Release 0.9.0: native gocoon provider + withdraw/unstake fix + reset

.github/workflows/release.yml

@@ -199,6 +199,10 @@ jobs:
           echo "$LOG" >> "$GITHUB_OUTPUT"
           echo "EOF" >> "$GITHUB_OUTPUT"
 
+      - name: Lowercase image path for the install snippet
+        id: meta
+        run: echo "repo=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
+
       - name: Create GitHub Release
         if: steps.check.outputs.exists == 'false'
         uses: softprops/action-gh-release@v2
@@ -214,7 +218,7 @@ jobs:
 
             **Docker:**
             ```bash
-            docker run -it -v ~/.teleton:/data ghcr.io/${{ github.repository }}:latest setup
+            docker run -it -v ~/.teleton:/data ghcr.io/${{ steps.meta.outputs.repo }}:latest setup
             ```
 
             ## Changes

CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-06-19
+
+### Added
+
+- **Native `gocoon` provider**: an OpenAI-compatible, pure-Go COCOON client ([gocoon](https://github.com/TONresistor/gocoon)). Turnkey lifecycle — auto-install and integrity-verify the runner binary, supervise it, and set up / top-up / withdraw the TON payment channel from the CLI (`teleton gocoon`) or the WebUI Gocoon page. Runner pinned to v0.2.0, default model `Qwen/Qwen3-32B`.
+- **WebUI Gocoon page**: channel status (including the fund address), top-up, withdraw, unstake, and wallet reset.
+- **Codex** in the WebUI provider selector.
+
+### Changed
+
+- **Replaced the `cocoon` provider with `gocoon`** (**Breaking**). Tool-calling now uses the model's native `tools`/`tool_calls` instead of the old XML-injection shim, which has been removed (`src/cocoon/` deleted). Set `agent.provider: gocoon` and rename the `cocoon:` config block to `gocoon:` (`gocoon.port`, default `10000`); legacy `cocoon` configs are auto-migrated on load.
+- **ToolSearch mode enabled by default.**
+- **Local SSE proxy** fronts the gocoon runner — fixes the pi-ai "empty response / zero tokens" issue and surfaces runner errors to the client.
+- **Auto-start is non-fatal**: an unfunded channel keeps the agent and WebUI running so it can be funded from the Gocoon page (requires ≥2 TON free in the fund wallet).
+- Re-verify the runner binary integrity on every launch, not only on install.
+
+### Fixed
+
+- **Unstake / withdraw**: `withdrawAll` scanned the owner wallet instead of the fund wallet, so the channel close was skipped and the staked TON stayed locked while only the liquid balance was swept. Now scans the fund address and reads channel state.
+- Harden withdraw against transient errors and re-runs (idempotent, re-broadcast-safe).
+- Hold the wallet tx-lock during the agent-wallet sweep to prevent a concurrent send from stealing the seqno.
+- Gate top-up on a running runner; show the fund address in status.
+- CI: lowercase the ghcr.io path in the release-notes Docker step.
+
+### Removed
+
+- The `cocoon` provider and its XML tool-adapter (`src/cocoon/`).
+- Dead code: `events/bus`, `memory/agent/sessions`, `telegram/callbacks/*`, web `SearchInput`, `lib/a11y`, and assorted unused helpers.
+
 ## [0.8.1] - 2026-03-05
 
 ### Added

GETTING_STARTED.md

@@ -113,7 +113,7 @@ Configuration is in `~/.teleton/config.yaml`. The setup wizard generates everyth
 
 ```yaml
 agent:
-  provider: "anthropic"              # anthropic | openai | google | xai | groq | openrouter | moonshot | mistral | cerebras | zai | minimax | huggingface | cocoon | local
+  provider: "anthropic"              # anthropic | openai | google | xai | groq | openrouter | moonshot | mistral | cerebras | zai | minimax | huggingface | gocoon | local
   model: "claude-opus-4-5-20251101"
   max_tokens: 4096
   temperature: 0.7
@@ -142,7 +142,7 @@ agent:
   model: "gpt-4o"
 ```
 
-Supported: `anthropic`, `openai`, `google`, `xai`, `groq`, `openrouter`, `moonshot`, `mistral`, `cerebras`, `zai`, `minimax`, `huggingface`, `cocoon`, `local`
+Supported: `anthropic`, `openai`, `google`, `xai`, `groq`, `openrouter`, `moonshot`, `mistral`, `cerebras`, `zai`, `minimax`, `huggingface`, `gocoon`, `local`
 
 ---
 

README.md

@@ -85,7 +85,7 @@
 ## Prerequisites
 
 - **Node.js 20.0.0+** - [Download](https://nodejs.org/)
-- **LLM API Key** - One of: [Anthropic](https://console.anthropic.com/) (recommended), [OpenAI](https://platform.openai.com/), [Google](https://aistudio.google.com/), [xAI](https://console.x.ai/), [Groq](https://console.groq.com/), [OpenRouter](https://openrouter.ai/), [Moonshot](https://platform.moonshot.ai/), [Mistral](https://console.mistral.ai/), [Cerebras](https://cloud.cerebras.ai/), [ZAI](https://open.bigmodel.cn/), [MiniMax](https://platform.minimaxi.com/), [Hugging Face](https://huggingface.co/settings/tokens) — or keyless: Codex (auto-detect), Cocoon (TON), Local (Ollama/vLLM)
+- **LLM API Key** - One of: [Anthropic](https://console.anthropic.com/) (recommended), [OpenAI](https://platform.openai.com/), [Google](https://aistudio.google.com/), [xAI](https://console.x.ai/), [Groq](https://console.groq.com/), [OpenRouter](https://openrouter.ai/), [Moonshot](https://platform.moonshot.ai/), [Mistral](https://console.mistral.ai/), [Cerebras](https://cloud.cerebras.ai/), [ZAI](https://open.bigmodel.cn/), [MiniMax](https://platform.minimaxi.com/), [Hugging Face](https://huggingface.co/settings/tokens) — or keyless: Codex (auto-detect), Gocoon (TON), Local (Ollama/vLLM)
 - **Telegram Account** - Dedicated account recommended for security
 - **Telegram API Credentials** - From [my.telegram.org/apps](https://my.telegram.org/apps)
 - **Your Telegram User ID** - Message [@userinfobot](https://t.me/userinfobot)
@@ -172,7 +172,7 @@ The `teleton setup` wizard generates a fully configured `~/.teleton/config.yaml`
 
 ```yaml
 agent:
-  provider: "anthropic"              # anthropic | openai | google | xai | groq | openrouter | moonshot | mistral | cerebras | zai | minimax | huggingface | cocoon | local
+  provider: "anthropic"              # anthropic | openai | google | xai | groq | openrouter | moonshot | mistral | cerebras | zai | minimax | huggingface | gocoon | local
   api_key: "sk-ant-api03-..."
   model: "claude-haiku-4-5-20251001"
   utility_model: "claude-haiku-4-5-20251001"  # for summarization, compaction, vision
@@ -235,7 +235,7 @@ ton_proxy:                   # Optional: .ton domain proxy
 <td align="center"><br><b>ZAI</b><br>GLM-5<br><br></td>
 <td align="center"><br><b>MiniMax</b><br>M2.5<br><br></td>
 <td align="center"><br><b>Hugging Face</b><br>DeepSeek V3.2<br><br></td>
-<td align="center"><br><b>Cocoon</b><br>Decentralized (TON)<br><br></td>
+<td align="center"><br><b>Gocoon</b><br>Decentralized (TON)<br><br></td>
 <td align="center"><br><b>Local</b><br>Ollama, vLLM, LM Studio<br><br></td>
 </tr>
 </table>
@@ -475,7 +475,7 @@ The SDK provides namespaced access to core services:
 
 | Layer | Technology |
 |-------|------------|
-| LLM | Multi-provider via [pi-ai](https://github.com/mariozechner/pi-ai) (15 providers: Anthropic, Codex, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cerebras, ZAI, MiniMax, Hugging Face, Cocoon, Local) |
+| LLM | Multi-provider via [pi-ai](https://github.com/mariozechner/pi-ai) (15 providers: Anthropic, Codex, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cerebras, ZAI, MiniMax, Hugging Face, Gocoon, Local) |
 | Telegram Userbot | [GramJS](https://gram.js.org/) Layer 223 fork (MTProto) |
 | Inline Bot | [Grammy](https://grammy.dev/) (Bot API, for deals) |
 | Blockchain | [TON SDK](https://github.com/ton-org/ton) (W5R1 wallet) |
@@ -593,7 +593,7 @@ packages/sdk/               # Published @teleton-agent/sdk
 | **Payment security** | `INSERT OR IGNORE` on tx hashes prevents double-spend, atomic status transitions prevent race conditions |
 | **Exec audit** | All YOLO mode commands logged to `exec_audit` table with user, command, output, and timestamps |
 | **Pino redaction** | Structured logging with automatic redaction of apiKey, password, secret, token, mnemonic fields |
-| **Tool scoping** | Financial tools DM-only, moderation group-only, admin-only policies, per-chat permissions configurable at runtime |
+| **Tool access control** | Per-tool access level (all, allow-list, admin, off), DM vs group gated by global policies, per-group module permissions, all runtime-configurable |
 
 ### Reporting Vulnerabilities
 

docs/configuration.md

@@ -23,7 +23,7 @@ Run `teleton setup` to generate a config file interactively, or copy `config.exa
 - [plugins](#plugins)
 - [ton_proxy](#ton_proxy)
 - [api](#api)
-- [cocoon](#cocoon)
+- [gocoon](#gocoon)
 - [tonapi_key](#tonapi_key)
 - [toncenter_api_key](#toncenter_api_key)
 - [tavily_api_key](#tavily_api_key)
@@ -38,7 +38,7 @@ LLM provider and agentic loop configuration.
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| `agent.provider` | `enum` | `"anthropic"` | LLM provider. One of: `anthropic`, `codex`, `openai`, `google`, `xai`, `groq`, `openrouter`, `moonshot`, `mistral`, `cerebras`, `zai`, `minimax`, `huggingface`, `cocoon`, `local`. |
+| `agent.provider` | `enum` | `"anthropic"` | LLM provider. One of: `anthropic`, `codex`, `openai`, `google`, `xai`, `groq`, `openrouter`, `moonshot`, `mistral`, `cerebras`, `zai`, `minimax`, `huggingface`, `gocoon`, `local`. |
 | `agent.api_key` | `string` | `""` | API key for the chosen provider. Can be overridden with `TELETON_API_KEY` env var. |
 | `agent.model` | `string` | `"claude-haiku-4-5-20251001"` | Primary model ID. Auto-detected from provider if not set (only for non-Anthropic providers). |
 | `agent.utility_model` | `string` | *auto-detected* | Cheap/fast model used for summarization and compaction. If omitted, the platform selects one based on the provider (e.g., `claude-haiku-4-5-20251001` for Anthropic, `gpt-4o-mini` for OpenAI). |
@@ -96,7 +96,7 @@ When you change the `provider` and omit `model`, the platform auto-selects:
 | `zai` | `glm-5.1` | `glm-4.5-air` |
 | `minimax` | `MiniMax-M2.7` | `MiniMax-M2.7` |
 | `huggingface` | `deepseek-ai/DeepSeek-V3.2` | `Qwen/Qwen3-Next-80B-A3B-Instruct` |
-| `cocoon` | `Qwen/Qwen3-32B` | `Qwen/Qwen3-32B` |
+| `gocoon` | `Qwen/Qwen3-32B` | `Qwen/Qwen3-32B` |
 | `local` | `auto` | `auto` |
 
 ---
@@ -485,20 +485,20 @@ api:
 
 ---
 
-## cocoon
+## gocoon
 
-Cocoon Network configuration. The Cocoon provider is a decentralized LLM proxy that pays in TON. It requires an external `cocoon-cli` process running on the specified port.
+Gocoon configuration. Gocoon is a pure-Go COCOON client: a decentralized LLM that pays in TON. It exposes a native OpenAI-compatible API (with function calling) and requires the `gocoon-runner` process running on the specified port.
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| `cocoon.port` | `number` | `10000` | HTTP port of the `cocoon-cli` proxy (1-65535). |
+| `gocoon.port` | `number` | `10000` | HTTP port of the `gocoon-runner` OpenAI-compatible API (1-65535). |
 
-The `cocoon` section is optional. Only needed when `agent.provider` is set to `"cocoon"`.
+The `gocoon` section is optional. Only needed when `agent.provider` is set to `"gocoon"`.
 
 ### Example
 
 ```yaml
-cocoon:
+gocoon:
   port: 10000
 ```
 

docs/deployment.md

@@ -27,7 +27,7 @@ Before deploying, make sure you have:
 1. **Node.js 20+** (required by the `engines` field in `package.json`)
 2. **npm** (ships with Node.js)
 3. **Telegram API credentials** -- obtain `api_id` and `api_hash` from [my.telegram.org/apps](https://my.telegram.org/apps)
-4. **LLM API key** -- from your chosen provider (Anthropic, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cerebras, ZAI, MiniMax, Hugging Face, or Cocoon)
+4. **LLM API key** -- from your chosen provider (Anthropic, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cerebras, ZAI, MiniMax, Hugging Face, or Gocoon)
 5. **Build tools** (only for source/Docker builds) -- `python3`, `make`, `g++` for native modules (`better-sqlite3`)
 
 ---

knip.json

@@ -7,7 +7,6 @@
         "src/webui/**/*.ts",
         "src/agent/index.ts",
         "src/telegram/index.ts",
-        "src/telegram/callbacks/index.ts",
         "src/sdk/hooks/index.ts",
         "src/constants/index.ts",
         "src/api/**/*.ts"