fix: note stable symlinked paths (#1505 ) (thanks @odysseus0)

daemon: prefer symlinked paths over realpath for stable service configs
When installing the LaunchAgent/systemd service, the CLI was using fs.realpath() to resolve the entry.js path, which converted stable symlinked paths (e.g. node_modules/clawdbot) into version-specific paths (e.g. .pnpm/clawdbot@X.Y.Z/...). This caused the service to break after pnpm updates because the old versioned path no longer exists, even though the symlink still works. Now we prefer the original (symlinked) path when it's valid, keeping service configs stable across package version updates.
2026-01-23 11:52:10 +00:00 · 2026-01-23 11:48:22 +00:00 · 2026-01-23 11:36:32 +00:00 · 2026-01-23 09:52:22 +00:00 · 2026-01-23 09:18:15 +00:00 · 2026-01-23 09:15:54 +00:00
43 changed files with 1392 additions and 337 deletions
@@ -29,5 +29,6 @@ jobs:
          CLAWDBOT_INSTALL_CLI_URL: https://clawd.bot/install-cli.sh
          CLAWDBOT_NO_ONBOARD: "1"
          CLAWDBOT_INSTALL_SMOKE_SKIP_CLI: "1"
+          CLAWDBOT_INSTALL_SMOKE_SKIP_NONROOT: ${{ github.event_name == 'pull_request' && '1' || '0' }}
          CLAWDBOT_INSTALL_SMOKE_PREVIOUS: "2026.1.11-4"
        run: pnpm test:install:smoke
@@ -22,6 +22,15 @@
 - README (GitHub): keep absolute docs URLs (`https://docs.clawd.bot/...`) so links work on GitHub.
 - Docs content must be generic: no personal device names/hostnames/paths; use placeholders like `user@gateway-host` and “gateway host”.

+## exe.dev VM ops (general)
+- Access: SSH to the VM directly: `ssh vm-name.exe.xyz` (or use exe.dev web terminal).
+- Updates: `sudo npm i -g clawdbot@latest` (global install needs root on `/usr/lib/node_modules`).
+- Config: use `clawdbot config set ...`; set `gateway.mode=local` if unset.
+- Restart: exe.dev often lacks systemd user bus; stop old gateway and run:
+  `pkill -9 -f clawdbot-gateway || true; nohup clawdbot gateway run --bind loopback --port 18789 --force > /tmp/clawdbot-gateway.log 2>&1 &`
+- Verify: `clawdbot --version`, `clawdbot health`, `ss -ltnp | rg 18789`.
+- SSH flaky: use exe.dev web terminal or Shelley (web agent) instead of CLI SSH.
+
 ## Build, Test, and Development Commands
 - Runtime baseline: Node **22+** (keep Node + Bun paths working).
 - Install deps: `pnpm install`
@@ -2,6 +2,13 @@

 Docs: https://docs.clawd.bot

+## 2026.1.23
+
+### Fixes
+- Media: preserve PNG alpha when possible; fall back to JPEG when still over size cap. (#1491) Thanks @robbyczgw-cla.
+- Agents: treat plugin-only tool allowlists as opt-ins; keep core tools enabled. (#1467)
+- Daemon: prefer symlinked CLI paths to keep service configs stable. (#1505) Thanks @odysseus0.
+
 ## 2026.1.22

 ### Changes
@@ -35,6 +42,7 @@ Docs: https://docs.clawd.bot
 - Docs: fix gog auth services example to include docs scope. (#1454) Thanks @zerone0x.
 - Slack: reduce WebClient retries to avoid duplicate sends. (#1481)
 - Slack: read thread replies for message reads when threadId is provided (replies-only). (#1450) Thanks @rodrigouroz.
+- Discord: honor accountId across message actions and cron deliveries. (#1492) Thanks @svkozak.
 - macOS: prefer linked channels in gateway summary to avoid false “not linked” status.
 - macOS/tests: fix gateway summary lookup after guard unwrap; prevent browser opens during tests. (ECID-1483)

@@ -2,6 +2,54 @@
 <rss xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" version="2.0">
    <channel>
        <title>Clawdbot</title>
+        <item>
+            <title>2026.1.22</title>
+            <pubDate>Fri, 23 Jan 2026 08:58:14 +0000</pubDate>
+            <link>https://raw.githubusercontent.com/clawdbot/clawdbot/main/appcast.xml</link>
+            <sparkle:version>7530</sparkle:version>
+            <sparkle:shortVersionString>2026.1.22</sparkle:shortVersionString>
+            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
+            <description><![CDATA[<h2>Clawdbot 2026.1.22</h2>
+<h3>Changes</h3>
+<ul>
+<li>Highlight: Compaction safeguard now uses adaptive chunking, progressive fallback, and UI status + retries. (#1466) Thanks @dlauer.</li>
+<li>Providers: add Antigravity usage tracking to status output. (#1490) Thanks @patelhiren.</li>
+<li>Slack: add chat-type reply threading overrides via <code>replyToModeByChatType</code>. (#1442) Thanks @stefangalescu.</li>
+<li>BlueBubbles: add <code>asVoice</code> support for MP3/CAF voice memos in sendAttachment. (#1477, #1482) Thanks @Nicell.</li>
+<li>Onboarding: add hatch choice (TUI/Web/Later), token explainer, background dashboard seed on macOS, and showcase link.</li>
+</ul>
+<h3>Fixes</h3>
+<ul>
+<li>BlueBubbles: stop typing indicator on idle/no-reply. (#1439) Thanks @Nicell.</li>
+<li>Message tool: keep path/filePath as-is for send; hydrate buffers only for sendAttachment. (#1444) Thanks @hopyky.</li>
+<li>Auto-reply: only report a model switch when session state is available. (#1465) Thanks @robbyczgw-cla.</li>
+<li>Control UI: resolve local avatar URLs with basePath across injection + identity RPC. (#1457) Thanks @dlauer.</li>
+<li>Agents: sanitize assistant history text to strip tool-call markers. (#1456) Thanks @zerone0x.</li>
+<li>Discord: clarify Message Content Intent onboarding hint. (#1487) Thanks @kyleok.</li>
+<li>Gateway: stop the service before uninstalling and fail if it remains loaded.</li>
+<li>Agents: surface concrete API error details instead of generic AI service errors.</li>
+<li>Exec: fall back to non-PTY when PTY spawn fails (EBADF). (#1484)</li>
+<li>Exec approvals: allow per-segment allowlists for chained shell commands on gateway + node hosts. (#1458) Thanks @czekaj.</li>
+<li>Agents: make OpenAI sessions image-sanitize-only; gate tool-id/repair sanitization by provider.</li>
+<li>Doctor: honor CLAWDBOT_GATEWAY_TOKEN for auth checks and security audit token reuse. (#1448) Thanks @azade-c.</li>
+<li>Agents: make tool summaries more readable and only show optional params when set.</li>
+<li>Agents: honor SOUL.md guidance even when the file is nested or path-qualified. (#1434) Thanks @neooriginal.</li>
+<li>Matrix (plugin): persist m.direct for resolved DMs and harden room fallback. (#1436, #1486) Thanks @sibbl.</li>
+<li>CLI: prefer <code>~</code> for home paths in output.</li>
+<li>Mattermost (plugin): enforce pairing/allowlist gating, keep @username targets, and clarify plugin-only docs. (#1428) Thanks @damoahdominic.</li>
+<li>Agents: centralize transcript sanitization in the runner; keep <final> tags and error turns intact.</li>
+<li>Auth: skip auth profiles in cooldown during initial selection and rotation. (#1316) Thanks @odrobnik.</li>
+<li>Agents/TUI: honor user-pinned auth profiles during cooldown and preserve search picker ranking. (#1432) Thanks @tobiasbischoff.</li>
+<li>Docs: fix gog auth services example to include docs scope. (#1454) Thanks @zerone0x.</li>
+<li>Slack: reduce WebClient retries to avoid duplicate sends. (#1481)</li>
+<li>Slack: read thread replies for message reads when threadId is provided (replies-only). (#1450) Thanks @rodrigouroz.</li>
+<li>macOS: prefer linked channels in gateway summary to avoid false “not linked” status.</li>
+<li>macOS/tests: fix gateway summary lookup after guard unwrap; prevent browser opens during tests. (ECID-1483)</li>
+</ul>
+<p><a href="https://github.com/clawdbot/clawdbot/blob/main/CHANGELOG.md">View full changelog</a></p>
+]]></description>
+            <enclosure url="https://github.com/clawdbot/clawdbot/releases/download/v2026.1.22/Clawdbot-2026.1.22.zip" length="22302446" type="application/octet-stream" sparkle:edSignature="w/EzfwGBCRRuCg5vz8enIfYujxOZJWRw9PaunQ7gIafKwnBJSTtxcnkvMVwQsnBwB6VN5Tu2MPij7PjDFFX+CA=="/>
+        </item>
        <item>
            <title>2026.1.21</title>
            <pubDate>Thu, 22 Jan 2026 12:22:35 +0000</pubDate>
@@ -266,21 +314,5 @@ Thanks @AlexMikhalev, @CoreyH, @John-Rood, @KrauseFx, @MaudeBot, @Nachx639, @Nic
 ]]></description>
            <enclosure url="https://github.com/clawdbot/clawdbot/releases/download/v2026.1.21/Clawdbot-2026.1.21.zip" length="12208102" type="application/octet-stream" sparkle:edSignature="hU495Eii8O3qmmUnxYFhXyEGv+qan6KL+GpeuBhPIXf+7B5F/gBh5Oz9cHaqaAPoZ4/3Bo6xgvic0HTkbz6gDw=="/>
        </item>
-        <item>
-            <title>2026.1.16-2</title>
-            <pubDate>Sat, 17 Jan 2026 12:46:22 +0000</pubDate>
-            <link>https://raw.githubusercontent.com/clawdbot/clawdbot/main/appcast.xml</link>
-            <sparkle:version>6273</sparkle:version>
-            <sparkle:shortVersionString>2026.1.16-2</sparkle:shortVersionString>
-            <sparkle:minimumSystemVersion>15.0</sparkle:minimumSystemVersion>
-            <description><![CDATA[<h2>Clawdbot 2026.1.16-2</h2>
-<h3>Changes</h3>
-<ul>
-<li>CLI: stamp build commit into dist metadata so banners show the commit in npm installs.</li>
-</ul>
-<p><a href="https://github.com/clawdbot/clawdbot/blob/main/CHANGELOG.md">View full changelog</a></p>
-]]></description>
-            <enclosure url="https://github.com/clawdbot/clawdbot/releases/download/v2026.1.16-2/Clawdbot-2026.1.16-2.zip" length="21399591" type="application/octet-stream" sparkle:edSignature="zelT+KzN32cXsihbFniPF5Heq0hkwFfL3Agrh/AaoKUkr7kJAFarkGSOZRTWZ9y+DvOluzn2wHHjVigRjMzrBA=="/>
-        </item>
    </channel>
 </rss>
@@ -11,7 +11,7 @@ This app now ships Sparkle auto-updates. Release builds must be Developer ID–s

 ## Prereqs
 - Developer ID Application cert installed (example: `Developer ID Application: <Developer Name> (<TEAMID>)`).
- Sparkle private key path set in the environment as `SPARKLE_PRIVATE_KEY_FILE` (path to your Sparkle ed25519 private key; public key baked into Info.plist).
+- Sparkle private key path set in the environment as `SPARKLE_PRIVATE_KEY_FILE` (path to your Sparkle ed25519 private key; public key baked into Info.plist). If it is missing, check `~/.profile`.
 - Notary credentials (keychain profile or API key) for `xcrun notarytool` if you want Gatekeeper-safe DMG/zip distribution.
  - We use a Keychain profile named `clawdbot-notary`, created from App Store Connect API key env vars in your shell profile:
    - `APP_STORE_CONNECT_API_KEY_P8`, `APP_STORE_CONNECT_KEY_ID`, `APP_STORE_CONNECT_ISSUER_ID`
@@ -82,6 +82,8 @@ Enable optional tools in `agents.list[].tools.allow` (or global `tools.allow`):
 ```

 Other config knobs that affect tool availability:
+- Allowlists that only name plugin tools are treated as plugin opt-ins; core tools remain
+  enabled unless you also include core tools or groups in the allowlist.
 - `tools.profile` / `agents.list[].tools.profile` (base allowlist)
 - `tools.byProvider` / `agents.list[].tools.byProvider` (provider‑specific allow/deny)
 - `tools.sandbox.tools.*` (sandbox tool policy when sandboxed)
@@ -13,7 +13,7 @@ Use `pnpm` (Node 22+) from the repo root. Keep the working tree clean before tag
 ## Operator trigger
 When the operator says “release”, immediately do this preflight (no extra questions unless blocked):
 - Read this doc and `docs/platforms/mac/release.md`.
- Load env from `~/.profile` and confirm `SPARKLE_PRIVATE_KEY_FILE` + App Store Connect vars are set.
+- Load env from `~/.profile` and confirm `SPARKLE_PRIVATE_KEY_FILE` + App Store Connect vars are set (SPARKLE_PRIVATE_KEY_FILE should live in `~/.profile`).
 - Use Sparkle keys from `~/Library/CloudStorage/Dropbox/Backup/Sparkle` if needed.

 1) **Version & metadata**
@@ -39,8 +39,9 @@ When the operator says “release”, immediately do this preflight (no extra qu
 - [ ] `pnpm test` (or `pnpm test:coverage` if you need coverage output)
 - [ ] `pnpm run build` (last sanity check after tests)
 - [ ] `pnpm release:check` (verifies npm pack contents)
- [ ] `pnpm test:install:smoke` (Docker install smoke test; required before release)
+- [ ] `CLAWDBOT_INSTALL_SMOKE_SKIP_NONROOT=1 pnpm test:install:smoke` (Docker install smoke test, fast path; required before release)
  - If the immediate previous npm release is known broken, set `CLAWDBOT_INSTALL_SMOKE_PREVIOUS=<last-good-version>` or `CLAWDBOT_INSTALL_SMOKE_SKIP_PREVIOUS=1` for the preinstall step.
+- [ ] (Optional) Full installer smoke (adds non-root + CLI coverage): `pnpm test:install:smoke`
 - [ ] (Optional) Installer E2E (Docker, runs `curl -fsSL https://clawd.bot/install.sh | bash`, onboards, then runs real tool calls):
  - `pnpm test:install:e2e:openai` (requires `OPENAI_API_KEY`)
  - `pnpm test:install:e2e:anthropic` (requires `ANTHROPIC_API_KEY`)
@@ -121,6 +121,10 @@ Lobster is an **optional** plugin tool (not enabled by default). Allow it per ag

 You can also allow it globally with `tools.allow` if every agent should see it.

+Note: allowlists are opt-in for optional plugins. If your allowlist only names
+plugin tools (like `lobster`), Clawdbot keeps core tools enabled. To restrict core
+tools, include the core tools or groups you want in the allowlist too.
+
 ## Example: Email triage

 Without Lobster:
@@ -19,7 +19,12 @@ echo "==> Verify git installed"
 command -v git >/dev/null

 echo "==> Verify clawdbot installed"
-LATEST_VERSION="$(npm view clawdbot version)"
+EXPECTED_VERSION="${CLAWDBOT_INSTALL_EXPECT_VERSION:-}"
+if [[ -n "$EXPECTED_VERSION" ]]; then
+  LATEST_VERSION="$EXPECTED_VERSION"
+else
+  LATEST_VERSION="$(npm view clawdbot version)"
+fi
 CMD_PATH="$(command -v clawdbot || true)"
 if [[ -z "$CMD_PATH" && -x "$HOME/.npm-global/bin/clawdbot" ]]; then
  CMD_PATH="$HOME/.npm-global/bin/clawdbot"
@@ -6,21 +6,36 @@ SMOKE_PREVIOUS_VERSION="${CLAWDBOT_INSTALL_SMOKE_PREVIOUS:-}"
 SKIP_PREVIOUS="${CLAWDBOT_INSTALL_SMOKE_SKIP_PREVIOUS:-0}"

 echo "==> Resolve npm versions"
-LATEST_VERSION="$(npm view clawdbot version)"
 if [[ -n "$SMOKE_PREVIOUS_VERSION" ]]; then
+  LATEST_VERSION="$(npm view clawdbot version)"
  PREVIOUS_VERSION="$SMOKE_PREVIOUS_VERSION"
 else
-  PREVIOUS_VERSION="$(node - <<'NODE'
-const { execSync } = require("node:child_process");
-
-const versions = JSON.parse(execSync("npm view clawdbot versions --json", { encoding: "utf8" }));
-if (!Array.isArray(versions) || versions.length === 0) {
+  VERSIONS_JSON="$(npm view clawdbot versions --json)"
+  versions_line="$(node - <<'NODE'
+const raw = process.env.VERSIONS_JSON || "[]";
+let versions;
+try {
+  versions = JSON.parse(raw);
+} catch {
+  versions = raw ? [raw] : [];
+}
+if (!Array.isArray(versions)) {
+  versions = [versions];
+}
+if (versions.length === 0) {
  process.exit(1);
 }
-const previous = versions.length >= 2 ? versions[versions.length - 2] : versions[0];
-process.stdout.write(previous);
+const latest = versions[versions.length - 1];
+const previous = versions.length >= 2 ? versions[versions.length - 2] : latest;
+process.stdout.write(`${latest} ${previous}`);
 NODE
 )"
+  LATEST_VERSION="${versions_line%% *}"
+  PREVIOUS_VERSION="${versions_line#* }"
+fi
+
+if [[ -n "${CLAWDBOT_INSTALL_LATEST_OUT:-}" ]]; then
+  printf "%s" "$LATEST_VERSION" > "$CLAWDBOT_INSTALL_LATEST_OUT"
 fi

 echo "latest=$LATEST_VERSION previous=$PREVIOUS_VERSION"
@@ -6,6 +6,9 @@ SMOKE_IMAGE="${CLAWDBOT_INSTALL_SMOKE_IMAGE:-clawdbot-install-smoke:local}"
 NONROOT_IMAGE="${CLAWDBOT_INSTALL_NONROOT_IMAGE:-clawdbot-install-nonroot:local}"
 INSTALL_URL="${CLAWDBOT_INSTALL_URL:-https://clawd.bot/install.sh}"
 CLI_INSTALL_URL="${CLAWDBOT_INSTALL_CLI_URL:-https://clawd.bot/install-cli.sh}"
+SKIP_NONROOT="${CLAWDBOT_INSTALL_SMOKE_SKIP_NONROOT:-0}"
+LATEST_DIR="$(mktemp -d)"
+LATEST_FILE="${LATEST_DIR}/latest"

 echo "==> Build smoke image (upgrade, root): $SMOKE_IMAGE"
 docker build \
@@ -15,31 +18,48 @@ docker build \

 echo "==> Run installer smoke test (root): $INSTALL_URL"
 docker run --rm -t \
+  -v "${LATEST_DIR}:/out" \
  -e CLAWDBOT_INSTALL_URL="$INSTALL_URL" \
+  -e CLAWDBOT_INSTALL_LATEST_OUT="/out/latest" \
  -e CLAWDBOT_INSTALL_SMOKE_PREVIOUS="${CLAWDBOT_INSTALL_SMOKE_PREVIOUS:-}" \
  -e CLAWDBOT_INSTALL_SMOKE_SKIP_PREVIOUS="${CLAWDBOT_INSTALL_SMOKE_SKIP_PREVIOUS:-0}" \
  -e CLAWDBOT_NO_ONBOARD=1 \
  -e DEBIAN_FRONTEND=noninteractive \
  "$SMOKE_IMAGE"

-echo "==> Build non-root image: $NONROOT_IMAGE"
-docker build \
-  -t "$NONROOT_IMAGE" \
-  -f "$ROOT_DIR/scripts/docker/install-sh-nonroot/Dockerfile" \
-  "$ROOT_DIR/scripts/docker/install-sh-nonroot"
+LATEST_VERSION=""
+if [[ -f "$LATEST_FILE" ]]; then
+  LATEST_VERSION="$(cat "$LATEST_FILE")"
+fi

-echo "==> Run installer non-root test: $INSTALL_URL"
-docker run --rm -t \
-  -e CLAWDBOT_INSTALL_URL="$INSTALL_URL" \
-  -e CLAWDBOT_NO_ONBOARD=1 \
-  -e DEBIAN_FRONTEND=noninteractive \
-  "$NONROOT_IMAGE"
+if [[ "$SKIP_NONROOT" == "1" ]]; then
+  echo "==> Skip non-root installer smoke (CLAWDBOT_INSTALL_SMOKE_SKIP_NONROOT=1)"
+else
+  echo "==> Build non-root image: $NONROOT_IMAGE"
+  docker build \
+    -t "$NONROOT_IMAGE" \
+    -f "$ROOT_DIR/scripts/docker/install-sh-nonroot/Dockerfile" \
+    "$ROOT_DIR/scripts/docker/install-sh-nonroot"
+
+  echo "==> Run installer non-root test: $INSTALL_URL"
+  docker run --rm -t \
+    -e CLAWDBOT_INSTALL_URL="$INSTALL_URL" \
+    -e CLAWDBOT_INSTALL_EXPECT_VERSION="$LATEST_VERSION" \
+    -e CLAWDBOT_NO_ONBOARD=1 \
+    -e DEBIAN_FRONTEND=noninteractive \
+    "$NONROOT_IMAGE"
+fi

 if [[ "${CLAWDBOT_INSTALL_SMOKE_SKIP_CLI:-0}" == "1" ]]; then
  echo "==> Skip CLI installer smoke (CLAWDBOT_INSTALL_SMOKE_SKIP_CLI=1)"
  exit 0
 fi

+if [[ "$SKIP_NONROOT" == "1" ]]; then
+  echo "==> Skip CLI installer smoke (non-root image skipped)"
+  exit 0
+fi
+
 echo "==> Run CLI installer non-root test (same image)"
 docker run --rm -t \
  --entrypoint /bin/bash \
@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import os from "node:os";

 const pnpm = process.platform === "win32" ? "pnpm.cmd" : "pnpm";

@@ -7,17 +8,31 @@ const runs = [
    name: "unit",
    args: ["vitest", "run", "--config", "vitest.unit.config.ts"],
  },
+  {
+    name: "extensions",
+    args: ["vitest", "run", "--config", "vitest.extensions.config.ts"],
+  },
  {
    name: "gateway",
    args: ["vitest", "run", "--config", "vitest.gateway.config.ts"],
  },
 ];

+const parallelRuns = runs.filter((entry) => entry.name !== "gateway");
+const serialRuns = runs.filter((entry) => entry.name === "gateway");
+
 const children = new Set();
+const isCI = process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true";
+const overrideWorkers = Number.parseInt(process.env.CLAWDBOT_TEST_WORKERS ?? "", 10);
+const resolvedOverride = Number.isFinite(overrideWorkers) && overrideWorkers > 0 ? overrideWorkers : null;
+const localWorkers = Math.max(4, Math.min(16, os.cpus().length));
+const perRunWorkers = Math.max(1, Math.floor(localWorkers / parallelRuns.length));
+const maxWorkers = isCI ? null : resolvedOverride ?? perRunWorkers;

 const run = (entry) =>
  new Promise((resolve) => {
-    const child = spawn(pnpm, entry.args, {
+    const args = maxWorkers ? [...entry.args, "--maxWorkers", String(maxWorkers)] : entry.args;
+    const child = spawn(pnpm, args, {
      stdio: "inherit",
      env: { ...process.env, VITEST_GROUP: entry.name },
      shell: process.platform === "win32",
@@ -38,6 +53,18 @@ const shutdown = (signal) => {
 process.on("SIGINT", () => shutdown("SIGINT"));
 process.on("SIGTERM", () => shutdown("SIGTERM"));

-const codes = await Promise.all(runs.map(run));
-const failed = codes.find((code) => code !== 0);
-process.exit(failed ?? 0);
+const parallelCodes = await Promise.all(parallelRuns.map(run));
+const failedParallel = parallelCodes.find((code) => code !== 0);
+if (failedParallel !== undefined) {
+  process.exit(failedParallel);
+}
+
+for (const entry of serialRuns) {
+  // eslint-disable-next-line no-await-in-loop
+  const code = await run(entry);
+  if (code !== 0) {
+    process.exit(code);
+  }
+}
+
+process.exit(0);
@@ -66,6 +66,10 @@ export function isModernModelRef(ref: ModelRef): boolean {
    return matchesPrefix(id, XAI_PREFIXES);
  }

+  if (provider === "opencode" && id.endsWith("-free")) {
+    return false;
+  }
+
  if (provider === "openrouter" || provider === "opencode") {
    return matchesAny(id, [
      ...ANTHROPIC_PREFIXES,
@@ -41,12 +41,11 @@ describe("resolveOpencodeZenAlias", () => {
 describe("resolveOpencodeZenModelApi", () => {
  it("maps APIs by model family", () => {
    expect(resolveOpencodeZenModelApi("claude-opus-4-5")).toBe("anthropic-messages");
-    expect(resolveOpencodeZenModelApi("minimax-m2.1-free")).toBe("anthropic-messages");
    expect(resolveOpencodeZenModelApi("gemini-3-pro")).toBe("google-generative-ai");
    expect(resolveOpencodeZenModelApi("gpt-5.2")).toBe("openai-responses");
    expect(resolveOpencodeZenModelApi("alpha-gd4")).toBe("openai-completions");
    expect(resolveOpencodeZenModelApi("big-pickle")).toBe("openai-completions");
-    expect(resolveOpencodeZenModelApi("glm-4.7-free")).toBe("openai-completions");
+    expect(resolveOpencodeZenModelApi("glm-4.7")).toBe("openai-completions");
    expect(resolveOpencodeZenModelApi("some-unknown-model")).toBe("openai-completions");
  });
 });
@@ -55,10 +54,10 @@ describe("getOpencodeZenStaticFallbackModels", () => {
  it("returns an array of models", () => {
    const models = getOpencodeZenStaticFallbackModels();
    expect(Array.isArray(models)).toBe(true);
-    expect(models.length).toBe(11);
+    expect(models.length).toBe(10);
  });

-  it("includes Claude, GPT, Gemini, GLM, and MiniMax models", () => {
+  it("includes Claude, GPT, Gemini, and GLM models", () => {
    const models = getOpencodeZenStaticFallbackModels();
    const ids = models.map((m) => m.id);

@@ -66,8 +65,7 @@ describe("getOpencodeZenStaticFallbackModels", () => {
    expect(ids).toContain("gpt-5.2");
    expect(ids).toContain("gpt-5.1-codex");
    expect(ids).toContain("gemini-3-pro");
-    expect(ids).toContain("glm-4.7-free");
-    expect(ids).toContain("minimax-m2.1-free");
+    expect(ids).toContain("glm-4.7");
  });

  it("returns valid ModelDefinitionConfig objects", () => {
@@ -90,8 +88,7 @@ describe("OPENCODE_ZEN_MODEL_ALIASES", () => {
    expect(OPENCODE_ZEN_MODEL_ALIASES.codex).toBe("gpt-5.1-codex");
    expect(OPENCODE_ZEN_MODEL_ALIASES.gpt5).toBe("gpt-5.2");
    expect(OPENCODE_ZEN_MODEL_ALIASES.gemini).toBe("gemini-3-pro");
-    expect(OPENCODE_ZEN_MODEL_ALIASES.glm).toBe("glm-4.7-free");
-    expect(OPENCODE_ZEN_MODEL_ALIASES.minimax).toBe("minimax-m2.1-free");
+    expect(OPENCODE_ZEN_MODEL_ALIASES.glm).toBe("glm-4.7");

    // Legacy aliases (kept for backward compatibility).
    expect(OPENCODE_ZEN_MODEL_ALIASES.sonnet).toBe("claude-opus-4-5");
@@ -68,13 +68,9 @@ export const OPENCODE_ZEN_MODEL_ALIASES: Record<string, string> = {
  "gemini-2.5-flash": "gemini-3-flash",

  // GLM (free + alpha)
-  glm: "glm-4.7-free",
-  "glm-free": "glm-4.7-free",
+  glm: "glm-4.7",
+  "glm-free": "glm-4.7",
  "alpha-glm": "alpha-glm-4.7",
-
-  // MiniMax
-  minimax: "minimax-m2.1-free",
-  "minimax-free": "minimax-m2.1-free",
 };

 /**
@@ -134,7 +130,7 @@ const MODEL_COSTS: Record<
    cacheWrite: 0,
  },
  "gpt-5.1": { input: 1.07, output: 8.5, cacheRead: 0.107, cacheWrite: 0 },
-  "glm-4.7-free": { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+  "glm-4.7": { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
  "gemini-3-flash": { input: 0.5, output: 3, cacheRead: 0.05, cacheWrite: 0 },
  "gpt-5.1-codex-max": {
    input: 1.25,
@@ -142,7 +138,6 @@ const MODEL_COSTS: Record<
    cacheRead: 0.125,
    cacheWrite: 0,
  },
-  "minimax-m2.1-free": { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
  "gpt-5.2": { input: 1.75, output: 14, cacheRead: 0.175, cacheWrite: 0 },
 };

@@ -155,10 +150,9 @@ const MODEL_CONTEXT_WINDOWS: Record<string, number> = {
  "alpha-glm-4.7": 204800,
  "gpt-5.1-codex-mini": 400000,
  "gpt-5.1": 400000,
-  "glm-4.7-free": 204800,
+  "glm-4.7": 204800,
  "gemini-3-flash": 1048576,
  "gpt-5.1-codex-max": 400000,
-  "minimax-m2.1-free": 204800,
  "gpt-5.2": 400000,
 };

@@ -173,10 +167,9 @@ const MODEL_MAX_TOKENS: Record<string, number> = {
  "alpha-glm-4.7": 131072,
  "gpt-5.1-codex-mini": 128000,
  "gpt-5.1": 128000,
-  "glm-4.7-free": 131072,
+  "glm-4.7": 131072,
  "gemini-3-flash": 65536,
  "gpt-5.1-codex-max": 128000,
-  "minimax-m2.1-free": 131072,
  "gpt-5.2": 128000,
 };

@@ -211,10 +204,9 @@ const MODEL_NAMES: Record<string, string> = {
  "alpha-glm-4.7": "Alpha GLM-4.7",
  "gpt-5.1-codex-mini": "GPT-5.1 Codex Mini",
  "gpt-5.1": "GPT-5.1",
-  "glm-4.7-free": "GLM-4.7",
+  "glm-4.7": "GLM-4.7",
  "gemini-3-flash": "Gemini 3 Flash",
  "gpt-5.1-codex-max": "GPT-5.1 Codex Max",
-  "minimax-m2.1-free": "MiniMax M2.1",
  "gpt-5.2": "GPT-5.2",
 };

@@ -240,10 +232,9 @@ export function getOpencodeZenStaticFallbackModels(): ModelDefinitionConfig[] {
    "alpha-glm-4.7",
    "gpt-5.1-codex-mini",
    "gpt-5.1",
-    "glm-4.7-free",
+    "glm-4.7",
    "gemini-3-flash",
    "gpt-5.1-codex-max",
-    "minimax-m2.1-free",
    "gpt-5.2",
  ];

@@ -44,6 +44,7 @@ import {
  collectExplicitAllowlist,
  expandPolicyWithPluginGroups,
  resolveToolProfilePolicy,
+  stripPluginOnlyAllowlist,
 } from "./tool-policy.js";
 import { getPluginToolMeta } from "../plugins/tools.js";

@@ -298,12 +299,30 @@ export function createClawdbotCodingTools(options?: {
    tools,
    toolMeta: (tool) => getPluginToolMeta(tool as AnyAgentTool),
  });
-  const profilePolicyExpanded = expandPolicyWithPluginGroups(profilePolicy, pluginGroups);
-  const providerProfileExpanded = expandPolicyWithPluginGroups(providerProfilePolicy, pluginGroups);
-  const globalPolicyExpanded = expandPolicyWithPluginGroups(globalPolicy, pluginGroups);
-  const globalProviderExpanded = expandPolicyWithPluginGroups(globalProviderPolicy, pluginGroups);
-  const agentPolicyExpanded = expandPolicyWithPluginGroups(agentPolicy, pluginGroups);
-  const agentProviderExpanded = expandPolicyWithPluginGroups(agentProviderPolicy, pluginGroups);
+  const profilePolicyExpanded = expandPolicyWithPluginGroups(
+    stripPluginOnlyAllowlist(profilePolicy, pluginGroups),
+    pluginGroups,
+  );
+  const providerProfileExpanded = expandPolicyWithPluginGroups(
+    stripPluginOnlyAllowlist(providerProfilePolicy, pluginGroups),
+    pluginGroups,
+  );
+  const globalPolicyExpanded = expandPolicyWithPluginGroups(
+    stripPluginOnlyAllowlist(globalPolicy, pluginGroups),
+    pluginGroups,
+  );
+  const globalProviderExpanded = expandPolicyWithPluginGroups(
+    stripPluginOnlyAllowlist(globalProviderPolicy, pluginGroups),
+    pluginGroups,
+  );
+  const agentPolicyExpanded = expandPolicyWithPluginGroups(
+    stripPluginOnlyAllowlist(agentPolicy, pluginGroups),
+    pluginGroups,
+  );
+  const agentProviderExpanded = expandPolicyWithPluginGroups(
+    stripPluginOnlyAllowlist(agentProviderPolicy, pluginGroups),
+    pluginGroups,
+  );
  const sandboxPolicyExpanded = expandPolicyWithPluginGroups(sandbox?.tools, pluginGroups);
  const subagentPolicyExpanded = expandPolicyWithPluginGroups(subagentPolicy, pluginGroups);

@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+
+import { stripPluginOnlyAllowlist, type PluginToolGroups } from "./tool-policy.js";
+
+const pluginGroups: PluginToolGroups = {
+  all: ["lobster", "workflow_tool"],
+  byPlugin: new Map([["lobster", ["lobster", "workflow_tool"]]]),
+};
+
+describe("stripPluginOnlyAllowlist", () => {
+  it("strips allowlist when it only targets plugin tools", () => {
+    const policy = stripPluginOnlyAllowlist({ allow: ["lobster"] }, pluginGroups);
+    expect(policy?.allow).toBeUndefined();
+  });
+
+  it("strips allowlist when it only targets plugin groups", () => {
+    const policy = stripPluginOnlyAllowlist({ allow: ["group:plugins"] }, pluginGroups);
+    expect(policy?.allow).toBeUndefined();
+  });
+
+  it("keeps allowlist when it mixes plugin and core entries", () => {
+    const policy = stripPluginOnlyAllowlist({ allow: ["lobster", "read"] }, pluginGroups);
+    expect(policy?.allow).toEqual(["lobster", "read"]);
+  });
+});
@@ -178,6 +178,22 @@ export function expandPolicyWithPluginGroups(
  };
 }

+export function stripPluginOnlyAllowlist(
+  policy: ToolPolicyLike | undefined,
+  groups: PluginToolGroups,
+): ToolPolicyLike | undefined {
+  if (!policy?.allow || policy.allow.length === 0) return policy;
+  const normalized = normalizeToolList(policy.allow);
+  if (normalized.length === 0) return policy;
+  const pluginIds = new Set(groups.byPlugin.keys());
+  const pluginTools = new Set(groups.all);
+  const isPluginEntry = (entry: string) =>
+    entry === "group:plugins" || pluginIds.has(entry) || pluginTools.has(entry);
+  const isPluginOnly = normalized.every((entry) => isPluginEntry(entry));
+  if (!isPluginOnly) return policy;
+  return { ...policy, allow: undefined };
+}
+
 export function resolveToolProfilePolicy(profile?: string): ToolProfilePolicy | undefined {
  if (!profile) return undefined;
  const resolved = TOOL_PROFILES[profile as ToolProfileId];
@@ -5,6 +5,10 @@ vi.mock("../../gateway/call.js", () => ({
  callGateway: (opts: unknown) => callGatewayMock(opts),
 }));

+vi.mock("../agent-scope.js", () => ({
+  resolveSessionAgentId: () => "agent-123",
+}));
+
 import { createCronTool } from "./cron-tool.js";

 describe("cron tool", () => {
@@ -85,6 +89,23 @@ describe("cron tool", () => {
    });
  });

+  it("does not default agentId when job.agentId is null", async () => {
+    const tool = createCronTool({ agentSessionKey: "main" });
+    await tool.execute("call-null", {
+      action: "add",
+      job: {
+        name: "wake-up",
+        schedule: { atMs: 123 },
+        agentId: null,
+      },
+    });
+
+    const call = callGatewayMock.mock.calls[0]?.[0] as {
+      params?: { agentId?: unknown };
+    };
+    expect(call?.params?.agentId).toBeNull();
+  });
+
  it("adds recent context for systemEvent reminders when contextMessages > 0", async () => {
    callGatewayMock
      .mockResolvedValueOnce({
@@ -188,4 +209,26 @@ describe("cron tool", () => {
    const text = cronCall.params?.payload?.text ?? "";
    expect(text).not.toContain("Recent context:");
  });
+
+  it("preserves explicit agentId null on add", async () => {
+    callGatewayMock.mockResolvedValueOnce({ ok: true });
+
+    const tool = createCronTool({ agentSessionKey: "main" });
+    await tool.execute("call6", {
+      action: "add",
+      job: {
+        name: "reminder",
+        schedule: { atMs: 123 },
+        agentId: null,
+        payload: { kind: "systemEvent", text: "Reminder: the thing." },
+      },
+    });
+
+    const call = callGatewayMock.mock.calls[0]?.[0] as {
+      method?: string;
+      params?: { agentId?: string | null };
+    };
+    expect(call.method).toBe("cron.add");
+    expect(call.params?.agentId).toBeNull();
+  });
 });
@@ -3,6 +3,7 @@ import { normalizeCronJobCreate, normalizeCronJobPatch } from "../../cron/normal
 import { loadConfig } from "../../config/config.js";
 import { truncateUtf16Safe } from "../../utils.js";
 import { optionalStringEnum, stringEnum } from "../schema/typebox.js";
+import { resolveSessionAgentId } from "../agent-scope.js";
 import { type AnyAgentTool, jsonResult, readStringParam } from "./common.js";
 import { callGatewayTool, type GatewayCallOptions } from "./gateway.js";
 import { resolveInternalSessionKey, resolveMainSessionAlias } from "./sessions-helpers.js";
@@ -158,6 +159,15 @@ export function createCronTool(opts?: CronToolOptions): AnyAgentTool {
            throw new Error("job required");
          }
          const job = normalizeCronJobCreate(params.job) ?? params.job;
+          if (job && typeof job === "object" && !("agentId" in job)) {
+            const cfg = loadConfig();
+            const agentId = opts?.agentSessionKey
+              ? resolveSessionAgentId({ sessionKey: opts.agentSessionKey, config: cfg })
+              : undefined;
+            if (agentId) {
+              (job as { agentId?: string }).agentId = agentId;
+            }
+          }
          const contextMessages =
            typeof params.contextMessages === "number" && Number.isFinite(params.contextMessages)
              ? params.contextMessages
@@ -39,6 +39,7 @@ export async function handleDiscordGuildAction(
  params: Record<string, unknown>,
  isActionEnabled: ActionGate<DiscordActionConfig>,
 ): Promise<AgentToolResult<unknown>> {
+  const accountId = readStringParam(params, "accountId");
  switch (action) {
    case "memberInfo": {
      if (!isActionEnabled("memberInfo")) {
@@ -50,7 +51,9 @@ export async function handleDiscordGuildAction(
      const userId = readStringParam(params, "userId", {
        required: true,
      });
-      const member = await fetchMemberInfoDiscord(guildId, userId);
+      const member = accountId
+        ? await fetchMemberInfoDiscord(guildId, userId, { accountId })
+        : await fetchMemberInfoDiscord(guildId, userId);
      return jsonResult({ ok: true, member });
    }
    case "roleInfo": {
@@ -60,7 +63,9 @@ export async function handleDiscordGuildAction(
      const guildId = readStringParam(params, "guildId", {
        required: true,
      });
-      const roles = await fetchRoleInfoDiscord(guildId);
+      const roles = accountId
+        ? await fetchRoleInfoDiscord(guildId, { accountId })
+        : await fetchRoleInfoDiscord(guildId);
      return jsonResult({ ok: true, roles });
    }
    case "emojiList": {
@@ -70,7 +75,9 @@ export async function handleDiscordGuildAction(
      const guildId = readStringParam(params, "guildId", {
        required: true,
      });
-      const emojis = await listGuildEmojisDiscord(guildId);
+      const emojis = accountId
+        ? await listGuildEmojisDiscord(guildId, { accountId })
+        : await listGuildEmojisDiscord(guildId);
      return jsonResult({ ok: true, emojis });
    }
    case "emojiUpload": {
@@ -85,12 +92,22 @@ export async function handleDiscordGuildAction(
        required: true,
      });
      const roleIds = readStringArrayParam(params, "roleIds");
-      const emoji = await uploadEmojiDiscord({
-        guildId,
-        name,
-        mediaUrl,
-        roleIds: roleIds?.length ? roleIds : undefined,
-      });
+      const emoji = accountId
+        ? await uploadEmojiDiscord(
+            {
+              guildId,
+              name,
+              mediaUrl,
+              roleIds: roleIds?.length ? roleIds : undefined,
+            },
+            { accountId },
+          )
+        : await uploadEmojiDiscord({
+            guildId,
+            name,
+            mediaUrl,
+            roleIds: roleIds?.length ? roleIds : undefined,
+          });
      return jsonResult({ ok: true, emoji });
    }
    case "stickerUpload": {
@@ -108,13 +125,24 @@ export async function handleDiscordGuildAction(
      const mediaUrl = readStringParam(params, "mediaUrl", {
        required: true,
      });
-      const sticker = await uploadStickerDiscord({
-        guildId,
-        name,
-        description,
-        tags,
-        mediaUrl,
-      });
+      const sticker = accountId
+        ? await uploadStickerDiscord(
+            {
+              guildId,
+              name,
+              description,
+              tags,
+              mediaUrl,
+            },
+            { accountId },
+          )
+        : await uploadStickerDiscord({
+            guildId,
+            name,
+            description,
+            tags,
+            mediaUrl,
+          });
      return jsonResult({ ok: true, sticker });
    }
    case "roleAdd": {
@@ -128,7 +156,11 @@ export async function handleDiscordGuildAction(
        required: true,
      });
      const roleId = readStringParam(params, "roleId", { required: true });
-      await addRoleDiscord({ guildId, userId, roleId });
+      if (accountId) {
+        await addRoleDiscord({ guildId, userId, roleId }, { accountId });
+      } else {
+        await addRoleDiscord({ guildId, userId, roleId });
+      }
      return jsonResult({ ok: true });
    }
    case "roleRemove": {
@@ -142,7 +174,11 @@ export async function handleDiscordGuildAction(
        required: true,
      });
      const roleId = readStringParam(params, "roleId", { required: true });
-      await removeRoleDiscord({ guildId, userId, roleId });
+      if (accountId) {
+        await removeRoleDiscord({ guildId, userId, roleId }, { accountId });
+      } else {
+        await removeRoleDiscord({ guildId, userId, roleId });
+      }
      return jsonResult({ ok: true });
    }
    case "channelInfo": {
@@ -152,7 +188,9 @@ export async function handleDiscordGuildAction(
      const channelId = readStringParam(params, "channelId", {
        required: true,
      });
-      const channel = await fetchChannelInfoDiscord(channelId);
+      const channel = accountId
+        ? await fetchChannelInfoDiscord(channelId, { accountId })
+        : await fetchChannelInfoDiscord(channelId);
      return jsonResult({ ok: true, channel });
    }
    case "channelList": {
@@ -162,7 +200,9 @@ export async function handleDiscordGuildAction(
      const guildId = readStringParam(params, "guildId", {
        required: true,
      });
-      const channels = await listGuildChannelsDiscord(guildId);
+      const channels = accountId
+        ? await listGuildChannelsDiscord(guildId, { accountId })
+        : await listGuildChannelsDiscord(guildId);
      return jsonResult({ ok: true, channels });
    }
    case "voiceStatus": {
@@ -175,7 +215,9 @@ export async function handleDiscordGuildAction(
      const userId = readStringParam(params, "userId", {
        required: true,
      });
-      const voice = await fetchVoiceStatusDiscord(guildId, userId);
+      const voice = accountId
+        ? await fetchVoiceStatusDiscord(guildId, userId, { accountId })
+        : await fetchVoiceStatusDiscord(guildId, userId);
      return jsonResult({ ok: true, voice });
    }
    case "eventList": {
@@ -185,7 +227,9 @@ export async function handleDiscordGuildAction(
      const guildId = readStringParam(params, "guildId", {
        required: true,
      });
-      const events = await listScheduledEventsDiscord(guildId);
+      const events = accountId
+        ? await listScheduledEventsDiscord(guildId, { accountId })
+        : await listScheduledEventsDiscord(guildId);
      return jsonResult({ ok: true, events });
    }
    case "eventCreate": {
@@ -215,7 +259,9 @@ export async function handleDiscordGuildAction(
        entity_metadata: entityType === 3 && location ? { location } : undefined,
        privacy_level: 2,
      };
-      const event = await createScheduledEventDiscord(guildId, payload);
+      const event = accountId
+        ? await createScheduledEventDiscord(guildId, payload, { accountId })
+        : await createScheduledEventDiscord(guildId, payload);
      return jsonResult({ ok: true, event });
    }
    case "channelCreate": {
@@ -229,15 +275,28 @@ export async function handleDiscordGuildAction(
      const topic = readStringParam(params, "topic");
      const position = readNumberParam(params, "position", { integer: true });
      const nsfw = params.nsfw as boolean | undefined;
-      const channel = await createChannelDiscord({
-        guildId,
-        name,
-        type: type ?? undefined,
-        parentId: parentId ?? undefined,
-        topic: topic ?? undefined,
-        position: position ?? undefined,
-        nsfw,
-      });
+      const channel = accountId
+        ? await createChannelDiscord(
+            {
+              guildId,
+              name,
+              type: type ?? undefined,
+              parentId: parentId ?? undefined,
+              topic: topic ?? undefined,
+              position: position ?? undefined,
+              nsfw,
+            },
+            { accountId },
+          )
+        : await createChannelDiscord({
+            guildId,
+            name,
+            type: type ?? undefined,
+            parentId: parentId ?? undefined,
+            topic: topic ?? undefined,
+            position: position ?? undefined,
+            nsfw,
+          });
      return jsonResult({ ok: true, channel });
    }
    case "channelEdit": {
@@ -255,15 +314,28 @@ export async function handleDiscordGuildAction(
      const rateLimitPerUser = readNumberParam(params, "rateLimitPerUser", {
        integer: true,
      });
-      const channel = await editChannelDiscord({
-        channelId,
-        name: name ?? undefined,
-        topic: topic ?? undefined,
-        position: position ?? undefined,
-        parentId,
-        nsfw,
-        rateLimitPerUser: rateLimitPerUser ?? undefined,
-      });
+      const channel = accountId
+        ? await editChannelDiscord(
+            {
+              channelId,
+              name: name ?? undefined,
+              topic: topic ?? undefined,
+              position: position ?? undefined,
+              parentId,
+              nsfw,
+              rateLimitPerUser: rateLimitPerUser ?? undefined,
+            },
+            { accountId },
+          )
+        : await editChannelDiscord({
+            channelId,
+            name: name ?? undefined,
+            topic: topic ?? undefined,
+            position: position ?? undefined,
+            parentId,
+            nsfw,
+            rateLimitPerUser: rateLimitPerUser ?? undefined,
+          });
      return jsonResult({ ok: true, channel });
    }
    case "channelDelete": {
@@ -273,7 +345,9 @@ export async function handleDiscordGuildAction(
      const channelId = readStringParam(params, "channelId", {
        required: true,
      });
-      const result = await deleteChannelDiscord(channelId);
+      const result = accountId
+        ? await deleteChannelDiscord(channelId, { accountId })
+        : await deleteChannelDiscord(channelId);
      return jsonResult(result);
    }
    case "channelMove": {
@@ -286,12 +360,24 @@ export async function handleDiscordGuildAction(
      });
      const parentId = readParentIdParam(params);
      const position = readNumberParam(params, "position", { integer: true });
-      await moveChannelDiscord({
-        guildId,
-        channelId,
-        parentId,
-        position: position ?? undefined,
-      });
+      if (accountId) {
+        await moveChannelDiscord(
+          {
+            guildId,
+            channelId,
+            parentId,
+            position: position ?? undefined,
+          },
+          { accountId },
+        );
+      } else {
+        await moveChannelDiscord({
+          guildId,
+          channelId,
+          parentId,
+          position: position ?? undefined,
+        });
+      }
      return jsonResult({ ok: true });
    }
    case "categoryCreate": {
@@ -301,12 +387,22 @@ export async function handleDiscordGuildAction(
      const guildId = readStringParam(params, "guildId", { required: true });
      const name = readStringParam(params, "name", { required: true });
      const position = readNumberParam(params, "position", { integer: true });
-      const channel = await createChannelDiscord({
-        guildId,
-        name,
-        type: 4,
-        position: position ?? undefined,
-      });
+      const channel = accountId
+        ? await createChannelDiscord(
+            {
+              guildId,
+              name,
+              type: 4,
+              position: position ?? undefined,
+            },
+            { accountId },
+          )
+        : await createChannelDiscord({
+            guildId,
+            name,
+            type: 4,
+            position: position ?? undefined,
+          });
      return jsonResult({ ok: true, category: channel });
    }
    case "categoryEdit": {
@@ -318,11 +414,20 @@ export async function handleDiscordGuildAction(
      });
      const name = readStringParam(params, "name");
      const position = readNumberParam(params, "position", { integer: true });
-      const channel = await editChannelDiscord({
-        channelId: categoryId,
-        name: name ?? undefined,
-        position: position ?? undefined,
-      });
+      const channel = accountId
+        ? await editChannelDiscord(
+            {
+              channelId: categoryId,
+              name: name ?? undefined,
+              position: position ?? undefined,
+            },
+            { accountId },
+          )
+        : await editChannelDiscord({
+            channelId: categoryId,
+            name: name ?? undefined,
+            position: position ?? undefined,
+          });
      return jsonResult({ ok: true, category: channel });
    }
    case "categoryDelete": {
@@ -332,7 +437,9 @@ export async function handleDiscordGuildAction(
      const categoryId = readStringParam(params, "categoryId", {
        required: true,
      });
-      const result = await deleteChannelDiscord(categoryId);
+      const result = accountId
+        ? await deleteChannelDiscord(categoryId, { accountId })
+        : await deleteChannelDiscord(categoryId);
      return jsonResult(result);
    }
    case "channelPermissionSet": {
@@ -349,13 +456,26 @@ export async function handleDiscordGuildAction(
      const targetType = targetTypeRaw === "member" ? 1 : 0;
      const allow = readStringParam(params, "allow");
      const deny = readStringParam(params, "deny");
-      await setChannelPermissionDiscord({
-        channelId,
-        targetId,
-        targetType,
-        allow: allow ?? undefined,
-        deny: deny ?? undefined,
-      });
+      if (accountId) {
+        await setChannelPermissionDiscord(
+          {
+            channelId,
+            targetId,
+            targetType,
+            allow: allow ?? undefined,
+            deny: deny ?? undefined,
+          },
+          { accountId },
+        );
+      } else {
+        await setChannelPermissionDiscord({
+          channelId,
+          targetId,
+          targetType,
+          allow: allow ?? undefined,
+          deny: deny ?? undefined,
+        });
+      }
      return jsonResult({ ok: true });
    }
    case "channelPermissionRemove": {
@@ -366,7 +486,11 @@ export async function handleDiscordGuildAction(
        required: true,
      });
      const targetId = readStringParam(params, "targetId", { required: true });
-      await removeChannelPermissionDiscord(channelId, targetId);
+      if (accountId) {
+        await removeChannelPermissionDiscord(channelId, targetId, { accountId });
+      } else {
+        await removeChannelPermissionDiscord(channelId, targetId);
+      }
      return jsonResult({ ok: true });
    }
    default:
@@ -58,6 +58,7 @@ export async function handleDiscordMessagingAction(
        required: true,
      }),
    );
+  const accountId = readStringParam(params, "accountId");
  const normalizeMessage = (message: unknown) => {
    if (!message || typeof message !== "object") return message;
    return withNormalizedTimestamp(
@@ -78,14 +79,24 @@ export async function handleDiscordMessagingAction(
        removeErrorMessage: "Emoji is required to remove a Discord reaction.",
      });
      if (remove) {
-        await removeReactionDiscord(channelId, messageId, emoji);
+        if (accountId) {
+          await removeReactionDiscord(channelId, messageId, emoji, { accountId });
+        } else {
+          await removeReactionDiscord(channelId, messageId, emoji);
+        }
        return jsonResult({ ok: true, removed: emoji });
      }
      if (isEmpty) {
-        const removed = await removeOwnReactionsDiscord(channelId, messageId);
+        const removed = accountId
+          ? await removeOwnReactionsDiscord(channelId, messageId, { accountId })
+          : await removeOwnReactionsDiscord(channelId, messageId);
        return jsonResult({ ok: true, removed: removed.removed });
      }
-      await reactMessageDiscord(channelId, messageId, emoji);
+      if (accountId) {
+        await reactMessageDiscord(channelId, messageId, emoji, { accountId });
+      } else {
+        await reactMessageDiscord(channelId, messageId, emoji);
+      }
      return jsonResult({ ok: true, added: emoji });
    }
    case "reactions": {
@@ -100,6 +111,7 @@ export async function handleDiscordMessagingAction(
      const limit =
        typeof limitRaw === "number" && Number.isFinite(limitRaw) ? limitRaw : undefined;
      const reactions = await fetchReactionsDiscord(channelId, messageId, {
+        ...(accountId ? { accountId } : {}),
        limit,
      });
      return jsonResult({ ok: true, reactions });
@@ -114,7 +126,10 @@ export async function handleDiscordMessagingAction(
        required: true,
        label: "stickerIds",
      });
-      await sendStickerDiscord(to, stickerIds, { content });
+      await sendStickerDiscord(to, stickerIds, {
+        ...(accountId ? { accountId } : {}),
+        content,
+      });
      return jsonResult({ ok: true });
    }
    case "poll": {
@@ -140,7 +155,7 @@ export async function handleDiscordMessagingAction(
      await sendPollDiscord(
        to,
        { question, options: answers, maxSelections, durationHours },
-        { content },
+        { ...(accountId ? { accountId } : {}), content },
      );
      return jsonResult({ ok: true });
    }
@@ -149,7 +164,9 @@ export async function handleDiscordMessagingAction(
        throw new Error("Discord permissions are disabled.");
      }
      const channelId = resolveChannelId();
-      const permissions = await fetchChannelPermissionsDiscord(channelId);
+      const permissions = accountId
+        ? await fetchChannelPermissionsDiscord(channelId, { accountId })
+        : await fetchChannelPermissionsDiscord(channelId);
      return jsonResult({ ok: true, permissions });
    }
    case "fetchMessage": {
@@ -171,7 +188,9 @@ export async function handleDiscordMessagingAction(
          "Discord message fetch requires guildId, channelId, and messageId (or a valid messageLink).",
        );
      }
-      const message = await fetchMessageDiscord(channelId, messageId);
+      const message = accountId
+        ? await fetchMessageDiscord(channelId, messageId, { accountId })
+        : await fetchMessageDiscord(channelId, messageId);
      return jsonResult({
        ok: true,
        message: normalizeMessage(message),
@@ -185,7 +204,7 @@ export async function handleDiscordMessagingAction(
        throw new Error("Discord message reads are disabled.");
      }
      const channelId = resolveChannelId();
-      const messages = await readMessagesDiscord(channelId, {
+      const query = {
        limit:
          typeof params.limit === "number" && Number.isFinite(params.limit)
            ? params.limit
@@ -193,7 +212,10 @@ export async function handleDiscordMessagingAction(
        before: readStringParam(params, "before"),
        after: readStringParam(params, "after"),
        around: readStringParam(params, "around"),
-      });
+      };
+      const messages = accountId
+        ? await readMessagesDiscord(channelId, query, { accountId })
+        : await readMessagesDiscord(channelId, query);
      return jsonResult({
        ok: true,
        messages: messages.map((message) => normalizeMessage(message)),
@@ -212,6 +234,7 @@ export async function handleDiscordMessagingAction(
      const embeds =
        Array.isArray(params.embeds) && params.embeds.length > 0 ? params.embeds : undefined;
      const result = await sendMessageDiscord(to, content, {
+        ...(accountId ? { accountId } : {}),
        mediaUrl,
        replyTo,
        embeds,
@@ -229,9 +252,9 @@ export async function handleDiscordMessagingAction(
      const content = readStringParam(params, "content", {
        required: true,
      });
-      const message = await editMessageDiscord(channelId, messageId, {
-        content,
-      });
+      const message = accountId
+        ? await editMessageDiscord(channelId, messageId, { content }, { accountId })
+        : await editMessageDiscord(channelId, messageId, { content });
      return jsonResult({ ok: true, message });
    }
    case "deleteMessage": {
@@ -242,7 +265,11 @@ export async function handleDiscordMessagingAction(
      const messageId = readStringParam(params, "messageId", {
        required: true,
      });
-      await deleteMessageDiscord(channelId, messageId);
+      if (accountId) {
+        await deleteMessageDiscord(channelId, messageId, { accountId });
+      } else {
+        await deleteMessageDiscord(channelId, messageId);
+      }
      return jsonResult({ ok: true });
    }
    case "threadCreate": {
@@ -257,11 +284,13 @@ export async function handleDiscordMessagingAction(
        typeof autoArchiveMinutesRaw === "number" && Number.isFinite(autoArchiveMinutesRaw)
          ? autoArchiveMinutesRaw
          : undefined;
-      const thread = await createThreadDiscord(channelId, {
-        name,
-        messageId,
-        autoArchiveMinutes,
-      });
+      const thread = accountId
+        ? await createThreadDiscord(
+            channelId,
+            { name, messageId, autoArchiveMinutes },
+            { accountId },
+          )
+        : await createThreadDiscord(channelId, { name, messageId, autoArchiveMinutes });
      return jsonResult({ ok: true, thread });
    }
    case "threadList": {
@@ -279,13 +308,24 @@ export async function handleDiscordMessagingAction(
        typeof params.limit === "number" && Number.isFinite(params.limit)
          ? params.limit
          : undefined;
-      const threads = await listThreadsDiscord({
-        guildId,
-        channelId,
-        includeArchived,
-        before,
-        limit,
-      });
+      const threads = accountId
+        ? await listThreadsDiscord(
+            {
+              guildId,
+              channelId,
+              includeArchived,
+              before,
+              limit,
+            },
+            { accountId },
+          )
+        : await listThreadsDiscord({
+            guildId,
+            channelId,
+            includeArchived,
+            before,
+            limit,
+          });
      return jsonResult({ ok: true, threads });
    }
    case "threadReply": {
@@ -299,6 +339,7 @@ export async function handleDiscordMessagingAction(
      const mediaUrl = readStringParam(params, "mediaUrl");
      const replyTo = readStringParam(params, "replyTo");
      const result = await sendMessageDiscord(`channel:${channelId}`, content, {
+        ...(accountId ? { accountId } : {}),
        mediaUrl,
        replyTo,
      });
@@ -312,7 +353,11 @@ export async function handleDiscordMessagingAction(
      const messageId = readStringParam(params, "messageId", {
        required: true,
      });
-      await pinMessageDiscord(channelId, messageId);
+      if (accountId) {
+        await pinMessageDiscord(channelId, messageId, { accountId });
+      } else {
+        await pinMessageDiscord(channelId, messageId);
+      }
      return jsonResult({ ok: true });
    }
    case "unpinMessage": {
@@ -323,7 +368,11 @@ export async function handleDiscordMessagingAction(
      const messageId = readStringParam(params, "messageId", {
        required: true,
      });
-      await unpinMessageDiscord(channelId, messageId);
+      if (accountId) {
+        await unpinMessageDiscord(channelId, messageId, { accountId });
+      } else {
+        await unpinMessageDiscord(channelId, messageId);
+      }
      return jsonResult({ ok: true });
    }
    case "listPins": {
@@ -331,7 +380,9 @@ export async function handleDiscordMessagingAction(
        throw new Error("Discord pins are disabled.");
      }
      const channelId = resolveChannelId();
-      const pins = await listPinsDiscord(channelId);
+      const pins = accountId
+        ? await listPinsDiscord(channelId, { accountId })
+        : await listPinsDiscord(channelId);
      return jsonResult({ ok: true, pins: pins.map((pin) => normalizeMessage(pin)) });
    }
    case "searchMessages": {
@@ -354,13 +405,24 @@ export async function handleDiscordMessagingAction(
          : undefined;
      const channelIdList = [...(channelIds ?? []), ...(channelId ? [channelId] : [])];
      const authorIdList = [...(authorIds ?? []), ...(authorId ? [authorId] : [])];
-      const results = await searchMessagesDiscord({
-        guildId,
-        content,
-        channelIds: channelIdList.length ? channelIdList : undefined,
-        authorIds: authorIdList.length ? authorIdList : undefined,
-        limit,
-      });
+      const results = accountId
+        ? await searchMessagesDiscord(
+            {
+              guildId,
+              content,
+              channelIds: channelIdList.length ? channelIdList : undefined,
+              authorIds: authorIdList.length ? authorIdList : undefined,
+              limit,
+            },
+            { accountId },
+          )
+        : await searchMessagesDiscord({
+            guildId,
+            content,
+            channelIds: channelIdList.length ? channelIdList : undefined,
+            authorIds: authorIdList.length ? authorIdList : undefined,
+            limit,
+          });
      if (!results || typeof results !== "object") {
        return jsonResult({ ok: true, results });
      }
@@ -8,6 +8,7 @@ export async function handleDiscordModerationAction(
  params: Record<string, unknown>,
  isActionEnabled: ActionGate<DiscordActionConfig>,
 ): Promise<AgentToolResult<unknown>> {
+  const accountId = readStringParam(params, "accountId");
  switch (action) {
    case "timeout": {
      if (!isActionEnabled("moderation", false)) {
@@ -25,13 +26,24 @@ export async function handleDiscordModerationAction(
          : undefined;
      const until = readStringParam(params, "until");
      const reason = readStringParam(params, "reason");
-      const member = await timeoutMemberDiscord({
-        guildId,
-        userId,
-        durationMinutes,
-        until,
-        reason,
-      });
+      const member = accountId
+        ? await timeoutMemberDiscord(
+            {
+              guildId,
+              userId,
+              durationMinutes,
+              until,
+              reason,
+            },
+            { accountId },
+          )
+        : await timeoutMemberDiscord({
+            guildId,
+            userId,
+            durationMinutes,
+            until,
+            reason,
+          });
      return jsonResult({ ok: true, member });
    }
    case "kick": {
@@ -45,7 +57,11 @@ export async function handleDiscordModerationAction(
        required: true,
      });
      const reason = readStringParam(params, "reason");
-      await kickMemberDiscord({ guildId, userId, reason });
+      if (accountId) {
+        await kickMemberDiscord({ guildId, userId, reason }, { accountId });
+      } else {
+        await kickMemberDiscord({ guildId, userId, reason });
+      }
      return jsonResult({ ok: true });
    }
    case "ban": {
@@ -63,12 +79,24 @@ export async function handleDiscordModerationAction(
        typeof params.deleteMessageDays === "number" && Number.isFinite(params.deleteMessageDays)
          ? params.deleteMessageDays
          : undefined;
-      await banMemberDiscord({
-        guildId,
-        userId,
-        reason,
-        deleteMessageDays,
-      });
+      if (accountId) {
+        await banMemberDiscord(
+          {
+            guildId,
+            userId,
+            reason,
+            deleteMessageDays,
+          },
+          { accountId },
+        );
+      } else {
+        await banMemberDiscord({
+          guildId,
+          userId,
+          reason,
+          deleteMessageDays,
+        });
+      }
      return jsonResult({ ok: true });
    }
    default:
@@ -3,6 +3,7 @@ import { describe, expect, it, vi } from "vitest";
 import type { DiscordActionConfig } from "../../config/config.js";
 import { handleDiscordGuildAction } from "./discord-actions-guild.js";
 import { handleDiscordMessagingAction } from "./discord-actions-messaging.js";
+import { handleDiscordModerationAction } from "./discord-actions-moderation.js";

 const createChannelDiscord = vi.fn(async () => ({
  id: "new-channel",
@@ -20,6 +21,7 @@ const editMessageDiscord = vi.fn(async () => ({}));
 const fetchMessageDiscord = vi.fn(async () => ({}));
 const fetchChannelPermissionsDiscord = vi.fn(async () => ({}));
 const fetchReactionsDiscord = vi.fn(async () => ({}));
+const listGuildChannelsDiscord = vi.fn(async () => []);
 const listPinsDiscord = vi.fn(async () => ({}));
 const listThreadsDiscord = vi.fn(async () => ({}));
 const moveChannelDiscord = vi.fn(async () => ({ ok: true }));
@@ -35,8 +37,12 @@ const sendPollDiscord = vi.fn(async () => ({}));
 const sendStickerDiscord = vi.fn(async () => ({}));
 const setChannelPermissionDiscord = vi.fn(async () => ({ ok: true }));
 const unpinMessageDiscord = vi.fn(async () => ({}));
+const timeoutMemberDiscord = vi.fn(async () => ({}));
+const kickMemberDiscord = vi.fn(async () => ({}));
+const banMemberDiscord = vi.fn(async () => ({}));

 vi.mock("../../discord/send.js", () => ({
+  banMemberDiscord: (...args: unknown[]) => banMemberDiscord(...args),
  createChannelDiscord: (...args: unknown[]) => createChannelDiscord(...args),
  createThreadDiscord: (...args: unknown[]) => createThreadDiscord(...args),
  deleteChannelDiscord: (...args: unknown[]) => deleteChannelDiscord(...args),
@@ -46,6 +52,8 @@ vi.mock("../../discord/send.js", () => ({
  fetchMessageDiscord: (...args: unknown[]) => fetchMessageDiscord(...args),
  fetchChannelPermissionsDiscord: (...args: unknown[]) => fetchChannelPermissionsDiscord(...args),
  fetchReactionsDiscord: (...args: unknown[]) => fetchReactionsDiscord(...args),
+  kickMemberDiscord: (...args: unknown[]) => kickMemberDiscord(...args),
+  listGuildChannelsDiscord: (...args: unknown[]) => listGuildChannelsDiscord(...args),
  listPinsDiscord: (...args: unknown[]) => listPinsDiscord(...args),
  listThreadsDiscord: (...args: unknown[]) => listThreadsDiscord(...args),
  moveChannelDiscord: (...args: unknown[]) => moveChannelDiscord(...args),
@@ -60,12 +68,15 @@ vi.mock("../../discord/send.js", () => ({
  sendPollDiscord: (...args: unknown[]) => sendPollDiscord(...args),
  sendStickerDiscord: (...args: unknown[]) => sendStickerDiscord(...args),
  setChannelPermissionDiscord: (...args: unknown[]) => setChannelPermissionDiscord(...args),
+  timeoutMemberDiscord: (...args: unknown[]) => timeoutMemberDiscord(...args),
  unpinMessageDiscord: (...args: unknown[]) => unpinMessageDiscord(...args),
 }));

 const enableAllActions = () => true;

 const disabledActions = (key: keyof DiscordActionConfig) => key !== "reactions";
+const channelInfoEnabled = (key: keyof DiscordActionConfig) => key === "channelInfo";
+const moderationEnabled = (key: keyof DiscordActionConfig) => key === "moderation";

 describe("handleDiscordMessagingAction", () => {
  it("adds reactions", async () => {
@@ -81,6 +92,20 @@ describe("handleDiscordMessagingAction", () => {
    expect(reactMessageDiscord).toHaveBeenCalledWith("C1", "M1", "✅");
  });

+  it("forwards accountId for reactions", async () => {
+    await handleDiscordMessagingAction(
+      "react",
+      {
+        channelId: "C1",
+        messageId: "M1",
+        emoji: "✅",
+        accountId: "ops",
+      },
+      enableAllActions,
+    );
+    expect(reactMessageDiscord).toHaveBeenCalledWith("C1", "M1", "✅", { accountId: "ops" });
+  });
+
  it("removes reactions on empty emoji", async () => {
    await handleDiscordMessagingAction(
      "react",
@@ -245,6 +270,15 @@ describe("handleDiscordGuildAction - channel management", () => {
    ).rejects.toThrow(/Discord channel management is disabled/);
  });

+  it("forwards accountId for channelList", async () => {
+    await handleDiscordGuildAction(
+      "channelList",
+      { guildId: "G1", accountId: "ops" },
+      channelInfoEnabled,
+    );
+    expect(listGuildChannelsDiscord).toHaveBeenCalledWith("G1", { accountId: "ops" });
+  });
+
  it("edits a channel", async () => {
    await handleDiscordGuildAction(
      "channelEdit",
@@ -448,3 +482,26 @@ describe("handleDiscordGuildAction - channel management", () => {
    expect(removeChannelPermissionDiscord).toHaveBeenCalledWith("C1", "R1");
  });
 });
+
+describe("handleDiscordModerationAction", () => {
+  it("forwards accountId for timeout", async () => {
+    await handleDiscordModerationAction(
+      "timeout",
+      {
+        guildId: "G1",
+        userId: "U1",
+        durationMinutes: 5,
+        accountId: "ops",
+      },
+      moderationEnabled,
+    );
+    expect(timeoutMemberDiscord).toHaveBeenCalledWith(
+      expect.objectContaining({
+        guildId: "G1",
+        userId: "U1",
+        durationMinutes: 5,
+      }),
+      { accountId: "ops" },
+    );
+  });
+});
@@ -342,6 +342,9 @@ export function createMessageTool(options?: MessageToolOptions): AnyAgentTool {
      }) as ChannelMessageActionName;

      const accountId = readStringParam(params, "accountId") ?? agentAccountId;
+      if (accountId) {
+        params.accountId = accountId;
+      }

      const gateway = {
        url: readStringParam(params, "gatewayUrl", { trim: false }),
@@ -1,11 +1,41 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";

 import type { ClawdbotConfig } from "../../../config/config.js";
-import { discordMessageActions } from "./discord.js";
+type SendMessageDiscord = typeof import("../../../discord/send.js").sendMessageDiscord;
+type SendPollDiscord = typeof import("../../../discord/send.js").sendPollDiscord;
+
+const sendMessageDiscord = vi.fn<Parameters<SendMessageDiscord>, ReturnType<SendMessageDiscord>>(
+  async () => ({ ok: true }) as Awaited<ReturnType<SendMessageDiscord>>,
+);
+const sendPollDiscord = vi.fn<Parameters<SendPollDiscord>, ReturnType<SendPollDiscord>>(
+  async () => ({ ok: true }) as Awaited<ReturnType<SendPollDiscord>>,
+);
+
+vi.mock("../../../discord/send.js", async () => {
+  const actual = await vi.importActual<typeof import("../../../discord/send.js")>(
+    "../../../discord/send.js",
+  );
+  return {
+    ...actual,
+    sendMessageDiscord: (...args: Parameters<SendMessageDiscord>) => sendMessageDiscord(...args),
+    sendPollDiscord: (...args: Parameters<SendPollDiscord>) => sendPollDiscord(...args),
+  };
+});
+
+const loadHandleDiscordMessageAction = async () => {
+  const mod = await import("./discord/handle-action.js");
+  return mod.handleDiscordMessageAction;
+};
+
+const loadDiscordMessageActions = async () => {
+  const mod = await import("./discord.js");
+  return mod.discordMessageActions;
+};

 describe("discord message actions", () => {
-  it("lists channel and upload actions by default", () => {
+  it("lists channel and upload actions by default", async () => {
    const cfg = { channels: { discord: { token: "d0" } } } as ClawdbotConfig;
+    const discordMessageActions = await loadDiscordMessageActions();
    const actions = discordMessageActions.listActions?.({ cfg }) ?? [];

    expect(actions).toContain("emoji-upload");
@@ -13,12 +43,88 @@ describe("discord message actions", () => {
    expect(actions).toContain("channel-create");
  });

-  it("respects disabled channel actions", () => {
+  it("respects disabled channel actions", async () => {
    const cfg = {
      channels: { discord: { token: "d0", actions: { channels: false } } },
    } as ClawdbotConfig;
+    const discordMessageActions = await loadDiscordMessageActions();
    const actions = discordMessageActions.listActions?.({ cfg }) ?? [];

    expect(actions).not.toContain("channel-create");
  });
 });
+
+describe("handleDiscordMessageAction", () => {
+  it("forwards context accountId for send", async () => {
+    sendMessageDiscord.mockClear();
+    const handleDiscordMessageAction = await loadHandleDiscordMessageAction();
+
+    await handleDiscordMessageAction({
+      action: "send",
+      params: {
+        to: "channel:123",
+        message: "hi",
+      },
+      cfg: {} as ClawdbotConfig,
+      accountId: "ops",
+    });
+
+    expect(sendMessageDiscord).toHaveBeenCalledWith(
+      "channel:123",
+      "hi",
+      expect.objectContaining({
+        accountId: "ops",
+      }),
+    );
+  });
+
+  it("falls back to params accountId when context missing", async () => {
+    sendPollDiscord.mockClear();
+    const handleDiscordMessageAction = await loadHandleDiscordMessageAction();
+
+    await handleDiscordMessageAction({
+      action: "poll",
+      params: {
+        to: "channel:123",
+        pollQuestion: "Ready?",
+        pollOption: ["Yes", "No"],
+        accountId: "marve",
+      },
+      cfg: {} as ClawdbotConfig,
+    });
+
+    expect(sendPollDiscord).toHaveBeenCalledWith(
+      "channel:123",
+      expect.objectContaining({
+        question: "Ready?",
+        options: ["Yes", "No"],
+      }),
+      expect.objectContaining({
+        accountId: "marve",
+      }),
+    );
+  });
+
+  it("forwards accountId for thread replies", async () => {
+    sendMessageDiscord.mockClear();
+    const handleDiscordMessageAction = await loadHandleDiscordMessageAction();
+
+    await handleDiscordMessageAction({
+      action: "thread-reply",
+      params: {
+        channelId: "123",
+        message: "hi",
+      },
+      cfg: {} as ClawdbotConfig,
+      accountId: "ops",
+    });
+
+    expect(sendMessageDiscord).toHaveBeenCalledWith(
+      "channel:123",
+      "hi",
+      expect.objectContaining({
+        accountId: "ops",
+      }),
+    );
+  });
+});
@@ -80,7 +80,7 @@ export const discordMessageActions: ChannelMessageActionAdapter = {
    }
    return null;
  },
-  handleAction: async ({ action, params, cfg }) => {
-    return await handleDiscordMessageAction({ action, params, cfg });
+  handleAction: async ({ action, params, cfg, accountId }) => {
+    return await handleDiscordMessageAction({ action, params, cfg, accountId });
  },
 };
@@ -7,7 +7,7 @@ import {
 import { handleDiscordAction } from "../../../../agents/tools/discord-actions.js";
 import type { ChannelMessageActionContext } from "../../types.js";

-type Ctx = Pick<ChannelMessageActionContext, "action" | "params" | "cfg">;
+type Ctx = Pick<ChannelMessageActionContext, "action" | "params" | "cfg" | "accountId">;

 export async function tryHandleDiscordMessageActionGuildAdmin(params: {
  ctx: Ctx;
@@ -16,27 +16,37 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
 }): Promise<AgentToolResult<unknown> | undefined> {
  const { ctx, resolveChannelId, readParentIdParam } = params;
  const { action, params: actionParams, cfg } = ctx;
+  const accountId = ctx.accountId ?? readStringParam(actionParams, "accountId");

  if (action === "member-info") {
    const userId = readStringParam(actionParams, "userId", { required: true });
    const guildId = readStringParam(actionParams, "guildId", {
      required: true,
    });
-    return await handleDiscordAction({ action: "memberInfo", guildId, userId }, cfg);
+    return await handleDiscordAction(
+      { action: "memberInfo", accountId: accountId ?? undefined, guildId, userId },
+      cfg,
+    );
  }

  if (action === "role-info") {
    const guildId = readStringParam(actionParams, "guildId", {
      required: true,
    });
-    return await handleDiscordAction({ action: "roleInfo", guildId }, cfg);
+    return await handleDiscordAction(
+      { action: "roleInfo", accountId: accountId ?? undefined, guildId },
+      cfg,
+    );
  }

  if (action === "emoji-list") {
    const guildId = readStringParam(actionParams, "guildId", {
      required: true,
    });
-    return await handleDiscordAction({ action: "emojiList", guildId }, cfg);
+    return await handleDiscordAction(
+      { action: "emojiList", accountId: accountId ?? undefined, guildId },
+      cfg,
+    );
  }

  if (action === "emoji-upload") {
@@ -50,7 +60,14 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    });
    const roleIds = readStringArrayParam(actionParams, "roleIds");
    return await handleDiscordAction(
-      { action: "emojiUpload", guildId, name, mediaUrl, roleIds },
+      {
+        action: "emojiUpload",
+        accountId: accountId ?? undefined,
+        guildId,
+        name,
+        mediaUrl,
+        roleIds,
+      },
      cfg,
    );
  }
@@ -73,7 +90,15 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
      trim: false,
    });
    return await handleDiscordAction(
-      { action: "stickerUpload", guildId, name, description, tags, mediaUrl },
+      {
+        action: "stickerUpload",
+        accountId: accountId ?? undefined,
+        guildId,
+        name,
+        description,
+        tags,
+        mediaUrl,
+      },
      cfg,
    );
  }
@@ -87,6 +112,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: action === "role-add" ? "roleAdd" : "roleRemove",
+        accountId: accountId ?? undefined,
        guildId,
        userId,
        roleId,
@@ -99,14 +125,20 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    const channelId = readStringParam(actionParams, "channelId", {
      required: true,
    });
-    return await handleDiscordAction({ action: "channelInfo", channelId }, cfg);
+    return await handleDiscordAction(
+      { action: "channelInfo", accountId: accountId ?? undefined, channelId },
+      cfg,
+    );
  }

  if (action === "channel-list") {
    const guildId = readStringParam(actionParams, "guildId", {
      required: true,
    });
-    return await handleDiscordAction({ action: "channelList", guildId }, cfg);
+    return await handleDiscordAction(
+      { action: "channelList", accountId: accountId ?? undefined, guildId },
+      cfg,
+    );
  }

  if (action === "channel-create") {
@@ -124,6 +156,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: "channelCreate",
+        accountId: accountId ?? undefined,
        guildId,
        name,
        type: type ?? undefined,
@@ -153,6 +186,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: "channelEdit",
+        accountId: accountId ?? undefined,
        channelId,
        name: name ?? undefined,
        topic: topic ?? undefined,
@@ -169,7 +203,10 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    const channelId = readStringParam(actionParams, "channelId", {
      required: true,
    });
-    return await handleDiscordAction({ action: "channelDelete", channelId }, cfg);
+    return await handleDiscordAction(
+      { action: "channelDelete", accountId: accountId ?? undefined, channelId },
+      cfg,
+    );
  }

  if (action === "channel-move") {
@@ -186,6 +223,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: "channelMove",
+        accountId: accountId ?? undefined,
        guildId,
        channelId,
        parentId: parentId === undefined ? undefined : parentId,
@@ -206,6 +244,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: "categoryCreate",
+        accountId: accountId ?? undefined,
        guildId,
        name,
        position: position ?? undefined,
@@ -225,6 +264,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: "categoryEdit",
+        accountId: accountId ?? undefined,
        categoryId,
        name: name ?? undefined,
        position: position ?? undefined,
@@ -237,7 +277,10 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    const categoryId = readStringParam(actionParams, "categoryId", {
      required: true,
    });
-    return await handleDiscordAction({ action: "categoryDelete", categoryId }, cfg);
+    return await handleDiscordAction(
+      { action: "categoryDelete", accountId: accountId ?? undefined, categoryId },
+      cfg,
+    );
  }

  if (action === "voice-status") {
@@ -245,14 +288,20 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
      required: true,
    });
    const userId = readStringParam(actionParams, "userId", { required: true });
-    return await handleDiscordAction({ action: "voiceStatus", guildId, userId }, cfg);
+    return await handleDiscordAction(
+      { action: "voiceStatus", accountId: accountId ?? undefined, guildId, userId },
+      cfg,
+    );
  }

  if (action === "event-list") {
    const guildId = readStringParam(actionParams, "guildId", {
      required: true,
    });
-    return await handleDiscordAction({ action: "eventList", guildId }, cfg);
+    return await handleDiscordAction(
+      { action: "eventList", accountId: accountId ?? undefined, guildId },
+      cfg,
+    );
  }

  if (action === "event-create") {
@@ -271,6 +320,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: "eventCreate",
+        accountId: accountId ?? undefined,
        guildId,
        name,
        startTime,
@@ -301,6 +351,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: discordAction,
+        accountId: accountId ?? undefined,
        guildId,
        userId,
        durationMinutes,
@@ -325,6 +376,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: "threadList",
+        accountId: accountId ?? undefined,
        guildId,
        channelId,
        includeArchived,
@@ -344,6 +396,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: "threadReply",
+        accountId: accountId ?? undefined,
        channelId: resolveChannelId(),
        content,
        mediaUrl: mediaUrl ?? undefined,
@@ -361,6 +414,7 @@ export async function tryHandleDiscordMessageActionGuildAdmin(params: {
    return await handleDiscordAction(
      {
        action: "searchMessages",
+        accountId: accountId ?? undefined,
        guildId,
        content: query,
        channelId: readStringParam(actionParams, "channelId"),
@@ -18,9 +18,10 @@ function readParentIdParam(params: Record<string, unknown>): string | null | und
 }

 export async function handleDiscordMessageAction(
-  ctx: Pick<ChannelMessageActionContext, "action" | "params" | "cfg">,
+  ctx: Pick<ChannelMessageActionContext, "action" | "params" | "cfg" | "accountId">,
 ): Promise<AgentToolResult<unknown>> {
  const { action, params, cfg } = ctx;
+  const accountId = ctx.accountId ?? readStringParam(params, "accountId");

  const resolveChannelId = () =>
    resolveDiscordChannelId(
@@ -39,6 +40,7 @@ export async function handleDiscordMessageAction(
    return await handleDiscordAction(
      {
        action: "sendMessage",
+        accountId: accountId ?? undefined,
        to,
        content,
        mediaUrl: mediaUrl ?? undefined,
@@ -62,6 +64,7 @@ export async function handleDiscordMessageAction(
    return await handleDiscordAction(
      {
        action: "poll",
+        accountId: accountId ?? undefined,
        to,
        question,
        answers,
@@ -80,6 +83,7 @@ export async function handleDiscordMessageAction(
    return await handleDiscordAction(
      {
        action: "react",
+        accountId: accountId ?? undefined,
        channelId: resolveChannelId(),
        messageId,
        emoji,
@@ -93,7 +97,13 @@ export async function handleDiscordMessageAction(
    const messageId = readStringParam(params, "messageId", { required: true });
    const limit = readNumberParam(params, "limit", { integer: true });
    return await handleDiscordAction(
-      { action: "reactions", channelId: resolveChannelId(), messageId, limit },
+      {
+        action: "reactions",
+        accountId: accountId ?? undefined,
+        channelId: resolveChannelId(),
+        messageId,
+        limit,
+      },
      cfg,
    );
  }
@@ -103,6 +113,7 @@ export async function handleDiscordMessageAction(
    return await handleDiscordAction(
      {
        action: "readMessages",
+        accountId: accountId ?? undefined,
        channelId: resolveChannelId(),
        limit,
        before: readStringParam(params, "before"),
@@ -119,6 +130,7 @@ export async function handleDiscordMessageAction(
    return await handleDiscordAction(
      {
        action: "editMessage",
+        accountId: accountId ?? undefined,
        channelId: resolveChannelId(),
        messageId,
        content,
@@ -130,7 +142,12 @@ export async function handleDiscordMessageAction(
  if (action === "delete") {
    const messageId = readStringParam(params, "messageId", { required: true });
    return await handleDiscordAction(
-      { action: "deleteMessage", channelId: resolveChannelId(), messageId },
+      {
+        action: "deleteMessage",
+        accountId: accountId ?? undefined,
+        channelId: resolveChannelId(),
+        messageId,
+      },
      cfg,
    );
  }
@@ -141,6 +158,7 @@ export async function handleDiscordMessageAction(
    return await handleDiscordAction(
      {
        action: action === "pin" ? "pinMessage" : action === "unpin" ? "unpinMessage" : "listPins",
+        accountId: accountId ?? undefined,
        channelId: resolveChannelId(),
        messageId,
      },
@@ -149,7 +167,14 @@ export async function handleDiscordMessageAction(
  }

  if (action === "permissions") {
-    return await handleDiscordAction({ action: "permissions", channelId: resolveChannelId() }, cfg);
+    return await handleDiscordAction(
+      {
+        action: "permissions",
+        accountId: accountId ?? undefined,
+        channelId: resolveChannelId(),
+      },
+      cfg,
+    );
  }

  if (action === "thread-create") {
@@ -161,6 +186,7 @@ export async function handleDiscordMessageAction(
    return await handleDiscordAction(
      {
        action: "threadCreate",
+        accountId: accountId ?? undefined,
        channelId: resolveChannelId(),
        name,
        messageId,
@@ -179,6 +205,7 @@ export async function handleDiscordMessageAction(
    return await handleDiscordAction(
      {
        action: "sticker",
+        accountId: accountId ?? undefined,
        to: readStringParam(params, "to", { required: true }),
        stickerIds,
        content: readStringParam(params, "message"),
@@ -299,6 +299,7 @@ export async function runCronIsolatedAgentTurn(params: {
          sessionId: cronSession.sessionEntry.sessionId,
          sessionKey: agentSessionKey,
          messageChannel,
+          agentAccountId: resolvedDelivery.accountId,
          sessionFile,
          workspaceDir,
          config: cfgWithAgentDefaults,
@@ -45,6 +45,26 @@ describe("resolveGatewayProgramArguments", () => {
    ]);
  });

+  it("prefers symlinked path over realpath for stable service config", async () => {
+    // Simulates pnpm global install where node_modules/clawdbot is a symlink
+    // to .pnpm/clawdbot@X.Y.Z/node_modules/clawdbot
+    const symlinkPath = path.resolve(
+      "/Users/test/Library/pnpm/global/5/node_modules/clawdbot/dist/entry.js",
+    );
+    const realpathResolved = path.resolve(
+      "/Users/test/Library/pnpm/global/5/node_modules/.pnpm/clawdbot@2026.1.21-2/node_modules/clawdbot/dist/entry.js",
+    );
+    process.argv = ["node", symlinkPath];
+    fsMocks.realpath.mockResolvedValue(realpathResolved);
+    fsMocks.access.mockResolvedValue(undefined); // Both paths exist
+
+    const result = await resolveGatewayProgramArguments({ port: 18789 });
+
+    // Should use the symlinked path, not the realpath-resolved versioned path
+    expect(result.programArguments[1]).toBe(symlinkPath);
+    expect(result.programArguments[1]).not.toContain("@2026.1.21-2");
+  });
+
  it("falls back to node_modules package dist when .bin path is not resolved", async () => {
    const argv1 = path.resolve("/tmp/.npm/_npx/63c3/node_modules/.bin/clawdbot");
    const indexPath = path.resolve("/tmp/.npm/_npx/63c3/node_modules/clawdbot/dist/index.js");
@@ -27,6 +27,20 @@ async function resolveCliEntrypointPathForService(): Promise<string> {
  const looksLikeDist = /[/\\]dist[/\\].+\.(cjs|js|mjs)$/.test(resolvedPath);
  if (looksLikeDist) {
    await fs.access(resolvedPath);
+    // Prefer the original (possibly symlinked) path over the resolved realpath.
+    // This keeps LaunchAgent/systemd paths stable across package version updates,
+    // since symlinks like node_modules/clawdbot -> .pnpm/clawdbot@X.Y.Z/...
+    // are automatically updated by pnpm, while the resolved path contains
+    // version-specific directories that break after updates.
+    const normalizedLooksLikeDist = /[/\\]dist[/\\].+\.(cjs|js|mjs)$/.test(normalized);
+    if (normalizedLooksLikeDist && normalized !== resolvedPath) {
+      try {
+        await fs.access(normalized);
+        return normalized;
+      } catch {
+        // Fall through to return resolvedPath
+      }
+    }
    return resolvedPath;
  }

@@ -40,7 +40,7 @@ const sendReq = (
  );
 };
 describe("gateway server chat", () => {
-  const timeoutMs = process.platform === "win32" ? 120_000 : 60_000;
+  const timeoutMs = 120_000;
  test(
    "handles history, abort, idempotency, and ordering flows",
    { timeout: timeoutMs },
@@ -410,3 +410,65 @@ describe("runMessageAction sendAttachment hydration", () => {
    );
  });
 });
+
+describe("runMessageAction accountId defaults", () => {
+  const handleAction = vi.fn(async () => jsonResult({ ok: true }));
+  const accountPlugin: ChannelPlugin = {
+    id: "discord",
+    meta: {
+      id: "discord",
+      label: "Discord",
+      selectionLabel: "Discord",
+      docsPath: "/channels/discord",
+      blurb: "Discord test plugin.",
+    },
+    capabilities: { chatTypes: ["direct"] },
+    config: {
+      listAccountIds: () => ["default"],
+      resolveAccount: () => ({}),
+    },
+    actions: {
+      listActions: () => ["send"],
+      handleAction,
+    },
+  };
+
+  beforeEach(() => {
+    setActivePluginRegistry(
+      createTestRegistry([
+        {
+          pluginId: "discord",
+          source: "test",
+          plugin: accountPlugin,
+        },
+      ]),
+    );
+    handleAction.mockClear();
+  });
+
+  afterEach(() => {
+    setActivePluginRegistry(createTestRegistry([]));
+    vi.clearAllMocks();
+  });
+
+  it("propagates defaultAccountId into params", async () => {
+    await runMessageAction({
+      cfg: {} as ClawdbotConfig,
+      action: "send",
+      params: {
+        channel: "discord",
+        target: "channel:123",
+        message: "hi",
+      },
+      defaultAccountId: "ops",
+    });
+
+    expect(handleAction).toHaveBeenCalled();
+    const ctx = handleAction.mock.calls[0]?.[0] as {
+      accountId?: string | null;
+      params: Record<string, unknown>;
+    };
+    expect(ctx.accountId).toBe("ops");
+    expect(ctx.params.accountId).toBe("ops");
+  });
+});
@@ -803,6 +803,9 @@ export async function runMessageAction(

  const channel = await resolveChannel(cfg, params);
  const accountId = readStringParam(params, "accountId") ?? input.defaultAccountId;
+  if (accountId) {
+    params.accountId = accountId;
+  }
  const dryRun = Boolean(input.dryRun ?? readBooleanParam(params, "dryRun"));

  await hydrateSendAttachmentParams({
@@ -339,6 +339,49 @@ export async function convertHeicToJpeg(buffer: Buffer): Promise<Buffer> {
  return await sharp(buffer).jpeg({ quality: 90, mozjpeg: true }).toBuffer();
 }

+/**
+ * Checks if an image has an alpha channel (transparency).
+ * Returns true if the image has alpha, false otherwise.
+ */
+export async function hasAlphaChannel(buffer: Buffer): Promise<boolean> {
+  try {
+    const sharp = await loadSharp();
+    const meta = await sharp(buffer).metadata();
+    // Check if the image has an alpha channel
+    // PNG color types with alpha: 4 (grayscale+alpha), 6 (RGBA)
+    // Sharp reports this via 'channels' (4 = RGBA) or 'hasAlpha'
+    return meta.hasAlpha === true || meta.channels === 4;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Resizes an image to PNG format, preserving alpha channel (transparency).
+ * Falls back to sharp only (no sips fallback for PNG with alpha).
+ */
+export async function resizeToPng(params: {
+  buffer: Buffer;
+  maxSide: number;
+  compressionLevel?: number;
+  withoutEnlargement?: boolean;
+}): Promise<Buffer> {
+  const sharp = await loadSharp();
+  // Compression level 6 is a good balance (0=fastest, 9=smallest)
+  const compressionLevel = params.compressionLevel ?? 6;
+
+  return await sharp(params.buffer)
+    .rotate() // Auto-rotate based on EXIF if present
+    .resize({
+      width: params.maxSide,
+      height: params.maxSide,
+      fit: "inside",
+      withoutEnlargement: params.withoutEnlargement !== false,
+    })
+    .png({ compressionLevel })
+    .toBuffer();
+}
+
 /**
 * Internal sips-only EXIF normalization (no sharp fallback).
 * Used by resizeToJpeg to normalize before sips resize.
@@ -5,10 +5,20 @@ import path from "node:path";
 import sharp from "sharp";
 import { afterEach, describe, expect, it, vi } from "vitest";

-import { loadWebMedia } from "./media.js";
+import { loadWebMedia, optimizeImageToJpeg, optimizeImageToPng } from "./media.js";

 const tmpFiles: string[] = [];

+function buildDeterministicBytes(length: number): Buffer {
+  const buffer = Buffer.allocUnsafe(length);
+  let seed = 0x12345678;
+  for (let i = 0; i < length; i++) {
+    seed = (1103515245 * seed + 12345) & 0x7fffffff;
+    buffer[i] = seed & 0xff;
+  }
+  return buffer;
+}
+
 afterEach(async () => {
  await Promise.all(tmpFiles.map((file) => fs.rm(file, { force: true })));
  tmpFiles.length = 0;
@@ -185,4 +195,69 @@ describe("web media loading", () => {

    fetchMock.mockRestore();
  });
+
+  it("preserves PNG alpha when under the cap", async () => {
+    const buffer = await sharp({
+      create: {
+        width: 64,
+        height: 64,
+        channels: 4,
+        background: { r: 255, g: 0, b: 0, alpha: 0.5 },
+      },
+    })
+      .png()
+      .toBuffer();
+
+    const file = path.join(os.tmpdir(), `clawdbot-media-${Date.now()}.png`);
+    tmpFiles.push(file);
+    await fs.writeFile(file, buffer);
+
+    const result = await loadWebMedia(file, 1024 * 1024);
+
+    expect(result.kind).toBe("image");
+    expect(result.contentType).toBe("image/png");
+    const meta = await sharp(result.buffer).metadata();
+    expect(meta.hasAlpha).toBe(true);
+  });
+
+  it("falls back to JPEG when PNG alpha cannot fit under cap", async () => {
+    const sizes = [512, 768, 1024];
+    let pngBuffer: Buffer | null = null;
+    let smallestPng: Awaited<ReturnType<typeof optimizeImageToPng>> | null = null;
+    let jpegOptimized: Awaited<ReturnType<typeof optimizeImageToJpeg>> | null = null;
+    let cap = 0;
+
+    for (const size of sizes) {
+      const raw = buildDeterministicBytes(size * size * 4);
+      pngBuffer = await sharp(raw, { raw: { width: size, height: size, channels: 4 } })
+        .png()
+        .toBuffer();
+      smallestPng = await optimizeImageToPng(pngBuffer, 1);
+      cap = Math.max(1, smallestPng.optimizedSize - 1);
+      jpegOptimized = await optimizeImageToJpeg(pngBuffer, cap);
+      if (jpegOptimized.buffer.length < smallestPng.optimizedSize) {
+        break;
+      }
+    }
+
+    if (!pngBuffer || !smallestPng || !jpegOptimized) {
+      throw new Error("PNG fallback setup failed");
+    }
+
+    if (jpegOptimized.buffer.length >= smallestPng.optimizedSize) {
+      throw new Error(
+        `JPEG fallback did not shrink below PNG (jpeg=${jpegOptimized.buffer.length}, png=${smallestPng.optimizedSize})`,
+      );
+    }
+
+    const file = path.join(os.tmpdir(), `clawdbot-media-${Date.now()}-alpha.png`);
+    tmpFiles.push(file);
+    await fs.writeFile(file, pngBuffer);
+
+    const result = await loadWebMedia(file, cap);
+
+    expect(result.kind).toBe("image");
+    expect(result.contentType).toBe("image/jpeg");
+    expect(result.buffer.length).toBeLessThanOrEqual(cap);
+  });
 });
@@ -6,7 +6,12 @@ import { logVerbose, shouldLogVerbose } from "../globals.js";
 import { type MediaKind, maxBytesForKind, mediaKindFromMime } from "../media/constants.js";
 import { resolveUserPath } from "../utils.js";
 import { fetchRemoteMedia } from "../media/fetch.js";
-import { convertHeicToJpeg, resizeToJpeg } from "../media/image-ops.js";
+import {
+  convertHeicToJpeg,
+  hasAlphaChannel,
+  resizeToJpeg,
+  resizeToPng,
+} from "../media/image-ops.js";
 import { detectMime, extensionForMime } from "../media/mime.js";

 export type WebMediaResult = {
@@ -61,27 +66,59 @@ async function loadWebMediaInternal(
    meta?: { contentType?: string; fileName?: string },
  ) => {
    const originalSize = buffer.length;
-    const optimized = await optimizeImageToJpeg(buffer, cap, meta);
-    const fileName = meta && isHeicSource(meta) ? toJpegFileName(meta.fileName) : meta?.fileName;
-    if (optimized.optimizedSize < originalSize && shouldLogVerbose()) {
-      logVerbose(
-        `Optimized media from ${(originalSize / (1024 * 1024)).toFixed(2)}MB to ${(optimized.optimizedSize / (1024 * 1024)).toFixed(2)}MB (side≤${optimized.resizeSide}px, q=${optimized.quality})`,
-      );
-    }
-    if (optimized.buffer.length > cap) {
-      throw new Error(
-        `Media could not be reduced below ${(cap / (1024 * 1024)).toFixed(0)}MB (got ${(
-          optimized.buffer.length /
-          (1024 * 1024)
-        ).toFixed(2)}MB)`,
-      );
-    }
-    return {
-      buffer: optimized.buffer,
-      contentType: "image/jpeg",
-      kind: "image" as const,
-      fileName,
+
+    const optimizeToJpeg = async () => {
+      const optimized = await optimizeImageToJpeg(buffer, cap, meta);
+      const fileName = meta && isHeicSource(meta) ? toJpegFileName(meta.fileName) : meta?.fileName;
+      if (optimized.optimizedSize < originalSize && shouldLogVerbose()) {
+        logVerbose(
+          `Optimized media from ${(originalSize / (1024 * 1024)).toFixed(2)}MB to ${(optimized.optimizedSize / (1024 * 1024)).toFixed(2)}MB (side≤${optimized.resizeSide}px, q=${optimized.quality})`,
+        );
+      }
+      if (optimized.buffer.length > cap) {
+        throw new Error(
+          `Media could not be reduced below ${(cap / (1024 * 1024)).toFixed(0)}MB (got ${(
+            optimized.buffer.length /
+            (1024 * 1024)
+          ).toFixed(2)}MB)`,
+        );
+      }
+      return {
+        buffer: optimized.buffer,
+        contentType: "image/jpeg",
+        kind: "image" as const,
+        fileName,
+      };
    };
+
+    // Check if this is a PNG with alpha channel - preserve transparency when possible
+    const isPng =
+      meta?.contentType === "image/png" || meta?.fileName?.toLowerCase().endsWith(".png");
+    const hasAlpha = isPng && (await hasAlphaChannel(buffer));
+
+    if (hasAlpha) {
+      const optimized = await optimizeImageToPng(buffer, cap);
+      if (optimized.buffer.length <= cap) {
+        if (optimized.optimizedSize < originalSize && shouldLogVerbose()) {
+          logVerbose(
+            `Optimized PNG (preserving alpha) from ${(originalSize / (1024 * 1024)).toFixed(2)}MB to ${(optimized.optimizedSize / (1024 * 1024)).toFixed(2)}MB (side≤${optimized.resizeSide}px)`,
+          );
+        }
+        return {
+          buffer: optimized.buffer,
+          contentType: "image/png",
+          kind: "image" as const,
+          fileName: meta?.fileName,
+        };
+      }
+      if (shouldLogVerbose()) {
+        logVerbose(
+          `PNG with alpha still exceeds ${(cap / (1024 * 1024)).toFixed(0)}MB after optimization; falling back to JPEG`,
+        );
+      }
+    }
+
+    return await optimizeToJpeg();
  };

  const clampAndFinalize = async (params: {
@@ -246,3 +283,62 @@ export async function optimizeImageToJpeg(

  throw new Error("Failed to optimize image");
 }
+
+export async function optimizeImageToPng(
+  buffer: Buffer,
+  maxBytes: number,
+): Promise<{
+  buffer: Buffer;
+  optimizedSize: number;
+  resizeSide: number;
+  compressionLevel: number;
+}> {
+  // Try a grid of sizes/compression levels until under the limit.
+  // PNG uses compression levels 0-9 (higher = smaller but slower)
+  const sides = [2048, 1536, 1280, 1024, 800];
+  const compressionLevels = [6, 7, 8, 9];
+  let smallest: {
+    buffer: Buffer;
+    size: number;
+    resizeSide: number;
+    compressionLevel: number;
+  } | null = null;
+
+  for (const side of sides) {
+    for (const compressionLevel of compressionLevels) {
+      try {
+        const out = await resizeToPng({
+          buffer,
+          maxSide: side,
+          compressionLevel,
+          withoutEnlargement: true,
+        });
+        const size = out.length;
+        if (!smallest || size < smallest.size) {
+          smallest = { buffer: out, size, resizeSide: side, compressionLevel };
+        }
+        if (size <= maxBytes) {
+          return {
+            buffer: out,
+            optimizedSize: size,
+            resizeSide: side,
+            compressionLevel,
+          };
+        }
+      } catch {
+        // Continue trying other size/compression combinations
+      }
+    }
+  }
+
+  if (smallest) {
+    return {
+      buffer: smallest.buffer,
+      optimizedSize: smallest.size,
+      resizeSide: smallest.resizeSide,
+      compressionLevel: smallest.compressionLevel,
+    };
+  }
+
+  throw new Error("Failed to optimize PNG image");
+}
@@ -299,99 +299,83 @@ export async function finalizeOnboardingWizard(options: FinalizeOnboardingOption
        ].join("\n"),
        "Start TUI (best option!)",
      );
-      await prompter.note(
-        [
-          "Gateway token: shared auth for the Gateway + Control UI.",
-          "Stored in: ~/.clawdbot/clawdbot.json (gateway.auth.token) or CLAWDBOT_GATEWAY_TOKEN.",
-          "Web UI stores a copy in this browser's localStorage (clawdbot.control.settings.v1).",
-          `Get the tokenized link anytime: ${formatCliCommand("clawdbot dashboard --no-open")}`,
-        ].join("\n"),
-        "Token",
-      );
+    }

-      hatchChoice = (await prompter.select({
-        message: "How do you want to hatch your bot?",
-        options: [
-          { value: "tui", label: "Hatch in TUI (recommended)" },
-          { value: "web", label: "Open the Web UI" },
-          { value: "later", label: "Do this later" },
-        ],
-        initialValue: "tui",
-      })) as "tui" | "web" | "later";
+    await prompter.note(
+      [
+        "Gateway token: shared auth for the Gateway + Control UI.",
+        "Stored in: ~/.clawdbot/clawdbot.json (gateway.auth.token) or CLAWDBOT_GATEWAY_TOKEN.",
+        "Web UI stores a copy in this browser's localStorage (clawdbot.control.settings.v1).",
+        `Get the tokenized link anytime: ${formatCliCommand("clawdbot dashboard --no-open")}`,
+      ].join("\n"),
+      "Token",
+    );

-      if (hatchChoice === "tui") {
-        await runTui({
-          url: links.wsUrl,
-          token: settings.authMode === "token" ? settings.gatewayToken : undefined,
-          password: settings.authMode === "password" ? nextConfig.gateway?.auth?.password : "",
-          // Safety: onboarding TUI should not auto-deliver to lastProvider/lastTo.
-          deliver: false,
-          message: "Wake up, my friend!",
-        });
-        if (settings.authMode === "token" && settings.gatewayToken) {
-          seededInBackground = await openUrlInBackground(authedUrl);
-        }
-        if (seededInBackground) {
-          await prompter.note(
-            `Web UI seeded in the background. Open later with: ${formatCliCommand(
-              "clawdbot dashboard --no-open",
-            )}`,
-            "Web UI",
-          );
-        }
-      } else if (hatchChoice === "web") {
-        const browserSupport = await detectBrowserOpenSupport();
-        if (browserSupport.ok) {
-          controlUiOpened = await openUrl(authedUrl);
-          if (!controlUiOpened) {
-            controlUiOpenHint = formatControlUiSshHint({
-              port: settings.port,
-              basePath: controlUiBasePath,
-              token: settings.gatewayToken,
-            });
-          }
-        } else {
+    hatchChoice = (await prompter.select({
+      message: "How do you want to hatch your bot?",
+      options: [
+        { value: "tui", label: "Hatch in TUI (recommended)" },
+        { value: "web", label: "Open the Web UI" },
+        { value: "later", label: "Do this later" },
+      ],
+      initialValue: "tui",
+    })) as "tui" | "web" | "later";
+
+    if (hatchChoice === "tui") {
+      await runTui({
+        url: links.wsUrl,
+        token: settings.authMode === "token" ? settings.gatewayToken : undefined,
+        password: settings.authMode === "password" ? nextConfig.gateway?.auth?.password : "",
+        // Safety: onboarding TUI should not auto-deliver to lastProvider/lastTo.
+        deliver: false,
+        message: hasBootstrap ? "Wake up, my friend!" : undefined,
+      });
+      if (settings.authMode === "token" && settings.gatewayToken) {
+        seededInBackground = await openUrlInBackground(authedUrl);
+      }
+      if (seededInBackground) {
+        await prompter.note(
+          `Web UI seeded in the background. Open later with: ${formatCliCommand(
+            "clawdbot dashboard --no-open",
+          )}`,
+          "Web UI",
+        );
+      }
+    } else if (hatchChoice === "web") {
+      const browserSupport = await detectBrowserOpenSupport();
+      if (browserSupport.ok) {
+        controlUiOpened = await openUrl(authedUrl);
+        if (!controlUiOpened) {
          controlUiOpenHint = formatControlUiSshHint({
            port: settings.port,
            basePath: controlUiBasePath,
            token: settings.gatewayToken,
          });
        }
-        await prompter.note(
-          [
-            `Dashboard link (with token): ${authedUrl}`,
-            controlUiOpened
-              ? "Opened in your browser. Keep that tab to control Clawdbot."
-              : "Copy/paste this URL in a browser on this machine to control Clawdbot.",
-            controlUiOpenHint,
-          ]
-            .filter(Boolean)
-            .join("\n"),
-          "Dashboard ready",
-        );
      } else {
-        await prompter.note(
-          `When you're ready: ${formatCliCommand("clawdbot dashboard --no-open")}`,
-          "Later",
-        );
+        controlUiOpenHint = formatControlUiSshHint({
+          port: settings.port,
+          basePath: controlUiBasePath,
+          token: settings.gatewayToken,
+        });
      }
+      await prompter.note(
+        [
+          `Dashboard link (with token): ${authedUrl}`,
+          controlUiOpened
+            ? "Opened in your browser. Keep that tab to control Clawdbot."
+            : "Copy/paste this URL in a browser on this machine to control Clawdbot.",
+          controlUiOpenHint,
+        ]
+          .filter(Boolean)
+          .join("\n"),
+        "Dashboard ready",
+      );
    } else {
-      const browserSupport = await detectBrowserOpenSupport();
-      if (!browserSupport.ok) {
-        await prompter.note(
-          formatControlUiSshHint({
-            port: settings.port,
-            basePath: controlUiBasePath,
-            token: settings.authMode === "token" ? settings.gatewayToken : undefined,
-          }),
-          "Open Control UI",
-        );
-      } else {
-        await prompter.note(
-          "Opening Control UI automatically after onboarding (no extra prompts).",
-          "Open Control UI",
-        );
-      }
+      await prompter.note(
+        `When you're ready: ${formatCliCommand("clawdbot dashboard --no-open")}`,
+        "Later",
+      );
    }
  } else if (opts.skipUi) {
    await prompter.note("Skipping Control UI/TUI prompts.", "Control UI");
@@ -227,6 +227,61 @@ describe("runOnboardingWizard", () => {
    await fs.rm(workspaceDir, { recursive: true, force: true });
  });

+  it("offers TUI hatch even without BOOTSTRAP.md", async () => {
+    runTui.mockClear();
+
+    const workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-onboard-"));
+
+    const select: WizardPrompter["select"] = vi.fn(async (opts) => {
+      if (opts.message === "How do you want to hatch your bot?") return "tui";
+      return "quickstart";
+    });
+
+    const prompter: WizardPrompter = {
+      intro: vi.fn(async () => {}),
+      outro: vi.fn(async () => {}),
+      note: vi.fn(async () => {}),
+      select,
+      multiselect: vi.fn(async () => []),
+      text: vi.fn(async () => ""),
+      confirm: vi.fn(async () => false),
+      progress: vi.fn(() => ({ update: vi.fn(), stop: vi.fn() })),
+    };
+
+    const runtime: RuntimeEnv = {
+      log: vi.fn(),
+      error: vi.fn(),
+      exit: vi.fn((code: number) => {
+        throw new Error(`exit:${code}`);
+      }),
+    };
+
+    await runOnboardingWizard(
+      {
+        acceptRisk: true,
+        flow: "quickstart",
+        mode: "local",
+        workspace: workspaceDir,
+        authChoice: "skip",
+        skipProviders: true,
+        skipSkills: true,
+        skipHealth: true,
+        installDaemon: false,
+      },
+      runtime,
+      prompter,
+    );
+
+    expect(runTui).toHaveBeenCalledWith(
+      expect.objectContaining({
+        deliver: false,
+        message: undefined,
+      }),
+    );
+
+    await fs.rm(workspaceDir, { recursive: true, force: true });
+  });
+
  it("shows the web search hint at the end of onboarding", async () => {
    const prevBraveKey = process.env.BRAVE_API_KEY;
    delete process.env.BRAVE_API_KEY;
@@ -0,0 +1,14 @@
+import { defineConfig } from "vitest/config";
+import baseConfig from "./vitest.config.ts";
+
+const baseTest = (baseConfig as { test?: { exclude?: string[] } }).test ?? {};
+const exclude = baseTest.exclude ?? [];
+
+export default defineConfig({
+  ...baseConfig,
+  test: {
+    ...baseTest,
+    include: ["extensions/**/*.test.ts"],
+    exclude,
+  },
+});
@@ -1,15 +1,14 @@
-import { defineConfig, mergeConfig } from "vitest/config";
+import { defineConfig } from "vitest/config";
 import baseConfig from "./vitest.config.ts";

 const baseTest = (baseConfig as { test?: { exclude?: string[] } }).test ?? {};
 const exclude = baseTest.exclude ?? [];

-export default mergeConfig(
-  baseConfig,
-  defineConfig({
-    test: {
-      include: ["src/gateway/**/*.test.ts", "extensions/**/*.test.ts"],
-      exclude,
-    },
-  }),
-);
+export default defineConfig({
+  ...baseConfig,
+  test: {
+    ...baseTest,
+    include: ["src/gateway/**/*.test.ts"],
+    exclude,
+  },
+});
@@ -1,4 +1,4 @@
-import { defineConfig, mergeConfig } from "vitest/config";
+import { defineConfig } from "vitest/config";
 import baseConfig from "./vitest.config.ts";

 const baseTest = (baseConfig as { test?: { include?: string[]; exclude?: string[] } }).test ?? {};
@@ -9,12 +9,11 @@ const include = baseTest.include ?? [
 ];
 const exclude = baseTest.exclude ?? [];

-export default mergeConfig(
-  baseConfig,
-  defineConfig({
-    test: {
-      include,
-      exclude: [...exclude, "src/gateway/**", "extensions/**"],
-    },
-  }),
-);
+export default defineConfig({
+  ...baseConfig,
+  test: {
+    ...baseTest,
+    include,
+    exclude: [...exclude, "src/gateway/**", "extensions/**"],
+  },
+});
Author	SHA1	Message	Date
Peter Steinberger	9bba80a4f5	fix: note stable symlinked paths (#1505 ) (thanks @odysseus0)	2026-01-23 11:52:10 +00:00
George Zhang	05195a390c	daemon: prefer symlinked paths over realpath for stable service configs When installing the LaunchAgent/systemd service, the CLI was using fs.realpath() to resolve the entry.js path, which converted stable symlinked paths (e.g. node_modules/clawdbot) into version-specific paths (e.g. .pnpm/clawdbot@X.Y.Z/...). This caused the service to break after pnpm updates because the old versioned path no longer exists, even though the symlink still works. Now we prefer the original (symlinked) path when it's valid, keeping service configs stable across package version updates.	2026-01-23 11:48:22 +00:00
Peter Steinberger	8b7b7e154f	chore: speed up tests and update opencode models	2026-01-23 11:36:32 +00:00
Peter Steinberger	bb9bddebb4	fix: stabilize ci tests	2026-01-23 09:52:22 +00:00
Peter Steinberger	6e570561b6	docs: prefer fast install smoke for release	2026-01-23 09:18:15 +00:00
Peter Steinberger	fb6363ae58	Merge pull request #1492 from svkozak/fix-discord-accountId Discord: preserve accountId in message actions (refs #1489)	2026-01-23 09:15:54 +00:00
Peter Steinberger	1b77e086d4	Merge origin/main into fix-discord-accountId	2026-01-23 09:15:44 +00:00
Sergii Kozak	d371a4c8c3	Discord Actions: Update tests for optional config parameter	2026-01-23 01:11:54 -08:00
Peter Steinberger	03e8b7c4ba	fix: always offer TUI hatch	2026-01-23 09:07:43 +00:00
Peter Steinberger	8aadcaa1bd	test: fix discord action mocks	2026-01-23 09:06:04 +00:00
Peter Steinberger	96800c27ec	docs: update changelog for #1492	2026-01-23 09:06:04 +00:00
Peter Steinberger	13d1712850	fix: honor accountId in message actions	2026-01-23 09:06:04 +00:00
Sergii Kozak	c5546f0d5b	Discord: preserve accountId in message actions (refs #1489 )	2026-01-23 09:06:04 +00:00
Peter Steinberger	3de5ea818d	ci: speed up install smoke on PRs	2026-01-23 09:05:15 +00:00
Peter Steinberger	dc07f1e021	fix: keep core tools when allowlist is plugin-only	2026-01-23 09:02:17 +00:00
Peter Steinberger	310a248a44	docs: add exe.dev ops note	2026-01-23 09:01:02 +00:00
Peter Steinberger	88e7684258	chore: update appcast for 2026.1.22	2026-01-23 08:59:04 +00:00
Sergii Kozak	716f901504	Discord: honor accountId across channel actions (refs #1489 )	2026-01-23 00:50:50 -08:00
Peter Steinberger	e817c0cee5	fix: preserve PNG alpha fallback (#1491 ) (thanks @robbyczgw-cla)	2026-01-23 08:45:50 +00:00
Robby	e634791585	fix(media): preserve alpha channel for transparent PNGs (#1473 )	2026-01-23 08:43:01 +00:00
Peter Steinberger	78071f8ec4	docs: note SPARKLE_PRIVATE_KEY_FILE in profile	2026-01-23 08:25:20 +00:00
Sergii Kozak	dc89bc4004	Discord: preserve accountId in message actions (refs #1489 )	2026-01-22 23:51:58 -08:00