@songsid/agend 2.1.11-beta.1 → 2.1.11-beta.2

package/dist/fleet-manager.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, constants as fsConstants } from "node:fs";
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { freemem, totalmem, cpus, homedir } from "node:os";
 import { createServer } from "node:http";
@@ -62,6 +62,7 @@ import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
 import { tightenInstanceDirs } from "./private-dir.js";
 import { decideSlash } from "./slash-authz.js";
+import { commandSpec, decideCommand } from "./command-table.js";
 import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS } from "./login-controller.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
@@ -457,6 +458,7 @@ export class FleetManager {
     startupRetryNotices = new Map();
     /** Unsupported-CLI refusals waiting to go out, grouped by reason (#1109). */
     unsupportedCliNotices = new Map();
+    kiroIncompatNotices = new Map();
     /** Backoff between automatic startup retries; the last step repeats while the backend is down. */
     static STARTUP_RETRY_BACKOFF_MS = [60_000, 5 * 60_000, 15 * 60_000];
     /** Hard cap on automatic startup retries (3 backoff steps + up to 3 more during a backend outage). */
@@ -1426,7 +1428,7 @@ export class FleetManager {
         const action = data.command;
         const classicName = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
         if (classicName) {
-            if (!this.classicChannels?.isAdmin(data.userId)) {
+            if (!this.isModelAdmin(data.userId, data.channelId, adapterId)) {
                 await data.respond(t("permission.denied"));
                 return;
             }
@@ -2220,6 +2222,230 @@ export class FleetManager {
             return "disabled";
         return this.isFleetAdmin(userId, adapterId) ? "ok" : "denied";
     }
+    /**
+     * Every Discord slash command, for every adapter, in one place (it used to be two copies that could drift).
+     *
+     * Two checks before any command's own code runs, and the order matters: the DOOR (src/slash-authz.ts — may
+     * this caller speak here at all) and then the COMMAND TABLE (src/command-table.ts — does this command apply
+     * in this kind of channel, and which kind of admin does it need). The table can only narrow what the door
+     * let through. A command nobody registered is answered, not left to time out.
+     */
+    async dispatchSlash(data, adapterId, adapter) {
+        const scope = await this.authorizeSlash(data, adapterId);
+        if (!scope)
+            return;
+        const spec = commandSpec(data.command);
+        if (!spec) {
+            this.logger.info({ command: data.command, adapterId }, "Slash command is not in the command table");
+            await data.respond(t("slash.unknown_command")).catch(() => { });
+            return;
+        }
+        const decision = decideCommand(spec, scope, {
+            fleetAdmin: () => this.fleetAdminGate(data.userId, adapterId),
+            channelAdmin: () => this.isModelAdmin(data.userId, data.channelId, adapterId),
+            classicAdmin: () => !!this.classicChannels?.isAdmin(data.userId),
+        });
+        if (!decision.allow) {
+            this.logger.info({ command: data.command, adapterId, scope, reply: decision.reply[0] }, "Slash command refused by the command table");
+            const [key, ...args] = decision.reply;
+            await data.respond(t(key, ...args)).catch(() => { });
+            return;
+        }
+        if (data.command === "start") {
+            await this.handleClassicStartSlash(data, adapterId);
+        }
+        else if (data.command === "stop") {
+            const reply = await this.handleClassicStop(data.channelId, adapterId);
+            await data.respond(reply);
+        }
+        else if (data.command === "pause" || data.command === "wake") {
+            await this.handlePauseWakeSlash(data, adapterId);
+        }
+        else if (data.command === "chat") {
+            const text = data.text ?? "";
+            if (!text) {
+                await data.respond(t("chat.usage"));
+                return;
+            }
+            const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
+            if (!name) {
+                await data.respond(t("classic.no_agent_start"));
+                return;
+            }
+            const status = this.resolveStatusEmojisFor(name, adapterId, adapter);
+            const replyMsgId = await data.respond(textForm(status.platform, status.received));
+            const username = data.username ?? data.userId;
+            ClassicChannelManager.logMessage(name, username, `/chat ${text}`, new Date());
+            await this.forwardToClassicInstance(name, text, {
+                chatId: data.channelId,
+                threadId: data.channelId,
+                messageId: replyMsgId ?? "",
+                userId: data.userId,
+                username,
+                source: "discord",
+                timestamp: new Date(),
+            });
+        }
+        else if (data.command === "save") {
+            await this.handleSlashSave(data, adapterId);
+        }
+        else if (data.command === "load") {
+            // load is kiro-cli/classic only — no claude-code equivalent. (Classic admins only: the command table.)
+            const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
+            if (!name) {
+                await data.respond(t("classic.no_agent_start"));
+                return;
+            }
+            const filename = data.options?.filename;
+            if (!SAVE_FILENAME_RE.test(filename ?? "")) {
+                await data.respond(t("filename.invalid"));
+                return;
+            }
+            this.pasteRawToClassicInstance(name, `/chat load ${filename}`);
+            await data.respond(t("save.sent", `/chat load ${filename}`, name));
+        }
+        else if (data.command === "model") {
+            await this.handleModelSlash(data, adapterId);
+        }
+        else if (data.command === "clear") {
+            await this.handleClearSlash(data, adapterId);
+        }
+        else if (data.command === "effort") {
+            await this.handleEffortSlash(data, adapterId);
+        }
+        else if (data.command === "cancel") {
+            const name = this.resolveSlashTarget(data.channelId, adapterId);
+            if (!name) {
+                await data.respond(t("classic.no_agent"));
+                return;
+            }
+            const ok = this.cancelInstance(name);
+            await data.respond(ok ? t("cancel.sent", name) : t("cancel.not_running", name));
+        }
+        else if (data.command === "ctx") {
+            const name = this.resolveSlashTarget(data.channelId, adapterId);
+            if (!name) {
+                await data.respond(t("classic.no_agent"));
+                return;
+            }
+            // Single source of truth (statusline.json + robust tmux pane fallback).
+            await data.respond(await this.topicCommands.getCtxText(name));
+        }
+        else if (data.command === "collab") {
+            // The scope the door and the table authorized is the scope this acts in. A channel can be in both the
+            // ClassicBot registry and the routing table (two configurations that each validate); the door and
+            // `isModelAdmin` read the registry first, so a ClassicBot admin was judged for the ClassicBot channel
+            // here and must not be handed the fleet instance's collab switch by a second, routing-first lookup.
+            const collabTarget2 = scope === "classic" ? undefined : this.routing.resolve(data.channelId);
+            if (collabTarget2) {
+                const isCollab = this.toggleFleetCollab(collabTarget2.name);
+                await data.respond(isCollab ? t("collab.on") : t("collab.off"));
+                return;
+            }
+            if (!this.classicChannels?.isClassicChannel(data.channelId, adapterId)) {
+                await data.respond(t("classic.no_agent_start"));
+                return;
+            }
+            const newState = this.classicChannels.toggleCollab(data.channelId, adapterId);
+            await data.respond(newState
+                ? t("collab.on.classic")
+                : t("collab.off.classic"));
+        }
+        else if (data.command === "update") {
+            await this.handleUpdateSlash(data, adapterId);
+        }
+        else if (data.command === "doctor") {
+            await data.respond(await this.runBackendDoctor());
+        }
+        else if (data.command === "usage") {
+            // Same permission level as /ctx (none). The reply is still ephemeral —
+            // the adapter defers non-chat commands that way — so it never spams the
+            // channel either way.
+            try {
+                const { getUsageSnapshot } = await import("./usage/usage-api.js");
+                const { renderUsageMarkdown } = await import("./usage/format-rich.js");
+                // slash_command is Discord-only; editReply renders Markdown natively.
+                await data.respond(renderUsageMarkdown(await getUsageSnapshot(false, this.getActiveUsageProviderIds())));
+            }
+            catch (err) {
+                await data.respond(t("usage.failed", err.message));
+            }
+        }
+        else if (data.command === "tips") {
+            await this.handleTipsSlash(data, adapterId);
+        }
+        else if (data.command === "status") {
+            // Admin-gated (like the topic path): the merged table shows every
+            // instance's cost and IPC health.
+            if (!this.isFleetAdmin(data.userId, adapterId)) {
+                await data.respond(t("cmd.admin_required", "/status"));
+                return;
+            }
+            const text = await this.topicCommands.getStatusText();
+            await data.respond(text);
+        }
+        else if (data.command === "sysinfo") {
+            // Slash commands are Discord-only; use plain lines (no markdown table)
+            await this.topicCommands.sendSysInfo(text => data.respond(text), { platform: "discord" });
+        }
+        else if (data.command === "dashboard") {
+            // Reply is ephemeral (adapter defers non-chat commands ephemerally), so
+            // the web-token-bearing URLs are only visible to the caller.
+            await data.respond(this.topicCommands.getDashboardText());
+        }
+        else if (data.command === "restart") {
+            await this.handleRestartSlash(data, adapterId);
+        }
+        else if (data.command === "compact") {
+            const name = this.resolveSlashTarget(data.channelId, adapterId);
+            if (!name) {
+                await data.respond(t("classic.no_agent"));
+                return;
+            }
+            const result = await this.topicCommands.sendCompact(name, String(data.options?.instructions ?? ""));
+            await data.respond(result);
+        }
+        else if (data.command === "steer") {
+            const name = this.resolveSlashTarget(data.channelId, adapterId);
+            if (!name) {
+                await data.respond(t("classic.no_agent"));
+                return;
+            }
+            const steerText = String(data.options?.message ?? "").trim();
+            if (!steerText) {
+                await data.respond(t("steer.usage"));
+                return;
+            }
+            // chat_id/message_id stay empty: a slash interaction has no channel
+            // message to react to, and an empty chat_id keeps updateLastChat from
+            // rerouting the instance's replies to the slash context.
+            const result = this.topicCommands.sendSteer(name, steerText, {
+                chatId: "", messageId: "", username: data.username ?? "user",
+                userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
+            });
+            await data.respond(result);
+        }
+        else if (data.command === "btw") {
+            const name = this.resolveSlashTarget(data.channelId, adapterId);
+            if (!name) {
+                await data.respond(t("classic.no_agent"));
+                return;
+            }
+            const btwText = String(data.options?.message ?? "").trim();
+            if (!btwText) {
+                await data.respond(t("btw.usage"));
+                return;
+            }
+            const result = this.topicCommands.sendBtw(name, btwText, {
+                chatId: "", messageId: "", username: data.username ?? "user",
+                userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
+            });
+            await data.respond(result);
+        }
+        else if (data.command === "login") {
+            await this.handleLoginSlash(data, adapterId, adapter);
+        }
+    }
     /**
      * The door every Discord slash command goes through (src/slash-authz.ts has the rule and the reasoning).
      * Answers the caller itself when it refuses, so a refused command costs one reply and does nothing else.
@@ -2229,6 +2455,8 @@ export class FleetManager {
         const classic = !!this.classicChannels?.isClassicChannel(channelId, adapterId);
         const fleetTarget = classic ? undefined : this.routing.resolve(channelId);
         const scope = classic ? "classic" : fleetTarget ? "fleet" : "none";
+        // The table tells the General dispatcher from an instance's own channel; the door does not need to.
+        const commandScope = classic ? "classic" : fleetTarget ? (fleetTarget.kind === "general" ? "general" : "fleet") : "none";
         let speaker = "denied";
         if (scope !== "classic") {
             // The same world the typed-message path would consult: the adapter that owns the channel's instance,
@@ -2253,12 +2481,12 @@ export class FleetManager {
         };
         const decision = decideSlash(facts);
         if (decision.allow)
-            return true;
+            return commandScope;
         this.logger.info({ command: data.command, reason: decision.reason, adapterId, guildId: data.guildId ?? null, channelId, scope }, "Slash command refused");
         await data.respond(t(decision.reason === "dm" ? "slash.dm_unsupported"
             : decision.reason === "wrong-guild" ? "slash.wrong_server"
                 : "not_authorized")).catch(() => { });
-        return false;
+        return null;
     }
     /** Phase 2: delivery_worker for a target (instance override → fleet default → wake_only). */
     deliveryWorkerMode(target) {
@@ -2868,8 +3096,58 @@ export class FleetManager {
             return false;
         this.logger.error({ name, reason: err.message }, `Not starting ${what}: the installed CLI cannot run it as configured`);
         this.queueUnsupportedCliNotice(name, err.message);
+        this.queueKiroIncompatNotice(name, err.message);
         return true;
     }
+    /**
+     * LifecycleContext: a kiro instance the installed kiro-cli cannot run as
+     * configured (#1109) — at start, or at a respawn after kiro-cli replaced
+     * itself. The operator already gets the plain notice; this tells every
+     * General, as an agent, so it can explain the kiro engine move when asked.
+     * One notice per refusal reason, like the operator's.
+     */
+    queueKiroIncompatNotice(name, reason) {
+        // The effective backend, ClassicBot channels included: they are not in fleetConfig.instances.
+        if (this.backendNameForInstance(name) !== "kiro-cli")
+            return;
+        const pending = this.kiroIncompatNotices.get(reason);
+        if (pending) {
+            if (!pending.names.includes(name))
+                pending.names.push(name);
+            return;
+        }
+        const timer = setTimeout(() => {
+            const entry = this.kiroIncompatNotices.get(reason);
+            this.kiroIncompatNotices.delete(reason);
+            if (entry)
+                this.sendKiroIncompatToGenerals(entry.names, reason);
+        }, FleetManager.STARTUP_RETRY_NOTICE_AGGREGATE_MS);
+        timer.unref?.();
+        this.kiroIncompatNotices.set(reason, { names: [name], timer });
+    }
+    /**
+     * Held in the delivery outbox until each General takes it: the same kiro-cli
+     * may have stopped the General too, and it should still hear once it is back.
+     * Admitted once per day per refusal (reason + names) and General.
+     */
+    sendKiroIncompatToGenerals(names, reason, now = new Date()) {
+        const generals = Object.entries(this.fleetConfig?.instances ?? {})
+            .filter(([, config]) => config.general_topic === true).map(([general]) => general);
+        if (generals.length === 0)
+            return;
+        try {
+            this.ensureDeliveryOutbox();
+            const sorted = [...names].sort();
+            const digest = createHash("sha256").update(`${reason}\u0000${sorted.join(",")}`).digest("hex").slice(0, 16);
+            const content = t("fleet.kiro_incompat_general", sorted.join(", "), reason);
+            for (const general of generals) {
+                this.deliveryOutbox.admitSystemNotice(general, `kiro-incompat:${now.toISOString().slice(0, 10)}:${digest}:${general}`, content, now);
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err, names }, "Could not queue the kiro incompatibility notice for General");
+        }
+    }
     /**
      * One notice per refusal reason: a kiro-cli that dropped the legacy UI
      * refuses every kiro instance at once, and that is one message, not ten.
@@ -4230,270 +4508,7 @@ export class FleetManager {
         this.adapter.on("slash_command", safeHandler(async (data) => {
             if (!isCurrentAdapter())
                 return;
-            if (!(await this.authorizeSlash(data, adapterId)))
-                return;
-            if (data.command === "start") {
-                await this.handleClassicStartSlash(data, adapterId);
-            }
-            else if (data.command === "stop") {
-                const reply = await this.handleClassicStop(data.channelId, adapterId);
-                await data.respond(reply);
-            }
-            else if (data.command === "pause" || data.command === "wake") {
-                await this.handlePauseWakeSlash(data, adapterId);
-            }
-            else if (data.command === "chat") {
-                const text = data.text ?? "";
-                if (!text) {
-                    await data.respond(t("chat.usage"));
-                    return;
-                }
-                const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent_start"));
-                    return;
-                }
-                const status = this.resolveStatusEmojisFor(name, adapterId, adapter);
-                const replyMsgId = await data.respond(textForm(status.platform, status.received));
-                const username = data.username ?? data.userId;
-                ClassicChannelManager.logMessage(name, username, `/chat ${text}`, new Date());
-                await this.forwardToClassicInstance(name, text, {
-                    chatId: data.channelId,
-                    threadId: data.channelId,
-                    messageId: replyMsgId ?? "",
-                    userId: data.userId,
-                    username,
-                    source: "discord",
-                    timestamp: new Date(),
-                });
-            }
-            else if (data.command === "save") {
-                await this.handleSlashSave(data, adapterId);
-            }
-            else if (data.command === "load") {
-                // load is kiro-cli/classic only — no claude-code equivalent.
-                if (!this.classicChannels?.isAdmin(data.userId)) {
-                    await data.respond(t("admin.required"));
-                    return;
-                }
-                const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent_start"));
-                    return;
-                }
-                const filename = data.options?.filename;
-                if (!SAVE_FILENAME_RE.test(filename ?? "")) {
-                    await data.respond(t("filename.invalid"));
-                    return;
-                }
-                this.pasteRawToClassicInstance(name, `/chat load ${filename}`);
-                await data.respond(t("save.sent", `/chat load ${filename}`, name));
-            }
-            else if (data.command === "compact") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const result = await this.topicCommands.sendCompact(name, String(data.options?.instructions ?? ""));
-                await data.respond(result);
-            }
-            else if (data.command === "steer") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const steerText = String(data.options?.message ?? "").trim();
-                if (!steerText) {
-                    await data.respond(t("steer.usage"));
-                    return;
-                }
-                // chat_id/message_id stay empty: a slash interaction has no channel
-                // message to react to, and an empty chat_id keeps updateLastChat from
-                // rerouting the instance's replies to the slash context.
-                const result = this.topicCommands.sendSteer(name, steerText, {
-                    chatId: "", messageId: "", username: data.username ?? "user",
-                    userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
-                });
-                await data.respond(result);
-            }
-            else if (data.command === "btw") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const btwText = String(data.options?.message ?? "").trim();
-                if (!btwText) {
-                    await data.respond(t("btw.usage"));
-                    return;
-                }
-                const result = this.topicCommands.sendBtw(name, btwText, {
-                    chatId: "", messageId: "", username: data.username ?? "user",
-                    userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
-                });
-                await data.respond(result);
-            }
-            else if (data.command === "login") {
-                await this.handleLoginSlash(data, adapterId, this.adapter);
-            }
-            else if (data.command === "clear") {
-                await this.handleClearSlash(data, adapterId);
-            }
-            else if (data.command === "model") {
-                await this.handleModelSlash(data, adapterId);
-            }
-            else if (data.command === "effort") {
-                await this.handleEffortSlash(data, adapterId);
-            }
-            else if (data.command === "cancel") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const ok = this.cancelInstance(name);
-                await data.respond(ok ? t("cancel.sent", name) : t("cancel.not_running", name));
-            }
-            else if (data.command === "ctx") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                // Single source of truth (statusline.json + robust tmux pane fallback).
-                await data.respond(await this.topicCommands.getCtxText(name));
-            }
-            else if (data.command === "collab") {
-                // Classic no longer lives in the routing engine, so a routing hit here is
-                // always a fleet-topic instance.
-                const collabTarget = this.routing.resolve(data.channelId);
-                if (collabTarget) {
-                    if (this.fleetAdminGate(data.userId, adapterId) !== "ok") {
-                        await data.respond(t("not_authorized"));
-                        return;
-                    }
-                    const isCollab = this.toggleFleetCollab(collabTarget.name);
-                    await data.respond(isCollab ? t("collab.on") : t("collab.off"));
-                    return;
-                }
-                if (!this.classicChannels?.isAdmin(data.userId)) {
-                    await data.respond(t("admin.required"));
-                    return;
-                }
-                if (!this.classicChannels.isClassicChannel(data.channelId, adapterId)) {
-                    await data.respond(t("classic.no_agent_start"));
-                    return;
-                }
-                const newState = this.classicChannels.toggleCollab(data.channelId, adapterId);
-                await data.respond(newState
-                    ? t("collab.on.classic")
-                    : t("collab.off.classic"));
-            }
-            else if (data.command === "update") {
-                await this.handleUpdateSlash(data, adapterId);
-            }
-            else if (data.command === "doctor") {
-                if (this.fleetAdminGate(data.userId, adapterId) !== "ok") {
-                    await data.respond(t("not_authorized"));
-                    return;
-                }
-                await data.respond(await this.runBackendDoctor());
-            }
-            else if (data.command === "usage") {
-                // Same permission level as /ctx (none). The reply is still ephemeral —
-                // the adapter defers non-chat commands that way — so it never spams the
-                // channel either way.
-                try {
-                    const { getUsageSnapshot } = await import("./usage/usage-api.js");
-                    const { renderUsageMarkdown } = await import("./usage/format-rich.js");
-                    // slash_command is Discord-only; editReply renders Markdown natively.
-                    await data.respond(renderUsageMarkdown(await getUsageSnapshot(false, this.getActiveUsageProviderIds())));
-                }
-                catch (err) {
-                    await data.respond(t("usage.failed", err.message));
-                }
-            }
-            else if (data.command === "tips") {
-                await this.handleTipsSlash(data, adapterId);
-            }
-            else if (data.command === "status") {
-                // Admin-gated (like the topic path): the merged table shows every
-                // instance's cost and IPC health.
-                if (!this.isFleetAdmin(data.userId, adapterId)) {
-                    await data.respond(t("cmd.admin_required", "/status"));
-                    return;
-                }
-                const text = await this.topicCommands.getStatusText();
-                await data.respond(text);
-            }
-            else if (data.command === "sysinfo") {
-                // Slash commands are Discord-only; use plain lines (no markdown table)
-                await this.topicCommands.sendSysInfo(text => data.respond(text), { platform: "discord" });
-            }
-            else if (data.command === "dashboard") {
-                // Reply is ephemeral (adapter defers non-chat commands ephemerally), so
-                // the web-token-bearing URLs are only visible to the caller.
-                const gate = this.fleetAdminGate(data.userId, adapterId);
-                if (gate !== "ok") {
-                    await data.respond(t(gate === "disabled" ? "dashboard.disabled" : "not_authorized"));
-                    return;
-                }
-                await data.respond(this.topicCommands.getDashboardText());
-            }
-            else if (data.command === "restart") {
-                await this.handleRestartSlash(data, adapterId);
-            }
-            else if (data.command === "compact") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const result = await this.topicCommands.sendCompact(name, String(data.options?.instructions ?? ""));
-                await data.respond(result);
-            }
-            else if (data.command === "steer") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const steerText = String(data.options?.message ?? "").trim();
-                if (!steerText) {
-                    await data.respond(t("steer.usage"));
-                    return;
-                }
-                // chat_id/message_id stay empty: a slash interaction has no channel
-                // message to react to, and an empty chat_id keeps updateLastChat from
-                // rerouting the instance's replies to the slash context.
-                const result = this.topicCommands.sendSteer(name, steerText, {
-                    chatId: "", messageId: "", username: data.username ?? "user",
-                    userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
-                });
-                await data.respond(result);
-            }
-            else if (data.command === "btw") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const btwText = String(data.options?.message ?? "").trim();
-                if (!btwText) {
-                    await data.respond(t("btw.usage"));
-                    return;
-                }
-                const result = this.topicCommands.sendBtw(name, btwText, {
-                    chatId: "", messageId: "", username: data.username ?? "user",
-                    userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
-                });
-                await data.respond(result);
-            }
-            else if (data.command === "login") {
-                await this.handleLoginSlash(data, adapterId, this.adapter);
-            }
+            await this.dispatchSlash(data, adapterId, adapter);
         }, this.logger, "adapter.slash_command"));
         await this.topicCommands.registerBotCommands().catch(e => this.logger.warn({ err: e }, "registerBotCommands failed (non-fatal)"));
         // Background-probe each backend's CLI env (version/models) → cli-env cache.
@@ -4597,221 +4612,7 @@ export class FleetManager {
         adapter.on("slash_command", safeHandler(async (data) => {
             if (!isCurrentAdapter())
                 return;
-            if (!(await this.authorizeSlash(data, adapterId)))
-                return;
-            if (data.command === "start") {
-                await this.handleClassicStartSlash(data, adapterId);
-            }
-            else if (data.command === "stop") {
-                const reply = await this.handleClassicStop(data.channelId, adapterId);
-                await data.respond(reply);
-            }
-            else if (data.command === "pause" || data.command === "wake") {
-                await this.handlePauseWakeSlash(data, adapterId);
-            }
-            else if (data.command === "chat") {
-                const text = data.text ?? "";
-                if (!text) {
-                    await data.respond(t("chat.usage"));
-                    return;
-                }
-                const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent_start"));
-                    return;
-                }
-                const status = this.resolveStatusEmojisFor(name, adapterId, adapter);
-                const replyMsgId = await data.respond(textForm(status.platform, status.received));
-                const username = data.username ?? data.userId;
-                ClassicChannelManager.logMessage(name, username, `/chat ${text}`, new Date());
-                await this.forwardToClassicInstance(name, text, {
-                    chatId: data.channelId,
-                    threadId: data.channelId,
-                    messageId: replyMsgId ?? "",
-                    userId: data.userId,
-                    username,
-                    source: channelConfig.type,
-                    timestamp: new Date(),
-                });
-            }
-            else if (data.command === "save") {
-                await this.handleSlashSave(data, adapterId);
-            }
-            else if (data.command === "load") {
-                // load is kiro-cli/classic only — no claude-code equivalent.
-                if (!this.classicChannels?.isAdmin(data.userId)) {
-                    await data.respond(t("admin.required"));
-                    return;
-                }
-                const name = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent_start"));
-                    return;
-                }
-                const filename = data.options?.filename;
-                if (!SAVE_FILENAME_RE.test(filename ?? "")) {
-                    await data.respond(t("filename.invalid"));
-                    return;
-                }
-                this.pasteRawToClassicInstance(name, `/chat load ${filename}`);
-                await data.respond(t("save.sent", `/chat load ${filename}`, name));
-            }
-            else if (data.command === "model") {
-                await this.handleModelSlash(data, adapterId);
-            }
-            else if (data.command === "clear") {
-                await this.handleClearSlash(data, adapterId);
-            }
-            else if (data.command === "effort") {
-                await this.handleEffortSlash(data, adapterId);
-            }
-            else if (data.command === "cancel") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const ok = this.cancelInstance(name);
-                await data.respond(ok ? t("cancel.sent", name) : t("cancel.not_running", name));
-            }
-            else if (data.command === "ctx") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                // Single source of truth (statusline.json + robust tmux pane fallback).
-                await data.respond(await this.topicCommands.getCtxText(name));
-            }
-            else if (data.command === "collab") {
-                // Classic no longer lives in the routing engine, so a routing hit here is
-                // always a fleet-topic instance.
-                const collabTarget2 = this.routing.resolve(data.channelId);
-                if (collabTarget2) {
-                    if (this.fleetAdminGate(data.userId, adapterId) !== "ok") {
-                        await data.respond(t("not_authorized"));
-                        return;
-                    }
-                    const isCollab = this.toggleFleetCollab(collabTarget2.name);
-                    await data.respond(isCollab ? t("collab.on") : t("collab.off"));
-                    return;
-                }
-                if (!this.classicChannels?.isAdmin(data.userId)) {
-                    await data.respond(t("admin.required"));
-                    return;
-                }
-                if (!this.classicChannels.isClassicChannel(data.channelId, adapterId)) {
-                    await data.respond(t("classic.no_agent_start"));
-                    return;
-                }
-                const newState = this.classicChannels.toggleCollab(data.channelId, adapterId);
-                await data.respond(newState
-                    ? t("collab.on.classic")
-                    : t("collab.off.classic"));
-            }
-            else if (data.command === "update") {
-                await this.handleUpdateSlash(data, adapterId);
-            }
-            else if (data.command === "doctor") {
-                if (this.fleetAdminGate(data.userId, adapterId) !== "ok") {
-                    await data.respond(t("not_authorized"));
-                    return;
-                }
-                await data.respond(await this.runBackendDoctor());
-            }
-            else if (data.command === "usage") {
-                // Same permission level as /ctx (none). The reply is still ephemeral —
-                // the adapter defers non-chat commands that way — so it never spams the
-                // channel either way.
-                try {
-                    const { getUsageSnapshot } = await import("./usage/usage-api.js");
-                    const { renderUsageMarkdown } = await import("./usage/format-rich.js");
-                    // slash_command is Discord-only; editReply renders Markdown natively.
-                    await data.respond(renderUsageMarkdown(await getUsageSnapshot(false, this.getActiveUsageProviderIds())));
-                }
-                catch (err) {
-                    await data.respond(t("usage.failed", err.message));
-                }
-            }
-            else if (data.command === "tips") {
-                await this.handleTipsSlash(data, adapterId);
-            }
-            else if (data.command === "status") {
-                // Admin-gated (like the topic path): the merged table shows every
-                // instance's cost and IPC health.
-                if (!this.isFleetAdmin(data.userId, adapterId)) {
-                    await data.respond(t("cmd.admin_required", "/status"));
-                    return;
-                }
-                const text = await this.topicCommands.getStatusText();
-                await data.respond(text);
-            }
-            else if (data.command === "sysinfo") {
-                // Slash commands are Discord-only; use plain lines (no markdown table)
-                await this.topicCommands.sendSysInfo(text => data.respond(text), { platform: "discord" });
-            }
-            else if (data.command === "dashboard") {
-                // Reply is ephemeral (adapter defers non-chat commands ephemerally), so
-                // the web-token-bearing URLs are only visible to the caller.
-                const gate = this.fleetAdminGate(data.userId, adapterId);
-                if (gate !== "ok") {
-                    await data.respond(t(gate === "disabled" ? "dashboard.disabled" : "not_authorized"));
-                    return;
-                }
-                await data.respond(this.topicCommands.getDashboardText());
-            }
-            else if (data.command === "restart") {
-                await this.handleRestartSlash(data, adapterId);
-            }
-            else if (data.command === "compact") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const result = await this.topicCommands.sendCompact(name, String(data.options?.instructions ?? ""));
-                await data.respond(result);
-            }
-            else if (data.command === "steer") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const steerText = String(data.options?.message ?? "").trim();
-                if (!steerText) {
-                    await data.respond(t("steer.usage"));
-                    return;
-                }
-                // chat_id/message_id stay empty: a slash interaction has no channel
-                // message to react to, and an empty chat_id keeps updateLastChat from
-                // rerouting the instance's replies to the slash context.
-                const result = this.topicCommands.sendSteer(name, steerText, {
-                    chatId: "", messageId: "", username: data.username ?? "user",
-                    userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
-                });
-                await data.respond(result);
-            }
-            else if (data.command === "btw") {
-                const name = this.resolveSlashTarget(data.channelId, adapterId);
-                if (!name) {
-                    await data.respond(t("classic.no_agent"));
-                    return;
-                }
-                const btwText = String(data.options?.message ?? "").trim();
-                if (!btwText) {
-                    await data.respond(t("btw.usage"));
-                    return;
-                }
-                const result = this.topicCommands.sendBtw(name, btwText, {
-                    chatId: "", messageId: "", username: data.username ?? "user",
-                    userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
-                });
-                await data.respond(result);
-            }
-            else if (data.command === "login") {
-                await this.handleLoginSlash(data, adapterId, adapter);
-            }
+            await this.dispatchSlash(data, adapterId, adapter);
         }, this.logger, `adapter[${adapterId}].slash_command`));
         adapter.on("started", safeHandler((username, userId) => {
             if (!isCurrentAdapter())
@@ -9025,10 +8826,17 @@ export class FleetManager {
      * unsupported backends get a clear error. Routes via classic paste or fleet IPC.
      */
     async handleSlashSave(data, adapterId) {
-        if (!this.classicChannels?.isAdmin(data.userId)) {
+        // The admin of the channel's own kind (a fleet admin in a fleet channel). It used to ask for a ClassicBot
+        // admin everywhere, so a fleet admin was refused in their own channel and a ClassicBot admin could paste
+        // into a fleet instance.
+        if (!this.isModelAdmin(data.userId, data.channelId, adapterId)) {
             await data.respond(t("admin.required"));
             return;
         }
+        if (!this.classicChannels) {
+            await data.respond(t("classic.no_agent_start"));
+            return;
+        }
         // Classic resolves per-bot (same-channel multi-bot); otherwise a fleet topic.
         const classicName = this.classicChannels.getInstanceByChannel(data.channelId, adapterId);
         const target = classicName