@songsid/agend 2.0.11-beta.2 → 2.0.11-beta.20

package/dist/fleet-manager.js

@@ -22,7 +22,7 @@ import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, sanitizeInstanceName, saveCommandForBackend, parseSaveFilename, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -33,8 +33,10 @@ import { TopicArchiver } from "./topic-archiver.js";
 import { StatuslineWatcher } from "./statusline-watcher.js";
 import { outboundHandlers } from "./outbound-handlers.js";
 import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
+import { handleViewRequest, isViewPath } from "./view-api.js";
+import { handleSettingsRequest } from "./settings-api.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
-import { ClassicChannelManager, classicInstanceName } from "./classic-channel-manager.js";
+import { ClassicChannelManager } from "./classic-channel-manager.js";
 import { getTmuxSession } from "./config.js";
 export function resolveReplyThreadId(argsThreadId, instanceConfig) {
     if (typeof argsThreadId === "string" && argsThreadId.length > 0) {
@@ -65,6 +67,9 @@ export class FleetManager {
     adapters = new Map(); // derived view for backward compat
     /** Track which world each instance is bound to */
     instanceWorldBinding = new Map();
+    // Dedup inbound messages seen by more than one adapter (e.g. two DC bots in the
+    // same guild both receive every message). Bounded FIFO of recent message keys.
+    recentMessageIds = new Set();
     accessManager = null;
     /** Primary world (first adapter) — used for fleet-level notifications */
     get primaryWorld() { return this.worlds.values().next().value; }
@@ -115,6 +120,7 @@ export class FleetManager {
     // Web UI: SSE clients + auth token
     sseClients = new Set();
     webToken = null;
+    viewToken = null;
     constructor(dataDir) {
         this.dataDir = dataDir;
         this.lifecycle = new InstanceLifecycle(this);
@@ -174,27 +180,42 @@ export class FleetManager {
         }
         return this.routing.map;
     }
-    /** Re-register classic channels after routing rebuild (rebuild clears the table) */
+    /**
+     * Refresh each adapter's open-channel whitelist after a classic change.
+     * Classic channels are NOT registered in the routing engine (it's single-key
+     * per channel — can't represent two bots in one channel); routing resolves
+     * per-bot via ClassicChannelManager.getInstanceByChannel. Each adapter only
+     * opens the channels IT owns so a sibling bot doesn't process another's cross-
+     * guild channel.
+     */
     reregisterClassicChannels() {
         if (!this.classicChannels)
             return;
         const channels = this.classicChannels.getAll();
-        for (const ch of channels) {
-            this.routing.register(ch.channelId, { kind: "classic", name: ch.instanceName });
-        }
         // Always update adapter openChannels (including empty — clears stale entries on /stop)
-        for (const [, w] of this.worlds) {
+        for (const [adapterId, w] of this.worlds) {
             if (typeof w.adapter?.setOpenChannels === "function") {
-                w.adapter.setOpenChannels(channels.map(ch => ch.channelId));
+                const owned = channels.filter(ch => ch.adapterId === adapterId).map(ch => ch.channelId);
+                w.adapter.setOpenChannels(owned);
             }
         }
         if (channels.length > 0) {
-            this.logger.info({ count: channels.length }, "Registered classic channel routes");
+            this.logger.info({ count: channels.length }, "Refreshed classic channel open-lists");
         }
     }
     getInstanceDir(name) {
         return join(this.dataDir, "instances", name);
     }
+    /**
+     * Resolve a slash-command target in a channel. Classic channels are looked up
+     * per-bot (same-channel multi-bot); a fleet-topic instance is found via the
+     * routing engine. Used by commands that work in BOTH contexts (/ctx, /compact,
+     * /cancel). Classic-only commands (/chat, /load) must NOT use this.
+     */
+    resolveSlashTarget(channelId, adapterId) {
+        return this.classicChannels?.getInstanceByChannel(channelId, adapterId)
+            ?? this.routing.resolve(channelId)?.name;
+    }
     /** Get the adapter bound to an instance, falling back to primary adapter */
     getAdapterForInstance(name) {
         const worldId = this.instanceWorldBinding.get(name);
@@ -221,9 +242,22 @@ export class FleetManager {
         const world = this.getWorldForInstance(name);
         return world?.groupId ?? String(this.fleetConfig?.channel?.group_id ?? "");
     }
-    /** Bind an instance to a specific world. fromInbound=true skips general_topic to prevent overwrite. */
+    /**
+     * Bind an instance to a specific world (the bot that answers for it).
+     * fromInbound=true (binding inferred from which adapter received a message)
+     * must not override a configured identity: skip when the instance is a general
+     * or has an explicit channel_id — otherwise a persona instance whose message
+     * was also seen by the main bot would get rebound to the wrong bot.
+     */
     bindInstanceAdapter(name, adapterId, fromInbound = false) {
-        if (fromInbound && this.fleetConfig?.instances[name]?.general_topic)
+        const cfg = this.fleetConfig?.instances[name];
+        if (fromInbound && (cfg?.general_topic || cfg?.channel_id))
+            return;
+        // A classic instance is bound authoritatively at /start. Don't let an inbound
+        // (seen by every same-guild bot) override an existing binding — but if there
+        // is none yet (e.g. after a restart, before v2.1 persistence), allow inbound
+        // to re-establish it so replies don't fall back to the primary bot forever.
+        if (fromInbound && this.classicChannels?.getChannelIdByInstance(name) !== undefined && this.instanceWorldBinding.has(name))
             return;
         this.instanceWorldBinding.set(name, adapterId);
     }
@@ -393,10 +427,19 @@ export class FleetManager {
         const pidPath = join(this.dataDir, "fleet.pid");
         writeFileSync(pidPath, String(process.pid), "utf-8");
         this.eventLog = new EventLog(join(this.dataDir, "events.db"));
-        // Initialize classic channel manager and register existing channels in routing
+        // Initialize classic channel manager. The primary adapter (channels[0])
+        // migrates legacy single-bot entries and names without a suffix. Classic
+        // routing does NOT go through the routing engine (single-key, can't hold two
+        // bots in one channel) — it resolves per-bot via getInstanceByChannel.
         this.classicChannels = new ClassicChannelManager(this.dataDir, this.logger);
+        const primaryCh = fleet.channels?.[0] ?? fleet.channel;
+        if (primaryCh)
+            this.classicChannels.setPrimaryAdapterId(primaryCh.id ?? primaryCh.type);
+        // Restore the persisted bot binding so replies/cancel go through the right
+        // bot after a restart (before this, inbound would re-bind lazily).
         for (const ch of this.classicChannels.getAll()) {
-            this.routing.register(ch.channelId, { kind: "classic", name: ch.instanceName });
+            if (ch.adapterId)
+                this.instanceWorldBinding.set(ch.instanceName, ch.adapterId);
         }
         // Poll classicBot.yaml for external changes every 30s
         this.classicReloadTimer = setInterval(async () => {
@@ -474,8 +517,9 @@ export class FleetManager {
         // Rotate classic channel chat logs daily (piggyback on daily summary timer)
         this.classicChannels?.rotateLogs();
         this.rotateInboxes();
-        // Auto-create general instance(s) — one per adapter that lacks a general
+        // Auto-create/adopt a general dispatcher — ONLY for the primary adapter.
         const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
+        const primaryAdapterId = channelConfigs[0] ? (channelConfigs[0].id ?? channelConfigs[0].type) : undefined;
         const generalInstances = Object.entries(fleet.instances).filter(([, inst]) => inst.general_topic === true);
         let generalsCreated = false;
         // Collect unbound generals (no channel_id set) for auto-assignment
@@ -484,6 +528,14 @@ export class FleetManager {
         const needsGeneral = [];
         for (const ch of channelConfigs) {
             const adapterId = ch.id ?? ch.type;
+            // Only the primary adapter gets an auto-general. Secondary (persona) bots
+            // answer for their explicitly-bound instances only — they don't need or
+            // auto-claim a general dispatcher, and must never adopt the primary's
+            // unbound general. A general a user manually bound to a secondary
+            // (channel_id: <persona>) is left untouched — the auto logic just won't
+            // create or reassign bindings for non-primary adapters.
+            if (adapterId !== primaryAdapterId)
+                continue;
             // Check if any general is explicitly bound to this adapter
             if (generalInstances.some(([, inst]) => inst.channel_id === adapterId))
                 continue;
@@ -606,12 +658,19 @@ export class FleetManager {
             catch (err) {
                 this.logger.error({ err }, "startSharedAdapter failed — fleet continues without some adapters");
             }
-            // Pre-bind general instances to their corresponding adapter
+            // Bind instances to their adapter (which bot answers on their behalf).
+            // An explicit channel_id is authoritative — this is how a persona instance
+            // picks its bot when several share one guild. Generals without a channel_id
+            // fall back to a name-contains-adapterId heuristic.
+            const channelConfigsForBind = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
             for (const [name, config] of Object.entries(fleet.instances)) {
+                if (config.channel_id) {
+                    this.bindInstanceAdapter(name, config.channel_id);
+                    continue;
+                }
                 if (!config.general_topic)
                     continue;
-                const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
-                for (const ch of channelConfigs) {
+                for (const ch of channelConfigsForBind) {
                     const id = ch.id ?? ch.type;
                     if (name.includes(id)) {
                         this.bindInstanceAdapter(name, id);
@@ -741,9 +800,13 @@ export class FleetManager {
         const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
         if (channelConfigs.length === 0)
             return;
-        // Start primary adapter (first channel) — this.adapter for backward compat
+        // Start primary adapter (first channel) — this.adapter for backward compat.
         await this.startSingleAdapter(fleet, channelConfigs[0]);
-        // Start additional adapters
+        // Start additional adapters. Every bot registers its own slash commands —
+        // Discord slash commands are per-application, so a same-guild secondary bot's
+        // /start etc. are distinct entries (labelled with the bot name) and the
+        // interaction only reaches the invoked bot. This is how ClassicBot supports
+        // multiple bots in one guild: the user picks which bot from autocomplete.
         for (let i = 1; i < channelConfigs.length; i++) {
             await this.startAdditionalAdapter(channelConfigs[i]);
         }
@@ -813,11 +876,11 @@ export class FleetManager {
         // Handle classic bot slash commands (/start, /stop, /chat, /compact, /save, /load)
         this.adapter.on("slash_command", safeHandler(async (data) => {
             if (data.command === "start") {
-                const reply = await this.handleClassicStart(data.channelId, data.channelName, data.userId, data.guildId);
+                const reply = await this.handleClassicStart(data.channelId, data.channelName, data.userId, data.guildId, adapterId);
                 await data.respond(reply);
             }
             else if (data.command === "stop") {
-                const reply = await this.handleClassicStop(data.channelId);
+                const reply = await this.handleClassicStop(data.channelId, adapterId);
                 await data.respond(reply);
             }
             else if (data.command === "chat") {
@@ -826,15 +889,15 @@ export class FleetManager {
                     await data.respond("Usage: `/chat <message>`");
                     return;
                 }
-                const target = this.routing.resolve(data.channelId);
-                if (!target || target.kind !== "classic") {
+                const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
                 const replyMsgId = await data.respond("👀");
                 const username = data.username ?? data.userId;
-                ClassicChannelManager.logMessage(target.name, username, `/chat ${text}`, new Date());
-                await this.forwardToClassicInstance(target.name, text, {
+                ClassicChannelManager.logMessage(name, username, `/chat ${text}`, new Date());
+                await this.forwardToClassicInstance(name, text, {
                     chatId: data.channelId,
                     threadId: data.channelId,
                     messageId: replyMsgId ?? "",
@@ -845,7 +908,7 @@ export class FleetManager {
                 });
             }
             else if (data.command === "save") {
-                await this.handleSlashSave(data);
+                await this.handleSlashSave(data, adapterId);
             }
             else if (data.command === "load") {
                 // load is kiro-cli/classic only — no claude-code equivalent.
@@ -853,8 +916,8 @@ export class FleetManager {
                     await data.respond("⛔ This command requires admin access.");
                     return;
                 }
-                const target = this.routing.resolve(data.channelId);
-                if (!target || target.kind !== "classic") {
+                const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
@@ -863,39 +926,41 @@ export class FleetManager {
                     await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
                     return;
                 }
-                this.pasteRawToClassicInstance(target.name, `/chat load ${filename}`);
-                await data.respond(`✅ Sent \`/chat load ${filename}\` to ${target.name}`);
+                this.pasteRawToClassicInstance(name, `/chat load ${filename}`);
+                await data.respond(`✅ Sent \`/chat load ${filename}\` to ${name}`);
             }
             else if (data.command === "compact") {
-                const target = this.routing.resolve(data.channelId);
-                if (!target) {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
-                const result = await this.topicCommands.sendCompact(target.name);
+                const result = await this.topicCommands.sendCompact(name);
                 await data.respond(result);
             }
             else if (data.command === "cancel") {
-                const target = this.routing.resolve(data.channelId);
-                if (!target) {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
-                const ok = this.cancelInstance(target.name);
-                await data.respond(ok ? `🛑 Sent cancel to ${target.name}.` : `❌ ${target.name} not running.`);
+                const ok = this.cancelInstance(name);
+                await data.respond(ok ? `🛑 Sent cancel to ${name}.` : `❌ ${name} not running.`);
             }
             else if (data.command === "ctx") {
-                const target = this.routing.resolve(data.channelId);
-                if (!target) {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
                 // Single source of truth (statusline.json + robust tmux pane fallback).
-                await data.respond(await this.topicCommands.getCtxText(target.name));
+                await data.respond(await this.topicCommands.getCtxText(name));
             }
             else if (data.command === "collab") {
+                // Classic no longer lives in the routing engine, so a routing hit here is
+                // always a fleet-topic instance.
                 const collabTarget = this.routing.resolve(data.channelId);
-                if (collabTarget && collabTarget.kind !== "classic") {
+                if (collabTarget) {
                     const allowed = this.fleetConfig?.channel?.access?.allowed_users ?? [];
                     if (allowed.length > 0 && !allowed.some(u => String(u) === String(data.userId))) {
                         await data.respond("⛔ Not authorized");
@@ -909,11 +974,11 @@ export class FleetManager {
                     await data.respond("⛔ This command requires admin access.");
                     return;
                 }
-                if (!this.classicChannels.isClassicChannel(data.channelId)) {
+                if (!this.classicChannels.isClassicChannel(data.channelId, adapterId)) {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
-                const newState = this.classicChannels.toggleCollab(data.channelId);
+                const newState = this.classicChannels.toggleCollab(data.channelId, adapterId);
                 await data.respond(newState
                     ? "🤝 Collaboration mode **ON** — @mention this bot to trigger the agent. Other bot messages are visible."
                     : "💬 Collaboration mode **OFF** — use `/chat` to talk to the agent.");
@@ -966,12 +1031,12 @@ export class FleetManager {
                 process.kill(process.pid, "SIGUSR2");
             }
             else if (data.command === "compact") {
-                const target = this.routing.resolve(data.channelId);
-                if (!target) {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
-                const result = await this.topicCommands.sendCompact(target.name);
+                const result = await this.topicCommands.sendCompact(name);
                 await data.respond(result);
             }
         }, this.logger, "adapter.slash_command"));
@@ -1015,7 +1080,7 @@ export class FleetManager {
         }, 5 * 60 * 1000);
     }
     /** Start an additional (non-primary) adapter */
-    async startAdditionalAdapter(channelConfig) {
+    async startAdditionalAdapter(channelConfig, registerCommands = true) {
         const adapterId = channelConfig.id ?? channelConfig.type;
         const botToken = process.env[channelConfig.bot_token_env];
         if (!botToken) {
@@ -1032,6 +1097,7 @@ export class FleetManager {
             botToken,
             accessManager,
             inboxDir,
+            registerCommands,
         });
         const world = new AdapterWorld(adapterId, adapter, accessManager, channelConfig);
         this.worlds.set(adapterId, world);
@@ -1075,11 +1141,11 @@ export class FleetManager {
         // Slash commands: classic bot + admin commands
         adapter.on("slash_command", safeHandler(async (data) => {
             if (data.command === "start") {
-                const reply = await this.handleClassicStart(data.channelId, data.channelName, data.userId, data.guildId);
+                const reply = await this.handleClassicStart(data.channelId, data.channelName, data.userId, data.guildId, adapterId);
                 await data.respond(reply);
             }
             else if (data.command === "stop") {
-                const reply = await this.handleClassicStop(data.channelId);
+                const reply = await this.handleClassicStop(data.channelId, adapterId);
                 await data.respond(reply);
             }
             else if (data.command === "chat") {
@@ -1088,15 +1154,15 @@ export class FleetManager {
                     await data.respond("Usage: `/chat <message>`");
                     return;
                 }
-                const target = this.routing.resolve(data.channelId);
-                if (!target || target.kind !== "classic") {
+                const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
                 const replyMsgId = await data.respond("👀");
                 const username = data.username ?? data.userId;
-                ClassicChannelManager.logMessage(target.name, username, `/chat ${text}`, new Date());
-                await this.forwardToClassicInstance(target.name, text, {
+                ClassicChannelManager.logMessage(name, username, `/chat ${text}`, new Date());
+                await this.forwardToClassicInstance(name, text, {
                     chatId: data.channelId,
                     threadId: data.channelId,
                     messageId: replyMsgId ?? "",
@@ -1107,7 +1173,7 @@ export class FleetManager {
                 });
             }
             else if (data.command === "save") {
-                await this.handleSlashSave(data);
+                await this.handleSlashSave(data, adapterId);
             }
             else if (data.command === "load") {
                 // load is kiro-cli/classic only — no claude-code equivalent.
@@ -1115,8 +1181,8 @@ export class FleetManager {
                     await data.respond("⛔ This command requires admin access.");
                     return;
                 }
-                const target = this.routing.resolve(data.channelId);
-                if (!target || target.kind !== "classic") {
+                const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
@@ -1125,39 +1191,32 @@ export class FleetManager {
                     await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
                     return;
                 }
-                this.pasteRawToClassicInstance(target.name, `/chat load ${filename}`);
-                await data.respond(`✅ Sent \`/chat load ${filename}\` to ${target.name}`);
-            }
-            else if (data.command === "compact") {
-                const target = this.routing.resolve(data.channelId);
-                if (!target) {
-                    await data.respond("No active agent in this channel.");
-                    return;
-                }
-                const result = await this.topicCommands.sendCompact(target.name);
-                await data.respond(result);
+                this.pasteRawToClassicInstance(name, `/chat load ${filename}`);
+                await data.respond(`✅ Sent \`/chat load ${filename}\` to ${name}`);
             }
             else if (data.command === "cancel") {
-                const target = this.routing.resolve(data.channelId);
-                if (!target) {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
-                const ok = this.cancelInstance(target.name);
-                await data.respond(ok ? `🛑 Sent cancel to ${target.name}.` : `❌ ${target.name} not running.`);
+                const ok = this.cancelInstance(name);
+                await data.respond(ok ? `🛑 Sent cancel to ${name}.` : `❌ ${name} not running.`);
             }
             else if (data.command === "ctx") {
-                const target = this.routing.resolve(data.channelId);
-                if (!target) {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
                 // Single source of truth (statusline.json + robust tmux pane fallback).
-                await data.respond(await this.topicCommands.getCtxText(target.name));
+                await data.respond(await this.topicCommands.getCtxText(name));
             }
             else if (data.command === "collab") {
+                // Classic no longer lives in the routing engine, so a routing hit here is
+                // always a fleet-topic instance.
                 const collabTarget2 = this.routing.resolve(data.channelId);
-                if (collabTarget2 && collabTarget2.kind !== "classic") {
+                if (collabTarget2) {
                     const allowed = this.fleetConfig?.channel?.access?.allowed_users ?? [];
                     if (allowed.length > 0 && !allowed.some(u => String(u) === String(data.userId))) {
                         await data.respond("⛔ Not authorized");
@@ -1171,11 +1230,11 @@ export class FleetManager {
                     await data.respond("⛔ This command requires admin access.");
                     return;
                 }
-                if (!this.classicChannels.isClassicChannel(data.channelId)) {
+                if (!this.classicChannels.isClassicChannel(data.channelId, adapterId)) {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
-                const newState = this.classicChannels.toggleCollab(data.channelId);
+                const newState = this.classicChannels.toggleCollab(data.channelId, adapterId);
                 await data.respond(newState
                     ? "🤝 Collaboration mode **ON** — @mention this bot to trigger the agent. Other bot messages are visible."
                     : "💬 Collaboration mode **OFF** — use `/chat` to talk to the agent.");
@@ -1228,12 +1287,12 @@ export class FleetManager {
                 process.kill(process.pid, "SIGUSR2");
             }
             else if (data.command === "compact") {
-                const target = this.routing.resolve(data.channelId);
-                if (!target) {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
-                const result = await this.topicCommands.sendCompact(target.name);
+                const result = await this.topicCommands.sendCompact(name);
                 await data.respond(result);
             }
         }, this.logger, `adapter[${adapterId}].slash_command`));
@@ -1451,6 +1510,34 @@ export class FleetManager {
     async handleInboundMessage(msg) {
         const threadId = msg.threadId || undefined;
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
+        // Multi-adapter dedup: when several bots share a guild, each adapter fires
+        // its own "message" event for the same underlying message. Process it once.
+        // Routing (by topic/channel) and reply-adapter selection (by channel_id
+        // binding) are adapter-independent, so it's safe to let whichever adapter
+        // arrives first handle it.
+        //
+        // EXCEPTION — classic channels with same-channel multi-bot: two bots may own
+        // separate agents in one channel, so each bot must process its OWN copy of
+        // the message (the @mention filter downstream decides who actually forwards).
+        // Key the dedup per-adapter there so a sibling bot's copy isn't dropped.
+        if (msg.messageId) {
+            const classicCid = msg.threadId || msg.chatId;
+            const isClassicMsg = this.classicChannels?.hasChannel(classicCid) ?? false;
+            const dedupKey = isClassicMsg
+                ? `${msg.source}:${msg.chatId}:${msg.messageId}:${msg.adapterId ?? ""}`
+                : `${msg.source}:${msg.chatId}:${msg.messageId}`;
+            if (this.recentMessageIds.has(dedupKey)) {
+                this.logger.debug({ dedupKey, adapterId: msg.adapterId }, "Duplicate inbound across adapters — skipping");
+                return;
+            }
+            this.recentMessageIds.add(dedupKey);
+            if (this.recentMessageIds.size > 1000) {
+                // Set preserves insertion order — drop the oldest key.
+                const oldest = this.recentMessageIds.values().next().value;
+                if (oldest !== undefined)
+                    this.recentMessageIds.delete(oldest);
+            }
+        }
         // Bot messages: only allow in collab channels or TG classic with @mention
         if (msg.isBotMessage) {
             if (!threadId) {
@@ -1465,21 +1552,25 @@ export class FleetManager {
                     return;
                 // Fall through to TG classic handling below
             }
+            else if (this.classicChannels?.hasChannel(threadId)) {
+                // Classic channel (per-bot): bot messages only when THIS bot owns an
+                // agent here and collab is on for it.
+                const classicName = this.classicChannels.getInstanceByChannel(threadId, msg.adapterId);
+                if (!classicName)
+                    return;
+                if (!this.classicChannels.isCollab(threadId, msg.adapterId))
+                    return;
+                // Fall through to channel handling
+            }
             else {
                 const target = this.routing.resolve(threadId);
                 if (!target)
                     return;
-                if (target.kind === "classic") {
-                    if (!this.classicChannels?.isCollab(threadId))
-                        return;
-                }
-                else {
-                    // Fleet topic: allow if collab enabled OR access mode is open
-                    const channelCfg = this.getChannelConfig(msg.adapterId);
-                    const isOpen = channelCfg?.access?.mode === "open";
-                    if (!isOpen && !this.collabInstances.has(target.name))
-                        return;
-                }
+                // Fleet topic: allow if collab enabled OR access mode is open
+                const channelCfg = this.getChannelConfig(msg.adapterId);
+                const isOpen = channelCfg?.access?.mode === "open";
+                if (!isOpen && !this.collabInstances.has(target.name))
+                    return;
                 // Fall through to channel handling
             }
         }
@@ -1489,9 +1580,10 @@ export class FleetManager {
             const adapterGroupId = String(this.getChannelConfig(msg.adapterId)?.group_id ?? "");
             const isTelegramClassicCandidate = msg.source === "telegram" && msg.chatId !== adapterGroupId && !threadId;
             if (!isTelegramClassicCandidate) {
-                const target = threadId ? this.routing.resolve(threadId) : undefined;
-                this.logger.info({ userId: msg.userId, threadId, targetKind: target?.kind, targetName: target?.name }, "Access DENIED for non-allowed user");
-                if (!target || target.kind !== "classic")
+                // Classic channels are open to all; check per-bot ownership (or fleet topic).
+                const isClassic = !!(threadId && this.classicChannels?.hasChannel(threadId));
+                this.logger.info({ userId: msg.userId, threadId, isClassic }, "Access DENIED for non-allowed user");
+                if (!isClassic)
                     return;
             }
         }
@@ -1564,9 +1656,8 @@ export class FleetManager {
                         }
                     }
                     const channelName = msg.username || chatId;
-                    const reply = await this.handleClassicStart(chatId, channelName, msg.userId);
-                    if (msg.adapterId)
-                        this.bindInstanceAdapter(classicInstanceName(sanitizeInstanceName(channelName || chatId), chatId), msg.adapterId, true);
+                    // handleClassicStart binds the instance to this adapter authoritatively.
+                    const reply = await this.handleClassicStart(chatId, channelName, msg.userId, undefined, msg.adapterId);
                     await msgAdapter?.sendText(chatId, reply);
                     return;
                 }
@@ -1580,7 +1671,7 @@ export class FleetManager {
                         }
                         return;
                     }
-                    const reply = await this.handleClassicStop(chatId);
+                    const reply = await this.handleClassicStop(chatId, msg.adapterId);
                     await msgAdapter?.sendText(chatId, reply);
                     return;
                 }
@@ -1590,34 +1681,34 @@ export class FleetManager {
                         await msgAdapter?.sendText(chatId, "⛔ /compact requires admin access.");
                         return;
                     }
-                    const compactTarget = this.routing.resolve(chatId);
-                    if (!compactTarget || compactTarget.kind !== "classic") {
+                    const compactName = this.classicChannels.getInstanceByChannel(chatId, msg.adapterId);
+                    if (!compactName) {
                         await msgAdapter?.sendText(chatId, "No active agent. Use /start first.");
                         return;
                     }
-                    const result = await this.topicCommands.sendCompact(compactTarget.name);
+                    const result = await this.topicCommands.sendCompact(compactName);
                     await msgAdapter?.sendText(chatId, result);
                     return;
                 }
                 // Handle /cancel command
                 if (text === "/cancel" || text.startsWith("/cancel@")) {
-                    const cancelTarget = this.routing.resolve(chatId);
-                    if (!cancelTarget || cancelTarget.kind !== "classic") {
+                    const cancelName = this.classicChannels.getInstanceByChannel(chatId, msg.adapterId);
+                    if (!cancelName) {
                         await msgAdapter?.sendText(chatId, "No active agent. Use /start first.");
                         return;
                     }
-                    const ok = this.cancelInstance(cancelTarget.name);
-                    await msgAdapter?.sendText(chatId, ok ? `🛑 已送出取消給 ${cancelTarget.name}。` : `❌ ${cancelTarget.name} 未在執行。`);
+                    const ok = this.cancelInstance(cancelName);
+                    await msgAdapter?.sendText(chatId, ok ? `🛑 已送出取消給 ${cancelName}。` : `❌ ${cancelName} 未在執行。`);
                     return;
                 }
                 // Handle /ctx command
                 if (text === "/ctx" || text.startsWith("/ctx@")) {
-                    const ctxTarget = this.routing.resolve(chatId);
-                    if (!ctxTarget || ctxTarget.kind !== "classic") {
+                    const ctxName = this.classicChannels.getInstanceByChannel(chatId, msg.adapterId);
+                    if (!ctxName) {
                         await msgAdapter?.sendText(chatId, "No active agent. Use /start first.");
                         return;
                     }
-                    const reply = await this.topicCommands.getCtxText(ctxTarget.name);
+                    const reply = await this.topicCommands.getCtxText(ctxName);
                     await msgAdapter?.sendText(chatId, reply);
                     return;
                 }
@@ -1627,8 +1718,8 @@ export class FleetManager {
                         await msgAdapter?.sendText(chatId, "⛔ /save requires admin access.");
                         return;
                     }
-                    const saveTarget = this.routing.resolve(chatId);
-                    if (!saveTarget || saveTarget.kind !== "classic") {
+                    const saveName = this.classicChannels.getInstanceByChannel(chatId, msg.adapterId);
+                    if (!saveName) {
                         await msgAdapter?.sendText(chatId, "No active agent. Use /start first.");
                         return;
                     }
@@ -1641,26 +1732,26 @@ export class FleetManager {
                         await msgAdapter?.sendText(chatId, "⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
                         return;
                     }
-                    const backend = this.classicChannels.getBackendByInstance(saveTarget.name, this.fleetConfig?.defaults?.backend);
+                    const backend = this.classicChannels.getBackendByInstance(saveName, this.fleetConfig?.defaults?.backend);
                     const cmd = saveCommandForBackend(backend, filename);
                     if (!cmd) {
                         await msgAdapter?.sendText(chatId, SAVE_UNSUPPORTED_MSG);
                         return;
                     }
-                    this.pasteRawToClassicInstance(saveTarget.name, cmd);
-                    await msgAdapter?.sendText(chatId, `✅ Sent \`${cmd}\` to ${saveTarget.name}`);
+                    this.pasteRawToClassicInstance(saveName, cmd);
+                    await msgAdapter?.sendText(chatId, `✅ Sent \`${cmd}\` to ${saveName}`);
                     return;
                 }
-                // Route to classic channel if registered
-                const target = this.routing.resolve(chatId);
-                if (target?.kind === "classic") {
+                // Route to classic channel if this bot has an agent here (per-bot).
+                const classicName = this.classicChannels.getInstanceByChannel(chatId, msg.adapterId);
+                if (classicName) {
                     if (msg.adapterId)
-                        this.bindInstanceAdapter(target.name, msg.adapterId, true);
+                        this.bindInstanceAdapter(classicName, msg.adapterId, true);
                     // TG ClassicBot: group requires @mention, private chat forwards directly.
                     if (!isPrivateChat && !isBotMentioned) {
                         // No trigger: save attachments + react, log, but don't forward to agent
                         const syntheticMsg = { ...msg, threadId: chatId, text: rawText.startsWith("/") ? "" : rawText };
-                        await this.handleClassicChannelMessage(target.name, syntheticMsg);
+                        await this.handleClassicChannelMessage(classicName, syntheticMsg);
                         return;
                     }
                     // Strip @bot from text and forward as /chat
@@ -1670,7 +1761,7 @@ export class FleetManager {
                         return;
                     }
                     const syntheticMsg = { ...msg, threadId: chatId, text: `/chat ${cleanText}` };
-                    await this.handleClassicChannelMessage(target.name, syntheticMsg);
+                    await this.handleClassicChannelMessage(classicName, syntheticMsg);
                     return;
                 }
                 // Handle @bot without active agent
@@ -1695,9 +1786,12 @@ export class FleetManager {
                 if (msg.adapterId)
                     this.bindInstanceAdapter(generalInstance, msg.adapterId, true);
                 const inboundAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
-                // React immediately — before any other API calls
+                // React immediately — before any other API calls. Use the adapter BOUND to
+                // the instance (not whichever same-guild bot received the event first) so
+                // exactly the owning bot reacts — no duplicate 👀 from a sibling bot.
                 if (msg.chatId && msg.messageId) {
-                    inboundAdapter.react(msg.threadId ?? msg.chatId, msg.messageId, "👀")
+                    const reactAdapter = this.getAdapterForInstance(generalInstance) ?? inboundAdapter;
+                    reactAdapter.react(msg.threadId ?? msg.chatId, msg.messageId, "👀")
                         .catch(e => this.logger.debug({ err: e.message }, "Auto-react failed"));
                 }
                 this.warnIfRateLimited(generalInstance, msg);
@@ -1733,6 +1827,18 @@ export class FleetManager {
             }
             return;
         }
+        // Classic channels resolve per-bot (same-channel multi-bot) — a channel can
+        // host two bots' agents. If this channel is classic but THIS bot has no
+        // agent here, a sibling bot owns it; skip rather than misroute to it.
+        if (this.classicChannels?.hasChannel(threadId)) {
+            const classicName = this.classicChannels.getInstanceByChannel(threadId, msg.adapterId);
+            if (!classicName)
+                return;
+            if (msg.adapterId)
+                this.bindInstanceAdapter(classicName, msg.adapterId, true);
+            await this.handleClassicChannelMessage(classicName, msg);
+            return;
+        }
         const target = this.routing.resolve(threadId);
         if (!target) {
             // Only show unbound message for actual forum topics (same group, has threadId)
@@ -1764,9 +1870,12 @@ export class FleetManager {
         if (msg.adapterId)
             this.bindInstanceAdapter(instanceName, msg.adapterId, true);
         const inboundAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
-        // React immediately — before any other Discord API calls
+        // React immediately — before any other Discord API calls. Use the adapter
+        // BOUND to the instance (not whichever same-guild bot received the event
+        // first) so exactly the owning bot reacts — no duplicate 👀 from a sibling.
         if (msg.chatId && msg.messageId) {
-            inboundAdapter.react(this.reactTarget(msg), msg.messageId, "👀")
+            const reactAdapter = this.getAdapterForInstance(instanceName) ?? inboundAdapter;
+            reactAdapter.react(this.reactTarget(msg), msg.messageId, "👀")
                 .catch(e => this.logger.debug({ err: e.message }, "Auto-react failed"));
         }
         // These may hit Discord API (topic icon, archive) — do after react
@@ -1891,7 +2000,7 @@ export class FleetManager {
                     ts: new Date().toISOString(),
                 });
                 // Log bot reply to classic instance chat-log
-                const isClassic = [...this.routing.entries()].some(([, t]) => t.kind === "classic" && t.name === instanceName);
+                const isClassic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined;
                 if (isClassic) {
                     ClassicChannelManager.logMessage(instanceName, "bot", args.text ?? "", new Date());
                 }
@@ -2510,15 +2619,17 @@ export class FleetManager {
     startStatuslineWatcher(name) {
         this.statuslineWatcher.watch(name);
     }
-    reactMessageStatus(chatId, messageId, emoji) {
-        // Find the adapter that owns this chatId (check all adapters, not just primary)
-        for (const [, w] of this.worlds) {
-            if (w.type === "discord") {
-                w.react(chatId, messageId, emoji)
-                    .catch(e => this.logger.debug({ err: e.message }, "Message status react failed"));
-                return;
-            }
-        }
+    reactMessageStatus(instanceName, chatId, messageId, emoji) {
+        // React via the adapter BOUND to this instance — NOT the first discord world.
+        // Otherwise, in a same-channel/same-guild multi-bot setup, the inbound 👀
+        // (bound bot) and the delivery/confirm reactions (some other bot) come from
+        // different bots, leaving a duplicate 👀 that never turns into ✅.
+        const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
+        // Status reactions are Discord-only (TG/others use the inbound react path).
+        if (!adapter || adapter.type !== "discord")
+            return;
+        adapter.react(chatId, messageId, emoji)
+            .catch(e => this.logger.debug({ err: e.message }, "Message status react failed"));
     }
     // ── Model failover ──────────────────────────────────────────────────────
     static FAILOVER_TRIGGER_PCT = 90;
@@ -2580,13 +2691,12 @@ export class FleetManager {
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send instance topic notification"));
             return;
         }
-        // Classic instance: find chatId from routing table
-        for (const [chatId, target] of this.routing.entries()) {
-            if (target.kind === "classic" && target.name === instanceName) {
-                adapter.sendText(chatId, text)
-                    .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send classic notification"));
-                return;
-            }
+        // Classic instance: find its channelId from the classic manager
+        const classicChatId = this.classicChannels?.getChannelIdByInstance(instanceName);
+        if (classicChatId) {
+            adapter.sendText(classicChatId, text)
+                .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send classic notification"));
+            return;
         }
         // Fallback: send to group without threadId
         if (groupId) {
@@ -2603,12 +2713,16 @@ export class FleetManager {
      * Picks the backend-appropriate command (kiro → /chat save, claude → /export);
      * unsupported backends get a clear error. Routes via classic paste or fleet IPC.
      */
-    async handleSlashSave(data) {
+    async handleSlashSave(data, adapterId) {
         if (!this.classicChannels?.isAdmin(data.userId)) {
             await data.respond("⛔ This command requires admin access.");
             return;
         }
-        const target = this.routing.resolve(data.channelId);
+        // Classic resolves per-bot (same-channel multi-bot); otherwise a fleet topic.
+        const classicName = this.classicChannels.getInstanceByChannel(data.channelId, adapterId);
+        const target = classicName
+            ? { kind: "classic", name: classicName }
+            : this.routing.resolve(data.channelId);
         if (!target) {
             await data.respond("No active agent in this channel. Use `/start` first.");
             return;
@@ -2663,13 +2777,8 @@ export class FleetManager {
             threadId = String(topicId);
         }
         else {
-            // Classic instance: chatId from the routing table.
-            for (const [cid, target] of this.routing.entries()) {
-                if (target.kind === "classic" && target.name === instanceName) {
-                    chatId = cid;
-                    break;
-                }
-            }
+            // Classic instance: channelId from the classic manager.
+            chatId = this.classicChannels?.getChannelIdByInstance(instanceName);
             // General / flat fallback: post to the group (no thread).
             if (!chatId && groupId)
                 chatId = String(groupId);
@@ -3152,7 +3261,7 @@ When users create specialized instances, suggest these configurations:
     async handleClassicChannelMessage(instanceName, msg) {
         const text = msg.text ?? "";
         const channelId = msg.threadId ?? msg.chatId;
-        const isCollabMode = this.classicChannels?.isCollab(channelId) ?? false;
+        const isCollabMode = this.classicChannels?.isCollab(channelId, msg.adapterId) ?? false;
         // Handle /ctx in classic mode — always, regardless of collab mode
         if (text === "/ctx" || text.startsWith("/ctx@")) {
             const reply = await this.topicCommands.getCtxText(instanceName);
@@ -3179,8 +3288,15 @@ When users create specialized instances, suggest these configurations:
                     : "");
             ClassicChannelManager.logMessage(instanceName, msg.username, text + collabAttachTag, msg.timestamp, msg.replyToText);
             this.logger.info({ instanceName, user: msg.username, textLen: text.length, attachments: msg.attachments?.length ?? 0, source: msg.source }, "Collab mode message");
-            // Check for @mention trigger: must be exact <@BOT_USER_ID>, not @everyone/@here
-            const adapterBotUserId = this.worlds.get(msg.adapterId ?? "")?.botUserId ?? this.botUserId;
+            // Check for @mention trigger: must be exact <@BOT_USER_ID>, not @everyone/@here.
+            // Each bot matches ONLY its own id. A secondary bot must NOT fall back to the
+            // process-wide botUserId (the primary's) — otherwise, in a same-channel
+            // multi-bot setup, an @mention of the primary would also match the secondary
+            // and BOTH bots would react 👀 and forward. Only the primary adapter may use
+            // the fallback.
+            const mentionWorld = this.worlds.get(msg.adapterId ?? "");
+            const isPrimaryAdapter = !mentionWorld || mentionWorld.adapter === this.adapter;
+            const adapterBotUserId = mentionWorld?.botUserId ?? (isPrimaryAdapter ? this.botUserId : undefined);
             const mentionTag = adapterBotUserId ? `<@${adapterBotUserId}>` : null;
             const isMentioned = mentionTag && text.includes(mentionTag);
             if (!isMentioned) {
@@ -3358,7 +3474,11 @@ When users create specialized instances, suggest these configurations:
     }
     /** Forward a message to a classic channel instance with chat log context */
     async forwardToClassicInstance(instanceName, text, msg, extraMeta) {
-        const contextLines = this.classicChannels?.getContextLines(msg.chatId) ?? 5;
+        // Resolve the channel/adapter from the instance itself so per-channel context
+        // config is correct even for a same-channel second bot.
+        const ctxAdapterId = this.classicChannels?.getAdapterIdByInstance(instanceName);
+        const ctxChannelId = this.classicChannels?.getChannelIdByInstance(instanceName) ?? msg.chatId;
+        const contextLines = this.classicChannels?.getContextLines(ctxChannelId, ctxAdapterId) ?? 5;
         const logContext = this.getRecentChatLog(instanceName, contextLines);
         const fullText = logContext
             ? `[Chat log for context]\n${logContext}\n\n[User message]\n${text}`
@@ -3444,7 +3564,7 @@ When users create specialized instances, suggest these configurations:
         await this.startInstance(instanceName, config, topicMode);
     }
     /** Handle /start slash command — register classic channel */
-    async handleClassicStart(channelId, channelName, userId, guildId) {
+    async handleClassicStart(channelId, channelName, userId, guildId, adapterId) {
         if (!this.classicChannels)
             return "Classic channel manager not initialized.";
         if (guildId && !this.classicChannels.isGuildAllowed(guildId)) {
@@ -3454,33 +3574,40 @@ When users create specialized instances, suggest these configurations:
             }
             return "⛔ This server is not in the allowed guilds list.";
         }
-        if (this.classicChannels.isClassicChannel(channelId))
+        // Per-bot check: a second bot may /start in the same channel (own agent).
+        if (this.classicChannels.isClassicChannel(channelId, adapterId))
             return "This channel already has an active agent. Use /chat to talk.";
+        // Classic no longer lives in the routing engine, so this only guards against
+        // a fleet topic-mode instance colliding with the channel.
         if (this.routing.resolve(channelId))
             return "This channel is already bound to a topic-mode instance.";
-        const instanceName = classicInstanceName(sanitizeInstanceName(channelName || channelId), channelId);
-        this.classicChannels.register(channelId, instanceName, channelName || channelId, userId);
-        this.routing.register(channelId, { kind: "classic", name: instanceName });
-        await this.startClassicInstance(instanceName, this.classicChannels.getBackend(channelId, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channelId), this.classicChannels.getModel(channelId, this.fleetConfig?.defaults?.model));
+        const instanceName = this.classicChannels.deriveInstanceName(channelName || channelId, channelId, adapterId);
+        this.classicChannels.register(channelId, adapterId, instanceName, channelName || channelId, userId);
+        // Bind this classic instance to the bot that started it (authoritative), so
+        // replies/cancel go out through that bot even though every same-guild bot
+        // also sees the channel's messages.
+        if (adapterId)
+            this.bindInstanceAdapter(instanceName, adapterId);
+        await this.startClassicInstance(instanceName, this.classicChannels.getBackend(channelId, adapterId, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channelId, adapterId), this.classicChannels.getModel(channelId, adapterId, this.fleetConfig?.defaults?.model));
         this.reregisterClassicChannels();
         // Auto-enable collab for Discord classic channels (TG uses @mention directly without collab mode)
-        if (guildId && !this.classicChannels.isCollab(channelId)) {
-            this.classicChannels.toggleCollab(channelId);
+        if (guildId && !this.classicChannels.isCollab(channelId, adapterId)) {
+            this.classicChannels.toggleCollab(channelId, adapterId);
         }
-        this.logger.info({ channelId, instanceName, userId }, "Classic channel started");
+        this.logger.info({ channelId, adapterId, instanceName, userId }, "Classic channel started");
         return `✅ Agent started in this channel. Use \`/chat <message>\` or @mention to talk.`;
     }
     /** Handle /stop slash command — unregister classic channel */
-    async handleClassicStop(channelId) {
+    async handleClassicStop(channelId, adapterId) {
         if (!this.classicChannels)
             return "Classic channel manager not initialized.";
-        const ch = this.classicChannels.unregister(channelId);
+        const ch = this.classicChannels.unregister(channelId, adapterId);
         if (!ch)
             return "No active agent in this channel.";
-        this.routing.unregister(channelId);
+        this.instanceWorldBinding.delete(ch.instanceName);
         await this.stopInstance(ch.instanceName).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to stop classic instance"));
         this.reregisterClassicChannels();
-        this.logger.info({ channelId, instanceName: ch.instanceName }, "Classic channel stopped");
+        this.logger.info({ channelId, adapterId, instanceName: ch.instanceName }, "Classic channel stopped");
         return `🛑 Agent stopped in this channel.`;
     }
     async stopAll() {
@@ -3955,6 +4082,15 @@ When users create specialized instances, suggest these configurations:
         catch {
             // best-effort
         }
+        // Separate read-only token for the /view page: grants terminal-view + profile
+        // read, but never write (POSTs still require the full web token).
+        this.viewToken = randomBytes(24).toString("hex");
+        const viewTokenPath = join(this.dataDir, "view.token");
+        writeFileSync(viewTokenPath, this.viewToken, { mode: 0o600 });
+        try {
+            chmodSync(viewTokenPath, 0o600);
+        }
+        catch { /* best-effort */ }
         this.healthServer = createServer((req, res) => {
             res.setHeader("Content-Type", "application/json");
             // Public health probe — no auth required.
@@ -3964,6 +4100,10 @@ When users create specialized instances, suggest these configurations:
             else if (req.method === "POST" && req.url === "/agent") {
                 // /agent handles its own instance-level auth via X-Agend-Instance-Token
             }
+            else if (isViewPath(new URL(req.url ?? "/", `http://localhost:${port}`).pathname)) {
+                // /view routes accept the read-only view.token (or web.token) and do
+                // their own per-method auth in view-api.ts — skip the web-token gate.
+            }
             else {
                 // All other endpoints require a valid token (query ?token= or X-Agend-Token header).
                 // /ui/* will also re-check in web-api.ts, which is harmless.
@@ -4147,6 +4287,10 @@ When users create specialized instances, suggest these configurations:
             }
             // ── Web UI endpoints (delegated to web-api.ts) ─────
             const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+            if (handleViewRequest(req, res, url, this))
+                return;
+            if (handleSettingsRequest(req, res, url, this))
+                return;
             if (handleWebRequest(req, res, url, this))
                 return;
             res.writeHead(404);
@@ -4188,6 +4332,7 @@ When users create specialized instances, suggest these configurations:
             this.logger.info({ port }, "Health endpoint listening");
         });
         this.logger.info({ url: `http://localhost:${port}/ui?token=${this.webToken}` }, "Web UI available");
+        this.logger.info({ url: `http://localhost:${port}/view?token=${this.viewToken}` }, "Web View available");
     }
     getUiStatus() {
         const instances = Object.keys(this.fleetConfig?.instances ?? {}).map(name => {