@songsid/agend 2.1.4 → 2.1.5-beta.10

package/dist/fleet-manager.js

@@ -7,7 +7,7 @@ import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
-import { beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, setUpdateProgressStage, } from "./update-marker.js";
+import { beginFullRestartProgress as persistFullRestartProgress, beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, setUpdateProgressStage, updateProgressOperation, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
 import { sdNotify, sdNotifyBlocking } from "./sd-notify.js";
 import { readFleetMemory } from "./process-memory.js";
@@ -48,6 +48,8 @@ import { handleViewRequest, isViewPath } from "./view-api.js";
 import { handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
+import { LoginController, LOGIN_TOKEN_RESEND_PREFIX } from "./login-controller.js";
+import { LoginWindowLock } from "./login-window-lock.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
@@ -58,7 +60,8 @@ import { clearPausedMarker } from "./pause-marker.js";
 import { releaseProcessFleetLock } from "./fleet-lock.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { loadOrCreateWebToken, WEB_TOKEN_INVALID_MESSAGE } from "./web-auth.js";
-import { RestartProgress } from "./restart-progress.js";
+import { formatRestartProgressCompletion, RESTART_PROGRESS_TERMINAL_TIMEOUT_MS, RestartProgress, } from "./restart-progress.js";
+import { launchFullRestartHelper } from "./full-restart.js";
 import { collectRedundantInstanceDefaultPaths } from "./fleet-yaml-slim.js";
 import { StormWindow } from "./storm-window.js";
 import { SpawnGate } from "./spawn-gate.js";
@@ -226,7 +229,39 @@ const CLEAR_CONFIRM_TIMEOUT_MS = 15_000;
 /** Default lifetime for long-lived nonce prompts (clear overrides this to 15s). */
 const NONCE_BUTTON_TIMEOUT_MS = 15 * 60_000;
 const TIP_BUTTON_TIMEOUT_MS = 24 * 60 * 60_000;
-const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // /model reads cached CLI env within 24h
+const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // hard validity bound for the cached CLI env
+/**
+ * How old the cached CLI env may be before `/model` re-probes it live.
+ *
+ * The cache is a file under AGEND_HOME, so it outlives the process, and the only
+ * thing that refreshed it was the startup probe. That is why a newly released
+ * model showed up only after `agend stop` + `agend start`: a bare `agend restart`
+ * signals SIGUSR2 and restarts the instances inside the *same* manager process,
+ * so nothing re-probed and `/model` kept serving a list up to 24h old.
+ */
+const CLI_ENV_FRESH_MS = 60 * 60 * 1000;
+/**
+ * Upper bound on a live probe driven by `/model`.
+ *
+ * A probe chains bounded leaves but is not itself bounded: claude-code runs
+ * `--version` (5s) then listModels then listApiModels (an 8s AbortController
+ * against api.anthropic.com), and several backends' probes carry no explicit
+ * timeout at all. Awaiting that inline would make `/model` the next thing to
+ * hang, so it races this deadline and falls back to the cached list.
+ *
+ * Must stay above CLI_PROBE_LONGEST_CHAIN_MS — the probe's bounded steps run
+ * back to back, so clearing only the longest single leaf would be false
+ * confidence: a deadline above 8s but below the 13s chain still truncates a
+ * probe that would have succeeded. Bounding the chain rather than the leaf is
+ * the lesson from the usage hang, and the tests assert against the derived
+ * chain constant so raising either step cannot silently break it.
+ *
+ * The deadline exists to stop a probe hanging forever, not to cut short one that
+ * would have finished: truncating a legitimate probe serves the previous list
+ * and hides exactly the newly released model the user opened `/model` to find.
+ * The wait is announced before it starts, so it reads as progress, not a stall.
+ */
+export const CLI_ENV_PROBE_DEADLINE_MS = 16_000;
 export class FleetManager {
     dataDir;
     static signalTarget = null;
@@ -377,6 +412,8 @@ export class FleetManager {
     updateProgressEditRunning = false;
     lastUpdateProgressText = null;
     updateCompletionTipText = null;
+    /** Injectable only to keep the chat→CLI reload hand-off deterministic in tests. */
+    fullRestartLauncher = launchFullRestartHelper;
     eventLogPruneTimer = null;
     logRotateTimer = null;
     /** Days of event/activity history to keep. */
@@ -763,6 +800,28 @@ export class FleetManager {
         child.once("error", err => this.failUpdateProgress(err.message));
         child.unref();
     }
+    async handleRestartSlash(data, adapterId) {
+        if (!this.isFleetAdmin(data.userId, adapterId)) {
+            await data.respond(t("not_authorized"));
+            return;
+        }
+        if (data.options?.mode !== "full") {
+            await data.respond(t("restart.graceful"));
+            process.kill(process.pid, "SIGUSR2");
+            return;
+        }
+        // Discord exposes only `full` as a choice. Keep a runtime check anyway: a
+        // briefly stale command schema must never turn an unknown value into SIGUSR1.
+        const messageId = await data.respond(t("restart.full_preparing"));
+        const adapter = this.adapters.get(adapterId) ?? this.adapter;
+        if (!messageId || !adapter) {
+            this.logger.error({ adapterId, hasMessageId: !!messageId }, "Full restart response could not be persisted — reload refused");
+            await data.respond(t("restart.full_launch_failed"));
+            return;
+        }
+        const chatId = String(this.getChannelConfig(adapterId)?.group_id ?? data.channelId);
+        await this.requestFullRestart(adapter, chatId, data.channelId, messageId);
+    }
     async handleTipsSlash(data, adapterId) {
         if (!this.fleetConfig)
             return;
@@ -1686,15 +1745,31 @@ export class FleetManager {
     }
     backendNameOf(name) {
         const fleetDefault = this.fleetConfig?.defaults?.backend;
-        const configured = this.fleetConfig?.instances[name]?.backend;
-        if (configured)
-            return configured;
+        const fleetInstance = this.fleetConfig?.instances[name];
+        // A malformed/manual config can give a fleet and Classic entry the same
+        // instance name. Fleet ownership wins, including its inherited default;
+        // otherwise a Classic override could make backend-scoped recovery restart
+        // the shared process under the wrong login result.
+        if (fleetInstance)
+            return fleetInstance.backend ?? fleetDefault ?? "claude-code";
         // ClassicBot channels pick their own backend; the fleet default is only the fallback.
         if (this.classicChannels?.getAll().some(channel => channel.instanceName === name)) {
             return this.classicChannels.getBackendByInstance(name, fleetDefault);
         }
         return fleetDefault ?? "claude-code";
     }
+    /**
+     * Every configured instance whose backend may share credentials. ClassicBot
+     * rows live only in classicBot.yaml, so backend-wide operations must not use
+     * fleetConfig.instances as their roster. Set keeps a malformed name collision
+     * from restarting the same process twice; backendNameOf defines ownership.
+     */
+    configuredBackendInstanceNames() {
+        const names = new Set(Object.keys(this.fleetConfig?.instances ?? {}));
+        for (const channel of this.classicChannels?.getAll() ?? [])
+            names.add(channel.instanceName);
+        return [...names];
+    }
     /**
      * One fleet-level notice per burst, not one per instance: a post-update herd
      * fails many instances within the same second. Two notices per incident at
@@ -1749,16 +1824,60 @@ export class FleetManager {
         if (!generalName)
             return null;
         const adapter = this.getAdapterForInstance(generalName);
+        const adapterId = this.getInstanceAdapterId(generalName);
         const chatId = this.getGroupIdForInstance(generalName);
         if (!adapter || !chatId)
             return null;
         const topicId = this.fleetConfig?.instances[generalName]?.topic_id;
         return {
             adapter,
+            resolveAdapter: adapterId ? () => this.readyProgressAdapter(adapterId) : undefined,
             chatId,
             threadId: topicId != null ? String(topicId) : undefined,
         };
     }
+    /** Resolve only an adapter generation that can accept progress delivery.
+     * Discord exposes direct gateway readiness; adapters without a health
+     * snapshot use the fleet startup/retry state. */
+    readyProgressAdapter(adapterId) {
+        const adapter = this.adapters.get(adapterId);
+        if (!adapter)
+            return undefined;
+        const health = adapter.getHealthSnapshot?.();
+        if (health)
+            return health.isReady ? adapter : undefined;
+        return this.adapterState.get(adapterId)?.status === "connected" ? adapter : undefined;
+    }
+    /** Last-resort completion after RestartProgress could not deliver to its
+     * adopted target. It stays bounded and never wakes a not-ready gateway. */
+    async sendFleetStartCompletionFallback(chatId, text, threadId) {
+        const adapterId = this.getPrimaryAdapterId();
+        const adapter = adapterId ? this.readyProgressAdapter(adapterId) : undefined;
+        if (!adapter) {
+            this.logger.error({ adapterId }, "Fleet start completion fallback skipped because the primary adapter is not ready");
+            return false;
+        }
+        let timer;
+        const timeout = new Promise(resolve => {
+            timer = setTimeout(() => resolve({ status: "timeout" }), RESTART_PROGRESS_TERMINAL_TIMEOUT_MS);
+            timer.unref?.();
+        });
+        const delivery = Promise.resolve()
+            .then(() => adapter.sendText(chatId, text, { threadId }))
+            .then(() => ({ status: "sent" }), err => ({ status: "failed", err }));
+        const result = await Promise.race([delivery, timeout]);
+        if (timer)
+            clearTimeout(timer);
+        if (result.status === "sent")
+            return true;
+        if (result.status === "failed") {
+            this.logger.error({ err: result.err }, "Failed to send fleet start completion fallback");
+        }
+        else {
+            this.logger.error({ timeout_ms: RESTART_PROGRESS_TERMINAL_TIMEOUT_MS }, "Timed out sending fleet start completion fallback");
+        }
+        return false;
+    }
     async stopInstance(name) {
         this.explicitStopGeneration.set(name, (this.explicitStopGeneration.get(name) ?? 0) + 1);
         this.cancelStartupRetry(name);
@@ -1904,6 +2023,130 @@ export class FleetManager {
         this.updateCompletionTipText = null;
         this.startUpdateProgressMonitor(adapter);
     }
+    /** Persist the public response, wait for idle, then start the canonical service restart. */
+    async requestFullRestart(adapter, chatId, threadId, messageId) {
+        const target = {
+            adapterId: adapter.id,
+            chatId,
+            ...(threadId ? { threadId } : {}),
+            messageId,
+        };
+        // This check is synchronous with the marker write below. A second command
+        // cannot slip through between them on Node's event loop and replace the
+        // first command's delivery target or launch a competing restart helper.
+        if (this.shuttingDown || isUpdateInProgress(this.dataDir)) {
+            this.logger.warn({ adapterId: adapter.id }, "Full restart refused because another planned restart is active");
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_busy"));
+            return false;
+        }
+        if (!persistFullRestartProgress(this.dataDir, target)) {
+            this.logger.error({ adapterId: adapter.id }, "Full restart marker could not be persisted — reload refused");
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_launch_failed"));
+            return false;
+        }
+        const ownedMarker = readUpdateProgress(this.dataDir);
+        if (!ownedMarker) {
+            this.logger.error({ adapterId: adapter.id }, "Full restart marker disappeared after persistence — reload refused");
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_launch_failed"));
+            return false;
+        }
+        this.lastUpdateProgressText = null;
+        this.updateCompletionTipText = null;
+        this.startUpdateProgressMonitor(adapter);
+        await this.waitForFullRestartIdleGrace();
+        // An update can begin while the idle wait yields. Never launch a second
+        // process replacement against a marker we no longer own.
+        if (this.shuttingDown || !this.isOwnedFullRestartMarker(ownedMarker.startedAt, target)) {
+            this.logger.warn({ adapterId: adapter.id }, "Full restart superseded during idle wait — reload refused");
+            if (this.isOwnedFullRestartMarker(ownedMarker.startedAt, target))
+                clearUpdateMarker(this.dataDir);
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_busy"));
+            return false;
+        }
+        let helper;
+        try {
+            helper = await this.fullRestartLauncher();
+        }
+        catch (err) {
+            this.logger.error({ err }, "Full restart helper failed to spawn — reload refused");
+            if (this.isOwnedFullRestartMarker(ownedMarker.startedAt, target))
+                clearUpdateMarker(this.dataDir);
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_launch_failed"));
+            return false;
+        }
+        void helper.completion.then(result => {
+            // A zero exit means the service manager accepted the restart. launchd
+            // may report that before its SIGTERM reaches us, so only an explicit
+            // helper error/non-zero exit is evidence of failure. A signal is also
+            // ambiguous under systemd because this helper shares the old cgroup.
+            if (this.shuttingDown || !this.isOwnedFullRestartMarker(ownedMarker.startedAt, target))
+                return;
+            if (!result.error && (result.code === 0 || result.code === null))
+                return;
+            const detail = result.error
+                ? "reload helper failed after launch"
+                : `reload helper exited before process hand-off (code ${result.code ?? "null"}, signal ${result.signal ?? "none"})`;
+            this.logger.error({ result }, "Full restart helper exited before the fleet began shutting down");
+            setUpdateProgressStage(this.dataDir, "failed", { error: detail });
+        });
+        return true;
+    }
+    isOwnedFullRestartMarker(startedAt, target) {
+        const marker = readUpdateProgress(this.dataDir);
+        if (!marker || marker.startedAt !== startedAt || marker.pid !== process.pid)
+            return false;
+        if (updateProgressOperation(marker.progress) !== "full-restart")
+            return false;
+        const current = marker.progress.target;
+        return current.adapterId === target.adapterId
+            && current.chatId === target.chatId
+            && current.threadId === target.threadId
+            && current.messageId === target.messageId;
+    }
+    /** Give current work the same bounded idle grace used by graceful reload. */
+    async waitForFullRestartIdleGrace() {
+        const instanceNames = [...this.daemons.keys()];
+        if (instanceNames.length === 0)
+            return;
+        const IDLE_TIMEOUT_MS = 5 * 60_000;
+        let timeoutHandle;
+        const deadline = new Promise((_, reject) => {
+            timeoutHandle = setTimeout(() => reject(new Error("Idle wait timed out after 5 minutes")), IDLE_TIMEOUT_MS);
+        });
+        try {
+            await Promise.race([
+                Promise.all(instanceNames.map(async (name) => {
+                    const daemon = this.daemons.get(name);
+                    if (!daemon)
+                        return;
+                    this.logger.info(`Full restart: waiting for ${name} to idle...`);
+                    await daemon.waitForIdle(10_000);
+                })),
+                deadline,
+            ]);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Full restart idle wait timed out — continuing with service restart");
+        }
+        finally {
+            clearTimeout(timeoutHandle);
+        }
+    }
+    async reportFullRestartFailure(adapter, chatId, threadId, messageId, text) {
+        try {
+            await adapter.editMessage(chatId, messageId, text, threadId);
+            return;
+        }
+        catch (err) {
+            this.logger.warn({ err, adapterId: adapter.id }, "Failed to edit rejected full-restart request; posting a fresh notice");
+        }
+        try {
+            await adapter.sendText(chatId, text, { threadId });
+        }
+        catch (err) {
+            this.logger.error({ err, adapterId: adapter.id }, "Failed to deliver full-restart rejection");
+        }
+    }
     failUpdateProgress(message) {
         setUpdateProgressStage(this.dataDir, "failed", { error: message });
     }
@@ -1965,6 +2208,8 @@ export class FleetManager {
     }
     /** Start all instances from fleet config */
     async startAll(configPath) {
+        this.loginWindow.reopen(); // a stopAll → startAll restart must accept login windows again
+        this.loginController?.reopen();
         const startupStartedAt = Date.now();
         FleetManager.signalTarget = this;
         this.startupComplete = false;
@@ -1984,6 +2229,9 @@ export class FleetManager {
             && savedUpdateProgress.progress.stage !== "complete"
             ? savedUpdateProgress
             : null;
+        const pendingProgressOperation = pendingUpdateProgress
+            ? updateProgressOperation(pendingUpdateProgress.progress)
+            : null;
         if (pendingUpdateProgress) {
             setUpdateProgressStage(this.dataDir, "starting", { version: pendingUpdateProgress.progress.version });
         }
@@ -2121,10 +2369,7 @@ export class FleetManager {
             ...fleet.defaults.daily_summary,
         };
         this.dailySummary = new DailySummary(summaryConfig, costGuardConfig.timezone, (text) => {
-            if (!this.adapter || !this.fleetConfig?.channel?.group_id)
-                return;
-            this.adapter.sendText(String(this.fleetConfig.channel.group_id), text)
-                .catch(e => this.logger.warn({ err: e }, "Failed to send daily summary"));
+            this.postDailySummary(text);
             // Rotate classic channel chat logs daily
             this.classicChannels?.rotateLogs();
             this.rotateInboxes();
@@ -2264,7 +2509,7 @@ export class FleetManager {
         const allEntries = Object.entries(fleet.instances);
         const generals = allEntries.filter(([_, cfg]) => cfg.general_topic);
         const others = allEntries.filter(([_, cfg]) => !cfg.general_topic);
-        const startupProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), pendingUpdateProgress?.startedAt ?? startupStartedAt, this.logger, { mode: pendingUpdateProgress ? "update" : "restart" });
+        const startupProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), pendingUpdateProgress?.startedAt ?? startupStartedAt, this.logger, { mode: pendingProgressOperation === "full-restart" ? "reload" : pendingUpdateProgress ? "update" : "restart" });
         if (generals.length > 0) {
             for (const [name, cfg] of generals) {
                 try {
@@ -2313,12 +2558,17 @@ export class FleetManager {
             progressStart = adapterStartup.then(() => {
                 if (pendingUpdateProgress) {
                     const saved = pendingUpdateProgress.progress.target;
-                    const adapter = this.adapters.get(saved.adapterId);
-                    const target = adapter ? {
-                        adapter,
+                    const target = {
+                        adapter: this.adapters.get(saved.adapterId),
+                        // Adapter retries replace the failed object in this map. Resolve at
+                        // every progress delivery so the adopted update message follows the
+                        // live, ready generation instead of remaining pinned to a stopped
+                        // client. This also waits when the first generation failed before
+                        // any adapter object was registered.
+                        resolveAdapter: () => this.readyProgressAdapter(saved.adapterId),
                         chatId: saved.chatId,
                         threadId: saved.threadId,
-                    } : null;
+                    };
                     return startupProgress.resume(target, saved.messageId);
                 }
                 return startupProgress.start(this.restartProgressTarget());
@@ -2428,16 +2678,25 @@ export class FleetManager {
                 version: agendVersion,
                 pausedNames,
                 failedNames,
-                tipText: pendingUpdateProgress && this.tipsEnabled()
+                tipText: pendingProgressOperation === "update" && this.tipsEnabled()
                     ? (() => {
                         const tip = this.pickAvailableTip();
                         return tip ? this.formatTip(tip) : undefined;
                     })()
                     : undefined,
             });
-            if (!progressCompleted && this.adapter && fleet.channel?.group_id) {
+            if (!progressCompleted && fleet.channel?.group_id) {
                 let text;
-                if (failedNames.length === 0 && pausedNames.length === 0) {
+                if (pendingProgressOperation === "full-restart") {
+                    text = formatRestartProgressCompletion("reload", {
+                        running: started,
+                        total,
+                        version: agendVersion,
+                        pausedNames,
+                        failedNames,
+                    }, pendingUpdateProgress.startedAt);
+                }
+                else if (failedNames.length === 0 && pausedNames.length === 0) {
                     text = t("fleet.ready", started, total, agendVersion);
                 }
                 else if (failedNames.length === 0) {
@@ -2447,9 +2706,7 @@ export class FleetManager {
                     text = t("fleet.ready_with_failed", started, total, agendVersion, failedNames.join(", "))
                         + (pausedNames.length > 0 ? `\n⏸ Paused: ${pausedNames.join(", ")}` : "");
                 }
-                this.adapter.sendText(String(fleet.channel.group_id), text, {
-                    threadId: generalThreadId != null ? String(generalThreadId) : undefined,
-                }).catch(e => this.logger.warn({ err: e }, "Failed to send fleet start notification"));
+                await this.sendFleetStartCompletionFallback(String(fleet.channel.group_id), text, generalThreadId != null ? String(generalThreadId) : undefined);
             }
         }
         // Health HTTP endpoint
@@ -2735,6 +2992,8 @@ export class FleetManager {
                 return;
             if (await this.handleLoginConfirm(data, adapterId, this.adapter ?? undefined))
                 return;
+            if (await this.handleLoginTokenResend(data, adapterId, this.adapter ?? undefined))
+                return;
             if (await this.handleInstallLoginConfirm(data, adapterId, this.adapter ?? undefined))
                 return;
             if (await this.handleClearConfirmation(data, adapterId, this.adapter ?? undefined))
@@ -2983,13 +3242,7 @@ export class FleetManager {
                 await data.respond(this.topicCommands.getDashboardText());
             }
             else if (data.command === "restart") {
-                const allowed = this.fleetConfig?.channel?.access?.allowed_users ?? [];
-                if (allowed.length > 0 && !allowed.some(u => String(u) === String(data.userId))) {
-                    await data.respond(t("not_authorized"));
-                    return;
-                }
-                await data.respond(t("restart.graceful"));
-                process.kill(process.pid, "SIGUSR2");
+                await this.handleRestartSlash(data, adapterId);
             }
             else if (data.command === "compact") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
@@ -3135,6 +3388,8 @@ export class FleetManager {
                 return;
             if (await this.handleLoginConfirm(data, adapterId, adapter))
                 return;
+            if (await this.handleLoginTokenResend(data, adapterId, adapter))
+                return;
             if (await this.handleInstallLoginConfirm(data, adapterId, adapter))
                 return;
             if (await this.handleClearConfirmation(data, adapterId, adapter))
@@ -3330,13 +3585,7 @@ export class FleetManager {
                 await data.respond(this.topicCommands.getDashboardText());
             }
             else if (data.command === "restart") {
-                const allowed = this.fleetConfig?.channel?.access?.allowed_users ?? [];
-                if (allowed.length > 0 && !allowed.some(u => String(u) === String(data.userId))) {
-                    await data.respond(t("not_authorized"));
-                    return;
-                }
-                await data.respond(t("restart.graceful"));
-                process.kill(process.pid, "SIGUSR2");
+                await this.handleRestartSlash(data, adapterId);
             }
             else if (data.command === "compact") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
@@ -4668,19 +4917,69 @@ export class FleetManager {
         this.scheduler.recordRun(id, "instance_offline", `retry ${retryCount}x failed`);
         this.notifyScheduleFailure(schedule);
     }
+    /**
+     * The adapter that can actually post into a chat, found by its group.
+     *
+     * A schedule records where it was created (reply_chat_id) separately from
+     * what it triggers (target). Those need not share a platform: a Telegram
+     * group can schedule a Discord-topic instance. Picking the adapter from the
+     * target then sends a Telegram chat id through the Discord bot, which fails
+     * with Unknown Channel — the source topic never hears that its schedule ran.
+     *
+     * When several bots share one guild, the primary wins: a persona should not
+     * be the voice announcing fleet scheduling.
+     */
+    adapterForChat(chatId) {
+        const id = String(chatId);
+        const matches = [...this.worlds.values()].filter(world => String(world.groupId) === id);
+        if (matches.length === 0)
+            return undefined;
+        const primaryId = this.getPrimaryAdapterId();
+        return (matches.find(world => world.id === primaryId) ?? matches[0]).adapter;
+    }
+    /**
+     * The adapter that can answer a schedule in the chat it was created from.
+     *
+     * A schedule records its creator (source) and its trigger (target) separately,
+     * and they need not share a platform — the live fleet has a Telegram group
+     * scheduling a Discord-topic instance. Routing by target sends a Telegram chat
+     * id through the Discord bot, which is one half of the Unknown Channel errors.
+     *
+     * The creator's own adapter comes first, and only when its world actually owns
+     * that chat. Classic keeps its own identity, so a schedule made from a
+     * persona-bound Classic channel is answered by that persona: the primary bot
+     * may not even have access there, and would be the wrong voice if it did.
+     * Falling back to the target's adapter is deliberately NOT an option — that is
+     * the misroute itself; callers say why they stayed silent instead.
+     */
+    scheduleSourceAdapter(schedule) {
+        const chatId = String(schedule.reply_chat_id);
+        const sourceAdapterId = schedule.source ? this.getInstanceAdapterId(schedule.source) : undefined;
+        const sourceWorld = sourceAdapterId ? this.worlds.get(sourceAdapterId) : undefined;
+        if (sourceWorld && String(sourceWorld.groupId) === chatId)
+            return sourceWorld.adapter;
+        return this.adapterForChat(chatId);
+    }
     notifySourceTopic(schedule) {
-        const adapter = this.getAdapterForInstance(schedule.target) ?? this.adapter;
-        if (!adapter)
+        const adapter = this.scheduleSourceAdapter(schedule);
+        if (!adapter) {
+            this.logger.warn({ scheduleId: schedule.id, chatId: schedule.reply_chat_id, source: schedule.source }, "No adapter can reach the schedule's source chat — trigger notice not sent");
             return;
+        }
         const text = `⏰ Schedule "${schedule.label ?? schedule.id}" triggered, target: ${schedule.target}`;
         adapter.sendText(schedule.reply_chat_id, text, {
             threadId: schedule.reply_thread_id ?? undefined,
         }).catch((err) => this.logger.error({ err }, "Failed to send cross-instance notification"));
     }
     notifyScheduleFailure(schedule) {
-        const adapter = this.getAdapterForInstance(schedule.target) ?? this.adapter;
-        if (!adapter)
+        // Same resolver as the success path: a failure notice was still being sent
+        // through the target's adapter, so a Telegram-created schedule for a
+        // Discord target announced its failure into the wrong platform.
+        const adapter = this.scheduleSourceAdapter(schedule);
+        if (!adapter) {
+            this.logger.warn({ scheduleId: schedule.id, chatId: schedule.reply_chat_id, source: schedule.source }, "No adapter can reach the schedule's source chat — failure notice not sent");
             return;
+        }
         const text = `⏰ Schedule "${schedule.label ?? schedule.id}" trigger failed: instance ${schedule.target} is offline.`;
         adapter.sendText(schedule.reply_chat_id, text, {
             threadId: schedule.reply_thread_id ?? undefined,
@@ -5526,6 +5825,65 @@ export class FleetManager {
         this.logger.error({ ids: bad }, "classicBot.yaml holds ids that can never match");
         this.notifyFleetError(t("classic.unrecoverable_ids", list));
     }
+    /**
+     * Where a fleet-wide notice can actually be posted, or null if nowhere.
+     *
+     * On Telegram a group id is itself a chat, so posting straight to it is
+     * right. On Discord it is a *guild* id, and sending there makes the adapter
+     * fetch a channel that does not exist — DiscordAPIError 10003 Unknown
+     * Channel. That is why the daily summary never arrived on a Discord fleet:
+     * it had been posting to the guild every night and only the catch handler
+     * ever saw it.
+     *
+     * Discord therefore needs a real channel: the General topic (resolved from
+     * config rather than findGeneralInstance, so a fleet-level fault can still be
+     * reported while the General daemon is down), else the adapter's configured
+     * general_channel_id. With neither, there is no safe target and the caller
+     * should say so rather than send into a guaranteed failure.
+     */
+    fleetNoticeTarget(adapterId) {
+        const cfg = this.getChannelConfig(adapterId);
+        const groupId = cfg?.group_id;
+        if (groupId == null)
+            return null;
+        const chatId = String(groupId);
+        // The General must belong to the SAME adapter as the group above. Taking
+        // whichever General comes first in the instance map produced a mixed target
+        // on a dual-platform fleet — a Telegram group id carrying a Discord channel
+        // as its thread — and made the result depend on map insertion order.
+        // Resolved from config, not from a live daemon, so a fleet-level fault is
+        // still reportable while the General itself is down.
+        const ownerId = cfg?.id ?? cfg?.type;
+        const generalTopic = Object.entries(this.fleetConfig?.instances ?? {})
+            .find(([name, instance]) => instance.general_topic === true
+            && this.getInstanceAdapterId(name) === ownerId)?.[1]?.topic_id;
+        if (generalTopic != null)
+            return { chatId, opts: { threadId: String(generalTopic) } };
+        if (cfg?.type === "discord") {
+            const configured = cfg.options?.general_channel_id;
+            if (configured != null && String(configured)) {
+                return { chatId, opts: { threadId: String(configured) } };
+            }
+            return null; // a guild id is not a channel; sending would always fail
+        }
+        return { chatId, opts: {} };
+    }
+    /**
+     * Post the daily summary where fleet-wide notices go.
+     *
+     * A named method rather than an inline closure so a test can drive the real
+     * thing: asserting on fleetNoticeTarget alone leaves the call site free to go
+     * back to posting at the bare group id, which is the defect this replaced.
+     */
+    postDailySummary(text) {
+        const target = this.fleetNoticeTarget();
+        if (!this.adapter || !target) {
+            this.logger.warn("Daily summary has no postable target — set a General topic or channel.options.general_channel_id");
+            return;
+        }
+        this.adapter.sendText(target.chatId, text, target.opts)
+            .catch(e => this.logger.warn({ err: e }, "Failed to send daily summary"));
+    }
     notifyFleetError(text) {
         const now = Date.now();
         const key = text.slice(0, 200);
@@ -5552,10 +5910,12 @@ export class FleetManager {
             dispatched = this.notifyInstanceTopic(general, body);
         }
         else {
-            // No General instance — fall back to the primary channel's group.
-            const groupId = this.getChannelConfig()?.group_id;
-            if (this.adapter && groupId) {
-                this.adapter.sendText(String(groupId), body)
+            // No General instance — fall back to the primary channel's own notice
+            // target. Posting to the bare group id looked right but is a guild id on
+            // Discord, so every such fallback failed inside the catch handler.
+            const target = this.fleetNoticeTarget();
+            if (this.adapter && target) {
+                this.adapter.sendText(target.chatId, body, target.opts)
                     .catch(err => this.logger.warn({ err }, "Failed to send fleet error notification"));
                 dispatched = true;
             }
@@ -5614,13 +5974,16 @@ export class FleetManager {
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send classic notification"));
             return true;
         }
-        // Fallback: send to group without threadId
-        if (groupId) {
-            adapter.sendText(String(groupId), text, extraOpts)
+        // Fallback: the instance has neither a topic nor a classic channel, so post
+        // where fleet-wide notices go. Not the bare group id: on Discord that is a
+        // guild, and the send fails inside the catch handler.
+        const target = this.fleetNoticeTarget(this.getInstanceAdapterId(instanceName));
+        if (target) {
+            adapter.sendText(target.chatId, text, { ...target.opts, ...extraOpts })
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send notification (no topic)"));
             return true;
         }
-        this.logger.warn({ instanceName }, "No group id — instance topic notification not sent");
+        this.logger.warn({ instanceName }, "No postable target — instance topic notification not sent");
         return false;
     }
     // ── Nonce-armed button prompts (hang / assist / exit / clear) ──
@@ -6859,11 +7222,45 @@ export class FleetManager {
     // repairs every instance of that backend, and instance delivery, pane-state
     // detection, tool progress, and mcp_proxy_reply never observe login output.
     activeLogin = null;
+    /**
+     * Web-terminal login (v2.1.5 default, `login.mode: web`). The relay code
+     * below (activeLogin/LoginSession) is `login.mode: relay`, kept for one
+     * release as the rollback lever and removed in 2.1.6.
+     */
+    loginController = null;
+    /**
+     * One login/install window fleet-wide. Claimed synchronously before the
+     * first await by web login, relay login and install alike (sol B1).
+     */
+    loginWindow = new LoginWindowLock();
+    get webLogin() {
+        if (!this.loginController) {
+            this.loginController = new LoginController({
+                logger: this.logger,
+                fleetConfig: () => this.fleetConfig,
+                isFleetAdmin: (userId, adapterId) => this.isFleetAdmin(userId, adapterId),
+                eventLog: () => this.eventLog,
+                recoverBackendInstances: backend => this.recoverBackendInstances(backend),
+                claimWindow: backend => this.loginWindow.tryClaim("web", backend),
+                releaseWindow: claim => { this.loginWindow.release(claim); },
+                isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
+                windowBusyMessage: () => this.loginWindow.busyMessage(),
+                postButtons: async ({ prefix, instanceName, chat, message, choices, expiredText }) => {
+                    await this.postNonceButtonPrompt({
+                        prefix, alertType: "login", instanceName,
+                        adapter: chat.adapter, adapterId: chat.adapterId, chatId: chat.chatId, threadId: chat.threadId,
+                        message, choices, expiredText,
+                    });
+                },
+            });
+        }
+        return this.loginController;
+    }
     /** Post the backend chooser for a bare `/login`. Caller enforces admin. */
     async promptLoginBackends(chat) {
         const configured = new Set();
-        for (const [, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
-            configured.add(config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
+        for (const name of this.configuredBackendInstanceNames()) {
+            configured.add(this.backendNameOf(name));
         }
         const choices = Object.keys(LOGIN_FLOWS)
             .filter(backend => configured.size === 0 || configured.has(backend))
@@ -7034,21 +7431,40 @@ export class FleetManager {
      * posted instead (auth still valid — see the pre-check below).
      */
     async startLoginSession(backendArg, chat, opts = {}) {
+        if (this.webLogin.mode() === "web")
+            return this.webLogin.start(backendArg, chat, opts);
+        // ── legacy relay mode (login.mode: relay) — removed in 2.1.6 ──
         const backend = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
         const flow = LOGIN_FLOWS[backend];
         if (!flow)
             return t("login.unsupported", backendArg);
-        if (this.activeLogin)
-            return t("login.busy", this.activeLogin.backend);
-        // Install sessions share the window namespace — never run both at once.
-        if (this.activeInstall)
-            return t("install.busy");
+        // Declined in every mode — never a silent relay fallback (e.g. Antigravity).
+        if (flow.remoteLogin === "unsupported")
+            return t("login.remote_unsupported_agent_cli", backend, flow.command);
+        // Reserve the window before the pre-check await. The claim is owned by this
+        // region until it is transferred to launchLoginSession; any other exit
+        // (buttons only, throw, shutdown) releases it.
+        const claim = this.loginWindow.tryClaim("relay", backend);
+        if (!claim)
+            return this.loginWindow.busyMessage();
+        let transferred = false;
+        try {
+            return await this.startRelayClaimed(flow, backend, chat, opts, claim, () => { transferred = true; });
+        }
+        finally {
+            if (!transferred)
+                this.loginWindow.release(claim);
+        }
+    }
+    async startRelayClaimed(flow, backend, chat, opts, claim, markTransferred) {
         // Token-free pre-check (5s cap): re-login while auth still works is
         // usually a mistake, so it needs a confirmed click. An invalid OR
         // uncertain result (timeout, missing binary) proceeds straight to login —
         // an unreliable probe must never block the re-login the admin asked for.
         if (!opts.skipAuthCheck && flow.authCheck) {
             const status = await checkAuthStatus(flow.authCheck);
+            if (!this.loginWindow.isCurrent(claim))
+                return t("login.web_shutting_down"); // fleet shut down while we probed
             if (status === "valid") {
                 await this.postNonceButtonPrompt({
                     prefix: LOGIN_CONFIRM_CALLBACK_PREFIX,
@@ -7068,18 +7484,27 @@ export class FleetManager {
                 return null;
             }
         }
-        return this.launchLoginSession(flow, backend, chat);
+        markTransferred(); // launchLoginSession owns the claim from here
+        return this.launchLoginSession(flow, backend, chat, claim);
     }
     /** Create the login window and session (pre-check already settled). */
-    async launchLoginSession(flow, backend, chat) {
-        if (this.activeLogin)
-            return t("login.busy", this.activeLogin.backend);
-        // Install sessions share the window namespace — never run both at once.
-        if (this.activeInstall)
-            return t("install.busy");
-        const sessionName = getTmuxSession();
-        await TmuxManager.ensureSession(sessionName);
-        const tmux = new TmuxManager(sessionName, "");
+    async launchLoginSession(flow, backend, chat, claim) {
+        // Owns `claim`: released on any failure before the session is published,
+        // and by onDone afterwards. A shutdown during ensureSession stops us.
+        let tmux;
+        try {
+            const sessionName = getTmuxSession();
+            await TmuxManager.ensureSession(sessionName);
+            if (!this.loginWindow.isCurrent(claim)) {
+                this.loginWindow.release(claim);
+                return t("login.web_shutting_down");
+            }
+            tmux = new TmuxManager(sessionName, "");
+        }
+        catch (err) {
+            this.loginWindow.release(claim);
+            return t("login.failed", backend, err.message);
+        }
         const session = new LoginSession(flow, tmux, {
             onMenu: async (options) => {
                 await this.postNonceButtonPrompt({
@@ -7101,8 +7526,12 @@ export class FleetManager {
             onNeedInput: async (promptExcerpt) => {
                 await chat.adapter.sendText(chat.chatId, t("login.need_input", backend, promptExcerpt), { threadId: chat.threadId }).catch(() => { });
             },
-            onDone: async ({ ok, detail }) => {
+            onDone: async ({ ok, detail, cleanupFailed }) => {
                 this.activeLogin = null;
+                this.loginWindow.release(claim);
+                if (cleanupFailed) {
+                    await chat.adapter.sendText(chat.chatId, t("login.web_cleanup_failed", backend), { threadId: chat.threadId }).catch(() => { });
+                }
                 let text;
                 if (ok) {
                     const { woken, restarted } = await this.recoverBackendInstances(backend);
@@ -7128,12 +7557,68 @@ export class FleetManager {
         }
         catch (err) {
             this.activeLogin = null;
-            return t("login.failed", backend, err.message);
+            this.loginWindow.release(claim);
+            const text = t("login.failed", backend, err.message);
+            return err.cleanupFailed ? `${text}\n${t("login.web_cleanup_failed", backend)}` : text;
+        }
+        if (session.state === "done") {
+            // Cancelled (user or shutdown) while starting: start() joined the
+            // teardown, so nothing is left. onDone already released the claim.
+            this.activeLogin = null;
+            this.loginWindow.release(claim);
+            return this.loginWindow.isClosed ? t("login.web_shutting_down") : t("login.cancelled", backend);
+        }
+        if (!this.loginWindow.isCurrent(claim)) {
+            await session.cancel("cancelled").catch(() => { });
+            this.activeLogin = null;
+            this.loginWindow.release(claim);
+            return t("login.web_shutting_down");
         }
         return t("login.started", backend);
     }
+    /** Fleet shutdown: end any web/relay login or install window and wait for its confirmed teardown. */
+    async shutdownLoginWindows() {
+        // Close the lock FIRST: in-flight starts parked in a pre-check or
+        // ensureSession observe !isCurrent when they resume and stop; no new
+        // window can be claimed while we stop.
+        this.loginWindow.close();
+        // Completion semantics live INSIDE the sessions: each awaits its own
+        // confirmed cleanup, every tmux op on that path has a hard per-op bound
+        // (web: abort ≤10 s + kill ≤31 s; legacy: create/list/kill ≤10 s each,
+        // duplicates killed in parallel). This outer deadline is only a loud last
+        // resort so `agend stop` cannot hang forever on a wedged tmux; reaching it
+        // is an ERROR, logged and recorded, and it releases nothing re-claimable
+        // (the lock stays closed, the controller keeps its entry). The timer is
+        // cleared on success so a long-lived process never fires it spuriously.
+        const SHUTDOWN_DEADLINE_MS = 120_000;
+        const bounded = (p, what) => {
+            if (!p)
+                return Promise.resolve();
+            let timer;
+            const deadline = new Promise(r => {
+                timer = setTimeout(() => {
+                    this.logger.error({ what, deadlineMs: SHUTDOWN_DEADLINE_MS }, "login window teardown still in flight at the shutdown deadline — a dedicated tmux server may survive; check `tmux -L agend-term-* ls`");
+                    this.eventLog?.insert("login", "login_window_shutdown_deadline", { what });
+                    r();
+                }, SHUTDOWN_DEADLINE_MS);
+                timer.unref?.();
+            });
+            return Promise.race([p.then(() => undefined, () => this.logger.warn({ what }, "login window shutdown failed")), deadline])
+                .finally(() => { if (timer)
+                clearTimeout(timer); });
+        };
+        // "cancelled" is the detail both legacy onDone handlers keep quiet about —
+        // a stopping fleet must not announce "login failed — fleet shutdown".
+        await Promise.all([
+            bounded(this.loginController?.shutdown(), "web-login"),
+            bounded(this.activeLogin?.session.cancel("cancelled"), "relay-login"),
+            bounded(this.activeInstall?.session.cancel("cancelled"), "install"),
+        ]);
+    }
     /** `/login code <text>` — paste admin-supplied text into the login window. */
     async loginSubmitInput(text) {
+        if (this.loginController?.isActive())
+            return t("login.web_code_not_needed");
         if (!this.activeLogin)
             return t("login.no_session");
         const ok = await this.activeLogin.session.submitInput(text);
@@ -7141,6 +7626,8 @@ export class FleetManager {
     }
     /** `/login cancel` — abort the active session and remove its window. */
     async cancelLoginSession() {
+        if (this.loginController?.isActive())
+            return this.loginController.cancel();
         if (!this.activeLogin)
             return t("login.no_session");
         const backend = this.activeLogin.backend;
@@ -7176,9 +7663,8 @@ export class FleetManager {
     async recoverBackendInstances(backend) {
         const woken = [];
         const restarted = [];
-        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
-            const effective = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
-            if (effective !== backend)
+        for (const name of this.configuredBackendInstanceNames()) {
+            if (this.backendNameOf(name) !== backend)
                 continue;
             const status = this.getInstanceStatus(name);
             try {
@@ -7214,6 +7700,7 @@ export class FleetManager {
             adapterId: entry.adapterId,
             chatId: entry.chatId,
             threadId: entry.threadId,
+            userId: data.userId,
         });
         if (text)
             await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
@@ -7221,7 +7708,7 @@ export class FleetManager {
     }
     /** Re-login confirmation (auth pre-check said credentials still work). */
     async handleLoginConfirm(data, callbackAdapterId, receivingAdapter) {
-        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|cancel)$/, data, callbackAdapterId, receivingAdapter);
+        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|go-relogin|cancel)$/, data, callbackAdapterId, receivingAdapter);
         if (claimed === null)
             return false;
         if (claimed === "consumed")
@@ -7238,11 +7725,24 @@ export class FleetManager {
             adapterId: entry.adapterId,
             chatId: entry.chatId,
             threadId: entry.threadId,
-        }, { skipAuthCheck: true });
+            userId: data.userId,
+        }, { skipAuthCheck: true, tokenPresent: action === "go-relogin" });
         if (text)
             await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
         return true;
     }
+    /** "Resend token" button (web login): only the requester may press it; the token never enters the channel. */
+    async handleLoginTokenResend(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(LOGIN_TOKEN_RESEND_PREFIX, /^login-token:([0-9a-f]+):(resend)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry } = claimed;
+        const text = await this.webLogin.resendToken(data.userId);
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, text);
+        return true;
+    }
     /** Kiro provider button → drive the CLI's arrow-key selector. */
     async handleLoginMenuSelect(data, callbackAdapterId, receivingAdapter) {
         const claimed = this.consumeNonceCallback(LOGIN_MENU_CALLBACK_PREFIX, /^login-menu:([0-9a-f]+):(\d)$/, data, callbackAdapterId, receivingAdapter);
@@ -7272,13 +7772,25 @@ export class FleetManager {
             return t("install.unsupported", backendArg);
         if (checkBinaryInstalled(info.binary))
             return t("install.already", backend, info.binary);
-        if (this.activeInstall)
-            return t("install.busy");
-        if (this.activeLogin)
-            return t("login.busy", this.activeLogin.backend);
-        const sessionName = getTmuxSession();
-        await TmuxManager.ensureSession(sessionName);
-        const tmux = new TmuxManager(sessionName, "");
+        // Reserve the fleet-wide window before the first await (shared with web/relay
+        // login). Owned by this method until the session is published.
+        const claim = this.loginWindow.tryClaim("install", backend);
+        if (!claim)
+            return this.loginWindow.busyMessage();
+        let tmux;
+        try {
+            const sessionName = getTmuxSession();
+            await TmuxManager.ensureSession(sessionName);
+            if (!this.loginWindow.isCurrent(claim)) {
+                this.loginWindow.release(claim);
+                return t("login.web_shutting_down");
+            }
+            tmux = new TmuxManager(sessionName, "");
+        }
+        catch (err) {
+            this.loginWindow.release(claim);
+            return t("install.failed", backend, err.message);
+        }
         // A synthetic login flow: success is decided by the installer's exit code
         // (LoginSession treats a clean exit as success), never by pane text — and
         // installer output that happens to contain a URL must not be forwarded as
@@ -7293,8 +7805,12 @@ export class FleetManager {
             onMenu: () => { },
             onAuthHint: () => { },
             onNeedInput: () => { },
-            onDone: async ({ ok, detail }) => {
+            onDone: async ({ ok, detail, cleanupFailed }) => {
                 this.activeInstall = null;
+                this.loginWindow.release(claim);
+                if (cleanupFailed) {
+                    await chat.adapter.sendText(chat.chatId, t("login.web_cleanup_failed", backend), { threadId: chat.threadId }).catch(() => { });
+                }
                 if (!ok) {
                     // A cancel is user-initiated — the cancel command's own reply already
                     // said so; a second message here would be a duplicate.
@@ -7336,7 +7852,20 @@ export class FleetManager {
         }
         catch (err) {
             this.activeInstall = null;
-            return t("install.failed", backend, err.message);
+            this.loginWindow.release(claim);
+            const text = t("install.failed", backend, err.message);
+            return err.cleanupFailed ? `${text}\n${t("login.web_cleanup_failed", backend)}` : text;
+        }
+        if (session.state === "done") {
+            this.activeInstall = null;
+            this.loginWindow.release(claim);
+            return this.loginWindow.isClosed ? t("login.web_shutting_down") : t("install.cancelled", backend);
+        }
+        if (!this.loginWindow.isCurrent(claim)) {
+            await session.cancel("cancelled").catch(() => { });
+            this.activeInstall = null;
+            this.loginWindow.release(claim);
+            return t("login.web_shutting_down");
         }
         return t("install.started", backend);
     }
@@ -7377,6 +7906,7 @@ export class FleetManager {
             adapterId: entry.adapterId,
             chatId: entry.chatId,
             threadId: entry.threadId,
+            userId: data.userId,
         });
         if (text)
             await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
@@ -7388,7 +7918,7 @@ export class FleetManager {
             await data.respond(t("permission.denied"));
             return;
         }
-        const chat = { adapter, adapterId, chatId: data.channelId };
+        const chat = { adapter, adapterId, chatId: data.channelId, userId: data.userId };
         if (data.options?.cancel === true) {
             await data.respond(await this.cancelLoginSession());
             return;
@@ -8200,6 +8730,32 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         catch { /* missing / stale / corrupt */ }
         return null;
     }
+    /** True when a cached CLI env is old enough that `/model` should re-probe. */
+    cliEnvNeedsRefresh(env) {
+        return !env || typeof env.probedAt !== "number" || Date.now() - env.probedAt >= CLI_ENV_FRESH_MS;
+    }
+    /**
+     * Run a live probe under a deadline, falling back to whatever the cache holds.
+     * A model list is an aid: a vendor that stops answering must degrade to the
+     * previous list, never stall the command that asked for it.
+     */
+    async probeBackendBounded(backend) {
+        const work = this.probeBackend(backend);
+        work.catch(() => { });
+        let timer;
+        const deadline = new Promise(resolve => {
+            timer = setTimeout(() => {
+                this.logger.warn({ backend, deadlineMs: CLI_ENV_PROBE_DEADLINE_MS }, "CLI env live probe exceeded its deadline — serving the cached model list");
+                resolve(null);
+            }, CLI_ENV_PROBE_DEADLINE_MS);
+        });
+        try {
+            return await Promise.race([work, deadline]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
     /**
      * Resolve the effective model for a fleet or ClassicBot instance, plus where it
      * came from. Single source of truth for `/model` and `/ctx` — precedence:
@@ -8301,16 +8857,23 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             void this.probeBackend(b);
     }
     /** Best-effort model list for `/model`: cached CLI env first, else live probe. Never throws. */
-    async getModelOptions(instanceName, refresh = false) {
+    async getModelOptions(instanceName, refresh = false, onLiveProbe) {
         const backendName = this.backendNameForInstance(instanceName);
-        if (!refresh) {
-            const cached = this.readCliEnv(backendName);
-            if (cached && cached.models.length)
-                return cached.models;
-        }
-        // Cache miss / stale / forced refresh → probe live (also refreshes the cache).
-        const env = await this.probeBackend(backendName);
-        return env?.models ?? [];
+        const cached = this.readCliEnv(backendName);
+        if (!refresh && cached?.models.length && !this.cliEnvNeedsRefresh(cached))
+            return cached.models;
+        // About to go to the vendor: let the caller say so. A silent 1–10s pause on
+        // an interactive command reads as another hang, which is the wrong lesson to
+        // teach a user who has just been bitten by one.
+        onLiveProbe?.();
+        // Stale, missing, or a forced refresh → probe live (also refreshes the cache).
+        // A newly released model is invisible until this runs, which is why staleness
+        // triggers it rather than waiting for the 24h hard expiry or a cold start.
+        const env = await this.probeBackendBounded(backendName);
+        if (env?.models.length)
+            return env.models;
+        // Probe failed or timed out: the previous list is still the best answer.
+        return cached?.models ?? [];
     }
     /**
      * Model catalog behind the `list_models` tool.
@@ -8601,7 +9164,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             await data.respond(t("model.usage"));
             return;
         }
-        const options = await this.getModelOptions(name, isRefresh);
+        const options = await this.getModelOptions(name, isRefresh, () => {
+            void data.respond(t("model.refreshing")).catch(() => { });
+        });
         if (options.length === 0) {
             await data.respond(t("model.list_unavailable", name));
             return;
@@ -9255,6 +9820,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.watchdogTimer);
             this.watchdogTimer = null;
         }
+        // A login/install window is a dedicated tmux server with its own TTL
+        // timer and HTTP listener living in THIS process: without an explicit
+        // shutdown it would outlive us as an owner-less login CLI (sol B3).
+        await this.shutdownLoginWindows();
         // Cancel adapter retry timers
         for (const state of this.adapterState.values()) {
             if (state.retryTimer) {
@@ -9431,10 +10000,27 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return;
         }
         this.logger.info(`Full restart: waiting for ${instanceNames.length} instances to idle...`);
-        const groupId = this.fleetConfig?.channel?.group_id;
-        if (groupId && this.adapter) {
-            await this.adapter.sendText(String(groupId), t("restart.full_initiated"))
-                .catch(e => this.logger.warn({ err: e }, "Failed to post full restart notification"));
+        const trackedProgress = readUpdateProgress(this.dataDir);
+        const trackedFullRestart = trackedProgress
+            && updateProgressOperation(trackedProgress.progress) === "full-restart"
+            && trackedProgress.progress.stage !== "failed"
+            && trackedProgress.progress.stage !== "complete";
+        if (trackedFullRestart) {
+            // `/restart full` already posted and persisted one public progress message.
+            // Keep that single message; the new process will adopt and finish it.
+            setUpdateProgressStage(this.dataDir, "stopping");
+        }
+        const restartTarget = this.fleetNoticeTarget();
+        if (!trackedFullRestart && this.adapter) {
+            if (restartTarget) {
+                await this.adapter.sendText(restartTarget.chatId, t("restart.full_initiated"), restartTarget.opts)
+                    .catch(e => this.logger.warn({ err: e }, "Failed to post full restart notification"));
+            }
+            else {
+                // Say why nothing was posted. A restart that announces itself nowhere,
+                // for a reason nobody logged, is the harder version of this bug.
+                this.logger.warn("Full restart notice has no postable target — set a General topic or channel.options.general_channel_id");
+            }
         }
         // Wait for idle with 5-minute timeout
         const IDLE_TIMEOUT_MS = 5 * 60 * 1000;
@@ -9608,6 +10194,13 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.error("Cannot restart: no config path (was startAll called?)");
             return;
         }
+        // A graceful restart keeps this manager process, so the startup probe does
+        // not run again. Without this, `agend restart` left the cached CLI env
+        // untouched and `/model` kept serving an old list until a cold start —
+        // exactly the "only stop+start works" report. Background, never blocking:
+        // /model re-probes on staleness anyway, this just makes a restart do the
+        // refreshing a user expects of it.
+        this.probeCliEnvs();
         const instanceNames = [...this.daemons.keys()];
         if (instanceNames.length === 0) {
             this.logger.info("No instances to restart");