@songsid/agend 2.1.9 → 2.1.10-beta.2

package/dist/fleet-manager.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, constants as fsConstants } from "node:fs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { freemem, totalmem, cpus } from "node:os";
+import { freemem, totalmem, cpus, homedir } from "node:os";
 import { createServer } from "node:http";
 import { Worker } from "node:worker_threads";
 import { join, dirname, basename, delimiter, isAbsolute } from "node:path";
@@ -29,7 +29,7 @@ import { IpcClient } from "./channel/ipc-bridge.js";
 import { createAdapter } from "./channel/factory.js";
 import { TelegramAdapter } from "./channel/adapters/telegram.js";
 import { createBackend } from "./backend/factory.js";
-import { isModelCompatible, SYSINFO_BACKEND_IDS } from "./backend/types.js";
+import { isModelCompatible, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
 import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
@@ -56,6 +56,7 @@ import { handleViewRequest, isViewPath } from "./view-api.js";
 import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
+import { tightenInstanceDirs } from "./private-dir.js";
 import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS, announcePostLoginRecovery } from "./login-controller.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
@@ -77,6 +78,7 @@ import { buildToolPermissionsNotice } from "./tool-permissions-notice.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
 import { decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
+import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
 import { fleetLevelDifferences, fleetLevelSignature } from "./fleet-level-config.js";
 import { checkSelfRestartAllowance, recordSelfRestartAttempt } from "./self-restart-limit.js";
 import { SecretStore } from "./secret-store.js";
@@ -362,6 +364,8 @@ export class FleetManager {
         "provider-unavailable",
     ]);
     logger = createLogger("info");
+    /** Report each bundled skill collision once per fleet, across instance starts. */
+    skippedBundledSkills = new Set();
     topicCommands;
     // sessionName → instanceName mapping for external sessions
     sessionRegistry = new Map();
@@ -430,6 +434,8 @@ export class FleetManager {
     stopsInFlight = new Map();
     /** Aggregation window for the "N instances failed to start" notice. */
     startupRetryNotices = new Map();
+    /** Unsupported-CLI refusals waiting to go out, grouped by reason (#1109). */
+    unsupportedCliNotices = new Map();
     /** Backoff between automatic startup retries; the last step repeats while the backend is down. */
     static STARTUP_RETRY_BACKOFF_MS = [60_000, 5 * 60_000, 15 * 60_000];
     /** Hard cap on automatic startup retries (3 backoff steps + up to 3 more during a backend outage). */
@@ -593,7 +599,7 @@ export class FleetManager {
             if (event.deliveryId && (event.state === "failed" || event.state === "uncertain")) {
                 const row = outbox.get(event.deliveryId);
                 if (row && row.kind !== "delivery_outcome_notice" && row.kind !== "post_restart_outcome_notice") {
-                    const notice = `Durable delivery ${row.state}: operation_id=${row.operationId}; target=${row.targetInstance}; delivery_id=${row.deliveryId}.`;
+                    const notice = t(`delivery.fleet_${row.state}`, row.targetInstance, row.operationId, row.deliveryId);
                     this.logger.error({ deliveryId: row.deliveryId, operationId: row.operationId, target: row.targetInstance, state: row.state }, notice);
                     this.notifyFleetError(notice);
                 }
@@ -614,7 +620,7 @@ export class FleetManager {
             this.scheduleDeliveryOutboxPump();
             this.wakeCoordinator?.kick();
             if (event.count)
-                this.notifyFleetError(`${event.count} durable delivery row(s) reached the 24-hour outbox bound; ${event.uncertain ?? 0} unresolved submissions are uncertain and sender notices were queued.`);
+                this.notifyFleetError(t("delivery.expired", event.count, event.uncertain ?? 0));
         });
         this.scheduleDeliveryOutboxPump();
     }
@@ -926,7 +932,7 @@ export class FleetManager {
                 if ((current?.state === "delivering" || current?.state === "submission_started")
                     && current.targetDaemonBootId === claimed.targetDaemonBootId
                     && current.managerBootId === claimed.managerBootId) {
-                    this.notifyFleetError(`Durable delivery to ${claimed.targetInstance} is still waiting after ${Math.round(DURABLE_DELIVERY_LANE_ALERT_MS / 60_000)} minutes; the same daemon generation retains delivery ${deliveryId}'s lane until it reports or is replaced.`);
+                    this.notifyFleetError(t("delivery.lane_waiting", claimed.targetInstance, Math.round(DURABLE_DELIVERY_LANE_ALERT_MS / 60_000), deliveryId));
                 }
             }, DURABLE_DELIVERY_LANE_ALERT_MS);
             alertTimer.unref?.();
@@ -1052,6 +1058,7 @@ export class FleetManager {
         // around to notice. Never throws: a lease that cannot be resolved blocks
         // the next tunnel and says so, it does not block the fleet.
         this.announceToolPermissionsChange();
+        this.tightenInstanceDirectories();
         void reapStaleTunnel(this.dataDir)
             .then(outcome => {
             if (outcome.kind === "manual")
@@ -1276,6 +1283,29 @@ export class FleetManager {
     getInstanceDir(name) {
         return join(this.dataDir, "instances", name);
     }
+    /**
+     * One-time repair of what earlier versions left behind: instance directories (agent.token and the IPC
+     * socket live in them) created with the process umask — typically 0775, group-writable and traversable
+     * by everyone. They are made 0700 here, once, and said so once; new ones are born 0700 (ensureInstanceDir).
+     * Idempotent, so a restart that finds nothing to do logs nothing. Never throws.
+     */
+    tightenInstanceDirectories() {
+        try {
+            const report = tightenInstanceDirs(this.dataDir);
+            if (report.tightened.length > 0) {
+                this.logger.info({
+                    count: report.tightened.length,
+                    modes: [...new Set(report.tightened.map(t => t.from))],
+                }, "Instance directories were open to other users; set to 0700 (they hold agent.token and the IPC socket)");
+            }
+            if (report.skipped.length > 0) {
+                this.logger.warn({ dirs: report.skipped.map(s => `${s.dir} (${s.why})`) }, "Could not tighten these instance directories — fix their owner/permissions by hand (chmod 700)");
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Instance directory permission check failed");
+        }
+    }
     /** AgEnD package version (for the Settings "current version" / What's New). */
     get currentVersion() {
         try {
@@ -2431,6 +2461,8 @@ export class FleetManager {
             // outcome. Retrying would start an instance the operator just stopped.
             if (err instanceof SupersededStartError)
                 return false;
+            if (this.stopOnUnsupportedCli(name, err, what))
+                return false;
             this.logger.error({ err, name }, `Failed to start ${what}`);
             this.scheduleStartupRetry(name, 0);
             return false;
@@ -2555,6 +2587,9 @@ export class FleetManager {
             // Superseded by a stop/restart: that transition owns the outcome.
             if (err instanceof SupersededStartError)
                 return;
+            // An earlier attempt could not tell (unknown probe); this one could.
+            if (this.stopOnUnsupportedCli(name, err, "instance"))
+                return;
             this.logger.error({ err, name, attempt: attempt + 1 }, "Automatic startup retry failed");
             this.scheduleStartupRetry(name, attempt + 1);
         }
@@ -2650,6 +2685,38 @@ export class FleetManager {
      * fails many instances within the same second. Two notices per incident at
      * most — "N failed, retrying in X" and, if it comes to that, "gave up on N".
      */
+    /**
+     * The CLI refuses this instance as configured (#1109): the same binary would
+     * refuse every retry, so say why once and leave it stopped. Shared by the
+     * first unattended start and every scheduled retry.
+     */
+    stopOnUnsupportedCli(name, err, what) {
+        if (!(err instanceof UnsupportedCliError))
+            return false;
+        this.logger.error({ name, reason: err.message }, `Not starting ${what}: the installed CLI cannot run it as configured`);
+        this.queueUnsupportedCliNotice(name, err.message);
+        return true;
+    }
+    /**
+     * One notice per refusal reason: a kiro-cli that dropped the legacy UI
+     * refuses every kiro instance at once, and that is one message, not ten.
+     */
+    queueUnsupportedCliNotice(name, reason) {
+        const pending = this.unsupportedCliNotices.get(reason);
+        if (pending) {
+            if (!pending.names.includes(name))
+                pending.names.push(name);
+            return;
+        }
+        const timer = setTimeout(() => {
+            const entry = this.unsupportedCliNotices.get(reason);
+            this.unsupportedCliNotices.delete(reason);
+            if (entry)
+                this.notifyFleetError(t("fleet.cli_unsupported", entry.names.join(", "), reason));
+        }, FleetManager.STARTUP_RETRY_NOTICE_AGGREGATE_MS);
+        timer.unref?.();
+        this.unsupportedCliNotices.set(reason, { names: [name], timer });
+    }
     queueStartupRetryNotice(kind, name, delayMs) {
         const pending = this.startupRetryNotices.get(kind);
         if (pending) {
@@ -3161,8 +3228,7 @@ export class FleetManager {
         this.configPath = configPath;
         this.loadEnvFile();
         this.ensureDeliveryOutbox();
-        // Rotate fleet.log if oversized (before any logging)
-        rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
+        this.rotateFleetLogs();
         const fleet = this.loadConfig(configPath);
         this.slimFleetConfigAtStartup();
         setLocale(detectLocale(fleet)); // user-facing text language (fleet.yaml defaults.locale / timezone)
@@ -3276,9 +3342,7 @@ export class FleetManager {
             // Rotate classic channel chat logs daily
             this.classicChannels?.rotateLogs();
             this.rotateInboxes();
-            // Rotate fleet.log daily too (besides the startup size check above), so a
-            // long-running fleet doesn't accumulate an unbounded log.
-            rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
+            this.rotateFleetLogs();
             // Instance output.log is pipe-pane (TUI ANSI). Daemon health ticks rotate a
             // running instance's own log; this sweep is the safety net for every other
             // kind. One implementation, so the two cannot cover different sets.
@@ -3494,11 +3558,14 @@ export class FleetManager {
         this.pruneEventLog();
         this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
         this.eventLogPruneTimer.unref?.();
-        // Same shape for pipe-pane logs, and for the same reason: the only sweep that
+        // Same shape for logs, and for the same reason: the only sweep that
         // covered them lived inside the daily-summary callback, so it did not run at
         // all when summaries were off.
         this.rotateAllInstanceLogs();
-        this.logRotateTimer = setInterval(() => this.rotateAllInstanceLogs(), 24 * 60 * 60_000);
+        this.logRotateTimer = setInterval(() => {
+            this.rotateFleetLogs();
+            this.rotateAllInstanceLogs();
+        }, 24 * 60 * 60_000);
         this.logRotateTimer.unref?.();
         // Phase 2: Start remaining instances with staggered concurrency
         if (others.length > 0) {
@@ -4773,6 +4840,7 @@ export class FleetManager {
                     const targetInstance = String(msg.targetInstance ?? name);
                     const correlationId = String(msg.correlationId ?? "unknown");
                     const error = String(msg.error ?? "unknown delivery failure");
+                    const displayError = error.replace(/^delivery failed: phase=(.*); proof=(.*)$/, (_match, phase, proof) => t("delivery.pane_failure", phase, proof));
                     const senderInstance = this.instanceIpcClients.has(senderSession)
                         ? senderSession
                         : this.sessionRegistry.get(senderSession);
@@ -4781,11 +4849,11 @@ export class FleetManager {
                         from: senderSession, correlation_id: correlationId, error,
                     });
                     if (senderInstance) {
-                        this.notifyInstanceTopic(senderInstance, t("cross_instance.delivery_failed_notice", targetInstance, error, correlationId));
+                        this.notifyInstanceTopic(senderInstance, t("cross_instance.delivery_failed_notice", targetInstance, displayError, correlationId));
                         void this.deliverToInstance(senderInstance, {
                             type: "fleet_inbound",
                             targetSession: senderSession,
-                            content: t("cross_instance.delivery_failed_agent", targetInstance, error, correlationId),
+                            content: t("cross_instance.delivery_failed_agent", targetInstance, displayError, correlationId),
                             meta: {
                                 chat_id: "",
                                 message_id: `delivery-failed-${Date.now()}`,
@@ -5061,7 +5129,7 @@ export class FleetManager {
      */
     governingAccess(msg, threadId) {
         if (threadId && !this.classicChannels?.hasChannel(threadId)) {
-            const target = this.routing.resolve(threadId);
+            const target = this.resolveInboundTarget(msg, threadId);
             if (target) {
                 const owner = this.getInstanceAdapterId(target.name);
                 if (owner)
@@ -5097,7 +5165,7 @@ export class FleetManager {
             return null;
         if (this.classicChannels?.hasChannel(threadId))
             return null;
-        const target = this.routing.resolve(threadId);
+        const target = this.resolveInboundTarget(msg, threadId);
         if (!target)
             return null;
         const ownerAdapterId = this.getInstanceAdapterId(target.name);
@@ -5129,7 +5197,7 @@ export class FleetManager {
                 return "classic: collab off";
             return null;
         }
-        const target = this.routing.resolve(threadId);
+        const target = this.resolveInboundTarget(msg, threadId);
         if (!target)
             return "fleet topic: no instance routed for this thread";
         // Fleet topic: this gate lets the copy through when the adapter is open OR
@@ -5162,8 +5230,42 @@ export class FleetManager {
             return;
         this.logger.warn({ statePath, configured, inEffect: accessManager.getMode() }, `access mode "${accessManager.getMode()}" comes from the state file and overrides "${configured}" in fleet.yaml; delete ${statePath} to go back to the configured value`);
     }
+    /**
+     * #1085: the thread id inbound routing may use. Telegram topic ids are small
+     * integers numbered per group, but the routing table is keyed by topic id
+     * alone — so a message in topic 30 of ANY group the bot is in resolved to
+     * the fleet instance that owns topic 30 of the fleet's own group (and a group
+     * that never ran /start was bound by coincidence). A Telegram topic counts
+     * as a fleet topic only in the fleet's group: `chat_id == group_id` of the
+     * receiving bot's channel. From any other group the message is a ClassicBot
+     * candidate keyed by its chat id (served only if /start registered it,
+     * ignored otherwise). Discord channel ids are global, so they are unaffected.
+     */
+    inboundRouteThreadId(msg) {
+        const raw = msg.threadId || undefined;
+        if (!raw || msg.source !== "telegram")
+            return raw;
+        const fleetGroupId = this.getChannelConfig(msg.adapterId)?.group_id;
+        if (fleetGroupId != null && String(fleetGroupId) === msg.chatId)
+            return raw;
+        this.logger.debug({ adapterId: msg.adapterId, chatId: msg.chatId, threadId: raw }, "Telegram topic outside the fleet group — not a fleet topic (#1085)");
+        return undefined;
+    }
+    /**
+     * #1085, defense in depth: a routed Telegram target must belong to the group
+     * the message came from — its own world's group_id. Two Telegram fleet
+     * worlds can number topics alike; a coincidence is dropped, never delivered.
+     */
+    resolveInboundTarget(msg, threadId) {
+        if (msg.source !== "telegram")
+            return this.routing.resolve(threadId);
+        return this.routing.resolveAll(threadId).find(target => {
+            const ownerGroupId = this.getChannelConfig(this.getInstanceAdapterId(target.name))?.group_id;
+            return ownerGroupId != null && String(ownerGroupId) === msg.chatId;
+        });
+    }
     async handleInboundMessage(msg) {
-        const threadId = msg.threadId || undefined;
+        const threadId = this.inboundRouteThreadId(msg);
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
         // Ownership and per-adapter filtering both run before the dedup claim below.
         // When several bots share a guild they all receive the same message; a copy
@@ -5219,7 +5321,7 @@ export class FleetManager {
         // the message (the @mention filter downstream decides who actually forwards).
         // Key the dedup per-adapter there so a sibling bot's copy isn't dropped.
         if (msg.messageId) {
-            const classicCid = msg.threadId || msg.chatId;
+            const classicCid = threadId || msg.chatId;
             const isClassicMsg = this.classicChannels?.hasChannel(classicCid) ?? false;
             const dedupKey = isClassicMsg
                 ? `${msg.source}:${msg.chatId}:${msg.messageId}:${msg.adapterId ?? ""}`
@@ -5508,7 +5610,7 @@ export class FleetManager {
                     // TG ClassicBot: group requires @mention, private chat forwards directly.
                     if (!isPrivateChat && !isBotMentioned) {
                         // No trigger: save attachments + react, log, but don't forward to agent
-                        const syntheticMsg = { ...msg, threadId: chatId, text: rawText.startsWith("/") ? "" : rawText };
+                        const syntheticMsg = { ...msg, threadId: chatId, transportThreadId: msg.threadId || undefined, text: rawText.startsWith("/") ? "" : rawText };
                         await this.handleClassicChannelMessage(classicName, syntheticMsg);
                         return;
                     }
@@ -5522,7 +5624,7 @@ export class FleetManager {
                         await msgAdapter?.sendText(chatId, t("cmd.admin_required", "/raw"));
                         return;
                     }
-                    const syntheticMsg = { ...msg, threadId: chatId, text: `/chat ${cleanText}` };
+                    const syntheticMsg = { ...msg, threadId: chatId, transportThreadId: msg.threadId || undefined, text: `/chat ${cleanText}` };
                     await this.handleClassicChannelMessage(classicName, syntheticMsg);
                     return;
                 }
@@ -5609,7 +5711,7 @@ export class FleetManager {
             await this.handleClassicChannelMessage(classicName, msg);
             return;
         }
-        const target = this.routing.resolve(threadId);
+        const target = this.resolveInboundTarget(msg, threadId);
         if (!target) {
             // Only show unbound message for actual forum topics (same group, has threadId)
             const adapterGroupId = String(this.getChannelConfig(msg.adapterId)?.group_id ?? "");
@@ -5849,8 +5951,18 @@ export class FleetManager {
         const classicChannelId = this.classicChannels?.getChannelIdByInstance(senderInstanceName ?? instanceName);
         if (classicChannelId) {
             args.chat_id = classicChannelId;
-            delete args.thread_id;
-            threadId = undefined;
+            // #1085: a Telegram forum ClassicBot replies in the topic it was asked
+            // in. Any other thread_id (threadless Telegram, where it echoes the chat
+            // id, or a Discord channel) is still cleared, as before.
+            const topic = typeof args.thread_id === "string" ? args.thread_id : "";
+            const telegram = (contextWorld?.adapter ?? outAdapter)?.type === "telegram";
+            if (telegram && topic && topic !== classicChannelId) {
+                threadId = topic;
+            }
+            else {
+                delete args.thread_id;
+                threadId = undefined;
+            }
         }
         // Reply dedup: retries land here when the agent was told a send failed
         // (daemon budget elapsed, shell tool killed) while the adapter send was
@@ -6922,7 +7034,7 @@ export class FleetManager {
     quarantineMissingTopic(threadId, target, evidence) {
         if (!isProbeableRouteTarget(target) || this.routing.resolve(threadId) !== target)
             return;
-        this.routing.unregister(threadId);
+        this.routing.unregister(threadId, target.name);
         this.logger.error({ instanceName: target.name, threadId, ...evidence }, "Topic is confirmed missing — route quarantined; instance configuration and user data were retained");
         this.notifyFleetError(t("fleet.topic_quarantined", target.name, threadId));
     }
@@ -7723,7 +7835,11 @@ export class FleetManager {
             return stripAnsi(e.message ?? "").trim() || t("doctor.failed");
         }
     }
-    /** Drop event/activity rows older than the retention window. Best-effort. */
+    /** Cap both structured runtime logs and service bootstrap diagnostics. */
+    rotateFleetLogs() {
+        rotateLogIfNeeded(join(this.dataDir, "daemon.log"));
+        rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
+    }
     /**
      * Cap every instance's pipe-pane log, walking the instances **directory** rather
      * than the config.
@@ -7759,6 +7875,7 @@ export class FleetManager {
             rotateLogIfNeeded(join(root, entry.name, "output.log"));
         }
     }
+    /** Drop event/activity rows older than the retention window. Best-effort. */
     pruneEventLog() {
         try {
             this.eventLog?.prune(FleetManager.EVENT_LOG_RETENTION_DAYS);
@@ -9375,6 +9492,7 @@ export class FleetManager {
                 releaseWindow: claim => { this.loginWindow.release(claim); },
                 isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
                 windowBusyMessage: () => this.loginWindow.busyMessage(),
+                tunnelDataDir: () => this.dataDir,
                 postButtons: async ({ prefix, instanceName, chat, message, choices, expiredText }) => {
                     await this.postNonceButtonPrompt({
                         prefix, alertType: "login", instanceName,
@@ -9892,7 +10010,7 @@ export class FleetManager {
     }
     /** Re-login confirmation (auth pre-check said credentials still work). */
     async handleLoginConfirm(data, callbackAdapterId, receivingAdapter) {
-        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|go-relogin|cancel)$/, data, callbackAdapterId, receivingAdapter);
+        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|go-relogin|go-tunnel|go-relogin-tunnel|cancel)$/, data, callbackAdapterId, receivingAdapter);
         if (claimed === null)
             return false;
         if (claimed === "consumed")
@@ -9910,7 +10028,12 @@ export class FleetManager {
             chatId: entry.chatId,
             threadId: entry.threadId,
             userId: data.userId,
-        }, { skipAuthCheck: true, tokenPresent: action === "go-relogin" });
+        }, {
+            skipAuthCheck: true,
+            tokenPresent: action === "go-relogin" || action === "go-relogin-tunnel",
+            // The consent is the button itself: only the explicit "Open public link" actions carry it.
+            tunnel: action === "go-tunnel" || action === "go-relogin-tunnel",
+        });
         if (text)
             await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
         return true;
@@ -10005,7 +10128,7 @@ export class FleetManager {
                 }
                 // The installer may only have added the binary to a profile PATH; a
                 // fresh login shell sees that, the fleet process's PATH may not.
-                const installedAt = this.locateBinaryOnLoginShell(info.binary);
+                const installedAt = this.locateBinaryOnLoginShell(info.binary) ?? this.locateInInstallerBinDirs(info);
                 if (!installedAt) {
                     await chat.adapter.sendText(chat.chatId, t("install.verify_failed", backend, info.binary), { threadId: chat.threadId }).catch(() => { });
                     return;
@@ -10094,6 +10217,26 @@ export class FleetManager {
             return null;
         }
     }
+    /**
+     * #1092: the binary in one of the directories its own installer installs to,
+     * when no login shell can see it (the installer recorded its PATH in an
+     * interactive-only rc file). The same executable-file check as the login
+     * shell lookup; a symlink to an executable counts, as codex's launcher is one.
+     */
+    locateInInstallerBinDirs(info) {
+        for (const dir of info.binDirs?.(process.env, homedir()) ?? []) {
+            if (!isAbsolute(dir))
+                continue;
+            const path = join(dir, info.binary);
+            try {
+                accessSync(path, fsConstants.X_OK);
+                if (statSync(path).isFile())
+                    return path;
+            }
+            catch { /* not there */ }
+        }
+        return null;
+    }
     /** Put an installed binary's directory on the fleet's PATH (#1059), once. */
     adoptBinaryDirectory(binaryPath, backend) {
         const dir = dirname(binaryPath);
@@ -10511,8 +10654,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             const dest = join(destDir, "SKILL.md");
             const isOurs = previouslyManaged.includes(name) || !existsSync(destDir);
             if (!isOurs) {
-                // Name collision with a user-authored skill: theirs wins, loudly.
-                this.logger.warn({ skill: name, destSkills }, "Skipping bundled skill — a skill of this name exists but was not published by AgEnD");
+                // The user's skill still wins on every sync; only the warning is deduped.
+                if (!this.skippedBundledSkills.has(name)) {
+                    this.skippedBundledSkills.add(name);
+                    this.logger.warn({ skill: name, destSkills }, "Skipping bundled skill — a skill of this name exists but was not published by AgEnD");
+                }
                 continue;
             }
             managed.push(name);
@@ -10854,6 +11000,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     /** Forward a message to a classic channel instance with chat log context */
     async forwardToClassicInstance(instanceName, text, msg, extraMeta) {
+        // #1085: a Telegram forum ClassicBot is keyed by chat id (threadId), but the
+        // reply context must carry the topic the message was really asked in.
+        const replyThreadId = msg.transportThreadId ?? msg.threadId;
         // Resolve the channel/adapter from the instance itself so per-channel context
         // config is correct even for a same-channel second bot.
         const ctxAdapterId = this.classicChannels?.getAdapterIdByInstance(instanceName);
@@ -10869,7 +11018,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             user: msg.username,
             user_id: msg.userId,
             ts: msg.timestamp.toISOString(),
-            thread_id: msg.threadId ?? "",
+            thread_id: replyThreadId ?? "",
             ...(msg.adapterId ? { adapter_id: msg.adapterId } : {}),
             source: msg.source,
             ...extraMeta,
@@ -10906,7 +11055,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         this.lastInboundUser.set(instanceName, msg.username);
         this.logger.info(`${msg.username} → ${instanceName} (classic): ${text.slice(0, 100)}`);
-        this.trackInboundMsg(instanceName, msg);
+        this.trackInboundMsg(instanceName, { ...msg, threadId: replyThreadId });
         void this.sendCancelButton(instanceName);
     }
     /** Paste raw text directly to a classic instance's CLI (no [user:] wrapping) */
@@ -12823,7 +12972,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return {
                 ok: false,
                 status: 409,
-                error: `fleet.yaml and the running configuration disagree on ${this.fleetSignatureMismatch.join(", ")} — check fleet.log before restarting`,
+                error: `fleet.yaml and the running configuration disagree on ${this.fleetSignatureMismatch.join(", ")} — check daemon.log before restarting`,
             };
         }
         const job = this.applyJobs.get(jobId);
@@ -12898,7 +13047,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.applyJobs.setTargetStatus(jobId, APPLY_FLEET_TARGET, "failed", "restart could not be launched");
             this.applyJobs.finish(jobId, "restart could not be launched");
             this.emitSseEvent("apply_progress", viewOf(this.applyJobs.get(jobId)));
-            return { ok: false, status: 409, error: "the restart could not be launched — see fleet.log" };
+            return { ok: false, status: 409, error: "the restart could not be launched — see daemon.log" };
         }
         return { ok: true, jobId };
     }
@@ -14106,6 +14255,20 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         return false; // identical
     }
     // ── Health HTTP endpoint ─────────────────────────────────────────────
+    /** Distinct rejected Host names already logged; bounded so a scanner cannot grow it. */
+    rejectedHostsLogged = new Set();
+    /**
+     * Say once per name why a request was refused, so a reverse-proxy deployment
+     * that stopped working after the Host check is diagnosable from fleet.log.
+     * Only the parsed host name is logged, never the raw header.
+     */
+    noteRejectedHost(header) {
+        const name = typeof header === "string" ? (hostnameOf(header) ?? "(malformed)") : "(missing)";
+        if (this.rejectedHostsLogged.has(name) || this.rejectedHostsLogged.size >= 32)
+            return;
+        this.rejectedHostsLogged.add(name);
+        this.logger.warn({ host: name }, "Web request refused: Host is not allowed (add it to web.allowed_hosts if this is a proxy you run)");
+    }
     startHealthServer(port) {
         this.startedAt = Date.now();
         this.healthServerListening = false;
@@ -14121,6 +14284,16 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // Authorization now depends on a cookie, so a shared cache (a tunnel, a
             // corporate proxy) must not serve one visitor's response to another.
             res.setHeader("Vary", "Cookie");
+            applyWebSecurityHeaders(res);
+            // Before any route, /health and /agent included: loopback binding does not
+            // stop DNS rebinding, and the Host the browser sends is the one thing a
+            // rebinding page cannot change.
+            if (!isHostAllowed(req.headers.host, allowedHostNames(this.fleetConfig))) {
+                this.noteRejectedHost(req.headers.host);
+                res.writeHead(403);
+                res.end(JSON.stringify({ error: WEB_HOST_REJECTED_MESSAGE }));
+                return;
+            }
             const requestPath = new URL(req.url ?? "/", `http://localhost:${port}`).pathname;
             // Browsers request this automatically and AgEnD does not ship an icon.
             // It is neither user data nor an API route, so do not turn the harmless