@songsid/agend 2.1.6-beta.8 → 2.1.6

package/dist/fleet-manager.js

@@ -44,7 +44,7 @@ import { StatuslineWatcher } from "./statusline-watcher.js";
 import { outboundHandlers } from "./outbound-handlers.js";
 import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
 import { handleViewRequest, isViewPath } from "./view-api.js";
-import { formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
+import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
 import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS, announcePostLoginRecovery } from "./login-controller.js";
@@ -52,7 +52,7 @@ import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, getLocale, t } from "./locale.js";
-import { handleAgentRequest } from "./agent-endpoint.js";
+import { handleAgentRequest, ToolNotPermittedError } from "./agent-endpoint.js";
 import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { validateFleetConfig } from "./config-validator.js";
@@ -63,7 +63,7 @@ import { isSetupComplete, markSetupComplete } from "./setup-marker.js";
 import { manualCleanupMessage, reapStaleTunnel } from "./tunnel/lease.js";
 import { buildToolPermissionsNotice } from "./tool-permissions-notice.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
-import { mayUseTool, resolveToolSet, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
+import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
 import { decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
 import { fleetLevelDifferences, fleetLevelSignature } from "./fleet-level-config.js";
 import { checkSelfRestartAllowance, recordSelfRestartAttempt } from "./self-restart-limit.js";
@@ -488,6 +488,8 @@ export class FleetManager {
     eventLogPruneTimer = null;
     logRotateTimer = null;
     discordPresenceTimer = null;
+    discordPresenceEagerTimer = null;
+    discordPresenceEagerPending = false;
     discordPresenceInFlight = null;
     static DISCORD_PRESENCE_REFRESH_MS = 15 * 60_000;
     /** Days of event/activity history to keep. */
@@ -1251,6 +1253,19 @@ export class FleetManager {
         }
         return providers;
     }
+    /** Subscription providers used by the running/paused instances owned by one adapter. */
+    getUsageProviderIdsForAdapter(adapterId) {
+        const providers = new Set();
+        for (const [name, backend, profile] of this.activeBackendBindings()) {
+            if (this.getInstanceAdapterId(name) !== adapterId)
+                continue;
+            const provider = usageProviderIdForBackend(backend);
+            if (!provider)
+                continue;
+            providers.add(profile ? `${provider}:${profile}` : provider);
+        }
+        return providers;
+    }
     /** `[instance, effective backend, credential profile]` for everything that is
      * running or paused — the one place both usage views agree on who is live. */
     activeBackendBindings() {
@@ -1826,6 +1841,7 @@ export class FleetManager {
         catch { /* consumed or absent */ }
         // Auto-connect IPC — daemon.start() ensures socket is ready before resolving
         await this.connectIpcToInstance(name);
+        this.requestDiscordUsagePresenceRefresh();
     }
     /** Recreate a daemon for a marker-only paused instance after an explicit wake/delivery. */
     async startPersistedPausedInstance(name) {
@@ -3045,12 +3061,37 @@ export class FleetManager {
     startDiscordUsagePresence() {
         if (this.discordPresenceTimer)
             clearInterval(this.discordPresenceTimer);
+        if (this.discordPresenceEagerTimer) {
+            clearTimeout(this.discordPresenceEagerTimer);
+            this.discordPresenceEagerTimer = null;
+        }
+        this.discordPresenceEagerPending = false;
         void this.refreshDiscordUsagePresence();
         this.discordPresenceTimer = setInterval(() => {
             void this.refreshDiscordUsagePresence();
         }, FleetManager.DISCORD_PRESENCE_REFRESH_MS);
         this.discordPresenceTimer.unref?.();
     }
+    /**
+     * Request one prompt presence refresh after an instance/adapter comes online.
+     * Startup can bring several instances up together; a short coalescing window
+     * keeps that herd on the existing shared refresh path and one usage fetch.
+     */
+    requestDiscordUsagePresenceRefresh() {
+        this.discordPresenceEagerPending = true;
+        // During early fleet startup the interval is not installed yet; its first
+        // refresh in startDiscordUsagePresence already covers all pending starts.
+        if (!this.discordPresenceTimer || this.discordPresenceEagerTimer)
+            return;
+        this.discordPresenceEagerTimer = setTimeout(() => {
+            this.discordPresenceEagerTimer = null;
+            if (!this.discordPresenceEagerPending || !this.discordPresenceTimer)
+                return;
+            this.discordPresenceEagerPending = false;
+            void this.refreshDiscordUsagePresence();
+        }, 50);
+        this.discordPresenceEagerTimer.unref?.();
+    }
     refreshDiscordUsagePresence() {
         if (this.discordPresenceInFlight)
             return this.discordPresenceInFlight;
@@ -3060,11 +3101,15 @@ export class FleetManager {
             if (targets.length === 0)
                 return;
             try {
-                const payload = await getUsageSnapshot(false, this.getActiveUsageProviderIds());
-                const text = formatDiscordUsageActivity(payload);
+                // Fetch the shared snapshot once, then scope the projection to each
+                // adapter's own fleet/Classic instances.  Passing the fleet-wide active
+                // set here would make every bot advertise providers owned by a sibling
+                // bot (notably ClassicBot's Grok/Antigravity rows).
+                const payload = await getUsageSnapshot(false);
                 for (const adapter of targets) {
                     try {
-                        adapter.setActivity?.(text);
+                        const scoped = filterUsageProviders(payload, this.getUsageProviderIdsForAdapter(adapter.id));
+                        adapter.setActivity?.(formatDiscordUsageActivity(scoped));
                     }
                     catch {
                         // Presence is cosmetic; a failed update must not affect delivery.
@@ -3077,11 +3122,12 @@ export class FleetManager {
                 this.logger.debug("Discord usage presence refresh skipped");
             }
         })();
-        this.discordPresenceInFlight = run.finally(() => {
-            if (this.discordPresenceInFlight === run)
+        const done = run.finally(() => {
+            if (this.discordPresenceInFlight === done)
                 this.discordPresenceInFlight = null;
         });
-        return this.discordPresenceInFlight;
+        this.discordPresenceInFlight = done;
+        return done;
     }
     /**
      * Delete inbox files older than retentionDays (by mtime). Cleans the shared
@@ -3688,7 +3734,7 @@ export class FleetManager {
             this.adapter.setChatId(String(fleet.channel.group_id));
         }
         if (this.discordPresenceTimer && this.adapter.type === "discord") {
-            void this.refreshDiscordUsagePresence();
+            this.requestDiscordUsagePresenceRefresh();
         }
         this.startTopicCleanupPoller();
         // Prune stale external sessions every 5 minutes
@@ -4033,7 +4079,7 @@ export class FleetManager {
             adapter.setChatId(String(channelConfig.group_id));
         }
         if (this.discordPresenceTimer && adapter.type === "discord") {
-            void this.refreshDiscordUsagePresence();
+            this.requestDiscordUsagePresenceRefresh();
         }
         this.logger.info({ adapterId, type: channelConfig.type }, "Additional adapter started");
     }
@@ -4278,7 +4324,7 @@ export class FleetManager {
                     await adapter.reconnectGateway(previous?.lastError ?? "fleet adapter restart");
                     this.adapterState.set(id, { status: "connected", retryCount: 0 });
                     if (this.discordPresenceTimer && adapter.type === "discord") {
-                        void this.refreshDiscordUsagePresence();
+                        this.requestDiscordUsagePresenceRefresh();
                     }
                     this.logger.info({ id }, "Adapter gateway rebuilt successfully");
                 }
@@ -4306,7 +4352,7 @@ export class FleetManager {
                     this.logger.info({ id, attempt }, "Adapter restarted successfully");
                     this.adapterState.set(id, { status: "connected", retryCount: 0 });
                     if (this.discordPresenceTimer && adapter.type === "discord") {
-                        void this.refreshDiscordUsagePresence();
+                        this.requestDiscordUsagePresenceRefresh();
                     }
                     return;
                 }
@@ -5532,36 +5578,18 @@ export class FleetManager {
             return;
         }
         try {
-            let result;
-            switch (msg.type) {
-                case "fleet_schedule_create": {
-                    const params = {
-                        cron: payload.cron,
-                        at: payload.at,
-                        message: payload.message,
-                        source: instanceName,
-                        target: payload.target || instanceName,
-                        reply_chat_id: meta.chat_id,
-                        reply_thread_id: meta.thread_id || null,
-                        reply_adapter_id: meta.adapter_id || null,
-                        label: payload.label,
-                        timezone: payload.timezone,
-                        silent: !!(payload.silent),
-                    };
-                    result = this.scheduler.create(params);
-                    break;
-                }
-                case "fleet_schedule_list":
-                    result = this.scheduler.list(payload.target);
-                    break;
-                case "fleet_schedule_update":
-                    result = this.scheduler.update(payload.id, payload);
-                    break;
-                case "fleet_schedule_delete":
-                    this.scheduler.delete(payload.id);
-                    result = "ok";
-                    break;
-            }
+            const op = String(msg.type).replace("fleet_schedule_", "");
+            const result = this.performScheduleOp(instanceName, op, payload, {
+                // The daemon sends its last chat id, which is unset until the instance
+                // has had a chat message — and cross-instance traffic never sets it. So
+                // a worker that only takes delegated tasks, the very instance #895 lets
+                // self-schedule, hit "NOT NULL constraint failed: schedules.reply_chat_id".
+                // No chat means no reply chat, exactly as on the agent endpoint.
+                chatId: meta.chat_id ?? "",
+                threadId: meta.thread_id || null,
+                adapterId: meta.adapter_id || null,
+                silent: !!(payload.silent),
+            });
             ipc.send({ type: "fleet_schedule_response", fleetRequestId, result });
         }
         catch (err) {
@@ -5697,23 +5725,76 @@ export class FleetManager {
     async handleScheduleCrudHttp(instance, op, args) {
         if (!this.scheduler)
             return { error: "Scheduler not available" };
+        if (op !== "create" && op !== "list" && op !== "update" && op !== "delete") {
+            return { error: `Unknown schedule op: ${op}` };
+        }
+        // No bound chat on this path, as before: a schedule made through the agent
+        // endpoint has nowhere of its own to reply.
+        return this.performScheduleOp(instance, op, args, { chatId: "", threadId: null });
+    }
+    /**
+     * The only place an agent's request creates, changes or removes a schedule
+     * (#895). The IPC handler (MCP calls, direct channel.sock writes) and the
+     * agent endpoint (agent-cli, HTTP agent mode) are adapters over this, so the
+     * target check cannot be present on one face and missing on the other — the
+     * shape #804 had to close twice.
+     *
+     * `caller` is the instance the server resolved for the request; any
+     * `source` in `args` is ignored, and a schedule's source is always its caller.
+     * A refusal is a ToolNotPermittedError: 403 on the agent endpoint, the error
+     * of the schedule response on IPC.
+     */
+    performScheduleOp(caller, op, args, reply) {
+        const scheduler = this.scheduler;
+        // Shape first, so the value the permission decision reads is the value the
+        // scheduler gets. `target` used to be filtered through typeof for the
+        // decision and passed raw to the scheduler, whose `target.startsWith`
+        // then threw a TypeError for `target: 123` (#897). A non-string is refused
+        // — never coerced: turning 123 into "123" would decide an identity
+        // question on a value the caller did not send. `null` means absent, as
+        // omitting it always did, and is removed before the scheduler sees it.
+        if (args.target === null) {
+            args = { ...args };
+            delete args.target;
+        }
+        if (args.target !== undefined && typeof args.target !== "string") {
+            throw new Error(`${op}_schedule: "target" must be an instance name (a string), not ${typeof args.target}.`);
+        }
+        if ((op === "update" || op === "delete") && typeof args.id !== "string") {
+            throw new Error(`${op}_schedule: "id" must be a schedule id (a string) — get one from list_schedules.`);
+        }
+        const requestedTarget = args.target;
+        if (op !== "list") {
+            const profile = resolveToolSet(this.fleetConfig?.instances[caller], caller);
+            const existing = op === "create" ? null : scheduler.get(args.id);
+            const refusal = scheduleOpRefusal(profile, caller, op, { requestedTarget, existing });
+            if (refusal) {
+                this.logger.warn({ instance: caller, profile, op, target: requestedTarget ?? existing?.target, scheduleId: args.id }, "tool-permissions: schedule op refused");
+                throw new ToolNotPermittedError(refusal);
+            }
+        }
         switch (op) {
             case "create":
-                return this.scheduler.create({
+                return scheduler.create({
                     cron: args.cron,
                     at: args.at,
                     message: args.message,
-                    source: instance, target: args.target || instance,
-                    reply_chat_id: "", reply_thread_id: null,
+                    source: caller,
+                    target: requestedTarget || caller,
+                    reply_chat_id: reply.chatId,
+                    reply_thread_id: reply.threadId,
+                    ...(reply.adapterId !== undefined ? { reply_adapter_id: reply.adapterId } : {}),
                     label: args.label,
                     timezone: args.timezone,
+                    ...(reply.silent !== undefined ? { silent: reply.silent } : {}),
                 });
-            case "list": return this.scheduler.list(args.target);
-            case "update": return this.scheduler.update(args.id, args);
+            case "list":
+                return scheduler.list(requestedTarget);
+            case "update":
+                return scheduler.update(args.id, args);
             case "delete":
-                this.scheduler.delete(args.id);
+                scheduler.delete(args.id);
                 return "ok";
-            default: return { error: `Unknown schedule op: ${op}` };
         }
     }
     async handleDecisionCrudHttp(instance, op, args) {
@@ -6378,6 +6459,9 @@ export class FleetManager {
                 }
             }
         }
+        // Capture instance dir BEFORE lifecycle.remove, which deletes the instance
+        // from fleetConfig. (The backend would be unresolvable afterwards.)
+        const instanceDirToClean = this.getInstanceDir(name);
         await this.lifecycle.remove(name, authorization);
         // Clean up per-instance tracking maps so they don't grow unbounded
         // as instances are created and deleted over the lifetime of the fleet.
@@ -6386,12 +6470,29 @@ export class FleetManager {
         this.rateLimitWarnedAt.delete(name);
         // Clean up statusline watcher + instance directory
         this.statuslineWatcher.unwatch(name);
+        // instanceDirToClean and effectiveBackend are captured before lifecycle.remove
+        // (which deletes the instance from fleetConfig).
         try {
-            rmSync(this.getInstanceDir(name), { recursive: true, force: true });
+            rmSync(instanceDirToClean, { recursive: true, force: true });
         }
         catch (err) {
             this.logger.debug({ err, name }, "Instance dir cleanup failed");
         }
+        // Remove the codex short home (~/.agend/cx/<hash>/) unconditionally.
+        // (#953). CodexBackend.shortHomeFor is a pure path computation; the existsSync
+        // guard makes this a no-op for instances that never used a short home (non-codex,
+        // or codex instances on a short-enough path). Unconditional also covers instances
+        // whose backend was switched away from codex before deletion — they still have a
+        // short home that would otherwise be inherited by a later same-name instance.
+        try {
+            const { CodexBackend } = await import("./backend/codex.js");
+            const shortHome = CodexBackend.shortHomeFor(instanceDirToClean);
+            if (existsSync(shortHome))
+                rmSync(shortHome, { recursive: true, force: true });
+        }
+        catch (err) {
+            this.logger.debug({ err, name }, "Codex short home cleanup failed");
+        }
     }
     startStatuslineWatcher(name) {
         if (this.lifecycle.isPaused(name))
@@ -9726,8 +9827,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * A model list is an aid: a vendor that stops answering must degrade to the
      * previous list, never stall the command that asked for it.
      */
-    async probeBackendBounded(backend) {
-        const work = this.probeBackend(backend);
+    async probeBackendBounded(backend, opts = {}) {
+        const work = this.probeBackend(backend, opts);
         work.catch(() => { });
         let timer;
         const deadline = new Promise(resolve => {
@@ -9791,12 +9892,23 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const label = option.description ? `${option.label} — ${option.description}` : option.label;
         return option.id === currentModel ? `✓ ${label}` : label;
     }
-    /** Probe one backend's CLI env and cache it. Best-effort; never throws. */
-    async probeBackend(backend) {
+    /**
+     * Probe one backend's CLI env and cache it. Best-effort; never throws.
+     *
+     * `refreshVendorCatalog` is the "🔄 Refresh models" path only (#886): first
+     * ask the CLI to refetch its own catalog, for backends whose probe merely
+     * reads a file the CLI maintains. Every other caller leaves it off, so the
+     * startup and /model probes behave exactly as before. A failed vendor
+     * refresh fails the probe (null), which the menu reports instead of passing
+     * the old list off as fresh.
+     */
+    async probeBackend(backend, opts = {}) {
         try {
             const be = createBackend(backend, join(getAgendHome(), "cli-env"));
             if (!be.probeCLIEnv)
                 return null;
+            if (opts.refreshVendorCatalog && be.refreshModelCatalog)
+                await be.refreshModelCatalog();
             const probed = await be.probeCLIEnv({ workingDirectory: "", instanceDir: join(getAgendHome(), "cli-env"), instanceName: `probe-${backend}`, mcpServers: {} });
             const env = { backend, probedAt: Date.now(), ...probed };
             // An empty result must never overwrite a catalog we already have. Some
@@ -9845,22 +9957,48 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     /** Best-effort model list for `/model`: cached CLI env first, else live probe. Never throws. */
     async getModelOptions(instanceName, refresh = false, onLiveProbe) {
+        return (await this.getModelOptionsWithSource(instanceName, { refresh, onLiveProbe })).models;
+    }
+    /**
+     * The model list plus where it came from. `source` is "live" only when a probe
+     * actually ran and answered; a refresh that failed or ran out of time reports
+     * "cache" with the previous list, so a menu can say "could not refresh"
+     * instead of presenting an old list as a fresh one.
+     */
+    async getModelOptionsWithSource(instanceName, opts = {}) {
         const backendName = this.backendNameForInstance(instanceName);
         const cached = this.readCliEnv(backendName);
-        if (!refresh && cached?.models.length && !this.cliEnvNeedsRefresh(cached))
-            return cached.models;
+        if (!opts.refresh && cached?.models.length && !this.cliEnvNeedsRefresh(cached)) {
+            return { models: cached.models, source: "cache" };
+        }
         // About to go to the vendor: let the caller say so. A silent 1–10s pause on
         // an interactive command reads as another hang, which is the wrong lesson to
         // teach a user who has just been bitten by one.
-        onLiveProbe?.();
+        opts.onLiveProbe?.();
         // Stale, missing, or a forced refresh → probe live (also refreshes the cache).
         // A newly released model is invisible until this runs, which is why staleness
         // triggers it rather than waiting for the 24h hard expiry or a cold start.
-        const env = await this.probeBackendBounded(backendName);
+        const env = await this.probeBackendBounded(backendName, { refreshVendorCatalog: opts.refreshVendorCatalog });
         if (env?.models.length)
-            return env.models;
+            return { models: env.models, source: "live" };
         // Probe failed or timed out: the previous list is still the best answer.
-        return cached?.models ?? [];
+        return { models: cached?.models ?? [], source: "cache" };
+    }
+    /**
+     * The /model menu's choices, in the one order all three pickers share:
+     * 🔄 Refresh first, then models, then (claude) "More models…". Refresh takes
+     * a slot inside Discord's 25-option select cap, so it is paid for from the
+     * model rows, never from "More models…".
+     */
+    modelMenuChoices(instanceName, nonce, options, currentModel) {
+        const isClaude = this.backendNameForInstance(instanceName) === "claude-code";
+        const choices = [{ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:__refresh__`, label: t("model.refresh") }];
+        for (const o of options.slice(0, isClaude ? 23 : 24)) {
+            choices.push({ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`, label: this.modelChoiceLabel(o, currentModel) });
+        }
+        if (isClaude)
+            choices.push({ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:__more__`, label: t("model.more") });
+        return choices;
     }
     /**
      * Model catalog behind the `list_models` tool.
@@ -9938,17 +10076,25 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return [];
         }
     }
-    /** Account-wide catalog: probe cache first, live probe on miss. */
+    /**
+     * Account-wide catalog: probe cache first, live probe when the cache is
+     * missing or older than the same ~1h window `/model` uses (#888).
+     *
+     * Previously this served anything inside the 24h hard TTL, so `list_models`
+     * could answer with a day-old list `/model` had already re-probed past.
+     * The probe runs under the same deadline `/model` uses: a vendor that stops
+     * answering degrades to the previous list, never stalls the tool call.
+     */
     async globalModelCatalog(backend) {
         const cached = this.readCliEnv(backend);
-        if (cached?.models?.length) {
+        if (cached?.models?.length && !this.cliEnvNeedsRefresh(cached)) {
             return {
                 backend, scope: "global", current_model: cached.currentModel ?? null,
                 models: cached.models, source: "cache",
                 probed_at: new Date(cached.probedAt).toISOString(),
             };
         }
-        const env = await this.probeBackend(backend);
+        const env = await this.probeBackendBounded(backend);
         if (env?.models?.length) {
             return {
                 backend, scope: "global", current_model: env.currentModel ?? null,
@@ -9956,6 +10102,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 probed_at: new Date(env.probedAt).toISOString(),
             };
         }
+        // Probe failed or timed out: like `/model`, the previous list is still the
+        // best answer — a stale list beats an empty one.
+        if (cached?.models?.length) {
+            return {
+                backend, scope: "global", current_model: cached.currentModel ?? null,
+                models: cached.models, source: "cache",
+                probed_at: new Date(cached.probedAt).toISOString(),
+            };
+        }
         // Reported rather than thrown: "we could not enumerate" is a useful answer,
         // and the caller can still set a model by name (AgEnD passes it through).
         return {
@@ -10161,14 +10316,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // Raw id for ✓-matching options; display resolves an inherited CLI default.
         const { model: currentModel, display: currentDisplay } = this.resolveInstanceModel(name);
         const nonce = randomBytes(6).toString("hex");
-        const isClaude = this.backendNameForInstance(name) === "claude-code";
-        const choices = options.slice(0, isClaude ? 24 : 25).map(o => ({
-            id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`,
-            label: this.modelChoiceLabel(o, currentModel),
-        }));
-        if (isClaude) {
-            choices.push({ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:__more__`, label: t("model.more") });
-        }
+        const choices = this.modelMenuChoices(name, nonce, options, currentModel);
         const timer = setTimeout(() => this.pendingModelSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
         this.pendingModelSelects.set(nonce, { instanceName: name, model: "", userId: data.userId, channelId: data.channelId, timer, respond: data.respond, respondChoices: data.respondChoices });
@@ -10194,15 +10342,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         const { model: currentModel, display: currentDisplay } = this.resolveInstanceModel(instanceName);
         const nonce = randomBytes(6).toString("hex");
-        const isClaude = this.backendNameForInstance(instanceName) === "claude-code";
-        // Keep the more-models entry inside Discord's 25-option select cap.
-        const choices = options.slice(0, isClaude ? 24 : 25).map(o => ({
-            id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`,
-            label: this.modelChoiceLabel(o, currentModel),
-        }));
-        if (isClaude) {
-            choices.push({ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:__more__`, label: t("model.more") });
-        }
+        const choices = this.modelMenuChoices(instanceName, nonce, options, currentModel);
         const respond = async (text) => {
             await adapter.sendText(chatId, text, { threadId });
             return undefined;
@@ -10286,6 +10426,64 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             await pending.respond(t("model.more_unavailable")).catch(() => { });
         }
     }
+    /**
+     * "🔄 Refresh models" (#886): probe live past both caches and redraw the menu.
+     *
+     * Past AgEnD's cli-env cache (refresh=true) and, where the backend supports
+     * it, past the CLI's own catalog cache too (codex: `codex debug models`).
+     * Without the second half, a codex refresh re-read the same models_cache.json
+     * and showed the old list as new.
+     *
+     * A failed refresh keeps the previous list and says so. It never blanks the
+     * menu, because a picker with no rows cannot even offer another refresh.
+     */
+    async refreshModelMenu(pending) {
+        const { models, source } = await this.getModelOptionsWithSource(pending.instanceName, {
+            refresh: true, refreshVendorCatalog: true,
+        });
+        if (models.length === 0) {
+            await pending.respond(t("model.list_unavailable", pending.instanceName)).catch(() => { });
+            return;
+        }
+        const { model: currentModel, display: currentDisplay } = this.resolveInstanceModel(pending.instanceName);
+        const nonce = randomBytes(6).toString("hex");
+        const choices = this.modelMenuChoices(pending.instanceName, nonce, models, currentModel);
+        const status = source === "live" ? t("model.refreshed") : t("model.refresh_failed");
+        const timer = setTimeout(() => {
+            const p = this.pendingModelSelects.get(nonce);
+            if (p) {
+                this.pendingModelSelects.delete(nonce);
+                p.respond(t("model.selection_expired")).catch(() => { });
+            }
+        }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        this.pendingModelSelects.set(nonce, { ...pending, model: "", timer });
+        try {
+            if (pending.respondChoices) {
+                // Discord select menu: edit the same interaction reply in place.
+                await pending.respondChoices(`${status}\n${t("model.menu", `**${currentDisplay}**`)}`, choices);
+                return;
+            }
+            if (pending.adapter && pending.adapterChatId) {
+                // Telegram: retire the consumed keyboard, then post the redrawn menu.
+                if (pending.menuMessageId && pending.adapter.editMessageRemoveButtons) {
+                    await pending.adapter.editMessageRemoveButtons(pending.adapterChatId, pending.menuMessageId, t("model.refresh"), pending.adapterThreadId).catch(() => { });
+                }
+                const menuMessageId = await pending.adapter.promptUser(pending.adapterChatId, `${status}\n${t("model.menu", currentDisplay)}`, choices, { threadId: pending.adapterThreadId });
+                const fresh = this.pendingModelSelects.get(nonce);
+                if (fresh)
+                    fresh.menuMessageId = menuMessageId;
+                return;
+            }
+            await pending.respond(t("model.usage")).catch(() => { });
+        }
+        catch (err) {
+            this.pendingModelSelects.delete(nonce);
+            clearTimeout(timer);
+            this.logger.warn({ err, instanceName: pending.instanceName }, "Refreshed model menu failed");
+            await pending.respond(t("model.usage")).catch(() => { });
+        }
+    }
     /** Consume a `/model` selection callback. Returns true for all model-select ids (incl. stale). */
     async handleModelSelection(data) {
         if (!data.callbackData.startsWith(MODEL_SELECT_CALLBACK_PREFIX))
@@ -10311,6 +10509,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             await this.expandClaudeModelMenu(pending);
             return true;
         }
+        // "🔄 Refresh models" is navigation too: re-probe past every cache and
+        // redraw the same menu with what came back.
+        if (model === "__refresh__") {
+            await this.refreshModelMenu(pending);
+            return true;
+        }
         // Send immediate "⏳ Switching..." feedback, then apply in background.
         const progressText = t("model.switching", pending.instanceName, model);
         let progressMsgId;
@@ -10848,6 +11052,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.discordPresenceTimer);
             this.discordPresenceTimer = null;
         }
+        if (this.discordPresenceEagerTimer) {
+            clearTimeout(this.discordPresenceEagerTimer);
+            this.discordPresenceEagerTimer = null;
+        }
+        this.discordPresenceEagerPending = false;
         // Cancel-button timers were never cleared here. The idle-check interval is not
         // unref'd, so it held the event loop open past shutdown and kept retrying
         // deletes against an adapter that was already gone.