@songsid/agend 2.1.10-beta.4 → 2.1.10-beta.6

package/dist/fleet-manager.js

@@ -7,6 +7,7 @@ import { Worker } from "node:worker_threads";
 import { join, dirname, basename, delimiter, isAbsolute } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
+import { fleetLabel } from "./fleet-label.js";
 import { beginFullRestartProgress as persistFullRestartProgress, beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, setUpdateProgressStage, updateProgressOperation, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
 import { sdNotify, sdNotifyBlocking } from "./sd-notify.js";
@@ -206,6 +207,11 @@ const IGNORED_REACTION_EMOJIS = new Set(["📷"]);
  */
 const IPC_RECONNECT_GRACE_MS = 30_000;
 const IPC_RECONNECT_POLL_MS = 250;
+/** The prefix of a button's callback data, for logs (never the nonce). */
+function callbackPrefix(callbackData) {
+    const colon = callbackData.indexOf(":");
+    return colon === -1 ? "(none)" : callbackData.slice(0, colon + 1);
+}
 const CLASSIC_BACKEND_SELECTION_TIMEOUT_MS = 60_000;
 const CLASSIC_BACKEND_CALLBACK_PREFIX = "classic-backend:";
 const MODEL_SELECT_CALLBACK_PREFIX = "model-select:";
@@ -217,11 +223,12 @@ const CLEAR_CONFIRM_CALLBACK_PREFIX = "clear-confirm:";
 const TIP_DISMISS_CALLBACK_PREFIX = "tip-dismiss:";
 const TIP_UNLOCK_CALLBACK_PREFIX = "tip-unlock:";
 export const LOGIN_CALLBACK_PREFIX = "login:";
-const INSTALL_CALLBACK_PREFIX = "install-select:";
+/** Prompt kinds `/install-cli` used, before it became part of `/login` (#1131). */
+const RETIRED_PROMPT_PREFIXES = ["install-select:", "install-login:"];
+const NEVER_MATCHES = /(?!)/;
 const CLASSIC_APPROVE_CALLBACK_PREFIX = "classic-approve:";
 const LOGIN_MENU_CALLBACK_PREFIX = "login-menu:";
 const LOGIN_CONFIRM_CALLBACK_PREFIX = "login-confirm:";
-const INSTALL_LOGIN_CALLBACK_PREFIX = "install-login:";
 const CLEAR_CONFIRM_TIMEOUT_MS = 15_000;
 /** Default lifetime for long-lived nonce prompts (clear overrides this to 15s). */
 const NONCE_BUTTON_TIMEOUT_MS = 15 * 60_000;
@@ -382,6 +389,8 @@ export class FleetManager {
     instanceStateCache = new Map();
     /** CLI pane status overrides; daemon.pid alone only proves FleetManager lives. */
     instanceProcessStatus = new Map();
+    /** Adapters whose last slash command registration failed and General was told (#1131). */
+    slashRegistrationFailed = new Set();
     /** Instances currently being auto-paused by warm_cap, so concurrent checks don't double-evict. */
     warmCapEvicting = new Set();
     /** Per-instance tail keeps cross-instance and scheduled deliveries FIFO. */
@@ -2667,7 +2676,7 @@ export class FleetManager {
     /**
      * Probe the same executable set exposed by the web backend catalog.
      *
-     * This deliberately has no cache: an `/install-cli` completion can add a
+     * This deliberately has no cache: an install `/login` ran can add a
      * binary to PATH while the fleet process remains alive, and the next bare
      * `/login` must see it without requiring a restart or an explicit cache
      * invalidation call.
@@ -3910,6 +3919,29 @@ export class FleetManager {
         return this.adapterState;
     }
     bindAdapterHealth(adapter, adapterId) {
+        // Discord slash command registration, every gateway ready (#1131). A
+        // rejected registration leaves the previous command list in place, so a
+        // new command silently never appears: log every outcome, and tell General
+        // once per failure streak (a reconnect loop must not repeat it).
+        adapter.on("slash_registration", (outcome) => {
+            if (this.adapters.get(adapterId) !== adapter)
+                return;
+            if (outcome.ok) {
+                this.slashRegistrationFailed.delete(adapterId);
+                this.logger.info({ adapterId, count: outcome.count }, "Registered Discord slash commands");
+                return;
+            }
+            this.logger.warn({ adapterId, code: outcome.code, status: outcome.status, error: outcome.message }, "Discord rejected the slash command registration; the previous command list stays");
+            if (this.slashRegistrationFailed.has(adapterId))
+                return;
+            const detail = [outcome.code, outcome.message].filter(v => v !== undefined && v !== "").join(" ");
+            // The streak is the de-duplication (not the shared text throttle), and
+            // it counts as told only once General actually got it: with nowhere to
+            // post yet, the next failure tries again.
+            if (this.notifyFleetError(t("discord.slash_registration_failed", adapterId, detail), { throttle: false })) {
+                this.slashRegistrationFailed.add(adapterId);
+            }
+        });
         adapter.on("gateway_health", (snapshot) => {
             // A token rotation tears down the old EventEmitter before constructing
             // the replacement. A late health frame from that old client must never
@@ -4016,6 +4048,7 @@ export class FleetManager {
             botToken,
             accessManager,
             inboxDir,
+            fleetLabel: fleetLabel(this.fleetConfig),
         });
         const adapter = this.adapter;
         const world = new AdapterWorld(adapterId, adapter, accessManager, channelConfig);
@@ -4034,44 +4067,7 @@ export class FleetManager {
             await this.handleInboundReaction(r);
         }, this.logger, "adapter.reaction"));
         this.adapter.on("callback_query", safeHandler(async (data) => {
-            if (!isCurrentAdapter())
-                return;
-            if (await this.handleTipDismiss(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleTipUnlock(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleLoginBackendSelect(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleInstallBackendSelect(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleClassicApproval(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleLoginMenuSelect(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleLoginConfirm(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleLoginTokenResend(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleInstallLoginConfirm(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleClearConfirmation(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleExitRestartPrompt(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleInteractivePromptAssist(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (await this.handleClassicBackendSelection(data))
-                return;
-            if (await this.handleModelSelection(data))
-                return;
-            if (await this.handleEffortSelection(data))
-                return;
-            if (await this.handleHangPrompt(data, adapterId, this.adapter ?? undefined))
-                return;
-            if (data.callbackData.startsWith("cancel:")) {
-                this.handleCancelClick(data.callbackData.slice("cancel:".length), this.adapter, data);
-                return;
-            }
+            await this.receiveAdapterCallback(data, adapterId, this.adapter ?? undefined, isCurrentAdapter);
         }, this.logger, "adapter.callback_query"));
         this.bindTopicClosedHandler(adapter, adapterId, "adapter.topic_closed");
         // Handle classic bot slash commands (/start, /stop, /chat, /compact, /save, /load)
@@ -4183,9 +4179,6 @@ export class FleetManager {
             else if (data.command === "login") {
                 await this.handleLoginSlash(data, adapterId, this.adapter);
             }
-            else if (data.command === "install-cli") {
-                await this.handleInstallCliSlash(data, adapterId, this.adapter);
-            }
             else if (data.command === "clear") {
                 await this.handleClearSlash(data, adapterId);
             }
@@ -4348,9 +4341,6 @@ export class FleetManager {
             else if (data.command === "login") {
                 await this.handleLoginSlash(data, adapterId, this.adapter);
             }
-            else if (data.command === "install-cli") {
-                await this.handleInstallCliSlash(data, adapterId, this.adapter);
-            }
         }, this.logger, "adapter.slash_command"));
         await this.topicCommands.registerBotCommands().catch(e => this.logger.warn({ err: e }, "registerBotCommands failed (non-fatal)"));
         // Background-probe each backend's CLI env (version/models) → cli-env cache.
@@ -4428,6 +4418,7 @@ export class FleetManager {
             accessManager,
             inboxDir,
             registerCommands,
+            fleetLabel: fleetLabel(this.fleetConfig),
         });
         const world = new AdapterWorld(adapterId, adapter, accessManager, channelConfig);
         this.worlds.set(adapterId, world);
@@ -4446,44 +4437,7 @@ export class FleetManager {
             await this.handleInboundReaction(r);
         }, this.logger, `adapter[${adapterId}].reaction`));
         adapter.on("callback_query", safeHandler(async (data) => {
-            if (!isCurrentAdapter())
-                return;
-            if (await this.handleTipDismiss(data, adapterId, adapter))
-                return;
-            if (await this.handleTipUnlock(data, adapterId, adapter))
-                return;
-            if (await this.handleLoginBackendSelect(data, adapterId, adapter))
-                return;
-            if (await this.handleInstallBackendSelect(data, adapterId, adapter))
-                return;
-            if (await this.handleClassicApproval(data, adapterId, adapter))
-                return;
-            if (await this.handleLoginMenuSelect(data, adapterId, adapter))
-                return;
-            if (await this.handleLoginConfirm(data, adapterId, adapter))
-                return;
-            if (await this.handleLoginTokenResend(data, adapterId, adapter))
-                return;
-            if (await this.handleInstallLoginConfirm(data, adapterId, adapter))
-                return;
-            if (await this.handleClearConfirmation(data, adapterId, adapter))
-                return;
-            if (await this.handleExitRestartPrompt(data, adapterId, adapter))
-                return;
-            if (await this.handleInteractivePromptAssist(data, adapterId, adapter))
-                return;
-            if (await this.handleClassicBackendSelection(data))
-                return;
-            if (await this.handleModelSelection(data))
-                return;
-            if (await this.handleEffortSelection(data))
-                return;
-            if (await this.handleHangPrompt(data, adapterId, adapter))
-                return;
-            if (data.callbackData.startsWith("cancel:")) {
-                this.handleCancelClick(data.callbackData.slice("cancel:".length), adapter, data);
-                return;
-            }
+            await this.receiveAdapterCallback(data, adapterId, adapter, isCurrentAdapter);
         }, this.logger, `adapter[${adapterId}].callback_query`));
         this.bindTopicClosedHandler(adapter, adapterId, `adapter[${adapterId}].topic_closed`);
         // Slash commands: classic bot + admin commands
@@ -4708,9 +4662,6 @@ export class FleetManager {
             else if (data.command === "login") {
                 await this.handleLoginSlash(data, adapterId, adapter);
             }
-            else if (data.command === "install-cli") {
-                await this.handleInstallCliSlash(data, adapterId, adapter);
-            }
         }, this.logger, `adapter[${adapterId}].slash_command`));
         adapter.on("started", safeHandler((username, userId) => {
             if (!isCurrentAdapter())
@@ -8005,13 +7956,20 @@ export class FleetManager {
         this.adapter.sendText(target.chatId, text, target.opts)
             .catch(e => this.logger.warn({ err: e }, "Failed to send daily summary"));
     }
-    notifyFleetError(text) {
+    /**
+     * Returns whether the notice was dispatched. `throttle: false` is for a
+     * caller that does its own de-duplication (one notice per failure streak):
+     * the shared 10-minute text throttle would otherwise swallow the next
+     * streak's notice, and it is neither consulted nor recorded.
+     */
+    notifyFleetError(text, opts = {}) {
+        const throttled = opts.throttle !== false;
         const now = Date.now();
         const key = text.slice(0, 200);
-        const seen = this.fleetErrorNotices.get(key);
+        const seen = throttled ? this.fleetErrorNotices.get(key) : undefined;
         if (seen && now - seen.at < FleetManager.FLEET_ERROR_THROTTLE_MS) {
             seen.suppressed++;
-            return;
+            return false;
         }
         const suppressed = seen?.suppressed ?? 0;
         const body = suppressed > 0
@@ -8049,8 +8007,10 @@ export class FleetManager {
             // unspent lets the next caller, once an adapter is up, actually get
             // through. The counter is not reset either: nothing was shown.
             this.logger.warn({ text: body }, "Fleet error could not be delivered (no adapter or no target yet) — not consuming the throttle window");
-            return;
+            return false;
         }
+        if (!throttled)
+            return true;
         this.fleetErrorNotices.set(key, { at: now, suppressed: 0 });
         // Bound the map: it is keyed by message text, and a message with a varying
         // suffix (a path, an id) would otherwise grow it without limit.
@@ -8059,6 +8019,7 @@ export class FleetManager {
             if (oldest !== undefined)
                 this.fleetErrorNotices.delete(oldest);
         }
+        return true;
     }
     static FLEET_ERROR_THROTTLE_MS = 10 * 60_000;
     fleetErrorNotices = new Map();
@@ -8121,7 +8082,22 @@ export class FleetManager {
      * fails, so a nonce in the map always refers to a message that exists (or
      * is about to). Returns the nonce, or null when the alert could not be sent.
      */
+    /** postNonceButtonPromptOrThrow, logging a failure and returning null instead. */
     async postNonceButtonPrompt(opts) {
+        try {
+            return await this.postNonceButtonPromptOrThrow(opts);
+        }
+        catch (err) {
+            this.logger.warn({ err, instanceName: opts.instanceName, prefix: opts.prefix }, "Failed to send button prompt");
+            return null;
+        }
+    }
+    /**
+     * Post a nonce-armed button prompt; throws (with the nonce disarmed) when it
+     * cannot be posted, so a caller that told the user "buttons posted" can
+     * tell them the truth instead (#1133).
+     */
+    async postNonceButtonPromptOrThrow(opts) {
         // 16 bytes = the 128-bit capability the design claims. Telegram's 64-byte
         // callback_data cap still holds, with two prefixes tied at the longest:
         // "interactive-assist:" (19) + 32 hex + ":confirm" (8) = 59, and
@@ -8178,8 +8154,7 @@ export class FleetManager {
             this.pendingNonceButtons.delete(nonce);
             if (entry.timer)
                 clearTimeout(entry.timer);
-            this.logger.warn({ err, instanceName: opts.instanceName, prefix: opts.prefix }, "Failed to send button prompt");
-            return null;
+            throw err;
         }
     }
     /**
@@ -8206,12 +8181,15 @@ export class FleetManager {
             pending = undefined;
         if (!match || !pending) {
             const adapter = receivingAdapter ?? this.adapter;
+            // The clicker always hears why nothing happens (#1133); collapsing the
+            // dead buttons is a courtesy that can fail (>48h on Telegram, message gone).
+            data.ack?.(t("buttons.stale_notice"));
+            const collapseFailed = (err) => this.logger.info({ err: err?.message, prefix }, "Could not collapse an expired prompt's buttons");
             if (staleHandling?.keepText && adapter?.removeMessageButtons) {
-                adapter.removeMessageButtons(data.chatId, data.messageId, data.threadId)
-                    .catch(() => { });
+                adapter.removeMessageButtons(data.chatId, data.messageId, data.threadId).catch(collapseFailed);
             }
             else {
-                adapter?.editMessageRemoveButtons?.(data.chatId, data.messageId, t("buttons.stale"), data.threadId).catch(() => { });
+                adapter?.editMessageRemoveButtons?.(data.chatId, data.messageId, t("buttons.stale"), data.threadId).catch(collapseFailed);
             }
             if (staleHandling?.notice) {
                 adapter?.sendText(data.chatId, staleHandling.notice, { threadId: data.threadId })
@@ -8248,8 +8226,10 @@ export class FleetManager {
                 userId: data.userId,
                 mismatchedFields: mismatchedFields.join(","),
             }, "Rejected unauthorized or mismatched button callback");
+            data.ack?.(t(isAuthorized ? "buttons.wrong_place" : "buttons.admin_only"));
             return "consumed";
         }
+        data.ack?.();
         // Claim before any await: double clicks and duplicate callback delivery
         // can never act twice for state-changing actions.
         this.pendingNonceButtons.delete(match[1]);
@@ -8258,18 +8238,91 @@ export class FleetManager {
         return { entry: pending, action: match[2] };
     }
     /** Collapse a consumed prompt's buttons into a final status line. */
-    async retireNonceButtons(pending, messageId, text) {
-        if (!pending.adapter.editMessageRemoveButtons) {
-            this.logger.warn({ instanceName: pending.instanceName, adapterId: pending.adapterId }, "Adapter cannot remove prompt buttons");
-            return;
+    /**
+     * One button click from an adapter (#1133). Every click is acknowledged
+     * once the fleet has decided — Telegram keeps a spinner until it is, and a
+     * refused click acknowledges with a notice of its own (consumeNonceCallback) —
+     * and a click nothing acts on is logged rather than vanishing.
+     */
+    async receiveAdapterCallback(data, adapterId, adapter, isCurrentAdapter) {
+        try {
+            if (!isCurrentAdapter()) {
+                this.logger.info({ adapterId, prefix: callbackPrefix(data.callbackData) }, "Button click from a replaced adapter ignored");
+                return;
+            }
+            if (!await this.dispatchAdapterCallback(data, adapterId, adapter)) {
+                this.logger.info({ adapterId, prefix: callbackPrefix(data.callbackData) }, "Button click not handled by the fleet (adapter-level prompt or unknown button)");
+            }
+        }
+        finally {
+            data.ack?.();
         }
+    }
+    /**
+     * A button from a prompt kind that no longer exists (#1131: `/install-cli`'s
+     * picker and its "sign in now?" prompt). Still on screen after an upgrade;
+     * a click gets the expired-prompt treatment — a private notice, the buttons
+     * collapsed — instead of nothing.
+     */
+    handleRetiredPromptButton(data, adapterId, adapter) {
+        for (const prefix of RETIRED_PROMPT_PREFIXES) {
+            if (this.consumeNonceCallback(prefix, NEVER_MATCHES, data, adapterId, adapter) !== null)
+                return true;
+        }
+        return false;
+    }
+    /** Routes a click to the handler that owns its prefix; false when none does. */
+    async dispatchAdapterCallback(data, adapterId, adapter) {
+        if (await this.handleTipDismiss(data, adapterId, adapter))
+            return true;
+        if (await this.handleTipUnlock(data, adapterId, adapter))
+            return true;
+        if (await this.handleLoginBackendSelect(data, adapterId, adapter))
+            return true;
+        if (await this.handleClassicApproval(data, adapterId, adapter))
+            return true;
+        if (await this.handleLoginMenuSelect(data, adapterId, adapter))
+            return true;
+        if (this.handleRetiredPromptButton(data, adapterId, adapter))
+            return true;
+        if (await this.handleLoginConfirm(data, adapterId, adapter))
+            return true;
+        if (await this.handleLoginTokenResend(data, adapterId, adapter))
+            return true;
+        if (await this.handleClearConfirmation(data, adapterId, adapter))
+            return true;
+        if (await this.handleExitRestartPrompt(data, adapterId, adapter))
+            return true;
+        if (await this.handleInteractivePromptAssist(data, adapterId, adapter))
+            return true;
+        if (await this.handleClassicBackendSelection(data))
+            return true;
+        if (await this.handleModelSelection(data))
+            return true;
+        if (await this.handleEffortSelection(data))
+            return true;
+        if (await this.handleHangPrompt(data, adapterId, adapter))
+            return true;
+        if (data.callbackData.startsWith("cancel:")) {
+            this.handleCancelClick(data.callbackData.slice("cancel:".length), adapter ?? null, data);
+            return true;
+        }
+        return false;
+    }
+    async retireNonceButtons(pending, messageId, text) {
         try {
+            if (!pending.adapter.editMessageRemoveButtons)
+                throw new Error("adapter cannot remove prompt buttons");
             await pending.adapter.editMessageRemoveButtons(pending.chatId, messageId, text, pending.threadId);
         }
         catch (err) {
             // The action was already atomically consumed. An edit failure must not
-            // undo that or make the button actionable again.
-            this.logger.warn({ err, instanceName: pending.instanceName }, "Failed to retire prompt buttons");
+            // undo that or make the button actionable again — but the edit is the
+            // only place some outcomes are told (cancel, later, a resend's result),
+            // so the text goes out as a message instead (#1133).
+            this.logger.warn({ err, instanceName: pending.instanceName }, "Failed to retire prompt buttons; posting the outcome instead");
+            await pending.adapter.sendText(pending.chatId, text, { threadId: pending.threadId })
+                .catch(sendErr => this.logger.warn({ err: sendErr, instanceName: pending.instanceName }, "Could not post a prompt's outcome"));
         }
     }
     tipsEnabled() {
@@ -9493,8 +9546,10 @@ export class FleetManager {
                 isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
                 windowBusyMessage: () => this.loginWindow.busyMessage(),
                 tunnelDataDir: () => this.dataDir,
+                // Throws when the prompt cannot be posted: the controller tells the
+                // user so instead of leaving "Starting…" as the last word (#1133).
                 postButtons: async ({ prefix, instanceName, chat, message, choices, expiredText }) => {
-                    await this.postNonceButtonPrompt({
+                    await this.postNonceButtonPromptOrThrow({
                         prefix, alertType: "login", instanceName,
                         adapter: chat.adapter, adapterId: chat.adapterId, chatId: chat.chatId, threadId: chat.threadId,
                         message, choices, expiredText,
@@ -9504,37 +9559,50 @@ export class FleetManager {
         }
         return this.loginController;
     }
-    /** Post the backend chooser for a bare `/login`. Caller enforces admin. */
+    /**
+     * Post the backend chooser for a bare `/login`. Caller enforces admin.
+     * Returns why the chooser could not be posted, for the caller to tell the
+     * user (#1133); undefined when it was posted or there was nothing to choose.
+     */
     async promptLoginBackends(chat) {
         const configured = new Set();
         for (const name of this.configuredBackendInstanceNames()) {
             configured.add(this.backendNameOf(name));
         }
         const installed = this.probeInstalledBackends();
-        const candidates = new Set([...installed, ...configured]);
+        // One entry point for "get this CLI working" (#1131): a backend that is
+        // not installed is offered too, and the click installs it first, then
+        // signs in (startLoginSession routes it). gemini-cli is not recommended,
+        // as before; `/login gemini-cli` still installs it.
+        const installable = new Set(Object.keys(BACKEND_INSTALLATION_INFO).filter(backend => backend !== "gemini-cli"));
+        const candidates = new Set([...installed, ...configured, ...installable]);
         const unsupported = [];
         const choices = [...candidates].sort().flatMap(backend => {
             const flow = LOGIN_FLOWS[backend];
             const remoteLogin = !!flow && flow.remoteLogin !== "unsupported";
+            const isInstalled = installed.has(backend);
             const status = [];
-            if (installed.has(backend))
-                status.push(t("login.status_installed"));
+            status.push(t(isInstalled ? "login.status_installed" : "login.status_not_installed"));
             if (configured.has(backend))
                 status.push(t("login.status_configured"));
-            if (remoteLogin)
+            if (!isInstalled && installable.has(backend)) {
+                status.push(t(remoteLogin ? "login.status_install_then_auth" : "login.status_install"));
+                return [{ action: backend, label: `${backend} · ${status.join(" · ")}` }];
+            }
+            if (remoteLogin && isInstalled) {
                 status.push(t("login.status_auth"));
-            else
-                status.push(t("login.status_unsupported"));
-            if (!remoteLogin) {
-                unsupported.push({ backend, flow, status });
-                return [];
+                return [{ action: backend, label: `${backend} · ${status.join(" · ")}` }];
             }
-            return [{ action: backend, label: `${backend} · ${status.join(" · ")}` }];
+            status.push(t("login.status_unsupported"));
+            unsupported.push({ backend, flow, status });
+            return [];
         });
         if (unsupported.length) {
-            const guidance = unsupported.map(({ backend, flow, status }) => `${backend} · ${status.join(" · ")} — ${flow?.remoteLogin === "unsupported"
-                ? t("login.remote_unsupported_agent_cli", backend, flow.command)
-                : backend === "opencode" ? t("login.unsupported", backend) : t("login.no_remote_flow", backend)}`).join("\n");
+            const guidance = unsupported.map(({ backend, flow, status }) => `${backend} · ${status.join(" · ")} — ${!installed.has(backend)
+                ? (BACKEND_INSTALLATION_INFO[backend] ? t("login.install_by_name", backend) : t("login.install_on_host", backend))
+                : flow?.remoteLogin === "unsupported"
+                    ? t("login.remote_unsupported_agent_cli", backend, flow.command)
+                    : backend === "opencode" ? t("login.unsupported", backend) : t("login.no_remote_flow", backend)}`).join("\n");
             await chat.adapter.sendText(chat.chatId, guidance, { threadId: chat.threadId })
                 .catch(err => this.logger.warn({ err }, "Failed to post unsupported login guidance"));
         }
@@ -9545,7 +9613,7 @@ export class FleetManager {
             }
             return;
         }
-        await this.postNonceButtonPrompt({
+        return this.postChooser({
             prefix: LOGIN_CALLBACK_PREFIX,
             alertType: "login",
             instanceName: "login",
@@ -9553,11 +9621,27 @@ export class FleetManager {
             adapterId: chat.adapterId,
             chatId: chat.chatId,
             threadId: chat.threadId,
-            message: t("login.choose_backend"),
+            message: `${t("login.choose_backend")}\n${t("fleet.label_line", fleetLabel(this.fleetConfig))}`,
             choices,
             expiredText: t("buttons.stale"),
         });
     }
+    /** A clicked prompt's follow-up line; a failure to post it is logged, not swallowed (#1133). */
+    async postPromptOutcome(entry, text) {
+        await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId })
+            .catch(err => this.logger.warn({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Could not post a prompt's follow-up"));
+    }
+    /** A chooser prompt: undefined when posted, else the user-facing reason it was not. */
+    async postChooser(opts) {
+        try {
+            await this.postNonceButtonPromptOrThrow(opts);
+            return undefined;
+        }
+        catch (err) {
+            this.logger.warn({ err, prefix: opts.prefix }, "Could not post a backend chooser");
+            return t("buttons.post_failed", err?.message ?? String(err));
+        }
+    }
     /**
      * Ask the General topic to approve a ClassicBot access request.
      *
@@ -9651,62 +9735,39 @@ export class FleetManager {
         await this.applyClassicApproval(entry, groupId, grantAdmin ? userId : undefined);
         return true;
     }
-    /**
-   * Backend chooser for a bare `/install-cli`, mirroring promptLoginBackends so
-   * both commands feel the same. Built on postNonceButtonPrompt rather than the
-   * `/model` selection coordinator: that is the mechanism `/login` already uses,
-   * and the one whose canonical-address binding (#682) makes the buttons answer
-   * in a Telegram General topic.
-   *
-   * Unlike the login chooser this does NOT filter to backends the fleet already
-   * runs. Installing is how you get a backend you do not have yet, so filtering
-   * by configured backends would hide the only entry the admin came for.
-   *
-   * gemini-cli is omitted: it is deprecated (see backend/factory.ts). Typing
-   * `/install-cli gemini-cli` still works — this only stops recommending it.
-   */
-    async promptInstallBackends(chat) {
-        const choices = Object.keys(BACKEND_INSTALLATION_INFO)
-            .filter(backend => backend !== "gemini-cli")
-            .map(backend => ({ action: backend, label: backend }));
-        await this.postNonceButtonPrompt({
-            prefix: INSTALL_CALLBACK_PREFIX,
-            alertType: "install",
-            instanceName: "install",
-            adapter: chat.adapter,
-            adapterId: chat.adapterId,
-            chatId: chat.chatId,
-            threadId: chat.threadId,
-            message: t("install.choose_backend"),
-            choices,
-            expiredText: t("buttons.stale"),
-        });
-    }
-    /** Backend chooser button → start that backend's install session. */
-    async handleInstallBackendSelect(data, callbackAdapterId, receivingAdapter) {
-        const claimed = this.consumeNonceCallback(INSTALL_CALLBACK_PREFIX, /^install-select:([0-9a-f]+):([a-z][a-z-]*)$/, data, callbackAdapterId, receivingAdapter);
-        if (claimed === null)
-            return false;
-        if (claimed === "consumed")
-            return true;
-        const { entry, action: backend } = claimed;
-        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("install.starting_backend", backend));
-        const text = await this.startInstallSession(backend, {
-            adapter: entry.adapter,
-            adapterId: entry.adapterId,
-            chatId: entry.chatId,
-            threadId: entry.threadId,
-        });
-        if (text)
-            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
-        return true;
-    }
     /**
      * Start a login session for one backend. Caller enforces admin.
      * Returns a status line to post, or null when a confirmation prompt was
      * posted instead (auth still valid — see the pre-check below).
      */
     async startLoginSession(backendArg, chat, opts = {}) {
+        // `/login` is the one entry point (#1131): a CLI that is not installed yet
+        // is installed first, and the install's success signs in (startInstallSession).
+        // A confirmation click (skipAuthCheck) continues a sign-in already decided:
+        // straight to it, never back through the install routing — a binary that
+        // went missing meanwhile must not start an installer from a "go" button.
+        if (opts.skipAuthCheck)
+            return this.launchSignIn(backendArg, chat, opts);
+        const wanted = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
+        if (BACKEND_INSTALLATION_INFO[wanted] && !this.isCliInstalled(wanted)) {
+            const flow = LOGIN_FLOWS[wanted];
+            this.recordLoginFlow(wanted, flow && flow.remoteLogin !== "unsupported" ? "install_then_login" : "install_only", chat.userId);
+            return this.startInstallSession(wanted, chat);
+        }
+        this.recordLoginFlow(wanted, "login", chat.userId);
+        return this.launchSignIn(backendArg, chat, opts);
+    }
+    /** Which way a `/login` went (#1131) — so the event log shows what users actually need. */
+    recordLoginFlow(backend, flow, requester) {
+        try {
+            this.eventLog?.insert("login", "login_entry", { backend, flow, requester: requester ?? null });
+        }
+        catch (err) {
+            this.logger.debug({ err, backend, flow }, "Could not record the /login flow");
+        }
+    }
+    /** The sign-in itself (web, or the legacy relay) for a CLI that is installed. */
+    async launchSignIn(backendArg, chat, opts = {}) {
         if (this.webLogin.mode() === "web")
             return this.webLogin.start(backendArg, chat, opts);
         // ── legacy relay mode (login.mode: relay) — removed in 2.1.6 ──
@@ -9742,7 +9803,7 @@ export class FleetManager {
             if (!this.loginWindow.isCurrent(claim))
                 return t("login.web_shutting_down"); // fleet shut down while we probed
             if (status === "valid") {
-                await this.postNonceButtonPrompt({
+                const failure = await this.postChooser({
                     prefix: LOGIN_CONFIRM_CALLBACK_PREFIX,
                     alertType: "login",
                     instanceName: backend,
@@ -9757,7 +9818,7 @@ export class FleetManager {
                     ],
                     expiredText: t("buttons.stale"),
                 });
-                return null;
+                return failure ?? null;
             }
         }
         markTransferred(); // launchLoginSession owns the claim from here
@@ -9783,7 +9844,7 @@ export class FleetManager {
         }
         const session = new LoginSession(flow, tmux, {
             onMenu: async (options) => {
-                await this.postNonceButtonPrompt({
+                const failure = await this.postChooser({
                     prefix: LOGIN_MENU_CALLBACK_PREFIX,
                     alertType: "login",
                     instanceName: backend,
@@ -9795,6 +9856,10 @@ export class FleetManager {
                     choices: options.map((label, index) => ({ action: String(index), label })),
                     expiredText: t("buttons.stale"),
                 });
+                if (failure) {
+                    await chat.adapter.sendText(chat.chatId, failure, { threadId: chat.threadId })
+                        .catch(err => this.logger.warn({ err, backend }, "Could not report a login menu that failed to post"));
+                }
             },
             onAuthHint: async (url, code) => {
                 await this.sendLoginSecret(chat, backend, url, code);
@@ -9906,6 +9971,16 @@ export class FleetManager {
     }
     /** `/login cancel` — abort the active session and remove its window. */
     async cancelLoginSession() {
+        // `/login cancel` also stops an install that `/login` started — and the
+        // sign-in an install that just succeeded is about to hand over to.
+        if (this.activeInstall)
+            return this.cancelInstallSession();
+        if (this.installHandoff) {
+            const { backend } = this.installHandoff;
+            this.installHandoff.cancelled = true;
+            this.installHandoff = null;
+            return t("login.cancelled", backend);
+        }
         if (this.loginController?.isActive())
             return this.loginController.cancel();
         if (!this.activeLogin)
@@ -10005,7 +10080,7 @@ export class FleetManager {
             userId: data.userId,
         });
         if (text)
-            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
+            await this.postPromptOutcome(entry, text);
         return true;
     }
     /** Re-login confirmation (auth pre-check said credentials still work). */
@@ -10035,7 +10110,7 @@ export class FleetManager {
             tunnel: action === "go-tunnel" || action === "go-relogin-tunnel",
         });
         if (text)
-            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
+            await this.postPromptOutcome(entry, text);
         return true;
     }
     /** "Resend token" button (web login): only the requester may press it; the token never enters the channel. */
@@ -10064,13 +10139,15 @@ export class FleetManager {
         await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, ok ? t("login.provider_selected", label) : t("login.no_session"));
         return true;
     }
-    // ── Remote CLI install (`/install-cli`) ──────────────────────────────────
+    // ── Remote CLI install (run by `/login` for a CLI that is missing) ──────────────────────────────────
     //
     // Same dedicated-window model as /login (and the same LoginSession state
     // machine — an install is a login flow with no auth hints): run the
     // installer, judge by exit code, verify the binary on a fresh login shell,
-    // then offer to chain straight into /login.
+    // then sign in (the hand-off below).
     activeInstall = null;
+    /** An install that succeeded, between its success line and the sign-in it hands over to (#1131). */
+    installHandoff = null;
     /** Start a CLI install session. Caller enforces admin. */
     async startInstallSession(backendArg, chat) {
         const backend = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
@@ -10147,22 +10224,24 @@ export class FleetManager {
                 // publish a durable completion line first so a successful install can
                 // never look like it silently disappeared.  Include the binary that
                 // passed the fresh-login-shell verification and the exact next step.
+                // Between the install ending and the sign-in starting there is no
+                // session to cancel; this hand-off is what `/login cancel` stops.
+                const handoff = { backend, cancelled: false };
+                this.installHandoff = handoff;
                 await chat.adapter.sendText(chat.chatId, t("install.success", backend, info.binary), { threadId: chat.threadId }).catch(err => this.logger.warn({ err, backend }, "Failed to send durable install success notification"));
-                await this.postNonceButtonPrompt({
-                    prefix: INSTALL_LOGIN_CALLBACK_PREFIX,
-                    alertType: "login",
-                    instanceName: backend,
-                    adapter: chat.adapter,
-                    adapterId: chat.adapterId,
-                    chatId: chat.chatId,
-                    threadId: chat.threadId,
-                    message: t("install.login_prompt", backend),
-                    choices: [
-                        { action: "go", label: t("install.login_now") },
-                        { action: "later", label: t("install.later") },
-                    ],
-                    expiredText: t("install.later_ack", backend),
-                });
+                if (handoff.cancelled || this.installHandoff !== handoff)
+                    return;
+                this.installHandoff = null;
+                // The user asked `/login` for a working CLI: sign in straight away
+                // (#1131). The login has its own confirmation, so nothing starts
+                // without a click.
+                // launchSignIn, not startLoginSession: if the new binary were still
+                // not visible, startLoginSession would route straight back to an install.
+                const next = await this.launchSignIn(backend, chat, {}).catch((err) => t("login.failed", backend, err?.message ?? String(err)));
+                if (next) {
+                    await chat.adapter.sendText(chat.chatId, next, { threadId: chat.threadId })
+                        .catch(err => this.logger.warn({ err, backend }, "Could not post the sign-in step after an install"));
+                }
             },
         }, this.logger);
         this.activeInstall = { session, backend, chat };
@@ -10188,7 +10267,12 @@ export class FleetManager {
         }
         return t("install.started", backend);
     }
-    /** `/install-cli cancel` — abort the active install and remove its window. */
+    /** Whether this backend's CLI is on the fleet's PATH (what `/login` installs when it is not). */
+    isCliInstalled(backend) {
+        const info = BACKEND_INSTALLATION_INFO[backend];
+        return !!info && checkBinaryInstalled(info.binary);
+    }
+    /** Abort the active install (`/login cancel`) and remove its window. */
     async cancelInstallSession() {
         if (!this.activeInstall)
             return t("install.no_session");
@@ -10246,31 +10330,6 @@ export class FleetManager {
         process.env.PATH = [dir, ...entries].join(delimiter);
         this.logger.info({ backend, dir }, "Added the installed CLI's directory to the fleet PATH");
     }
-    /** "Sign in now?" button after a successful install. */
-    async handleInstallLoginConfirm(data, callbackAdapterId, receivingAdapter) {
-        const claimed = this.consumeNonceCallback(INSTALL_LOGIN_CALLBACK_PREFIX, /^install-login:([0-9a-f]+):(go|later)$/, data, callbackAdapterId, receivingAdapter);
-        if (claimed === null)
-            return false;
-        if (claimed === "consumed")
-            return true;
-        const { entry, action } = claimed;
-        const backend = entry.instanceName;
-        if (action === "later") {
-            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("install.later_ack", backend));
-            return true;
-        }
-        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("login.starting_backend", backend));
-        const text = await this.startLoginSession(backend, {
-            adapter: entry.adapter,
-            adapterId: entry.adapterId,
-            chatId: entry.chatId,
-            threadId: entry.threadId,
-            userId: data.userId,
-        });
-        if (text)
-            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
-        return true;
-    }
     /** Discord native `/login` slash — shared by every adapter dispatch block. */
     async handleLoginSlash(data, adapterId, adapter) {
         if (!data.userId || !this.isFleetAdmin(data.userId, adapterId)) {
@@ -10282,40 +10341,14 @@ export class FleetManager {
             await data.respond(await this.cancelLoginSession());
             return;
         }
-        const code = String(data.options?.code ?? "").trim();
-        if (code) {
-            await data.respond(await this.loginSubmitInput(code));
-            return;
-        }
         const backend = String(data.options?.backend ?? "").trim();
         if (backend) {
             const text = await this.startLoginSession(backend, chat);
             await data.respond(text ?? t("login.confirm_posted"));
             return;
         }
-        await this.promptLoginBackends(chat);
-        await data.respond(t("login.chooser_posted"));
-    }
-    /** Discord native `/install-cli` slash — shared by every dispatch block. */
-    async handleInstallCliSlash(data, adapterId, adapter) {
-        if (!data.userId || !this.isFleetAdmin(data.userId, adapterId)) {
-            await data.respond(t("permission.denied"));
-            return;
-        }
-        if (data.options?.cancel === true) {
-            await data.respond(await this.cancelInstallSession());
-            return;
-        }
-        const backend = String(data.options?.backend ?? "").trim();
-        if (!backend) {
-            // Bare call: offer the backends instead of printing a usage line the user
-            // then has to retype. A Discord slash that DID pick the native `backend`
-            // choice never lands here, so the two paths cannot both fire.
-            await this.promptInstallBackends({ adapter, adapterId, chatId: data.channelId });
-            await data.respond(t("install.chooser_posted"));
-            return;
-        }
-        await data.respond(await this.startInstallSession(backend, { adapter, adapterId, chatId: data.channelId }));
+        const failure = await this.promptLoginBackends(chat);
+        await data.respond(failure ?? t("login.chooser_posted"));
     }
     queueMirrorMessage(text) {
         const mirrorTopicId = this.fleetConfig?.channel?.mirror_topic_id;