@songsid/agend 2.1.12-beta.6 → 2.1.12-beta.8

package/dist/fleet-manager.js

@@ -1,4 +1,6 @@
 import { measureSyncWork } from "./sync-work-attribution.js";
+import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
+import { ProfileControlServer } from "./profile-control.js";
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, constants as fsConstants } from "node:fs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
@@ -57,6 +59,51 @@ import { DeliveryOutbox } from "./delivery-outbox.js";
 // active manager/target generation pair owns the lane until the daemon reports
 // a state transition or that generation is replaced.
 export const DURABLE_DELIVERY_LANE_ALERT_MS = 35 * 60_000;
+/**
+ * #1335: Cap an unfiltered task list at 100 rows (most recently updated first).
+ * Exported so the production branch can be tested directly without starting a fleet.
+ * Filtered calls pass-through unchanged. Empty strings count as "not set" (P3).
+ * #1336: generic over the row shape so it works on both full Task and compact rows.
+ */
+export const TASK_LIST_CAP = 100;
+/**
+ * #1336: the non-terminal statuses a bare `list` returns by default. `done`
+ * and `cancelled` are excluded unless the caller passes `filter_status`.
+ */
+export const LIVE_TASK_STATUSES = ["open", "claimed", "blocked"];
+/**
+ * #1336 P2: shared normalization for filter_status across both task handlers
+ * and the cap helper. Trims whitespace before dropping empties, so
+ * " \t " and [" ", "\t"] both normalize to undefined (not treated as explicit
+ * filters). The same result drives the live-only default and the cap decision.
+ */
+export function normalizeStatusFilter(v) {
+    if (typeof v === "string") {
+        const s = v.trim();
+        return s || undefined;
+    }
+    if (Array.isArray(v) && v.every(x => typeof x === "string")) {
+        const arr = [...new Set(v.map(s => s.trim()).filter(s => s.length > 0))];
+        return arr.length > 0 ? arr : undefined;
+    }
+    return undefined;
+}
+export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
+    // Use the shared normalizer so " \t " is treated identically to undefined.
+    const normalized = normalizeStatusFilter(filterStatus);
+    const hasStatusFilter = Array.isArray(normalized) ? normalized.length > 0 : !!normalized;
+    const isFiltered = !!filterAssignee || hasStatusFilter;
+    if (!isFiltered && tasks.length > TASK_LIST_CAP) {
+        const omitted = tasks.length - TASK_LIST_CAP;
+        tasks.sort((a, b) => b.updated_at.localeCompare(a.updated_at));
+        return {
+            tasks: tasks.slice(0, TASK_LIST_CAP),
+            omitted,
+            hint: `${omitted} older task(s) omitted — use filter_assignee or filter_status to narrow results`,
+        };
+    }
+    return tasks;
+}
 import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
 import { handleViewRequest, isViewPath } from "./view-api.js";
 import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
@@ -571,6 +618,7 @@ export class FleetManager {
     /** Injectable only to keep the chat→CLI reload hand-off deterministic in tests. */
     fullRestartLauncher = launchFullRestartHelper;
     eventLogPruneTimer = null;
+    outboxPruneTimer = null;
     logRotateTimer = null;
     discordPresenceTimer = null;
     discordPresenceEagerTimer = null;
@@ -1543,6 +1591,85 @@ export class FleetManager {
         child.once("error", err => this.failUpdateProgress(err.message));
         child.unref();
     }
+    async handleProfileSlash(data, adapterId) {
+        const route = this.routing.resolve(data.channelId);
+        await this.handleGeneralProfile(route?.kind === "general" ? route.name : undefined, data.userId, adapterId, data.options?.seconds, data.respond);
+    }
+    /** Typed /profile belongs only to Telegram's General dispatcher. */
+    async runProfileCommand(msg, seconds) {
+        if (msg.source !== "telegram")
+            return;
+        const adapterId = msg.adapterId ?? this.getPrimaryAdapterId();
+        const route = msg.threadId ? this.routing.resolve(msg.threadId) : undefined;
+        const general = msg.threadId ? (route?.kind === "general" ? route.name : undefined)
+            : Object.keys(this.fleetConfig?.instances ?? {}).find(name => this.fleetConfig.instances[name].general_topic
+                && this.getInstanceAdapterId(name) === adapterId);
+        const adapter = adapterId ? this.adapters.get(adapterId) : this.adapter;
+        if (!adapter)
+            return;
+        await this.handleGeneralProfile(general, msg.userId, adapterId, seconds, async (text) => (await adapter.sendText(msg.chatId, text, { threadId: msg.threadId })).messageId);
+    }
+    async handleGeneralProfile(general, userId, ingressAdapterId, seconds, respond) {
+        if (!general || !this.fleetConfig?.instances[general]?.general_topic) {
+            await respond(t("profile.general_only"));
+            return;
+        }
+        const ownerId = this.getInstanceAdapterId(general);
+        if (!ownerId || ownerId !== ingressAdapterId) {
+            await respond(t("not_authorized"));
+            return;
+        }
+        const gate = this.fleetAdminGate(userId, ownerId);
+        if (gate !== "ok") {
+            await respond(t(gate === "disabled" ? "profile.disabled" : "not_authorized"));
+            return;
+        }
+        const adapter = this.getAdapterForInstance(general);
+        const group = String(this.getGroupIdForInstance(general) ?? "");
+        const topic = this.fleetConfig.instances[general].topic_id?.toString();
+        if (!adapter || this.worlds.get(ownerId)?.adapter !== adapter || !group) {
+            await respond(t("profile.unavailable"));
+            return;
+        }
+        let duration;
+        try {
+            duration = profileDuration(seconds);
+        }
+        catch {
+            await respond(t("profile.invalid"));
+            return;
+        }
+        let ticket;
+        try {
+            ticket = await this.startCpuProfile(duration);
+        }
+        catch (err) {
+            await respond(err instanceof ProfileBusyError ? t("profile.busy", String(err.remainingSeconds)) : t("profile.unavailable"));
+            return;
+        }
+        // A long recording must not hold a Discord interaction (or the inbound handler) open.
+        const initial = Promise.resolve().then(() => respond(t("profile.started", String(ticket.seconds))));
+        void (async () => {
+            await initial.catch(err => this.logger.warn({ err }, "CPU profile acknowledgement failed"));
+            let message;
+            try {
+                const result = await ticket.done;
+                const size = result.bytes === null ? t("profile.size_unknown") : `${(result.bytes / 1048576).toFixed(2)} MiB`;
+                message = t("profile.saved", result.path, size);
+            }
+            catch {
+                message = t("profile.failed");
+            }
+            // Never send a delayed artifact path to a replacement adapter/topic/world.
+            if (this.shuttingDown || this.getInstanceAdapterId(general) !== ownerId
+                || this.getAdapterForInstance(general) !== adapter || String(this.getGroupIdForInstance(general) ?? "") !== group
+                || this.fleetConfig?.instances[general]?.topic_id?.toString() !== topic
+                || !this.fleetConfig?.instances[general]?.general_topic)
+                return;
+            await adapter.sendText(group, message, { threadId: topic });
+        })().catch(err => this.logger.warn({ err }, "CPU profile General notice failed"));
+        await initial.catch(() => { });
+    }
     async handleRestartSlash(data, adapterId) {
         if (!this.isFleetAdmin(data.userId, adapterId)) {
             await data.respond(t("not_authorized"));
@@ -2314,6 +2441,36 @@ export class FleetManager {
             return "disabled";
         return this.isFleetAdmin(userId, adapterId) ? "ok" : "denied";
     }
+    runtimeCpuProfiler = null;
+    cpuProfileControl = null;
+    getCpuProfiler() {
+        if (!this.runtimeCpuProfiler || (this.runtimeCpuProfiler.closed && !this.shuttingDown)) {
+            this.runtimeCpuProfiler = new RuntimeCpuProfiler({ dataDir: this.dataDir,
+                logger: { info: message => this.logger.info(message), warn: message => this.logger.warn(message) } });
+        }
+        return this.runtimeCpuProfiler;
+    }
+    /** Called only by cold CLI startup, after claiming the fleet singleton. */
+    async startCpuProfileControl() {
+        if (this.shuttingDown || this.cpuProfileControl)
+            return;
+        const control = new ProfileControlServer(this.dataDir, this.getCpuProfiler());
+        this.cpuProfileControl = control; // shutdown owns even an in-flight listen
+        try {
+            await control.listen();
+        }
+        catch (err) {
+            if (this.cpuProfileControl === control)
+                this.cpuProfileControl = null;
+            throw err;
+        }
+    }
+    startEnvironmentCpuProfile() { return this.getCpuProfiler().startFromEnvironment(); }
+    startCpuProfile(seconds) {
+        if (this.shuttingDown)
+            return Promise.reject(new Error("Fleet is stopping."));
+        return this.getCpuProfiler().start(seconds);
+    }
     /**
      * Every Discord slash command, for every adapter, in one place (it used to be two copies that could drift).
      *
@@ -2446,6 +2603,9 @@ export class FleetManager {
         else if (data.command === "update") {
             await this.handleUpdateSlash(data, adapterId);
         }
+        else if (data.command === "profile") {
+            await this.handleProfileSlash(data, adapterId);
+        }
         else if (data.command === "doctor") {
             await data.respond(await this.runBackendDoctor());
         }
@@ -4116,6 +4276,11 @@ export class FleetManager {
         this.pruneEventLog();
         this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
         this.eventLogPruneTimer.unref?.();
+        // #1335: delivery-outbox.db and Task Board retention. Same once-at-startup
+        // + daily-timer pattern; chunked DELETEs so one run cannot hold the loop.
+        void this.pruneOutboxAndTasks();
+        this.outboxPruneTimer = setInterval(() => { void this.pruneOutboxAndTasks(); }, 24 * 60 * 60_000);
+        this.outboxPruneTimer.unref?.();
         // Same shape for logs, and for the same reason: the only sweep that
         // covered them lived inside the daily-summary callback, so it did not run at
         // all when summaries were off.
@@ -5274,6 +5439,35 @@ export class FleetManager {
      * the message came from — its own world's group_id. Two Telegram fleet
      * worlds can number topics alike; a coincidence is dropped, never delivered.
      */
+    /**
+     * #1346: whether this copy may claim the shared dedup key for
+     * command-like text. Fleet topics resolve an owning adapter and only its
+     * copy proceeds; anything else (classic targets, unknown routing, no
+     * identity) passes through to the existing handling.
+     */
+    isOwnerCommandCopy(msg, threadId) {
+        if (!msg.adapterId || threadId === undefined)
+            return true;
+        const target = this.resolveInboundTarget(msg, threadId);
+        if (!target || target.kind === "classic")
+            return true;
+        const owner = this.getInstanceAdapterId(target.name);
+        if (owner && msg.adapterId !== owner)
+            return false;
+        // #1346 6b: /cmd@otherbot is addressed elsewhere — ignore it even on the
+        // owner's copy. An unknown username can't be judged: let it through (the
+        // receiver gate above still applies). Same case-insensitive rule as the
+        // Telegram classic branch.
+        // Hyphenated aliases count too (e.g. /install-cli): Telegram command
+        // names cannot contain "-", but typed aliases can.
+        const suffix = msg.text?.trim().match(/^\/[\w-]+@(\S+)/)?.[1];
+        if (suffix && owner) {
+            const ownerUser = this.worlds.get(owner)?.botUsername;
+            if (ownerUser && suffix.toLowerCase() !== ownerUser.toLowerCase())
+                return false;
+        }
+        return true;
+    }
     resolveInboundTarget(msg, threadId) {
         if (msg.source !== "telegram")
             return this.routing.resolve(threadId);
@@ -5337,6 +5531,16 @@ export class FleetManager {
         // EXCEPTION — classic channels with same-channel multi-bot: two bots may own
         // separate agents in one channel, so each bot must process its OWN copy of
         // the message (the @mention filter downstream decides who actually forwards).
+        // #1346: a non-owner adapter's copy of command-like text must not burn
+        // the shared dedup key — the owner's copy still has to run the command.
+        // (Non-command input keeps first-wins delivery.) Classic channels keep
+        // per-adapter keys — first-/start-contact onboarding needs every copy
+        // to flow — so only fleet targets are judged here; the in-handler gates
+        // (owner entry check, Discord ignore) cover classic instead.
+        if (msg.messageId && /^\/\w/.test(msg.text?.trim() ?? "") && !this.isOwnerCommandCopy(msg, threadId)) {
+            this.logger.debug({ adapterId: msg.adapterId, threadId }, "Non-owner command copy — skipping before dedup claim");
+            return;
+        }
         // Key the dedup per-adapter there so a sibling bot's copy isn't dropped.
         if (msg.messageId) {
             const classicCid = threadId || msg.chatId;
@@ -5665,11 +5869,14 @@ export class FleetManager {
                 // Unregistered group: ignore
                 return;
             }
-            // General topic: check /ctx /compact /collab first, then admin commands
+            // General topic: Discord /xxx gets the system note first (never a
+            // command); other sources fall through to the handlers below.
             const generalInstance = this.findGeneralInstance(msg.adapterId);
+            if (generalInstance && await this.replyDiscordNotACommand(msg, generalInstance))
+                return;
             if (generalInstance && await this.topicCommands.handleInstanceCommand(msg, generalInstance))
                 return;
-            if (await this.topicCommands.handleGeneralCommand(msg))
+            if (generalInstance && await this.topicCommands.handleGeneralCommand(msg, generalInstance))
                 return;
             // Forward to General Topic instance if configured
             if (generalInstance) {
@@ -5754,13 +5961,18 @@ export class FleetManager {
             return;
         }
         const instanceName = target.name;
+        // #1346: on Discord, plain-text /xxx runs no command — the owner posts
+        // the system note before the handlers below ever see the text.
+        if (await this.replyDiscordNotACommand(msg, instanceName)) {
+            return;
+        }
         // Intercept /ctx /compact /collab in ANY topic (including general)
         if (await this.topicCommands.handleInstanceCommand(msg, instanceName)) {
             return;
         }
         // Intercept admin commands (/status, /restart, /sysinfo) in general topics
         const instanceConfig = this.fleetConfig?.instances[instanceName];
-        if (instanceConfig?.general_topic && await this.topicCommands.handleGeneralCommand(msg)) {
+        if (instanceConfig?.general_topic && await this.topicCommands.handleGeneralCommand(msg, instanceName)) {
             return;
         }
         // Bind instance to the adapter that delivered this message
@@ -6636,45 +6848,74 @@ export class FleetManager {
         const asStatus = (v) => {
             return (v === "open" || v === "claimed" || v === "done" || v === "blocked" || v === "cancelled") ? v : undefined;
         };
-        switch (action) {
-            case "create": {
-                const title = asStr(args.title);
-                if (!title)
-                    return { error: "title is required" };
-                return db.createTask({
-                    title,
-                    description: asStr(args.description),
-                    priority: asPriority(args.priority),
-                    assignee: asStr(args.assignee),
-                    depends_on: asStrArr(args.depends_on),
-                    created_by: instance,
-                });
-            }
-            case "list": return db.listTasks({ assignee: asStr(args.filter_assignee), status: asStr(args.filter_status) });
-            case "claim": {
-                const id = asStr(args.id);
-                if (!id)
-                    return { error: "id is required" };
-                return db.claimTask(id, instance);
-            }
-            case "done": {
-                const id = asStr(args.id);
-                if (!id)
-                    return { error: "id is required" };
-                return db.completeTask(id, asStr(args.result));
-            }
-            case "update": {
-                const id = asStr(args.id);
-                if (!id)
-                    return { error: "id is required" };
-                return db.updateTask(id, {
-                    status: asStatus(args.status),
-                    assignee: asStr(args.assignee),
-                    result: asStr(args.result),
-                    priority: asPriority(args.priority),
-                });
+        // #1336 P2: use the shared normalizer — trims whitespace AND drops empties,
+        // so " \t " / [" ","\t"] are treated identically to undefined.
+        const asStatusFilter = normalizeStatusFilter;
+        // #1336: small write ack — identifying fields only.
+        const ack = (t) => ({ id: t.id, status: t.status, updated_at: t.updated_at });
+        try {
+            switch (action) {
+                case "create": {
+                    const title = asStr(args.title);
+                    if (!title)
+                        return { error: "title is required" };
+                    return ack(db.createTask({
+                        title,
+                        description: asStr(args.description),
+                        priority: asPriority(args.priority),
+                        assignee: asStr(args.assignee),
+                        depends_on: asStrArr(args.depends_on),
+                        created_by: instance,
+                    }));
+                }
+                case "list": {
+                    const filterAssignee = asStr(args.filter_assignee) || undefined;
+                    const explicitStatus = asStatusFilter(args.filter_status);
+                    // #1336 item 1: default to live-only (no done/cancelled) unless the
+                    // caller explicitly asked for a status.
+                    const effectiveStatus = explicitStatus ?? LIVE_TASK_STATUSES;
+                    const verbose = args.verbose === true;
+                    const tasks = verbose
+                        ? db.listTasks({ assignee: filterAssignee, status: effectiveStatus, verbose: true })
+                        : db.listTasks({ assignee: filterAssignee, status: effectiveStatus });
+                    // #1335: cap unfiltered list. The default live-only filter does not
+                    // count as an explicit filter for the cap decision.
+                    return applyTaskListCap(tasks, filterAssignee, explicitStatus);
+                }
+                case "get": {
+                    const id = asStr(args.id);
+                    if (!id)
+                        return { error: "id is required" };
+                    return db.getTaskByPrefix(id);
+                }
+                case "claim": {
+                    const id = asStr(args.id);
+                    if (!id)
+                        return { error: "id is required" };
+                    return ack(db.claimTask(db.getTaskByPrefix(id).id, instance));
+                }
+                case "done": {
+                    const id = asStr(args.id);
+                    if (!id)
+                        return { error: "id is required" };
+                    return ack(db.completeTask(db.getTaskByPrefix(id).id, asStr(args.result)));
+                }
+                case "update": {
+                    const id = asStr(args.id);
+                    if (!id)
+                        return { error: "id is required" };
+                    return ack(db.updateTask(db.getTaskByPrefix(id).id, {
+                        status: asStatus(args.status),
+                        assignee: asStr(args.assignee),
+                        result: asStr(args.result),
+                        priority: asPriority(args.priority),
+                    }));
+                }
+                default: return { error: `Unknown task action: ${action}` };
             }
-            default: return { error: `Unknown task action: ${action}` };
+        }
+        catch (err) {
+            return { error: err.message };
         }
     }
     async handleSetDisplayNameHttp(instance, name) {
@@ -6745,11 +6986,17 @@ export class FleetManager {
         }
         const db = this.scheduler.db;
         const action = payload.action;
+        // #1336 P2: use the shared normalizer — trims whitespace AND drops empties,
+        // so " \t " / [" ","\t"] are treated identically to undefined.
+        const asStatusFilter = normalizeStatusFilter;
+        const ack = (t) => ({ id: t.id, status: t.status, updated_at: t.updated_at });
         try {
             let result;
+            // Full task kept for activity logging; the IPC reply uses the compact ack.
+            let logTask;
             switch (action) {
                 case "create":
-                    result = db.createTask({
+                    logTask = db.createTask({
                         title: payload.title,
                         description: payload.description,
                         priority: payload.priority,
@@ -6757,43 +7004,57 @@ export class FleetManager {
                         depends_on: payload.depends_on,
                         created_by: meta.instance_name || instanceName,
                     });
+                    result = ack(logTask);
                     break;
-                case "list":
-                    result = db.listTasks({
-                        assignee: payload.filter_assignee,
-                        status: payload.filter_status,
-                    });
+                case "list": {
+                    // P3: normalize empty strings to undefined — SchedulerDb.listTasks
+                    // ignores them but the cap logic must treat them as "not filtered".
+                    const filterAssignee = payload.filter_assignee || undefined;
+                    const explicitStatus = asStatusFilter(payload.filter_status);
+                    // #1336 item 1: default to live-only (no done/cancelled).
+                    const effectiveStatus = explicitStatus ?? LIVE_TASK_STATUSES;
+                    const verbose = payload.verbose === true;
+                    const tasks = verbose
+                        ? db.listTasks({ assignee: filterAssignee, status: effectiveStatus, verbose: true })
+                        : db.listTasks({ assignee: filterAssignee, status: effectiveStatus });
+                    // #1335: cap unfiltered list — the default live-only filter does not
+                    // count as an explicit filter.
+                    result = applyTaskListCap(tasks, filterAssignee, explicitStatus);
+                    break;
+                }
+                case "get":
+                    result = db.getTaskByPrefix(payload.id);
                     break;
                 case "claim":
-                    result = db.claimTask(payload.id, meta.instance_name || instanceName);
+                    logTask = db.claimTask(db.getTaskByPrefix(payload.id).id, meta.instance_name || instanceName);
+                    result = ack(logTask);
                     break;
                 case "done":
-                    result = db.completeTask(payload.id, payload.result);
+                    logTask = db.completeTask(db.getTaskByPrefix(payload.id).id, payload.result);
+                    result = ack(logTask);
                     break;
                 case "update":
-                    result = db.updateTask(payload.id, {
+                    logTask = db.updateTask(db.getTaskByPrefix(payload.id).id, {
                         status: payload.status,
                         assignee: payload.assignee,
                         result: payload.result,
                         priority: payload.priority,
                     });
+                    result = ack(logTask);
                     break;
                 default:
                     throw new Error(`Unknown task action: ${action}`);
             }
             ipc.send({ type: "fleet_task_response", fleetRequestId, result });
             // Activity log for task lifecycle events
-            if (action === "create") {
-                const t = result;
-                this.eventLog?.logActivity("task_update", instanceName, `created task: ${t.title}`, t.assignee ?? undefined);
+            if (action === "create" && logTask) {
+                this.eventLog?.logActivity("task_update", instanceName, `created task: ${logTask.title}`, logTask.assignee ?? undefined);
             }
-            else if (action === "claim") {
-                const t = result;
-                this.eventLog?.logActivity("task_update", instanceName, `claimed: ${t.title}`);
+            else if (action === "claim" && logTask) {
+                this.eventLog?.logActivity("task_update", instanceName, `claimed: ${logTask.title}`);
             }
-            else if (action === "done") {
-                const t = result;
-                this.eventLog?.logActivity("task_update", instanceName, `completed: ${t.title}`, undefined, t.result ?? undefined);
+            else if (action === "done" && logTask) {
+                this.eventLog?.logActivity("task_update", instanceName, `completed: ${logTask.title}`, undefined, logTask.result ?? undefined);
             }
         }
         catch (err) {
@@ -8165,6 +8426,42 @@ export class FleetManager {
             this.logger.warn({ err }, "Event log prune failed");
         }
     }
+    /** #1335: Prune delivery-outbox.db and Task Board in chunked async passes. */
+    async pruneOutboxAndTasks() {
+        const days = this.fleetConfig?.defaults?.retention_days ?? 30;
+        // Outbox prune
+        const outbox = this.deliveryOutbox;
+        if (outbox?.isOpen) {
+            try {
+                const { pruned, durationMs } = await outbox.prune(days);
+                if (pruned > 0) {
+                    this.logger.info({ pruned, durationMs: Math.round(durationMs) }, "Delivery outbox pruned");
+                }
+            }
+            catch (err) {
+                this.logger.warn({ err }, "Delivery outbox prune failed");
+            }
+        }
+        // Task Board prune
+        if (this.scheduler?.db) {
+            try {
+                const pruned = await this.scheduler.db.pruneOldTasks(days);
+                if (pruned > 0) {
+                    this.logger.info({ pruned }, "Task board pruned");
+                }
+            }
+            catch (err) {
+                this.logger.warn({ err }, "Task board prune failed");
+            }
+        }
+    }
+    /**
+     * #1335: True when the delivery_id was in the outbox, was pruned by
+     * retention, and the caller is the original source or target (#1340 P2 🔒).
+     */
+    wasDeliveryIdPrunedForCaller(deliveryId, callerInstance) {
+        return this.deliveryOutbox?.wasDeliveryIdPrunedForCaller(deliveryId, callerInstance) ?? false;
+    }
     openEventLog() {
         const dbPath = join(this.dataDir, "events.db");
         try {
@@ -10941,13 +11238,50 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.failoverActive.clear();
     }
     // ── Classic Channel Methods ──────────────────────────────────────────
+    /**
+     * #1346: on Discord, plain-text /xxx is never a command — the slash menu
+     * is. Both fleet call sites run this BEFORE the command handlers, so even
+     * the owning adapter's copy never executes text. The owning adapter posts
+     * one system note and consumes the message so it never reaches the agent;
+     * other adapters' copies stay silent (and the shared dedup key means
+     * exactly one copy gets here). Telegram keeps text commands working —
+     * text is its command path — and other sources pass through untouched.
+     */
+    async replyDiscordNotACommand(msg, instanceName) {
+        if (msg.source !== "discord")
+            return false;
+        if (!/^\/\w/.test(msg.text?.trim() ?? ""))
+            return false;
+        const owner = this.getInstanceAdapterId(instanceName);
+        if (msg.adapterId && owner && msg.adapterId !== owner)
+            return false;
+        const adapter = this.worlds.get(owner ?? msg.adapterId ?? "")?.adapter ?? this.adapter;
+        if (!adapter)
+            return false;
+        await adapter.sendText(msg.chatId, t("cmd.not_a_command"), { threadId: msg.threadId });
+        return true;
+    }
     /** Handle a message in a classic channel: log it, forward only /chat messages */
     async handleClassicChannelMessage(instanceName, msg) {
         const text = msg.text ?? "";
         const channelId = msg.threadId ?? msg.chatId;
         const isCollabMode = this.classicChannels?.isCollab(channelId, msg.adapterId) ?? false;
-        // Handle /ctx in classic mode — always, regardless of collab mode
+        // #1346: Discord ClassicBot channels ignore plain-text /xxx silently —
+        // no warning (multi-bot groups must not all warn), no command, and no
+        // forward to the agent either. The received-reaction and chat-log paths
+        // below still run (a /chat ack is not a reply). Telegram keeps working
+        // (text is its command path there).
+        const discordSlashText = msg.source === "discord" && /^\/\w/.test(text.trim());
+        // Handle /ctx in classic mode — always, regardless of collab mode.
+        // Only the adapter that owns an entry in this channel answers; the
+        // per-adapter dedup key already scopes copies, this guards the rest.
+        // Discord /chat still flows through (its received-reaction below is an
+        // ack, not a reply); only its forward is skipped.
+        if (discordSlashText && !/^\/chat(\s|$)/.test(text.trim()))
+            return;
         if (text === "/ctx" || text.startsWith("/ctx@")) {
+            if (!this.classicChannels?.getInstanceByChannel(channelId, msg.adapterId))
+                return;
             const reply = await this.topicCommands.getCtxText(instanceName);
             const classicAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
             if (classicAdapter)
@@ -11049,7 +11383,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     finalText = `${tags}\n${finalText}`;
                 }
             }
-            await this.forwardToClassicInstance(instanceName, finalText, msg, extraMeta);
+            // #1346: Discord typed /xxx is never forwarded (reacts above already ran).
+            if (!discordSlashText)
+                await this.forwardToClassicInstance(instanceName, finalText, msg, extraMeta);
             return;
         }
         // Normal mode: /chat trigger
@@ -11116,7 +11452,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     .catch(e => this.logger.debug({ err: e.message }, "Auto-react failed"));
             }
         }
-        await this.forwardToClassicInstance(instanceName, finalText, msg, extraMeta);
+        // #1346: Discord typed /chat gets its received-reaction above but is
+        // never forwarded to the agent.
+        if (!discordSlashText)
+            await this.forwardToClassicInstance(instanceName, finalText, msg, extraMeta);
     }
     /** Download photo or document attachment to classic instance workspace inbox. Returns { path, kind } or undefined. */
     async saveClassicAttachment(instanceName, msg) {
@@ -12554,6 +12893,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // because we asked it to. Set synchronously — doStopAll runs to its first
         // await in the same tick as the signal handler, so no event can slip in.
         this.shuttingDown = true;
+        const profileStopped = this.runtimeCpuProfiler?.shutdown("fleet shutdown");
         this.ipcStoppingInstances.add("__fleet_stopping__");
         // Release held delivery promises before awaiting daemon shutdown, then
         // reject spawn work which has not started. Otherwise a storm backoff could
@@ -12582,6 +12922,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // A login/install window is a dedicated tmux server with its own TTL
         // timer and HTTP listener living in THIS process: without an explicit
         // shutdown it would outlive us as an owner-less login CLI (sol B3).
+        await profileStopped;
+        await this.cpuProfileControl?.close();
+        this.cpuProfileControl = null;
         await this.shutdownLoginWindows();
         // Cancel adapter retry timers
         for (const state of this.adapterState.values()) {
@@ -12604,6 +12947,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.eventLogPruneTimer);
             this.eventLogPruneTimer = null;
         }
+        if (this.outboxPruneTimer) {
+            clearInterval(this.outboxPruneTimer);
+            this.outboxPruneTimer = null;
+        }
         if (this.replyObligationTimer) {
             clearInterval(this.replyObligationTimer);
             this.replyObligationTimer = null;