manage-channels

# Manage Channels Wire messaging channels to agent groups. See `docs/isolation-model.md` for the full isolation model. Privilege is a **user-level** concept, not a channel-level one (see `src/modules/permissions/db/user-roles.ts`, `src/modules/permissions/access.ts`). There is no "main channel" / "main group" — any user can be granted `owner` or `admin` (global or scoped to an agent group) via `grantRole()`, and messages from unknown senders are gated per-messaging-group by `unknown_sender_policy` (`strict` | `request_approval` | `public`). ## Assess Current State Read the central DB (`data/v2.db`) using these canonical queries (column names match the schema, not the CLI flags — the `register` command's `--assistant-name` is stored in `agent_groups.name`). Run each via the in-tree wrapper — the host setup deliberately ships no `sqlite3` CLI: ```bash pnpm exec tsx scripts/q.ts data/v2.db "<query>" ``` ```sql SELECT id, name AS assistant_name, folder, agent_provider FROM agent_groups; SELECT id, channel_type, platform_id, name, unknown_sender_policy FROM messaging_groups; SELECT messaging_group_id, agent_group_id, engage_mode, engage_pattern, session_mode, threads, priority FROM messaging_group_agents; SELECT user_id, role, agent_group_id FROM user_roles ORDER BY role='owner' DESC; ``` Also check `.env` for channel tokens and `src/channels/index.ts` for uncommented imports. Categorize channels as: **wired** (has DB entities + messaging_group_agents row), **configured b...