@songsid/agend 2.0.8-beta.9 → 2.0.9-beta.1

package/dist/fleet-manager.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync } from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
@@ -22,7 +22,7 @@ import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, sanitizeInstanceName } from "./topic-commands.js";
+import { TopicCommands, sanitizeInstanceName, saveCommandForBackend, parseSaveFilename, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -45,6 +45,14 @@ export function resolveReplyThreadId(argsThreadId, instanceConfig) {
     }
     return instanceConfig?.topic_id != null ? String(instanceConfig.topic_id) : undefined;
 }
+/** Retry cadence for retiring a cancel button whose delete failed (e.g. a DC
+ * forum thread the bot momentarily can't reach). 3 retries × 5min = 15min. */
+const CANCEL_BTN_RETRY_INTERVAL_MS = 5 * 60_000;
+const CANCEL_BTN_MAX_RETRIES = 3;
+/** Backstop: every 5min, retire a button whose instance has gone idle. Catches
+ * buttons no clear trigger reached (e.g. a scheduled/HTTP turn that never called
+ * reply). 5min (not the old 2s idle-watch) so Thinking isn't misread as idle. */
+const CANCEL_BTN_IDLE_CHECK_INTERVAL_MS = 5 * 60_000;
 export class FleetManager {
     dataDir;
     children = new Map();
@@ -78,9 +86,11 @@ export class FleetManager {
     topicIcons = {};
     lastActivity = new Map();
     lastInboundUser = new Map(); // instanceName → last username
-    // Pending "🛑 Cancel" button per instance — sent after a message is delivered,
-    // retired when the agent replies, when cancelled, or after a timeout.
-    pendingCancelMessages = new Map();
+    // Active "🛑 Cancel" buttons, tracked per button (keyed by messageId) rather
+    // than one-per-instance. A button is retired (deleted, with bounded retry) on
+    // reply, on cancel, or when a newer button supersedes it for the same
+    // instance. Per-button tracking means a failed delete never strands a button.
+    cancelButtons = new Map();
     // Last user message delivered to each instance — used to react ✅ on completion.
     lastInboundMsg = new Map();
     topicArchiver;
@@ -448,6 +458,10 @@ export class FleetManager {
                 .catch(e => this.logger.warn({ err: e }, "Failed to send daily summary"));
             // Rotate classic channel chat logs daily
             this.classicChannels?.rotateLogs();
+            this.rotateInboxes();
+            // Rotate fleet.log daily too (besides the startup size check above), so a
+            // long-running fleet doesn't accumulate an unbounded log.
+            rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
         }, () => {
             const instances = Object.keys(this.fleetConfig?.instances ?? {});
             const costMap = new Map();
@@ -459,6 +473,7 @@ export class FleetManager {
         this.dailySummary.start();
         // Rotate classic channel chat logs daily (piggyback on daily summary timer)
         this.classicChannels?.rotateLogs();
+        this.rotateInboxes();
         // Auto-create general instance(s) — one per adapter that lacks a general
         const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
         const generalInstances = Object.entries(fleet.instances).filter(([, inst]) => inst.general_topic === true);
@@ -686,6 +701,41 @@ export class FleetManager {
         };
         process.once("SIGUSR1", onFullRestart);
     }
+    /**
+     * Delete inbox files older than retentionDays (by mtime). Cleans the shared
+     * inbox (`<dataDir>/inbox`) and every workspace inbox
+     * (`<agendHome>/workspaces/*\/inbox`). Piggybacks on the daily summary timer,
+     * mirroring classic chat-log rotation (same 7-day retention).
+     */
+    rotateInboxes(retentionDays = 7) {
+        const cutoff = Date.now() - retentionDays * 86400_000;
+        const dirs = [join(this.dataDir, "inbox")];
+        const workspacesDir = join(getAgendHome(), "workspaces");
+        if (existsSync(workspacesDir)) {
+            for (const ws of readdirSync(workspacesDir)) {
+                dirs.push(join(workspacesDir, ws, "inbox"));
+            }
+        }
+        let deleted = 0;
+        for (const dir of dirs) {
+            if (!existsSync(dir))
+                continue;
+            for (const file of readdirSync(dir)) {
+                const full = join(dir, file);
+                try {
+                    const st = statSync(full);
+                    if (st.isFile() && st.mtimeMs < cutoff) {
+                        unlinkSync(full);
+                        deleted++;
+                    }
+                }
+                catch { /* file vanished or unreadable — skip */ }
+            }
+        }
+        if (deleted > 0)
+            this.logger.info({ deleted }, "Rotated inbox files");
+        return deleted;
+    }
     /** Start the shared channel adapter(s) for topic mode */
     async startSharedAdapter(fleet) {
         const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
@@ -737,10 +787,10 @@ export class FleetManager {
                         await this.startInstance(instanceName, config, topicMode);
                         // startInstance already calls connectIpcToInstance
                     }
-                    this.adapter?.editMessage(data.chatId, data.messageId, `🔄 ${instanceName} restarted.`).catch(() => { });
+                    this.adapter?.editMessage(data.chatId, data.messageId, `🔄 ${instanceName} restarted.`, data.threadId).catch(() => { });
                 }
                 else {
-                    this.adapter?.editMessage(data.chatId, data.messageId, `⏳ Continuing to wait for ${instanceName}.`).catch(() => { });
+                    this.adapter?.editMessage(data.chatId, data.messageId, `⏳ Continuing to wait for ${instanceName}.`, data.threadId).catch(() => { });
                 }
                 return;
             }
@@ -749,7 +799,7 @@ export class FleetManager {
                 // Idempotent: a button click only acts while the button is live. A
                 // second click (entry already cleared) is a no-op — don't re-send the
                 // interrupt key. (The /cancel command path calls cancelInstance directly.)
-                if (this.pendingCancelMessages.has(instanceName))
+                if (this.hasCancelButton(instanceName))
                     this.cancelInstance(instanceName);
                 return;
             }
@@ -794,7 +844,11 @@ export class FleetManager {
                     timestamp: new Date(),
                 });
             }
-            else if (data.command === "save" || data.command === "load") {
+            else if (data.command === "save") {
+                await this.handleSlashSave(data);
+            }
+            else if (data.command === "load") {
+                // load is kiro-cli/classic only — no claude-code equivalent.
                 if (!this.classicChannels?.isAdmin(data.userId)) {
                     await data.respond("⛔ This command requires admin access.");
                     return;
@@ -804,25 +858,13 @@ export class FleetManager {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
-                let rawCmd;
-                if (data.command === "save") {
-                    const filename = data.options?.filename;
-                    if (!/^[\w.-]+$/.test(filename)) {
-                        await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
-                        return;
-                    }
-                    rawCmd = data.options?.force ? `/chat save ${filename} -f` : `/chat save ${filename}`;
-                }
-                else {
-                    const filename = data.options?.filename;
-                    if (!/^[\w.-]+$/.test(filename)) {
-                        await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
-                        return;
-                    }
-                    rawCmd = `/chat load ${filename}`;
+                const filename = data.options?.filename;
+                if (!SAVE_FILENAME_RE.test(filename ?? "")) {
+                    await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
+                    return;
                 }
-                this.pasteRawToClassicInstance(target.name, rawCmd);
-                await data.respond(`✅ Sent \`${rawCmd}\` to ${target.name}`);
+                this.pasteRawToClassicInstance(target.name, `/chat load ${filename}`);
+                await data.respond(`✅ Sent \`/chat load ${filename}\` to ${target.name}`);
             }
             else if (data.command === "compact") {
                 const target = this.routing.resolve(data.channelId);
@@ -848,42 +890,8 @@ export class FleetManager {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
-                const instanceName = target.name;
-                const backend = target.kind === "classic"
-                    ? (this.classicChannels?.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend) ?? "claude-code")
-                    : (this.fleetConfig?.instances[instanceName]?.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
-                let context = null;
-                // Try statusline.json first
-                try {
-                    const statusFile = join(this.getInstanceDir(instanceName), "statusline.json");
-                    if (existsSync(statusFile)) {
-                        const d = JSON.parse(readFileSync(statusFile, "utf-8"));
-                        context = d.context_window?.used_percentage ?? null;
-                    }
-                }
-                catch { /* ignore */ }
-                // Fallback: capture tmux pane
-                if (context == null) {
-                    try {
-                        const { execFileSync } = await import("node:child_process");
-                        const { getTmuxSocketName } = await import("./paths.js");
-                        const socketName = getTmuxSocketName();
-                        const tmuxArgs = socketName
-                            ? ["-L", socketName, "capture-pane", "-t", `${getTmuxSession()}:${instanceName}`, "-p"]
-                            : ["capture-pane", "-t", `${getTmuxSession()}:${instanceName}`, "-p"];
-                        const pane = execFileSync("tmux", tmuxArgs, { encoding: "utf-8", timeout: 2000, stdio: ["pipe", "pipe", "pipe"] });
-                        const m = pane.match(/(\d+)%.*[!❯>]/m) || pane.match(/◔\s*(\d+)%/) || pane.match(/\[(\d+)%\]/);
-                        if (m)
-                            context = parseInt(m[1], 10);
-                    }
-                    catch { /* ignore */ }
-                }
-                if (context != null) {
-                    await data.respond(`📊 Context: ${context}% used\nBackend: ${backend}\nInstance: ${instanceName}`);
-                }
-                else {
-                    await data.respond(`Context info not available yet.\nBackend: ${backend}\nInstance: ${instanceName}`);
-                }
+                // Single source of truth (statusline.json + robust tmux pane fallback).
+                await data.respond(await this.topicCommands.getCtxText(target.name));
             }
             else if (data.command === "collab") {
                 const collabTarget = this.routing.resolve(data.channelId);
@@ -1044,17 +1052,17 @@ export class FleetManager {
                         const topicMode = this.fleetConfig?.channel?.mode === "topic";
                         await this.startInstance(instanceName, config, topicMode);
                     }
-                    adapter.editMessage(data.chatId, data.messageId, `🔄 ${instanceName} restarted.`).catch(() => { });
+                    adapter.editMessage(data.chatId, data.messageId, `🔄 ${instanceName} restarted.`, data.threadId).catch(() => { });
                 }
                 else {
-                    adapter.editMessage(data.chatId, data.messageId, `⏳ Continuing to wait for ${instanceName}.`).catch(() => { });
+                    adapter.editMessage(data.chatId, data.messageId, `⏳ Continuing to wait for ${instanceName}.`, data.threadId).catch(() => { });
                 }
                 return;
             }
             if (data.callbackData.startsWith("cancel:")) {
                 const instanceName = data.callbackData.slice("cancel:".length);
                 // Idempotent: only the first click (while the button is live) acts.
-                if (this.pendingCancelMessages.has(instanceName))
+                if (this.hasCancelButton(instanceName))
                     this.cancelInstance(instanceName);
                 return;
             }
@@ -1098,7 +1106,11 @@ export class FleetManager {
                     timestamp: new Date(),
                 });
             }
-            else if (data.command === "save" || data.command === "load") {
+            else if (data.command === "save") {
+                await this.handleSlashSave(data);
+            }
+            else if (data.command === "load") {
+                // load is kiro-cli/classic only — no claude-code equivalent.
                 if (!this.classicChannels?.isAdmin(data.userId)) {
                     await data.respond("⛔ This command requires admin access.");
                     return;
@@ -1108,25 +1120,13 @@ export class FleetManager {
                     await data.respond("No active agent in this channel. Use `/start` first.");
                     return;
                 }
-                let rawCmd;
-                if (data.command === "save") {
-                    const filename = data.options?.filename;
-                    if (!/^[\w.-]+$/.test(filename)) {
-                        await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
-                        return;
-                    }
-                    rawCmd = data.options?.force ? `/chat save ${filename} -f` : `/chat save ${filename}`;
-                }
-                else {
-                    const filename = data.options?.filename;
-                    if (!/^[\w.-]+$/.test(filename)) {
-                        await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
-                        return;
-                    }
-                    rawCmd = `/chat load ${filename}`;
+                const filename = data.options?.filename;
+                if (!SAVE_FILENAME_RE.test(filename ?? "")) {
+                    await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
+                    return;
                 }
-                this.pasteRawToClassicInstance(target.name, rawCmd);
-                await data.respond(`✅ Sent \`${rawCmd}\` to ${target.name}`);
+                this.pasteRawToClassicInstance(target.name, `/chat load ${filename}`);
+                await data.respond(`✅ Sent \`/chat load ${filename}\` to ${target.name}`);
             }
             else if (data.command === "compact") {
                 const target = this.routing.resolve(data.channelId);
@@ -1152,25 +1152,8 @@ export class FleetManager {
                     await data.respond("No active agent in this channel.");
                     return;
                 }
-                const instanceName = target.name;
-                const ctxBackend = target.kind === "classic"
-                    ? (this.classicChannels?.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend) ?? "claude-code")
-                    : (this.fleetConfig?.instances[instanceName]?.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
-                let context = null;
-                try {
-                    const statusFile = join(this.getInstanceDir(instanceName), "statusline.json");
-                    if (existsSync(statusFile)) {
-                        const d = JSON.parse(readFileSync(statusFile, "utf-8"));
-                        context = d.context_window?.used_percentage ?? null;
-                    }
-                }
-                catch { /* ignore */ }
-                if (context != null) {
-                    await data.respond(`📊 Context: ${context}% used\nBackend: ${ctxBackend}\nInstance: ${instanceName}`);
-                }
-                else {
-                    await data.respond(`Context info not available yet.\nBackend: ${ctxBackend}\nInstance: ${instanceName}`);
-                }
+                // Single source of truth (statusline.json + robust tmux pane fallback).
+                await data.respond(await this.topicCommands.getCtxText(target.name));
             }
             else if (data.command === "collab") {
                 const collabTarget2 = this.routing.resolve(data.channelId);
@@ -1538,6 +1521,15 @@ export class FleetManager {
                 const isBotMentioned = !!(botUser && text.toLowerCase().includes(`@${botUser.toLowerCase()}`));
                 const isPrivateChat = !chatId.startsWith("-"); // Telegram: positive = private, negative = group
                 const msgAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
+                // In a TG Classic group, ignore bare slash commands (no @bot specified).
+                // Prevents multiple bots all responding to the same /ctx, /compact, etc.
+                // `/cmd@otherbot` already returned above; `/cmd@mybot` set cmdMatch, so it
+                // still processes. Private chat (only one bot) always processes.
+                // NOTE: this also silently drops bare `/start` in a group, so group
+                // onboarding now requires `/start@mybot` — consistent with the policy.
+                if (!isPrivateChat && !cmdMatch && rawText.startsWith("/")) {
+                    return; // bare slash in group — ignore silently
+                }
                 // Handle /start command
                 if (text === "/start" || text.startsWith("/start ")) {
                     if (isPrivateChat) {
@@ -1629,6 +1621,36 @@ export class FleetManager {
                     await msgAdapter?.sendText(chatId, reply);
                     return;
                 }
+                // Handle /save command (admin only)
+                if (text === "/save" || text.startsWith("/save ") || text.startsWith("/save@")) {
+                    if (!this.classicChannels.isAdmin(msg.userId)) {
+                        await msgAdapter?.sendText(chatId, "⛔ /save requires admin access.");
+                        return;
+                    }
+                    const saveTarget = this.routing.resolve(chatId);
+                    if (!saveTarget || saveTarget.kind !== "classic") {
+                        await msgAdapter?.sendText(chatId, "No active agent. Use /start first.");
+                        return;
+                    }
+                    const filename = parseSaveFilename(text);
+                    if (!filename) {
+                        await msgAdapter?.sendText(chatId, "Usage: /save <filename>");
+                        return;
+                    }
+                    if (!SAVE_FILENAME_RE.test(filename)) {
+                        await msgAdapter?.sendText(chatId, "⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
+                        return;
+                    }
+                    const backend = this.classicChannels.getBackendByInstance(saveTarget.name, this.fleetConfig?.defaults?.backend);
+                    const cmd = saveCommandForBackend(backend, filename);
+                    if (!cmd) {
+                        await msgAdapter?.sendText(chatId, SAVE_UNSUPPORTED_MSG);
+                        return;
+                    }
+                    this.pasteRawToClassicInstance(saveTarget.name, cmd);
+                    await msgAdapter?.sendText(chatId, `✅ Sent \`${cmd}\` to ${saveTarget.name}`);
+                    return;
+                }
                 // Route to classic channel if registered
                 const target = this.routing.resolve(chatId);
                 if (target?.kind === "classic") {
@@ -1907,7 +1929,7 @@ export class FleetManager {
         if (!chatId)
             return;
         if (editMessageId) {
-            statusAdapter.editMessage(chatId, editMessageId, text).catch(e => this.logger.debug({ err: e }, "Failed to edit tool status message"));
+            statusAdapter.editMessage(chatId, editMessageId, text, threadId).catch(e => this.logger.debug({ err: e }, "Failed to edit tool status message"));
         }
         else {
             statusAdapter.sendText(chatId, text, { threadId }).then((sent) => {
@@ -1945,6 +1967,8 @@ export class FleetManager {
                 payload: { schedule_id: id, message: `[Scheduled] ${message}`, label },
                 meta: { chat_id: reply_chat_id, thread_id: reply_thread_id, user: "scheduler" },
             });
+            // A scheduled trigger also puts the instance to work — show a cancel button.
+            void this.sendCancelButton(target);
             return true;
         };
         if (deliver()) {
@@ -2574,9 +2598,57 @@ export class FleetManager {
     // Sent after delivering a user message to an instance; clicking it (or
     // /cancel) sends Escape to the instance's pane to interrupt generation.
     /** Send a "🛑 Cancel" button to the instance's topic/channel after delivery. */
-    async sendCancelButton(instanceName) {
-        // Replace any stale button for this instance first.
-        this.clearCancelButton(instanceName);
+    /**
+     * Handle the DC `/save` slash command for both classic AND fleet-topic targets.
+     * Picks the backend-appropriate command (kiro → /chat save, claude → /export);
+     * unsupported backends get a clear error. Routes via classic paste or fleet IPC.
+     */
+    async handleSlashSave(data) {
+        if (!this.classicChannels?.isAdmin(data.userId)) {
+            await data.respond("⛔ This command requires admin access.");
+            return;
+        }
+        const target = this.routing.resolve(data.channelId);
+        if (!target) {
+            await data.respond("No active agent in this channel. Use `/start` first.");
+            return;
+        }
+        const filename = data.options?.filename ?? "";
+        if (!SAVE_FILENAME_RE.test(filename)) {
+            await data.respond("⛔ Invalid filename — only letters, numbers, dots, hyphens, underscores allowed.");
+            return;
+        }
+        const backend = target.kind === "classic"
+            ? this.classicChannels.getBackendByInstance(target.name, this.fleetConfig?.defaults?.backend)
+            : (this.fleetConfig?.instances[target.name]?.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
+        // force (-f) is only meaningful for kiro/classic /chat save.
+        const force = target.kind === "classic" && !!data.options?.force;
+        const cmd = saveCommandForBackend(backend, filename, force);
+        if (!cmd) {
+            await data.respond(SAVE_UNSUPPORTED_MSG);
+            return;
+        }
+        if (target.kind === "classic") {
+            this.pasteRawToClassicInstance(target.name, cmd);
+        }
+        else {
+            this.instanceIpcClients.get(target.name)?.send({ type: "raw_paste", content: cmd });
+        }
+        await data.respond(`✅ Sent \`${cmd}\` to ${target.name}`);
+    }
+    /** Whether the instance currently has at least one live cancel button. */
+    hasCancelButton(instanceName) {
+        for (const e of this.cancelButtons.values()) {
+            if (e.instanceName === instanceName)
+                return true;
+        }
+        return false;
+    }
+    async sendCancelButton(instanceName, correlationId) {
+        // At most one button shown per instance: retire any existing ones first
+        // (delete + bounded retry). Each is tracked separately, so a failed delete
+        // here doesn't strand it — it keeps retrying on its own timer.
+        this.retireInstanceButtons(instanceName);
         const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
         if (!adapter)
             return;
@@ -2611,34 +2683,114 @@ export class FleetManager {
                 message: "👀 處理中…",
                 choices: [{ id: `cancel:${instanceName}`, label: "🛑 取消" }],
             }, threadId ? { threadId } : undefined);
-            const timer = setTimeout(() => this.clearCancelButton(instanceName), 30_000);
-            this.pendingCancelMessages.set(instanceName, {
-                adapterId, chatId: sent.chatId, messageId: sent.messageId, threadId: sent.threadId ?? threadId, timer,
-            });
+            // A concurrent sendCancelButton for the same instance may have posted its
+            // own button while we awaited notifyAlert. Retire any other buttons for
+            // this instance (not the one we just posted) so only the newest shows.
+            for (const other of this.cancelButtons.values()) {
+                if (other.instanceName === instanceName)
+                    this.retireButton(other);
+            }
+            const entry = {
+                instanceName,
+                adapterId,
+                chatId: sent.chatId,
+                messageId: sent.messageId,
+                threadId: sent.threadId ?? threadId,
+                correlationId,
+                retryCount: 0,
+            };
+            // Idle-check backstop: every 5min, if the instance is idle, retire the
+            // button. Covers turns that end without hitting a clear trigger (reply /
+            // cancel / correlation). Cleared in discardButton when the entry is removed.
+            entry.idleCheckTimer = setInterval(() => {
+                if (!this.cancelButtons.has(entry.messageId)) {
+                    clearInterval(entry.idleCheckTimer);
+                    return;
+                }
+                if (this.getInstanceIdle(instanceName)) {
+                    this.logger.info({ instanceName, messageId: entry.messageId }, "Cancel button idle backstop retiring");
+                    this.retireButton(entry);
+                }
+            }, CANCEL_BTN_IDLE_CHECK_INTERVAL_MS);
+            this.cancelButtons.set(sent.messageId, entry);
+            this.logger.info({ instanceName, messageId: sent.messageId }, "Cancel button sent");
         }
         catch (e) {
-            this.logger.debug({ err: e.message, instanceName }, "Failed to send cancel button");
+            this.logger.warn({ err: e.message, instanceName }, "Failed to send cancel button");
         }
     }
-    /** Retire (delete) the pending cancel button — on reply, cancel, or timeout. */
-    clearCancelButton(instanceName) {
-        const pending = this.pendingCancelMessages.get(instanceName);
-        if (!pending)
+    /** Retire (delete) every cancel button belonging to an instance. */
+    retireInstanceButtons(instanceName) {
+        // Snapshot first — retireButton may delete entries from the map on success.
+        for (const e of [...this.cancelButtons.values()]) {
+            if (e.instanceName === instanceName)
+                this.retireButton(e);
+        }
+    }
+    /** Begin retiring one button (delete + bounded retry on failure). Idempotent:
+     * a button already in a retire cycle is left to its own timer, so a second
+     * retire request (e.g. a new send + the post-await sweep) won't double-delete. */
+    retireButton(entry) {
+        if (entry.retiring)
             return;
-        clearTimeout(pending.timer);
-        this.pendingCancelMessages.delete(instanceName);
-        const adapter = (pending.adapterId ? this.worlds.get(pending.adapterId)?.adapter : undefined)
-            ?? this.getAdapterForInstance(instanceName) ?? this.adapter;
-        if (!adapter)
+        entry.retiring = true;
+        this.attemptButtonDelete(entry);
+    }
+    attemptButtonDelete(entry) {
+        this.deleteButtonMessage(entry)
+            .then(() => {
+            this.discardButton(entry);
+            this.logger.info({ instanceName: entry.instanceName, messageId: entry.messageId }, "Cancel button removed");
+        })
+            .catch((err) => this.scheduleButtonRetry(entry, err));
+    }
+    /** Clear an entry's timers (retry + idle-check) and drop it from the map. */
+    discardButton(entry) {
+        if (entry.retryTimer)
+            clearTimeout(entry.retryTimer);
+        if (entry.idleCheckTimer)
+            clearInterval(entry.idleCheckTimer);
+        this.cancelButtons.delete(entry.messageId);
+    }
+    /** Re-attempt a failed button delete up to CANCEL_BTN_MAX_RETRIES times. */
+    scheduleButtonRetry(entry, err) {
+        if (entry.retryCount >= CANCEL_BTN_MAX_RETRIES) {
+            this.discardButton(entry);
+            this.logger.warn({ instanceName: entry.instanceName, messageId: entry.messageId, err: err.message }, `Cancel button delete gave up after ${CANCEL_BTN_MAX_RETRIES} retries`);
             return;
-        if (adapter.deleteMessage) {
-            adapter.deleteMessage(pending.chatId, pending.messageId)
-                .catch((e) => this.logger.debug({ err: e.message, instanceName }, "Failed to delete cancel button"));
         }
-        else {
-            // Fallback for adapters without delete: at least drop the button.
-            const remove = adapter.editMessageRemoveButtons?.bind(adapter) ?? adapter.editMessage.bind(adapter);
-            remove(pending.chatId, pending.messageId, "✅").catch(() => { });
+        entry.retryCount++;
+        this.logger.warn({ instanceName: entry.instanceName, messageId: entry.messageId, attempt: entry.retryCount, err: err.message }, "Cancel button delete failed, will retry");
+        if (entry.retryTimer)
+            clearTimeout(entry.retryTimer);
+        // Continue the same retire cycle (bypass the retiring-guard in retireButton).
+        entry.retryTimer = setTimeout(() => this.attemptButtonDelete(entry), CANCEL_BTN_RETRY_INTERVAL_MS);
+    }
+    /** Delete one button's message via its own adapter. Resolves on success,
+     * rejects on failure so the caller can retry. */
+    deleteButtonMessage(e) {
+        const adapter = (e.adapterId ? this.worlds.get(e.adapterId)?.adapter : undefined) ?? this.adapter;
+        if (!adapter)
+            return Promise.reject(new Error("no adapter for cancel button"));
+        if (adapter.deleteMessage)
+            return adapter.deleteMessage(e.chatId, e.messageId, e.threadId);
+        if (adapter.editMessageRemoveButtons)
+            return adapter.editMessageRemoveButtons(e.chatId, e.messageId, "✅", e.threadId);
+        return adapter.editMessage(e.chatId, e.messageId, "✅", e.threadId);
+    }
+    /** Retire all cancel buttons for an instance — on reply or cancel. */
+    clearCancelButton(instanceName) {
+        this.retireInstanceButtons(instanceName);
+    }
+    /** Retire the cross-instance button matching a delegate→report correlation id.
+     * Used by report_result, where the sender's self-derived name may not match
+     * the target-address name the button was registered under. */
+    clearCancelButtonByCorrelation(correlationId) {
+        if (!correlationId)
+            return;
+        for (const e of [...this.cancelButtons.values()]) {
+            if (e.correlationId === correlationId)
+                this.retireButton(e);
         }
     }
     /**
@@ -2658,15 +2810,13 @@ export class FleetManager {
             adapterId: msg.adapterId, chatId: msg.chatId, threadId: msg.threadId ?? undefined, messageId: msg.messageId, source: msg.source,
         });
     }
-    /** React ✅ on the last user message after the agent replies. */
+    /** Clear the tracked last-inbound message after the agent replies. The ✅
+     * reaction is already applied by delivery confirmation (message_confirmed), so
+     * reacting again here would be a duplicate API call — we only drop the entry. */
     reactDone(instanceName) {
-        const m = this.lastInboundMsg.get(instanceName);
-        if (!m)
+        if (!this.lastInboundMsg.has(instanceName))
             return;
         this.lastInboundMsg.delete(instanceName);
-        const adapter = (m.adapterId ? this.worlds.get(m.adapterId)?.adapter : undefined)
-            ?? this.getAdapterForInstance(instanceName) ?? this.adapter;
-        adapter?.react(this.reactTarget(m), m.messageId, "✅").catch(() => { });
     }
     /** Interrupt an instance's current generation (cancel button / /cancel). */
     cancelInstance(instanceName) {
@@ -3725,14 +3875,21 @@ When users create specialized instances, suggest these configurations:
             const latest = execSync("npm view @songsid/agend version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
             let target = latest;
             if (currentVersion.includes("-beta")) {
+                // Beta users track the @beta channel (never fall back to @latest, which is
+                // older), but should also hear when a newer STABLE ships — pick whichever
+                // of beta/latest is the newest.
+                let beta = "";
                 try {
-                    const beta = execSync("npm view @songsid/agend@beta version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
-                    if (beta && beta !== currentVersion)
-                        target = beta;
+                    beta = execSync("npm view @songsid/agend@beta version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
                 }
                 catch { /* no beta tag */ }
+                target = beta || latest;
+                if (latest && this.semverGt(latest, target))
+                    target = latest;
             }
-            if (target && target !== currentVersion) {
+            // Only notify when target is genuinely newer (semver), so a beta user on
+            // 2.0.8-beta.16 is never told that stable 2.0.7 is "available".
+            if (target && this.semverGt(target, currentVersion)) {
                 const generalId = this.findGeneralInstance();
                 if (generalId) {
                     this.notifyInstanceTopic(generalId, `🆕 AgEnD v${target} available (current: v${currentVersion}). Use \`/update\` to upgrade.`);
@@ -3741,6 +3898,49 @@ When users create specialized instances, suggest these configurations:
         }
         catch { /* silent — network issues */ }
     }
+    /**
+     * Semver "a > b". Compares major.minor.patch numerically; a version without a
+     * prerelease outranks the same core with one (2.0.8 > 2.0.8-beta.16); two
+     * prereleases compare identifier-by-identifier (numeric < alphanumeric, numeric
+     * fields compared as numbers). Sufficient for our X.Y.Z[-beta.N] scheme.
+     */
+    semverGt(a, b) {
+        const parse = (v) => {
+            const [core, pre] = v.replace(/^v/, "").split("-");
+            const nums = core.split(".").map(n => parseInt(n, 10) || 0);
+            return { nums: [nums[0] ?? 0, nums[1] ?? 0, nums[2] ?? 0], pre: pre ? pre.split(".") : [] };
+        };
+        const pa = parse(a), pb = parse(b);
+        for (let i = 0; i < 3; i++) {
+            if (pa.nums[i] !== pb.nums[i])
+                return pa.nums[i] > pb.nums[i];
+        }
+        if (pa.pre.length === 0 && pb.pre.length === 0)
+            return false;
+        if (pa.pre.length === 0)
+            return true; // a stable, b prerelease → a > b
+        if (pb.pre.length === 0)
+            return false; // a prerelease, b stable → a < b
+        const len = Math.max(pa.pre.length, pb.pre.length);
+        for (let i = 0; i < len; i++) {
+            const x = pa.pre[i], y = pb.pre[i];
+            if (x === undefined)
+                return false; // a has fewer identifiers → a < b
+            if (y === undefined)
+                return true; // a has more identifiers → a > b
+            const xn = /^\d+$/.test(x), yn = /^\d+$/.test(y);
+            if (xn && yn) {
+                const dx = parseInt(x, 10), dy = parseInt(y, 10);
+                if (dx !== dy)
+                    return dx > dy;
+            }
+            else if (xn !== yn)
+                return yn; // numeric has lower precedence than alphanumeric
+            else if (x !== y)
+                return x > y; // both alphanumeric
+        }
+        return false; // identical
+    }
     // ── Health HTTP endpoint ─────────────────────────────────────────────
     startHealthServer(port) {
         this.startedAt = Date.now();
@@ -3917,6 +4117,29 @@ When users create specialized instances, suggest these configurations:
                 })();
                 return;
             }
+            if (req.method === "POST" && req.url?.startsWith("/stop/")) {
+                const name = decodeURIComponent(req.url.slice("/stop/".length));
+                this.logger.info({ name }, "Instance stop requested via HTTP");
+                (async () => {
+                    try {
+                        // Runs inside the live fleet process: lifecycle.stop finds the
+                        // in-memory daemon and stops just this instance. (Doing this from a
+                        // detached CLI FleetManager would read the shared daemon.pid — the
+                        // fleet's own pid — and kill the whole fleet.)
+                        await this.stopInstance(name);
+                        this.logger.info({ name }, "Instance stopped");
+                        this.emitSseEvent("status", this.getUiStatus());
+                        res.writeHead(200);
+                        res.end(JSON.stringify({ stopped: name }));
+                    }
+                    catch (err) {
+                        this.logger.error({ err, name }, "Instance stop failed");
+                        res.writeHead(500);
+                        res.end(JSON.stringify({ error: `Stop failed: ${err.message}` }));
+                    }
+                })();
+                return;
+            }
             // ── Agent CLI endpoint ─────
             if (req.url === "/agent" && req.method === "POST") {
                 handleAgentRequest(req, res, this);