function isExternalProfileFresh(cred: AuthProfileCredential | undefined, now: number): boolean {
   if (!cred) return false;
   if (cred.type !== "oauth" && cred.type !== "token") return false;
-  if (
-    cred.provider !== "anthropic" &&
-    cred.provider !== "openai-codex" &&
-    cred.provider !== "qwen-portal"
-  ) {
+  if (cred.provider !== "anthropic" && cred.provider !== "openai-codex") {
     return false;
   }
   if (typeof cred.expires !== "number") return true;
@@ -171,33 +165,5 @@ export function syncExternalCliCredentials(
     }
   }
 
-  // Sync from Qwen Code CLI
-  const existingQwen = store.profiles[QWEN_CLI_PROFILE_ID];
-  const shouldSyncQwen =
-    !existingQwen ||
-    existingQwen.provider !== "qwen-portal" ||
-    !isExternalProfileFresh(existingQwen, now);
-  const qwenCreds = shouldSyncQwen
-    ? readQwenCliCredentialsCached({ ttlMs: EXTERNAL_CLI_SYNC_TTL_MS })
-    : null;
-  if (qwenCreds) {
-    const existing = store.profiles[QWEN_CLI_PROFILE_ID];
-    const existingOAuth = existing?.type === "oauth" ? existing : undefined;
-    const shouldUpdate =
-      !existingOAuth ||
-      existingOAuth.provider !== "qwen-portal" ||
-      existingOAuth.expires <= now ||
-      qwenCreds.expires > existingOAuth.expires;
-
-    if (shouldUpdate && !shallowEqualOAuthCredentials(existingOAuth, qwenCreds)) {
-      store.profiles[QWEN_CLI_PROFILE_ID] = qwenCreds;
-      mutated = true;
-      log.info("synced qwen credentials from qwen cli", {
-        profileId: QWEN_CLI_PROFILE_ID,
-        expires: new Date(qwenCreds.expires).toISOString(),
-      });
-    }
-  }
-
   return mutated;
 }

src/agents/auth-profiles/oauth.ts

@@ -3,7 +3,6 @@ import lockfile from "proper-lockfile";
 
 import type { ClawdbotConfig } from "../../config/config.js";
 import { refreshChutesTokens } from "../chutes-oauth.js";
-import { refreshQwenPortalCredentials } from "../../providers/qwen-portal-oauth.js";
 import { writeClaudeCliCredentials } from "../cli-credentials.js";
 import { AUTH_STORE_LOCK_OPTIONS, CLAUDE_CLI_PROFILE_ID } from "./constants.js";
 import { formatAuthDoctorHint } from "./doctor.js";
@@ -58,12 +57,7 @@ async function refreshOAuthTokenWithLock(params: {
             });
             return { apiKey: newCredentials.access, newCredentials };
           })()
-        : String(cred.provider) === "qwen-portal"
-          ? await (async () => {
-              const newCredentials = await refreshQwenPortalCredentials(cred);
-              return { apiKey: newCredentials.access, newCredentials };
-            })()
-          : await getOAuthApiKey(cred.provider as OAuthProvider, oauthCreds);
+        : await getOAuthApiKey(cred.provider as OAuthProvider, oauthCreds);
     if (!result) return null;
     store.profiles[params.profileId] = {
       ...cred,

src/agents/clawdbot-tools.sessions.test.ts

@@ -54,7 +54,6 @@ describe("sessions tools", () => {
     expect(schemaProp("sessions_list", "activeMinutes").type).toBe("number");
     expect(schemaProp("sessions_list", "messageLimit").type).toBe("number");
     expect(schemaProp("sessions_send", "timeoutSeconds").type).toBe("number");
-    expect(schemaProp("sessions_spawn", "thinking").type).toBe("string");
     expect(schemaProp("sessions_spawn", "runTimeoutSeconds").type).toBe("number");
     expect(schemaProp("sessions_spawn", "timeoutSeconds").type).toBe("number");
   });

src/agents/clawdbot-tools.subagents.sessions-spawn-applies-model-child-session.test.ts

@@ -92,68 +92,6 @@ describe("clawdbot-tools: subagents", () => {
       model: "claude-haiku-4-5",
     });
   });
-
-  it("sessions_spawn forwards thinking overrides to the agent run", async () => {
-    resetSubagentRegistryForTests();
-    callGatewayMock.mockReset();
-    const calls: Array<{ method?: string; params?: unknown }> = [];
-
-    callGatewayMock.mockImplementation(async (opts: unknown) => {
-      const request = opts as { method?: string; params?: unknown };
-      calls.push(request);
-      if (request.method === "agent") {
-        return { runId: "run-thinking", status: "accepted" };
-      }
-      return {};
-    });
-
-    const tool = createClawdbotTools({
-      agentSessionKey: "discord:group:req",
-      agentChannel: "discord",
-    }).find((candidate) => candidate.name === "sessions_spawn");
-    if (!tool) throw new Error("missing sessions_spawn tool");
-
-    const result = await tool.execute("call-thinking", {
-      task: "do thing",
-      thinking: "high",
-    });
-    expect(result.details).toMatchObject({
-      status: "accepted",
-    });
-
-    const agentCall = calls.find((call) => call.method === "agent");
-    expect(agentCall?.params).toMatchObject({
-      thinking: "high",
-    });
-  });
-
-  it("sessions_spawn rejects invalid thinking levels", async () => {
-    resetSubagentRegistryForTests();
-    callGatewayMock.mockReset();
-    const calls: Array<{ method?: string }> = [];
-
-    callGatewayMock.mockImplementation(async (opts: unknown) => {
-      const request = opts as { method?: string };
-      calls.push(request);
-      return {};
-    });
-
-    const tool = createClawdbotTools({
-      agentSessionKey: "discord:group:req",
-      agentChannel: "discord",
-    }).find((candidate) => candidate.name === "sessions_spawn");
-    if (!tool) throw new Error("missing sessions_spawn tool");
-
-    const result = await tool.execute("call-thinking-invalid", {
-      task: "do thing",
-      thinking: "banana",
-    });
-    expect(result.details).toMatchObject({
-      status: "error",
-    });
-    expect(String(result.details?.error)).toMatch(/Invalid thinking level/i);
-    expect(calls).toHaveLength(0);
-  });
   it("sessions_spawn applies default subagent model from defaults config", async () => {
     resetSubagentRegistryForTests();
     callGatewayMock.mockReset();

src/agents/cli-credentials.ts

@@ -13,7 +13,6 @@ const log = createSubsystemLogger("agents/auth-profiles");
 
 const CLAUDE_CLI_CREDENTIALS_RELATIVE_PATH = ".claude/.credentials.json";
 const CODEX_CLI_AUTH_FILENAME = "auth.json";
-const QWEN_CLI_CREDENTIALS_RELATIVE_PATH = ".qwen/oauth_creds.json";
 
 const CLAUDE_CLI_KEYCHAIN_SERVICE = "Claude Code-credentials";
 const CLAUDE_CLI_KEYCHAIN_ACCOUNT = "Claude Code";
@@ -26,7 +25,6 @@ type CachedValue<T> = {
 
 let claudeCliCache: CachedValue<ClaudeCliCredential> | null = null;
 let codexCliCache: CachedValue<CodexCliCredential> | null = null;
-let qwenCliCache: CachedValue<QwenCliCredential> | null = null;
 
 export type ClaudeCliCredential =
   | {
@@ -51,14 +49,6 @@ export type CodexCliCredential = {
   expires: number;
 };
 
-export type QwenCliCredential = {
-  type: "oauth";
-  provider: "qwen-portal";
-  access: string;
-  refresh: string;
-  expires: number;
-};
-
 type ClaudeCliFileOptions = {
   homeDir?: string;
 };
@@ -88,11 +78,6 @@ function resolveCodexHomePath() {
   }
 }
 
-function resolveQwenCliCredentialsPath(homeDir?: string) {
-  const baseDir = homeDir ?? resolveUserPath("~");
-  return path.join(baseDir, QWEN_CLI_CREDENTIALS_RELATIVE_PATH);
-}
-
 function computeCodexKeychainAccount(codexHome: string) {
   const hash = createHash("sha256").update(codexHome).digest("hex");
   return `cli|${hash.slice(0, 16)}`;
@@ -148,28 +133,6 @@ function readCodexKeychainCredentials(options?: {
   }
 }
 
-function readQwenCliCredentials(options?: { homeDir?: string }): QwenCliCredential | null {
-  const credPath = resolveQwenCliCredentialsPath(options?.homeDir);
-  const raw = loadJsonFile(credPath);
-  if (!raw || typeof raw !== "object") return null;
-  const data = raw as Record<string, unknown>;
-  const accessToken = data.access_token;
-  const refreshToken = data.refresh_token;
-  const expiresAt = data.expiry_date;
-
-  if (typeof accessToken !== "string" || !accessToken) return null;
-  if (typeof refreshToken !== "string" || !refreshToken) return null;
-  if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
-
-  return {
-    type: "oauth",
-    provider: "qwen-portal",
-    access: accessToken,
-    refresh: refreshToken,
-    expires: expiresAt,
-  };
-}
-
 function readClaudeCliKeychainCredentials(): ClaudeCliCredential | null {
   try {
     const result = execSync(
@@ -443,25 +406,3 @@ export function readCodexCliCredentialsCached(options?: {
   }
   return value;
 }
-
-export function readQwenCliCredentialsCached(options?: {
-  ttlMs?: number;
-  homeDir?: string;
-}): QwenCliCredential | null {
-  const ttlMs = options?.ttlMs ?? 0;
-  const now = Date.now();
-  const cacheKey = resolveQwenCliCredentialsPath(options?.homeDir);
-  if (
-    ttlMs > 0 &&
-    qwenCliCache &&
-    qwenCliCache.cacheKey === cacheKey &&
-    now - qwenCliCache.readAt < ttlMs
-  ) {
-    return qwenCliCache.value;
-  }
-  const value = readQwenCliCredentials({ homeDir: options?.homeDir });
-  if (ttlMs > 0) {
-    qwenCliCache = { value, readAt: now, cacheKey };
-  }
-  return value;
-}

src/agents/memory-search.test.ts

@@ -67,39 +67,6 @@ describe("memory search config", () => {
     expect(resolved?.store.vector.extensionPath).toBe("/opt/sqlite-vec.dylib");
   });
 
-  it("includes batch defaults for openai without remote overrides", () => {
-    const cfg = {
-      agents: {
-        defaults: {
-          memorySearch: {
-            provider: "openai",
-          },
-        },
-      },
-    };
-    const resolved = resolveMemorySearchConfig(cfg, "main");
-    expect(resolved?.remote?.batch).toEqual({
-      enabled: true,
-      wait: true,
-      pollIntervalMs: 5000,
-      timeoutMinutes: 60,
-    });
-  });
-
-  it("keeps remote unset for local provider without overrides", () => {
-    const cfg = {
-      agents: {
-        defaults: {
-          memorySearch: {
-            provider: "local",
-          },
-        },
-      },
-    };
-    const resolved = resolveMemorySearchConfig(cfg, "main");
-    expect(resolved?.remote).toBeUndefined();
-  });
-
   it("merges remote defaults with agent overrides", () => {
     const cfg = {
       agents: {

src/agents/memory-search.ts

@@ -95,7 +95,6 @@ function mergeConfig(
     overrides?.experimental?.sessionMemory ?? defaults?.experimental?.sessionMemory ?? false;
   const provider = overrides?.provider ?? defaults?.provider ?? "openai";
   const hasRemote = Boolean(defaults?.remote || overrides?.remote);
-  const includeRemote = hasRemote || provider === "openai";
   const batch = {
     enabled: overrides?.remote?.batch?.enabled ?? defaults?.remote?.batch?.enabled ?? true,
     wait: overrides?.remote?.batch?.wait ?? defaults?.remote?.batch?.wait ?? true,
@@ -108,7 +107,7 @@ function mergeConfig(
       defaults?.remote?.batch?.timeoutMinutes ??
       60,
   };
-  const remote = includeRemote
+  const remote = hasRemote
     ? {
         baseUrl: overrides?.remote?.baseUrl ?? defaults?.remote?.baseUrl,
         apiKey: overrides?.remote?.apiKey ?? defaults?.remote?.apiKey,

src/agents/model-auth.ts

@@ -147,10 +147,6 @@ export function resolveEnvApiKey(provider: string): EnvApiKeyResult | null {
     return pick("OPENCODE_API_KEY") ?? pick("OPENCODE_ZEN_API_KEY");
   }
 
-  if (normalized === "qwen-portal") {
-    return pick("QWEN_OAUTH_TOKEN") ?? pick("QWEN_PORTAL_API_KEY");
-  }
-
   const envMap: Record<string, string> = {
     openai: "OPENAI_API_KEY",
     google: "GEMINI_API_KEY",

src/agents/model-selection.ts

@@ -26,7 +26,6 @@ export function normalizeProviderId(provider: string): string {
   const normalized = provider.trim().toLowerCase();
   if (normalized === "z.ai" || normalized === "z-ai") return "zai";
   if (normalized === "opencode-zen") return "opencode";
-  if (normalized === "qwen") return "qwen-portal";
   return normalized;
 }
 

src/agents/models-config.providers.ts

@@ -50,17 +50,6 @@ const KIMI_CODE_DEFAULT_COST = {
   cacheWrite: 0,
 };
 
-const QWEN_PORTAL_BASE_URL = "https://portal.qwen.ai/v1";
-const QWEN_PORTAL_OAUTH_PLACEHOLDER = "qwen-oauth";
-const QWEN_PORTAL_DEFAULT_CONTEXT_WINDOW = 128000;
-const QWEN_PORTAL_DEFAULT_MAX_TOKENS = 8192;
-const QWEN_PORTAL_DEFAULT_COST = {
-  input: 0,
-  output: 0,
-  cacheRead: 0,
-  cacheWrite: 0,
-};
-
 function normalizeApiKeyConfig(value: string): string {
   const trimmed = value.trim();
   const match = /^\$\{([A-Z0-9_]+)\}$/.exec(trimmed);
@@ -227,33 +216,6 @@ function buildKimiCodeProvider(): ProviderConfig {
   };
 }
 
-function buildQwenPortalProvider(): ProviderConfig {
-  return {
-    baseUrl: QWEN_PORTAL_BASE_URL,
-    api: "openai-completions",
-    models: [
-      {
-        id: "coder-model",
-        name: "Qwen Coder",
-        reasoning: false,
-        input: ["text"],
-        cost: QWEN_PORTAL_DEFAULT_COST,
-        contextWindow: QWEN_PORTAL_DEFAULT_CONTEXT_WINDOW,
-        maxTokens: QWEN_PORTAL_DEFAULT_MAX_TOKENS,
-      },
-      {
-        id: "vision-model",
-        name: "Qwen Vision",
-        reasoning: false,
-        input: ["text", "image"],
-        cost: QWEN_PORTAL_DEFAULT_COST,
-        contextWindow: QWEN_PORTAL_DEFAULT_CONTEXT_WINDOW,
-        maxTokens: QWEN_PORTAL_DEFAULT_MAX_TOKENS,
-      },
-    ],
-  };
-}
-
 function buildSyntheticProvider(): ProviderConfig {
   return {
     baseUrl: SYNTHETIC_BASE_URL,
@@ -296,14 +258,6 @@ export function resolveImplicitProviders(params: { agentDir: string }): ModelsCo
     providers.synthetic = { ...buildSyntheticProvider(), apiKey: syntheticKey };
   }
 
-  const qwenProfiles = listProfilesForProvider(authStore, "qwen-portal");
-  if (qwenProfiles.length > 0) {
-    providers["qwen-portal"] = {
-      ...buildQwenPortalProvider(),
-      apiKey: QWEN_PORTAL_OAUTH_PLACEHOLDER,
-    };
-  }
-
   return providers;
 }
 

src/agents/tool-display.json

@@ -266,7 +266,7 @@
     "sessions_spawn": {
       "emoji": "🧑‍🔧",
       "title": "Sub-agent",
-      "detailKeys": ["label", "agentId", "thinking", "runTimeoutSeconds", "cleanup"]
+      "detailKeys": ["label", "agentId", "runTimeoutSeconds", "cleanup"]
     },
     "session_status": {
       "emoji": "📊",

src/agents/tools/discord-actions-messaging.ts

@@ -28,7 +28,6 @@ import {
   readStringParam,
 } from "./common.js";
 import { withNormalizedTimestamp } from "../date-time.js";
-import { resolveDiscordChannelId } from "../../discord/targets.js";
 
 function parseDiscordMessageLink(link: string) {
   const normalized = link.trim();
@@ -52,12 +51,6 @@ export async function handleDiscordMessagingAction(
   params: Record<string, unknown>,
   isActionEnabled: ActionGate<DiscordActionConfig>,
 ): Promise<AgentToolResult<unknown>> {
-  const resolveChannelId = () =>
-    resolveDiscordChannelId(
-      readStringParam(params, "channelId", {
-        required: true,
-      }),
-    );
   const normalizeMessage = (message: unknown) => {
     if (!message || typeof message !== "object") return message;
     return withNormalizedTimestamp(
@@ -70,7 +63,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("reactions")) {
         throw new Error("Discord reactions are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const messageId = readStringParam(params, "messageId", {
         required: true,
       });
@@ -92,7 +87,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("reactions")) {
         throw new Error("Discord reactions are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const messageId = readStringParam(params, "messageId", {
         required: true,
       });
@@ -148,7 +145,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("permissions")) {
         throw new Error("Discord permissions are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const permissions = await fetchChannelPermissionsDiscord(channelId);
       return jsonResult({ ok: true, permissions });
     }
@@ -184,7 +183,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("messages")) {
         throw new Error("Discord message reads are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const messages = await readMessagesDiscord(channelId, {
         limit:
           typeof params.limit === "number" && Number.isFinite(params.limit)
@@ -222,7 +223,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("messages")) {
         throw new Error("Discord message edits are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const messageId = readStringParam(params, "messageId", {
         required: true,
       });
@@ -238,7 +241,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("messages")) {
         throw new Error("Discord message deletes are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const messageId = readStringParam(params, "messageId", {
         required: true,
       });
@@ -249,7 +254,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("threads")) {
         throw new Error("Discord threads are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const name = readStringParam(params, "name", { required: true });
       const messageId = readStringParam(params, "messageId");
       const autoArchiveMinutesRaw = params.autoArchiveMinutes;
@@ -292,7 +299,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("threads")) {
         throw new Error("Discord threads are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const content = readStringParam(params, "content", {
         required: true,
       });
@@ -308,7 +317,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("pins")) {
         throw new Error("Discord pins are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const messageId = readStringParam(params, "messageId", {
         required: true,
       });
@@ -319,7 +330,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("pins")) {
         throw new Error("Discord pins are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const messageId = readStringParam(params, "messageId", {
         required: true,
       });
@@ -330,7 +343,9 @@ export async function handleDiscordMessagingAction(
       if (!isActionEnabled("pins")) {
         throw new Error("Discord pins are disabled.");
       }
-      const channelId = resolveChannelId();
+      const channelId = readStringParam(params, "channelId", {
+        required: true,
+      });
       const pins = await listPinsDiscord(channelId);
       return jsonResult({ ok: true, pins: pins.map((pin) => normalizeMessage(pin)) });
     }

src/agents/tools/sessions-spawn-tool.ts

@@ -2,7 +2,6 @@ import crypto from "node:crypto";
 
 import { Type } from "@sinclair/typebox";
 
-import { formatThinkingLevels, normalizeThinkLevel } from "../../auto-reply/thinking.js";
 import { loadConfig } from "../../config/config.js";
 import { callGateway } from "../../gateway/call.js";
 import {
@@ -30,22 +29,12 @@ const SessionsSpawnToolSchema = Type.Object({
   label: Type.Optional(Type.String()),
   agentId: Type.Optional(Type.String()),
   model: Type.Optional(Type.String()),
-  thinking: Type.Optional(Type.String()),
   runTimeoutSeconds: Type.Optional(Type.Number({ minimum: 0 })),
   // Back-compat alias. Prefer runTimeoutSeconds.
   timeoutSeconds: Type.Optional(Type.Number({ minimum: 0 })),
   cleanup: optionalStringEnum(["delete", "keep"] as const),
 });
 
-function splitModelRef(ref?: string) {
-  if (!ref) return { provider: undefined, model: undefined };
-  const trimmed = ref.trim();
-  if (!trimmed) return { provider: undefined, model: undefined };
-  const [provider, model] = trimmed.split("/", 2);
-  if (model) return { provider, model };
-  return { provider: undefined, model: trimmed };
-}
-
 function normalizeModelSelection(value: unknown): string | undefined {
   if (typeof value === "string") {
     const trimmed = value.trim();
@@ -75,7 +64,6 @@ export function createSessionsSpawnTool(opts?: {
       const label = typeof params.label === "string" ? params.label.trim() : "";
       const requestedAgentId = readStringParam(params, "agentId");
       const modelOverride = readStringParam(params, "model");
-      const thinkingOverrideRaw = readStringParam(params, "thinking");
       const cleanup =
         params.cleanup === "keep" || params.cleanup === "delete"
           ? (params.cleanup as "keep" | "delete")
@@ -155,19 +143,6 @@ export function createSessionsSpawnTool(opts?: {
         normalizeModelSelection(modelOverride) ??
         normalizeModelSelection(targetAgentConfig?.subagents?.model) ??
         normalizeModelSelection(cfg.agents?.defaults?.subagents?.model);
-      let thinkingOverride: string | undefined;
-      if (thinkingOverrideRaw) {
-        const normalized = normalizeThinkLevel(thinkingOverrideRaw);
-        if (!normalized) {
-          const { provider, model } = splitModelRef(resolvedModel);
-          const hint = formatThinkingLevels(provider, model);
-          return jsonResult({
-            status: "error",
-            error: `Invalid thinking level "${thinkingOverrideRaw}". Use one of: ${hint}.`,
-          });
-        }
-        thinkingOverride = normalized;
-      }
       if (resolvedModel) {
         try {
           await callGateway({
@@ -212,7 +187,6 @@ export function createSessionsSpawnTool(opts?: {
             deliver: false,
             lane: AGENT_LANE_SUBAGENT,
             extraSystemPrompt: childSystemPrompt,
-            thinking: thinkingOverride,
             timeout: runTimeoutSeconds > 0 ? runTimeoutSeconds : undefined,
             label: label || undefined,
             spawnedBy: shouldPatchSpawnedBy ? requesterInternalKey : undefined,

src/agents/tools/slack-actions.test.ts

@@ -48,20 +48,6 @@ describe("handleSlackAction", () => {
     expect(reactSlackMessage).toHaveBeenCalledWith("C1", "123.456", "✅");
   });
 
-  it("strips channel: prefix for channelId params", async () => {
-    const cfg = { channels: { slack: { botToken: "tok" } } } as ClawdbotConfig;
-    await handleSlackAction(
-      {
-        action: "react",
-        channelId: "channel:C1",
-        messageId: "123.456",
-        emoji: "✅",
-      },
-      cfg,
-    );
-    expect(reactSlackMessage).toHaveBeenCalledWith("C1", "123.456", "✅");
-  });
-
   it("removes reactions on empty emoji", async () => {
     const cfg = { channels: { slack: { botToken: "tok" } } } as ClawdbotConfig;
     await handleSlackAction(

src/agents/tools/slack-actions.ts

@@ -17,7 +17,6 @@ import {
   sendSlackMessage,
   unpinSlackMessage,
 } from "../../slack/actions.js";
-import { parseSlackTarget, resolveSlackChannelId } from "../../slack/targets.js";
 import { withNormalizedTimestamp } from "../date-time.js";
 import { createActionGate, jsonResult, readReactionParams, readStringParam } from "./common.js";
 
@@ -53,9 +52,10 @@ function resolveThreadTsFromContext(
   // No context or missing required fields
   if (!context?.currentThreadTs || !context?.currentChannelId) return undefined;
 
-  const parsedTarget = parseSlackTarget(targetChannel, { defaultKind: "channel" });
-  if (!parsedTarget || parsedTarget.kind !== "channel") return undefined;
-  const normalizedTarget = parsedTarget.id;
+  // Normalize target (strip "channel:" prefix if present)
+  const normalizedTarget = targetChannel.startsWith("channel:")
+    ? targetChannel.slice("channel:".length)
+    : targetChannel;
 
   // Different channel - don't inject
   if (normalizedTarget !== context.currentChannelId) return undefined;
@@ -76,12 +76,6 @@ export async function handleSlackAction(
   cfg: ClawdbotConfig,
   context?: SlackActionContext,
 ): Promise<AgentToolResult<unknown>> {
-  const resolveChannelId = () =>
-    resolveSlackChannelId(
-      readStringParam(params, "channelId", {
-        required: true,
-      }),
-    );
   const action = readStringParam(params, "action", { required: true });
   const accountId = readStringParam(params, "accountId");
   const account = resolveSlackAccount({ cfg, accountId });
@@ -115,7 +109,7 @@ export async function handleSlackAction(
     if (!isActionEnabled("reactions")) {
       throw new Error("Slack reactions are disabled.");
     }
-    const channelId = resolveChannelId();
+    const channelId = readStringParam(params, "channelId", { required: true });
     const messageId = readStringParam(params, "messageId", { required: true });
     if (action === "react") {
       const { emoji, remove, isEmpty } = readReactionParams(params, {
@@ -172,8 +166,8 @@ export async function handleSlackAction(
         // threadTs: once we send a message to the current channel, consider the
         // first reply "used" so later tool calls don't auto-thread again.
         if (context?.hasRepliedRef && context.currentChannelId) {
-          const parsedTarget = parseSlackTarget(to, { defaultKind: "channel" });
-          if (parsedTarget?.kind === "channel" && parsedTarget.id === context.currentChannelId) {
+          const normalizedTarget = to.startsWith("channel:") ? to.slice("channel:".length) : to;
+          if (normalizedTarget === context.currentChannelId) {
             context.hasRepliedRef.value = true;
           }
         }
@@ -181,7 +175,9 @@ export async function handleSlackAction(
         return jsonResult({ ok: true, result });
       }
       case "editMessage": {
-        const channelId = resolveChannelId();
+        const channelId = readStringParam(params, "channelId", {
+          required: true,
+        });
         const messageId = readStringParam(params, "messageId", {
           required: true,
         });
@@ -196,7 +192,9 @@ export async function handleSlackAction(
         return jsonResult({ ok: true });
       }
       case "deleteMessage": {
-        const channelId = resolveChannelId();
+        const channelId = readStringParam(params, "channelId", {
+          required: true,
+        });
         const messageId = readStringParam(params, "messageId", {
           required: true,
         });
@@ -208,7 +206,9 @@ export async function handleSlackAction(
         return jsonResult({ ok: true });
       }
       case "readMessages": {
-        const channelId = resolveChannelId();
+        const channelId = readStringParam(params, "channelId", {
+          required: true,
+        });
         const limitRaw = params.limit;
         const limit =
           typeof limitRaw === "number" && Number.isFinite(limitRaw) ? limitRaw : undefined;
@@ -237,7 +237,7 @@ export async function handleSlackAction(
     if (!isActionEnabled("pins")) {
       throw new Error("Slack pins are disabled.");
     }
-    const channelId = resolveChannelId();
+    const channelId = readStringParam(params, "channelId", { required: true });
     if (action === "pinMessage") {
       const messageId = readStringParam(params, "messageId", {
         required: true,

src/channels/allowlists/resolve-utils.ts

@@ -1,47 +0,0 @@
-import type { RuntimeEnv } from "../../runtime.js";
-
-export function mergeAllowlist(params: {
-  existing?: Array<string | number>;
-  additions: string[];
-}): string[] {
-  const seen = new Set<string>();
-  const merged: string[] = [];
-  const push = (value: string) => {
-    const normalized = value.trim();
-    if (!normalized) return;
-    const key = normalized.toLowerCase();
-    if (seen.has(key)) return;
-    seen.add(key);
-    merged.push(normalized);
-  };
-  for (const entry of params.existing ?? []) {
-    push(String(entry));
-  }
-  for (const entry of params.additions) {
-    push(entry);
-  }
-  return merged;
-}
-
-export function summarizeMapping(
-  label: string,
-  mapping: string[],
-  unresolved: string[],
-  runtime: RuntimeEnv,
-): void {
-  const lines: string[] = [];
-  if (mapping.length > 0) {
-    const sample = mapping.slice(0, 6);
-    const suffix = mapping.length > sample.length ? ` (+${mapping.length - sample.length})` : "";
-    lines.push(`${label} resolved: ${sample.join(", ")}${suffix}`);
-  }
-  if (unresolved.length > 0) {
-    const sample = unresolved.slice(0, 6);
-    const suffix =
-      unresolved.length > sample.length ? ` (+${unresolved.length - sample.length})` : "";
-    lines.push(`${label} unresolved: ${sample.join(", ")}${suffix}`);
-  }
-  if (lines.length > 0) {
-    runtime.log?.(lines.join("\n"));
-  }
-}

src/channels/plugins/actions/discord/handle-action.ts

@@ -7,7 +7,6 @@ import {
 import { handleDiscordAction } from "../../../../agents/tools/discord-actions.js";
 import type { ChannelMessageActionContext } from "../../types.js";
 import { tryHandleDiscordMessageActionGuildAdmin } from "./handle-action.guild-admin.js";
-import { resolveDiscordChannelId } from "../../../../discord/targets.js";
 
 const providerId = "discord";
 
@@ -23,9 +22,7 @@ export async function handleDiscordMessageAction(
   const { action, params, cfg } = ctx;
 
   const resolveChannelId = () =>
-    resolveDiscordChannelId(
-      readStringParam(params, "channelId") ?? readStringParam(params, "to", { required: true }),
-    );
+    readStringParam(params, "channelId") ?? readStringParam(params, "to", { required: true });
 
   if (action === "send") {
     const to = readStringParam(params, "to", { required: true });

src/channels/plugins/channel-config.ts

@@ -1,2 +0,0 @@
-export type { ChannelEntryMatch } from "../channel-config.js";
-export { buildChannelKeyCandidates, resolveChannelEntryMatch } from "../channel-config.js";

src/channels/plugins/directory-config.ts

@@ -4,7 +4,7 @@ import { resolveSlackAccount } from "../../slack/accounts.js";
 import { resolveDiscordAccount } from "../../discord/accounts.js";
 import { resolveTelegramAccount } from "../../telegram/accounts.js";
 import { resolveWhatsAppAccount } from "../../web/accounts.js";
-import { normalizeSlackMessagingTarget } from "./normalize/slack.js";
+import { normalizeSlackMessagingTarget } from "./normalize-target.js";
 import { isWhatsAppGroupJid, normalizeWhatsAppTarget } from "../../whatsapp/normalize.js";
 
 export type DirectoryConfigParams = {

src/channels/plugins/discord.ts

@@ -9,9 +9,11 @@ import {
   collectDiscordAuditChannelIds,
 } from "../../discord/audit.js";
 import { probeDiscord } from "../../discord/probe.js";
-import { resolveDiscordChannelAllowlist } from "../../discord/resolve-channels.js";
-import { resolveDiscordUserAllowlist } from "../../discord/resolve-users.js";
-import { sendMessageDiscord, sendPollDiscord } from "../../discord/send.js";
+import {
+  listGuildChannelsDiscord,
+  sendMessageDiscord,
+  sendPollDiscord,
+} from "../../discord/send.js";
 import { shouldLogVerbose } from "../../globals.js";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "../../routing/session-key.js";
 import { getChatChannelMeta } from "../registry.js";
@@ -24,10 +26,7 @@ import {
 } from "./config-helpers.js";
 import { resolveDiscordGroupRequireMention } from "./group-mentions.js";
 import { formatPairingApproveHint } from "./helpers.js";
-import {
-  looksLikeDiscordTargetId,
-  normalizeDiscordMessagingTarget,
-} from "./normalize/discord.js";
+import { looksLikeDiscordTargetId, normalizeDiscordMessagingTarget } from "./normalize-target.js";
 import { discordOnboardingAdapter } from "./onboarding/discord.js";
 import { PAIRING_APPROVED_MESSAGE } from "./pairing-message.js";
 import {
@@ -40,10 +39,6 @@ import {
   listDiscordDirectoryGroupsFromConfig,
   listDiscordDirectoryPeersFromConfig,
 } from "./directory-config.js";
-import {
-  listDiscordDirectoryGroupsLive,
-  listDiscordDirectoryPeersLive,
-} from "../../discord/directory-live.js";
 
 const meta = getChatChannelMeta("discord");
 
@@ -125,10 +120,9 @@ export const discordPlugin: ChannelPlugin<ResolvedDiscordAccount> = {
         normalizeEntry: (raw) => raw.replace(/^(discord|user):/i, "").replace(/^<@!?(\d+)>$/, "$1"),
       };
     },
-    collectWarnings: ({ account, cfg }) => {
+    collectWarnings: ({ account }) => {
       const warnings: string[] = [];
-      const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-      const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "open";
+      const groupPolicy = account.config.groupPolicy ?? "allowlist";
       const guildEntries = account.config.guilds ?? {};
       const guildsConfigured = Object.keys(guildEntries).length > 0;
       const channelAllowlistConfigured = guildsConfigured;
@@ -168,41 +162,29 @@ export const discordPlugin: ChannelPlugin<ResolvedDiscordAccount> = {
     self: async () => null,
     listPeers: async (params) => listDiscordDirectoryPeersFromConfig(params),
     listGroups: async (params) => listDiscordDirectoryGroupsFromConfig(params),
-    listPeersLive: async (params) => listDiscordDirectoryPeersLive(params),
-    listGroupsLive: async (params) => listDiscordDirectoryGroupsLive(params),
-  },
-  resolver: {
-    resolveTargets: async ({ cfg, accountId, inputs, kind }) => {
+    listGroupsLive: async ({ cfg, accountId, query, limit }) => {
       const account = resolveDiscordAccount({ cfg, accountId });
-      const token = account.token?.trim();
-      if (!token) {
-        return inputs.map((input) => ({
-          input,
-          resolved: false,
-          note: "missing Discord token",
-        }));
+      const q = query?.trim().toLowerCase() || "";
+      const guildIds = Object.keys(account.config.guilds ?? {}).filter((id) => /^\d+$/.test(id));
+      const rows: Array<{ kind: "group"; id: string; name?: string; raw?: unknown }> = [];
+      for (const guildId of guildIds) {
+        const channels = await listGuildChannelsDiscord(guildId, {
+          accountId: account.accountId,
+        });
+        for (const channel of channels) {
+          const name = typeof channel.name === "string" ? channel.name : undefined;
+          if (q && name && !name.toLowerCase().includes(q)) continue;
+          rows.push({
+            kind: "group",
+            id: `channel:${channel.id}`,
+            name: name ?? undefined,
+            raw: channel,
+          });
+        }
       }
-      if (kind === "group") {
-        const resolved = await resolveDiscordChannelAllowlist({ token, entries: inputs });
-        return resolved.map((entry) => ({
-          input: entry.input,
-          resolved: entry.resolved,
-          id: entry.channelId ?? entry.guildId,
-          name:
-            entry.channelName ??
-            entry.guildName ??
-            (entry.guildId && !entry.channelId ? entry.guildId : undefined),
-          note: entry.note,
-        }));
-      }
-      const resolved = await resolveDiscordUserAllowlist({ token, entries: inputs });
-      return resolved.map((entry) => ({
-        input: entry.input,
-        resolved: entry.resolved,
-        id: entry.id,
-        name: entry.name,
-        note: entry.note,
-      }));
+      const filtered = q ? rows.filter((row) => row.name?.toLowerCase().includes(q)) : rows;
+      const limited = typeof limit === "number" && limit > 0 ? filtered.slice(0, limit) : filtered;
+      return limited;
     },
   },
   actions: discordMessageActions,

src/channels/plugins/imessage.ts

@@ -95,9 +95,8 @@ export const imessagePlugin: ChannelPlugin<ResolvedIMessageAccount> = {
         approveHint: formatPairingApproveHint("imessage"),
       };
     },
-    collectWarnings: ({ account, cfg }) => {
-      const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-      const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+    collectWarnings: ({ account }) => {
+      const groupPolicy = account.config.groupPolicy ?? "allowlist";
       if (groupPolicy !== "open") return [];
       return [
         `- iMessage groups: groupPolicy="open" allows any member to trigger the bot. Set channels.imessage.groupPolicy="allowlist" + channels.imessage.groupAllowFrom to restrict senders.`,

src/channels/plugins/index.ts

@@ -84,9 +84,4 @@ export {
   listWhatsAppDirectoryGroupsFromConfig,
   listWhatsAppDirectoryPeersFromConfig,
 } from "./directory-config.js";
-export {
-  buildChannelKeyCandidates,
-  resolveChannelEntryMatch,
-  type ChannelEntryMatch,
-} from "./channel-config.js";
 export type { ChannelId, ChannelPlugin } from "./types.js";

src/channels/plugins/normalize-target.ts

@@ -0,0 +1,143 @@
+import { normalizeWhatsAppTarget } from "../../whatsapp/normalize.js";
+
+export function normalizeSlackMessagingTarget(raw: string): string | undefined {
+  const trimmed = raw.trim();
+  if (!trimmed) return undefined;
+  const mentionMatch = trimmed.match(/^<@([A-Z0-9]+)>$/i);
+  if (mentionMatch) return `user:${mentionMatch[1]}`.toLowerCase();
+  if (trimmed.startsWith("user:")) {
+    const id = trimmed.slice(5).trim();
+    return id ? `user:${id}`.toLowerCase() : undefined;
+  }
+  if (trimmed.startsWith("channel:")) {
+    const id = trimmed.slice(8).trim();
+    return id ? `channel:${id}`.toLowerCase() : undefined;
+  }
+  if (trimmed.startsWith("slack:")) {
+    const id = trimmed.slice(6).trim();
+    return id ? `user:${id}`.toLowerCase() : undefined;
+  }
+  if (trimmed.startsWith("@")) {
+    const id = trimmed.slice(1).trim();
+    return id ? `user:${id}`.toLowerCase() : undefined;
+  }
+  if (trimmed.startsWith("#")) {
+    const id = trimmed.slice(1).trim();
+    return id ? `channel:${id}`.toLowerCase() : undefined;
+  }
+  return `channel:${trimmed}`.toLowerCase();
+}
+
+export function looksLikeSlackTargetId(raw: string): boolean {
+  const trimmed = raw.trim();
+  if (!trimmed) return false;
+  if (/^<@([A-Z0-9]+)>$/i.test(trimmed)) return true;
+  if (/^(user|channel):/i.test(trimmed)) return true;
+  if (/^slack:/i.test(trimmed)) return true;
+  if (/^[@#]/.test(trimmed)) return true;
+  return /^[CUWGD][A-Z0-9]{8,}$/i.test(trimmed);
+}
+
+export function normalizeDiscordMessagingTarget(raw: string): string | undefined {
+  const trimmed = raw.trim();
+  if (!trimmed) return undefined;
+  const mentionMatch = trimmed.match(/^<@!?(\d+)>$/);
+  if (mentionMatch) return `user:${mentionMatch[1]}`.toLowerCase();
+  if (trimmed.startsWith("user:")) {
+    const id = trimmed.slice(5).trim();
+    return id ? `user:${id}`.toLowerCase() : undefined;
+  }
+  if (trimmed.startsWith("channel:")) {
+    const id = trimmed.slice(8).trim();
+    return id ? `channel:${id}`.toLowerCase() : undefined;
+  }
+  if (trimmed.startsWith("discord:")) {
+    const id = trimmed.slice(8).trim();
+    return id ? `user:${id}`.toLowerCase() : undefined;
+  }
+  if (trimmed.startsWith("@")) {
+    const id = trimmed.slice(1).trim();
+    return id ? `user:${id}`.toLowerCase() : undefined;
+  }
+  return `channel:${trimmed}`.toLowerCase();
+}
+
+export function looksLikeDiscordTargetId(raw: string): boolean {
+  const trimmed = raw.trim();
+  if (!trimmed) return false;
+  if (/^<@!?\d+>$/.test(trimmed)) return true;
+  if (/^(user|channel|discord):/i.test(trimmed)) return true;
+  if (/^\d{6,}$/.test(trimmed)) return true;
+  return false;
+}
+
+export function normalizeTelegramMessagingTarget(raw: string): string | undefined {
+  const trimmed = raw.trim();
+  if (!trimmed) return undefined;
+  let normalized = trimmed;
+  if (normalized.startsWith("telegram:")) {
+    normalized = normalized.slice("telegram:".length).trim();
+  } else if (normalized.startsWith("tg:")) {
+    normalized = normalized.slice("tg:".length).trim();
+  }
+  if (!normalized) return undefined;
+  const tmeMatch =
+    /^https?:\/\/t\.me\/([A-Za-z0-9_]+)$/i.exec(normalized) ??
+    /^t\.me\/([A-Za-z0-9_]+)$/i.exec(normalized);
+  if (tmeMatch?.[1]) normalized = `@${tmeMatch[1]}`;
+  if (!normalized) return undefined;
+  return `telegram:${normalized}`.toLowerCase();
+}
+
+export function looksLikeTelegramTargetId(raw: string): boolean {
+  const trimmed = raw.trim();
+  if (!trimmed) return false;
+  if (/^(telegram|tg):/i.test(trimmed)) return true;
+  if (trimmed.startsWith("@")) return true;
+  return /^-?\d{6,}$/.test(trimmed);
+}
+
+export function normalizeSignalMessagingTarget(raw: string): string | undefined {
+  const trimmed = raw.trim();
+  if (!trimmed) return undefined;
+  let normalized = trimmed;
+  if (normalized.toLowerCase().startsWith("signal:")) {
+    normalized = normalized.slice("signal:".length).trim();
+  }
+  if (!normalized) return undefined;
+  const lower = normalized.toLowerCase();
+  if (lower.startsWith("group:")) {
+    const id = normalized.slice("group:".length).trim();
+    return id ? `group:${id}`.toLowerCase() : undefined;
+  }
+  if (lower.startsWith("username:")) {
+    const id = normalized.slice("username:".length).trim();
+    return id ? `username:${id}`.toLowerCase() : undefined;
+  }
+  if (lower.startsWith("u:")) {
+    const id = normalized.slice("u:".length).trim();
+    return id ? `username:${id}`.toLowerCase() : undefined;
+  }
+  return normalized.toLowerCase();
+}
+
+export function looksLikeSignalTargetId(raw: string): boolean {
+  const trimmed = raw.trim();
+  if (!trimmed) return false;
+  if (/^(signal:)?(group:|username:|u:)/i.test(trimmed)) return true;
+  return /^\+?\d{3,}$/.test(trimmed);
+}
+
+export function normalizeWhatsAppMessagingTarget(raw: string): string | undefined {
+  const trimmed = raw.trim();
+  if (!trimmed) return undefined;
+  return normalizeWhatsAppTarget(trimmed) ?? undefined;
+}
+
+export function looksLikeWhatsAppTargetId(raw: string): boolean {
+  const trimmed = raw.trim();
+  if (!trimmed) return false;
+  if (/^whatsapp:/i.test(trimmed)) return true;
+  if (trimmed.includes("@")) return true;
+  return /^\+?\d{3,}$/.test(trimmed);
+}

src/channels/plugins/normalize/discord.ts

@@ -1,16 +0,0 @@
-import { parseDiscordTarget } from "../../../discord/targets.js";
-
-export function normalizeDiscordMessagingTarget(raw: string): string | undefined {
-  // Default bare IDs to channels so routing is stable across tool actions.
-  const target = parseDiscordTarget(raw, { defaultKind: "channel" });
-  return target?.normalized;
-}
-
-export function looksLikeDiscordTargetId(raw: string): boolean {
-  const trimmed = raw.trim();
-  if (!trimmed) return false;
-  if (/^<@!?\d+>$/.test(trimmed)) return true;
-  if (/^(user|channel|discord):/i.test(trimmed)) return true;
-  if (/^\d{6,}$/.test(trimmed)) return true;
-  return false;
-}

src/channels/plugins/normalize/signal.ts

@@ -1,30 +0,0 @@
-export function normalizeSignalMessagingTarget(raw: string): string | undefined {
-  const trimmed = raw.trim();
-  if (!trimmed) return undefined;
-  let normalized = trimmed;
-  if (normalized.toLowerCase().startsWith("signal:")) {
-    normalized = normalized.slice("signal:".length).trim();
-  }
-  if (!normalized) return undefined;
-  const lower = normalized.toLowerCase();
-  if (lower.startsWith("group:")) {
-    const id = normalized.slice("group:".length).trim();
-    return id ? `group:${id}`.toLowerCase() : undefined;
-  }
-  if (lower.startsWith("username:")) {
-    const id = normalized.slice("username:".length).trim();
-    return id ? `username:${id}`.toLowerCase() : undefined;
-  }
-  if (lower.startsWith("u:")) {
-    const id = normalized.slice("u:".length).trim();
-    return id ? `username:${id}`.toLowerCase() : undefined;
-  }
-  return normalized.toLowerCase();
-}
-
-export function looksLikeSignalTargetId(raw: string): boolean {
-  const trimmed = raw.trim();
-  if (!trimmed) return false;
-  if (/^(signal:)?(group:|username:|u:)/i.test(trimmed)) return true;
-  return /^\+?\d{3,}$/.test(trimmed);
-}

src/channels/plugins/normalize/slack.ts

@@ -1,16 +0,0 @@
-import { parseSlackTarget } from "../../../slack/targets.js";
-
-export function normalizeSlackMessagingTarget(raw: string): string | undefined {
-  const target = parseSlackTarget(raw, { defaultKind: "channel" });
-  return target?.normalized;
-}
-
-export function looksLikeSlackTargetId(raw: string): boolean {
-  const trimmed = raw.trim();
-  if (!trimmed) return false;
-  if (/^<@([A-Z0-9]+)>$/i.test(trimmed)) return true;
-  if (/^(user|channel):/i.test(trimmed)) return true;
-  if (/^slack:/i.test(trimmed)) return true;
-  if (/^[@#]/.test(trimmed)) return true;
-  return /^[CUWGD][A-Z0-9]{8,}$/i.test(trimmed);
-}

src/channels/plugins/normalize/telegram.ts

@@ -1,25 +0,0 @@
-export function normalizeTelegramMessagingTarget(raw: string): string | undefined {
-  const trimmed = raw.trim();
-  if (!trimmed) return undefined;
-  let normalized = trimmed;
-  if (normalized.startsWith("telegram:")) {
-    normalized = normalized.slice("telegram:".length).trim();
-  } else if (normalized.startsWith("tg:")) {
-    normalized = normalized.slice("tg:".length).trim();
-  }
-  if (!normalized) return undefined;
-  const tmeMatch =
-    /^https?:\/\/t\.me\/([A-Za-z0-9_]+)$/i.exec(normalized) ??
-    /^t\.me\/([A-Za-z0-9_]+)$/i.exec(normalized);
-  if (tmeMatch?.[1]) normalized = `@${tmeMatch[1]}`;
-  if (!normalized) return undefined;
-  return `telegram:${normalized}`.toLowerCase();
-}
-
-export function looksLikeTelegramTargetId(raw: string): boolean {
-  const trimmed = raw.trim();
-  if (!trimmed) return false;
-  if (/^(telegram|tg):/i.test(trimmed)) return true;
-  if (trimmed.startsWith("@")) return true;
-  return /^-?\d{6,}$/.test(trimmed);
-}

src/channels/plugins/normalize/whatsapp.ts

@@ -1,15 +0,0 @@
-import { normalizeWhatsAppTarget } from "../../../whatsapp/normalize.js";
-
-export function normalizeWhatsAppMessagingTarget(raw: string): string | undefined {
-  const trimmed = raw.trim();
-  if (!trimmed) return undefined;
-  return normalizeWhatsAppTarget(trimmed) ?? undefined;
-}
-
-export function looksLikeWhatsAppTargetId(raw: string): boolean {
-  const trimmed = raw.trim();
-  if (!trimmed) return false;
-  if (/^whatsapp:/i.test(trimmed)) return true;
-  if (trimmed.includes("@")) return true;
-  return /^\+?\d{3,}$/.test(trimmed);
-}

src/channels/plugins/onboarding/channel-access.ts

@@ -1,93 +0,0 @@
-import type { WizardPrompter } from "../../../wizard/prompts.js";
-
-export type ChannelAccessPolicy = "allowlist" | "open" | "disabled";
-
-export function parseAllowlistEntries(raw: string): string[] {
-  return String(raw ?? "")
-    .split(/[,\n]/g)
-    .map((entry) => entry.trim())
-    .filter(Boolean);
-}
-
-export function formatAllowlistEntries(entries: string[]): string {
-  return entries.map((entry) => entry.trim()).filter(Boolean).join(", ");
-}
-
-export async function promptChannelAccessPolicy(params: {
-  prompter: WizardPrompter;
-  label: string;
-  currentPolicy?: ChannelAccessPolicy;
-  allowOpen?: boolean;
-  allowDisabled?: boolean;
-}): Promise<ChannelAccessPolicy> {
-  const options: Array<{ value: ChannelAccessPolicy; label: string }> = [
-    { value: "allowlist", label: "Allowlist (recommended)" },
-  ];
-  if (params.allowOpen !== false) {
-    options.push({ value: "open", label: "Open (allow all channels)" });
-  }
-  if (params.allowDisabled !== false) {
-    options.push({ value: "disabled", label: "Disabled (block all channels)" });
-  }
-  const initialValue = params.currentPolicy ?? "allowlist";
-  return (await params.prompter.select({
-    message: `${params.label} access`,
-    options,
-    initialValue,
-  })) as ChannelAccessPolicy;
-}
-
-export async function promptChannelAllowlist(params: {
-  prompter: WizardPrompter;
-  label: string;
-  currentEntries?: string[];
-  placeholder?: string;
-}): Promise<string[]> {
-  const initialValue =
-    params.currentEntries && params.currentEntries.length > 0
-      ? formatAllowlistEntries(params.currentEntries)
-      : undefined;
-  const raw = await params.prompter.text({
-    message: `${params.label} allowlist (comma-separated)`,
-    placeholder: params.placeholder,
-    initialValue,
-  });
-  return parseAllowlistEntries(raw);
-}
-
-export async function promptChannelAccessConfig(params: {
-  prompter: WizardPrompter;
-  label: string;
-  currentPolicy?: ChannelAccessPolicy;
-  currentEntries?: string[];
-  placeholder?: string;
-  allowOpen?: boolean;
-  allowDisabled?: boolean;
-  defaultPrompt?: boolean;
-  updatePrompt?: boolean;
-}): Promise<{ policy: ChannelAccessPolicy; entries: string[] } | null> {
-  const hasEntries = (params.currentEntries ?? []).length > 0;
-  const shouldPrompt = params.defaultPrompt ?? !hasEntries;
-  const wants = await params.prompter.confirm({
-    message: params.updatePrompt
-      ? `Update ${params.label} access?`
-      : `Configure ${params.label} access?`,
-    initialValue: shouldPrompt,
-  });
-  if (!wants) return null;
-  const policy = await promptChannelAccessPolicy({
-    prompter: params.prompter,
-    label: params.label,
-    currentPolicy: params.currentPolicy,
-    allowOpen: params.allowOpen,
-    allowDisabled: params.allowDisabled,
-  });
-  if (policy !== "allowlist") return { policy, entries: [] };
-  const entries = await promptChannelAllowlist({
-    prompter: params.prompter,
-    label: params.label,
-    currentEntries: params.currentEntries,
-    placeholder: params.placeholder,
-  });
-  return { policy, entries };
-}

src/channels/plugins/onboarding/discord.ts

@@ -1,21 +1,14 @@
 import type { ClawdbotConfig } from "../../../config/config.js";
 import type { DmPolicy } from "../../../config/types.js";
-import type { DiscordGuildEntry } from "../../../config/types.discord.js";
 import {
   listDiscordAccountIds,
   resolveDefaultDiscordAccountId,
   resolveDiscordAccount,
 } from "../../../discord/accounts.js";
-import { normalizeDiscordSlug } from "../../../discord/monitor/allow-list.js";
-import {
-  resolveDiscordChannelAllowlist,
-  type DiscordChannelResolution,
-} from "../../../discord/resolve-channels.js";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "../../../routing/session-key.js";
 import { formatDocsLink } from "../../../terminal/links.js";
 import type { WizardPrompter } from "../../../wizard/prompts.js";
 import type { ChannelOnboardingAdapter, ChannelOnboardingDmPolicy } from "../onboarding-types.js";
-import { promptChannelAccessConfig } from "./channel-access.js";
 import { addWildcardAllowFrom, promptAccountId } from "./helpers.js";
 
 const channel = "discord" as const;
@@ -53,101 +46,6 @@ async function noteDiscordTokenHelp(prompter: WizardPrompter): Promise<void> {
   );
 }
 
-function setDiscordGroupPolicy(
-  cfg: ClawdbotConfig,
-  accountId: string,
-  groupPolicy: "open" | "allowlist" | "disabled",
-): ClawdbotConfig {
-  if (accountId === DEFAULT_ACCOUNT_ID) {
-    return {
-      ...cfg,
-      channels: {
-        ...cfg.channels,
-        discord: {
-          ...cfg.channels?.discord,
-          enabled: true,
-          groupPolicy,
-        },
-      },
-    };
-  }
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      discord: {
-        ...cfg.channels?.discord,
-        enabled: true,
-        accounts: {
-          ...cfg.channels?.discord?.accounts,
-          [accountId]: {
-            ...cfg.channels?.discord?.accounts?.[accountId],
-            enabled: cfg.channels?.discord?.accounts?.[accountId]?.enabled ?? true,
-            groupPolicy,
-          },
-        },
-      },
-    },
-  };
-}
-
-function setDiscordGuildChannelAllowlist(
-  cfg: ClawdbotConfig,
-  accountId: string,
-  entries: Array<{
-    guildKey: string;
-    channelKey?: string;
-  }>,
-): ClawdbotConfig {
-  const baseGuilds =
-    accountId === DEFAULT_ACCOUNT_ID
-      ? (cfg.channels?.discord?.guilds ?? {})
-      : (cfg.channels?.discord?.accounts?.[accountId]?.guilds ?? {});
-  const guilds: Record<string, DiscordGuildEntry> = { ...baseGuilds };
-  for (const entry of entries) {
-    const guildKey = entry.guildKey || "*";
-    const existing = guilds[guildKey] ?? {};
-    if (entry.channelKey) {
-      const channels = { ...existing.channels };
-      channels[entry.channelKey] = { allow: true };
-      guilds[guildKey] = { ...existing, channels };
-    } else {
-      guilds[guildKey] = existing;
-    }
-  }
-  if (accountId === DEFAULT_ACCOUNT_ID) {
-    return {
-      ...cfg,
-      channels: {
-        ...cfg.channels,
-        discord: {
-          ...cfg.channels?.discord,
-          enabled: true,
-          guilds,
-        },
-      },
-    };
-  }
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      discord: {
-        ...cfg.channels?.discord,
-        enabled: true,
-        accounts: {
-          ...cfg.channels?.discord?.accounts,
-          [accountId]: {
-            ...cfg.channels?.discord?.accounts?.[accountId],
-            enabled: cfg.channels?.discord?.accounts?.[accountId]?.enabled ?? true,
-            guilds,
-          },
-        },
-      },
-    },
-  };
-}
-
 const dmPolicy: ChannelOnboardingDmPolicy = {
   label: "Discord",
   channel,
@@ -276,94 +174,6 @@ export const discordOnboardingAdapter: ChannelOnboardingAdapter = {
       }
     }
 
-    const currentEntries = Object.entries(resolvedAccount.config.guilds ?? {}).flatMap(
-      ([guildKey, value]) => {
-        const channels = value?.channels ?? {};
-        const channelKeys = Object.keys(channels);
-        if (channelKeys.length === 0) return [guildKey];
-        return channelKeys.map((channelKey) => `${guildKey}/${channelKey}`);
-      },
-    );
-    const accessConfig = await promptChannelAccessConfig({
-      prompter,
-      label: "Discord channels",
-      currentPolicy: resolvedAccount.config.groupPolicy ?? "allowlist",
-      currentEntries,
-      placeholder: "My Server/#general, guildId/channelId, #support",
-      updatePrompt: Boolean(resolvedAccount.config.guilds),
-    });
-    if (accessConfig) {
-      if (accessConfig.policy !== "allowlist") {
-        next = setDiscordGroupPolicy(next, discordAccountId, accessConfig.policy);
-      } else {
-        const accountWithTokens = resolveDiscordAccount({
-          cfg: next,
-          accountId: discordAccountId,
-        });
-        let resolved: DiscordChannelResolution[] = accessConfig.entries.map((input) => ({
-          input,
-          resolved: false,
-        }));
-        if (accountWithTokens.token && accessConfig.entries.length > 0) {
-          try {
-            resolved = await resolveDiscordChannelAllowlist({
-              token: accountWithTokens.token,
-              entries: accessConfig.entries,
-            });
-            const resolvedChannels = resolved.filter(
-              (entry) => entry.resolved && entry.channelId,
-            );
-            const resolvedGuilds = resolved.filter(
-              (entry) => entry.resolved && entry.guildId && !entry.channelId,
-            );
-            const unresolved = resolved.filter((entry) => !entry.resolved).map((entry) => entry.input);
-            if (resolvedChannels.length > 0 || resolvedGuilds.length > 0 || unresolved.length > 0) {
-              const summary: string[] = [];
-              if (resolvedChannels.length > 0) {
-                summary.push(
-                  `Resolved channels: ${resolvedChannels
-                    .map((entry) => entry.channelId)
-                    .filter(Boolean)
-                    .join(", ")}`,
-                );
-              }
-              if (resolvedGuilds.length > 0) {
-                summary.push(
-                  `Resolved guilds: ${resolvedGuilds
-                    .map((entry) => entry.guildId)
-                    .filter(Boolean)
-                    .join(", ")}`,
-                );
-              }
-              if (unresolved.length > 0) {
-                summary.push(`Unresolved (kept as typed): ${unresolved.join(", ")}`);
-              }
-              await prompter.note(summary.join("\n"), "Discord channels");
-            }
-          } catch (err) {
-            await prompter.note(
-              `Channel lookup failed; keeping entries as typed. ${String(err)}`,
-              "Discord channels",
-            );
-          }
-        }
-        const allowlistEntries: Array<{ guildKey: string; channelKey?: string }> = [];
-        for (const entry of resolved) {
-          const guildKey =
-            entry.guildId ??
-            (entry.guildName ? normalizeDiscordSlug(entry.guildName) : undefined) ??
-            "*";
-          const channelKey =
-            entry.channelId ??
-            (entry.channelName ? normalizeDiscordSlug(entry.channelName) : undefined);
-          if (!channelKey && guildKey === "*") continue;
-          allowlistEntries.push({ guildKey, ...(channelKey ? { channelKey } : {}) });
-        }
-        next = setDiscordGroupPolicy(next, discordAccountId, "allowlist");
-        next = setDiscordGuildChannelAllowlist(next, discordAccountId, allowlistEntries);
-      }
-    }
-
     return { cfg: next, accountId: discordAccountId };
   },
   dmPolicy,

src/channels/plugins/onboarding/slack.ts

@@ -6,11 +6,9 @@ import {
   resolveDefaultSlackAccountId,
   resolveSlackAccount,
 } from "../../../slack/accounts.js";
-import { resolveSlackChannelAllowlist } from "../../../slack/resolve-channels.js";
 import { formatDocsLink } from "../../../terminal/links.js";
 import type { WizardPrompter } from "../../../wizard/prompts.js";
 import type { ChannelOnboardingAdapter, ChannelOnboardingDmPolicy } from "../onboarding-types.js";
-import { promptChannelAccessConfig } from "./channel-access.js";
 import { addWildcardAllowFrom, promptAccountId } from "./helpers.js";
 
 const channel = "slack" as const;
@@ -123,85 +121,6 @@ async function noteSlackTokenHelp(prompter: WizardPrompter, botName: string): Pr
   );
 }
 
-function setSlackGroupPolicy(
-  cfg: ClawdbotConfig,
-  accountId: string,
-  groupPolicy: "open" | "allowlist" | "disabled",
-): ClawdbotConfig {
-  if (accountId === DEFAULT_ACCOUNT_ID) {
-    return {
-      ...cfg,
-      channels: {
-        ...cfg.channels,
-        slack: {
-          ...cfg.channels?.slack,
-          enabled: true,
-          groupPolicy,
-        },
-      },
-    };
-  }
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      slack: {
-        ...cfg.channels?.slack,
-        enabled: true,
-        accounts: {
-          ...cfg.channels?.slack?.accounts,
-          [accountId]: {
-            ...cfg.channels?.slack?.accounts?.[accountId],
-            enabled: cfg.channels?.slack?.accounts?.[accountId]?.enabled ?? true,
-            groupPolicy,
-          },
-        },
-      },
-    },
-  };
-}
-
-function setSlackChannelAllowlist(
-  cfg: ClawdbotConfig,
-  accountId: string,
-  channelKeys: string[],
-): ClawdbotConfig {
-  const channels = Object.fromEntries(
-    channelKeys.map((key) => [key, { allow: true }]),
-  );
-  if (accountId === DEFAULT_ACCOUNT_ID) {
-    return {
-      ...cfg,
-      channels: {
-        ...cfg.channels,
-        slack: {
-          ...cfg.channels?.slack,
-          enabled: true,
-          channels,
-        },
-      },
-    };
-  }
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      slack: {
-        ...cfg.channels?.slack,
-        enabled: true,
-        accounts: {
-          ...cfg.channels?.slack?.accounts,
-          [accountId]: {
-            ...cfg.channels?.slack?.accounts?.[accountId],
-            enabled: cfg.channels?.slack?.accounts?.[accountId]?.enabled ?? true,
-            channels,
-          },
-        },
-      },
-    },
-  };
-}
-
 const dmPolicy: ChannelOnboardingDmPolicy = {
   label: "Slack",
   channel,
@@ -365,68 +284,6 @@ export const slackOnboardingAdapter: ChannelOnboardingAdapter = {
       }
     }
 
-    const accessConfig = await promptChannelAccessConfig({
-      prompter,
-      label: "Slack channels",
-      currentPolicy: resolvedAccount.config.groupPolicy ?? "allowlist",
-      currentEntries: Object.entries(resolvedAccount.config.channels ?? {})
-        .filter(([, value]) => value?.allow !== false && value?.enabled !== false)
-        .map(([key]) => key),
-      placeholder: "#general, #private, C123",
-      updatePrompt: Boolean(resolvedAccount.config.channels),
-    });
-    if (accessConfig) {
-      if (accessConfig.policy !== "allowlist") {
-        next = setSlackGroupPolicy(next, slackAccountId, accessConfig.policy);
-      } else {
-        let keys = accessConfig.entries;
-        const accountWithTokens = resolveSlackAccount({
-          cfg: next,
-          accountId: slackAccountId,
-        });
-        if (accountWithTokens.botToken && accessConfig.entries.length > 0) {
-          try {
-            const resolved = await resolveSlackChannelAllowlist({
-              token: accountWithTokens.botToken,
-              entries: accessConfig.entries,
-            });
-            const resolvedKeys = resolved
-              .filter((entry) => entry.resolved && entry.id)
-              .map((entry) => entry.id as string);
-            const unresolved = resolved
-              .filter((entry) => !entry.resolved)
-              .map((entry) => entry.input);
-            keys = [
-              ...resolvedKeys,
-              ...unresolved.map((entry) => entry.trim()).filter(Boolean),
-            ];
-            if (resolvedKeys.length > 0 || unresolved.length > 0) {
-              await prompter.note(
-                [
-                  resolvedKeys.length > 0
-                    ? `Resolved: ${resolvedKeys.join(", ")}`
-                    : undefined,
-                  unresolved.length > 0
-                    ? `Unresolved (kept as typed): ${unresolved.join(", ")}`
-                    : undefined,
-                ]
-                  .filter(Boolean)
-                  .join("\n"),
-                "Slack channels",
-              );
-            }
-          } catch (err) {
-            await prompter.note(
-              `Channel lookup failed; keeping entries as typed. ${String(err)}`,
-              "Slack channels",
-            );
-          }
-        }
-        next = setSlackGroupPolicy(next, slackAccountId, "allowlist");
-        next = setSlackChannelAllowlist(next, slackAccountId, keys);
-      }
-    }
-
     return { cfg: next, accountId: slackAccountId };
   },
   dmPolicy,

src/channels/plugins/signal.ts

@@ -18,10 +18,7 @@ import {
 } from "./config-helpers.js";
 import { formatPairingApproveHint } from "./helpers.js";
 import { resolveChannelMediaMaxBytes } from "./media-limits.js";
-import {
-  looksLikeSignalTargetId,
-  normalizeSignalMessagingTarget,
-} from "./normalize/signal.js";
+import { looksLikeSignalTargetId, normalizeSignalMessagingTarget } from "./normalize-target.js";
 import { signalOnboardingAdapter } from "./onboarding/signal.js";
 import { PAIRING_APPROVED_MESSAGE } from "./pairing-message.js";
 import {
@@ -108,9 +105,8 @@ export const signalPlugin: ChannelPlugin<ResolvedSignalAccount> = {
         normalizeEntry: (raw) => normalizeE164(raw.replace(/^signal:/i, "").trim()),
       };
     },
-    collectWarnings: ({ account, cfg }) => {
-      const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-      const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+    collectWarnings: ({ account }) => {
+      const groupPolicy = account.config.groupPolicy ?? "allowlist";
       if (groupPolicy !== "open") return [];
       return [
         `- Signal groups: groupPolicy="open" allows any member to trigger the bot. Set channels.signal.groupPolicy="allowlist" + channels.signal.groupAllowFrom to restrict senders.`,

src/channels/plugins/slack.actions.ts

@@ -1,7 +1,6 @@
 import { createActionGate, readNumberParam, readStringParam } from "../../agents/tools/common.js";
 import { handleSlackAction, type SlackActionContext } from "../../agents/tools/slack-actions.js";
 import { listEnabledSlackAccounts } from "../../slack/accounts.js";
-import { resolveSlackChannelId } from "../../slack/targets.js";
 import type {
   ChannelMessageActionAdapter,
   ChannelMessageActionContext,
@@ -61,9 +60,7 @@ export function createSlackActions(providerId: string): ChannelMessageActionAdap
       const accountId = ctx.accountId ?? undefined;
       const toolContext = ctx.toolContext as SlackActionContext | undefined;
       const resolveChannelId = () =>
-        resolveSlackChannelId(
-          readStringParam(params, "channelId") ?? readStringParam(params, "to", { required: true }),
-        );
+        readStringParam(params, "channelId") ?? readStringParam(params, "to", { required: true });
 
       if (action === "send") {
         const to = readStringParam(params, "to", { required: true });

src/channels/plugins/slack.ts

@@ -9,8 +9,6 @@ import {
   resolveDefaultSlackAccountId,
   resolveSlackAccount,
 } from "../../slack/accounts.js";
-import { resolveSlackChannelAllowlist } from "../../slack/resolve-channels.js";
-import { resolveSlackUserAllowlist } from "../../slack/resolve-users.js";
 import { probeSlack } from "../../slack/probe.js";
 import { sendMessageSlack } from "../../slack/send.js";
 import { getChatChannelMeta } from "../registry.js";
@@ -22,7 +20,7 @@ import {
 } from "./config-helpers.js";
 import { resolveSlackGroupRequireMention } from "./group-mentions.js";
 import { formatPairingApproveHint } from "./helpers.js";
-import { looksLikeSlackTargetId, normalizeSlackMessagingTarget } from "./normalize/slack.js";
+import { looksLikeSlackTargetId, normalizeSlackMessagingTarget } from "./normalize-target.js";
 import { slackOnboardingAdapter } from "./onboarding/slack.js";
 import { PAIRING_APPROVED_MESSAGE } from "./pairing-message.js";
 import {
@@ -34,10 +32,6 @@ import {
   listSlackDirectoryGroupsFromConfig,
   listSlackDirectoryPeersFromConfig,
 } from "./directory-config.js";
-import {
-  listSlackDirectoryGroupsLive,
-  listSlackDirectoryPeersLive,
-} from "../../slack/directory-live.js";
 
 const meta = getChatChannelMeta("slack");
 
@@ -144,10 +138,9 @@ export const slackPlugin: ChannelPlugin<ResolvedSlackAccount> = {
         normalizeEntry: (raw) => raw.replace(/^(slack|user):/i, ""),
       };
     },
-    collectWarnings: ({ account, cfg }) => {
+    collectWarnings: ({ account }) => {
       const warnings: string[] = [];
-      const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-      const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "open";
+      const groupPolicy = account.config.groupPolicy ?? "allowlist";
       const channelAllowlistConfigured =
         Boolean(account.config.channels) && Object.keys(account.config.channels ?? {}).length > 0;
 
@@ -197,39 +190,6 @@ export const slackPlugin: ChannelPlugin<ResolvedSlackAccount> = {
     self: async () => null,
     listPeers: async (params) => listSlackDirectoryPeersFromConfig(params),
     listGroups: async (params) => listSlackDirectoryGroupsFromConfig(params),
-    listPeersLive: async (params) => listSlackDirectoryPeersLive(params),
-    listGroupsLive: async (params) => listSlackDirectoryGroupsLive(params),
-  },
-  resolver: {
-    resolveTargets: async ({ cfg, accountId, inputs, kind }) => {
-      const account = resolveSlackAccount({ cfg, accountId });
-      const token = account.config.userToken?.trim() || account.botToken?.trim();
-      if (!token) {
-        return inputs.map((input) => ({
-          input,
-          resolved: false,
-          note: "missing Slack token",
-        }));
-      }
-      if (kind === "group") {
-        const resolved = await resolveSlackChannelAllowlist({ token, entries: inputs });
-        return resolved.map((entry) => ({
-          input: entry.input,
-          resolved: entry.resolved,
-          id: entry.id,
-          name: entry.name,
-          note: entry.archived ? "archived" : undefined,
-        }));
-      }
-      const resolved = await resolveSlackUserAllowlist({ token, entries: inputs });
-      return resolved.map((entry) => ({
-        input: entry.input,
-        resolved: entry.resolved,
-        id: entry.id,
-        name: entry.name,
-        note: entry.note,
-      }));
-    },
   },
   actions: {
     listActions: ({ cfg }) => {

src/channels/plugins/status-issues/discord.ts

@@ -24,8 +24,6 @@ type DiscordPermissionsAuditSummary = {
     ok?: boolean;
     missing?: string[];
     error?: string | null;
-    matchKey?: string;
-    matchSource?: string;
   }>;
 };
 
@@ -74,15 +72,11 @@ function readDiscordPermissionsAuditSummary(value: unknown): DiscordPermissionsA
             ? entry.missing.map((v) => asString(v)).filter(Boolean)
             : undefined;
           const error = asString(entry.error) ?? null;
-          const matchKey = asString(entry.matchKey) ?? undefined;
-          const matchSource = asString(entry.matchSource) ?? undefined;
           return {
             channelId,
             ok,
             missing: missing?.length ? missing : undefined,
             error,
-            matchKey,
-            matchSource,
           };
         })
         .filter(Boolean) as DiscordPermissionsAuditSummary["channels"])
@@ -128,15 +122,11 @@ export function collectDiscordStatusIssues(
       if (channel.ok === true) continue;
       const missing = channel.missing?.length ? ` missing ${channel.missing.join(", ")}` : "";
       const error = channel.error ? `: ${channel.error}` : "";
-      const matchMeta =
-        channel.matchKey || channel.matchSource
-          ? ` (matchKey=${channel.matchKey ?? "none"} matchSource=${channel.matchSource ?? "none"})`
-          : "";
       issues.push({
         channel: "discord",
         accountId,
         kind: "permissions",
-        message: `Channel ${channel.channelId} permission check failed.${missing}${error}${matchMeta}`,
+        message: `Channel ${channel.channelId} permission check failed.${missing}${error}`,
         fix: "Ensure the bot role can view + send in this channel (and that channel overrides don't deny it).",
       });
     }

src/channels/plugins/status-issues/telegram.ts

@@ -17,8 +17,6 @@ type TelegramGroupMembershipAuditSummary = {
     ok?: boolean;
     status?: string | null;
     error?: string | null;
-    matchKey?: string;
-    matchSource?: string;
   }>;
 };
 
@@ -55,9 +53,7 @@ function readTelegramGroupMembershipAuditSummary(
           const ok = typeof entry.ok === "boolean" ? entry.ok : undefined;
           const status = asString(entry.status) ?? null;
           const error = asString(entry.error) ?? null;
-          const matchKey = asString(entry.matchKey) ?? undefined;
-          const matchSource = asString(entry.matchSource) ?? undefined;
-          return { chatId, ok, status, error, matchKey, matchSource };
+          return { chatId, ok, status, error };
         })
         .filter(Boolean) as TelegramGroupMembershipAuditSummary["groups"])
     : undefined;
@@ -111,15 +107,11 @@ export function collectTelegramStatusIssues(
       if (group.ok === true) continue;
       const status = group.status ? ` status=${group.status}` : "";
       const err = group.error ? `: ${group.error}` : "";
-      const matchMeta =
-        group.matchKey || group.matchSource
-          ? ` (matchKey=${group.matchKey ?? "none"} matchSource=${group.matchSource ?? "none"})`
-          : "";
       issues.push({
         channel: "telegram",
         accountId,
         kind: "runtime",
-        message: `Group ${group.chatId} not reachable by bot.${status}${err}${matchMeta}`,
+        message: `Group ${group.chatId} not reachable by bot.${status}${err}`,
         fix: "Invite the bot to the group, then DM the bot once (/start) and restart the gateway.",
       });
     }

src/channels/plugins/telegram.ts

@@ -26,10 +26,7 @@ import {
 } from "./config-helpers.js";
 import { resolveTelegramGroupRequireMention } from "./group-mentions.js";
 import { formatPairingApproveHint } from "./helpers.js";
-import {
-  looksLikeTelegramTargetId,
-  normalizeTelegramMessagingTarget,
-} from "./normalize/telegram.js";
+import { looksLikeTelegramTargetId, normalizeTelegramMessagingTarget } from "./normalize-target.js";
 import { telegramOnboardingAdapter } from "./onboarding/telegram.js";
 import { PAIRING_APPROVED_MESSAGE } from "./pairing-message.js";
 import {
@@ -141,9 +138,8 @@ export const telegramPlugin: ChannelPlugin<ResolvedTelegramAccount> = {
         normalizeEntry: (raw) => raw.replace(/^(telegram|tg):/i, ""),
       };
     },
-    collectWarnings: ({ account, cfg }) => {
-      const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-      const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+    collectWarnings: ({ account }) => {
+      const groupPolicy = account.config.groupPolicy ?? "allowlist";
       if (groupPolicy !== "open") return [];
       const groupAllowlistConfigured =
         account.config.groups && Object.keys(account.config.groups).length > 0;

src/channels/plugins/types.adapters.ts

@@ -263,26 +263,6 @@ export type ChannelDirectoryAdapter = {
   }) => Promise<ChannelDirectoryEntry[]>;
 };
 
-export type ChannelResolveKind = "user" | "group";
-
-export type ChannelResolveResult = {
-  input: string;
-  resolved: boolean;
-  id?: string;
-  name?: string;
-  note?: string;
-};
-
-export type ChannelResolverAdapter = {
-  resolveTargets: (params: {
-    cfg: ClawdbotConfig;
-    accountId?: string | null;
-    inputs: string[];
-    kind: ChannelResolveKind;
-    runtime: RuntimeEnv;
-  }) => Promise<ChannelResolveResult[]>;
-};
-
 export type ChannelElevatedAdapter = {
   allowFromFallback?: (params: {
     cfg: ClawdbotConfig;

src/channels/plugins/types.core.ts

@@ -236,7 +236,6 @@ export type ChannelDirectoryEntry = {
   name?: string;
   handle?: string;
   avatarUrl?: string;
-  rank?: number;
   raw?: unknown;
 };
 

src/channels/plugins/types.plugin.ts

@@ -4,7 +4,6 @@ import type {
   ChannelCommandAdapter,
   ChannelConfigAdapter,
   ChannelDirectoryAdapter,
-  ChannelResolverAdapter,
   ChannelElevatedAdapter,
   ChannelGatewayAdapter,
   ChannelGroupAdapter,
@@ -69,7 +68,6 @@ export type ChannelPlugin<ResolvedAccount = any> = {
   threading?: ChannelThreadingAdapter;
   messaging?: ChannelMessagingAdapter;
   directory?: ChannelDirectoryAdapter;
-  resolver?: ChannelResolverAdapter;
   actions?: ChannelMessageActionAdapter;
   heartbeat?: ChannelHeartbeatAdapter;
   // Channel-owned agent tools (login flows, etc.).

src/channels/plugins/types.ts

@@ -9,9 +9,6 @@ export type {
   ChannelCommandAdapter,
   ChannelConfigAdapter,
   ChannelDirectoryAdapter,
-  ChannelResolveKind,
-  ChannelResolveResult,
-  ChannelResolverAdapter,
   ChannelElevatedAdapter,
   ChannelGatewayAdapter,
   ChannelGatewayContext,

src/channels/plugins/whatsapp.ts

@@ -26,10 +26,7 @@ import { buildChannelConfigSchema } from "./config-schema.js";
 import { createWhatsAppLoginTool } from "./agent-tools/whatsapp-login.js";
 import { resolveWhatsAppGroupRequireMention } from "./group-mentions.js";
 import { formatPairingApproveHint } from "./helpers.js";
-import {
-  looksLikeWhatsAppTargetId,
-  normalizeWhatsAppMessagingTarget,
-} from "./normalize/whatsapp.js";
+import { looksLikeWhatsAppTargetId, normalizeWhatsAppMessagingTarget } from "./normalize-target.js";
 import { whatsappOnboardingAdapter } from "./onboarding/whatsapp.js";
 import {
   applyAccountNameToChannelSection,
@@ -149,9 +146,8 @@ export const whatsappPlugin: ChannelPlugin<ResolvedWhatsAppAccount> = {
         normalizeEntry: (raw) => normalizeE164(raw),
       };
     },
-    collectWarnings: ({ account, cfg }) => {
-      const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
-      const groupPolicy = account.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+    collectWarnings: ({ account }) => {
+      const groupPolicy = account.groupPolicy ?? "allowlist";
       if (groupPolicy !== "open") return [];
       const groupAllowlistConfigured =
         Boolean(account.groups) && Object.keys(account.groups ?? {}).length > 0;

src/channels/targets.test.ts

@@ -1,42 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { buildMessagingTarget, ensureTargetId, requireTargetKind } from "./targets.js";
-
-describe("ensureTargetId", () => {
-  it("returns the candidate when it matches", () => {
-    expect(
-      ensureTargetId({
-        candidate: "U123",
-        pattern: /^[A-Z0-9]+$/i,
-        errorMessage: "bad",
-      }),
-    ).toBe("U123");
-  });
-
-  it("throws with the provided message on mismatch", () => {
-    expect(() =>
-      ensureTargetId({
-        candidate: "not-ok",
-        pattern: /^[A-Z0-9]+$/i,
-        errorMessage: "Bad target",
-      }),
-    ).toThrow(/Bad target/);
-  });
-});
-
-describe("requireTargetKind", () => {
-  it("returns the target id when the kind matches", () => {
-    const target = buildMessagingTarget("channel", "C123", "C123");
-    expect(requireTargetKind({ platform: "Slack", target, kind: "channel" })).toBe("C123");
-  });
-
-  it("throws when the kind is missing or mismatched", () => {
-    expect(() => requireTargetKind({ platform: "Slack", target: undefined, kind: "channel" })).toThrow(
-      /Slack channel id is required/,
-    );
-    const target = buildMessagingTarget("user", "U123", "U123");
-    expect(() => requireTargetKind({ platform: "Slack", target, kind: "channel" })).toThrow(
-      /Slack channel id is required/,
-    );
-  });
-});

src/channels/targets.ts

@@ -1,56 +0,0 @@
-export type MessagingTargetKind = "user" | "channel";
-
-export type MessagingTarget = {
-  kind: MessagingTargetKind;
-  id: string;
-  raw: string;
-  normalized: string;
-};
-
-export type MessagingTargetParseOptions = {
-  defaultKind?: MessagingTargetKind;
-  ambiguousMessage?: string;
-};
-
-export function normalizeTargetId(kind: MessagingTargetKind, id: string): string {
-  return `${kind}:${id}`.toLowerCase();
-}
-
-export function buildMessagingTarget(
-  kind: MessagingTargetKind,
-  id: string,
-  raw: string,
-): MessagingTarget {
-  return {
-    kind,
-    id,
-    raw,
-    normalized: normalizeTargetId(kind, id),
-  };
-}
-
-export function ensureTargetId(params: {
-  candidate: string;
-  pattern: RegExp;
-  errorMessage: string;
-}): string {
-  if (!params.pattern.test(params.candidate)) {
-    throw new Error(params.errorMessage);
-  }
-  return params.candidate;
-}
-
-export function requireTargetKind(params: {
-  platform: string;
-  target: MessagingTarget | undefined;
-  kind: MessagingTargetKind;
-}): string {
-  const kindLabel = params.kind;
-  if (!params.target) {
-    throw new Error(`${params.platform} ${kindLabel} id is required.`);
-  }
-  if (params.target.kind !== params.kind) {
-    throw new Error(`${params.platform} ${kindLabel} id is required (use ${kindLabel}:<id>).`);
-  }
-  return params.target.id;
-}

src/cli/channels-cli.ts

@@ -6,7 +6,6 @@ import {
   channelsListCommand,
   channelsLogsCommand,
   channelsRemoveCommand,
-  channelsResolveCommand,
   channelsStatusCommand,
 } from "../commands/channels.js";
 import { danger } from "../globals.js";
@@ -106,32 +105,6 @@ export function registerChannelsCli(program: Command) {
       }
     });
 
-  channels
-    .command("resolve")
-    .description("Resolve channel/user names to IDs")
-    .argument("<entries...>", "Entries to resolve (names or ids)")
-    .option("--channel <name>", `Channel (${channelNames})`)
-    .option("--account <id>", "Account id (accountId)")
-    .option("--kind <kind>", "Target kind (auto|user|group)", "auto")
-    .option("--json", "Output JSON", false)
-    .action(async (entries, opts) => {
-      try {
-        await channelsResolveCommand(
-          {
-            channel: opts.channel as string | undefined,
-            account: opts.account as string | undefined,
-            kind: opts.kind as "auto" | "user" | "group",
-            json: Boolean(opts.json),
-            entries: Array.isArray(entries) ? entries : [String(entries)],
-          },
-          defaultRuntime,
-        );
-      } catch (err) {
-        defaultRuntime.error(String(err));
-        defaultRuntime.exit(1);
-      }
-    });
-
   channels
     .command("logs")
     .description("Show recent channel logs from the gateway log file")

src/cli/tagline.ts

@@ -88,7 +88,6 @@ const TAGLINES: string[] = [
   "Your AI assistant, now without the $3,499 headset.",
   "Think different. Actually think.",
   "Ah, the fruit tree company! 🍎",
-  "Greetings, Professor Falken",
   HOLIDAY_TAGLINES.newYear,
   HOLIDAY_TAGLINES.lunarNewYear,
   HOLIDAY_TAGLINES.christmas,

src/commands/auth-choice-options.test.ts

@@ -138,16 +138,4 @@ describe("buildAuthChoiceOptions", () => {
 
     expect(options.some((opt) => opt.value === "chutes")).toBe(true);
   });
-
-  it("includes Qwen auth choice", () => {
-    const store: AuthProfileStore = { version: 1, profiles: {} };
-    const options = buildAuthChoiceOptions({
-      store,
-      includeSkip: false,
-      includeClaudeCliIfMissing: true,
-      platform: "darwin",
-    });
-
-    expect(options.some((opt) => opt.value === "qwen-portal")).toBe(true);
-  });
 });

src/commands/auth-choice-options.ts

@@ -19,8 +19,7 @@ export type AuthChoiceGroupId =
   | "zai"
   | "opencode-zen"
   | "minimax"
-  | "synthetic"
-  | "qwen";
+  | "synthetic";
 
 export type AuthChoiceGroup = {
   value: AuthChoiceGroupId;
@@ -53,12 +52,6 @@ const AUTH_CHOICE_GROUP_DEFS: {
     hint: "M2.1 (recommended)",
     choices: ["minimax-api", "minimax-api-lightning"],
   },
-  {
-    value: "qwen",
-    label: "Qwen",
-    hint: "OAuth",
-    choices: ["qwen-portal"],
-  },
   {
     value: "synthetic",
     label: "Synthetic",
@@ -196,7 +189,6 @@ export function buildAuthChoiceOptions(params: {
   });
   options.push({ value: "gemini-api-key", label: "Google Gemini API key" });
   options.push({ value: "zai-api-key", label: "Z.AI (GLM 4.7) API key" });
-  options.push({ value: "qwen-portal", label: "Qwen OAuth" });
   options.push({ value: "apiKey", label: "Anthropic API key" });
   // Token flow is currently Anthropic-only; use CLI for advanced providers.
   options.push({

src/commands/auth-choice.apply.qwen-portal.ts

@@ -1,191 +0,0 @@
-import { resolveClawdbotAgentDir } from "../agents/agent-paths.js";
-import { resolveDefaultAgentId, resolveAgentDir, resolveAgentWorkspaceDir } from "../agents/agent-scope.js";
-import { upsertAuthProfile } from "../agents/auth-profiles.js";
-import { normalizeProviderId } from "../agents/model-selection.js";
-import { resolveDefaultAgentWorkspaceDir } from "../agents/workspace.js";
-import type { ClawdbotConfig } from "../config/config.js";
-import { resolvePluginProviders } from "../plugins/providers.js";
-import type { ProviderAuthMethod, ProviderPlugin } from "../plugins/types.js";
-import type { ApplyAuthChoiceParams, ApplyAuthChoiceResult } from "./auth-choice.apply.js";
-import { applyAuthProfileConfig } from "./onboard-auth.js";
-import { openUrl } from "./onboard-helpers.js";
-import { createVpsAwareOAuthHandlers } from "./oauth-flow.js";
-import { isRemoteEnvironment } from "./oauth-env.js";
-
-const PLUGIN_ID = "qwen-portal-auth";
-const PROVIDER_ID = "qwen-portal";
-
-function enableBundledPlugin(cfg: ClawdbotConfig): ClawdbotConfig {
-  const existingEntry = cfg.plugins?.entries?.[PLUGIN_ID];
-  return {
-    ...cfg,
-    plugins: {
-      ...cfg.plugins,
-      entries: {
-        ...cfg.plugins?.entries,
-        [PLUGIN_ID]: {
-          ...existingEntry,
-          enabled: true,
-        },
-      },
-    },
-  };
-}
-
-function resolveProviderMatch(
-  providers: ProviderPlugin[],
-  rawProvider: string,
-): ProviderPlugin | null {
-  const normalized = normalizeProviderId(rawProvider);
-  return (
-    providers.find((provider) => normalizeProviderId(provider.id) === normalized) ??
-    providers.find(
-      (provider) =>
-        provider.aliases?.some((alias) => normalizeProviderId(alias) === normalized) ?? false,
-    ) ??
-    null
-  );
-}
-
-function pickAuthMethod(provider: ProviderPlugin, rawMethod?: string): ProviderAuthMethod | null {
-  const raw = rawMethod?.trim();
-  if (!raw) return null;
-  const normalized = raw.toLowerCase();
-  return (
-    provider.auth.find((method) => method.id.toLowerCase() === normalized) ??
-    provider.auth.find((method) => method.label.toLowerCase() === normalized) ??
-    null
-  );
-}
-
-function isPlainRecord(value: unknown): value is Record<string, unknown> {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-
-function mergeConfigPatch<T>(base: T, patch: unknown): T {
-  if (!isPlainRecord(base) || !isPlainRecord(patch)) {
-    return patch as T;
-  }
-
-  const next: Record<string, unknown> = { ...base };
-  for (const [key, value] of Object.entries(patch)) {
-    const existing = next[key];
-    if (isPlainRecord(existing) && isPlainRecord(value)) {
-      next[key] = mergeConfigPatch(existing, value);
-    } else {
-      next[key] = value;
-    }
-  }
-  return next as T;
-}
-
-function applyDefaultModel(cfg: ClawdbotConfig, model: string): ClawdbotConfig {
-  const models = { ...cfg.agents?.defaults?.models };
-  models[model] = models[model] ?? {};
-
-  const existingModel = cfg.agents?.defaults?.model;
-  return {
-    ...cfg,
-    agents: {
-      ...cfg.agents,
-      defaults: {
-        ...cfg.agents?.defaults,
-        models,
-        model: {
-          ...(existingModel && typeof existingModel === "object" && "fallbacks" in existingModel
-            ? { fallbacks: (existingModel as { fallbacks?: string[] }).fallbacks }
-            : undefined),
-          primary: model,
-        },
-      },
-    },
-  };
-}
-
-export async function applyAuthChoiceQwenPortal(
-  params: ApplyAuthChoiceParams,
-): Promise<ApplyAuthChoiceResult | null> {
-  if (params.authChoice !== "qwen-portal") return null;
-
-  let nextConfig = enableBundledPlugin(params.config);
-  const agentId = params.agentId ?? resolveDefaultAgentId(nextConfig);
-  const defaultAgentId = resolveDefaultAgentId(nextConfig);
-  const agentDir =
-    params.agentDir ??
-    (agentId === defaultAgentId ? resolveClawdbotAgentDir() : resolveAgentDir(nextConfig, agentId));
-  const workspaceDir =
-    resolveAgentWorkspaceDir(nextConfig, agentId) ?? resolveDefaultAgentWorkspaceDir();
-
-  const providers = resolvePluginProviders({ config: nextConfig, workspaceDir });
-  const provider = resolveProviderMatch(providers, PROVIDER_ID);
-  if (!provider) {
-    await params.prompter.note(
-      "Qwen auth plugin is not available. Run `clawdbot plugins enable qwen-portal-auth` and re-run the wizard.",
-      "Qwen",
-    );
-    return { config: nextConfig };
-  }
-
-  const method = pickAuthMethod(provider, "device") ?? provider.auth[0];
-  if (!method) {
-    await params.prompter.note("Qwen auth method missing.", "Qwen");
-    return { config: nextConfig };
-  }
-
-  const isRemote = isRemoteEnvironment();
-  const result = await method.run({
-    config: nextConfig,
-    agentDir,
-    workspaceDir,
-    prompter: params.prompter,
-    runtime: params.runtime,
-    isRemote,
-    openUrl: async (url) => {
-      await openUrl(url);
-    },
-    oauth: {
-      createVpsAwareHandlers: (opts) => createVpsAwareOAuthHandlers(opts),
-    },
-  });
-
-  if (result.configPatch) {
-    nextConfig = mergeConfigPatch(nextConfig, result.configPatch);
-  }
-
-  for (const profile of result.profiles) {
-    upsertAuthProfile({
-      profileId: profile.profileId,
-      credential: profile.credential,
-      agentDir,
-    });
-
-    nextConfig = applyAuthProfileConfig(nextConfig, {
-      profileId: profile.profileId,
-      provider: profile.credential.provider,
-      mode: profile.credential.type === "token" ? "token" : profile.credential.type,
-      ...("email" in profile.credential && profile.credential.email
-        ? { email: profile.credential.email }
-        : {}),
-    });
-  }
-
-  let agentModelOverride: string | undefined;
-  if (result.defaultModel) {
-    if (params.setDefaultModel) {
-      nextConfig = applyDefaultModel(nextConfig, result.defaultModel);
-      await params.prompter.note(`Default model set to ${result.defaultModel}`, "Model configured");
-    } else if (params.agentId) {
-      agentModelOverride = result.defaultModel;
-      await params.prompter.note(
-        `Default model set to ${result.defaultModel} for agent "${params.agentId}".`,
-        "Model configured",
-      );
-    }
-  }
-
-  if (result.notes && result.notes.length > 0) {
-    await params.prompter.note(result.notes.join("\n"), "Provider notes");
-  }
-
-  return { config: nextConfig, agentModelOverride };
-}

src/commands/auth-choice.apply.ts

@@ -7,7 +7,6 @@ import { applyAuthChoiceGitHubCopilot } from "./auth-choice.apply.github-copilot
 import { applyAuthChoiceMiniMax } from "./auth-choice.apply.minimax.js";
 import { applyAuthChoiceOAuth } from "./auth-choice.apply.oauth.js";
 import { applyAuthChoiceOpenAI } from "./auth-choice.apply.openai.js";
-import { applyAuthChoiceQwenPortal } from "./auth-choice.apply.qwen-portal.js";
 import type { AuthChoice } from "./onboard-types.js";
 
 export type ApplyAuthChoiceParams = {
@@ -35,7 +34,6 @@ export async function applyAuthChoice(
     applyAuthChoiceApiProviders,
     applyAuthChoiceMiniMax,
     applyAuthChoiceGitHubCopilot,
-    applyAuthChoiceQwenPortal,
   ];
 
   for (const handler of handlers) {

src/commands/auth-choice.preferred-provider.ts

@@ -23,7 +23,6 @@ const PREFERRED_PROVIDER_BY_AUTH_CHOICE: Partial<Record<AuthChoice, string>> = {
   "minimax-api-lightning": "minimax",
   minimax: "lmstudio",
   "opencode-zen": "opencode",
-  "qwen-portal": "qwen-portal",
 };
 
 export function resolvePreferredProviderForAuthChoice(choice: AuthChoice): string | undefined {

src/commands/auth-choice.test.ts

@@ -13,11 +13,6 @@ vi.mock("../providers/github-copilot-auth.js", () => ({
   githubCopilotLoginCommand: vi.fn(async () => {}),
 }));
 
-const resolvePluginProviders = vi.hoisted(() => vi.fn(() => []));
-vi.mock("../plugins/providers.js", () => ({
-  resolvePluginProviders,
-}));
-
 const noopAsync = async () => {};
 const noop = () => {};
 const authProfilePathFor = (agentDir: string) => path.join(agentDir, "auth-profiles.json");
@@ -39,7 +34,6 @@ describe("applyAuthChoice", () => {
 
   afterEach(async () => {
     vi.unstubAllGlobals();
-    resolvePluginProviders.mockReset();
     if (tempStateDir) {
       await fs.rm(tempStateDir, { recursive: true, force: true });
       tempStateDir = null;
@@ -491,101 +485,6 @@ describe("applyAuthChoice", () => {
       email: "remote-user",
     });
   });
-
-  it("writes Qwen credentials when selecting qwen-portal", async () => {
-    tempStateDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-auth-"));
-    process.env.CLAWDBOT_STATE_DIR = tempStateDir;
-    process.env.CLAWDBOT_AGENT_DIR = path.join(tempStateDir, "agent");
-    process.env.PI_CODING_AGENT_DIR = process.env.CLAWDBOT_AGENT_DIR;
-
-    resolvePluginProviders.mockReturnValue([
-      {
-        id: "qwen-portal",
-        label: "Qwen",
-        auth: [
-          {
-            id: "device",
-            label: "Qwen OAuth",
-            kind: "device_code",
-            run: vi.fn(async () => ({
-              profiles: [
-                {
-                  profileId: "qwen-portal:default",
-                  credential: {
-                    type: "oauth",
-                    provider: "qwen-portal",
-                    access: "access",
-                    refresh: "refresh",
-                    expires: Date.now() + 60 * 60 * 1000,
-                  },
-                },
-              ],
-              configPatch: {
-                models: {
-                  providers: {
-                    "qwen-portal": {
-                      baseUrl: "https://portal.qwen.ai/v1",
-                      apiKey: "qwen-oauth",
-                      api: "openai-completions",
-                      models: [],
-                    },
-                  },
-                },
-              },
-              defaultModel: "qwen-portal/coder-model",
-            })),
-          },
-        ],
-      },
-    ]);
-
-    const prompter: WizardPrompter = {
-      intro: vi.fn(noopAsync),
-      outro: vi.fn(noopAsync),
-      note: vi.fn(noopAsync),
-      select: vi.fn(async () => "" as never),
-      multiselect: vi.fn(async () => []),
-      text: vi.fn(async () => ""),
-      confirm: vi.fn(async () => false),
-      progress: vi.fn(() => ({ update: noop, stop: noop })),
-    };
-    const runtime: RuntimeEnv = {
-      log: vi.fn(),
-      error: vi.fn(),
-      exit: vi.fn((code: number) => {
-        throw new Error(`exit:${code}`);
-      }),
-    };
-
-    const result = await applyAuthChoice({
-      authChoice: "qwen-portal",
-      config: {},
-      prompter,
-      runtime,
-      setDefaultModel: true,
-    });
-
-    expect(result.config.auth?.profiles?.["qwen-portal:default"]).toMatchObject({
-      provider: "qwen-portal",
-      mode: "oauth",
-    });
-    expect(result.config.agents?.defaults?.model?.primary).toBe("qwen-portal/coder-model");
-    expect(result.config.models?.providers?.["qwen-portal"]).toMatchObject({
-      baseUrl: "https://portal.qwen.ai/v1",
-      apiKey: "qwen-oauth",
-    });
-
-    const authProfilePath = authProfilePathFor(requireAgentDir());
-    const raw = await fs.readFile(authProfilePath, "utf8");
-    const parsed = JSON.parse(raw) as {
-      profiles?: Record<string, { access?: string; refresh?: string; provider?: string }>;
-    };
-    expect(parsed.profiles?.["qwen-portal:default"]).toMatchObject({
-      provider: "qwen-portal",
-      access: "access",
-      refresh: "refresh",
-    });
-  });
 });
 
 describe("resolvePreferredProviderForAuthChoice", () => {
@@ -593,10 +492,6 @@ describe("resolvePreferredProviderForAuthChoice", () => {
     expect(resolvePreferredProviderForAuthChoice("github-copilot")).toBe("github-copilot");
   });
 
-  it("maps qwen-portal to the provider", () => {
-    expect(resolvePreferredProviderForAuthChoice("qwen-portal")).toBe("qwen-portal");
-  });
-
   it("returns undefined for unknown choices", () => {
     expect(resolvePreferredProviderForAuthChoice("unknown" as AuthChoice)).toBeUndefined();
   });

src/commands/channels.ts

@@ -8,7 +8,5 @@ export type { ChannelsLogsOptions } from "./channels/logs.js";
 export { channelsLogsCommand } from "./channels/logs.js";
 export type { ChannelsRemoveOptions } from "./channels/remove.js";
 export { channelsRemoveCommand } from "./channels/remove.js";
-export type { ChannelsResolveOptions } from "./channels/resolve.js";
-export { channelsResolveCommand } from "./channels/resolve.js";
 export type { ChannelsStatusOptions } from "./channels/status.js";
 export { channelsStatusCommand, formatGatewayChannelsStatusLines } from "./channels/status.js";

src/commands/channels/capabilities.ts

@@ -1,8 +1,8 @@
 import { getChannelPlugin, listChannelPlugins } from "../../channels/plugins/index.js";
 import { resolveChannelDefaultAccountId } from "../../channels/plugins/helpers.js";
+import { normalizeDiscordMessagingTarget } from "../../channels/plugins/normalize-target.js";
 import type { ChannelCapabilities, ChannelPlugin } from "../../channels/plugins/types.js";
 import { fetchChannelPermissionsDiscord } from "../../discord/send.js";
-import { parseDiscordTarget } from "../../discord/targets.js";
 import { danger } from "../../globals.js";
 import type { ClawdbotConfig } from "../../config/config.js";
 import { defaultRuntime, type RuntimeEnv } from "../../runtime.js";
@@ -88,24 +88,24 @@ function formatSupport(capabilities?: ChannelCapabilities) {
 
 function summarizeDiscordTarget(raw?: string): DiscordTargetSummary | undefined {
   if (!raw) return undefined;
-  const target = parseDiscordTarget(raw, { defaultKind: "channel" });
-  if (!target) return { raw };
-  if (target.kind === "channel") {
+  const normalized = normalizeDiscordMessagingTarget(raw);
+  if (!normalized) return { raw };
+  if (normalized.startsWith("channel:")) {
     return {
       raw,
-      normalized: target.normalized,
+      normalized,
       kind: "channel",
-      channelId: target.id,
+      channelId: normalized.slice("channel:".length),
     };
   }
-  if (target.kind === "user") {
+  if (normalized.startsWith("user:")) {
     return {
       raw,
-      normalized: target.normalized,
+      normalized,
       kind: "user",
     };
   }
-  return { raw, normalized: target.normalized };
+  return { raw, normalized };
 }
 
 function formatDiscordIntents(intents?: {

src/commands/channels/resolve.ts

@@ -1,131 +0,0 @@
-import { loadConfig } from "../../config/config.js";
-import { danger } from "../../globals.js";
-import { getChannelPlugin } from "../../channels/plugins/index.js";
-import type { ChannelResolveKind, ChannelResolveResult } from "../../channels/plugins/types.js";
-import { resolveMessageChannelSelection } from "../../infra/outbound/channel-selection.js";
-import type { RuntimeEnv } from "../../runtime.js";
-
-export type ChannelsResolveOptions = {
-  channel?: string;
-  account?: string;
-  kind?: "auto" | "user" | "group" | "channel";
-  json?: boolean;
-  entries?: string[];
-};
-
-type ResolveResult = {
-  input: string;
-  resolved: boolean;
-  id?: string;
-  name?: string;
-  error?: string;
-  note?: string;
-};
-
-function resolvePreferredKind(kind?: ChannelsResolveOptions["kind"]): ChannelResolveKind | undefined {
-  if (!kind || kind === "auto") return undefined;
-  if (kind === "user") return "user";
-  return "group";
-}
-
-function detectAutoKind(input: string): ChannelResolveKind {
-  const trimmed = input.trim();
-  if (!trimmed) return "group";
-  if (trimmed.startsWith("@")) return "user";
-  if (/^<@!?/.test(trimmed)) return "user";
-  if (/^(user|discord|slack|matrix|msteams|teams|zalo|zalouser):/i.test(trimmed)) {
-    return "user";
-  }
-  return "group";
-}
-
-function formatResolveResult(result: ResolveResult): string {
-  if (!result.resolved || !result.id) return `${result.input} -> unresolved`;
-  const name = result.name ? ` (${result.name})` : "";
-  const note = result.note ? ` [${result.note}]` : "";
-  return `${result.input} -> ${result.id}${name}${note}`;
-}
-
-export async function channelsResolveCommand(
-  opts: ChannelsResolveOptions,
-  runtime: RuntimeEnv,
-) {
-  const cfg = loadConfig();
-  const entries = (opts.entries ?? []).map((entry) => entry.trim()).filter(Boolean);
-  if (entries.length === 0) {
-    throw new Error("At least one entry is required.");
-  }
-
-  const selection = await resolveMessageChannelSelection({
-    cfg,
-    channel: opts.channel ?? null,
-  });
-  const plugin = getChannelPlugin(selection.channel);
-  if (!plugin?.resolver?.resolveTargets) {
-    throw new Error(`Channel ${selection.channel} does not support resolve.`);
-  }
-  const preferredKind = resolvePreferredKind(opts.kind);
-
-  let results: ResolveResult[] = [];
-  if (preferredKind) {
-    const resolved = await plugin.resolver.resolveTargets({
-      cfg,
-      accountId: opts.account ?? null,
-      inputs: entries,
-      kind: preferredKind,
-      runtime,
-    });
-    results = resolved.map((entry) => ({
-      input: entry.input,
-      resolved: entry.resolved,
-      id: entry.id,
-      name: entry.name,
-      note: entry.note,
-    }));
-  } else {
-    const byKind = new Map<ChannelResolveKind, string[]>();
-    for (const entry of entries) {
-      const kind = detectAutoKind(entry);
-      byKind.set(kind, [...(byKind.get(kind) ?? []), entry]);
-    }
-    const resolved: ChannelResolveResult[] = [];
-    for (const [kind, inputs] of byKind.entries()) {
-      const batch = await plugin.resolver.resolveTargets({
-        cfg,
-        accountId: opts.account ?? null,
-        inputs,
-        kind,
-        runtime,
-      });
-      resolved.push(...batch);
-    }
-    const byInput = new Map(resolved.map((entry) => [entry.input, entry]));
-    results = entries.map((input) => {
-      const entry = byInput.get(input);
-      return {
-        input,
-        resolved: entry?.resolved ?? false,
-        id: entry?.id,
-        name: entry?.name,
-        note: entry?.note,
-      };
-    });
-  }
-
-  if (opts.json) {
-    runtime.log(JSON.stringify(results, null, 2));
-    return;
-  }
-
-  for (const result of results) {
-    if (result.resolved && result.id) {
-      runtime.log(formatResolveResult(result));
-    } else {
-      runtime.error(
-        danger(
-          `${result.input} -> unresolved${result.error ? ` (${result.error})` : result.note ? ` (${result.note})` : ""}`,
-        ),
-      );
-    }
-  }
-}

src/commands/onboard-non-interactive/local/auth-choice.ts

@@ -352,12 +352,7 @@ export async function applyNonInteractiveAuthChoice(params: {
     return applyOpencodeZenConfig(nextConfig);
   }
 
-  if (
-    authChoice === "oauth" ||
-    authChoice === "chutes" ||
-    authChoice === "openai-codex" ||
-    authChoice === "qwen-portal"
-  ) {
+  if (authChoice === "oauth" || authChoice === "chutes" || authChoice === "openai-codex") {
     runtime.error("OAuth requires interactive mode.");
     runtime.exit(1);
     return null;

src/commands/onboard-types.ts

@@ -26,7 +26,6 @@ export type AuthChoice =
   | "minimax-api-lightning"
   | "opencode-zen"
   | "github-copilot"
-  | "qwen-portal"
   | "skip";
 export type GatewayAuthChoice = "off" | "token" | "password";
 export type ResetScope = "config" | "config+creds+sessions" | "full";

src/config/types.channels.ts

@@ -5,14 +5,8 @@ import type { SignalConfig } from "./types.signal.js";
 import type { SlackConfig } from "./types.slack.js";
 import type { TelegramConfig } from "./types.telegram.js";
 import type { WhatsAppConfig } from "./types.whatsapp.js";
-import type { GroupPolicy } from "./types.base.js";
-
-export type ChannelDefaultsConfig = {
-  groupPolicy?: GroupPolicy;
-};
 
 export type ChannelsConfig = {
-  defaults?: ChannelDefaultsConfig;
   whatsapp?: WhatsAppConfig;
   telegram?: TelegramConfig;
   discord?: DiscordConfig;

src/config/zod-schema.providers.ts

@@ -9,18 +9,12 @@ import {
   TelegramConfigSchema,
 } from "./zod-schema.providers-core.js";
 import { WhatsAppConfigSchema } from "./zod-schema.providers-whatsapp.js";
-import { GroupPolicySchema } from "./zod-schema.core.js";
 
 export * from "./zod-schema.providers-core.js";
 export * from "./zod-schema.providers-whatsapp.js";
 
 export const ChannelsSchema = z
   .object({
-    defaults: z
-      .object({
-        groupPolicy: GroupPolicySchema.optional(),
-      })
-      .optional(),
     whatsapp: WhatsAppConfigSchema.optional(),
     telegram: TelegramConfigSchema.optional(),
     discord: DiscordConfigSchema.optional(),