@songsid/agend 2.0.8-beta.3 → 2.0.8-beta.31

package/dist/fleet-manager.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync } from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
@@ -22,7 +22,7 @@ import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, sanitizeInstanceName } from "./topic-commands.js";
+import { TopicCommands, sanitizeInstanceName, saveCommandForBackend, parseSaveFilename, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -45,6 +45,10 @@ export function resolveReplyThreadId(argsThreadId, instanceConfig) {
     }
     return instanceConfig?.topic_id != null ? String(instanceConfig.topic_id) : undefined;
 }
+/** Retry cadence for retiring a cancel button whose delete failed (e.g. a DC
+ * forum thread the bot momentarily can't reach). 3 retries × 5min = 15min. */
+const CANCEL_BTN_RETRY_INTERVAL_MS = 5 * 60_000;
+const CANCEL_BTN_MAX_RETRIES = 3;
 export class FleetManager {
     dataDir;
     children = new Map();
@@ -78,6 +82,13 @@ export class FleetManager {
     topicIcons = {};
     lastActivity = new Map();
     lastInboundUser = new Map(); // instanceName → last username
+    // Active "🛑 Cancel" buttons, tracked per button (keyed by messageId) rather
+    // than one-per-instance. A button is retired (deleted, with bounded retry) on
+    // reply, on cancel, or when a newer button supersedes it for the same
+    // instance. Per-button tracking means a failed delete never strands a button.
+    cancelButtons = new Map();
+    // Last user message delivered to each instance — used to react ✅ on completion.
+    lastInboundMsg = new Map();
     topicArchiver;
     controlClient = null;
     classicChannels = null;
@@ -443,6 +454,10 @@ export class FleetManager {
                 .catch(e => this.logger.warn({ err: e }, "Failed to send daily summary"));
             // Rotate classic channel chat logs daily
             this.classicChannels?.rotateLogs();
+            this.rotateInboxes();
+            // Rotate fleet.log daily too (besides the startup size check above), so a
+            // long-running fleet doesn't accumulate an unbounded log.
+            rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
         }, () => {
             const instances = Object.keys(this.fleetConfig?.instances ?? {});
             const costMap = new Map();
@@ -454,6 +469,7 @@ export class FleetManager {
         this.dailySummary.start();
         // Rotate classic channel chat logs daily (piggyback on daily summary timer)
         this.classicChannels?.rotateLogs();
+        this.rotateInboxes();
         // Auto-create general instance(s) — one per adapter that lacks a general
         const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
         const generalInstances = Object.entries(fleet.instances).filter(([, inst]) => inst.general_topic === true);
@@ -681,6 +697,41 @@ export class FleetManager {
         };
         process.once("SIGUSR1", onFullRestart);
     }
+    /**
+     * Delete inbox files older than retentionDays (by mtime). Cleans the shared
+     * inbox (`<dataDir>/inbox`) and every workspace inbox
+     * (`<agendHome>/workspaces/*\/inbox`). Piggybacks on the daily summary timer,
+     * mirroring classic chat-log rotation (same 7-day retention).
+     */
+    rotateInboxes(retentionDays = 7) {
+        const cutoff = Date.now() - retentionDays * 86400_000;
+        const dirs = [join(this.dataDir, "inbox")];
+        const workspacesDir = join(getAgendHome(), "workspaces");
+        if (existsSync(workspacesDir)) {
+            for (const ws of readdirSync(workspacesDir)) {
+                dirs.push(join(workspacesDir, ws, "inbox"));
+            }
+        }
+        let deleted = 0;
+        for (const dir of dirs) {
+            if (!existsSync(dir))
+                continue;
+            for (const file of readdirSync(dir)) {
+                const full = join(dir, file);
+                try {
+                    const st = statSync(full);
+                    if (st.isFile() && st.mtimeMs < cutoff) {
+                        unlinkSync(full);
+                        deleted++;
+                    }
+                }
+                catch { /* file vanished or unreadable — skip */ }
+            }
+        }
+        if (deleted > 0)
+            this.logger.info({ deleted }, "Rotated inbox files");
+        return deleted;
+    }
     /** Start the shared channel adapter(s) for topic mode */
     async startSharedAdapter(fleet) {
         const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
@@ -732,13 +783,22 @@ export class FleetManager {
                         await this.startInstance(instanceName, config, topicMode);
                         // startInstance already calls connectIpcToInstance
                     }
-                    this.adapter?.editMessage(data.chatId, data.messageId, `🔄 ${instanceName} restarted.`).catch(() => { });
+                    this.adapter?.editMessage(data.chatId, data.messageId, `🔄 ${instanceName} restarted.`, data.threadId).catch(() => { });
                 }
                 else {
-                    this.adapter?.editMessage(data.chatId, data.messageId, `⏳ Continuing to wait for ${instanceName}.`).catch(() => { });
+                    this.adapter?.editMessage(data.chatId, data.messageId, `⏳ Continuing to wait for ${instanceName}.`, data.threadId).catch(() => { });
                 }
                 return;
             }
+            if (data.callbackData.startsWith("cancel:")) {
+                const instanceName = data.callbackData.slice("cancel:".length);
+                // Idempotent: a button click only acts while the button is live. A
+                // second click (entry already cleared) is a no-op — don't re-send the
+                // interrupt key. (The /cancel command path calls cancelInstance directly.)
+                if (this.hasCancelButton(instanceName))
+                    this.cancelInstance(instanceName);
+                return;
+            }
         }, this.logger, "adapter.callback_query"));
         this.adapter.on("topic_closed", safeHandler(async (data) => {
             // Skip unbind if we archived this topic ourselves
@@ -780,7 +840,11 @@ export class FleetManager {
                     timestamp: new Date(),
                 });
             }
-            else if (data.command === "save" || data.command === "load") {
+            else if (data.command === "save") {
+                await this.handleSlashSave(data);
+            }
+            else if (data.command === "load") {
+                // load is kiro-cli/classic only — no claude-code equivalent.
                 if (!this.classicChannels?.isAdmin(data.userId)) {
                     await data.respond("⛔ This command requires admin access.");
                     return;
@@ -790,25 +854,13 @@ export class FleetManager {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
-                let rawCmd;
-                if (data.command === "save") {
-                    const filename = data.options?.filename;
-                    if (!/^[\w.-]+$/.test(filename)) {
-                        await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
-                        return;
-                    }
-                    rawCmd = data.options?.force ? `/chat save ${filename} -f` : `/chat save ${filename}`;
-                }
-                else {
-                    const filename = data.options?.filename;
-                    if (!/^[\w.-]+$/.test(filename)) {
-                        await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
-                        return;
-                    }
-                    rawCmd = `/chat load ${filename}`;
+                const filename = data.options?.filename;
+                if (!SAVE_FILENAME_RE.test(filename ?? "")) {
+                    await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
+                    return;
                 }
-                this.pasteRawToClassicInstance(target.name, rawCmd);
-                await data.respond(`✅ Sent \`${rawCmd}\` to ${target.name}`);
+                this.pasteRawToClassicInstance(target.name, `/chat load ${filename}`);
+                await data.respond(`✅ Sent \`/chat load ${filename}\` to ${target.name}`);
             }
             else if (data.command === "compact") {
                 const target = this.routing.resolve(data.channelId);
@@ -819,48 +871,23 @@ export class FleetManager {
                 const result = await this.topicCommands.sendCompact(target.name);
                 await data.respond(result);
             }
-            else if (data.command === "ctx") {
+            else if (data.command === "cancel") {
                 const target = this.routing.resolve(data.channelId);
                 if (!target) {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
-                const instanceName = target.name;
-                const backend = target.kind === "classic"
-                    ? (this.classicChannels?.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend) ?? "claude-code")
-                    : (this.fleetConfig?.instances[instanceName]?.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
-                let context = null;
-                // Try statusline.json first
-                try {
-                    const statusFile = join(this.getInstanceDir(instanceName), "statusline.json");
-                    if (existsSync(statusFile)) {
-                        const d = JSON.parse(readFileSync(statusFile, "utf-8"));
-                        context = d.context_window?.used_percentage ?? null;
-                    }
-                }
-                catch { /* ignore */ }
-                // Fallback: capture tmux pane
-                if (context == null) {
-                    try {
-                        const { execFileSync } = await import("node:child_process");
-                        const { getTmuxSocketName } = await import("./paths.js");
-                        const socketName = getTmuxSocketName();
-                        const tmuxArgs = socketName
-                            ? ["-L", socketName, "capture-pane", "-t", `${getTmuxSession()}:${instanceName}`, "-p"]
-                            : ["capture-pane", "-t", `${getTmuxSession()}:${instanceName}`, "-p"];
-                        const pane = execFileSync("tmux", tmuxArgs, { encoding: "utf-8", timeout: 2000, stdio: ["pipe", "pipe", "pipe"] });
-                        const m = pane.match(/(\d+)%.*[!❯>]/m) || pane.match(/◔\s*(\d+)%/) || pane.match(/\[(\d+)%\]/);
-                        if (m)
-                            context = parseInt(m[1], 10);
-                    }
-                    catch { /* ignore */ }
-                }
-                if (context != null) {
-                    await data.respond(`📊 Context: ${context}% used\nBackend: ${backend}\nInstance: ${instanceName}`);
-                }
-                else {
-                    await data.respond(`Context info not available yet.\nBackend: ${backend}\nInstance: ${instanceName}`);
+                const ok = this.cancelInstance(target.name);
+                await data.respond(ok ? `🛑 Sent cancel to ${target.name}.` : `❌ ${target.name} not running.`);
+            }
+            else if (data.command === "ctx") {
+                const target = this.routing.resolve(data.channelId);
+                if (!target) {
+                    await data.respond("No active agent in this channel.");
+                    return;
                 }
+                // Single source of truth (statusline.json + robust tmux pane fallback).
+                await data.respond(await this.topicCommands.getCtxText(target.name));
             }
             else if (data.command === "collab") {
                 const collabTarget = this.routing.resolve(data.channelId);
@@ -1021,11 +1048,19 @@ export class FleetManager {
                         const topicMode = this.fleetConfig?.channel?.mode === "topic";
                         await this.startInstance(instanceName, config, topicMode);
                     }
-                    adapter.editMessage(data.chatId, data.messageId, `🔄 ${instanceName} restarted.`).catch(() => { });
+                    adapter.editMessage(data.chatId, data.messageId, `🔄 ${instanceName} restarted.`, data.threadId).catch(() => { });
                 }
                 else {
-                    adapter.editMessage(data.chatId, data.messageId, `⏳ Continuing to wait for ${instanceName}.`).catch(() => { });
+                    adapter.editMessage(data.chatId, data.messageId, `⏳ Continuing to wait for ${instanceName}.`, data.threadId).catch(() => { });
                 }
+                return;
+            }
+            if (data.callbackData.startsWith("cancel:")) {
+                const instanceName = data.callbackData.slice("cancel:".length);
+                // Idempotent: only the first click (while the button is live) acts.
+                if (this.hasCancelButton(instanceName))
+                    this.cancelInstance(instanceName);
+                return;
             }
         }, this.logger, `adapter[${adapterId}].callback_query`));
         adapter.on("topic_closed", safeHandler(async (data) => {
@@ -1067,7 +1102,11 @@ export class FleetManager {
                     timestamp: new Date(),
                 });
             }
-            else if (data.command === "save" || data.command === "load") {
+            else if (data.command === "save") {
+                await this.handleSlashSave(data);
+            }
+            else if (data.command === "load") {
+                // load is kiro-cli/classic only — no claude-code equivalent.
                 if (!this.classicChannels?.isAdmin(data.userId)) {
                     await data.respond("⛔ This command requires admin access.");
                     return;
@@ -1077,25 +1116,13 @@ export class FleetManager {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
-                let rawCmd;
-                if (data.command === "save") {
-                    const filename = data.options?.filename;
-                    if (!/^[\w.-]+$/.test(filename)) {
-                        await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
-                        return;
-                    }
-                    rawCmd = data.options?.force ? `/chat save ${filename} -f` : `/chat save ${filename}`;
-                }
-                else {
-                    const filename = data.options?.filename;
-                    if (!/^[\w.-]+$/.test(filename)) {
-                        await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
-                        return;
-                    }
-                    rawCmd = `/chat load ${filename}`;
+                const filename = data.options?.filename;
+                if (!SAVE_FILENAME_RE.test(filename ?? "")) {
+                    await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
+                    return;
                 }
-                this.pasteRawToClassicInstance(target.name, rawCmd);
-                await data.respond(`✅ Sent \`${rawCmd}\` to ${target.name}`);
+                this.pasteRawToClassicInstance(target.name, `/chat load ${filename}`);
+                await data.respond(`✅ Sent \`/chat load ${filename}\` to ${target.name}`);
             }
             else if (data.command === "compact") {
                 const target = this.routing.resolve(data.channelId);
@@ -1106,31 +1133,23 @@ export class FleetManager {
                 const result = await this.topicCommands.sendCompact(target.name);
                 await data.respond(result);
             }
-            else if (data.command === "ctx") {
+            else if (data.command === "cancel") {
                 const target = this.routing.resolve(data.channelId);
                 if (!target) {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
-                const instanceName = target.name;
-                const ctxBackend = target.kind === "classic"
-                    ? (this.classicChannels?.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend) ?? "claude-code")
-                    : (this.fleetConfig?.instances[instanceName]?.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
-                let context = null;
-                try {
-                    const statusFile = join(this.getInstanceDir(instanceName), "statusline.json");
-                    if (existsSync(statusFile)) {
-                        const d = JSON.parse(readFileSync(statusFile, "utf-8"));
-                        context = d.context_window?.used_percentage ?? null;
-                    }
-                }
-                catch { /* ignore */ }
-                if (context != null) {
-                    await data.respond(`📊 Context: ${context}% used\nBackend: ${ctxBackend}\nInstance: ${instanceName}`);
-                }
-                else {
-                    await data.respond(`Context info not available yet.\nBackend: ${ctxBackend}\nInstance: ${instanceName}`);
+                const ok = this.cancelInstance(target.name);
+                await data.respond(ok ? `🛑 Sent cancel to ${target.name}.` : `❌ ${target.name} not running.`);
+            }
+            else if (data.command === "ctx") {
+                const target = this.routing.resolve(data.channelId);
+                if (!target) {
+                    await data.respond("No active agent in this channel.");
+                    return;
                 }
+                // Single source of truth (statusline.json + robust tmux pane fallback).
+                await data.respond(await this.topicCommands.getCtxText(target.name));
             }
             else if (data.command === "collab") {
                 const collabTarget2 = this.routing.resolve(data.channelId);
@@ -1498,6 +1517,15 @@ export class FleetManager {
                 const isBotMentioned = !!(botUser && text.toLowerCase().includes(`@${botUser.toLowerCase()}`));
                 const isPrivateChat = !chatId.startsWith("-"); // Telegram: positive = private, negative = group
                 const msgAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
+                // In a TG Classic group, ignore bare slash commands (no @bot specified).
+                // Prevents multiple bots all responding to the same /ctx, /compact, etc.
+                // `/cmd@otherbot` already returned above; `/cmd@mybot` set cmdMatch, so it
+                // still processes. Private chat (only one bot) always processes.
+                // NOTE: this also silently drops bare `/start` in a group, so group
+                // onboarding now requires `/start@mybot` — consistent with the policy.
+                if (!isPrivateChat && !cmdMatch && rawText.startsWith("/")) {
+                    return; // bare slash in group — ignore silently
+                }
                 // Handle /start command
                 if (text === "/start" || text.startsWith("/start ")) {
                     if (isPrivateChat) {
@@ -1567,6 +1595,17 @@ export class FleetManager {
                     await msgAdapter?.sendText(chatId, result);
                     return;
                 }
+                // Handle /cancel command
+                if (text === "/cancel" || text.startsWith("/cancel@")) {
+                    const cancelTarget = this.routing.resolve(chatId);
+                    if (!cancelTarget || cancelTarget.kind !== "classic") {
+                        await msgAdapter?.sendText(chatId, "No active agent. Use /start first.");
+                        return;
+                    }
+                    const ok = this.cancelInstance(cancelTarget.name);
+                    await msgAdapter?.sendText(chatId, ok ? `🛑 已送出取消給 ${cancelTarget.name}。` : `❌ ${cancelTarget.name} 未在執行。`);
+                    return;
+                }
                 // Handle /ctx command
                 if (text === "/ctx" || text.startsWith("/ctx@")) {
                     const ctxTarget = this.routing.resolve(chatId);
@@ -1578,6 +1617,36 @@ export class FleetManager {
                     await msgAdapter?.sendText(chatId, reply);
                     return;
                 }
+                // Handle /save command (admin only)
+                if (text === "/save" || text.startsWith("/save ") || text.startsWith("/save@")) {
+                    if (!this.classicChannels.isAdmin(msg.userId)) {
+                        await msgAdapter?.sendText(chatId, "⛔ /save requires admin access.");
+                        return;
+                    }
+                    const saveTarget = this.routing.resolve(chatId);
+                    if (!saveTarget || saveTarget.kind !== "classic") {
+                        await msgAdapter?.sendText(chatId, "No active agent. Use /start first.");
+                        return;
+                    }
+                    const filename = parseSaveFilename(text);
+                    if (!filename) {
+                        await msgAdapter?.sendText(chatId, "Usage: /save <filename>");
+                        return;
+                    }
+                    if (!SAVE_FILENAME_RE.test(filename)) {
+                        await msgAdapter?.sendText(chatId, "⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
+                        return;
+                    }
+                    const backend = this.classicChannels.getBackendByInstance(saveTarget.name, this.fleetConfig?.defaults?.backend);
+                    const cmd = saveCommandForBackend(backend, filename);
+                    if (!cmd) {
+                        await msgAdapter?.sendText(chatId, SAVE_UNSUPPORTED_MSG);
+                        return;
+                    }
+                    this.pasteRawToClassicInstance(saveTarget.name, cmd);
+                    await msgAdapter?.sendText(chatId, `✅ Sent \`${cmd}\` to ${saveTarget.name}`);
+                    return;
+                }
                 // Route to classic channel if registered
                 const target = this.routing.resolve(chatId);
                 if (target?.kind === "classic") {
@@ -1654,6 +1723,8 @@ export class FleetManager {
                         instance: generalInstance, sender: msg.username,
                         text: (text ?? "").slice(0, 2000), ts: new Date().toISOString(),
                     });
+                    this.trackInboundMsg(generalInstance, msg);
+                    void this.sendCancelButton(generalInstance);
                 }
             }
             return;
@@ -1691,7 +1762,7 @@ export class FleetManager {
         const inboundAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
         // React immediately — before any other Discord API calls
         if (msg.chatId && msg.messageId) {
-            inboundAdapter.react(msg.threadId ?? msg.chatId, msg.messageId, "👀")
+            inboundAdapter.react(this.reactTarget(msg), msg.messageId, "👀")
                 .catch(e => this.logger.debug({ err: e.message }, "Auto-react failed"));
         }
         // These may hit Discord API (topic icon, archive) — do after react
@@ -1730,6 +1801,8 @@ export class FleetManager {
             instance: instanceName, sender: msg.username,
             text: (text ?? "").slice(0, 2000), ts: new Date().toISOString(),
         });
+        this.trackInboundMsg(instanceName, msg);
+        void this.sendCancelButton(instanceName);
     }
     /** Handle outbound tool calls from a daemon instance */
     /** Warn (but don't block) when rate limits are high. 30-min debounce per instance. */
@@ -1803,6 +1876,9 @@ export class FleetManager {
         // Route standard channel tools (reply, react, edit_message, download_attachment)
         if (routeToolCall(outAdapter, tool, args, threadId, respond)) {
             if (tool === "reply") {
+                // Agent answered — retire its pending cancel button and mark ✅ done.
+                this.clearCancelButton(instanceName);
+                this.reactDone(instanceName);
                 const replyTo = this.lastInboundUser.get(instanceName) ?? "user";
                 this.logger.info(`${instanceName} → ${replyTo}: ${(args.text ?? "").slice(0, 100)}`);
                 this.emitSseEvent("message", {
@@ -1849,7 +1925,7 @@ export class FleetManager {
         if (!chatId)
             return;
         if (editMessageId) {
-            statusAdapter.editMessage(chatId, editMessageId, text).catch(e => this.logger.debug({ err: e }, "Failed to edit tool status message"));
+            statusAdapter.editMessage(chatId, editMessageId, text, threadId).catch(e => this.logger.debug({ err: e }, "Failed to edit tool status message"));
         }
         else {
             statusAdapter.sendText(chatId, text, { threadId }).then((sent) => {
@@ -1887,6 +1963,8 @@ export class FleetManager {
                 payload: { schedule_id: id, message: `[Scheduled] ${message}`, label },
                 meta: { chat_id: reply_chat_id, thread_id: reply_thread_id, user: "scheduler" },
             });
+            // A scheduled trigger also puts the instance to work — show a cancel button.
+            void this.sendCancelButton(target);
             return true;
         };
         if (deliver()) {
@@ -2512,6 +2590,212 @@ export class FleetManager {
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send notification (no topic)"));
         }
     }
+    // ── Cancel button ────────────────────────────────────────────────────
+    // Sent after delivering a user message to an instance; clicking it (or
+    // /cancel) sends Escape to the instance's pane to interrupt generation.
+    /** Send a "🛑 Cancel" button to the instance's topic/channel after delivery. */
+    /**
+     * Handle the DC `/save` slash command for both classic AND fleet-topic targets.
+     * Picks the backend-appropriate command (kiro → /chat save, claude → /export);
+     * unsupported backends get a clear error. Routes via classic paste or fleet IPC.
+     */
+    async handleSlashSave(data) {
+        if (!this.classicChannels?.isAdmin(data.userId)) {
+            await data.respond("⛔ This command requires admin access.");
+            return;
+        }
+        const target = this.routing.resolve(data.channelId);
+        if (!target) {
+            await data.respond("No active agent in this channel. Use `/start` first.");
+            return;
+        }
+        const filename = data.options?.filename ?? "";
+        if (!SAVE_FILENAME_RE.test(filename)) {
+            await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
+            return;
+        }
+        const backend = target.kind === "classic"
+            ? this.classicChannels.getBackendByInstance(target.name, this.fleetConfig?.defaults?.backend)
+            : (this.fleetConfig?.instances[target.name]?.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
+        // force (-f) is only meaningful for kiro/classic /chat save.
+        const force = target.kind === "classic" && !!data.options?.force;
+        const cmd = saveCommandForBackend(backend, filename, force);
+        if (!cmd) {
+            await data.respond(SAVE_UNSUPPORTED_MSG);
+            return;
+        }
+        if (target.kind === "classic") {
+            this.pasteRawToClassicInstance(target.name, cmd);
+        }
+        else {
+            this.instanceIpcClients.get(target.name)?.send({ type: "raw_paste", content: cmd });
+        }
+        await data.respond(`✅ Sent \`${cmd}\` to ${target.name}`);
+    }
+    /** Whether the instance currently has at least one live cancel button. */
+    hasCancelButton(instanceName) {
+        for (const e of this.cancelButtons.values()) {
+            if (e.instanceName === instanceName)
+                return true;
+        }
+        return false;
+    }
+    async sendCancelButton(instanceName) {
+        // At most one button shown per instance: retire any existing ones first
+        // (delete + bounded retry). Each is tracked separately, so a failed delete
+        // here doesn't strand it — it keeps retrying on its own timer.
+        this.retireInstanceButtons(instanceName);
+        const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
+        if (!adapter)
+            return;
+        const adapterId = this.instanceWorldBinding.get(instanceName);
+        const groupId = this.getChannelConfig(adapterId)?.group_id;
+        const topicId = this.fleetConfig?.instances[instanceName]?.topic_id;
+        let chatId;
+        let threadId;
+        if (topicId != null && groupId) {
+            // Fleet topic instance.
+            chatId = String(groupId);
+            threadId = String(topicId);
+        }
+        else {
+            // Classic instance: chatId from the routing table.
+            for (const [cid, target] of this.routing.entries()) {
+                if (target.kind === "classic" && target.name === instanceName) {
+                    chatId = cid;
+                    break;
+                }
+            }
+            // General / flat fallback: post to the group (no thread).
+            if (!chatId && groupId)
+                chatId = String(groupId);
+        }
+        if (!chatId)
+            return;
+        try {
+            const sent = await adapter.notifyAlert(chatId, {
+                type: "cancel",
+                instanceName,
+                message: "👀 處理中…",
+                choices: [{ id: `cancel:${instanceName}`, label: "🛑 取消" }],
+            }, threadId ? { threadId } : undefined);
+            // A concurrent sendCancelButton for the same instance may have posted its
+            // own button while we awaited notifyAlert. Retire any other buttons for
+            // this instance (not the one we just posted) so only the newest shows.
+            for (const other of this.cancelButtons.values()) {
+                if (other.instanceName === instanceName)
+                    this.retireButton(other);
+            }
+            this.cancelButtons.set(sent.messageId, {
+                instanceName,
+                adapterId,
+                chatId: sent.chatId,
+                messageId: sent.messageId,
+                threadId: sent.threadId ?? threadId,
+                retryCount: 0,
+            });
+            this.logger.info({ instanceName, messageId: sent.messageId }, "Cancel button sent");
+        }
+        catch (e) {
+            this.logger.warn({ err: e.message, instanceName }, "Failed to send cancel button");
+        }
+    }
+    /** Retire (delete) every cancel button belonging to an instance. */
+    retireInstanceButtons(instanceName) {
+        // Snapshot first — retireButton may delete entries from the map on success.
+        for (const e of [...this.cancelButtons.values()]) {
+            if (e.instanceName === instanceName)
+                this.retireButton(e);
+        }
+    }
+    /** Begin retiring one button (delete + bounded retry on failure). Idempotent:
+     * a button already in a retire cycle is left to its own timer, so a second
+     * retire request (e.g. a new send + the post-await sweep) won't double-delete. */
+    retireButton(entry) {
+        if (entry.retiring)
+            return;
+        entry.retiring = true;
+        this.attemptButtonDelete(entry);
+    }
+    attemptButtonDelete(entry) {
+        this.deleteButtonMessage(entry)
+            .then(() => {
+            if (entry.retryTimer)
+                clearTimeout(entry.retryTimer);
+            this.cancelButtons.delete(entry.messageId);
+            this.logger.info({ instanceName: entry.instanceName, messageId: entry.messageId }, "Cancel button removed");
+        })
+            .catch((err) => this.scheduleButtonRetry(entry, err));
+    }
+    /** Re-attempt a failed button delete up to CANCEL_BTN_MAX_RETRIES times. */
+    scheduleButtonRetry(entry, err) {
+        if (entry.retryCount >= CANCEL_BTN_MAX_RETRIES) {
+            if (entry.retryTimer)
+                clearTimeout(entry.retryTimer);
+            this.cancelButtons.delete(entry.messageId);
+            this.logger.warn({ instanceName: entry.instanceName, messageId: entry.messageId, err: err.message }, `Cancel button delete gave up after ${CANCEL_BTN_MAX_RETRIES} retries`);
+            return;
+        }
+        entry.retryCount++;
+        this.logger.warn({ instanceName: entry.instanceName, messageId: entry.messageId, attempt: entry.retryCount, err: err.message }, "Cancel button delete failed, will retry");
+        if (entry.retryTimer)
+            clearTimeout(entry.retryTimer);
+        // Continue the same retire cycle (bypass the retiring-guard in retireButton).
+        entry.retryTimer = setTimeout(() => this.attemptButtonDelete(entry), CANCEL_BTN_RETRY_INTERVAL_MS);
+    }
+    /** Delete one button's message via its own adapter. Resolves on success,
+     * rejects on failure so the caller can retry. */
+    deleteButtonMessage(e) {
+        const adapter = (e.adapterId ? this.worlds.get(e.adapterId)?.adapter : undefined) ?? this.adapter;
+        if (!adapter)
+            return Promise.reject(new Error("no adapter for cancel button"));
+        if (adapter.deleteMessage)
+            return adapter.deleteMessage(e.chatId, e.messageId, e.threadId);
+        if (adapter.editMessageRemoveButtons)
+            return adapter.editMessageRemoveButtons(e.chatId, e.messageId, "✅", e.threadId);
+        return adapter.editMessage(e.chatId, e.messageId, "✅", e.threadId);
+    }
+    /** Retire all cancel buttons for an instance — on reply, cancel, or report. */
+    clearCancelButton(instanceName) {
+        this.retireInstanceButtons(instanceName);
+    }
+    /**
+     * Reaction target chat id. Telegram reactions key on the supergroup chat_id
+     * (the topic thread is NOT a chat_id), so a forum-topic message must react on
+     * msg.chatId — reacting on threadId silently fails. Discord reactions key on
+     * the channel/thread id.
+     */
+    reactTarget(msg) {
+        return msg.source === "telegram" ? msg.chatId : (msg.threadId ?? msg.chatId);
+    }
+    /** Remember the user message just delivered, so we can react ✅ when done. */
+    trackInboundMsg(instanceName, msg) {
+        if (!msg.chatId || !msg.messageId)
+            return;
+        this.lastInboundMsg.set(instanceName, {
+            adapterId: msg.adapterId, chatId: msg.chatId, threadId: msg.threadId ?? undefined, messageId: msg.messageId, source: msg.source,
+        });
+    }
+    /** React ✅ on the last user message after the agent replies. */
+    reactDone(instanceName) {
+        const m = this.lastInboundMsg.get(instanceName);
+        if (!m)
+            return;
+        this.lastInboundMsg.delete(instanceName);
+        const adapter = (m.adapterId ? this.worlds.get(m.adapterId)?.adapter : undefined)
+            ?? this.getAdapterForInstance(instanceName) ?? this.adapter;
+        adapter?.react(this.reactTarget(m), m.messageId, "✅").catch(() => { });
+    }
+    /** Interrupt an instance's current generation (cancel button / /cancel). */
+    cancelInstance(instanceName) {
+        const daemon = this.daemons.get(instanceName);
+        if (!daemon)
+            return false;
+        daemon.sendEscape().catch(e => this.logger.warn({ err: e, instanceName }, "sendEscape failed"));
+        this.lastInboundMsg.delete(instanceName);
+        this.clearCancelButton(instanceName);
+        return true;
+    }
     queueMirrorMessage(text) {
         const mirrorTopicId = this.fleetConfig?.channel?.mirror_topic_id;
         if (mirrorTopicId == null || !this.adapter)
@@ -2850,10 +3134,17 @@ When users create specialized instances, suggest these configurations:
             // Skip empty bot messages (e.g., reactions) — don't pollute chat log
             if (msg.isBotMessage && !text && !msg.attachments?.length)
                 return;
+            // Save attachments FIRST so the chat-log records their inbox paths
+            // (consistent with the /chat path). Otherwise a non-@mention image is
+            // saved to inbox but its path never reaches the agent — the log keeps
+            // only a pathless filename, so later context can't locate the file.
+            const saved = msg.attachments?.length ? await this.saveClassicAttachment(instanceName, msg) : undefined;
             // Log every message (including other bots) to chat-logs
-            const collabAttachTag = msg.attachments?.length
-                ? ` [${msg.attachments.map(a => `${a.kind === "photo" ? "📷" : "📎"} ${a.filename || a.kind}`).join(", ")}]`
-                : "";
+            const collabAttachTag = saved
+                ? ` [${saved.kind === "photo" ? "📷" : "📎"} saved: ${saved.paths.join(", ")}]`
+                : (msg.attachments?.length
+                    ? ` [${msg.attachments.map(a => `${a.kind === "photo" ? "📷" : "📎"} ${a.filename || a.kind}`).join(", ")}]`
+                    : "");
             ClassicChannelManager.logMessage(instanceName, msg.username, text + collabAttachTag, msg.timestamp, msg.replyToText);
             this.logger.info({ instanceName, user: msg.username, textLen: text.length, attachments: msg.attachments?.length ?? 0, source: msg.source }, "Collab mode message");
             // Check for @mention trigger: must be exact <@BOT_USER_ID>, not @everyone/@here
@@ -2861,19 +3152,16 @@ When users create specialized instances, suggest these configurations:
             const mentionTag = adapterBotUserId ? `<@${adapterBotUserId}>` : null;
             const isMentioned = mentionTag && text.includes(mentionTag);
             if (!isMentioned) {
-                // Save bare attachments (stickers, images) even without @mention
-                if (msg.attachments?.length) {
-                    const saved = await this.saveClassicAttachment(instanceName, msg);
-                    if (saved) {
-                        const reactAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
-                        const noMentionReactChatId = msg.threadId ?? msg.chatId;
-                        if (reactAdapter && noMentionReactChatId && msg.messageId) {
-                            const emoji = msg.source === "telegram"
-                                ? (saved.kind === "photo" ? "👌" : "👍")
-                                : (saved.kind === "photo" ? "📸" : "📎");
-                            reactAdapter.react(noMentionReactChatId, msg.messageId, emoji)
-                                .catch(e => this.logger.debug({ err: e.message }, "Auto-react failed"));
-                        }
+                // Bare attachment (no @mention) — already saved above; just acknowledge.
+                if (saved) {
+                    const reactAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
+                    const noMentionReactChatId = msg.threadId ?? msg.chatId;
+                    if (reactAdapter && noMentionReactChatId && msg.messageId) {
+                        const emoji = msg.source === "telegram"
+                            ? (saved.kind === "photo" ? "👌" : "👍")
+                            : (saved.kind === "photo" ? "📸" : "📎");
+                        reactAdapter.react(noMentionReactChatId, msg.messageId, emoji)
+                            .catch(e => this.logger.debug({ err: e.message }, "Auto-react failed"));
                     }
                 }
                 return;
@@ -2891,8 +3179,7 @@ When users create specialized instances, suggest these configurations:
             // Block /raw bypass
             if (cleanText.startsWith("/raw "))
                 return;
-            // Save and process attachments (same as /chat mode)
-            const saved = await this.saveClassicAttachment(instanceName, msg);
+            // Attachments already saved at the top of the collab block.
             if (saved && classicAdapter && collabReactChatId && msg.messageId) {
                 const emoji = msg.source === "telegram"
                     ? (saved.kind === "photo" ? "👌" : "👍")
@@ -3049,24 +3336,37 @@ When users create specialized instances, suggest these configurations:
             this.logger.warn({ instanceName }, "Classic channel instance IPC not connected");
             return;
         }
+        const meta = {
+            chat_id: msg.chatId,
+            message_id: msg.messageId,
+            user: msg.username,
+            user_id: msg.userId,
+            ts: msg.timestamp.toISOString(),
+            thread_id: msg.threadId ?? "",
+            source: msg.source,
+            ...extraMeta,
+            ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
+        };
+        // If the triggering message carried no image of its own, surface the most
+        // recent image saved earlier in this channel (logged as "[📷 saved: <path>]"
+        // by an untriggered collab message) as image_path, so the agent's
+        // read-the-image trigger fires instead of the path sitting inert in context.
+        if (!meta.image_path && logContext) {
+            const saves = [...logContext.matchAll(/\[📷 saved: ([^\]]+)\]/g)];
+            if (saves.length > 0) {
+                meta.image_path = saves[saves.length - 1][1].split(",")[0].trim();
+            }
+        }
         ipc.send({
             type: "fleet_inbound",
             content: fullText,
             targetSession: instanceName,
-            meta: {
-                chat_id: msg.chatId,
-                message_id: msg.messageId,
-                user: msg.username,
-                user_id: msg.userId,
-                ts: msg.timestamp.toISOString(),
-                thread_id: msg.threadId ?? "",
-                source: msg.source,
-                ...extraMeta,
-                ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
-            },
+            meta,
         });
         this.lastInboundUser.set(instanceName, msg.username);
         this.logger.info(`${msg.username} → ${instanceName} (classic): ${text.slice(0, 100)}`);
+        this.trackInboundMsg(instanceName, msg);
+        void this.sendCancelButton(instanceName);
     }
     /** Paste raw text directly to a classic instance's CLI (no [user:] wrapping) */
     pasteRawToClassicInstance(instanceName, text) {
@@ -3186,9 +3486,11 @@ When users create specialized instances, suggest these configurations:
         this.topicArchiver.stop();
         this.scheduler?.shutdown();
         // Stop instances in parallel batches to avoid long sequential waits.
-        // Concurrency limited to avoid overwhelming the tmux server.
-        const STOP_CONCURRENCY = 5;
+        // Concurrency scales with fleet size — larger fleets tolerate more parallel
+        // tmux ops, while small fleets stay conservative to avoid overwhelming the
+        // tmux server.
         const entries = [...this.daemons.entries()];
+        const STOP_CONCURRENCY = entries.length > 30 ? 15 : entries.length >= 10 ? 10 : 5;
         for (const [name] of entries)
             this.ipcStoppingInstances.add(name);
         for (let i = 0; i < entries.length; i += STOP_CONCURRENCY) {
@@ -3203,9 +3505,9 @@ When users create specialized instances, suggest these configurations:
                 this.daemons.delete(name);
             }));
         }
-        for (const [, ipc] of this.instanceIpcClients) {
-            await ipc.close();
-        }
+        // Close IPC clients in parallel — serial close over a large fleet adds
+        // noticeable latency.
+        await Promise.all([...this.instanceIpcClients.values()].map(ipc => Promise.resolve(ipc.close()).catch(() => { })));
         this.instanceIpcClients.clear();
         this.ipcStoppingInstances.clear();
         for (const [, w] of this.worlds) {
@@ -3541,14 +3843,21 @@ When users create specialized instances, suggest these configurations:
             const latest = execSync("npm view @songsid/agend version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
             let target = latest;
             if (currentVersion.includes("-beta")) {
+                // Beta users track the @beta channel (never fall back to @latest, which is
+                // older), but should also hear when a newer STABLE ships — pick whichever
+                // of beta/latest is the newest.
+                let beta = "";
                 try {
-                    const beta = execSync("npm view @songsid/agend@beta version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
-                    if (beta && beta !== currentVersion)
-                        target = beta;
+                    beta = execSync("npm view @songsid/agend@beta version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
                 }
                 catch { /* no beta tag */ }
+                target = beta || latest;
+                if (latest && this.semverGt(latest, target))
+                    target = latest;
             }
-            if (target && target !== currentVersion) {
+            // Only notify when target is genuinely newer (semver), so a beta user on
+            // 2.0.8-beta.16 is never told that stable 2.0.7 is "available".
+            if (target && this.semverGt(target, currentVersion)) {
                 const generalId = this.findGeneralInstance();
                 if (generalId) {
                     this.notifyInstanceTopic(generalId, `🆕 AgEnD v${target} available (current: v${currentVersion}). Use \`/update\` to upgrade.`);
@@ -3557,6 +3866,49 @@ When users create specialized instances, suggest these configurations:
         }
         catch { /* silent — network issues */ }
     }
+    /**
+     * Semver "a > b". Compares major.minor.patch numerically; a version without a
+     * prerelease outranks the same core with one (2.0.8 > 2.0.8-beta.16); two
+     * prereleases compare identifier-by-identifier (numeric < alphanumeric, numeric
+     * fields compared as numbers). Sufficient for our X.Y.Z[-beta.N] scheme.
+     */
+    semverGt(a, b) {
+        const parse = (v) => {
+            const [core, pre] = v.replace(/^v/, "").split("-");
+            const nums = core.split(".").map(n => parseInt(n, 10) || 0);
+            return { nums: [nums[0] ?? 0, nums[1] ?? 0, nums[2] ?? 0], pre: pre ? pre.split(".") : [] };
+        };
+        const pa = parse(a), pb = parse(b);
+        for (let i = 0; i < 3; i++) {
+            if (pa.nums[i] !== pb.nums[i])
+                return pa.nums[i] > pb.nums[i];
+        }
+        if (pa.pre.length === 0 && pb.pre.length === 0)
+            return false;
+        if (pa.pre.length === 0)
+            return true; // a stable, b prerelease → a > b
+        if (pb.pre.length === 0)
+            return false; // a prerelease, b stable → a < b
+        const len = Math.max(pa.pre.length, pb.pre.length);
+        for (let i = 0; i < len; i++) {
+            const x = pa.pre[i], y = pb.pre[i];
+            if (x === undefined)
+                return false; // a has fewer identifiers → a < b
+            if (y === undefined)
+                return true; // a has more identifiers → a > b
+            const xn = /^\d+$/.test(x), yn = /^\d+$/.test(y);
+            if (xn && yn) {
+                const dx = parseInt(x, 10), dy = parseInt(y, 10);
+                if (dx !== dy)
+                    return dx > dy;
+            }
+            else if (xn !== yn)
+                return yn; // numeric has lower precedence than alphanumeric
+            else if (x !== y)
+                return x > y; // both alphanumeric
+        }
+        return false; // identical
+    }
     // ── Health HTTP endpoint ─────────────────────────────────────────────
     startHealthServer(port) {
         this.startedAt = Date.now();
@@ -3733,6 +4085,29 @@ When users create specialized instances, suggest these configurations:
                 })();
                 return;
             }
+            if (req.method === "POST" && req.url?.startsWith("/stop/")) {
+                const name = decodeURIComponent(req.url.slice("/stop/".length));
+                this.logger.info({ name }, "Instance stop requested via HTTP");
+                (async () => {
+                    try {
+                        // Runs inside the live fleet process: lifecycle.stop finds the
+                        // in-memory daemon and stops just this instance. (Doing this from a
+                        // detached CLI FleetManager would read the shared daemon.pid — the
+                        // fleet's own pid — and kill the whole fleet.)
+                        await this.stopInstance(name);
+                        this.logger.info({ name }, "Instance stopped");
+                        this.emitSseEvent("status", this.getUiStatus());
+                        res.writeHead(200);
+                        res.end(JSON.stringify({ stopped: name }));
+                    }
+                    catch (err) {
+                        this.logger.error({ err, name }, "Instance stop failed");
+                        res.writeHead(500);
+                        res.end(JSON.stringify({ error: `Stop failed: ${err.message}` }));
+                    }
+                })();
+                return;
+            }
             // ── Agent CLI endpoint ─────
             if (req.url === "/agent" && req.method === "POST") {
                 handleAgentRequest(req, res, this);