fix: answer telegram callback queries immediately (#1349 ) (thanks @siddhantjain)

fix(telegram): answer callback queries immediately to prevent retries
Telegram retries callback queries if they aren't acknowledged quickly. Previously, answerCallbackQuery was called in a finally block AFTER processing, which could take several seconds for agent responses. This change moves answerCallbackQuery to immediately after basic validation, before any processing begins. This prevents Telegram from sending duplicate callbacks while the agent is thinking. Fixes duplicate callback handling when agent processing is slow.
2026-01-21 03:51:22 +00:00 · 2026-01-21 03:46:38 +00:00
129 changed files with 1291 additions and 4356 deletions
@@ -100,7 +100,7 @@
 - CLI progress: use `src/cli/progress.ts` (`osc-progress` + `@clack/prompts` spinner); don’t hand-roll spinners/bars.
 - Status output: keep tables + ANSI-safe wrapping (`src/terminal/table.ts`); `status --all` = read-only/pasteable, `status --deep` = probes.
 - Gateway currently runs only as the menubar app; there is no separate LaunchAgent/helper label installed. Restart via the Clawdbot Mac app or `scripts/restart-mac.sh`; to verify/kill use `launchctl print gui/$UID | grep clawdbot` rather than assuming a fixed label. **When debugging on macOS, start/stop the gateway via the app, not ad-hoc tmux sessions; kill any temporary tunnels before handoff.**
- macOS logs: use `./scripts/clawlog.sh` to query unified logs for the Clawdbot subsystem; it supports follow/tail/category filters and expects passwordless sudo for `/usr/bin/log`.
+- macOS logs: use `./scripts/clawlog.sh` (aka `vtlog`) to query unified logs for the Clawdbot subsystem; it supports follow/tail/category filters and expects passwordless sudo for `/usr/bin/log`.
 - If shared guardrails are available locally, review them; otherwise follow this repo's guidance.
 - SwiftUI state management (iOS/macOS): prefer the `Observation` framework (`@Observable`, `@Bindable`) over `ObservableObject`/`@StateObject`; don’t introduce new `ObservableObject` unless required for compatibility, and migrate existing usages when touching related code.
 - Connection providers: when adding a new connection, update every UI surface and docs (macOS app, web UI, mobile if applicable, onboarding/overview docs) and add matching status + configuration forms so provider lists and settings stay in sync.
@@ -2,39 +2,73 @@

 Docs: https://docs.clawd.bot

-## 2026.1.21
-
-### Fixes
- UI: remove the chat stop button and keep the composer aligned to the bottom edge.
-
-## 2026.1.20-1
-
-### Fixes
- Install: include pnpm patch files in the npm package to avoid postinstall failures.
-
 ## 2026.1.20

-### Highlights
- Installer: npm packages now ship pnpm patch files again, fixing `curl | bash` installs.
-
 ### Changes
- Agents: add auto-notify-on-completion guidance for coding-agent background runs.
- Build: remove the legacy Peekaboo submodule pointer (SPM release already in use).
-
+- Deps: update workspace + memory-lancedb dependencies.
+- Repo: remove the Peekaboo git submodule now that the SPM release is used.
+- Update: sync plugin sources on channel switches and update npm-installed plugins during `clawdbot update`.
+- Plugins: share npm plugin update logic between `clawdbot update` and `clawdbot plugins update`.
+- Browser: allow config defaults for efficient snapshots in the tool/CLI. (#1336) — thanks @sebslight.
+- Channels: add the Nostr plugin channel with profile management + onboarding install defaults. (#1323) — thanks @joelklabo.
+- Plugins: require manifest-embedded config schemas, validate configs without loading plugin code, and surface plugin config warnings. (#1272) — thanks @thewilloftheshadow.
+- Plugins: move channel catalog metadata into plugin manifests; align Nextcloud Talk policy helpers with core patterns. (#1290) — thanks @NicholaiVogel.
+- Discord: fall back to /skill when native command limits are exceeded; expose /skill globally. (#1287) — thanks @thewilloftheshadow.
+- Docs: refresh bird skill install metadata and usage notes. (#1302) — thanks @odysseus0.
+- Matrix: migrate to matrix-bot-sdk with E2EE support, location handling, and group allowlist upgrades. (#1298) — thanks @sibbl.
+- Plugins/UI: let channel plugin metadata drive UI labels/icons and cron channel options. (#1306) — thanks @steipete.
+- Zalouser: add channel dock metadata, config schema, setup wiring, probe, and status issues. (#1219) — thanks @suminhthanh.
+- Security: warn when <=300B models run without sandboxing and with web tools enabled.
+- Skills: add download installs with OS-filtered install options; add local sherpa-onnx-tts skill.
+- Docs: clarify WhatsApp voice notes and Windows WSL portproxy LAN access notes.
+- UI: add copy-as-markdown with error feedback and drop legacy list view. (#1345) — thanks @bradleypriest.
 ### Fixes
- Installer: ship pnpm patch files in the npm tarball so postinstall patches apply correctly.
- Agents: suppress duplicate assistant text blocks that only differ in trailing whitespace; add a regression test.
- Slack: fix Bolt ESM/CJS import resolution on Node 25.x and remove duplicate thread metadata. (#1360) — thanks @SocialNerd42069.
- CLI: fix a duplicate UpdateStepResult import that broke `pnpm build`.
- macOS: mark Tailscale IP fallback helpers nonisolated to fix Swift 6.2 build failures.
+- Discovery: shorten Bonjour DNS-SD service type to `_clawdbot-gw._tcp` and update discovery clients/docs.
+- Telegram: answer callback queries immediately to prevent retries. (#1349) — thanks @siddhantjain.
+- Agents: preserve subagent announce thread/topic routing + queued replies across channels. (#1241) — thanks @gnarco.
+- Agents: avoid treating timeout errors with "aborted" messages as user aborts, so model fallback still runs.
+- Diagnostics: export OTLP logs, correct queue depth tracking, and document message-flow telemetry.
+- Diagnostics: emit message-flow diagnostics across channels via shared dispatch; gate heartbeat/webhook logging. (#1244) — thanks @oscargavin.
+- CLI: preserve cron delivery settings when editing message payloads. (#1322) — thanks @KrauseFx.
+- CLI: keep `clawdbot logs` output resilient to broken pipes while preserving progress output.
+- Model catalog: avoid caching import failures, log transient discovery errors, and keep partial results. (#1332) — thanks @dougvk.
+- Doctor: clarify plugin auto-enable hint text in the startup banner.
+- Gateway: clarify unauthorized handshake responses with token/password mismatch guidance.
+- Gateway: clarify connect/validation errors for gateway params. (#1347) — thanks @vignesh07.
+- Gateway: preserve restart wake routing + thread replies across restarts. (#1337) — thanks @John-Rood.
+- Gateway: reschedule per-agent heartbeats on config hot reload without restarting the runner.
+- Config: log invalid config issues once per run and keep invalid-config errors stackless.
+- Exec: default gateway/node exec security to allowlist when unset (sandbox stays deny).
+- UI: keep config form enums typed, preserve empty strings, protect sensitive defaults, and deepen config search. (#1315) — thanks @MaudeBot.
+- UI: preserve ordered list numbering in chat markdown. (#1341) — thanks @bradleypriest.
+- UI: allow Control UI to read gatewayUrl from URL params for remote WebSocket targets. (#1342) — thanks @ameno-.
+- Web search: infer Perplexity base URL from API key source (direct vs OpenRouter).
+- Web fetch: harden SSRF protection with shared hostname checks and redirect limits. (#1346) — thanks @fogboots.
+- TUI: keep thinking blocks ordered before content during streaming and isolate per-run assembly. (#1202) — thanks @aaronveklabs.
+- TUI: align custom editor initialization with the latest pi-tui API. (#1298) — thanks @sibbl.
+- CLI: avoid duplicating --profile/--dev flags when formatting commands.
+- Status: route native `/status` to the active agent so model selection reflects the correct profile. (#1301)
+- Exec: prefer bash when fish is default shell, falling back to sh if bash is missing. (#1297) — thanks @ysqander.
+- Exec: merge login-shell PATH for host=gateway exec while keeping daemon PATH minimal. (#1304)
+- Plugins: add Nextcloud Talk manifest for plugin config validation. (#1297) — thanks @ysqander.
+- Anthropic: default API prompt caching to 1h with configurable TTL override; ignore TTL for OAuth.
+- Discord: make resolve warnings avoid raw JSON payloads on rate limits.
+- Discord: process message handlers in parallel across sessions to avoid event queue blocking. (#1295)
+- Cron: auto-deliver isolated agent output to explicit targets without tool calls. (#1285)
+
 ## 2026.1.19-3

 ### Changes
 - Android: remove legacy bridge transport code now that nodes use the gateway protocol.
 - Android: send structured payloads in node events/invokes and include user-agent metadata in gateway connects.
+- Gateway: expand `/v1/responses` to support file/image inputs, tool_choice, usage, and output limits. (#1229) — thanks @RyanLisse.
+- Docs: surface Amazon Bedrock in provider lists and clarify Bedrock auth env vars. (#1289) — thanks @steipete.

 ### Fixes
- Slack: respect verbose tool summaries and keep tool notifications threaded. (#1360) — thanks @SocialNerd42069.
+- Gateway: strip inbound envelope headers from chat history messages to keep clients clean.
+- UI: prevent double-scroll in Control UI chat by locking chat layout to the viewport. (#1283) — thanks @bradleypriest.
+- Config: allow Perplexity as a web_search provider in config validation. (#1230)
+- Browser: register AI snapshot refs for act commands. (#1282) — thanks @John-Rood.

 ## 2026.1.19-2

@@ -53,9 +87,11 @@ Docs: https://docs.clawd.bot
 - **BREAKING:** Reject invalid/unknown config entries and refuse to start the gateway for safety; run `clawdbot doctor --fix` to repair. 

 ### Changes
+- Gateway: add `/v1/responses` endpoint (OpenResponses API) for agentic workflows with item-based input and semantic streaming events. Enable via `gateway.http.endpoints.responses.enabled: true`.
 - Usage: add `/usage cost` summaries and macOS menu cost submenu with daily charting.
 - Agents: clarify node_modules read-only guidance in agent instructions.
 - TUI: add syntax highlighting for code blocks. (#1200) — thanks @vignesh07.
+- TUI: session picker shows derived titles, fuzzy search, relative times, and last message preview. (#1271) — thanks @Whoaa512.

 ### Fixes
 - UI: enable shell mode for sync Windows spawns to avoid `pnpm ui:build` EINVAL. (#1212) — thanks @longmaba.
@@ -64,9 +100,11 @@ Docs: https://docs.clawd.bot
 - Agents: propagate accountId into embedded runs so sub-agent announce routing honors the originating account. (#1058)
 - Compaction: include tool failure summaries in safeguard compaction to prevent retry loops. (#1084)
 - Daemon: include HOME in service environments to avoid missing HOME errors. (#1214) — thanks @ameno-.
+- Memory: show total file counts + scan issues in `clawdbot memory status`; fall back to non-batch embeddings after repeated batch failures.
 - TUI: show generic empty-state text for searchable pickers. (#1201) — thanks @vignesh07.
 - Doctor: canonicalize legacy session keys in session stores to prevent stale metadata. (#1169)
 - CLI: centralize CLI command registration to keep fast-path routing and program wiring in sync. (#1207) — thanks @gumadeiras.
+- Config: allow custom fields under `skills.entries.<name>.config` for skill credentials/config. (#1226) — thanks @VACInc. (fixes #1225)

 ## 2026.1.18-5

@@ -92,8 +130,8 @@ Docs: https://docs.clawd.bot
 ## 2026.1.18-4

 ### Changes
- macOS: switch PeekabooBridge integration to the tagged Swift Package Manager release (no submodule).
- macOS: stop syncing Peekaboo as a git submodule in postinstall.
+- macOS: switch PeekabooBridge integration to the tagged Swift Package Manager release.
+- macOS: stop syncing Peekaboo in postinstall.
 - Swabble: use the tagged Commander Swift package release.
 - CLI: add `clawdbot acp client` interactive ACP harness for debugging.
 - Plugins: route command detection/text chunking helpers through the plugin runtime and drop runtime exports from the SDK.
@@ -2,35 +2,6 @@
 <rss xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" version="2.0">
    <channel>
        <title>Clawdbot</title>
-        <item>
-            <title>2026.1.20</title>
-            <pubDate>Wed, 21 Jan 2026 08:18:22 +0000</pubDate>
-            <link>https://raw.githubusercontent.com/clawdbot/clawdbot/main/appcast.xml</link>
-            <sparkle:version>7116</sparkle:version>
-            <sparkle:shortVersionString>2026.1.20</sparkle:shortVersionString>
-            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
-            <description><![CDATA[<h2>Clawdbot 2026.1.20</h2>
-<h3>Highlights</h3>
-<ul>
-<li>Installer: npm packages now ship pnpm patch files again, fixing <code>curl | bash</code> installs.</li>
-</ul>
-<h3>Changes</h3>
-<ul>
-<li>Agents: add auto-notify-on-completion guidance for coding-agent background runs.</li>
-<li>Build: remove the legacy Peekaboo submodule pointer (SPM release already in use).</li>
-</ul>
-<h3>Fixes</h3>
-<ul>
-<li>Installer: ship pnpm patch files in the npm tarball so postinstall patches apply correctly.</li>
-<li>Agents: suppress duplicate assistant text blocks that only differ in trailing whitespace; add a regression test.</li>
-<li>Slack: fix Bolt ESM/CJS import resolution on Node 25.x and remove duplicate thread metadata. (#1360) — thanks @SocialNerd42069.</li>
-<li>CLI: fix a duplicate UpdateStepResult import that broke <code>pnpm build</code>.</li>
-<li>macOS: mark Tailscale IP fallback helpers nonisolated to fix Swift 6.2 build failures.</li>
-</ul>
-<p><a href="https://github.com/clawdbot/clawdbot/blob/main/CHANGELOG.md">View full changelog</a></p>
-]]></description>
-            <enclosure url="https://github.com/clawdbot/clawdbot/releases/download/v2026.1.20/Clawdbot-2026.1.20.zip" length="12208102" type="application/octet-stream" sparkle:edSignature="hU495Eii8O3qmmUnxYFhXyEGv+qan6KL+GpeuBhPIXf+7B5F/gBh5Oz9cHaqaAPoZ4/3Bo6xgvic0HTkbz6gDw=="/>
-        </item>
        <item>
            <title>2026.1.16-2</title>
            <pubDate>Sat, 17 Jan 2026 12:46:22 +0000</pubDate>
@@ -128,5 +99,177 @@
 ]]></description>
            <enclosure url="https://github.com/clawdbot/clawdbot/releases/download/v2026.1.15/Clawdbot-2026.1.15.zip" length="12127276" type="application/octet-stream" sparkle:edSignature="o79vwTbtW/d91NQFRVfUDhsv6D4zIw7IkhY0N1iLImMu94BURgLcecA6z7Smy3bMobPwOyzN8yfm6mA/Rt8FCA=="/>
        </item>
+        <item>
+            <title>2026.1.14-1</title>
+            <pubDate>Thu, 15 Jan 2026 11:14:40 +0000</pubDate>
+            <link>https://raw.githubusercontent.com/clawdbot/clawdbot/main/appcast.xml</link>
+            <sparkle:version>5825</sparkle:version>
+            <sparkle:shortVersionString>2026.1.14-1</sparkle:shortVersionString>
+            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
+            <description><![CDATA[<h2>Clawdbot 2026.1.14-1</h2>
+<h3>Highlights</h3>
+<ul>
+<li>Web search: <code>web_search</code>/<code>web_fetch</code> tools (Brave API) + first-time setup in onboarding/configure.</li>
+<li>Browser control: Chrome extension relay takeover mode + remote browser control via <code>clawdbot browser serve</code>.</li>
+<li>Plugins: channel plugins (gateway HTTP hooks) + Zalo plugin + onboarding install flow. (#854) — thanks @longmaba.</li>
+<li>Security: expanded <code>clawdbot security audit</code> (+ <code>--fix</code>), detect-secrets CI scan, and a <code>SECURITY.md</code> reporting policy.</li>
+</ul>
+<h3>Changes</h3>
+<h4>Web Tools</h4>
+<ul>
+<li>Tools: add <code>web_search</code>/<code>web_fetch</code> (Brave API), including helpful setup hints when the key is missing.</li>
+<li>Tools: enable <code>web_fetch</code> by default (unless explicitly disabled in config).</li>
+<li>CLI/Docs: add <code>clawdbot configure --section web</code> for storing Brave API keys and update onboarding tips.</li>
+</ul>
+<h4>Browser / Control UI</h4>
+<ul>
+<li>Browser: add Chrome extension relay takeover mode (toolbar button) + <code>clawdbot browser serve</code> remote control + <code>browser.controlToken</code>.</li>
+<li>Browser: ship a built-in <code>chrome</code> profile for extension relay and start the relay automatically when running locally.</li>
+<li>Browser: default <code>browser.defaultProfile</code> to <code>chrome</code> (existing Chrome takeover mode).</li>
+<li>Browser: add <code>clawdbot browser extension install/path</code> and copy extension path to clipboard.</li>
+<li>Browser: add <code>snapshot refs=aria</code> (Playwright aria-ref ids) for self-resolving refs across <code>snapshot</code> → <code>act</code>.</li>
+<li>Browser: <code>profile="chrome"</code> now defaults to host control and returns clearer “attach a tab” errors.</li>
+<li>Browser: extension mode recovers when only one tab is attached (stale targetId fallback).</li>
+<li>Control UI: show raw any-map entries in config views; move Docs link into the left nav.</li>
+</ul>
+<h4>Plugins</h4>
+<ul>
+<li>Plugins: add plugin HTTP hooks + loader updates to support channel plugins. (#854) — thanks @longmaba.</li>
+<li>Plugins: add onboarding plugin install flow. (#854) — thanks @longmaba.</li>
+<li>Channels: add Matrix plugin (external) with docs + onboarding hooks.</li>
+<li>Voice Call: add Plivo provider (no SDK dependency). (#846) — thanks @vrknetha.</li>
+</ul>
+<h4>Security</h4>
+<ul>
+<li>Security: expand <code>clawdbot security audit</code> checks and publish a <code>SECURITY.md</code> reporting policy.</li>
+<li>Security: extend <code>clawdbot security audit --fix</code> to tighten more sensitive state paths.</li>
+<li>Security: add detect-secrets CI scan and baseline guidance. (#227) — thanks @Hyaxia.</li>
+</ul>
+<h4>Onboarding / Daemon</h4>
+<ul>
+<li>Onboarding: add a security checkpoint prompt (docs link + sandboxing hint); require <code>--accept-risk</code> for <code>--non-interactive</code>.</li>
+<li>Daemon: support profile-aware service names for multi-gateway setups. (#671) — thanks @bjesuiter.</li>
+</ul>
+<h4>Auth / Usage / Config</h4>
+<ul>
+<li>Usage: add MiniMax coding plan usage tracking.</li>
+<li>Auth: label Claude Code CLI auth options. (#915) — thanks @SeanZoR.</li>
+<li>Agents: add optional auth-profile copy prompt on <code>agents add</code> and improve auth error messaging.</li>
+<li>Auth: add dynamic template variables to <code>messages.responsePrefix</code>. (#928) — thanks @sebslight.</li>
+<li>Config: add <code>channels.<provider>.configWrites</code> gating for channel-initiated config writes; migrate Slack channel IDs.</li>
+</ul>
+<h4>Channels</h4>
+<ul>
+<li>Telegram: add message delete action in the message tool. (#903) — thanks @sleontenko.</li>
+<li>WhatsApp: add <code>channels.whatsapp.sendReadReceipts</code> to disable auto read receipts. (#882) — thanks @chrisrodz.</li>
+</ul>
+<h4>Docs</h4>
+<ul>
+<li>Docs: clarify per-agent auth stores, sandboxed skill binaries, and elevated semantics.</li>
+<li>Docs: add FAQ entries for missing provider auth after adding agents and Gemini thinking signature errors.</li>
+<li>Docs: expand gateway security hardening guidance and incident response checklist.</li>
+<li>Docs: document DM history limits for channel DMs. (#883) — thanks @pkrmf.</li>
+<li>Docs: standardize Claude Code CLI naming across docs and prompts. (follow-up to #915)</li>
+<li>Docs: add per-command CLI doc pages and link them from <code>clawdbot <command> --help</code>.</li>
+<li>Docs: add multi-gateway guide (sidebar + nav).</li>
+</ul>
+<h3>Fixes</h3>
+<h4>Gateway / Daemon / Sessions</h4>
+<ul>
+<li>Gateway: forward termination signals to respawned CLI child processes to avoid orphaned systemd runs. (#933) — thanks @roshanasingh4.</li>
+<li>Gateway/UI: ship session defaults in the hello snapshot so the Control UI canonicalizes main session keys (no bare <code>main</code> alias).</li>
+<li>Agents: skip thinking/final tag stripping inside Markdown code spans. (#939) — thanks @ngutman.</li>
+<li>Browser: add tests for snapshot labels/efficient query params and labeled image responses.</li>
+<li>Browser: persist role snapshot refs per CDP target so <code>snapshot</code> → <code>act</code> clicks work even if Playwright returns a different Page instance.</li>
+<li>macOS: ensure launchd log directory exists with a test-only override. (#909) — thanks @roshanasingh4.</li>
+<li>macOS: format ConnectionsStore config to satisfy SwiftFormat lint. (#852) — thanks @mneves75.</li>
+<li>Packaging: run <code>pnpm build</code> on <code>prepack</code> so npm publishes include fresh <code>dist/</code> output.</li>
+<li>Telegram: register dock native commands with underscores to avoid <code>BOT_COMMAND_INVALID</code> (#929, fixes #901) — thanks @grp06.</li>
+<li>Google: downgrade unsigned thinking blocks before send to avoid missing signature errors.</li>
+<li>Agents: make user time zone and 24-hour time explicit in the system prompt. (#859) — thanks @CashWilliams.</li>
+<li>Agents: strip downgraded tool call text without eating adjacent replies and filter thinking-tag leaks. (#905) — thanks @erikpr1994.</li>
+<li>Agents: cap tool call IDs for OpenAI/OpenRouter to avoid request rejections. (#875) — thanks @j1philli.</li>
+<li>Doctor: avoid re-adding WhatsApp config when only legacy ack reactions are set. (#927, fixes #900) — thanks @grp06.</li>
+<li>Agents: scrub tuple <code>items</code> schemas for Gemini tool calls. (#926, fixes #746) — thanks @grp06.</li>
+<li>Agents: stabilize sub-agent announce status from runtime outcomes and normalize Result/Notes. (#835) — thanks @roshanasingh4.</li>
+<li>Apps: use canonical main session keys from gateway defaults across macOS/iOS/Android to avoid creating bare <code>main</code> sessions.</li>
+<li>Embedded runner: suppress raw API error payloads from replies. (#924) — thanks @grp06.</li>
+<li>Auth: normalize Claude Code CLI profile mode to oauth and auto-migrate config. (#855) — thanks @sebslight.</li>
+<li>Daemon: clear persisted launchd disabled state before bootstrap (fixes <code>daemon install</code> after uninstall). (#849) — thanks @ndraiman.</li>
+<li>Sessions: return deep clones (<code>structuredClone</code>) so cached session entries can't be mutated. (#934) — thanks @ronak-guliani.</li>
+<li>Heartbeat: keep <code>updatedAt</code> monotonic when restoring heartbeat sessions. (#934) — thanks @ronak-guliani.</li>
+<li>Agent: clear run context after CLI runs (<code>clearAgentRunContext</code>) to avoid runaway contexts. (#934) — thanks @ronak-guliani.</li>
+<li>Gateway/Dev: ensure <code>pnpm gateway:dev</code> always uses the dev profile config + state (<code>~/.clawdbot-dev</code>).</li>
+</ul>
+<h4>CLI / Onboarding</h4>
+<ul>
+<li>Onboarding: show web search setup at the end (not the beginning).</li>
+<li>Onboarding: show daemon install/restart progress (avoid “blinking cursor”) and fix daemon install output formatting.</li>
+<li>Health: colorize “not configured” provider lines for easier scanning.</li>
+</ul>
+<h4>Control UI / TUI</h4>
+<ul>
+<li>Control UI: load cron run history on job selection and clarify empty-state messaging. (#866)</li>
+<li>UI: use application-defined WebSocket close code and fix dashboard auth query items. (#918) — thanks @rahthakor.</li>
+<li>UI: always apply <code>?token=</code> from URL (fixes unauthorized after re-onboard).</li>
+<li>Browser: add tests for snapshot labels/efficient query params and labeled image responses.</li>
+<li>TUI: render picker overlays via the overlay stack so /models and /settings display. (#921) — thanks @grizzdank.</li>
+<li>TUI: add a bright spinner + elapsed time in the status line for send/stream/run states.</li>
+<li>TUI: show LLM error messages (rate limits, auth, etc.) instead of <code>(no output)</code>.</li>
+</ul>
+<h4>Agents / Auth / Tools / Sandbox</h4>
+<ul>
+<li>Agents: make user time zone and 24-hour time explicit in the system prompt. (#859) — thanks @CashWilliams.</li>
+<li>Agents: strip downgraded tool call text without eating adjacent replies and filter thinking-tag leaks. (#905) — thanks @erikpr1994.</li>
+<li>Agents: cap tool call IDs for OpenAI/OpenRouter to avoid request rejections. (#875) — thanks @j1philli.</li>
+<li>Agents: scrub tuple <code>items</code> schemas for Gemini tool calls. (#926, fixes #746) — thanks @grp06.</li>
+<li>Agents: stabilize sub-agent announce status from runtime outcomes and normalize Result/Notes. (#835) — thanks @roshanasingh4.</li>
+<li>Auth: normalize Claude Code CLI profile mode to oauth and auto-migrate config. (#855) — thanks @sebslight.</li>
+<li>Embedded runner: suppress raw API error payloads from replies. (#924) — thanks @grp06.</li>
+<li>Logging: tolerate <code>EIO</code> from console writes to avoid gateway crashes. (#925, fixes #878) — thanks @grp06.</li>
+<li>Sandbox: restore <code>docker.binds</code> config validation and preserve configured PATH for <code>docker exec</code>. (#873) — thanks @akonyer.</li>
+<li>Google: downgrade unsigned thinking blocks before send to avoid missing signature errors.</li>
+</ul>
+<h4>macOS / Apps</h4>
+<ul>
+<li>macOS: ensure launchd log directory exists with a test-only override. (#909) — thanks @roshanasingh4.</li>
+<li>macOS: format ConnectionsStore config to satisfy SwiftFormat lint. (#852) — thanks @mneves75.</li>
+<li>macOS: pass auth token/password to dashboard URL for authenticated access. (#918) — thanks @rahthakor.</li>
+<li>macOS: reuse launchd gateway auth and skip wizard when gateway config already exists. (#917)</li>
+<li>Apps: use canonical main session keys from gateway defaults across macOS/iOS/Android to avoid creating bare <code>main</code> sessions.</li>
+<li>macOS: fix cron preview/testing payload to use <code>channel</code> key. (#867) — thanks @wes-davis.</li>
+<li>macOS: update cron testing channel arg. (#896) — thanks @ngutman.</li>
+</ul>
+<h4>Channels / Messaging</h4>
+<ul>
+<li>Slack: isolate thread history and avoid inheriting channel transcripts for new threads by default. (#758)</li>
+<li>Slack: respect <code>channels.slack.requireMention</code> default when resolving channel mention gating. (#850) — thanks @evalexpr.</li>
+<li>Slack: drop Socket Mode events with mismatched <code>api_app_id</code>/<code>team_id</code>. (#889) — thanks @roshanasingh4.</li>
+<li>Commands: add native command argument menus across Discord/Slack/Telegram. (#936) — thanks @thewilloftheshadow.</li>
+<li>Discord: isolate autoThread thread context. (#856) — thanks @davidguttman.</li>
+<li>Telegram: honor <code>channels.telegram.timeoutSeconds</code> for grammY API requests. (#863) — thanks @Snaver.</li>
+<li>Telegram: aggregate split inbound messages into one prompt (reduces “one reply per fragment”).</li>
+<li>Telegram: let control commands bypass per-chat sequentialization; always allow abort triggers.</li>
+<li>Telegram: split long captions into media + follow-up text messages. (#907) — thanks @jalehman.</li>
+<li>Telegram: migrate group config when supergroups change chat IDs. (#906) — thanks @sleontenko.</li>
+<li>Telegram: register dock native commands with underscores to avoid <code>BOT_COMMAND_INVALID</code> (#929, fixes #901) — thanks @grp06.</li>
+<li>Messaging: unify markdown formatting + format-first chunking for Slack/Telegram/Signal. (#920) — thanks @TheSethRose.</li>
+<li>iMessage: prefer handle routing for direct-message replies; include imsg RPC error details. (#935)</li>
+<li>WhatsApp: fix context isolation using wrong ID (was bot's number, now conversation ID). (#911) — thanks @tristanmanchester.</li>
+<li>WhatsApp: normalize user JIDs with device suffix for allowlist checks in groups. (#838) — thanks @peschee.</li>
+<li>WhatsApp: harden owner command auth.</li>
+<li>Auto-reply: treat trailing <code>NO_REPLY</code> tokens as silent replies.</li>
+</ul>
+<h4>Config / Doctor / Packaging</h4>
+<ul>
+<li>Config: prevent partial config writes from clobbering unrelated settings (base hash guard + merge patch for connection saves).</li>
+<li>Config/Doctor: remove legacy Clawdis env fallbacks and config/service migrations (Clawdbot-only).</li>
+<li>Doctor: avoid re-adding WhatsApp config when only legacy ack reactions are set. (#927, fixes #900) — thanks @grp06.</li>
+<li>Packaging: run <code>pnpm build</code> on <code>prepack</code> so npm publishes include fresh <code>dist/</code> output.</li>
+</ul>
+<p><a href="https://github.com/clawdbot/clawdbot/blob/main/CHANGELOG.md">View full changelog</a></p>
+]]></description>
+            <enclosure url="https://github.com/clawdbot/clawdbot/releases/download/v2026.1.14-1/Clawdbot-2026.1.14-1.zip" length="19887144" type="application/octet-stream" sparkle:edSignature="1irKxBLt2eRtns34m/8JsjL/ZzhZQNjahwrxtArTvzaCnidS/MEnpD4nV2SHnhuo8g+fJZQpV9NoCAoEOAinCw=="/>
+        </item>
    </channel>
 </rss>
@@ -529,7 +529,7 @@ class NodeRuntime(context: Context) {
      caps = buildCapabilities(),
      commands = buildInvokeCommands(),
      permissions = emptyMap(),
-      client = buildClientInfo(clientId = "clawdbot-android", clientMode = "node"),
+      client = buildClientInfo(clientId = "node-host", clientMode = "node"),
      userAgent = buildUserAgent(),
    )
  }
@@ -132,12 +132,6 @@ final class TalkModeManager: NSObject {
    }

    private func startRecognition() throws {
-        #if targetEnvironment(simulator)
-            throw NSError(domain: "TalkMode", code: 2, userInfo: [
-                NSLocalizedDescriptionKey: "Talk mode is not supported on the iOS simulator",
-            ])
-        #endif
-
        self.stopRecognition()
        self.speechRecognizer = SFSpeechRecognizer()
        guard let recognizer = self.speechRecognizer else {
@@ -152,11 +146,6 @@ final class TalkModeManager: NSObject {

        let input = self.audioEngine.inputNode
        let format = input.outputFormat(forBus: 0)
-        guard format.sampleRate > 0, format.channelCount > 0 else {
-            throw NSError(domain: "TalkMode", code: 3, userInfo: [
-                NSLocalizedDescriptionKey: "Invalid audio input format",
-            ])
-        }
        input.removeTap(onBus: 0)
        let tapBlock = Self.makeAudioTapAppendCallback(request: request)
        input.installTap(onBus: 0, bufferSize: 2048, format: format, block: tapBlock)
@@ -87,7 +87,15 @@ final class ControlChannel {

    func configure() async {
        self.logger.info("control channel configure mode=local")
-        await self.refreshEndpoint(reason: "configure")
+        self.state = .connecting
+        do {
+            try await GatewayConnection.shared.refresh()
+            self.state = .connected
+            PresenceReporter.shared.sendImmediate(reason: "connect")
+        } catch {
+            let message = self.friendlyGatewayMessage(error)
+            self.state = .degraded(message)
+        }
    }

    func configure(mode: Mode = .local) async throws {
@@ -103,7 +111,7 @@ final class ControlChannel {
                        "target=\(target, privacy: .public) identitySet=\(idSet, privacy: .public)")
                self.state = .connecting
                _ = try await GatewayEndpointStore.shared.ensureRemoteControlTunnel()
-                await self.refreshEndpoint(reason: "configure")
+                await self.configure()
            } catch {
                self.state = .degraded(error.localizedDescription)
                throw error
@@ -111,19 +119,6 @@ final class ControlChannel {
        }
    }

-    func refreshEndpoint(reason: String) async {
-        self.logger.info("control channel refresh endpoint reason=\(reason, privacy: .public)")
-        self.state = .connecting
-        do {
-            try await self.establishGatewayConnection()
-            self.state = .connected
-            PresenceReporter.shared.sendImmediate(reason: "connect")
-        } catch {
-            let message = self.friendlyGatewayMessage(error)
-            self.state = .degraded(message)
-        }
-    }
-
    func disconnect() async {
        await GatewayConnection.shared.shutdown()
        self.state = .disconnected
@@ -280,28 +275,18 @@ final class ControlChannel {
                }
            }

-            await self.refreshEndpoint(reason: "recovery:\(reasonText)")
-            if case .connected = self.state {
+            do {
+                try await GatewayConnection.shared.refresh()
                self.logger.info("control channel recovery finished")
-            } else if case let .degraded(message) = self.state {
-                self.logger.error("control channel recovery failed \(message, privacy: .public)")
+            } catch {
+                self.logger.error(
+                    "control channel recovery failed \(error.localizedDescription, privacy: .public)")
            }

            self.recoveryTask = nil
        }
    }

-    private func establishGatewayConnection(timeoutMs: Int = 5000) async throws {
-        try await GatewayConnection.shared.refresh()
-        let ok = try await GatewayConnection.shared.healthOK(timeoutMs: timeoutMs)
-        if ok == false {
-            throw NSError(
-                domain: "Gateway",
-                code: 0,
-                userInfo: [NSLocalizedDescriptionKey: "gateway health not ok"])
-        }
-    }
-
    func sendSystemEvent(_ text: String, params: [String: AnyHashable] = [:]) async throws {
        var merged = params
        merged["text"] = AnyHashable(text)
@@ -1,63 +0,0 @@
-import Foundation
-import Observation
-import OSLog
-
-@MainActor
-@Observable
-final class GatewayConnectivityCoordinator {
-    static let shared = GatewayConnectivityCoordinator()
-
-    private let logger = Logger(subsystem: "com.clawdbot", category: "gateway.connectivity")
-    private var endpointTask: Task<Void, Never>?
-    private var lastResolvedURL: URL?
-
-    private(set) var endpointState: GatewayEndpointState?
-    private(set) var resolvedURL: URL?
-    private(set) var resolvedMode: AppState.ConnectionMode?
-    private(set) var resolvedHostLabel: String?
-
-    private init() {
-        self.start()
-    }
-
-    func start() {
-        guard self.endpointTask == nil else { return }
-        self.endpointTask = Task { [weak self] in
-            guard let self else { return }
-            let stream = await GatewayEndpointStore.shared.subscribe()
-            for await state in stream {
-                await MainActor.run { self.handleEndpointState(state) }
-            }
-        }
-    }
-
-    var localEndpointHostLabel: String? {
-        guard self.resolvedMode == .local, let url = self.resolvedURL else { return nil }
-        return Self.hostLabel(for: url)
-    }
-
-    private func handleEndpointState(_ state: GatewayEndpointState) {
-        self.endpointState = state
-        switch state {
-        case let .ready(mode, url, _, _):
-            self.resolvedMode = mode
-            self.resolvedURL = url
-            self.resolvedHostLabel = Self.hostLabel(for: url)
-            let urlChanged = self.lastResolvedURL?.absoluteString != url.absoluteString
-            if urlChanged {
-                self.lastResolvedURL = url
-                Task { await ControlChannel.shared.refreshEndpoint(reason: "endpoint changed") }
-            }
-        case let .connecting(mode, _):
-            self.resolvedMode = mode
-        case let .unavailable(mode, _):
-            self.resolvedMode = mode
-        }
-    }
-
-    private static func hostLabel(for url: URL) -> String {
-        let host = url.host ?? url.absoluteString
-        if let port = url.port { return "\(host):\(port)" }
-        return host
-    }
-}
@@ -68,7 +68,6 @@ actor GatewayEndpointStore {
                    env: ProcessInfo.processInfo.environment)
                let customBindHost = GatewayEndpointStore.resolveGatewayCustomBindHost(root: root)
                let tailscaleIP = await MainActor.run { TailscaleService.shared.tailscaleIP }
-                    ?? TailscaleService.fallbackTailnetIPv4()
                return GatewayEndpointStore.resolveLocalGatewayHost(
                    bindMode: bind,
                    customBindHost: customBindHost,
@@ -488,7 +487,6 @@ actor GatewayEndpointStore {
        guard currentHost == "127.0.0.1" || currentHost == "localhost" else { return nil }

        let tailscaleIP = await MainActor.run { TailscaleService.shared.tailscaleIP }
-            ?? TailscaleService.fallbackTailnetIPv4()
        guard let tailscaleIP, !tailscaleIP.isEmpty else { return nil }

        let scheme = GatewayEndpointStore.resolveGatewayScheme(
@@ -235,8 +235,8 @@ final class HealthStore {
            let lower = error.lowercased()
            if lower.contains("connection refused") {
                let port = GatewayEnvironment.gatewayPort()
-                let host = GatewayConnectivityCoordinator.shared.localEndpointHostLabel ?? "127.0.0.1:\(port)"
-                return "The gateway control port (\(host)) isn’t listening — restart Clawdbot to bring it back."
+                return "The gateway control port (127.0.0.1:\(port)) isn’t listening — " +
+                    "restart Clawdbot to bring it back."
            }
            if lower.contains("timeout") {
                return "Timed out waiting for the control server; the gateway may be crashed or still starting."
@@ -13,7 +13,6 @@ struct ClawdbotApp: App {
    private let gatewayManager = GatewayProcessManager.shared
    private let controlChannel = ControlChannel.shared
    private let activityStore = WorkActivityStore.shared
-    private let connectivityCoordinator = GatewayConnectivityCoordinator.shared
    @State private var statusItem: NSStatusItem?
    @State private var isMenuPresented = false
    @State private var isPanelVisible = false
@@ -469,7 +469,7 @@ extension MenuSessionsInjector {
            }
        case .local:
            platform = "local"
-            host = GatewayConnectivityCoordinator.shared.localEndpointHostLabel ?? "127.0.0.1:\(port)"
+            host = "127.0.0.1:\(port)"
        case .unconfigured:
            platform = nil
            host = nil
@@ -103,7 +103,6 @@ final class TailscaleService {
    }

    func checkTailscaleStatus() async {
-        let previousIP = self.tailscaleIP
        self.isInstalled = self.checkAppInstallation()
        if !self.isInstalled {
            self.isRunning = false
@@ -148,10 +147,6 @@ final class TailscaleService {
            self.statusError = nil
            self.logger.info("Tailscale interface IP detected (fallback) ip=\(fallback, privacy: .public)")
        }
-
-        if previousIP != self.tailscaleIP {
-            await GatewayEndpointStore.shared.refresh()
-        }
    }

    func openTailscaleApp() {
@@ -178,7 +173,7 @@ final class TailscaleService {
        }
    }

-    private nonisolated static func isTailnetIPv4(_ address: String) -> Bool {
+    private static func isTailnetIPv4(_ address: String) -> Bool {
        let parts = address.split(separator: ".")
        guard parts.count == 4 else { return false }
        let octets = parts.compactMap { Int($0) }
@@ -188,7 +183,7 @@ final class TailscaleService {
        return a == 100 && b >= 64 && b <= 127
    }

-    private nonisolated static func detectTailnetIPv4() -> String? {
+    private static func detectTailnetIPv4() -> String? {
        var addrList: UnsafeMutablePointer<ifaddrs>?
        guard getifaddrs(&addrList) == 0, let first = addrList else { return nil }
        defer { freeifaddrs(addrList) }
@@ -219,8 +214,4 @@ final class TailscaleService {

        return nil
    }
-
-    nonisolated static func fallbackTailnetIPv4() -> String? {
-        Self.detectTailnetIPv4()
-    }
 }
@@ -23,35 +23,6 @@ public actor GatewayNodeSession {
    private var onConnected: (@Sendable () async -> Void)?
    private var onDisconnected: (@Sendable (String) async -> Void)?
    private var onInvoke: (@Sendable (BridgeInvokeRequest) async -> BridgeInvokeResponse)?
-
-    static func invokeWithTimeout(
-        request: BridgeInvokeRequest,
-        timeoutMs: Int?,
-        onInvoke: @escaping @Sendable (BridgeInvokeRequest) async -> BridgeInvokeResponse
-    ) async -> BridgeInvokeResponse {
-        let timeout = max(0, timeoutMs ?? 0)
-        guard timeout > 0 else {
-            return await onInvoke(request)
-        }
-
-        return await withTaskGroup(of: BridgeInvokeResponse.self) { group in
-            group.addTask { await onInvoke(request) }
-            group.addTask {
-                try? await Task.sleep(nanoseconds: UInt64(timeout) * 1_000_000)
-                return BridgeInvokeResponse(
-                    id: request.id,
-                    ok: false,
-                    error: ClawdbotNodeError(
-                        code: .unavailable,
-                        message: "node invoke timed out")
-                )
-            }
-
-            let first = await group.next()!
-            group.cancelAll()
-            return first
-        }
-    }
    private var serverEventSubscribers: [UUID: AsyncStream<EventFrame>.Continuation] = [:]
    private var canvasHostUrl: String?

@@ -196,11 +167,7 @@ public actor GatewayNodeSession {
            let request = try self.decoder.decode(NodeInvokeRequestPayload.self, from: data)
            guard let onInvoke else { return }
            let req = BridgeInvokeRequest(id: request.id, command: request.command, paramsJSON: request.paramsJSON)
-            let response = await Self.invokeWithTimeout(
-                request: req,
-                timeoutMs: request.timeoutMs,
-                onInvoke: onInvoke
-            )
+            let response = await onInvoke(req)
            await self.sendInvokeResult(request: request, response: response)
        } catch {
            self.logger.error("node invoke decode failed: \(error.localizedDescription, privacy: .public)")
@@ -213,10 +180,8 @@ public actor GatewayNodeSession {
            "id": AnyCodable(request.id),
            "nodeId": AnyCodable(request.nodeId),
            "ok": AnyCodable(response.ok),
+            "payloadJSON": AnyCodable(response.payloadJSON ?? NSNull()),
        ]
-        if let payloadJSON = response.payloadJSON {
-            params["payloadJSON"] = AnyCodable(payloadJSON)
-        }
        if let error = response.error {
            params["error"] = AnyCodable([
                "code": AnyCodable(error.code.rawValue),
@@ -1,56 +0,0 @@
-import Foundation
-import Testing
-@testable import ClawdbotKit
-import ClawdbotProtocol
-
-struct GatewayNodeSessionTests {
-    @Test
-    func invokeWithTimeoutReturnsUnderlyingResponseBeforeTimeout() async {
-        let request = BridgeInvokeRequest(id: "1", command: "x", paramsJSON: nil)
-        let response = await GatewayNodeSession.invokeWithTimeout(
-            request: request,
-            timeoutMs: 50,
-            onInvoke: { req in
-                #expect(req.id == "1")
-                return BridgeInvokeResponse(id: req.id, ok: true, payloadJSON: "{}", error: nil)
-            }
-        )
-
-        #expect(response.ok == true)
-        #expect(response.error == nil)
-        #expect(response.payloadJSON == "{}")
-    }
-
-    @Test
-    func invokeWithTimeoutReturnsTimeoutError() async {
-        let request = BridgeInvokeRequest(id: "abc", command: "x", paramsJSON: nil)
-        let response = await GatewayNodeSession.invokeWithTimeout(
-            request: request,
-            timeoutMs: 10,
-            onInvoke: { _ in
-                try? await Task.sleep(nanoseconds: 200_000_000) // 200ms
-                return BridgeInvokeResponse(id: "abc", ok: true, payloadJSON: "{}", error: nil)
-            }
-        )
-
-        #expect(response.ok == false)
-        #expect(response.error?.code == .unavailable)
-        #expect(response.error?.message.contains("timed out") == true)
-    }
-
-    @Test
-    func invokeWithTimeoutZeroDisablesTimeout() async {
-        let request = BridgeInvokeRequest(id: "1", command: "x", paramsJSON: nil)
-        let response = await GatewayNodeSession.invokeWithTimeout(
-            request: request,
-            timeoutMs: 0,
-            onInvoke: { req in
-                try? await Task.sleep(nanoseconds: 5_000_000)
-                return BridgeInvokeResponse(id: req.id, ok: true, payloadJSON: nil, error: nil)
-            }
-        )
-
-        #expect(response.ok == true)
-        #expect(response.error == nil)
-    }
-}
@@ -825,9 +825,9 @@ Common options:
 - `--url`, `--token`, `--timeout`, `--json`

 Subcommands:
- `nodes status [--connected] [--last-connected <duration>]`
+- `nodes status`
 - `nodes describe --node <id|name|ip>`
- `nodes list [--connected] [--last-connected <duration>]`
+- `nodes list`
 - `nodes pending`
 - `nodes approve <requestId>`
 - `nodes reject <requestId>`
@@ -18,18 +18,12 @@ Related:

 ```bash
 clawdbot nodes list
-clawdbot nodes list --connected
-clawdbot nodes list --last-connected 24h
 clawdbot nodes pending
 clawdbot nodes approve <requestId>
 clawdbot nodes status
-clawdbot nodes status --connected
-clawdbot nodes status --last-connected 24h
 ```

 `nodes list` prints pending/paired tables. Paired rows include the most recent connect age (Last Connect).
-Use `--connected` to only show currently-connected nodes. Use `--last-connected <duration>` to
-filter to nodes that connected within a duration (e.g. `24h`, `7d`).

 ## Invoke / run

@@ -7,9 +7,9 @@ read_when:

 # `clawdbot update`

-Safely update Clawdbot and switch between stable/beta/dev channels.
+Safely update a **source checkout** (git install) of Clawdbot.

-If you installed via **npm/pnpm** (global install, no git metadata), updates happen via the package manager flow in [Updating](/install/updating).
+If you installed via **npm/pnpm** (global install, no git metadata), use the package manager flow in [Updating](/install/updating).

 ## Usage

@@ -48,16 +48,7 @@ Options:
 - `--json`: print machine-readable status JSON.
 - `--timeout <seconds>`: timeout for checks (default is 3s).

-## What it does
-
-When you switch channels explicitly (`--channel ...`), Clawdbot also keeps the
-install method aligned:
-
- `dev` → ensures a git checkout (default: `~/clawdbot`, override with `CLAWDBOT_GIT_DIR`),
-  updates it, and installs the global CLI from that checkout.
- `stable`/`beta` → installs from npm using the matching dist-tag.
-
-## Git checkout flow
+## What it does (git checkout)

 Channels:

@@ -7,7 +7,7 @@ read_when:

 # Development channels

-Last updated: 2026-01-21
+Last updated: 2026-01-20

 Clawdbot ships three update channels:

@@ -38,13 +38,6 @@ clawdbot update --channel dev

 This updates via the corresponding npm dist-tag (`latest`, `beta`, `dev`).

-When you **explicitly** switch channels with `--channel`, Clawdbot also aligns
-the install method:
-
- `dev` ensures a git checkout (default `~/clawdbot`, override with `CLAWDBOT_GIT_DIR`),
-  updates it, and installs the global CLI from that checkout.
- `stable`/`beta` installs from npm using the matching dist-tag.
-
 Tip: if you want stable + dev in parallel, keep two clones and point your gateway at the stable one.

 ## Plugins and channels
@@ -34,81 +34,6 @@ clawdbot nodes rename --node <idOrNameOrIp> --name "Kitchen iPad"
 Notes:
 - `nodes rename` stores a display name override in the gateway pairing store.

-## Remote node host (system.run)
-
-Use a **node host** when your Gateway runs on one machine and you want commands
-to execute on another. The model still talks to the **gateway**; the gateway
-forwards `exec` calls to the **node host** when `host=node` is selected.
-
-### What runs where
- **Gateway host**: receives messages, runs the model, routes tool calls.
- **Node host**: executes `system.run`/`system.which` on the node machine.
- **Approvals**: enforced on the node host via `~/.clawdbot/exec-approvals.json`.
-
-### Start a node host (foreground)
-
-On the node machine:
-
-```bash
-clawdbot node start --host <gateway-host> --port 18789 --display-name "Build Node"
-```
-
-### Start a node host (service)
-
-```bash
-clawdbot node service install --host <gateway-host> --port 18789 --display-name "Build Node"
-clawdbot node service start
-```
-
-### Pair + name
-
-On the gateway host:
-
-```bash
-clawdbot nodes pending
-clawdbot nodes approve <requestId>
-clawdbot nodes list
-```
-
-Naming options:
- `--display-name` on `clawdbot node start/service install` (persists in `~/.clawdbot/node.json` on the node).
- `clawdbot nodes rename --node <id|name|ip> --name "Build Node"` (gateway override).
-
-### Allowlist the commands
-
-Exec approvals are **per node host**. Add allowlist entries from the gateway:
-
-```bash
-clawdbot approvals allowlist add --node <id|name|ip> "/usr/bin/uname"
-clawdbot approvals allowlist add --node <id|name|ip> "/usr/bin/sw_vers"
-```
-
-Approvals live on the node host at `~/.clawdbot/exec-approvals.json`.
-
-### Point exec at the node
-
-Configure defaults (gateway config):
-
-```bash
-clawdbot config set tools.exec.host node
-clawdbot config set tools.exec.security allowlist
-clawdbot config set tools.exec.node "<id-or-name>"
-```
-
-Or per session:
-
-```
-/exec host=node security=allowlist node=<id-or-name>
-```
-
-Once set, any `exec` call with `host=node` runs on the node host (subject to the
-node allowlist/approvals).
-
-Related:
- [Node host CLI](/cli/node)
- [Exec tool](/tools/exec)
- [Exec approvals](/tools/exec-approvals)
-
 ## Invoking commands

 Low-level (raw RPC):
@@ -289,9 +214,6 @@ Notes:
 - The node host stores its node id + pairing token in `~/.clawdbot/node.json`.
 - Exec approvals are enforced locally via `~/.clawdbot/exec-approvals.json`
  (see [Exec approvals](/tools/exec-approvals)).
- On macOS, the headless node host prefers the companion app exec host when reachable and falls
-  back to local execution if the app is unavailable. Set `CLAWDBOT_NODE_EXEC_HOST=app` to require
-  the app, or `CLAWDBOT_NODE_EXEC_FALLBACK=0` to disable fallback.
 - Add `--tls` / `--tls-fingerprint` when the bridge requires TLS.

 ## Mac node mode
@@ -26,7 +26,6 @@ When the operator says “release”, immediately do this preflight (no extra qu
 2) **Build & artifacts**
 - [ ] If A2UI inputs changed, run `pnpm canvas:a2ui:bundle` and commit any updated [`src/canvas-host/a2ui/a2ui.bundle.js`](https://github.com/clawdbot/clawdbot/blob/main/src/canvas-host/a2ui/a2ui.bundle.js).
 - [ ] `pnpm run build` (regenerates `dist/`).
- [ ] Verify npm package `files` includes all required `dist/*` folders (notably `dist/node-host/**` and `dist/acp/**` for headless node + ACP CLI).
 - [ ] Confirm `dist/build-info.json` exists and includes the expected `commit` hash (CLI banner uses this for npm installs).
 - [ ] Optional: `npm pack --pack-destination /tmp` after the build; inspect the tarball contents and keep it handy for the GitHub release (do **not** commit it).

@@ -60,7 +60,6 @@ Text + native (when enabled):
 - `/commands`
 - `/skill <name> [input]` (run a skill by name)
 - `/status` (show current status; includes provider usage/quota for the current model provider when available)
- `/allowlist` (list/add/remove allowlist entries)
 - `/context [list|detail|json]` (explain “context”; `detail` shows per-file + per-tool + per-skill + system prompt size)
 - `/whoami` (show your sender id; alias: `/id`)
 - `/subagents list|stop|log|info|send` (inspect, stop, log, or message sub-agent runs for the current session)
@@ -94,7 +93,6 @@ Notes:
 - Commands accept an optional `:` between the command and args (e.g. `/think: high`, `/send: on`, `/help:`).
 - `/new <model>` accepts a model alias, `provider/model`, or a provider name (fuzzy match); if no match, the text is treated as the message body.
 - For full provider usage breakdown, use `clawdbot status --usage`.
- `/allowlist add|remove` requires `commands.config=true` and honors channel `configWrites`.
 - `/usage` controls the per-response usage footer; `/usage cost` prints a local cost summary from Clawdbot session logs.
 - `/restart` is disabled by default; set `commands.restart: true` to enable it.
 - `/verbose` is meant for debugging and extra visibility; keep it **off** in normal use.
@@ -1,12 +1,10 @@
 {
  "name": "@clawdbot/bluebubbles",
-  "version": "2026.1.20",
+  "version": "2026.1.15",
  "type": "module",
  "description": "Clawdbot BlueBubbles channel plugin",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ],
+    "extensions": ["./index.ts"],
    "channel": {
      "id": "bluebubbles",
      "label": "BlueBubbles",
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/copilot-proxy",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Copilot Proxy provider plugin",
  "clawdbot": {
@@ -1,12 +1,10 @@
 {
  "name": "@clawdbot/diagnostics-otel",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot diagnostics OpenTelemetry exporter",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ]
+    "extensions": ["./index.ts"]
  },
  "dependencies": {
    "@opentelemetry/api": "^1.9.0",
@@ -1,11 +1,9 @@
 {
  "name": "@clawdbot/discord",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Discord channel plugin",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ]
+    "extensions": ["./index.ts"]
  }
 }
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/google-antigravity-auth",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Google Antigravity OAuth provider plugin",
  "clawdbot": {
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/google-gemini-cli-auth",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Gemini CLI OAuth provider plugin",
  "clawdbot": {
@@ -1,11 +1,9 @@
 {
  "name": "@clawdbot/imessage",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot iMessage channel plugin",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ]
+    "extensions": ["./index.ts"]
  }
 }
@@ -1,10 +1,5 @@
 # Changelog

-## 2026.1.20
-
-### Changes
- Version alignment with core Clawdbot release numbers.
-
 ## 2026.1.17-1

 ### Changes
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/matrix",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Matrix channel plugin",
  "clawdbot": {
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/memory-core",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot core memory search plugin",
  "clawdbot": {
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/memory-lancedb",
-  "version": "2026.1.20",
+  "version": "0.0.1",
  "type": "module",
  "description": "Clawdbot LanceDB-backed long-term memory plugin with auto-recall/capture",
  "dependencies": {
@@ -1,10 +1,5 @@
 # Changelog

-## 2026.1.20
-
-### Changes
- Version alignment with core Clawdbot release numbers.
-
 ## 2026.1.17-1

 ### Changes
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/msteams",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Microsoft Teams channel plugin",
  "clawdbot": {
@@ -14,9 +14,7 @@
      "docsPath": "/channels/msteams",
      "docsLabel": "msteams",
      "blurb": "Bot Framework; enterprise support.",
-      "aliases": [
-        "teams"
-      ],
+      "aliases": ["teams"],
      "order": 60
    },
    "install": {
@@ -1,12 +1,10 @@
 {
  "name": "@clawdbot/nextcloud-talk",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Nextcloud Talk channel plugin",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ],
+    "extensions": ["./index.ts"],
    "channel": {
      "id": "nextcloud-talk",
      "label": "Nextcloud Talk",
@@ -14,10 +12,7 @@
      "docsPath": "/channels/nextcloud-talk",
      "docsLabel": "nextcloud-talk",
      "blurb": "Self-hosted chat via Nextcloud Talk webhook bots.",
-      "aliases": [
-        "nc-talk",
-        "nc"
-      ],
+      "aliases": ["nc-talk", "nc"],
      "order": 65,
      "quickstartAllowFrom": true
    },
@@ -1,10 +1,5 @@
 # Changelog

-## 2026.1.20
-
-### Changes
- Version alignment with core Clawdbot release numbers.
-
 ## 2026.1.19-1

 Initial release.
@@ -1,12 +1,10 @@
 {
  "name": "@clawdbot/nostr",
-  "version": "2026.1.20",
+  "version": "2026.1.19-1",
  "type": "module",
  "description": "Clawdbot Nostr channel plugin for NIP-04 encrypted DMs",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ],
+    "extensions": ["./index.ts"],
    "channel": {
      "id": "nostr",
      "label": "Nostr",
@@ -1,11 +1,9 @@
 {
  "name": "@clawdbot/signal",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Signal channel plugin",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ]
+    "extensions": ["./index.ts"]
  }
 }
@@ -1,11 +1,9 @@
 {
  "name": "@clawdbot/slack",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Slack channel plugin",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ]
+    "extensions": ["./index.ts"]
  }
 }
@@ -1,11 +1,9 @@
 {
  "name": "@clawdbot/telegram",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Telegram channel plugin",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ]
+    "extensions": ["./index.ts"]
  }
 }
@@ -1,10 +1,5 @@
 # Changelog

-## 2026.1.20
-
-### Changes
- Version alignment with core Clawdbot release numbers.
-
 ## 2026.1.17-1

 ### Changes
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/voice-call",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot voice-call plugin",
  "dependencies": {
@@ -1,11 +1,9 @@
 {
  "name": "@clawdbot/whatsapp",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot WhatsApp channel plugin",
  "clawdbot": {
-    "extensions": [
-      "./index.ts"
-    ]
+    "extensions": ["./index.ts"]
  }
 }
@@ -1,10 +1,5 @@
 # Changelog

-## 2026.1.20
-
-### Changes
- Version alignment with core Clawdbot release numbers.
-
 ## 2026.1.17-1

 ### Changes
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/zalo",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Zalo channel plugin",
  "clawdbot": {
@@ -14,9 +14,7 @@
      "docsPath": "/channels/zalo",
      "docsLabel": "zalo",
      "blurb": "Vietnam-focused messaging platform with Bot API.",
-      "aliases": [
-        "zl"
-      ],
+      "aliases": ["zl"],
      "order": 80,
      "quickstartAllowFrom": true
    },
@@ -1,10 +1,5 @@
 # Changelog

-## 2026.1.20
-
-### Changes
- Version alignment with core Clawdbot release numbers.
-
 ## 2026.1.17-1

 - Initial version with full channel plugin support
@@ -1,6 +1,6 @@
 {
  "name": "@clawdbot/zalouser",
-  "version": "2026.1.20",
+  "version": "2026.1.17-1",
  "type": "module",
  "description": "Clawdbot Zalo Personal Account plugin via zca-cli",
  "dependencies": {
@@ -1,6 +1,6 @@
 {
  "name": "clawdbot",
-  "version": "2026.1.20-1",
+  "version": "2026.1.20",
  "description": "WhatsApp gateway CLI (Baileys web) with Pi RPC agent",
  "type": "module",
  "main": "dist/index.js",
@@ -50,7 +50,6 @@
    "extensions/**",
    "assets/**",
    "skills/**",
-    "patches/**",
    "README.md",
    "README-header.png",
    "CHANGELOG.md",
@@ -211,7 +210,6 @@
    "@types/proper-lockfile": "^4.1.4",
    "@types/qrcode-terminal": "^0.12.2",
    "@types/ws": "^8.18.1",
-    "@typescript/native-preview": "7.0.0-dev.20260120.1",
    "@vitest/coverage-v8": "^4.0.17",
    "docx-preview": "^0.3.7",
    "lit": "^3.3.2",
@@ -233,7 +231,7 @@
    "overrides": {
      "@sinclair/typebox": "0.34.47",
      "hono": "4.11.4",
-      "tar": "7.5.4"
+      "tar": "7.5.3"
    },
    "patchedDependencies": {
      "@mariozechner/pi-ai@0.49.2": "patches/@mariozechner__pi-ai@0.49.2.patch"
@@ -7,7 +7,7 @@ settings:
 overrides:
  '@sinclair/typebox': 0.34.47
  hono: 4.11.4
-  tar: 7.5.4
+  tar: 7.5.3

 patchedDependencies:
  '@mariozechner/pi-ai@0.49.2':
@@ -151,8 +151,8 @@ importers:
        specifier: 0.1.7-alpha.2
        version: 0.1.7-alpha.2
      tar:
-        specifier: 7.5.4
-        version: 7.5.4
+        specifier: 7.5.3
+        version: 7.5.3
      tslog:
        specifier: ^4.10.2
        version: 4.10.2
@@ -202,9 +202,6 @@ importers:
      '@types/ws':
        specifier: ^8.18.1
        version: 8.18.1
-      '@typescript/native-preview':
-        specifier: 7.0.0-dev.20260120.1
-        version: 7.0.0-dev.20260120.1
      '@vitest/coverage-v8':
        specifier: ^4.0.17
        version: 4.0.17(@vitest/browser@4.0.17(vite@7.3.1(@types/node@25.0.9)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0)(yaml@2.8.2))(vitest@4.0.17))(vitest@4.0.17)
@@ -2533,45 +2530,6 @@ packages:
  '@types/ws@8.18.1':
    resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}

-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260120.1':
-    resolution: {integrity: sha512-r3pWFuR2H7mn6ScwpH5jJljKQqKto0npVuJSk6pRwFwexpTyxOGmJTZJ1V0AWiisaNxU2+CNAqWFJSJYIE/QTg==}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260120.1':
-    resolution: {integrity: sha512-cuC1+wLbUP+Ip2UT94G134fqRdp5w3b3dhcCO6/FQ4yXxvRNyv/WK+upHBUFDaeSOeHgDTyO9/QFYUWwC4If1A==}
-    cpu: [x64]
-    os: [darwin]
-
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260120.1':
-    resolution: {integrity: sha512-zZGvEGY7wcHYefMZ87KNmvjN3NLIhsCMHEpHZiGCS3khKf+8z6ZsanrzCjOTodvL01VPyBzHxV1EtkSxAcLiQg==}
-    cpu: [arm64]
-    os: [linux]
-
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260120.1':
-    resolution: {integrity: sha512-vN6OYVySol/kQZjJGmAzd6L30SyVlCgmCXS8WjUYtE5clN0YrzQHop16RK29fYZHMxpkOniVBtRPxUYQANZBlQ==}
-    cpu: [arm]
-    os: [linux]
-
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260120.1':
-    resolution: {integrity: sha512-JBfNhWd/asd5MDeS3VgRvE24pGKBkmvLub6tsux6ypr+Yhy+o0WaAEzVpmlRYZUqss2ai5tvOu4dzPBXzZAtFw==}
-    cpu: [x64]
-    os: [linux]
-
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260120.1':
-    resolution: {integrity: sha512-tTndRtYCq2xwgE0VkTi9ACNiJaV43+PqvBqCxk8ceYi3X36Ve+CCnwlZfZJ4k9NxZthtrAwF/kUmpC9iIYbq1w==}
-    cpu: [arm64]
-    os: [win32]
-
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260120.1':
-    resolution: {integrity: sha512-oZia7hFL6k9pVepfonuPI86Jmyz6WlJKR57tWCDwRNmpA7odxuTq1PbvcYgy1z4+wHF1nnKKJY0PMAiq6ac18w==}
-    cpu: [x64]
-    os: [win32]
-
-  '@typescript/native-preview@7.0.0-dev.20260120.1':
-    resolution: {integrity: sha512-nnEf37C9ue7OBRnF2zmV/OCBmV5Y7T/K4mCHa+nxgiXcF/1w8sA0cgdFl+gHQ0mysqUJ+Bu5btAMeWgpLyjrgg==}
-    hasBin: true
-
  '@typespec/ts-http-runtime@0.3.2':
    resolution: {integrity: sha512-IlqQ/Gv22xUC1r/WQm4StLkYQmaaTsXAhUVsNE0+xiyf0yRFiH5++q78U3bw6bLKDCTmh0uqKB9eG9+Bt75Dkg==}
    engines: {node: '>=20.0.0'}
@@ -4905,9 +4863,10 @@ packages:
  tailwindcss@4.1.17:
    resolution: {integrity: sha512-j9Ee2YjuQqYT9bbRTfTZht9W/ytp5H+jJpZKiYdP/bpnXARAuELt9ofP0lPnmHjbga7SNQIxdTAXCmtKVYjN+Q==}

-  tar@7.5.4:
-    resolution: {integrity: sha512-AN04xbWGrSTDmVwlI4/GTlIIwMFk/XEv7uL8aa57zuvRy6s4hdBed+lVq2fAZ89XDa7Us3ANXcE3Tvqvja1kTA==}
+  tar@7.5.3:
+    resolution: {integrity: sha512-ENg5JUHUm2rDD7IvKNFGzyElLXNjachNLp6RaGf4+JOgxXHkqA+gq81ZAMCUmtMtqBsoU62lcp6S27g1LCYGGQ==}
    engines: {node: '>=18'}
+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exhorbitant rates) by contacting i@izs.me

  thenify-all@1.6.0:
    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
@@ -7740,37 +7699,6 @@ snapshots:
    dependencies:
      '@types/node': 25.0.9

-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260120.1':
-    optional: true
-
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260120.1':
-    optional: true
-
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260120.1':
-    optional: true
-
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260120.1':
-    optional: true
-
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260120.1':
-    optional: true
-
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260120.1':
-    optional: true
-
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260120.1':
-    optional: true
-
-  '@typescript/native-preview@7.0.0-dev.20260120.1':
-    optionalDependencies:
-      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260120.1
-      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260120.1
-      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260120.1
-      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260120.1
-      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260120.1
-      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260120.1
-      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260120.1
-
  '@typespec/ts-http-runtime@0.3.2':
    dependencies:
      http-proxy-agent: 7.0.2
@@ -8268,7 +8196,7 @@ snapshots:
      npmlog: 6.0.2
      rc: 1.2.8
      semver: 7.7.3
-      tar: 7.5.4
+      tar: 7.5.3
      url-join: 4.0.1
      which: 2.0.2
      yargs: 17.7.2
@@ -10510,7 +10438,7 @@ snapshots:

  tailwindcss@4.1.17: {}

-  tar@7.5.4:
+  tar@7.5.3:
    dependencies:
      '@isaacs/fs-minipass': 4.0.1
      chownr: 3.0.0
@@ -21,7 +21,7 @@ handle_sudo_error() {
    echo -e "\n${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
    echo -e "${YELLOW}⚠️  Password Required for Log Access${NC}"
    echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}\n"
-    echo -e "clawlog needs to use sudo to show complete log data (Apple hides sensitive info by default)."
+    echo -e "vtlog needs to use sudo to show complete log data (Apple hides sensitive info by default)."
    echo -e "\nTo avoid password prompts, configure passwordless sudo for the log command:"
    echo -e "See: ${BLUE}apple/docs/logging-private-fix.md${NC}\n"
    echo -e "Quick fix:"
@@ -51,7 +51,7 @@ show_usage() {
 clawlog - Clawdbot Logging Utility

 USAGE:
-    clawlog [OPTIONS]
+    vtlog [OPTIONS]

 DESCRIPTION:
    View Clawdbot logs with full details (bypasses Apple's privacy redaction).
@@ -69,10 +69,10 @@ LOG CATEGORIES (examples):
    • shell               - ShellExecutor

 QUICK START:
-    clawlog -n 100             Show last 100 lines from all components
-    clawlog -f                 Follow logs in real-time
-    clawlog -e                 Show only errors
-    clawlog -c ServerManager   Show logs from ServerManager only
+    vtlog -n 100             Show last 100 lines from all components
+    vtlog -f                 Follow logs in real-time
+    vtlog -e                 Show only errors
+    vtlog -c ServerManager   Show logs from ServerManager only

 OPTIONS:
    -h, --help              Show this help message
@@ -91,15 +91,15 @@ OPTIONS:
    --json                  Output in JSON format

 EXAMPLES:
-    clawlog                   Show last 50 lines from past 5 minutes (default)
-    clawlog -f                Stream logs continuously
-    clawlog -n 100            Show last 100 lines
-    clawlog -e                Show only recent errors
-    clawlog -l 30m -n 200     Show last 200 lines from past 30 minutes
-    clawlog -c ServerManager  Show recent ServerManager logs
-    clawlog -s "fail"         Search for "fail" in recent logs
-    clawlog --server -e       Show recent server errors
-    clawlog -f -d             Stream debug logs continuously
+    vtlog                   Show last 50 lines from past 5 minutes (default)
+    vtlog -f                Stream logs continuously
+    vtlog -n 100            Show last 100 lines
+    vtlog -e                Show only recent errors
+    vtlog -l 30m -n 200     Show last 200 lines from past 30 minutes
+    vtlog -c ServerManager  Show recent ServerManager logs
+    vtlog -s "fail"         Search for "fail" in recent logs
+    vtlog --server -e       Show recent server errors
+    vtlog -f -d             Stream debug logs continuously

 CATEGORIES:
    Common categories include:
@@ -7,8 +7,6 @@ import process from "node:process";
 const args = process.argv.slice(2);
 const env = { ...process.env };
 const cwd = process.cwd();
-const compiler = env.CLAWDBOT_TS_COMPILER === "tsc" ? "tsc" : "tsgo";
-const projectArgs = ["--project", "tsconfig.json"];

 const distRoot = path.join(cwd, "dist");
 const distEntry = path.join(distRoot, "entry.js");
@@ -115,7 +113,7 @@ if (!shouldBuild()) {
  runNode();
 } else {
  logRunner("Building TypeScript (dist is stale).");
-  const build = spawn("pnpm", ["exec", compiler, ...projectArgs], {
+  const build = spawn("pnpm", ["exec", "tsc", "-p", "tsconfig.json"], {
    cwd,
    env,
    stdio: "inherit",
@@ -5,10 +5,8 @@ import process from "node:process";
 const args = process.argv.slice(2);
 const env = { ...process.env };
 const cwd = process.cwd();
-const compiler = env.CLAWDBOT_TS_COMPILER === "tsc" ? "tsc" : "tsgo";
-const projectArgs = ["--project", "tsconfig.json"];

-const initialBuild = spawnSync("pnpm", ["exec", compiler, ...projectArgs], {
+const initialBuild = spawnSync("pnpm", ["exec", "tsc", "-p", "tsconfig.json"], {
  cwd,
  env,
  stdio: "inherit",
@@ -18,12 +16,7 @@ if (initialBuild.status !== 0) {
  process.exit(initialBuild.status ?? 1);
 }

-const watchArgs =
-  compiler === "tsc"
-    ? [...projectArgs, "--watch", "--preserveWatchOutput"]
-    : [...projectArgs, "--watch"];
-
-const compilerProcess = spawn("pnpm", ["exec", compiler, ...watchArgs], {
+const tsc = spawn("pnpm", ["exec", "tsc", "--watch", "--preserveWatchOutput"], {
  cwd,
  env,
  stdio: "inherit",
@@ -41,14 +34,14 @@ function cleanup(code = 0) {
  if (exiting) return;
  exiting = true;
  nodeProcess.kill("SIGTERM");
-  compilerProcess.kill("SIGTERM");
+  tsc.kill("SIGTERM");
  process.exit(code);
 }

 process.on("SIGINT", () => cleanup(130));
 process.on("SIGTERM", () => cleanup(143));

-compilerProcess.on("exit", (code) => {
+tsc.on("exit", (code) => {
  if (exiting) return;
  cleanup(code ?? 1);
 });
@@ -76,7 +76,7 @@ bash pty:true workdir:~/project background:true command:"codex exec --full-auto
 # Monitor progress
 process action:log sessionId:XXX

-# Check if done
+# Check if done  
 process action:poll sessionId:XXX

 # Send input (if agent asks a question)
@@ -217,55 +217,15 @@ git worktree remove /tmp/issue-99

 ## ⚠️ Rules

-1. **Always use pty:true** - coding agents need a terminal!
-2. **Respect tool choice** - if user asks for Codex, use Codex.
-   - Orchestrator mode: do NOT hand-code patches yourself.
-   - If an agent fails/hangs, respawn it or ask the user for direction, but don't silently take over.
-3. **Be patient** - don't kill sessions because they're "slow"
-4. **Monitor with process:log** - check progress without interfering
-5. **--full-auto for building** - auto-approves changes
-6. **vanilla for reviewing** - no special flags needed
-7. **Parallel is OK** - run many Codex processes at once for batch work
-8. **NEVER start Codex in ~/clawd/** - it'll read your soul docs and get weird ideas about the org chart!
-9. **NEVER checkout branches in ~/Projects/clawdbot/** - that's the LIVE Clawdbot instance!
-
---
-
-## Progress Updates (Critical)
-
-When you spawn coding agents in the background, keep the user in the loop.
-
- Send 1 short message when you start (what's running + where).
- Then only update again when something changes:
-  - a milestone completes (build finished, tests passed)
-  - the agent asks a question / needs input
-  - you hit an error or need user action
-  - the agent finishes (include what changed + where)
- If you kill a session, immediately say you killed it and why.
-
-This prevents the user from seeing only "Agent failed before reply" and having no idea what happened.
-
---
-
-## Auto-Notify on Completion
-
-For long-running background tasks, append a wake trigger to your prompt so Clawdbot gets notified immediately when the agent finishes (instead of waiting for the next heartbeat):
-
-```
-... your task here.
-
-When completely finished, run this command to notify me:
-clawdbot gateway wake --text "Done: [brief summary of what was built]" --mode now
-```
-
-**Example:**
-```bash
-bash pty:true workdir:~/project background:true command:"codex --yolo exec 'Build a REST API for todos.
-
-When completely finished, run: clawdbot gateway wake --text \"Done: Built todos REST API with CRUD endpoints\" --mode now'"
-```
-
-This triggers an immediate wake event — Skippy gets pinged in seconds, not 10 minutes.
+1. **Always use pty:true** — coding agents need a terminal!
+2. **Respect tool choice** — if user asks for Codex, use Codex. NEVER offer to build it yourself!
+3. **Be patient** — don't kill sessions because they're "slow"
+4. **Monitor with process:log** — check progress without interfering
+5. **--full-auto for building** — auto-approves changes
+6. **vanilla for reviewing** — no special flags needed
+7. **Parallel is OK** — run many Codex processes at once for batch work
+8. **NEVER start Codex in ~/clawd/** — it'll read your soul docs and get weird ideas about the org chart!
+9. **NEVER checkout branches in ~/Projects/clawdbot/** — that's the LIVE Clawdbot instance!

 ---

@@ -1,61 +0,0 @@
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { describe, expect, it } from "vitest";
-
-import type { ClawdbotConfig } from "../../config/config.js";
-import type { SessionEntry } from "../../config/sessions.js";
-import { resolveSessionAuthProfileOverride } from "./session-override.js";
-
-async function writeAuthStore(agentDir: string) {
-  const authPath = path.join(agentDir, "auth-profiles.json");
-  const payload = {
-    version: 1,
-    profiles: {
-      "zai:work": { type: "api_key", provider: "zai", key: "sk-test" },
-    },
-    order: {
-      zai: ["zai:work"],
-    },
-  };
-  await fs.writeFile(authPath, JSON.stringify(payload), "utf-8");
-}
-
-describe("resolveSessionAuthProfileOverride", () => {
-  it("keeps user override when provider alias differs", async () => {
-    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-auth-"));
-    const prevStateDir = process.env.CLAWDBOT_STATE_DIR;
-    process.env.CLAWDBOT_STATE_DIR = tmpDir;
-    try {
-      const agentDir = path.join(tmpDir, "agent");
-      await fs.mkdir(agentDir, { recursive: true });
-      await writeAuthStore(agentDir);
-
-      const sessionEntry: SessionEntry = {
-        sessionId: "s1",
-        updatedAt: Date.now(),
-        authProfileOverride: "zai:work",
-        authProfileOverrideSource: "user",
-      };
-      const sessionStore = { "agent:main:main": sessionEntry };
-
-      const resolved = await resolveSessionAuthProfileOverride({
-        cfg: {} as ClawdbotConfig,
-        provider: "z.ai",
-        agentDir,
-        sessionEntry,
-        sessionStore,
-        sessionKey: "agent:main:main",
-        storePath: undefined,
-        isNewSession: false,
-      });
-
-      expect(resolved).toBe("zai:work");
-      expect(sessionEntry.authProfileOverride).toBe("zai:work");
-    } finally {
-      if (prevStateDir === undefined) delete process.env.CLAWDBOT_STATE_DIR;
-      else process.env.CLAWDBOT_STATE_DIR = prevStateDir;
-      await fs.rm(tmpDir, { recursive: true, force: true });
-    }
-  });
-});
@@ -1,139 +0,0 @@
-import type { ClawdbotConfig } from "../../config/config.js";
-import { updateSessionStore, type SessionEntry } from "../../config/sessions.js";
-import { normalizeProviderId } from "../model-selection.js";
-import {
-  ensureAuthProfileStore,
-  isProfileInCooldown,
-  resolveAuthProfileOrder,
-} from "../auth-profiles.js";
-
-function isProfileForProvider(params: {
-  provider: string;
-  profileId: string;
-  store: ReturnType<typeof ensureAuthProfileStore>;
-}): boolean {
-  const entry = params.store.profiles[params.profileId];
-  if (!entry?.provider) return false;
-  return normalizeProviderId(entry.provider) === normalizeProviderId(params.provider);
-}
-
-export async function clearSessionAuthProfileOverride(params: {
-  sessionEntry: SessionEntry;
-  sessionStore: Record<string, SessionEntry>;
-  sessionKey: string;
-  storePath?: string;
-}) {
-  const { sessionEntry, sessionStore, sessionKey, storePath } = params;
-  delete sessionEntry.authProfileOverride;
-  delete sessionEntry.authProfileOverrideSource;
-  delete sessionEntry.authProfileOverrideCompactionCount;
-  sessionEntry.updatedAt = Date.now();
-  sessionStore[sessionKey] = sessionEntry;
-  if (storePath) {
-    await updateSessionStore(storePath, (store) => {
-      store[sessionKey] = sessionEntry;
-    });
-  }
-}
-
-export async function resolveSessionAuthProfileOverride(params: {
-  cfg: ClawdbotConfig;
-  provider: string;
-  agentDir: string;
-  sessionEntry?: SessionEntry;
-  sessionStore?: Record<string, SessionEntry>;
-  sessionKey?: string;
-  storePath?: string;
-  isNewSession: boolean;
-}): Promise<string | undefined> {
-  const {
-    cfg,
-    provider,
-    agentDir,
-    sessionEntry,
-    sessionStore,
-    sessionKey,
-    storePath,
-    isNewSession,
-  } = params;
-  if (!sessionEntry || !sessionStore || !sessionKey) return sessionEntry?.authProfileOverride;
-
-  const store = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
-  const order = resolveAuthProfileOrder({ cfg, store, provider });
-  let current = sessionEntry.authProfileOverride?.trim();
-
-  if (current && !store.profiles[current]) {
-    await clearSessionAuthProfileOverride({ sessionEntry, sessionStore, sessionKey, storePath });
-    current = undefined;
-  }
-
-  if (current && !isProfileForProvider({ provider, profileId: current, store })) {
-    await clearSessionAuthProfileOverride({ sessionEntry, sessionStore, sessionKey, storePath });
-    current = undefined;
-  }
-
-  if (current && order.length > 0 && !order.includes(current)) {
-    await clearSessionAuthProfileOverride({ sessionEntry, sessionStore, sessionKey, storePath });
-    current = undefined;
-  }
-
-  if (order.length === 0) return undefined;
-
-  const pickFirstAvailable = () =>
-    order.find((profileId) => !isProfileInCooldown(store, profileId)) ?? order[0];
-  const pickNextAvailable = (active: string) => {
-    const startIndex = order.indexOf(active);
-    if (startIndex < 0) return pickFirstAvailable();
-    for (let offset = 1; offset <= order.length; offset += 1) {
-      const candidate = order[(startIndex + offset) % order.length];
-      if (!isProfileInCooldown(store, candidate)) return candidate;
-    }
-    return order[startIndex] ?? order[0];
-  };
-
-  const compactionCount = sessionEntry.compactionCount ?? 0;
-  const storedCompaction =
-    typeof sessionEntry.authProfileOverrideCompactionCount === "number"
-      ? sessionEntry.authProfileOverrideCompactionCount
-      : compactionCount;
-
-  const source =
-    sessionEntry.authProfileOverrideSource ??
-    (typeof sessionEntry.authProfileOverrideCompactionCount === "number"
-      ? "auto"
-      : current
-        ? "user"
-        : undefined);
-  if (source === "user" && current && !isNewSession) {
-    return current;
-  }
-
-  let next = current;
-  if (isNewSession) {
-    next = current ? pickNextAvailable(current) : pickFirstAvailable();
-  } else if (current && compactionCount > storedCompaction) {
-    next = pickNextAvailable(current);
-  } else if (!current || isProfileInCooldown(store, current)) {
-    next = pickFirstAvailable();
-  }
-
-  if (!next) return current;
-  const shouldPersist =
-    next !== sessionEntry.authProfileOverride ||
-    sessionEntry.authProfileOverrideSource !== "auto" ||
-    sessionEntry.authProfileOverrideCompactionCount !== compactionCount;
-  if (shouldPersist) {
-    sessionEntry.authProfileOverride = next;
-    sessionEntry.authProfileOverrideSource = "auto";
-    sessionEntry.authProfileOverrideCompactionCount = compactionCount;
-    sessionEntry.updatedAt = Date.now();
-    sessionStore[sessionKey] = sessionEntry;
-    if (storePath) {
-      await updateSessionStore(storePath, (store) => {
-        store[sessionKey] = sessionEntry;
-      });
-    }
-  }
-
-  return next;
-}
@@ -494,7 +494,12 @@ export function createExecTool(
        if (nodeEnv) {
          applyPathPrepend(nodeEnv, defaultPathPrepend, { requireExisting: true });
        }
-        const requiresAsk = hostAsk === "always" || hostAsk === "on-miss";
+        const resolution = resolveCommandResolution(params.command, workdir, env);
+        const allowlistMatch =
+          hostSecurity === "allowlist" ? matchAllowlist(approvals.allowlist, resolution) : null;
+        const requiresAsk =
+          hostAsk === "always" ||
+          (hostAsk === "on-miss" && hostSecurity === "allowlist" && !allowlistMatch);

        let approvedByAsk = false;
        let approvalDecision: "allow-once" | "allow-always" | null = null;
@@ -509,7 +514,7 @@ export function createExecTool(
              security: hostSecurity,
              ask: hostAsk,
              agentId: defaults?.agentId,
-              resolvedPath: null,
+              resolvedPath: resolution?.resolvedPath ?? null,
              sessionKey: defaults?.sessionKey ?? null,
              timeoutMs: 120_000,
            },
@@ -527,7 +532,11 @@ export function createExecTool(
              approvedByAsk = true;
              approvalDecision = "allow-once";
            } else if (askFallback === "allowlist") {
-              // Defer allowlist enforcement to the node host.
+              if (!allowlistMatch) {
+                throw new Error("exec denied: approval required (approval UI not available)");
+              }
+              approvedByAsk = true;
+              approvalDecision = "allow-once";
            } else {
              throw new Error("exec denied: approval required (approval UI not available)");
            }
@@ -539,8 +548,32 @@ export function createExecTool(
          if (decision === "allow-always") {
            approvedByAsk = true;
            approvalDecision = "allow-always";
+            if (hostSecurity === "allowlist") {
+              const pattern =
+                resolution?.resolvedPath ??
+                resolution?.rawExecutable ??
+                params.command.split(/\s+/).shift() ??
+                "";
+              if (pattern) {
+                addAllowlistEntry(approvals.file, defaults?.agentId, pattern);
+              }
+            }
          }
        }
+
+        if (hostSecurity === "allowlist" && !allowlistMatch && !approvedByAsk) {
+          throw new Error("exec denied: allowlist miss");
+        }
+
+        if (allowlistMatch) {
+          recordAllowlistUse(
+            approvals.file,
+            defaults?.agentId,
+            allowlistMatch,
+            params.command,
+            resolution?.resolvedPath,
+          );
+        }
        const invokeParams: Record<string, unknown> = {
          nodeId,
          command: "system.run",
@@ -92,16 +92,13 @@ const makeConfig = (): ClawdbotConfig =>
    },
  }) satisfies ClawdbotConfig;

-const writeAuthStore = async (agentDir: string, opts?: { includeAnthropic?: boolean }) => {
+const writeAuthStore = async (agentDir: string) => {
  const authPath = path.join(agentDir, "auth-profiles.json");
  const payload = {
    version: 1,
    profiles: {
      "openai:p1": { type: "api_key", provider: "openai", key: "sk-one" },
      "openai:p2": { type: "api_key", provider: "openai", key: "sk-two" },
-      ...(opts?.includeAnthropic
-        ? { "anthropic:default": { type: "api_key", provider: "anthropic", key: "sk-anth" } }
-        : {}),
    },
    usageStats: {
      "openai:p1": { lastUsed: 1 },
@@ -209,43 +206,4 @@ describe("runEmbeddedPiAgent auth profile rotation", () => {
      await fs.rm(workspaceDir, { recursive: true, force: true });
    }
  });
-
-  it("ignores user-locked profile when provider mismatches", async () => {
-    const agentDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-agent-"));
-    const workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-workspace-"));
-    try {
-      await writeAuthStore(agentDir, { includeAnthropic: true });
-
-      runEmbeddedAttemptMock.mockResolvedValueOnce(
-        makeAttempt({
-          assistantTexts: ["ok"],
-          lastAssistant: buildAssistant({
-            stopReason: "stop",
-            content: [{ type: "text", text: "ok" }],
-          }),
-        }),
-      );
-
-      await runEmbeddedPiAgent({
-        sessionId: "session:test",
-        sessionKey: "agent:test:mismatch",
-        sessionFile: path.join(workspaceDir, "session.jsonl"),
-        workspaceDir,
-        agentDir,
-        config: makeConfig(),
-        prompt: "hello",
-        provider: "openai",
-        model: "mock-1",
-        authProfileId: "anthropic:default",
-        authProfileIdSource: "user",
-        timeoutMs: 5_000,
-        runId: "run:mismatch",
-      });
-
-      expect(runEmbeddedAttemptMock).toHaveBeenCalledTimes(1);
-    } finally {
-      await fs.rm(agentDir, { recursive: true, force: true });
-      await fs.rm(workspaceDir, { recursive: true, force: true });
-    }
-  });
 });
@@ -23,7 +23,6 @@ import {
  resolveAuthProfileOrder,
  type ResolvedProviderAuth,
 } from "../model-auth.js";
-import { normalizeProviderId } from "../model-selection.js";
 import { ensureClawdbotModelsJson } from "../models-config.js";
 import {
  classifyFailoverReason,
@@ -51,18 +50,6 @@ import { describeUnknownError } from "./utils.js";

 type ApiKeyInfo = ResolvedProviderAuth;

-// Avoid Anthropic's refusal test token poisoning session transcripts.
-const ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL = "ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL";
-const ANTHROPIC_MAGIC_STRING_REPLACEMENT = "ANTHROPIC MAGIC STRING TRIGGER REFUSAL (redacted)";
-
-function scrubAnthropicRefusalMagic(prompt: string): string {
-  if (!prompt.includes(ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL)) return prompt;
-  return prompt.replaceAll(
-    ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL,
-    ANTHROPIC_MAGIC_STRING_REPLACEMENT,
-  );
-}
-
 export async function runEmbeddedPiAgent(
  params: RunEmbeddedPiAgentParams,
 ): Promise<EmbeddedPiRunResult> {
@@ -129,16 +116,8 @@ export async function runEmbeddedPiAgent(

      const authStore = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
      const preferredProfileId = params.authProfileId?.trim();
-      let lockedProfileId = params.authProfileIdSource === "user" ? preferredProfileId : undefined;
-      if (lockedProfileId) {
-        const lockedProfile = authStore.profiles[lockedProfileId];
-        if (
-          !lockedProfile ||
-          normalizeProviderId(lockedProfile.provider) !== normalizeProviderId(provider)
-        ) {
-          lockedProfileId = undefined;
-        }
-      }
+      const lockedProfileId =
+        params.authProfileIdSource === "user" ? preferredProfileId : undefined;
      const profileOrder = resolveAuthProfileOrder({
        cfg: params.config,
        store: authStore,
@@ -223,9 +202,6 @@ export async function runEmbeddedPiAgent(
          attemptedThinking.add(thinkLevel);
          await fs.mkdir(resolvedWorkspace, { recursive: true });

-          const prompt =
-            provider === "anthropic" ? scrubAnthropicRefusalMagic(params.prompt) : params.prompt;
-
          const attempt = await runEmbeddedAttempt({
            sessionId: params.sessionId,
            sessionKey: params.sessionKey,
@@ -243,7 +219,7 @@ export async function runEmbeddedPiAgent(
            agentDir,
            config: params.config,
            skillsSnapshot: params.skillsSnapshot,
-            prompt,
+            prompt: params.prompt,
            images: params.images,
            provider,
            modelId,
@@ -39,10 +39,6 @@ export type EmbeddedPiSubscribeState = {
  lastStreamedAssistant?: string;
  lastStreamedReasoning?: string;
  lastBlockReplyText?: string;
-  assistantMessageIndex: number;
-  lastAssistantTextMessageIndex: number;
-  lastAssistantTextNormalized?: string;
-  lastAssistantTextTrimmed?: string;
  assistantTextBaseline: number;
  suppressBlockChunks: boolean;
  lastReasoningSent?: string;
@@ -86,35 +86,6 @@ describe("subscribeEmbeddedPiSession", () => {

    expect(subscription.assistantTexts).toEqual(["Hello world"]);
  });
-  it("does not duplicate assistantTexts when message_end repeats with trailing whitespace changes", () => {
-    let handler: SessionEventHandler | undefined;
-    const session: StubSession = {
-      subscribe: (fn) => {
-        handler = fn;
-        return () => {};
-      },
-    };
-
-    const subscription = subscribeEmbeddedPiSession({
-      session: session as unknown as Parameters<typeof subscribeEmbeddedPiSession>[0]["session"],
-      runId: "run",
-    });
-
-    const assistantMessageWithNewline = {
-      role: "assistant",
-      content: [{ type: "text", text: "Hello world\n" }],
-    } as AssistantMessage;
-
-    const assistantMessageTrimmed = {
-      role: "assistant",
-      content: [{ type: "text", text: "Hello world" }],
-    } as AssistantMessage;
-
-    handler?.({ type: "message_end", message: assistantMessageWithNewline });
-    handler?.({ type: "message_end", message: assistantMessageTrimmed });
-
-    expect(subscription.assistantTexts).toEqual(["Hello world"]);
-  });
  it("does not duplicate assistantTexts when message_end repeats with reasoning blocks", () => {
    let handler: SessionEventHandler | undefined;
    const session: StubSession = {
@@ -48,10 +48,6 @@ export function subscribeEmbeddedPiSession(params: SubscribeEmbeddedPiSessionPar
    lastStreamedAssistant: undefined,
    lastStreamedReasoning: undefined,
    lastBlockReplyText: undefined,
-    assistantMessageIndex: 0,
-    lastAssistantTextMessageIndex: -1,
-    lastAssistantTextNormalized: undefined,
-    lastAssistantTextTrimmed: undefined,
    assistantTextBaseline: 0,
    suppressBlockChunks: false, // Avoid late chunk inserts after final text merge.
    lastReasoningSent: undefined,
@@ -88,36 +84,9 @@ export function subscribeEmbeddedPiSession(params: SubscribeEmbeddedPiSessionPar
    state.lastStreamedReasoning = undefined;
    state.lastReasoningSent = undefined;
    state.suppressBlockChunks = false;
-    state.assistantMessageIndex += 1;
-    state.lastAssistantTextMessageIndex = -1;
-    state.lastAssistantTextNormalized = undefined;
-    state.lastAssistantTextTrimmed = undefined;
    state.assistantTextBaseline = nextAssistantTextBaseline;
  };

-  const rememberAssistantText = (text: string) => {
-    state.lastAssistantTextMessageIndex = state.assistantMessageIndex;
-    state.lastAssistantTextTrimmed = text.trimEnd();
-    const normalized = normalizeTextForComparison(text);
-    state.lastAssistantTextNormalized = normalized.length > 0 ? normalized : undefined;
-  };
-
-  const shouldSkipAssistantText = (text: string) => {
-    if (state.lastAssistantTextMessageIndex !== state.assistantMessageIndex) return false;
-    const trimmed = text.trimEnd();
-    if (trimmed && trimmed === state.lastAssistantTextTrimmed) return true;
-    const normalized = normalizeTextForComparison(text);
-    if (normalized.length > 0 && normalized === state.lastAssistantTextNormalized) return true;
-    return false;
-  };
-
-  const pushAssistantText = (text: string) => {
-    if (!text) return;
-    if (shouldSkipAssistantText(text)) return;
-    assistantTexts.push(text);
-    rememberAssistantText(text);
-  };
-
  const finalizeAssistantTexts = (args: {
    text: string;
    addedDuringMessage: boolean;
@@ -134,15 +103,16 @@ export function subscribeEmbeddedPiSession(params: SubscribeEmbeddedPiSessionPar
          assistantTexts.length - state.assistantTextBaseline,
          text,
        );
-        rememberAssistantText(text);
      } else {
-        pushAssistantText(text);
+        const last = assistantTexts.at(-1);
+        if (!last || last !== text) assistantTexts.push(text);
      }
      state.suppressBlockChunks = true;
    } else if (!addedDuringMessage && !chunkerHasBuffered && text) {
      // Non-streaming models (no text_delta): ensure assistantTexts gets the final
      // text when the chunker has nothing buffered to drain.
-      pushAssistantText(text);
+      const last = assistantTexts.at(-1);
+      if (!last || last !== text) assistantTexts.push(text);
    }

    state.assistantTextBaseline = assistantTexts.length;
@@ -368,11 +338,8 @@ export function subscribeEmbeddedPiSession(params: SubscribeEmbeddedPiSessionPar
      return;
    }

-    if (shouldSkipAssistantText(chunk)) return;
-
    state.lastBlockReplyText = chunk;
    assistantTexts.push(chunk);
-    rememberAssistantText(chunk);
    if (!params.onBlockReply) return;
    const splitResult = parseReplyDirectives(chunk);
    const {
@@ -36,7 +36,6 @@ import {
  DEFAULT_AGENT_ID,
  resolveAgentIdFromSessionKey,
 } from "../../routing/session-key.js";
-import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";
 import type { AnyAgentTool } from "./common.js";
 import { readStringParam } from "./common.js";
 import { resolveInternalSessionKey, resolveMainSessionAlias } from "./sessions-helpers.js";
@@ -241,7 +240,6 @@ export function createSessionStatusTool(opts?: {
        throw new Error(`Unknown sessionKey: ${requestedKeyRaw}`);
      }

-      const configured = resolveDefaultModelForAgent({ cfg, agentId });
      const modelRaw = readStringParam(params, "model");
      let changedModel = false;
      if (typeof modelRaw === "string") {
@@ -251,33 +249,33 @@ export function createSessionStatusTool(opts?: {
          sessionEntry: resolved.entry,
          agentId,
        });
-        const nextEntry: SessionEntry = { ...resolved.entry };
-        const applied = applyModelOverrideToSessionEntry({
-          entry: nextEntry,
-          selection:
-            selection.kind === "reset"
-              ? {
-                  provider: configured.provider,
-                  model: configured.model,
-                  isDefault: true,
-                }
-              : {
-                  provider: selection.provider,
-                  model: selection.model,
-                  isDefault: selection.isDefault,
-                },
-        });
-        if (applied.updated) {
-          store[resolved.key] = nextEntry;
-          await updateSessionStore(storePath, (nextStore) => {
-            nextStore[resolved.key] = nextEntry;
-          });
-          resolved.entry = nextEntry;
-          changedModel = true;
+        const nextEntry: SessionEntry = {
+          ...resolved.entry,
+          updatedAt: Date.now(),
+        };
+        if (selection.kind === "reset" || selection.isDefault) {
+          delete nextEntry.providerOverride;
+          delete nextEntry.modelOverride;
+          delete nextEntry.authProfileOverride;
+          delete nextEntry.authProfileOverrideSource;
+          delete nextEntry.authProfileOverrideCompactionCount;
+        } else {
+          nextEntry.providerOverride = selection.provider;
+          nextEntry.modelOverride = selection.model;
+          delete nextEntry.authProfileOverride;
+          delete nextEntry.authProfileOverrideSource;
+          delete nextEntry.authProfileOverrideCompactionCount;
        }
+        store[resolved.key] = nextEntry;
+        await updateSessionStore(storePath, (nextStore) => {
+          nextStore[resolved.key] = nextEntry;
+        });
+        resolved.entry = nextEntry;
+        changedModel = true;
      }

      const agentDir = resolveAgentDir(cfg, agentId);
+      const configured = resolveDefaultModelForAgent({ cfg, agentId });
      const providerForCard = resolved.entry.providerOverride?.trim() || configured.provider;
      const usageProvider = resolveUsageProviderId(providerForCard);
      let usageLine: string | undefined;
@@ -157,13 +157,6 @@ function buildChatCommands(): ChatCommandDefinition[] {
      description: "Show current status.",
      textAlias: "/status",
    }),
-    defineChatCommand({
-      key: "allowlist",
-      description: "List/add/remove allowlist entries.",
-      textAlias: "/allowlist",
-      acceptsArgs: true,
-      scope: "text",
-    }),
    defineChatCommand({
      key: "context",
      nativeName: "context",
@@ -16,21 +16,19 @@ export const createShouldEmitToolResult = (params: {
  storePath?: string;
  resolvedVerboseLevel: VerboseLevel;
 }): (() => boolean) => {
-  // Normalize verbose values from session store/config so false/"false" still means off.
-  const fallbackVerbose = normalizeVerboseLevel(String(params.resolvedVerboseLevel ?? "")) ?? "off";
  return () => {
    if (!params.sessionKey || !params.storePath) {
-      return fallbackVerbose !== "off";
+      return params.resolvedVerboseLevel !== "off";
    }
    try {
      const store = loadSessionStore(params.storePath);
      const entry = store[params.sessionKey];
-      const current = normalizeVerboseLevel(String(entry?.verboseLevel ?? ""));
+      const current = normalizeVerboseLevel(entry?.verboseLevel);
      if (current) return current !== "off";
    } catch {
      // ignore store read failures
    }
-    return fallbackVerbose !== "off";
+    return params.resolvedVerboseLevel !== "off";
  };
 };

@@ -39,21 +37,19 @@ export const createShouldEmitToolOutput = (params: {
  storePath?: string;
  resolvedVerboseLevel: VerboseLevel;
 }): (() => boolean) => {
-  // Normalize verbose values from session store/config so false/"false" still means off.
-  const fallbackVerbose = normalizeVerboseLevel(String(params.resolvedVerboseLevel ?? "")) ?? "off";
  return () => {
    if (!params.sessionKey || !params.storePath) {
-      return fallbackVerbose === "full";
+      return params.resolvedVerboseLevel === "full";
    }
    try {
      const store = loadSessionStore(params.storePath);
      const entry = store[params.sessionKey];
-      const current = normalizeVerboseLevel(String(entry?.verboseLevel ?? ""));
+      const current = normalizeVerboseLevel(entry?.verboseLevel);
      if (current) return current === "full";
    } catch {
      // ignore store read failures
    }
-    return fallbackVerbose === "full";
+    return params.resolvedVerboseLevel === "full";
  };
 };

@@ -1,149 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import type { TemplateContext } from "../templating.js";
-import type { FollowupRun, QueueSettings } from "./queue.js";
-import { createMockTypingController } from "./test-helpers.js";
-
-const runEmbeddedPiAgentMock = vi.fn();
-
-vi.mock("../../agents/model-fallback.js", () => ({
-  runWithModelFallback: async ({
-    run,
-  }: {
-    run: (provider: string, model: string) => Promise<unknown>;
-  }) => ({
-    // Force a cross-provider fallback candidate
-    result: await run("openai-codex", "gpt-5.2"),
-    provider: "openai-codex",
-    model: "gpt-5.2",
-  }),
-}));
-
-vi.mock("../../agents/pi-embedded.js", () => ({
-  queueEmbeddedPiMessage: vi.fn().mockReturnValue(false),
-  runEmbeddedPiAgent: (params: unknown) => runEmbeddedPiAgentMock(params),
-}));
-
-vi.mock("./queue.js", async () => {
-  const actual = await vi.importActual<typeof import("./queue.js")>("./queue.js");
-  return {
-    ...actual,
-    enqueueFollowupRun: vi.fn(),
-    scheduleFollowupDrain: vi.fn(),
-  };
-});
-
-import { runReplyAgent } from "./agent-runner.js";
-
-function createBaseRun(params: { runOverrides?: Partial<FollowupRun["run"]> }) {
-  const typing = createMockTypingController();
-  const sessionCtx = {
-    Provider: "telegram",
-    OriginatingTo: "chat",
-    AccountId: "primary",
-    MessageSid: "msg",
-    Surface: "telegram",
-  } as unknown as TemplateContext;
-
-  const resolvedQueue = { mode: "interrupt" } as unknown as QueueSettings;
-
-  const followupRun = {
-    prompt: "hello",
-    summaryLine: "hello",
-    enqueuedAt: Date.now(),
-    run: {
-      agentId: "main",
-      agentDir: "/tmp/agent",
-      sessionId: "session",
-      sessionKey: "main",
-      messageProvider: "telegram",
-      sessionFile: "/tmp/session.jsonl",
-      workspaceDir: "/tmp",
-      config: {},
-      skillsSnapshot: {},
-      provider: "anthropic",
-      model: "claude-opus",
-      authProfileId: "anthropic:clawd",
-      authProfileIdSource: "manual",
-      thinkLevel: "low",
-      verboseLevel: "off",
-      elevatedLevel: "off",
-      bashElevated: {
-        enabled: false,
-        allowed: false,
-        defaultLevel: "off",
-      },
-      timeoutMs: 5_000,
-      blockReplyBreak: "message_end",
-    },
-  } as unknown as FollowupRun;
-
-  return {
-    typing,
-    sessionCtx,
-    resolvedQueue,
-    followupRun: {
-      ...followupRun,
-      run: { ...followupRun.run, ...params.runOverrides },
-    },
-  };
-}
-
-describe("authProfileId fallback scoping", () => {
-  it("drops authProfileId when provider changes during fallback", async () => {
-    runEmbeddedPiAgentMock.mockReset();
-    runEmbeddedPiAgentMock.mockResolvedValue({ payloads: [{ text: "ok" }], meta: {} });
-
-    const sessionKey = "main";
-    const sessionEntry = {
-      sessionId: "session",
-      updatedAt: Date.now(),
-      totalTokens: 1,
-      compactionCount: 0,
-    };
-
-    const { typing, sessionCtx, resolvedQueue, followupRun } = createBaseRun({
-      runOverrides: {
-        provider: "anthropic",
-        model: "claude-opus",
-        authProfileId: "anthropic:clawd",
-        authProfileIdSource: "manual",
-      },
-    });
-
-    await runReplyAgent({
-      commandBody: "hello",
-      followupRun,
-      queueKey: sessionKey,
-      resolvedQueue,
-      shouldSteer: false,
-      shouldFollowup: false,
-      isActive: false,
-      isStreaming: false,
-      typing,
-      sessionCtx,
-      sessionEntry,
-      sessionStore: { [sessionKey]: sessionEntry },
-      sessionKey,
-      storePath: undefined,
-      defaultModel: "anthropic/claude-opus-4-5",
-      agentCfgContextTokens: 100_000,
-      resolvedVerboseLevel: "off",
-      isNewSession: false,
-      blockStreamingEnabled: false,
-      resolvedBlockStreamingBreak: "message_end",
-      shouldInjectGroupIntro: false,
-      typingMode: "instant",
-    });
-
-    expect(runEmbeddedPiAgentMock).toHaveBeenCalledTimes(1);
-    const call = runEmbeddedPiAgentMock.mock.calls[0]?.[0] as {
-      authProfileId?: unknown;
-      authProfileIdSource?: unknown;
-      provider?: unknown;
-    };
-
-    expect(call.provider).toBe("openai-codex");
-    expect(call.authProfileId).toBeUndefined();
-    expect(call.authProfileIdSource).toBeUndefined();
-  });
-});
@@ -1,139 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-
-import type { ClawdbotConfig } from "../../config/config.js";
-import type { MsgContext } from "../templating.js";
-import { buildCommandContext, handleCommands } from "./commands.js";
-import { parseInlineDirectives } from "./directive-handling.js";
-
-const readConfigFileSnapshotMock = vi.hoisted(() => vi.fn());
-const validateConfigObjectWithPluginsMock = vi.hoisted(() => vi.fn());
-const writeConfigFileMock = vi.hoisted(() => vi.fn());
-
-vi.mock("../../config/config.js", async () => {
-  const actual =
-    await vi.importActual<typeof import("../../config/config.js")>("../../config/config.js");
-  return {
-    ...actual,
-    readConfigFileSnapshot: readConfigFileSnapshotMock,
-    validateConfigObjectWithPlugins: validateConfigObjectWithPluginsMock,
-    writeConfigFile: writeConfigFileMock,
-  };
-});
-
-const readChannelAllowFromStoreMock = vi.hoisted(() => vi.fn());
-const addChannelAllowFromStoreEntryMock = vi.hoisted(() => vi.fn());
-const removeChannelAllowFromStoreEntryMock = vi.hoisted(() => vi.fn());
-
-vi.mock("../../pairing/pairing-store.js", async () => {
-  const actual = await vi.importActual<typeof import("../../pairing/pairing-store.js")>(
-    "../../pairing/pairing-store.js",
-  );
-  return {
-    ...actual,
-    readChannelAllowFromStore: readChannelAllowFromStoreMock,
-    addChannelAllowFromStoreEntry: addChannelAllowFromStoreEntryMock,
-    removeChannelAllowFromStoreEntry: removeChannelAllowFromStoreEntryMock,
-  };
-});
-
-vi.mock("../../channels/plugins/pairing.js", async () => {
-  const actual = await vi.importActual<typeof import("../../channels/plugins/pairing.js")>(
-    "../../channels/plugins/pairing.js",
-  );
-  return {
-    ...actual,
-    listPairingChannels: () => ["telegram"],
-  };
-});
-
-function buildParams(commandBody: string, cfg: ClawdbotConfig, ctxOverrides?: Partial<MsgContext>) {
-  const ctx = {
-    Body: commandBody,
-    CommandBody: commandBody,
-    CommandSource: "text",
-    CommandAuthorized: true,
-    Provider: "telegram",
-    Surface: "telegram",
-    ...ctxOverrides,
-  } as MsgContext;
-
-  const command = buildCommandContext({
-    ctx,
-    cfg,
-    isGroup: false,
-    triggerBodyNormalized: commandBody.trim().toLowerCase(),
-    commandAuthorized: true,
-  });
-
-  return {
-    ctx,
-    cfg,
-    command,
-    directives: parseInlineDirectives(commandBody),
-    elevated: { enabled: true, allowed: true, failures: [] },
-    sessionKey: "agent:main:main",
-    workspaceDir: "/tmp",
-    defaultGroupActivation: () => "mention",
-    resolvedVerboseLevel: "off" as const,
-    resolvedReasoningLevel: "off" as const,
-    resolveDefaultThinkingLevel: async () => undefined,
-    provider: "telegram",
-    model: "test-model",
-    contextTokens: 0,
-    isGroup: false,
-  };
-}
-
-describe("handleCommands /allowlist", () => {
-  it("lists config + store allowFrom entries", async () => {
-    readChannelAllowFromStoreMock.mockResolvedValueOnce(["456"]);
-
-    const cfg = {
-      commands: { text: true },
-      channels: { telegram: { allowFrom: ["123", "@Alice"] } },
-    } as ClawdbotConfig;
-    const params = buildParams("/allowlist list dm", cfg);
-    const result = await handleCommands(params);
-
-    expect(result.shouldContinue).toBe(false);
-    expect(result.reply?.text).toContain("Channel: telegram");
-    expect(result.reply?.text).toContain("DM allowFrom (config): 123, @alice");
-    expect(result.reply?.text).toContain("Paired allowFrom (store): 456");
-  });
-
-  it("adds entries to config and pairing store", async () => {
-    readConfigFileSnapshotMock.mockResolvedValueOnce({
-      valid: true,
-      parsed: {
-        channels: { telegram: { allowFrom: ["123"] } },
-      },
-    });
-    validateConfigObjectWithPluginsMock.mockImplementation((config: unknown) => ({
-      ok: true,
-      config,
-    }));
-    addChannelAllowFromStoreEntryMock.mockResolvedValueOnce({
-      changed: true,
-      allowFrom: ["123", "789"],
-    });
-
-    const cfg = {
-      commands: { text: true, config: true },
-      channels: { telegram: { allowFrom: ["123"] } },
-    } as ClawdbotConfig;
-    const params = buildParams("/allowlist add dm 789", cfg);
-    const result = await handleCommands(params);
-
-    expect(result.shouldContinue).toBe(false);
-    expect(writeConfigFileMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        channels: { telegram: { allowFrom: ["123", "789"] } },
-      }),
-    );
-    expect(addChannelAllowFromStoreEntryMock).toHaveBeenCalledWith({
-      channel: "telegram",
-      entry: "789",
-    });
-    expect(result.reply?.text).toContain("DM allowlist added");
-  });
-});
@@ -1,657 +0,0 @@
-import {
-  readConfigFileSnapshot,
-  validateConfigObjectWithPlugins,
-  writeConfigFile,
-} from "../../config/config.js";
-import { resolveChannelConfigWrites } from "../../channels/plugins/config-writes.js";
-import { getChannelDock } from "../../channels/dock.js";
-import { normalizeChannelId } from "../../channels/registry.js";
-import { listPairingChannels } from "../../channels/plugins/pairing.js";
-import { logVerbose } from "../../globals.js";
-import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "../../routing/session-key.js";
-import { resolveDiscordAccount } from "../../discord/accounts.js";
-import { resolveIMessageAccount } from "../../imessage/accounts.js";
-import { resolveSignalAccount } from "../../signal/accounts.js";
-import { resolveSlackAccount } from "../../slack/accounts.js";
-import { resolveTelegramAccount } from "../../telegram/accounts.js";
-import { resolveWhatsAppAccount } from "../../web/accounts.js";
-import { resolveSlackUserAllowlist } from "../../slack/resolve-users.js";
-import { resolveDiscordUserAllowlist } from "../../discord/resolve-users.js";
-import {
-  addChannelAllowFromStoreEntry,
-  readChannelAllowFromStore,
-  removeChannelAllowFromStoreEntry,
-} from "../../pairing/pairing-store.js";
-import type { ClawdbotConfig } from "../../config/config.js";
-import type { ChannelId } from "../../channels/plugins/types.js";
-import type { CommandHandler } from "./commands-types.js";
-
-type AllowlistScope = "dm" | "group" | "all";
-type AllowlistAction = "list" | "add" | "remove";
-type AllowlistTarget = "both" | "config" | "store";
-
-type AllowlistCommand =
-  | {
-      action: "list";
-      scope: AllowlistScope;
-      channel?: string;
-      account?: string;
-      resolve?: boolean;
-    }
-  | {
-      action: "add" | "remove";
-      scope: AllowlistScope;
-      channel?: string;
-      account?: string;
-      entry: string;
-      resolve?: boolean;
-      target: AllowlistTarget;
-    }
-  | { action: "error"; message: string };
-
-const ACTIONS = new Set(["list", "add", "remove"]);
-const SCOPES = new Set<AllowlistScope>(["dm", "group", "all"]);
-
-function parseAllowlistCommand(raw: string): AllowlistCommand | null {
-  const trimmed = raw.trim();
-  if (!trimmed.toLowerCase().startsWith("/allowlist")) return null;
-  const rest = trimmed.slice("/allowlist".length).trim();
-  if (!rest) return { action: "list", scope: "dm" };
-
-  const tokens = rest.split(/\s+/);
-  let action: AllowlistAction = "list";
-  let scope: AllowlistScope = "dm";
-  let resolve = false;
-  let target: AllowlistTarget = "both";
-  let channel: string | undefined;
-  let account: string | undefined;
-  const entryTokens: string[] = [];
-
-  let i = 0;
-  if (tokens[i] && ACTIONS.has(tokens[i].toLowerCase())) {
-    action = tokens[i].toLowerCase() as AllowlistAction;
-    i += 1;
-  }
-  if (tokens[i] && SCOPES.has(tokens[i].toLowerCase() as AllowlistScope)) {
-    scope = tokens[i].toLowerCase() as AllowlistScope;
-    i += 1;
-  }
-
-  for (; i < tokens.length; i += 1) {
-    const token = tokens[i];
-    const lowered = token.toLowerCase();
-    if (lowered === "--resolve" || lowered === "resolve") {
-      resolve = true;
-      continue;
-    }
-    if (lowered === "--config" || lowered === "config") {
-      target = "config";
-      continue;
-    }
-    if (lowered === "--store" || lowered === "store") {
-      target = "store";
-      continue;
-    }
-    if (lowered === "--channel" && tokens[i + 1]) {
-      channel = tokens[i + 1];
-      i += 1;
-      continue;
-    }
-    if (lowered === "--account" && tokens[i + 1]) {
-      account = tokens[i + 1];
-      i += 1;
-      continue;
-    }
-    const kv = token.split("=");
-    if (kv.length === 2) {
-      const key = kv[0]?.trim().toLowerCase();
-      const value = kv[1]?.trim();
-      if (key === "channel") {
-        if (value) channel = value;
-        continue;
-      }
-      if (key === "account") {
-        if (value) account = value;
-        continue;
-      }
-      if (key === "scope" && value && SCOPES.has(value.toLowerCase() as AllowlistScope)) {
-        scope = value.toLowerCase() as AllowlistScope;
-        continue;
-      }
-    }
-    entryTokens.push(token);
-  }
-
-  if (action === "add" || action === "remove") {
-    const entry = entryTokens.join(" ").trim();
-    if (!entry) {
-      return { action: "error", message: "Usage: /allowlist add|remove <entry>" };
-    }
-    return { action, scope, entry, channel, account, resolve, target };
-  }
-
-  return { action: "list", scope, channel, account, resolve };
-}
-
-function normalizeAllowFrom(params: {
-  cfg: ClawdbotConfig;
-  channelId: ChannelId;
-  accountId?: string | null;
-  values: Array<string | number>;
-}): string[] {
-  const dock = getChannelDock(params.channelId);
-  if (dock?.config?.formatAllowFrom) {
-    return dock.config.formatAllowFrom({
-      cfg: params.cfg,
-      accountId: params.accountId,
-      allowFrom: params.values,
-    });
-  }
-  return params.values.map((entry) => String(entry).trim()).filter(Boolean);
-}
-
-function formatEntryList(entries: string[], resolved?: Map<string, string>): string {
-  if (entries.length === 0) return "(none)";
-  return entries
-    .map((entry) => {
-      const name = resolved?.get(entry);
-      return name ? `${entry} (${name})` : entry;
-    })
-    .join(", ");
-}
-
-function resolveAccountTarget(
-  parsed: Record<string, unknown>,
-  channelId: ChannelId,
-  accountId?: string | null,
-) {
-  const channels = (parsed.channels ??= {}) as Record<string, unknown>;
-  const channel = (channels[channelId] ??= {}) as Record<string, unknown>;
-  const normalizedAccountId = normalizeAccountId(accountId);
-  const hasAccounts = Boolean(channel.accounts && typeof channel.accounts === "object");
-  const useAccount = normalizedAccountId !== DEFAULT_ACCOUNT_ID || hasAccounts;
-  if (!useAccount) {
-    return { target: channel, pathPrefix: `channels.${channelId}`, accountId: normalizedAccountId };
-  }
-  const accounts = (channel.accounts ??= {}) as Record<string, unknown>;
-  const account = (accounts[normalizedAccountId] ??= {}) as Record<string, unknown>;
-  return {
-    target: account,
-    pathPrefix: `channels.${channelId}.accounts.${normalizedAccountId}`,
-    accountId: normalizedAccountId,
-  };
-}
-
-function getNestedValue(root: Record<string, unknown>, path: string[]): unknown {
-  let current: unknown = root;
-  for (const key of path) {
-    if (!current || typeof current !== "object") return undefined;
-    current = (current as Record<string, unknown>)[key];
-  }
-  return current;
-}
-
-function ensureNestedObject(
-  root: Record<string, unknown>,
-  path: string[],
-): Record<string, unknown> {
-  let current = root;
-  for (const key of path) {
-    const existing = current[key];
-    if (!existing || typeof existing !== "object") {
-      current[key] = {};
-    }
-    current = current[key] as Record<string, unknown>;
-  }
-  return current;
-}
-
-function setNestedValue(root: Record<string, unknown>, path: string[], value: unknown) {
-  if (path.length === 0) return;
-  if (path.length === 1) {
-    root[path[0]] = value;
-    return;
-  }
-  const parent = ensureNestedObject(root, path.slice(0, -1));
-  parent[path[path.length - 1]] = value;
-}
-
-function deleteNestedValue(root: Record<string, unknown>, path: string[]) {
-  if (path.length === 0) return;
-  if (path.length === 1) {
-    delete root[path[0]];
-    return;
-  }
-  const parent = getNestedValue(root, path.slice(0, -1));
-  if (!parent || typeof parent !== "object") return;
-  delete (parent as Record<string, unknown>)[path[path.length - 1]];
-}
-
-function resolveChannelAllowFromPaths(
-  channelId: ChannelId,
-  scope: AllowlistScope,
-): string[] | null {
-  if (scope === "all") return null;
-  if (scope === "dm") {
-    if (channelId === "slack" || channelId === "discord") return ["dm", "allowFrom"];
-    if (
-      channelId === "telegram" ||
-      channelId === "whatsapp" ||
-      channelId === "signal" ||
-      channelId === "imessage"
-    ) {
-      return ["allowFrom"];
-    }
-    return null;
-  }
-  if (scope === "group") {
-    if (
-      channelId === "telegram" ||
-      channelId === "whatsapp" ||
-      channelId === "signal" ||
-      channelId === "imessage"
-    ) {
-      return ["groupAllowFrom"];
-    }
-    return null;
-  }
-  return null;
-}
-
-async function resolveSlackNames(params: {
-  cfg: ClawdbotConfig;
-  accountId?: string | null;
-  entries: string[];
-}) {
-  const account = resolveSlackAccount({ cfg: params.cfg, accountId: params.accountId });
-  const token = account.config.userToken?.trim() || account.botToken?.trim();
-  if (!token) return new Map<string, string>();
-  const resolved = await resolveSlackUserAllowlist({ token, entries: params.entries });
-  const map = new Map<string, string>();
-  for (const entry of resolved) {
-    if (entry.resolved && entry.name) map.set(entry.input, entry.name);
-  }
-  return map;
-}
-
-async function resolveDiscordNames(params: {
-  cfg: ClawdbotConfig;
-  accountId?: string | null;
-  entries: string[];
-}) {
-  const account = resolveDiscordAccount({ cfg: params.cfg, accountId: params.accountId });
-  const token = account.token?.trim();
-  if (!token) return new Map<string, string>();
-  const resolved = await resolveDiscordUserAllowlist({ token, entries: params.entries });
-  const map = new Map<string, string>();
-  for (const entry of resolved) {
-    if (entry.resolved && entry.name) map.set(entry.input, entry.name);
-  }
-  return map;
-}
-
-export const handleAllowlistCommand: CommandHandler = async (params, allowTextCommands) => {
-  if (!allowTextCommands) return null;
-  const parsed = parseAllowlistCommand(params.command.commandBodyNormalized);
-  if (!parsed) return null;
-  if (parsed.action === "error") {
-    return { shouldContinue: false, reply: { text: `⚠️ ${parsed.message}` } };
-  }
-  if (!params.command.isAuthorizedSender) {
-    logVerbose(
-      `Ignoring /allowlist from unauthorized sender: ${params.command.senderId || "<unknown>"}`,
-    );
-    return { shouldContinue: false };
-  }
-
-  const channelId =
-    normalizeChannelId(parsed.channel) ??
-    params.command.channelId ??
-    normalizeChannelId(params.command.channel);
-  if (!channelId) {
-    return {
-      shouldContinue: false,
-      reply: { text: "⚠️ Unknown channel. Add channel=<id> to the command." },
-    };
-  }
-  const accountId = normalizeAccountId(parsed.account ?? params.ctx.AccountId);
-  const scope = parsed.scope;
-
-  if (parsed.action === "list") {
-    const pairingChannels = listPairingChannels();
-    const supportsStore = pairingChannels.includes(channelId);
-    const storeAllowFrom = supportsStore
-      ? await readChannelAllowFromStore(channelId).catch(() => [])
-      : [];
-
-    let dmAllowFrom: string[] = [];
-    let groupAllowFrom: string[] = [];
-    let groupOverrides: Array<{ label: string; entries: string[] }> = [];
-    let dmPolicy: string | undefined;
-    let groupPolicy: string | undefined;
-
-    if (channelId === "telegram") {
-      const account = resolveTelegramAccount({ cfg: params.cfg, accountId });
-      dmAllowFrom = (account.config.allowFrom ?? []).map(String);
-      groupAllowFrom = (account.config.groupAllowFrom ?? []).map(String);
-      dmPolicy = account.config.dmPolicy;
-      groupPolicy = account.config.groupPolicy;
-      const groups = account.config.groups ?? {};
-      for (const [groupId, groupCfg] of Object.entries(groups)) {
-        const entries = (groupCfg?.allowFrom ?? []).map(String).filter(Boolean);
-        if (entries.length > 0) {
-          groupOverrides.push({ label: groupId, entries });
-        }
-        const topics = groupCfg?.topics ?? {};
-        for (const [topicId, topicCfg] of Object.entries(topics)) {
-          const topicEntries = (topicCfg?.allowFrom ?? []).map(String).filter(Boolean);
-          if (topicEntries.length > 0) {
-            groupOverrides.push({ label: `${groupId} topic ${topicId}`, entries: topicEntries });
-          }
-        }
-      }
-    } else if (channelId === "whatsapp") {
-      const account = resolveWhatsAppAccount({ cfg: params.cfg, accountId });
-      dmAllowFrom = (account.allowFrom ?? []).map(String);
-      groupAllowFrom = (account.groupAllowFrom ?? []).map(String);
-      dmPolicy = account.dmPolicy;
-      groupPolicy = account.groupPolicy;
-    } else if (channelId === "signal") {
-      const account = resolveSignalAccount({ cfg: params.cfg, accountId });
-      dmAllowFrom = (account.config.allowFrom ?? []).map(String);
-      groupAllowFrom = (account.config.groupAllowFrom ?? []).map(String);
-      dmPolicy = account.config.dmPolicy;
-      groupPolicy = account.config.groupPolicy;
-    } else if (channelId === "imessage") {
-      const account = resolveIMessageAccount({ cfg: params.cfg, accountId });
-      dmAllowFrom = (account.config.allowFrom ?? []).map(String);
-      groupAllowFrom = (account.config.groupAllowFrom ?? []).map(String);
-      dmPolicy = account.config.dmPolicy;
-      groupPolicy = account.config.groupPolicy;
-    } else if (channelId === "slack") {
-      const account = resolveSlackAccount({ cfg: params.cfg, accountId });
-      dmAllowFrom = (account.dm?.allowFrom ?? []).map(String);
-      groupPolicy = account.groupPolicy;
-      const channels = account.channels ?? {};
-      groupOverrides = Object.entries(channels)
-        .map(([key, value]) => {
-          const entries = (value?.users ?? []).map(String).filter(Boolean);
-          return entries.length > 0 ? { label: key, entries } : null;
-        })
-        .filter(Boolean) as Array<{ label: string; entries: string[] }>;
-    } else if (channelId === "discord") {
-      const account = resolveDiscordAccount({ cfg: params.cfg, accountId });
-      dmAllowFrom = (account.config.dm?.allowFrom ?? []).map(String);
-      groupPolicy = account.config.groupPolicy;
-      const guilds = account.config.guilds ?? {};
-      for (const [guildKey, guildCfg] of Object.entries(guilds)) {
-        const entries = (guildCfg?.users ?? []).map(String).filter(Boolean);
-        if (entries.length > 0) {
-          groupOverrides.push({ label: `guild ${guildKey}`, entries });
-        }
-        const channels = guildCfg?.channels ?? {};
-        for (const [channelKey, channelCfg] of Object.entries(channels)) {
-          const channelEntries = (channelCfg?.users ?? []).map(String).filter(Boolean);
-          if (channelEntries.length > 0) {
-            groupOverrides.push({
-              label: `guild ${guildKey} / channel ${channelKey}`,
-              entries: channelEntries,
-            });
-          }
-        }
-      }
-    }
-
-    const dmDisplay = normalizeAllowFrom({
-      cfg: params.cfg,
-      channelId,
-      accountId,
-      values: dmAllowFrom,
-    });
-    const groupDisplay = normalizeAllowFrom({
-      cfg: params.cfg,
-      channelId,
-      accountId,
-      values: groupAllowFrom,
-    });
-    const groupOverrideEntries = groupOverrides.flatMap((entry) => entry.entries);
-    const groupOverrideDisplay = normalizeAllowFrom({
-      cfg: params.cfg,
-      channelId,
-      accountId,
-      values: groupOverrideEntries,
-    });
-    const resolvedDm =
-      parsed.resolve && dmDisplay.length > 0 && channelId === "slack"
-        ? await resolveSlackNames({ cfg: params.cfg, accountId, entries: dmDisplay })
-        : parsed.resolve && dmDisplay.length > 0 && channelId === "discord"
-          ? await resolveDiscordNames({ cfg: params.cfg, accountId, entries: dmDisplay })
-          : undefined;
-    const resolvedGroup =
-      parsed.resolve && groupOverrideDisplay.length > 0 && channelId === "slack"
-        ? await resolveSlackNames({
-            cfg: params.cfg,
-            accountId,
-            entries: groupOverrideDisplay,
-          })
-        : parsed.resolve && groupOverrideDisplay.length > 0 && channelId === "discord"
-          ? await resolveDiscordNames({
-              cfg: params.cfg,
-              accountId,
-              entries: groupOverrideDisplay,
-            })
-          : undefined;
-
-    const lines: string[] = ["🧾 Allowlist"];
-    lines.push(`Channel: ${channelId}${accountId ? ` (account ${accountId})` : ""}`);
-    if (dmPolicy) lines.push(`DM policy: ${dmPolicy}`);
-    if (groupPolicy) lines.push(`Group policy: ${groupPolicy}`);
-
-    const showDm = scope === "dm" || scope === "all";
-    const showGroup = scope === "group" || scope === "all";
-    if (showDm) {
-      lines.push(`DM allowFrom (config): ${formatEntryList(dmDisplay, resolvedDm)}`);
-    }
-    if (supportsStore && storeAllowFrom.length > 0) {
-      const storeLabel = normalizeAllowFrom({
-        cfg: params.cfg,
-        channelId,
-        accountId,
-        values: storeAllowFrom,
-      });
-      lines.push(`Paired allowFrom (store): ${formatEntryList(storeLabel)}`);
-    }
-    if (showGroup) {
-      if (groupAllowFrom.length > 0) {
-        lines.push(`Group allowFrom (config): ${formatEntryList(groupDisplay)}`);
-      }
-      if (groupOverrides.length > 0) {
-        lines.push("Group overrides:");
-        for (const entry of groupOverrides) {
-          const normalized = normalizeAllowFrom({
-            cfg: params.cfg,
-            channelId,
-            accountId,
-            values: entry.entries,
-          });
-          lines.push(`- ${entry.label}: ${formatEntryList(normalized, resolvedGroup)}`);
-        }
-      }
-    }
-
-    return { shouldContinue: false, reply: { text: lines.join("\n") } };
-  }
-
-  if (params.cfg.commands?.config !== true) {
-    return {
-      shouldContinue: false,
-      reply: { text: "⚠️ /allowlist edits are disabled. Set commands.config=true to enable." },
-    };
-  }
-
-  const shouldUpdateConfig = parsed.target !== "store";
-  const shouldTouchStore = parsed.target !== "config" && listPairingChannels().includes(channelId);
-
-  if (shouldUpdateConfig) {
-    const allowWrites = resolveChannelConfigWrites({
-      cfg: params.cfg,
-      channelId,
-      accountId: params.ctx.AccountId,
-    });
-    if (!allowWrites) {
-      const hint = `channels.${channelId}.configWrites=true`;
-      return {
-        shouldContinue: false,
-        reply: { text: `⚠️ Config writes are disabled for ${channelId}. Set ${hint} to enable.` },
-      };
-    }
-
-    const allowlistPath = resolveChannelAllowFromPaths(channelId, scope);
-    if (!allowlistPath) {
-      return {
-        shouldContinue: false,
-        reply: {
-          text: `⚠️ ${channelId} does not support ${scope} allowlist edits via /allowlist.`,
-        },
-      };
-    }
-
-    const snapshot = await readConfigFileSnapshot();
-    if (!snapshot.valid || !snapshot.parsed || typeof snapshot.parsed !== "object") {
-      return {
-        shouldContinue: false,
-        reply: { text: "⚠️ Config file is invalid; fix it before using /allowlist." },
-      };
-    }
-    const parsedConfig = structuredClone(snapshot.parsed as Record<string, unknown>);
-    const {
-      target,
-      pathPrefix,
-      accountId: normalizedAccountId,
-    } = resolveAccountTarget(parsedConfig, channelId, accountId);
-    const existingRaw = getNestedValue(target, allowlistPath);
-    const existing = Array.isArray(existingRaw)
-      ? existingRaw.map((entry) => String(entry).trim()).filter(Boolean)
-      : [];
-
-    const normalizedEntry = normalizeAllowFrom({
-      cfg: params.cfg,
-      channelId,
-      accountId: normalizedAccountId,
-      values: [parsed.entry],
-    });
-    if (normalizedEntry.length === 0) {
-      return {
-        shouldContinue: false,
-        reply: { text: "⚠️ Invalid allowlist entry." },
-      };
-    }
-
-    const existingNormalized = normalizeAllowFrom({
-      cfg: params.cfg,
-      channelId,
-      accountId: normalizedAccountId,
-      values: existing,
-    });
-
-    const shouldMatch = (value: string) => normalizedEntry.includes(value);
-
-    let configChanged = false;
-    let next = existing;
-    const configHasEntry = existingNormalized.some((value) => shouldMatch(value));
-    if (parsed.action === "add") {
-      if (!configHasEntry) {
-        next = [...existing, parsed.entry.trim()];
-        configChanged = true;
-      }
-    }
-
-    if (parsed.action === "remove") {
-      const keep: string[] = [];
-      for (const entry of existing) {
-        const normalized = normalizeAllowFrom({
-          cfg: params.cfg,
-          channelId,
-          accountId: normalizedAccountId,
-          values: [entry],
-        });
-        if (normalized.some((value) => shouldMatch(value))) {
-          configChanged = true;
-          continue;
-        }
-        keep.push(entry);
-      }
-      next = keep;
-    }
-
-    if (configChanged) {
-      if (next.length === 0) {
-        deleteNestedValue(target, allowlistPath);
-      } else {
-        setNestedValue(target, allowlistPath, next);
-      }
-    }
-
-    if (configChanged) {
-      const validated = validateConfigObjectWithPlugins(parsedConfig);
-      if (!validated.ok) {
-        const issue = validated.issues[0];
-        return {
-          shouldContinue: false,
-          reply: { text: `⚠️ Config invalid after update (${issue.path}: ${issue.message}).` },
-        };
-      }
-      await writeConfigFile(validated.config);
-    }
-
-    if (!configChanged && !shouldTouchStore) {
-      const message = parsed.action === "add" ? "✅ Already allowlisted." : "⚠️ Entry not found.";
-      return { shouldContinue: false, reply: { text: message } };
-    }
-
-    if (shouldTouchStore) {
-      if (parsed.action === "add") {
-        await addChannelAllowFromStoreEntry({ channel: channelId, entry: parsed.entry });
-      } else if (parsed.action === "remove") {
-        await removeChannelAllowFromStoreEntry({ channel: channelId, entry: parsed.entry });
-      }
-    }
-
-    const actionLabel = parsed.action === "add" ? "added" : "removed";
-    const scopeLabel = scope === "dm" ? "DM" : "group";
-    const locations: string[] = [];
-    if (configChanged) {
-      locations.push(`${pathPrefix}.${allowlistPath.join(".")}`);
-    }
-    if (shouldTouchStore) {
-      locations.push("pairing store");
-    }
-    const targetLabel = locations.length > 0 ? locations.join(" + ") : "no-op";
-    return {
-      shouldContinue: false,
-      reply: {
-        text: `✅ ${scopeLabel} allowlist ${actionLabel}: ${targetLabel}.`,
-      },
-    };
-  }
-
-  if (!shouldTouchStore) {
-    return {
-      shouldContinue: false,
-      reply: { text: "⚠️ This channel does not support allowlist storage." },
-    };
-  }
-
-  if (parsed.action === "add") {
-    await addChannelAllowFromStoreEntry({ channel: channelId, entry: parsed.entry });
-  } else if (parsed.action === "remove") {
-    await removeChannelAllowFromStoreEntry({ channel: channelId, entry: parsed.entry });
-  }
-
-  const actionLabel = parsed.action === "add" ? "added" : "removed";
-  const scopeLabel = scope === "dm" ? "DM" : "group";
-  return {
-    shouldContinue: false,
-    reply: { text: `✅ ${scopeLabel} allowlist ${actionLabel} in pairing store.` },
-  };
-};
@@ -13,7 +13,6 @@ import {
  handleStatusCommand,
  handleWhoamiCommand,
 } from "./commands-info.js";
-import { handleAllowlistCommand } from "./commands-allowlist.js";
 import { handleSubagentsCommand } from "./commands-subagents.js";
 import {
  handleAbortTrigger,
@@ -38,7 +37,6 @@ const HANDLERS: CommandHandler[] = [
  handleHelpCommand,
  handleCommandsListCommand,
  handleStatusCommand,
-  handleAllowlistCommand,
  handleContextCommand,
  handleWhoamiCommand,
  handleSubagentsCommand,
@@ -10,7 +10,6 @@ import { type SessionEntry, updateSessionStore } from "../../config/sessions.js"
 import type { ExecAsk, ExecHost, ExecSecurity } from "../../infra/exec-approvals.js";
 import { enqueueSystemEvent } from "../../infra/system-events.js";
 import { applyVerboseOverride } from "../../sessions/level-overrides.js";
-import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";
 import { formatThinkingLevels, formatXHighModelHint, supportsXHighThinking } from "../thinking.js";
 import type { ReplyPayload } from "../types.js";
 import {
@@ -341,11 +340,22 @@ export async function handleDirectiveOnly(params: {
      }
    }
    if (modelSelection) {
-      applyModelOverrideToSessionEntry({
-        entry: sessionEntry,
-        selection: modelSelection,
-        profileOverride,
-      });
+      if (modelSelection.isDefault) {
+        delete sessionEntry.providerOverride;
+        delete sessionEntry.modelOverride;
+      } else {
+        sessionEntry.providerOverride = modelSelection.provider;
+        sessionEntry.modelOverride = modelSelection.model;
+      }
+      if (profileOverride) {
+        sessionEntry.authProfileOverride = profileOverride;
+        sessionEntry.authProfileOverrideSource = "user";
+        delete sessionEntry.authProfileOverrideCompactionCount;
+      } else if (directives.hasModelDirective) {
+        delete sessionEntry.authProfileOverride;
+        delete sessionEntry.authProfileOverrideSource;
+        delete sessionEntry.authProfileOverrideCompactionCount;
+      }
    }
    if (directives.hasQueueDirective && directives.queueReset) {
      delete sessionEntry.queueMode;
@@ -16,7 +16,6 @@ import type { ClawdbotConfig } from "../../config/config.js";
 import { type SessionEntry, updateSessionStore } from "../../config/sessions.js";
 import { enqueueSystemEvent } from "../../infra/system-events.js";
 import { applyVerboseOverride } from "../../sessions/level-overrides.js";
-import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";
 import { resolveProfileOverride } from "./directive-handling.auth.js";
 import type { InlineDirectives } from "./directive-handling.parse.js";
 import { formatElevatedEvent, formatReasoningEvent } from "./directive-handling.shared.js";
@@ -165,15 +164,22 @@ export async function persistInlineDirectives(params: {
          }
          const isDefault =
            resolved.ref.provider === defaultProvider && resolved.ref.model === defaultModel;
-          const { updated: modelUpdated } = applyModelOverrideToSessionEntry({
-            entry: sessionEntry,
-            selection: {
-              provider: resolved.ref.provider,
-              model: resolved.ref.model,
-              isDefault,
-            },
-            profileOverride,
-          });
+          if (isDefault) {
+            delete sessionEntry.providerOverride;
+            delete sessionEntry.modelOverride;
+          } else {
+            sessionEntry.providerOverride = resolved.ref.provider;
+            sessionEntry.modelOverride = resolved.ref.model;
+          }
+          if (profileOverride) {
+            sessionEntry.authProfileOverride = profileOverride;
+            sessionEntry.authProfileOverrideSource = "user";
+            delete sessionEntry.authProfileOverrideCompactionCount;
+          } else if (directives.hasModelDirective) {
+            delete sessionEntry.authProfileOverride;
+            delete sessionEntry.authProfileOverrideSource;
+            delete sessionEntry.authProfileOverrideCompactionCount;
+          }
          provider = resolved.ref.provider;
          model = resolved.ref.model;
          const nextLabel = `${provider}/${model}`;
@@ -183,7 +189,7 @@ export async function persistInlineDirectives(params: {
              contextKey: `model:${nextLabel}`,
            });
          }
-          updated = updated || modelUpdated;
+          updated = true;
        }
      }
    }
@@ -5,11 +5,16 @@ import {
  isEmbeddedPiRunStreaming,
  resolveEmbeddedSessionLane,
 } from "../../agents/pi-embedded.js";
-import { resolveSessionAuthProfileOverride } from "../../agents/auth-profiles/session-override.js";
+import {
+  ensureAuthProfileStore,
+  isProfileInCooldown,
+  resolveAuthProfileOrder,
+} from "../../agents/auth-profiles.js";
 import type { ExecToolDefaults } from "../../agents/bash-tools.js";
 import type { ClawdbotConfig } from "../../config/config.js";
 import {
  resolveSessionFilePath,
+  saveSessionStore,
  type SessionEntry,
  updateSessionStore,
 } from "../../config/sessions.js";
@@ -103,6 +108,92 @@ type RunPreparedReplyParams = {
  abortedLastRun: boolean;
 };

+async function resolveSessionAuthProfileOverride(params: {
+  cfg: ClawdbotConfig;
+  provider: string;
+  agentDir: string;
+  sessionEntry?: SessionEntry;
+  sessionStore?: Record<string, SessionEntry>;
+  sessionKey?: string;
+  storePath?: string;
+  isNewSession: boolean;
+}): Promise<string | undefined> {
+  const {
+    cfg,
+    provider,
+    agentDir,
+    sessionEntry,
+    sessionStore,
+    sessionKey,
+    storePath,
+    isNewSession,
+  } = params;
+  if (!sessionEntry || !sessionStore || !sessionKey) return sessionEntry?.authProfileOverride;
+
+  const store = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
+  const order = resolveAuthProfileOrder({ cfg, store, provider });
+  if (order.length === 0) return sessionEntry.authProfileOverride;
+
+  const pickFirstAvailable = () =>
+    order.find((profileId) => !isProfileInCooldown(store, profileId)) ?? order[0];
+  const pickNextAvailable = (current: string) => {
+    const startIndex = order.indexOf(current);
+    if (startIndex < 0) return pickFirstAvailable();
+    for (let offset = 1; offset <= order.length; offset += 1) {
+      const candidate = order[(startIndex + offset) % order.length];
+      if (!isProfileInCooldown(store, candidate)) return candidate;
+    }
+    return order[startIndex] ?? order[0];
+  };
+
+  const compactionCount = sessionEntry.compactionCount ?? 0;
+  const storedCompaction =
+    typeof sessionEntry.authProfileOverrideCompactionCount === "number"
+      ? sessionEntry.authProfileOverrideCompactionCount
+      : compactionCount;
+
+  let current = sessionEntry.authProfileOverride?.trim();
+  if (current && !order.includes(current)) current = undefined;
+
+  const source =
+    sessionEntry.authProfileOverrideSource ??
+    (typeof sessionEntry.authProfileOverrideCompactionCount === "number"
+      ? "auto"
+      : current
+        ? "user"
+        : undefined);
+  if (source === "user" && current && !isNewSession) {
+    return current;
+  }
+
+  let next = current;
+  if (isNewSession) {
+    next = current ? pickNextAvailable(current) : pickFirstAvailable();
+  } else if (current && compactionCount > storedCompaction) {
+    next = pickNextAvailable(current);
+  } else if (!current || isProfileInCooldown(store, current)) {
+    next = pickFirstAvailable();
+  }
+
+  if (!next) return current;
+  const shouldPersist =
+    next !== sessionEntry.authProfileOverride ||
+    sessionEntry.authProfileOverrideSource !== "auto" ||
+    sessionEntry.authProfileOverrideCompactionCount !== compactionCount;
+  if (shouldPersist) {
+    sessionEntry.authProfileOverride = next;
+    sessionEntry.authProfileOverrideSource = "auto";
+    sessionEntry.authProfileOverrideCompactionCount = compactionCount;
+    sessionEntry.updatedAt = Date.now();
+    sessionStore[sessionKey] = sessionEntry;
+    if (storePath) {
+      await saveSessionStore(storePath, sessionStore);
+    }
+  }
+
+  return next;
+}
+
 export async function runPreparedReply(
  params: RunPreparedReplyParams,
 ): Promise<ReplyPayload | ReplyPayload[] | undefined> {
@@ -11,8 +11,6 @@ import {
 } from "../../agents/model-selection.js";
 import type { ClawdbotConfig } from "../../config/config.js";
 import { type SessionEntry, updateSessionStore } from "../../config/sessions.js";
-import { clearSessionAuthProfileOverride } from "../../agents/auth-profiles/session-override.js";
-import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";
 import type { ThinkLevel } from "./directives.js";

 export type ModelDirectiveSelection = {
@@ -186,19 +184,16 @@ export async function createModelSelectionState(params: {
    if (overrideModel) {
      const key = modelKey(overrideProvider, overrideModel);
      if (allowedModelKeys.size > 0 && !allowedModelKeys.has(key)) {
-        const { updated } = applyModelOverrideToSessionEntry({
-          entry: sessionEntry,
-          selection: { provider: defaultProvider, model: defaultModel, isDefault: true },
-        });
-        if (updated) {
-          sessionStore[sessionKey] = sessionEntry;
-          if (storePath) {
-            await updateSessionStore(storePath, (store) => {
-              store[sessionKey] = sessionEntry;
-            });
-          }
+        delete sessionEntry.providerOverride;
+        delete sessionEntry.modelOverride;
+        sessionEntry.updatedAt = Date.now();
+        sessionStore[sessionKey] = sessionEntry;
+        if (storePath) {
+          await updateSessionStore(storePath, (store) => {
+            store[sessionKey] = sessionEntry;
+          });
        }
-        resetModelOverride = updated;
+        resetModelOverride = true;
      }
    }
  }
@@ -220,14 +215,17 @@ export async function createModelSelectionState(params: {
      allowKeychainPrompt: false,
    });
    const profile = store.profiles[sessionEntry.authProfileOverride];
-    const providerKey = normalizeProviderId(provider);
-    if (!profile || normalizeProviderId(profile.provider) !== providerKey) {
-      await clearSessionAuthProfileOverride({
-        sessionEntry,
-        sessionStore,
-        sessionKey,
-        storePath,
-      });
+    if (!profile || profile.provider !== provider) {
+      delete sessionEntry.authProfileOverride;
+      delete sessionEntry.authProfileOverrideSource;
+      delete sessionEntry.authProfileOverrideCompactionCount;
+      sessionEntry.updatedAt = Date.now();
+      sessionStore[sessionKey] = sessionEntry;
+      if (storePath) {
+        await updateSessionStore(storePath, (store) => {
+          store[sessionKey] = sessionEntry;
+        });
+      }
    }
  }

@@ -209,22 +209,6 @@ describe("routeReply", () => {
    expect(mocks.sendMessageSlack).toHaveBeenCalledWith("channel:C123", "hi", expect.any(Object));
  });

-  it("uses threadId for Slack when replyToId is missing", async () => {
-    mocks.sendMessageSlack.mockClear();
-    await routeReply({
-      payload: { text: "hi" },
-      channel: "slack",
-      to: "channel:C123",
-      threadId: "456.789",
-      cfg: {} as never,
-    });
-    expect(mocks.sendMessageSlack).toHaveBeenCalledWith(
-      "channel:C123",
-      "hi",
-      expect.objectContaining({ threadTs: "456.789" }),
-    );
-  });
-
  it("passes thread id to Telegram sends", async () => {
    mocks.sendMessageTelegram.mockClear();
    await routeReply({
@@ -42,39 +42,6 @@ describe("applyResetModelOverride", () => {
    expect(sessionCtx.BodyStripped).toBe("summarize");
  });

-  it("clears auth profile overrides when reset applies a model", async () => {
-    const cfg = {} as ClawdbotConfig;
-    const aliasIndex = buildModelAliasIndex({ cfg, defaultProvider: "openai" });
-    const sessionEntry = {
-      sessionId: "s1",
-      updatedAt: Date.now(),
-      authProfileOverride: "anthropic:default",
-      authProfileOverrideSource: "user",
-      authProfileOverrideCompactionCount: 2,
-    };
-    const sessionStore = { "agent:main:dm:1": sessionEntry };
-    const sessionCtx = { BodyStripped: "minimax summarize" };
-    const ctx = { ChatType: "direct" };
-
-    await applyResetModelOverride({
-      cfg,
-      resetTriggered: true,
-      bodyStripped: "minimax summarize",
-      sessionCtx,
-      ctx,
-      sessionEntry,
-      sessionStore,
-      sessionKey: "agent:main:dm:1",
-      defaultProvider: "openai",
-      defaultModel: "gpt-4o-mini",
-      aliasIndex,
-    });
-
-    expect(sessionEntry.authProfileOverride).toBeUndefined();
-    expect(sessionEntry.authProfileOverrideSource).toBeUndefined();
-    expect(sessionEntry.authProfileOverrideCompactionCount).toBeUndefined();
-  });
-
  it("skips when resetTriggered is false", async () => {
    const cfg = {} as ClawdbotConfig;
    const aliasIndex = buildModelAliasIndex({ cfg, defaultProvider: "openai" });
@@ -12,7 +12,6 @@ import { updateSessionStore } from "../../config/sessions.js";
 import type { MsgContext, TemplateContext } from "../templating.js";
 import { formatInboundBodyWithSenderMeta } from "./inbound-sender-meta.js";
 import { resolveModelDirectiveSelection, type ModelDirectiveSelection } from "./model-selection.js";
-import { applyModelOverrideToSessionEntry } from "../../sessions/model-overrides.js";

 type ResetModelResult = {
  selection?: ModelDirectiveSelection;
@@ -63,11 +62,25 @@ function applySelectionToSession(params: {
 }) {
  const { selection, sessionEntry, sessionStore, sessionKey, storePath } = params;
  if (!sessionEntry || !sessionStore || !sessionKey) return;
-  const { updated } = applyModelOverrideToSessionEntry({
-    entry: sessionEntry,
-    selection,
-  });
+  let updated = false;
+  if (selection.isDefault) {
+    if (sessionEntry.providerOverride || sessionEntry.modelOverride) {
+      delete sessionEntry.providerOverride;
+      delete sessionEntry.modelOverride;
+      updated = true;
+    }
+  } else {
+    if (sessionEntry.providerOverride !== selection.provider) {
+      sessionEntry.providerOverride = selection.provider;
+      updated = true;
+    }
+    if (sessionEntry.modelOverride !== selection.model) {
+      sessionEntry.modelOverride = selection.model;
+      updated = true;
+    }
+  }
  if (!updated) return;
+  sessionEntry.updatedAt = Date.now();
  sessionStore[sessionKey] = sessionEntry;
  if (storePath) {
    updateSessionStore(storePath, (store) => {
@@ -5,23 +5,19 @@ export const slackOutbound: ChannelOutboundAdapter = {
  deliveryMode: "direct",
  chunker: null,
  textChunkLimit: 4000,
-  sendText: async ({ to, text, accountId, deps, replyToId, threadId }) => {
+  sendText: async ({ to, text, accountId, deps, replyToId }) => {
    const send = deps?.sendSlack ?? sendMessageSlack;
-    // Use threadId fallback so routed tool notifications stay in the Slack thread.
-    const threadTs = replyToId ?? (threadId != null ? String(threadId) : undefined);
    const result = await send(to, text, {
-      threadTs,
+      threadTs: replyToId ?? undefined,
      accountId: accountId ?? undefined,
    });
    return { channel: "slack", ...result };
  },
-  sendMedia: async ({ to, text, mediaUrl, accountId, deps, replyToId, threadId }) => {
+  sendMedia: async ({ to, text, mediaUrl, accountId, deps, replyToId }) => {
    const send = deps?.sendSlack ?? sendMessageSlack;
-    // Use threadId fallback so routed tool notifications stay in the Slack thread.
-    const threadTs = replyToId ?? (threadId != null ? String(threadId) : undefined);
    const result = await send(to, text, {
      mediaUrl,
-      threadTs,
+      threadTs: replyToId ?? undefined,
      accountId: accountId ?? undefined,
    });
    return { channel: "slack", ...result };
@@ -5,7 +5,6 @@ import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
 import { theme } from "../terminal/theme.js";
 import { formatCliCommand } from "./command-format.js";
-import { formatHelpExamples } from "./help-format.js";
 import { registerBrowserActionInputCommands } from "./browser-cli-actions-input.js";
 import { registerBrowserActionObserveCommands } from "./browser-cli-actions-observe.js";
 import { registerBrowserDebugCommands } from "./browser-cli-debug.js";
@@ -27,10 +26,7 @@ export function registerBrowserCli(program: Command) {
    .addHelpText(
      "after",
      () =>
-        `\n${theme.heading("Examples:")}\n${formatHelpExamples(
-          [...browserCoreExamples, ...browserActionExamples].map((cmd) => [cmd, ""]),
-          true,
-        )}\n\n${theme.muted("Docs:")} ${formatDocsLink(
+        `\nExamples:\n  ${[...browserCoreExamples, ...browserActionExamples].join("\n  ")}\n\n${theme.muted("Docs:")} ${formatDocsLink(
          "/cli/browser",
          "docs.clawd.bot/cli/browser",
        )}\n`,
@@ -3,8 +3,6 @@ import type { Command } from "commander";
 import { callGateway } from "../gateway/call.js";
 import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../utils/message-channel.js";
 import { defaultRuntime } from "../runtime.js";
-import { renderTable } from "../terminal/table.js";
-import { theme } from "../terminal/theme.js";
 import { withProgress } from "./progress.js";

 type DevicesRpcOpts = {
@@ -98,11 +96,11 @@ function parseDevicePairingList(value: unknown): DevicePairingList {
 }

 function formatTokenSummary(tokens: DeviceTokenSummary[] | undefined) {
-  if (!tokens || tokens.length === 0) return "none";
+  if (!tokens || tokens.length === 0) return "tokens: none";
  const parts = tokens
    .map((t) => `${t.role}${t.revokedAtMs ? " (revoked)" : ""}`)
    .sort((a, b) => a.localeCompare(b));
-  return parts.join(", ");
+  return `tokens: ${parts.join(", ")}`;
 }

 export function registerDevicesCli(program: Command) {
@@ -120,59 +118,32 @@ export function registerDevicesCli(program: Command) {
          return;
        }
        if (list.pending?.length) {
-          const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-          defaultRuntime.log(
-            `${theme.heading("Pending")} ${theme.muted(`(${list.pending.length})`)}`,
-          );
-          defaultRuntime.log(
-            renderTable({
-              width: tableWidth,
-              columns: [
-                { key: "Request", header: "Request", minWidth: 10 },
-                { key: "Device", header: "Device", minWidth: 16, flex: true },
-                { key: "Role", header: "Role", minWidth: 8 },
-                { key: "IP", header: "IP", minWidth: 12 },
-                { key: "Age", header: "Age", minWidth: 8 },
-                { key: "Flags", header: "Flags", minWidth: 8 },
-              ],
-              rows: list.pending.map((req) => ({
-                Request: req.requestId,
-                Device: req.displayName || req.deviceId,
-                Role: req.role ?? "",
-                IP: req.remoteIp ?? "",
-                Age: typeof req.ts === "number" ? `${formatAge(Date.now() - req.ts)} ago` : "",
-                Flags: req.isRepair ? "repair" : "",
-              })),
-            }).trimEnd(),
-          );
+          defaultRuntime.log("Pending:");
+          for (const req of list.pending) {
+            const name = req.displayName || req.deviceId;
+            const repair = req.isRepair ? " (repair)" : "";
+            const ip = req.remoteIp ? ` · ${req.remoteIp}` : "";
+            const age =
+              typeof req.ts === "number" ? ` · ${formatAge(Date.now() - req.ts)} ago` : "";
+            const role = req.role ? ` · role: ${req.role}` : "";
+            defaultRuntime.log(`- ${req.requestId}: ${name}${repair}${role}${ip}${age}`);
+          }
        }
        if (list.paired?.length) {
-          const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-          defaultRuntime.log(
-            `${theme.heading("Paired")} ${theme.muted(`(${list.paired.length})`)}`,
-          );
-          defaultRuntime.log(
-            renderTable({
-              width: tableWidth,
-              columns: [
-                { key: "Device", header: "Device", minWidth: 16, flex: true },
-                { key: "Roles", header: "Roles", minWidth: 12, flex: true },
-                { key: "Scopes", header: "Scopes", minWidth: 12, flex: true },
-                { key: "Tokens", header: "Tokens", minWidth: 12, flex: true },
-                { key: "IP", header: "IP", minWidth: 12 },
-              ],
-              rows: list.paired.map((device) => ({
-                Device: device.displayName || device.deviceId,
-                Roles: device.roles?.length ? device.roles.join(", ") : "",
-                Scopes: device.scopes?.length ? device.scopes.join(", ") : "",
-                Tokens: formatTokenSummary(device.tokens),
-                IP: device.remoteIp ?? "",
-              })),
-            }).trimEnd(),
-          );
+          defaultRuntime.log("Paired:");
+          for (const device of list.paired) {
+            const name = device.displayName || device.deviceId;
+            const roles = device.roles?.length ? `roles: ${device.roles.join(", ")}` : "roles: -";
+            const scopes = device.scopes?.length
+              ? `scopes: ${device.scopes.join(", ")}`
+              : "scopes: -";
+            const ip = device.remoteIp ? ` · ${device.remoteIp}` : "";
+            const tokens = formatTokenSummary(device.tokens);
+            defaultRuntime.log(`- ${name} · ${roles} · ${scopes} · ${tokens}${ip}`);
+          }
        }
        if (!list.pending?.length && !list.paired?.length) {
-          defaultRuntime.log(theme.muted("No device pairing entries."));
+          defaultRuntime.log("No device pairing entries.");
        }
      }),
  );
@@ -189,7 +160,7 @@ export function registerDevicesCli(program: Command) {
          return;
        }
        const deviceId = (result as { device?: { deviceId?: string } })?.device?.deviceId;
-        defaultRuntime.log(`${theme.success("Approved")} ${theme.command(deviceId ?? "ok")}`);
+        defaultRuntime.log(`device approved: ${deviceId ?? "ok"}`);
      }),
  );

@@ -205,7 +176,7 @@ export function registerDevicesCli(program: Command) {
          return;
        }
        const deviceId = (result as { deviceId?: string })?.deviceId;
-        defaultRuntime.log(`${theme.warn("Rejected")} ${theme.command(deviceId ?? "ok")}`);
+        defaultRuntime.log(`device rejected: ${deviceId ?? "ok"}`);
      }),
  );

@@ -8,7 +8,6 @@ import { resolveMessageChannelSelection } from "../infra/outbound/channel-select
 import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
 import { theme } from "../terminal/theme.js";
-import { renderTable } from "../terminal/table.js";

 function parseLimit(value: unknown): number | null {
  if (typeof value === "number" && Number.isFinite(value)) {
@@ -23,11 +22,9 @@ function parseLimit(value: unknown): number | null {
  return parsed;
 }

-function buildRows(entries: Array<{ id: string; name?: string | undefined }>) {
-  return entries.map((entry) => ({
-    ID: entry.id,
-    Name: entry.name?.trim() ?? "",
-  }));
+function formatEntry(entry: { kind: string; id: string; name?: string | undefined }): string {
+  const name = entry.name?.trim();
+  return name ? `${entry.id}\t${name}` : entry.id;
 }

 export function registerDirectoryCli(program: Command) {
@@ -80,21 +77,10 @@ export function registerDirectoryCli(program: Command) {
          return;
        }
        if (!result) {
-          defaultRuntime.log(theme.muted("Not available."));
+          defaultRuntime.log("not available");
          return;
        }
-        const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-        defaultRuntime.log(`${theme.heading("Self")}`);
-        defaultRuntime.log(
-          renderTable({
-            width: tableWidth,
-            columns: [
-              { key: "ID", header: "ID", minWidth: 16, flex: true },
-              { key: "Name", header: "Name", minWidth: 18, flex: true },
-            ],
-            rows: buildRows([result]),
-          }).trimEnd(),
-        );
+        defaultRuntime.log(formatEntry(result));
      } catch (err) {
        defaultRuntime.error(danger(String(err)));
        defaultRuntime.exit(1);
@@ -125,22 +111,9 @@ export function registerDirectoryCli(program: Command) {
          defaultRuntime.log(JSON.stringify(result, null, 2));
          return;
        }
-        if (result.length === 0) {
-          defaultRuntime.log(theme.muted("No peers found."));
-          return;
+        for (const entry of result) {
+          defaultRuntime.log(formatEntry(entry));
        }
-        const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-        defaultRuntime.log(`${theme.heading("Peers")} ${theme.muted(`(${result.length})`)}`);
-        defaultRuntime.log(
-          renderTable({
-            width: tableWidth,
-            columns: [
-              { key: "ID", header: "ID", minWidth: 16, flex: true },
-              { key: "Name", header: "Name", minWidth: 18, flex: true },
-            ],
-            rows: buildRows(result),
-          }).trimEnd(),
-        );
      } catch (err) {
        defaultRuntime.error(danger(String(err)));
        defaultRuntime.exit(1);
@@ -170,22 +143,9 @@ export function registerDirectoryCli(program: Command) {
          defaultRuntime.log(JSON.stringify(result, null, 2));
          return;
        }
-        if (result.length === 0) {
-          defaultRuntime.log(theme.muted("No groups found."));
-          return;
+        for (const entry of result) {
+          defaultRuntime.log(formatEntry(entry));
        }
-        const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-        defaultRuntime.log(`${theme.heading("Groups")} ${theme.muted(`(${result.length})`)}`);
-        defaultRuntime.log(
-          renderTable({
-            width: tableWidth,
-            columns: [
-              { key: "ID", header: "ID", minWidth: 16, flex: true },
-              { key: "Name", header: "Name", minWidth: 18, flex: true },
-            ],
-            rows: buildRows(result),
-          }).trimEnd(),
-        );
      } catch (err) {
        defaultRuntime.error(danger(String(err)));
        defaultRuntime.exit(1);
@@ -220,24 +180,9 @@ export function registerDirectoryCli(program: Command) {
          defaultRuntime.log(JSON.stringify(result, null, 2));
          return;
        }
-        if (result.length === 0) {
-          defaultRuntime.log(theme.muted("No group members found."));
-          return;
+        for (const entry of result) {
+          defaultRuntime.log(formatEntry(entry));
        }
-        const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-        defaultRuntime.log(
-          `${theme.heading("Group Members")} ${theme.muted(`(${result.length})`)}`,
-        );
-        defaultRuntime.log(
-          renderTable({
-            width: tableWidth,
-            columns: [
-              { key: "ID", header: "ID", minWidth: 16, flex: true },
-              { key: "Name", header: "Name", minWidth: 18, flex: true },
-            ],
-            rows: buildRows(result),
-          }).trimEnd(),
-        );
      } catch (err) {
        defaultRuntime.error(danger(String(err)));
        defaultRuntime.exit(1);
@@ -7,8 +7,6 @@ describe("dns cli", () => {
    const log = vi.spyOn(console, "log").mockImplementation(() => {});
    const program = buildProgram();
    await program.parseAsync(["dns", "setup"], { from: "user" });
-    const output = log.mock.calls.map((call) => call.join(" ")).join("\n");
-    expect(output).toContain("DNS setup");
-    expect(output).toContain("clawdbot.internal");
+    expect(log).toHaveBeenCalledWith(expect.stringContaining("Domain:"));
  });
 });
@@ -7,9 +7,7 @@ import type { Command } from "commander";
 import { loadConfig } from "../config/config.js";
 import { pickPrimaryTailnetIPv4, pickPrimaryTailnetIPv6 } from "../infra/tailnet.js";
 import { getWideAreaZonePath, WIDE_AREA_DISCOVERY_DOMAIN } from "../infra/widearea-dns.js";
-import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
-import { renderTable } from "../terminal/table.js";
 import { theme } from "../terminal/theme.js";

 type RunOpts = { allowFailure?: boolean; inherit?: boolean };
@@ -114,28 +112,14 @@ export function registerDnsCli(program: Command) {
      const tailnetIPv6 = pickPrimaryTailnetIPv6();
      const zonePath = getWideAreaZonePath();

-      const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-      defaultRuntime.log(theme.heading("DNS setup"));
-      defaultRuntime.log(
-        renderTable({
-          width: tableWidth,
-          columns: [
-            { key: "Key", header: "Key", minWidth: 18 },
-            { key: "Value", header: "Value", minWidth: 24, flex: true },
-          ],
-          rows: [
-            { Key: "Domain", Value: WIDE_AREA_DISCOVERY_DOMAIN },
-            { Key: "Zone file", Value: zonePath },
-            {
-              Key: "Tailnet IP",
-              Value: `${tailnetIPv4 ?? "—"}${tailnetIPv6 ? ` (v6 ${tailnetIPv6})` : ""}`,
-            },
-          ],
-        }).trimEnd(),
+      console.log(`Domain: ${WIDE_AREA_DISCOVERY_DOMAIN}`);
+      console.log(`Zone file (gateway-owned): ${zonePath}`);
+      console.log(
+        `Detected tailnet IP: ${tailnetIPv4 ?? "—"}${tailnetIPv6 ? ` (v6 ${tailnetIPv6})` : ""}`,
      );
-      defaultRuntime.log("");
-      defaultRuntime.log(theme.heading("Recommended ~/.clawdbot/clawdbot.json:"));
-      defaultRuntime.log(
+      console.log("");
+      console.log("Recommended ~/.clawdbot/clawdbot.json:");
+      console.log(
        JSON.stringify(
          {
            gateway: { bind: "auto" },
@@ -145,16 +129,14 @@ export function registerDnsCli(program: Command) {
          2,
        ),
      );
-      defaultRuntime.log("");
-      defaultRuntime.log(theme.heading("Tailscale admin (DNS → Nameservers):"));
-      defaultRuntime.log(
-        theme.muted(`- Add nameserver: ${tailnetIPv4 ?? "<this machine's tailnet IPv4>"}`),
-      );
-      defaultRuntime.log(theme.muted("- Restrict to domain (Split DNS): clawdbot.internal"));
+      console.log("");
+      console.log("Tailscale admin (DNS → Nameservers):");
+      console.log(`- Add nameserver: ${tailnetIPv4 ?? "<this machine's tailnet IPv4>"}`);
+      console.log(`- Restrict to domain (Split DNS): clawdbot.internal`);

      if (!opts.apply) {
-        defaultRuntime.log("");
-        defaultRuntime.log(theme.muted("Run with --apply to install CoreDNS and configure it."));
+        console.log("");
+        console.log("Run with --apply to install CoreDNS and configure it.");
        return;
      }

@@ -223,18 +205,16 @@ export function registerDnsCli(program: Command) {
        fs.writeFileSync(zonePath, zoneLines.join("\n"), "utf-8");
      }

-      defaultRuntime.log("");
-      defaultRuntime.log(theme.heading("Starting CoreDNS (sudo)…"));
+      console.log("");
+      console.log("Starting CoreDNS (sudo)…");
      run("sudo", ["brew", "services", "restart", "coredns"], {
        inherit: true,
      });

      if (cfg.discovery?.wideArea?.enabled !== true) {
-        defaultRuntime.log("");
-        defaultRuntime.log(
-          theme.muted(
-            "Note: enable discovery.wideArea.enabled in ~/.clawdbot/clawdbot.json on the gateway and restart the gateway so it writes the DNS-SD zone.",
-          ),
+        console.log("");
+        console.log(
+          "Note: enable discovery.wideArea.enabled in ~/.clawdbot/clawdbot.json on the gateway and restart the gateway so it writes the DNS-SD zone.",
        );
      }
    });
@@ -1,25 +0,0 @@
-import { theme } from "../terminal/theme.js";
-
-export type HelpExample = readonly [command: string, description: string];
-
-export function formatHelpExample(command: string, description: string): string {
-  return `  ${theme.command(command)}\n    ${theme.muted(description)}`;
-}
-
-export function formatHelpExampleLine(command: string, description: string): string {
-  if (!description) return `  ${theme.command(command)}`;
-  return `  ${theme.command(command)} ${theme.muted(`# ${description}`)}`;
-}
-
-export function formatHelpExamples(examples: ReadonlyArray<HelpExample>, inline = false): string {
-  const formatter = inline ? formatHelpExampleLine : formatHelpExample;
-  return examples.map(([command, description]) => formatter(command, description)).join("\n");
-}
-
-export function formatHelpExampleGroup(
-  label: string,
-  examples: ReadonlyArray<HelpExample>,
-  inline = false,
-) {
-  return `${theme.muted(label)}\n${formatHelpExamples(examples, inline)}`;
-}
@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import fsp from "node:fs/promises";
 import path from "node:path";
+import chalk from "chalk";
 import type { Command } from "commander";
 import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agents/agent-scope.js";
 import type { ClawdbotConfig } from "../config/config.js";
@@ -22,7 +23,6 @@ import { recordHookInstall } from "../hooks/installs.js";
 import { buildPluginStatusReport } from "../plugins/status.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
-import { renderTable } from "../terminal/table.js";
 import { theme } from "../terminal/theme.js";
 import { formatCliCommand } from "./command-format.js";
 import { resolveUserPath } from "../utils.js";
@@ -66,40 +66,50 @@ function buildHooksReport(config: ClawdbotConfig): HookStatusReport {
  return buildWorkspaceHookStatus(workspaceDir, { config, entries });
 }

-function formatHookStatus(hook: HookStatusEntry): string {
-  if (hook.eligible) return theme.success("✓ ready");
-  if (hook.disabled) return theme.warn("⏸ disabled");
-  return theme.error("✗ missing");
-}
-
-function formatHookName(hook: HookStatusEntry): string {
+/**
+ * Format a single hook for display in the list
+ */
+function formatHookLine(hook: HookStatusEntry, verbose = false): string {
  const emoji = hook.emoji ?? "🔗";
-  return `${emoji} ${theme.command(hook.name)}`;
-}
+  const status = hook.eligible
+    ? chalk.green("✓")
+    : hook.disabled
+      ? chalk.yellow("disabled")
+      : chalk.red("missing reqs");

-function formatHookSource(hook: HookStatusEntry): string {
-  if (!hook.managedByPlugin) return hook.source;
-  return `plugin:${hook.pluginId ?? "unknown"}`;
-}
+  const name = hook.eligible ? chalk.white(hook.name) : chalk.gray(hook.name);

-function formatHookMissingSummary(hook: HookStatusEntry): string {
-  const missing: string[] = [];
-  if (hook.missing.bins.length > 0) {
-    missing.push(`bins: ${hook.missing.bins.join(", ")}`);
+  const desc = chalk.gray(
+    hook.description.length > 50 ? `${hook.description.slice(0, 47)}...` : hook.description,
+  );
+  const sourceLabel = hook.managedByPlugin
+    ? chalk.magenta(`plugin:${hook.pluginId ?? "unknown"}`)
+    : "";
+
+  if (verbose) {
+    const missing: string[] = [];
+    if (hook.missing.bins.length > 0) {
+      missing.push(`bins: ${hook.missing.bins.join(", ")}`);
+    }
+    if (hook.missing.anyBins.length > 0) {
+      missing.push(`anyBins: ${hook.missing.anyBins.join(", ")}`);
+    }
+    if (hook.missing.env.length > 0) {
+      missing.push(`env: ${hook.missing.env.join(", ")}`);
+    }
+    if (hook.missing.config.length > 0) {
+      missing.push(`config: ${hook.missing.config.join(", ")}`);
+    }
+    if (hook.missing.os.length > 0) {
+      missing.push(`os: ${hook.missing.os.join(", ")}`);
+    }
+    const missingStr = missing.length > 0 ? chalk.red(` [${missing.join("; ")}]`) : "";
+    const sourceSuffix = sourceLabel ? ` ${sourceLabel}` : "";
+    return `${emoji} ${name} ${status}${missingStr}\n   ${desc}${sourceSuffix}`;
  }
-  if (hook.missing.anyBins.length > 0) {
-    missing.push(`anyBins: ${hook.missing.anyBins.join(", ")}`);
-  }
-  if (hook.missing.env.length > 0) {
-    missing.push(`env: ${hook.missing.env.join(", ")}`);
-  }
-  if (hook.missing.config.length > 0) {
-    missing.push(`config: ${hook.missing.config.join(", ")}`);
-  }
-  if (hook.missing.os.length > 0) {
-    missing.push(`os: ${hook.missing.os.join(", ")}`);
-  }
-  return missing.join("; ");
+
+  const sourceSuffix = sourceLabel ? ` ${sourceLabel}` : "";
+  return `${emoji} ${name} ${status} - ${desc}${sourceSuffix}`;
 }

 async function readInstalledPackageVersion(dir: string): Promise<string | undefined> {
@@ -147,39 +157,27 @@ export function formatHooksList(report: HookStatusReport, opts: HooksListOptions
  }

  const eligible = hooks.filter((h) => h.eligible);
-  const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-  const rows = hooks.map((hook) => {
-    const missing = formatHookMissingSummary(hook);
-    return {
-      Status: formatHookStatus(hook),
-      Hook: formatHookName(hook),
-      Description: theme.muted(hook.description),
-      Source: formatHookSource(hook),
-      Missing: missing ? theme.warn(missing) : "",
-    };
-  });
-
-  const columns = [
-    { key: "Status", header: "Status", minWidth: 10 },
-    { key: "Hook", header: "Hook", minWidth: 18, flex: true },
-    { key: "Description", header: "Description", minWidth: 24, flex: true },
-    { key: "Source", header: "Source", minWidth: 12, flex: true },
-  ];
-  if (opts.verbose) {
-    columns.push({ key: "Missing", header: "Missing", minWidth: 18, flex: true });
-  }
+  const notEligible = hooks.filter((h) => !h.eligible);

  const lines: string[] = [];
-  lines.push(
-    `${theme.heading("Hooks")} ${theme.muted(`(${eligible.length}/${hooks.length} ready)`)}`,
-  );
-  lines.push(
-    renderTable({
-      width: tableWidth,
-      columns,
-      rows,
-    }).trimEnd(),
-  );
+  lines.push(chalk.bold.cyan("Hooks") + chalk.gray(` (${eligible.length}/${hooks.length} ready)`));
+  lines.push("");
+
+  if (eligible.length > 0) {
+    lines.push(chalk.bold.green("Ready:"));
+    for (const hook of eligible) {
+      lines.push(`  ${formatHookLine(hook, opts.verbose)}`);
+    }
+  }
+
+  if (notEligible.length > 0 && !opts.eligible) {
+    if (eligible.length > 0) lines.push("");
+    lines.push(chalk.bold.yellow("Not ready:"));
+    for (const hook of notEligible) {
+      lines.push(`  ${formatHookLine(hook, opts.verbose)}`);
+    }
+  }
+
  return lines.join("\n");
 }

@@ -207,33 +205,33 @@ export function formatHookInfo(
  const lines: string[] = [];
  const emoji = hook.emoji ?? "🔗";
  const status = hook.eligible
-    ? theme.success("✓ Ready")
+    ? chalk.green("✓ Ready")
    : hook.disabled
-      ? theme.warn("⏸ Disabled")
-      : theme.error("✗ Missing requirements");
+      ? chalk.yellow("⏸ Disabled")
+      : chalk.red("✗ Missing requirements");

-  lines.push(`${emoji} ${theme.heading(hook.name)} ${status}`);
+  lines.push(`${emoji} ${chalk.bold.cyan(hook.name)} ${status}`);
  lines.push("");
-  lines.push(hook.description);
+  lines.push(chalk.white(hook.description));
  lines.push("");

  // Details
-  lines.push(theme.heading("Details:"));
+  lines.push(chalk.bold("Details:"));
  if (hook.managedByPlugin) {
-    lines.push(`${theme.muted("  Source:")} ${hook.source} (${hook.pluginId ?? "unknown"})`);
+    lines.push(`  Source: ${hook.source} (${hook.pluginId ?? "unknown"})`);
  } else {
-    lines.push(`${theme.muted("  Source:")} ${hook.source}`);
+    lines.push(`  Source: ${hook.source}`);
  }
-  lines.push(`${theme.muted("  Path:")} ${hook.filePath}`);
-  lines.push(`${theme.muted("  Handler:")} ${hook.handlerPath}`);
+  lines.push(`  Path: ${chalk.gray(hook.filePath)}`);
+  lines.push(`  Handler: ${chalk.gray(hook.handlerPath)}`);
  if (hook.homepage) {
-    lines.push(`${theme.muted("  Homepage:")} ${hook.homepage}`);
+    lines.push(`  Homepage: ${chalk.blue(hook.homepage)}`);
  }
  if (hook.events.length > 0) {
-    lines.push(`${theme.muted("  Events:")} ${hook.events.join(", ")}`);
+    lines.push(`  Events: ${hook.events.join(", ")}`);
  }
  if (hook.managedByPlugin) {
-    lines.push(theme.muted("  Managed by plugin; enable/disable via hooks CLI not available."));
+    lines.push(`  Managed by plugin; enable/disable via hooks CLI not available.`);
  }

  // Requirements
@@ -246,40 +244,40 @@ export function formatHookInfo(

  if (hasRequirements) {
    lines.push("");
-    lines.push(theme.heading("Requirements:"));
+    lines.push(chalk.bold("Requirements:"));
    if (hook.requirements.bins.length > 0) {
      const binsStatus = hook.requirements.bins.map((bin) => {
        const missing = hook.missing.bins.includes(bin);
-        return missing ? theme.error(`✗ ${bin}`) : theme.success(`✓ ${bin}`);
+        return missing ? chalk.red(`✗ ${bin}`) : chalk.green(`✓ ${bin}`);
      });
-      lines.push(`${theme.muted("  Binaries:")} ${binsStatus.join(", ")}`);
+      lines.push(`  Binaries: ${binsStatus.join(", ")}`);
    }
    if (hook.requirements.anyBins.length > 0) {
      const anyBinsStatus =
        hook.missing.anyBins.length > 0
-          ? theme.error(`✗ (any of: ${hook.requirements.anyBins.join(", ")})`)
-          : theme.success(`✓ (any of: ${hook.requirements.anyBins.join(", ")})`);
-      lines.push(`${theme.muted("  Any binary:")} ${anyBinsStatus}`);
+          ? chalk.red(`✗ (any of: ${hook.requirements.anyBins.join(", ")})`)
+          : chalk.green(`✓ (any of: ${hook.requirements.anyBins.join(", ")})`);
+      lines.push(`  Any binary: ${anyBinsStatus}`);
    }
    if (hook.requirements.env.length > 0) {
      const envStatus = hook.requirements.env.map((env) => {
        const missing = hook.missing.env.includes(env);
-        return missing ? theme.error(`✗ ${env}`) : theme.success(`✓ ${env}`);
+        return missing ? chalk.red(`✗ ${env}`) : chalk.green(`✓ ${env}`);
      });
-      lines.push(`${theme.muted("  Environment:")} ${envStatus.join(", ")}`);
+      lines.push(`  Environment: ${envStatus.join(", ")}`);
    }
    if (hook.requirements.config.length > 0) {
      const configStatus = hook.configChecks.map((check) => {
-        return check.satisfied ? theme.success(`✓ ${check.path}`) : theme.error(`✗ ${check.path}`);
+        return check.satisfied ? chalk.green(`✓ ${check.path}`) : chalk.red(`✗ ${check.path}`);
      });
-      lines.push(`${theme.muted("  Config:")} ${configStatus.join(", ")}`);
+      lines.push(`  Config: ${configStatus.join(", ")}`);
    }
    if (hook.requirements.os.length > 0) {
      const osStatus =
        hook.missing.os.length > 0
-          ? theme.error(`✗ (${hook.requirements.os.join(", ")})`)
-          : theme.success(`✓ (${hook.requirements.os.join(", ")})`);
-      lines.push(`${theme.muted("  OS:")} ${osStatus}`);
+          ? chalk.red(`✗ (${hook.requirements.os.join(", ")})`)
+          : chalk.green(`✓ (${hook.requirements.os.join(", ")})`);
+      lines.push(`  OS: ${osStatus}`);
    }
  }

@@ -315,15 +313,15 @@ export function formatHooksCheck(report: HookStatusReport, opts: HooksCheckOptio
  const notEligible = report.hooks.filter((h) => !h.eligible);

  const lines: string[] = [];
-  lines.push(theme.heading("Hooks Status"));
+  lines.push(chalk.bold.cyan("Hooks Status"));
  lines.push("");
-  lines.push(`${theme.muted("Total hooks:")} ${report.hooks.length}`);
-  lines.push(`${theme.success("Ready:")} ${eligible.length}`);
-  lines.push(`${theme.warn("Not ready:")} ${notEligible.length}`);
+  lines.push(`Total hooks: ${report.hooks.length}`);
+  lines.push(chalk.green(`Ready: ${eligible.length}`));
+  lines.push(chalk.yellow(`Not ready: ${notEligible.length}`));

  if (notEligible.length > 0) {
    lines.push("");
-    lines.push(theme.heading("Hooks not ready:"));
+    lines.push(chalk.bold.yellow("Hooks not ready:"));
    for (const hook of notEligible) {
      const reasons = [];
      if (hook.disabled) reasons.push("disabled");
@@ -376,9 +374,7 @@ export async function enableHook(hookName: string): Promise<void> {
  };

  await writeConfigFile(nextConfig);
-  defaultRuntime.log(
-    `${theme.success("✓")} Enabled hook: ${hook.emoji ?? "🔗"} ${theme.command(hookName)}`,
-  );
+  console.log(`${chalk.green("✓")} Enabled hook: ${hook.emoji ?? "🔗"} ${hookName}`);
 }

 export async function disableHook(hookName: string): Promise<void> {
@@ -412,9 +408,7 @@ export async function disableHook(hookName: string): Promise<void> {
  };

  await writeConfigFile(nextConfig);
-  defaultRuntime.log(
-    `${theme.warn("⏸")} Disabled hook: ${hook.emoji ?? "🔗"} ${theme.command(hookName)}`,
-  );
+  console.log(`${chalk.yellow("⏸")} Disabled hook: ${hook.emoji ?? "🔗"} ${hookName}`);
 }

 export function registerHooksCli(program: Command): void {
@@ -437,11 +431,9 @@ export function registerHooksCli(program: Command): void {
      try {
        const config = loadConfig();
        const report = buildHooksReport(config);
-        defaultRuntime.log(formatHooksList(report, opts));
+        console.log(formatHooksList(report, opts));
      } catch (err) {
-        defaultRuntime.error(
-          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
-        );
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
        process.exit(1);
      }
    });
@@ -454,11 +446,9 @@ export function registerHooksCli(program: Command): void {
      try {
        const config = loadConfig();
        const report = buildHooksReport(config);
-        defaultRuntime.log(formatHookInfo(report, name, opts));
+        console.log(formatHookInfo(report, name, opts));
      } catch (err) {
-        defaultRuntime.error(
-          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
-        );
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
        process.exit(1);
      }
    });
@@ -471,11 +461,9 @@ export function registerHooksCli(program: Command): void {
      try {
        const config = loadConfig();
        const report = buildHooksReport(config);
-        defaultRuntime.log(formatHooksCheck(report, opts));
+        console.log(formatHooksCheck(report, opts));
      } catch (err) {
-        defaultRuntime.error(
-          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
-        );
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
        process.exit(1);
      }
    });
@@ -487,9 +475,7 @@ export function registerHooksCli(program: Command): void {
      try {
        await enableHook(name);
      } catch (err) {
-        defaultRuntime.error(
-          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
-        );
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
        process.exit(1);
      }
    });
@@ -501,9 +487,7 @@ export function registerHooksCli(program: Command): void {
      try {
        await disableHook(name);
      } catch (err) {
-        defaultRuntime.error(
-          `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
-        );
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
        process.exit(1);
      }
    });
@@ -586,7 +570,7 @@ export function registerHooksCli(program: Command): void {
          path: resolved,
          logger: {
            info: (msg) => defaultRuntime.log(msg),
-            warn: (msg) => defaultRuntime.log(theme.warn(msg)),
+            warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
          },
        });
        if (!result.ok) {
@@ -666,7 +650,7 @@ export function registerHooksCli(program: Command): void {
        spec: raw,
        logger: {
          info: (msg) => defaultRuntime.log(msg),
-          warn: (msg) => defaultRuntime.log(theme.warn(msg)),
+          warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
        },
      });
      if (!result.ok) {
@@ -742,15 +726,15 @@ export function registerHooksCli(program: Command): void {
      for (const hookId of targets) {
        const record = installs[hookId];
        if (!record) {
-          defaultRuntime.log(theme.warn(`No install record for "${hookId}".`));
+          defaultRuntime.log(chalk.yellow(`No install record for "${hookId}".`));
          continue;
        }
        if (record.source !== "npm") {
-          defaultRuntime.log(theme.warn(`Skipping "${hookId}" (source: ${record.source}).`));
+          defaultRuntime.log(chalk.yellow(`Skipping "${hookId}" (source: ${record.source}).`));
          continue;
        }
        if (!record.spec) {
-          defaultRuntime.log(theme.warn(`Skipping "${hookId}" (missing npm spec).`));
+          defaultRuntime.log(chalk.yellow(`Skipping "${hookId}" (missing npm spec).`));
          continue;
        }

@@ -765,11 +749,11 @@ export function registerHooksCli(program: Command): void {
            expectedHookPackId: hookId,
            logger: {
              info: (msg) => defaultRuntime.log(msg),
-              warn: (msg) => defaultRuntime.log(theme.warn(msg)),
+              warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
            },
          });
          if (!probe.ok) {
-            defaultRuntime.log(theme.error(`Failed to check ${hookId}: ${probe.error}`));
+            defaultRuntime.log(chalk.red(`Failed to check ${hookId}: ${probe.error}`));
            continue;
          }

@@ -789,11 +773,11 @@ export function registerHooksCli(program: Command): void {
          expectedHookPackId: hookId,
          logger: {
            info: (msg) => defaultRuntime.log(msg),
-            warn: (msg) => defaultRuntime.log(theme.warn(msg)),
+            warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
          },
        });
        if (!result.ok) {
-          defaultRuntime.log(theme.error(`Failed to update ${hookId}: ${result.error}`));
+          defaultRuntime.log(chalk.red(`Failed to update ${hookId}: ${result.error}`));
          continue;
        }

@@ -827,11 +811,9 @@ export function registerHooksCli(program: Command): void {
    try {
      const config = loadConfig();
      const report = buildHooksReport(config);
-      defaultRuntime.log(formatHooksList(report, {}));
+      console.log(formatHooksList(report, {}));
    } catch (err) {
-      defaultRuntime.error(
-        `${theme.error("Error:")} ${err instanceof Error ? err.message : String(err)}`,
-      );
+      console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
      process.exit(1);
    }
  });
@@ -5,7 +5,6 @@ import { getNodesTheme, runNodesCommand } from "./cli-utils.js";
 import { callGatewayCli, nodesCallOpts, resolveNodeId } from "./rpc.js";
 import type { NodesRpcOpts } from "./types.js";
 import { renderTable } from "../../terminal/table.js";
-import { parseDurationMs } from "../parse-duration.js";

 function formatVersionLabel(raw: string) {
  const trimmed = raw.trim();
@@ -44,85 +43,30 @@ function formatNodeVersions(node: {
  return parts.length > 0 ? parts.join(" · ") : null;
 }

-function parseSinceMs(raw: unknown, label: string): number | undefined {
-  if (raw === undefined || raw === null) return undefined;
-  const value =
-    typeof raw === "string" ? raw.trim() : typeof raw === "number" ? String(raw).trim() : null;
-  if (value === null) {
-    defaultRuntime.error(`${label}: invalid duration value`);
-    defaultRuntime.exit(1);
-    return undefined;
-  }
-  if (!value) return undefined;
-  try {
-    return parseDurationMs(value);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    defaultRuntime.error(`${label}: ${message}`);
-    defaultRuntime.exit(1);
-    return undefined;
-  }
-}
-
 export function registerNodesStatusCommands(nodes: Command) {
  nodesCallOpts(
    nodes
      .command("status")
      .description("List known nodes with connection status and capabilities")
-      .option("--connected", "Only show connected nodes")
-      .option("--last-connected <duration>", "Only show nodes connected within duration (e.g. 24h)")
      .action(async (opts: NodesRpcOpts) => {
        await runNodesCommand("status", async () => {
-          const connectedOnly = Boolean(opts.connected);
-          const sinceMs = parseSinceMs(opts.lastConnected, "Invalid --last-connected");
          const result = (await callGatewayCli("node.list", opts, {})) as unknown;
-          const obj =
-            typeof result === "object" && result !== null
-              ? (result as Record<string, unknown>)
-              : {};
+          if (opts.json) {
+            defaultRuntime.log(JSON.stringify(result, null, 2));
+            return;
+          }
          const { ok, warn, muted } = getNodesTheme();
          const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
          const now = Date.now();
          const nodes = parseNodeList(result);
-          const lastConnectedById =
-            sinceMs !== undefined
-              ? new Map(
-                  parsePairingList(await callGatewayCli("node.pair.list", opts, {})).paired.map(
-                    (entry) => [entry.nodeId, entry],
-                  ),
-                )
-              : null;
-          const filtered = nodes.filter((n) => {
-            if (connectedOnly && !n.connected) return false;
-            if (sinceMs !== undefined) {
-              const paired = lastConnectedById?.get(n.nodeId);
-              const lastConnectedAtMs =
-                typeof paired?.lastConnectedAtMs === "number"
-                  ? paired.lastConnectedAtMs
-                  : typeof n.connectedAtMs === "number"
-                    ? n.connectedAtMs
-                    : undefined;
-              if (typeof lastConnectedAtMs !== "number") return false;
-              if (now - lastConnectedAtMs > sinceMs) return false;
-            }
-            return true;
-          });
-
-          if (opts.json) {
-            const ts = typeof obj.ts === "number" ? obj.ts : Date.now();
-            defaultRuntime.log(JSON.stringify({ ...obj, ts, nodes: filtered }, null, 2));
-            return;
-          }
-
-          const pairedCount = filtered.filter((n) => Boolean(n.paired)).length;
-          const connectedCount = filtered.filter((n) => Boolean(n.connected)).length;
-          const filteredLabel = filtered.length !== nodes.length ? ` (of ${nodes.length})` : "";
+          const pairedCount = nodes.filter((n) => Boolean(n.paired)).length;
+          const connectedCount = nodes.filter((n) => Boolean(n.connected)).length;
          defaultRuntime.log(
-            `Known: ${filtered.length}${filteredLabel} · Paired: ${pairedCount} · Connected: ${connectedCount}`,
+            `Known: ${nodes.length} · Paired: ${pairedCount} · Connected: ${connectedCount}`,
          );
-          if (filtered.length === 0) return;
+          if (nodes.length === 0) return;

-          const rows = filtered.map((n) => {
+          const rows = nodes.map((n) => {
            const name = n.displayName?.trim() ? n.displayName.trim() : n.nodeId;
            const perms = formatPermissions(n.permissions);
            const versions = formatNodeVersions(n);
@@ -253,60 +197,21 @@ export function registerNodesStatusCommands(nodes: Command) {
    nodes
      .command("list")
      .description("List pending and paired nodes")
-      .option("--connected", "Only show connected nodes")
-      .option("--last-connected <duration>", "Only show nodes connected within duration (e.g. 24h)")
      .action(async (opts: NodesRpcOpts) => {
        await runNodesCommand("list", async () => {
-          const connectedOnly = Boolean(opts.connected);
-          const sinceMs = parseSinceMs(opts.lastConnected, "Invalid --last-connected");
          const result = (await callGatewayCli("node.pair.list", opts, {})) as unknown;
+          if (opts.json) {
+            defaultRuntime.log(JSON.stringify(result, null, 2));
+            return;
+          }
          const { pending, paired } = parsePairingList(result);
+          defaultRuntime.log(`Pending: ${pending.length} · Paired: ${paired.length}`);
          const { heading, muted, warn } = getNodesTheme();
          const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
          const now = Date.now();
-          const hasFilters = connectedOnly || sinceMs !== undefined;
-          const pendingRows = hasFilters ? [] : pending;
-          const connectedById = hasFilters
-            ? new Map(
-                parseNodeList(await callGatewayCli("node.list", opts, {})).map((node) => [
-                  node.nodeId,
-                  node,
-                ]),
-              )
-            : null;
-          const filteredPaired = paired.filter((node) => {
-            if (connectedOnly) {
-              const live = connectedById?.get(node.nodeId);
-              if (!live?.connected) return false;
-            }
-            if (sinceMs !== undefined) {
-              const live = connectedById?.get(node.nodeId);
-              const lastConnectedAtMs =
-                typeof node.lastConnectedAtMs === "number"
-                  ? node.lastConnectedAtMs
-                  : typeof live?.connectedAtMs === "number"
-                    ? live.connectedAtMs
-                    : undefined;
-              if (typeof lastConnectedAtMs !== "number") return false;
-              if (now - lastConnectedAtMs > sinceMs) return false;
-            }
-            return true;
-          });
-          const filteredLabel =
-            hasFilters && filteredPaired.length !== paired.length ? ` (of ${paired.length})` : "";
-          defaultRuntime.log(
-            `Pending: ${pendingRows.length} · Paired: ${filteredPaired.length}${filteredLabel}`,
-          );

-          if (opts.json) {
-            defaultRuntime.log(
-              JSON.stringify({ pending: pendingRows, paired: filteredPaired }, null, 2),
-            );
-            return;
-          }
-
-          if (pendingRows.length > 0) {
-            const pendingRowsRendered = pendingRows.map((r) => ({
+          if (pending.length > 0) {
+            const pendingRows = pending.map((r) => ({
              Request: r.requestId,
              Node: r.displayName?.trim() ? r.displayName.trim() : r.nodeId,
              IP: r.remoteIp ?? "",
@@ -328,30 +233,21 @@ export function registerNodesStatusCommands(nodes: Command) {
                  { key: "Requested", header: "Requested", minWidth: 12 },
                  { key: "Repair", header: "Repair", minWidth: 6 },
                ],
-                rows: pendingRowsRendered,
+                rows: pendingRows,
              }).trimEnd(),
            );
          }

-          if (filteredPaired.length > 0) {
-            const pairedRows = filteredPaired.map((n) => {
-              const live = connectedById?.get(n.nodeId);
-              const lastConnectedAtMs =
+          if (paired.length > 0) {
+            const pairedRows = paired.map((n) => ({
+              Node: n.displayName?.trim() ? n.displayName.trim() : n.nodeId,
+              Id: n.nodeId,
+              IP: n.remoteIp ?? "",
+              LastConnect:
                typeof n.lastConnectedAtMs === "number"
-                  ? n.lastConnectedAtMs
-                  : typeof live?.connectedAtMs === "number"
-                    ? live.connectedAtMs
-                    : undefined;
-              return {
-                Node: n.displayName?.trim() ? n.displayName.trim() : n.nodeId,
-                Id: n.nodeId,
-                IP: n.remoteIp ?? "",
-                LastConnect:
-                  typeof lastConnectedAtMs === "number"
-                    ? `${formatAge(Math.max(0, now - lastConnectedAtMs))} ago`
-                    : muted("unknown"),
-              };
-            });
+                  ? `${formatAge(Math.max(0, now - n.lastConnectedAtMs))} ago`
+                  : muted("unknown"),
+            }));
            defaultRuntime.log("");
            defaultRuntime.log(heading("Paired"));
            defaultRuntime.log(
@@ -8,8 +8,6 @@ export type NodesRpcOpts = {
  params?: string;
  invokeTimeout?: string;
  idempotencyKey?: string;
-  connected?: boolean;
-  lastConnected?: string;
  target?: string;
  x?: string;
  y?: string;
@@ -71,9 +71,7 @@ describe("pairing cli", () => {
    await program.parseAsync(["pairing", "list", "--channel", "telegram"], {
      from: "user",
    });
-    const output = log.mock.calls.map((call) => call.join(" ")).join("\n");
-    expect(output).toContain("telegramUserId");
-    expect(output).toContain("123");
+    expect(log).toHaveBeenCalledWith(expect.stringContaining("telegramUserId=123"));
  });

  it("accepts channel as positional for list", async () => {
@@ -133,9 +131,7 @@ describe("pairing cli", () => {
    await program.parseAsync(["pairing", "list", "--channel", "discord"], {
      from: "user",
    });
-    const output = log.mock.calls.map((call) => call.join(" ")).join("\n");
-    expect(output).toContain("discordUserId");
-    expect(output).toContain("999");
+    expect(log).toHaveBeenCalledWith(expect.stringContaining("discordUserId=999"));
  });

  it("accepts channel as positional for approve (npm-run compatible)", async () => {
@@ -8,9 +8,7 @@ import {
  listChannelPairingRequests,
  type PairingChannel,
 } from "../pairing/pairing-store.js";
-import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
-import { renderTable } from "../terminal/table.js";
 import { theme } from "../terminal/theme.js";
 import { formatCliCommand } from "./command-format.js";

@@ -72,35 +70,18 @@ export function registerPairingCli(program: Command) {
      const channel = parseChannel(channelRaw, channels);
      const requests = await listChannelPairingRequests(channel);
      if (opts.json) {
-        defaultRuntime.log(JSON.stringify({ channel, requests }, null, 2));
+        console.log(JSON.stringify({ channel, requests }, null, 2));
        return;
      }
      if (requests.length === 0) {
-        defaultRuntime.log(theme.muted(`No pending ${channel} pairing requests.`));
+        console.log(`No pending ${channel} pairing requests.`);
        return;
      }
-      const idLabel = resolvePairingIdLabel(channel);
-      const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-      defaultRuntime.log(
-        `${theme.heading("Pairing requests")} ${theme.muted(`(${requests.length})`)}`,
-      );
-      defaultRuntime.log(
-        renderTable({
-          width: tableWidth,
-          columns: [
-            { key: "Code", header: "Code", minWidth: 10 },
-            { key: "ID", header: idLabel, minWidth: 12, flex: true },
-            { key: "Meta", header: "Meta", minWidth: 8, flex: true },
-            { key: "Requested", header: "Requested", minWidth: 12 },
-          ],
-          rows: requests.map((r) => ({
-            Code: r.code,
-            ID: r.id,
-            Meta: r.meta ? JSON.stringify(r.meta) : "",
-            Requested: r.createdAt,
-          })),
-        }).trimEnd(),
-      );
+      for (const r of requests) {
+        const meta = r.meta ? JSON.stringify(r.meta) : "";
+        const idLabel = resolvePairingIdLabel(channel);
+        console.log(`${r.code}  ${idLabel}=${r.id}${meta ? `  meta=${meta}` : ""}  ${r.createdAt}`);
+      }
    });

  pairing
@@ -132,13 +113,11 @@ export function registerPairingCli(program: Command) {
        throw new Error(`No pending pairing request found for code: ${String(resolvedCode)}`);
      }

-      defaultRuntime.log(
-        `${theme.success("Approved")} ${theme.muted(channel)} sender ${theme.command(approved.id)}.`,
-      );
+      console.log(`Approved ${channel} sender ${approved.id}.`);

      if (!opts.notify) return;
      await notifyApproved(channel, approved.id).catch((err) => {
-        defaultRuntime.log(theme.warn(`Failed to notify requester: ${String(err)}`));
+        console.log(`Failed to notify requester: ${String(err)}`);
      });
    });
 }
@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import chalk from "chalk";
 import type { Command } from "commander";

 import { loadConfig, writeConfigFile } from "../config/config.js";
@@ -13,7 +14,6 @@ import { buildPluginStatusReport } from "../plugins/status.js";
 import { updateNpmInstalledPlugins } from "../plugins/update.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
-import { renderTable } from "../terminal/table.js";
 import { theme } from "../terminal/theme.js";
 import { resolveUserPath } from "../utils.js";

@@ -35,19 +35,19 @@ export type PluginUpdateOptions = {
 function formatPluginLine(plugin: PluginRecord, verbose = false): string {
  const status =
    plugin.status === "loaded"
-      ? theme.success("loaded")
+      ? chalk.green("✓")
      : plugin.status === "disabled"
-        ? theme.warn("disabled")
-        : theme.error("error");
-  const name = theme.command(plugin.name || plugin.id);
-  const idSuffix = plugin.name && plugin.name !== plugin.id ? theme.muted(` (${plugin.id})`) : "";
+        ? chalk.yellow("disabled")
+        : chalk.red("error");
+  const name = plugin.name ? chalk.white(plugin.name) : chalk.white(plugin.id);
+  const idSuffix = plugin.name !== plugin.id ? chalk.gray(` (${plugin.id})`) : "";
  const desc = plugin.description
-    ? theme.muted(
+    ? chalk.gray(
        plugin.description.length > 60
          ? `${plugin.description.slice(0, 57)}...`
          : plugin.description,
      )
-    : theme.muted("(no description)");
+    : chalk.gray("(no description)");

  if (!verbose) {
    return `${name}${idSuffix} ${status} - ${desc}`;
@@ -55,14 +55,14 @@ function formatPluginLine(plugin: PluginRecord, verbose = false): string {

  const parts = [
    `${name}${idSuffix} ${status}`,
-    `  source: ${theme.muted(plugin.source)}`,
+    `  source: ${chalk.gray(plugin.source)}`,
    `  origin: ${plugin.origin}`,
  ];
  if (plugin.version) parts.push(`  version: ${plugin.version}`);
  if (plugin.providerIds.length > 0) {
    parts.push(`  providers: ${plugin.providerIds.join(", ")}`);
  }
-  if (plugin.error) parts.push(theme.error(`  error: ${plugin.error}`));
+  if (plugin.error) parts.push(chalk.red(`  error: ${plugin.error}`));
  return parts.join("\n");
 }

@@ -87,7 +87,7 @@ function applySlotSelectionForPlugin(
 function logSlotWarnings(warnings: string[]) {
  if (warnings.length === 0) return;
  for (const warning of warnings) {
-    defaultRuntime.log(theme.warn(warning));
+    defaultRuntime.log(chalk.yellow(warning));
  }
 }

@@ -124,51 +124,19 @@ export function registerPluginsCli(program: Command) {
      }

      if (list.length === 0) {
-        defaultRuntime.log(theme.muted("No plugins found."));
-        return;
-      }
-
-      const loaded = list.filter((p) => p.status === "loaded").length;
-      defaultRuntime.log(
-        `${theme.heading("Plugins")} ${theme.muted(`(${loaded}/${list.length} loaded)`)}`,
-      );
-
-      if (!opts.verbose) {
-        const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
-        const rows = list.map((plugin) => ({
-          Name: plugin.name || plugin.id,
-          ID: plugin.name && plugin.name !== plugin.id ? plugin.id : "",
-          Status:
-            plugin.status === "loaded"
-              ? theme.success("loaded")
-              : plugin.status === "disabled"
-                ? theme.warn("disabled")
-                : theme.error("error"),
-          Source: plugin.source,
-          Version: plugin.version ?? "",
-          Description: plugin.description ?? "",
-        }));
-        defaultRuntime.log(
-          renderTable({
-            width: tableWidth,
-            columns: [
-              { key: "Name", header: "Name", minWidth: 14, flex: true },
-              { key: "ID", header: "ID", minWidth: 10, flex: true },
-              { key: "Status", header: "Status", minWidth: 10 },
-              { key: "Source", header: "Source", minWidth: 10 },
-              { key: "Version", header: "Version", minWidth: 8 },
-              { key: "Description", header: "Description", minWidth: 18, flex: true },
-            ],
-            rows,
-          }).trimEnd(),
-        );
+        defaultRuntime.log("No plugins found.");
        return;
      }

      const lines: string[] = [];
+      const loaded = list.filter((p) => p.status === "loaded").length;
+      lines.push(
+        `${chalk.bold.cyan("Plugins")} ${chalk.gray(`(${loaded}/${list.length} loaded)`)}`,
+      );
+      lines.push("");
      for (const plugin of list) {
-        lines.push(formatPluginLine(plugin, true));
-        lines.push("");
+        lines.push(formatPluginLine(plugin, opts.verbose));
+        if (opts.verbose) lines.push("");
      }
      defaultRuntime.log(lines.join("\n").trim());
    });
@@ -194,45 +162,43 @@ export function registerPluginsCli(program: Command) {
      }

      const lines: string[] = [];
-      lines.push(theme.heading(plugin.name || plugin.id));
+      lines.push(chalk.bold.cyan(plugin.name || plugin.id));
      if (plugin.name && plugin.name !== plugin.id) {
-        lines.push(theme.muted(`id: ${plugin.id}`));
+        lines.push(chalk.gray(`id: ${plugin.id}`));
      }
      if (plugin.description) lines.push(plugin.description);
      lines.push("");
-      lines.push(`${theme.muted("Status:")} ${plugin.status}`);
-      lines.push(`${theme.muted("Source:")} ${plugin.source}`);
-      lines.push(`${theme.muted("Origin:")} ${plugin.origin}`);
-      if (plugin.version) lines.push(`${theme.muted("Version:")} ${plugin.version}`);
+      lines.push(`Status: ${plugin.status}`);
+      lines.push(`Source: ${plugin.source}`);
+      lines.push(`Origin: ${plugin.origin}`);
+      if (plugin.version) lines.push(`Version: ${plugin.version}`);
      if (plugin.toolNames.length > 0) {
-        lines.push(`${theme.muted("Tools:")} ${plugin.toolNames.join(", ")}`);
+        lines.push(`Tools: ${plugin.toolNames.join(", ")}`);
      }
      if (plugin.hookNames.length > 0) {
-        lines.push(`${theme.muted("Hooks:")} ${plugin.hookNames.join(", ")}`);
+        lines.push(`Hooks: ${plugin.hookNames.join(", ")}`);
      }
      if (plugin.gatewayMethods.length > 0) {
-        lines.push(`${theme.muted("Gateway methods:")} ${plugin.gatewayMethods.join(", ")}`);
+        lines.push(`Gateway methods: ${plugin.gatewayMethods.join(", ")}`);
      }
      if (plugin.providerIds.length > 0) {
-        lines.push(`${theme.muted("Providers:")} ${plugin.providerIds.join(", ")}`);
+        lines.push(`Providers: ${plugin.providerIds.join(", ")}`);
      }
      if (plugin.cliCommands.length > 0) {
-        lines.push(`${theme.muted("CLI commands:")} ${plugin.cliCommands.join(", ")}`);
+        lines.push(`CLI commands: ${plugin.cliCommands.join(", ")}`);
      }
      if (plugin.services.length > 0) {
-        lines.push(`${theme.muted("Services:")} ${plugin.services.join(", ")}`);
+        lines.push(`Services: ${plugin.services.join(", ")}`);
      }
-      if (plugin.error) lines.push(`${theme.error("Error:")} ${plugin.error}`);
+      if (plugin.error) lines.push(chalk.red(`Error: ${plugin.error}`));
      if (install) {
        lines.push("");
-        lines.push(`${theme.muted("Install:")} ${install.source}`);
-        if (install.spec) lines.push(`${theme.muted("Spec:")} ${install.spec}`);
-        if (install.sourcePath) lines.push(`${theme.muted("Source path:")} ${install.sourcePath}`);
-        if (install.installPath)
-          lines.push(`${theme.muted("Install path:")} ${install.installPath}`);
-        if (install.version) lines.push(`${theme.muted("Recorded version:")} ${install.version}`);
-        if (install.installedAt)
-          lines.push(`${theme.muted("Installed at:")} ${install.installedAt}`);
+        lines.push(`Install: ${install.source}`);
+        if (install.spec) lines.push(`Spec: ${install.spec}`);
+        if (install.sourcePath) lines.push(`Source path: ${install.sourcePath}`);
+        if (install.installPath) lines.push(`Install path: ${install.installPath}`);
+        if (install.version) lines.push(`Recorded version: ${install.version}`);
+        if (install.installedAt) lines.push(`Installed at: ${install.installedAt}`);
      }
      defaultRuntime.log(lines.join("\n"));
    });
@@ -342,7 +308,7 @@ export function registerPluginsCli(program: Command) {
          path: resolved,
          logger: {
            info: (msg) => defaultRuntime.log(msg),
-            warn: (msg) => defaultRuntime.log(theme.warn(msg)),
+            warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
          },
        });
        if (!result.ok) {
@@ -406,7 +372,7 @@ export function registerPluginsCli(program: Command) {
        spec: raw,
        logger: {
          info: (msg) => defaultRuntime.log(msg),
-          warn: (msg) => defaultRuntime.log(theme.warn(msg)),
+          warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
        },
      });
      if (!result.ok) {
@@ -454,10 +420,6 @@ export function registerPluginsCli(program: Command) {
      const targets = opts.all ? Object.keys(installs) : id ? [id] : [];

      if (targets.length === 0) {
-        if (opts.all) {
-          defaultRuntime.log("No npm-installed plugins to update.");
-          return;
-        }
        defaultRuntime.error("Provide a plugin id or use --all.");
        process.exit(1);
      }
@@ -468,17 +430,17 @@ export function registerPluginsCli(program: Command) {
        dryRun: opts.dryRun,
        logger: {
          info: (msg) => defaultRuntime.log(msg),
-          warn: (msg) => defaultRuntime.log(theme.warn(msg)),
+          warn: (msg) => defaultRuntime.log(chalk.yellow(msg)),
        },
      });

      for (const outcome of result.outcomes) {
        if (outcome.status === "error") {
-          defaultRuntime.log(theme.error(outcome.message));
+          defaultRuntime.log(chalk.red(outcome.message));
          continue;
        }
        if (outcome.status === "skipped") {
-          defaultRuntime.log(theme.warn(outcome.message));
+          defaultRuntime.log(chalk.yellow(outcome.message));
          continue;
        }
        defaultRuntime.log(outcome.message);
@@ -505,14 +467,14 @@ export function registerPluginsCli(program: Command) {

      const lines: string[] = [];
      if (errors.length > 0) {
-        lines.push(theme.error("Plugin errors:"));
+        lines.push(chalk.bold.red("Plugin errors:"));
        for (const entry of errors) {
          lines.push(`- ${entry.id}: ${entry.error ?? "failed to load"} (${entry.source})`);
        }
      }
      if (diags.length > 0) {
        if (lines.length > 0) lines.push("");
-        lines.push(theme.warn("Diagnostics:"));
+        lines.push(chalk.bold.yellow("Diagnostics:"));
        for (const diag of diags) {
          const target = diag.pluginId ? `${diag.pluginId}: ` : "";
          lines.push(`- ${target}${diag.message}`);
@@ -68,83 +68,6 @@ describe("cli program (nodes basics)", () => {
    expect(runtime.log).toHaveBeenCalledWith("Pending: 0 · Paired: 0");
  });

-  it("runs nodes list --connected and filters to connected nodes", async () => {
-    const now = Date.now();
-    callGateway.mockImplementation(async (opts: { method?: string }) => {
-      if (opts.method === "node.pair.list") {
-        return {
-          pending: [],
-          paired: [
-            {
-              nodeId: "n1",
-              displayName: "One",
-              remoteIp: "10.0.0.1",
-              lastConnectedAtMs: now - 1_000,
-            },
-            {
-              nodeId: "n2",
-              displayName: "Two",
-              remoteIp: "10.0.0.2",
-              lastConnectedAtMs: now - 1_000,
-            },
-          ],
-        };
-      }
-      if (opts.method === "node.list") {
-        return {
-          nodes: [
-            { nodeId: "n1", connected: true },
-            { nodeId: "n2", connected: false },
-          ],
-        };
-      }
-      return { ok: true };
-    });
-    const program = buildProgram();
-    runtime.log.mockClear();
-    await program.parseAsync(["nodes", "list", "--connected"], { from: "user" });
-
-    expect(callGateway).toHaveBeenCalledWith(expect.objectContaining({ method: "node.list" }));
-    const output = runtime.log.mock.calls.map((c) => String(c[0] ?? "")).join("\n");
-    expect(output).toContain("One");
-    expect(output).not.toContain("Two");
-  });
-
-  it("runs nodes status --last-connected and filters by age", async () => {
-    const now = Date.now();
-    callGateway.mockImplementation(async (opts: { method?: string }) => {
-      if (opts.method === "node.list") {
-        return {
-          ts: now,
-          nodes: [
-            { nodeId: "n1", displayName: "One", connected: false },
-            { nodeId: "n2", displayName: "Two", connected: false },
-          ],
-        };
-      }
-      if (opts.method === "node.pair.list") {
-        return {
-          pending: [],
-          paired: [
-            { nodeId: "n1", lastConnectedAtMs: now - 1_000 },
-            { nodeId: "n2", lastConnectedAtMs: now - 2 * 24 * 60 * 60 * 1000 },
-          ],
-        };
-      }
-      return { ok: true };
-    });
-    const program = buildProgram();
-    runtime.log.mockClear();
-    await program.parseAsync(["nodes", "status", "--last-connected", "24h"], {
-      from: "user",
-    });
-
-    expect(callGateway).toHaveBeenCalledWith(expect.objectContaining({ method: "node.pair.list" }));
-    const output = runtime.log.mock.calls.map((c) => String(c[0] ?? "")).join("\n");
-    expect(output).toContain("One");
-    expect(output).not.toContain("Two");
-  });
-
  it("runs nodes status and calls node.list", async () => {
    callGateway.mockResolvedValue({
      ts: Date.now(),
@@ -4,6 +4,7 @@ import { agentsListCommand } from "../../commands/agents.js";
 import { healthCommand } from "../../commands/health.js";
 import { sessionsCommand } from "../../commands/sessions.js";
 import { statusCommand } from "../../commands/status.js";
+import { setVerbose } from "../../globals.js";
 import { defaultRuntime } from "../../runtime.js";
 import { getFlagValue, getPositiveIntFlagValue, getVerboseFlag, hasFlag } from "../argv.js";
 import { registerBrowserCli } from "../browser-cli.js";
@@ -45,6 +46,7 @@ const routeHealth: RouteSpec = {
    const verbose = getVerboseFlag(argv, { includeDebug: true });
    const timeoutMs = getPositiveIntFlagValue(argv, "--timeout");
    if (timeoutMs === null) return false;
+    setVerbose(verbose);
    await healthCommand({ json, timeoutMs, verbose }, defaultRuntime);
    return true;
  },
@@ -61,6 +63,7 @@ const routeStatus: RouteSpec = {
    const verbose = getVerboseFlag(argv, { includeDebug: true });
    const timeoutMs = getPositiveIntFlagValue(argv, "--timeout");
    if (timeoutMs === null) return false;
+    setVerbose(verbose);
    await statusCommand({ json, deep, all, usage, timeoutMs, verbose }, defaultRuntime);
    return true;
  },
@@ -70,10 +73,12 @@ const routeSessions: RouteSpec = {
  match: (path) => path[0] === "sessions",
  run: async (argv) => {
    const json = hasFlag(argv, "--json");
+    const verbose = getVerboseFlag(argv);
    const store = getFlagValue(argv, "--store");
    if (store === null) return false;
    const active = getFlagValue(argv, "--active");
    if (active === null) return false;
+    setVerbose(verbose);
    await sessionsCommand({ json, store, active }, defaultRuntime);
    return true;
  },
@@ -1,11 +1,9 @@
 import type { Command } from "commander";
 import { defaultRuntime } from "../../runtime.js";
 import { emitCliBanner } from "../banner.js";
-import { getCommandPath, getVerboseFlag, hasHelpOrVersion } from "../argv.js";
+import { getCommandPath, hasHelpOrVersion } from "../argv.js";
 import { ensureConfigReady } from "./config-guard.js";
 import { ensurePluginRegistryLoaded } from "../plugin-registry.js";
-import { isTruthyEnvValue } from "../../infra/env.js";
-import { setVerbose } from "../../globals.js";

 function setProcessTitleForCommand(actionCommand: Command) {
  let current: Command = actionCommand;
@@ -23,21 +21,10 @@ const PLUGIN_REQUIRED_COMMANDS = new Set(["message", "channels", "directory"]);
 export function registerPreActionHooks(program: Command, programVersion: string) {
  program.hook("preAction", async (_thisCommand, actionCommand) => {
    setProcessTitleForCommand(actionCommand);
+    emitCliBanner(programVersion);
    const argv = process.argv;
    if (hasHelpOrVersion(argv)) return;
    const commandPath = getCommandPath(argv, 2);
-    const hideBanner =
-      isTruthyEnvValue(process.env.CLAWDBOT_HIDE_BANNER) ||
-      commandPath[0] === "update" ||
-      (commandPath[0] === "plugins" && commandPath[1] === "update");
-    if (!hideBanner) {
-      emitCliBanner(programVersion);
-    }
-    const verbose = getVerboseFlag(argv, { includeDebug: true });
-    setVerbose(verbose);
-    if (!verbose) {
-      process.env.NODE_NO_WARNINGS ??= "1";
-    }
    if (commandPath[0] === "doctor") return;
    await ensureConfigReady({ runtime: defaultRuntime, commandPath });
    // Load plugins for commands that need channel access
@@ -12,7 +12,6 @@ import { defaultRuntime } from "../../runtime.js";
 import { formatDocsLink } from "../../terminal/links.js";
 import { theme } from "../../terminal/theme.js";
 import { hasExplicitOptions } from "../command-options.js";
-import { formatHelpExamples } from "../help-format.js";
 import { createDefaultDeps } from "../deps.js";
 import { runCommandWithRuntime } from "../cli-utils.js";
 import { collectOption } from "./helpers.js";
@@ -49,24 +48,13 @@ export function registerAgentCommands(program: Command, args: { agentChannelOpti
      "after",
      () =>
        `
-${theme.heading("Examples:")}
-${formatHelpExamples([
-  ['clawdbot agent --to +15555550123 --message "status update"', "Start a new session."],
-  ['clawdbot agent --agent ops --message "Summarize logs"', "Use a specific agent."],
-  [
-    'clawdbot agent --session-id 1234 --message "Summarize inbox" --thinking medium',
-    "Target a session with explicit thinking level.",
-  ],
-  [
-    'clawdbot agent --to +15555550123 --message "Trace logs" --verbose on --json',
-    "Enable verbose logging and JSON output.",
-  ],
-  ['clawdbot agent --to +15555550123 --message "Summon reply" --deliver', "Deliver reply."],
-  [
-    'clawdbot agent --agent ops --message "Generate report" --deliver --reply-channel slack --reply-to "#reports"',
-    "Send reply to a different channel/target.",
-  ],
-])}
+Examples:
+  clawdbot agent --to +15555550123 --message "status update"
+  clawdbot agent --agent ops --message "Summarize logs"
+  clawdbot agent --session-id 1234 --message "Summarize inbox" --thinking medium
+  clawdbot agent --to +15555550123 --message "Trace logs" --verbose on --json
+  clawdbot agent --to +15555550123 --message "Summon reply" --deliver
+  clawdbot agent --agent ops --message "Generate report" --deliver --reply-channel slack --reply-to "#reports"

 ${theme.muted("Docs:")} ${formatDocsLink("/cli/agent", "docs.clawd.bot/cli/agent")}`,
    )
@@ -152,15 +140,10 @@ ${theme.muted("Docs:")} ${formatDocsLink("/cli/agent", "docs.clawd.bot/cli/agent
      "after",
      () =>
        `
-${theme.heading("Examples:")}
-${formatHelpExamples([
-  ['clawdbot agents set-identity --agent main --name "Clawd" --emoji "🦞"', "Set name + emoji."],
-  ["clawdbot agents set-identity --workspace ~/clawd --from-identity", "Load from IDENTITY.md."],
-  [
-    "clawdbot agents set-identity --identity-file ~/clawd/IDENTITY.md --agent main",
-    "Use a specific IDENTITY.md.",
-  ],
-])}
+Examples:
+  clawdbot agents set-identity --agent main --name "Clawd" --emoji "🦞"
+  clawdbot agents set-identity --workspace ~/clawd --from-identity
+  clawdbot agents set-identity --identity-file ~/clawd/IDENTITY.md --agent main
 `,
    )
    .action(async (opts) => {
@@ -1,7 +1,6 @@
 import type { Command } from "commander";
 import { formatDocsLink } from "../../terminal/links.js";
 import { theme } from "../../terminal/theme.js";
-import { formatHelpExamples } from "../help-format.js";
 import type { ProgramContext } from "./context.js";
 import { createMessageCliHelpers } from "./message/helpers.js";
 import { registerMessageDiscordAdminCommands } from "./message/register.discord-admin.js";
@@ -29,22 +28,11 @@ export function registerMessageCommands(program: Command, ctx: ProgramContext) {
      "after",
      () =>
        `
-${theme.heading("Examples:")}
-${formatHelpExamples([
-  ['clawdbot message send --target +15555550123 --message "Hi"', "Send a text message."],
-  [
-    'clawdbot message send --target +15555550123 --message "Hi" --media photo.jpg',
-    "Send a message with media.",
-  ],
-  [
-    'clawdbot message poll --channel discord --target channel:123 --poll-question "Snack?" --poll-option Pizza --poll-option Sushi',
-    "Create a Discord poll.",
-  ],
-  [
-    'clawdbot message react --channel discord --target 123 --message-id 456 --emoji "✅"',
-    "React to a message.",
-  ],
-])}
+Examples:
+  clawdbot message send --target +15555550123 --message "Hi"
+  clawdbot message send --target +15555550123 --message "Hi" --media photo.jpg
+  clawdbot message poll --channel discord --target channel:123 --poll-question "Snack?" --poll-option Pizza --poll-option Sushi
+  clawdbot message react --channel discord --target 123 --message-id 456 --emoji "✅"

 ${theme.muted("Docs:")} ${formatDocsLink("/cli/message", "docs.clawd.bot/cli/message")}`,
    )
@@ -7,7 +7,6 @@ import { defaultRuntime } from "../../runtime.js";
 import { formatDocsLink } from "../../terminal/links.js";
 import { theme } from "../../terminal/theme.js";
 import { runCommandWithRuntime } from "../cli-utils.js";
-import { formatHelpExamples } from "../help-format.js";
 import { parsePositiveIntOrUndefined } from "./helpers.js";

 function resolveVerbose(opts: { verbose?: boolean; debug?: boolean }): boolean {
@@ -37,18 +36,15 @@ export function registerStatusHealthSessionsCommands(program: Command) {
    .option("--debug", "Alias for --verbose", false)
    .addHelpText(
      "after",
-      () =>
-        `\n${theme.heading("Examples:")}\n${formatHelpExamples([
-          ["clawdbot status", "Show channel health + session summary."],
-          ["clawdbot status --all", "Full diagnosis (read-only)."],
-          ["clawdbot status --json", "Machine-readable output."],
-          ["clawdbot status --usage", "Show model provider usage/quota snapshots."],
-          [
-            "clawdbot status --deep",
-            "Run channel probes (WA + Telegram + Discord + Slack + Signal).",
-          ],
-          ["clawdbot status --deep --timeout 5000", "Tighten probe timeout."],
-        ])}`,
+      `
+Examples:
+  clawdbot status                   # show linked account + session store summary
+  clawdbot status --all             # full diagnosis (read-only)
+  clawdbot status --json            # machine-readable output
+  clawdbot status --usage           # show model provider usage/quota snapshots
+  clawdbot status --deep            # run channel probes (WA + Telegram + Discord + Slack + Signal)
+  clawdbot status --deep --timeout 5000 # tighten probe timeout
+  clawdbot channels status          # gateway channel runtime + probes`,
    )
    .addHelpText(
      "after",
@@ -117,15 +113,14 @@ export function registerStatusHealthSessionsCommands(program: Command) {
    .option("--active <minutes>", "Only show sessions updated within the past N minutes")
    .addHelpText(
      "after",
-      () =>
-        `\n${theme.heading("Examples:")}\n${formatHelpExamples([
-          ["clawdbot sessions", "List all sessions."],
-          ["clawdbot sessions --active 120", "Only last 2 hours."],
-          ["clawdbot sessions --json", "Machine-readable output."],
-          ["clawdbot sessions --store ./tmp/sessions.json", "Use a specific session store."],
-        ])}\n\n${theme.muted(
-          "Shows token usage per session when the agent reports it; set agents.defaults.contextTokens to see % of your model window.",
-        )}`,
+      `
+Examples:
+  clawdbot sessions                 # list all sessions
+  clawdbot sessions --active 120    # only last 2 hours
+  clawdbot sessions --json          # machine-readable output
+  clawdbot sessions --store ./tmp/sessions.json
+
+Shows token usage per session when the agent reports it; set agents.defaults.contextTokens to see % of your model window.`,
    )
    .addHelpText(
      "after",
@@ -21,7 +21,7 @@ const { nodesAction, registerNodesCli } = vi.hoisted(() => {
 vi.mock("../acp-cli.js", () => ({ registerAcpCli }));
 vi.mock("../nodes-cli.js", () => ({ registerNodesCli }));

-const { registerSubCliByName, registerSubCliCommands } = await import("./register.subclis.js");
+const { registerSubCliCommands } = await import("./register.subclis.js");

 describe("registerSubCliCommands", () => {
  const originalArgv = process.argv;
@@ -78,20 +78,4 @@ describe("registerSubCliCommands", () => {
    expect(registerNodesCli).toHaveBeenCalledTimes(1);
    expect(nodesAction).toHaveBeenCalledTimes(1);
  });
-
-  it("replaces placeholder when registering a subcommand by name", async () => {
-    process.argv = ["node", "clawdbot", "acp", "--help"];
-    const program = new Command();
-    program.name("clawdbot");
-    registerSubCliCommands(program, process.argv);
-
-    await registerSubCliByName(program, "acp");
-
-    const names = program.commands.map((cmd) => cmd.name());
-    expect(names.filter((name) => name === "acp")).toHaveLength(1);
-
-    await program.parseAsync(["node", "clawdbot", "acp"], { from: "user" });
-    expect(registerAcpCli).toHaveBeenCalledTimes(1);
-    expect(acpAction).toHaveBeenCalledTimes(1);
-  });
 });
@@ -18,8 +18,10 @@ const shouldRegisterPrimaryOnly = (argv: string[]) => {
  return true;
 };

-const shouldEagerRegisterSubcommands = (_argv: string[]) => {
-  return isTruthyEnvValue(process.env.CLAWDBOT_DISABLE_LAZY_SUBCOMMANDS);
+const shouldEagerRegisterSubcommands = (argv: string[]) => {
+  if (isTruthyEnvValue(process.env.CLAWDBOT_DISABLE_LAZY_SUBCOMMANDS)) return true;
+  if (hasHelpOrVersion(argv)) return true;
+  return false;
 };

 const loadConfig = async (): Promise<ClawdbotConfig> => {
@@ -232,15 +234,6 @@ function removeCommand(program: Command, command: Command) {
  }
 }

-export async function registerSubCliByName(program: Command, name: string): Promise<boolean> {
-  const entry = entries.find((candidate) => candidate.name === name);
-  if (!entry) return false;
-  const existing = program.commands.find((cmd) => cmd.name() === entry.name);
-  if (existing) removeCommand(program, existing);
-  await entry.register(program);
-  return true;
-}
-
 function registerLazyCommand(program: Command, entry: SubCliEntry) {
  const placeholder = program.command(entry.name).description(entry.description);
  placeholder.allowUnknownOption(true);
@@ -10,7 +10,6 @@ import { assertSupportedRuntime } from "../infra/runtime-guard.js";
 import { formatUncaughtError } from "../infra/errors.js";
 import { installUnhandledRejectionHandler } from "../infra/unhandled-rejections.js";
 import { enableConsoleCapture } from "../logging.js";
-import { getPrimaryCommand, hasHelpOrVersion } from "./argv.js";
 import { tryRouteCli } from "./route.js";

 export function rewriteUpdateFlagArgv(argv: string[]): string[] {
@@ -48,15 +47,7 @@ export async function runCli(argv: string[] = process.argv) {
    process.exit(1);
  });

-  const parseArgv = rewriteUpdateFlagArgv(normalizedArgv);
-  if (hasHelpOrVersion(parseArgv)) {
-    const primary = getPrimaryCommand(parseArgv);
-    if (primary) {
-      const { registerSubCliByName } = await import("./program/register.subclis.js");
-      await registerSubCliByName(program, primary);
-    }
-  }
-  await program.parseAsync(parseArgv);
+  await program.parseAsync(rewriteUpdateFlagArgv(normalizedArgv));
 }

 function stripWindowsNodeExec(argv: string[]): string[] {
@@ -5,7 +5,6 @@ import { sandboxExplainCommand } from "../commands/sandbox-explain.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
 import { theme } from "../terminal/theme.js";
-import { formatHelpExamples } from "./help-format.js";

 // --- Types ---

@@ -13,34 +12,58 @@ type CommandOptions = Record<string, unknown>;

 // --- Helpers ---

-const SANDBOX_EXAMPLES = {
-  main: [
-    ["clawdbot sandbox list", "List all sandbox containers."],
-    ["clawdbot sandbox list --browser", "List only browser containers."],
-    ["clawdbot sandbox recreate --all", "Recreate all containers."],
-    ["clawdbot sandbox recreate --session main", "Recreate a specific session."],
-    ["clawdbot sandbox recreate --agent mybot", "Recreate agent containers."],
-    ["clawdbot sandbox explain", "Explain effective sandbox config."],
-  ],
-  list: [
-    ["clawdbot sandbox list", "List all sandbox containers."],
-    ["clawdbot sandbox list --browser", "List only browser containers."],
-    ["clawdbot sandbox list --json", "JSON output."],
-  ],
-  recreate: [
-    ["clawdbot sandbox recreate --all", "Recreate all containers."],
-    ["clawdbot sandbox recreate --session main", "Recreate a specific session."],
-    ["clawdbot sandbox recreate --agent mybot", "Recreate a specific agent (includes sub-agents)."],
-    ["clawdbot sandbox recreate --browser --all", "Recreate only browser containers."],
-    ["clawdbot sandbox recreate --all --force", "Skip confirmation."],
-  ],
-  explain: [
-    ["clawdbot sandbox explain", "Show effective sandbox config."],
-    ["clawdbot sandbox explain --session agent:main:main", "Explain a specific session."],
-    ["clawdbot sandbox explain --agent work", "Explain an agent sandbox."],
-    ["clawdbot sandbox explain --json", "JSON output."],
-  ],
-} as const;
+const EXAMPLES = {
+  main: `
+Examples:
+  clawdbot sandbox list                     # List all sandbox containers
+  clawdbot sandbox list --browser           # List only browser containers
+  clawdbot sandbox recreate --all           # Recreate all containers
+  clawdbot sandbox recreate --session main  # Recreate specific session
+  clawdbot sandbox recreate --agent mybot   # Recreate agent containers
+  clawdbot sandbox explain                  # Explain effective sandbox config`,
+
+  list: `
+Examples:
+  clawdbot sandbox list              # List all sandbox containers
+  clawdbot sandbox list --browser    # List only browser containers
+  clawdbot sandbox list --json       # JSON output
+
+Output includes:
+  • Container name and status (running/stopped)
+  • Docker image and whether it matches current config
+  • Age (time since creation)
+  • Idle time (time since last use)
+  • Associated session/agent ID`,
+
+  recreate: `
+Examples:
+  clawdbot sandbox recreate --all              # Recreate all containers
+  clawdbot sandbox recreate --session main     # Specific session
+  clawdbot sandbox recreate --agent mybot      # Specific agent (includes sub-agents)
+  clawdbot sandbox recreate --browser --all    # All browser containers only
+  clawdbot sandbox recreate --all --force      # Skip confirmation
+
+Why use this?
+  After updating Docker images or sandbox configuration, existing containers
+  continue running with old settings. This command removes them so they'll be
+  recreated automatically with current config when next needed.
+
+Filter options:
+  --all          Remove all sandbox containers
+  --session      Remove container for specific session key
+  --agent        Remove containers for agent (includes agent:id:* variants)
+  
+Modifiers:
+  --browser      Only affect browser containers (not regular sandbox)
+  --force        Skip confirmation prompt`,
+
+  explain: `
+Examples:
+  clawdbot sandbox explain
+  clawdbot sandbox explain --session agent:main:main
+  clawdbot sandbox explain --agent work
+  clawdbot sandbox explain --json`,
+};

 function createRunner(
  commandFn: (opts: CommandOptions, runtime: typeof defaultRuntime) => Promise<void>,
@@ -61,10 +84,7 @@ export function registerSandboxCli(program: Command) {
  const sandbox = program
    .command("sandbox")
    .description("Manage sandbox containers (Docker-based agent isolation)")
-    .addHelpText(
-      "after",
-      () => `\n${theme.heading("Examples:")}\n${formatHelpExamples(SANDBOX_EXAMPLES.main)}\n`,
-    )
+    .addHelpText("after", EXAMPLES.main)
    .addHelpText(
      "after",
      () =>
@@ -81,17 +101,7 @@ export function registerSandboxCli(program: Command) {
    .description("List sandbox containers and their status")
    .option("--json", "Output result as JSON", false)
    .option("--browser", "List browser containers only", false)
-    .addHelpText(
-      "after",
-      () =>
-        `\n${theme.heading("Examples:")}\n${formatHelpExamples(SANDBOX_EXAMPLES.list)}\n\n${theme.heading(
-          "Output includes:",
-        )}\n${theme.muted("- Container name and status (running/stopped)")}\n${theme.muted(
-          "- Docker image and whether it matches current config",
-        )}\n${theme.muted("- Age (time since creation)")}\n${theme.muted(
-          "- Idle time (time since last use)",
-        )}\n${theme.muted("- Associated session/agent ID")}`,
-    )
+    .addHelpText("after", EXAMPLES.list)
    .action(
      createRunner((opts) =>
        sandboxListCommand(
@@ -114,25 +124,7 @@ export function registerSandboxCli(program: Command) {
    .option("--agent <id>", "Recreate containers for specific agent")
    .option("--browser", "Only recreate browser containers", false)
    .option("--force", "Skip confirmation prompt", false)
-    .addHelpText(
-      "after",
-      () =>
-        `\n${theme.heading("Examples:")}\n${formatHelpExamples(SANDBOX_EXAMPLES.recreate)}\n\n${theme.heading(
-          "Why use this?",
-        )}\n${theme.muted(
-          "After updating Docker images or sandbox configuration, existing containers continue running with old settings.",
-        )}\n${theme.muted(
-          "This command removes them so they'll be recreated automatically with current config when next needed.",
-        )}\n\n${theme.heading("Filter options:")}\n${theme.muted(
-          "  --all          Remove all sandbox containers",
-        )}\n${theme.muted(
-          "  --session      Remove container for specific session key",
-        )}\n${theme.muted(
-          "  --agent        Remove containers for agent (includes agent:id:* variants)",
-        )}\n\n${theme.heading("Modifiers:")}\n${theme.muted(
-          "  --browser      Only affect browser containers (not regular sandbox)",
-        )}\n${theme.muted("  --force        Skip confirmation prompt")}`,
-    )
+    .addHelpText("after", EXAMPLES.recreate)
    .action(
      createRunner((opts) =>
        sandboxRecreateCommand(
@@ -156,10 +148,7 @@ export function registerSandboxCli(program: Command) {
    .option("--session <key>", "Session key to inspect (defaults to agent main)")
    .option("--agent <id>", "Agent id to inspect (defaults to derived agent)")
    .option("--json", "Output result as JSON", false)
-    .addHelpText(
-      "after",
-      () => `\n${theme.heading("Examples:")}\n${formatHelpExamples(SANDBOX_EXAMPLES.explain)}\n`,
-    )
+    .addHelpText("after", EXAMPLES.explain)
    .action(
      createRunner((opts) =>
        sandboxExplainCommand(
@@ -1,3 +1,4 @@
+import chalk from "chalk";
 import type { Command } from "commander";

 import { loadConfig } from "../config/config.js";
@@ -120,7 +121,7 @@ export function registerSecurityCli(program: Command) {
        lines.push("");
        lines.push(heading(label));
        for (const f of list) {
-          lines.push(`${theme.muted(f.checkId)} ${f.title}`);
+          lines.push(`${chalk.gray(f.checkId)} ${f.title}`);
          lines.push(`  ${f.detail}`);
          if (f.remediation?.trim()) lines.push(`  ${muted(`Fix: ${f.remediation.trim()}`)}`);
        }
@@ -1,7 +1,6 @@
 import type { Command } from "commander";
 import { formatDocsLink } from "../terminal/links.js";
 import { theme } from "../terminal/theme.js";
-import { formatHelpExampleGroup } from "./help-format.js";
 import { createDefaultDeps } from "./deps.js";
 import {
  runDaemonInstall,
@@ -21,6 +20,12 @@ import {
 } from "./node-cli/daemon.js";

 export function registerServiceCli(program: Command) {
+  const formatExample = (cmd: string, desc: string) =>
+    `  ${theme.command(cmd)}\n    ${theme.muted(desc)}`;
+
+  const formatGroup = (label: string, examples: Array<[string, string]>) =>
+    `${theme.muted(label)}\n${examples.map(([cmd, desc]) => formatExample(cmd, desc)).join("\n")}`;
+
  const gatewayExamples: Array<[string, string]> = [
    ["clawdbot service gateway status", "Show gateway service status + probe."],
    [
@@ -45,12 +50,10 @@ export function registerServiceCli(program: Command) {
    .addHelpText(
      "after",
      () =>
-        `\n${theme.heading("Examples:")}\n${formatHelpExampleGroup(
-          "Gateway:",
-          gatewayExamples,
-        )}\n\n${formatHelpExampleGroup("Node:", nodeExamples)}\n\n${theme.muted(
-          "Docs:",
-        )} ${formatDocsLink("/cli/service", "docs.clawd.bot/cli/service")}\n`,
+        `\n${theme.heading("Examples:")}\n${formatGroup("Gateway:", gatewayExamples)}\n\n${formatGroup(
+          "Node:",
+          nodeExamples,
+        )}\n\n${theme.muted("Docs:")} ${formatDocsLink("/cli/service", "docs.clawd.bot/cli/service")}\n`,
    );

  const gateway = service.command("gateway").description("Manage the Gateway service");