@songsid/agend 2.2.0-alpha.1 → 2.2.0-alpha.2

package/dist/fleet-manager.js

@@ -39,6 +39,7 @@ import { STATUS_EMOJI_CONFIG_KEYS, STATUS_EMOJI_KEYS, STATUS_EMOJI_SUGGESTIONS,
 import { isProbeableRouteTarget } from "./fleet-context.js";
 import { loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
+import { classifySqliteOpenError } from "./sqlite-open-errors.js";
 import { AdapterWorld } from "./adapter-world.js";
 import { CostGuard, formatCents } from "./cost-guard.js";
 import { startEventLoopWatch } from "./event-loop-watch.js";
@@ -129,7 +130,8 @@ import { tightenInstanceDirs } from "./private-dir.js";
 import { decideSlash } from "./slash-authz.js";
 import { commandSpec, decideCommand, ruleFor } from "./command-table.js";
 import { runVisibilityCommand } from "./cross-instance-notice.js";
-import { UPDATE_COMMAND, installedChannel, isPrereleaseVersion, updateNoticeKey } from "./update-check.js";
+import { installedChannel, isPrereleaseVersion, updateNoticeKey } from "./update-check.js";
+import { resolveInstalledAgend, updateCommand } from "./update-dispatch.js";
 import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS } from "./login-controller.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
@@ -156,6 +158,10 @@ import { NeedsYouHub } from "./needs-you-hub.js";
 import { WEB_CHAT_NOTICE, WEB_REMOTE_DOCS_URL, claimNotice, hasWebChat, releaseNotice, upgradeNoticesPath } from "./upgrade-notices.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { buildOrgChart } from "./web-org.js";
+import { CacheService, WINDOWS } from "./cache-service.js";
+import { runWebCommand } from "./web-commands.js";
+import { claudeProjectKey } from "./backend/claude-code.js";
+import { sharedRolloutIndex } from "./rollout-index.js";
 import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
 import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
 import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
@@ -1898,11 +1904,16 @@ export class FleetManager {
         const { spawn } = await import("node:child_process");
         // Plain `agend update`: the CLI picks the channel from the version it is about to replace (a beta install
         // stays on beta). Deciding here, from the package.json next to THIS code, read a source checkout's 1.22.0 as
-        // "not a beta" and sent a beta install to @latest.
-        const command = UPDATE_COMMAND;
+        // "not a beta" and sent a beta install to @latest. #1450 C5: the INSTALLED agend, verified, by absolute path.
+        const installed = await resolveInstalledAgend();
+        if (!installed.ok) {
+            this.failUpdateProgress(`/update cannot verify the installed AgEnD (${installed.reason}). Run \`agend update\` from a shell.`);
+            return;
+        }
         const origin = `slash /update by ${adapterId}:${data.userId}`;
         recordInternalRequest(this.dataDir, "update", origin);
-        const child = spawn("sh", ["-c", `sleep 2 && ${command}`], {
+        const { command, args } = updateCommand(installed.agend);
+        const child = spawn(command, args, {
             detached: true, stdio: "ignore", env: withOrigin(origin),
         });
         child.once("error", err => this.failUpdateProgress(err.message));
@@ -8581,6 +8592,17 @@ export class FleetManager {
             this.writeFleetConfigBackup(source);
         const tempPath = `${this.configPath}.tmp-${process.pid}`;
         writeFileSync(tempPath, output, "utf-8");
+        // #1056 (Fable's 2.2 audit): the patcher writes leaves, not configs, so a wrong patch can produce a file the
+        // validator — or the next start — refuses (a bare channels[0], a channels list with a null). Load and validate
+        // what is about to replace fleet.yaml; a result that adds an error is not written, and the save fails instead.
+        const refusal = this.savedFleetConfigProblem(tempPath);
+        if (refusal) {
+            try {
+                unlinkSync(tempPath);
+            }
+            catch { /* already gone */ }
+            throw new Error(refusal);
+        }
         if (existsSync(this.configPath))
             chmodSync(tempPath, statSync(this.configPath).mode);
         renameSync(tempPath, this.configPath);
@@ -8588,6 +8610,27 @@ export class FleetManager {
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.logger.info({ path: this.configPath, strippedDefaults: redundantPaths.length }, "Saved fleet config (lossless patch)");
     }
+    /** Why the config written to `candidate` must not replace fleet.yaml, or null: it does not load, or it adds errors. */
+    savedFleetConfigProblem(candidate) {
+        let after;
+        try {
+            after = validateFleetConfig(loadFleetConfig(candidate));
+        }
+        catch (err) {
+            return `Refusing to save fleet.yaml: the result would not load (${err.message})`;
+        }
+        let had = new Set();
+        try {
+            if (this.configPath && existsSync(this.configPath)) {
+                had = new Set(validateFleetConfig(loadFleetConfig(this.configPath)).errors.map(e => `${e.path}\u0000${e.message}`));
+            }
+        }
+        catch { /* the current file does not load: every error of the result counts as new */ }
+        const introduced = after.errors.filter(e => !had.has(`${e.path}\u0000${e.message}`));
+        return introduced.length
+            ? `Refusing to save fleet.yaml: it would be invalid (${introduced.map(e => `${e.path}: ${e.message}`).join("; ")})`
+            : null;
+    }
     /** One-time upgrade migration; invalid YAML is never rewritten. */
     slimFleetConfigAtStartup() {
         const redundantPaths = collectRedundantInstanceDefaultPaths(this.rawFleetConfig);
@@ -8646,6 +8689,20 @@ export class FleetManager {
         }
         const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
         if (isRecord(before) && isRecord(after)) {
+            // #1056: a legacy `channel` is being migrated (the caller removed it and kept `channels`). The file has no
+            // `channels` for the leaf patch below to land on — the snapshot's list is only the normalized alias — so a bare
+            // channels[0] holding just the changed field would be written while `channel` is deleted. Move the connection
+            // as it is in the file NOW (a concurrent or manual edit, an option AgEnD does not know) into channels[0]
+            // first; the patch then applies only this save's own changes on top, with the usual identity/order check.
+            if (path.length === 0 && this.rawFleetConfig.channel && !this.rawFleetConfig.channels
+                && after.channel === undefined && Array.isArray(after.channels) && !document.hasIn(["channels"])) {
+                const fresh = document.getIn(["channel"], true);
+                if (isMap(fresh)) {
+                    const list = document.createNode([]);
+                    list.items.push(fresh.clone());
+                    document.setIn(["channels"], list);
+                }
+            }
             const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
             for (const key of keys) {
                 // `channel` is a derived alias when the raw file uses `channels`.
@@ -8790,6 +8847,21 @@ export class FleetManager {
      * to a plain add (never worse than the old behaviour).
      */
     lastStatusEmoji = new Map();
+    /**
+     * #1056: every status emoji each bot really stamped, per `${adapterId}:${messageId}` (match keys). A connection's
+     * status set can change while AgEnD runs, so "is this a stamp?" cannot be answered from the current set alone: a
+     * bot's earlier stamp in the old emoji must still be plumbing, not an agent's reaction. Unbounded for the same
+     * reason as lastStatusEmoji (a few short strings per stamped message).
+     */
+    stampedStatus = new Map();
+    noteStamped(adapter, messageId, emoji) {
+        const adapterId = typeof adapter.id === "string" ? adapter.id : "?";
+        const k = `${adapterId}:${messageId}`;
+        let set = this.stampedStatus.get(k);
+        if (!set)
+            this.stampedStatus.set(k, set = new Set());
+        set.add(statusMatchKey(emoji));
+    }
     /**
      * One in-flight status update per bot+message: updates run strictly in call
      * order, so a delayed ❌ add can never land after a newer ✅'s removal —
@@ -8812,7 +8884,7 @@ export class FleetManager {
      */
     resolveStatusEmojisFor(instanceName, adapterId, adapter) {
         const worldId = adapterId ?? this.getInstanceAdapterId(instanceName);
-        const channel = (worldId ? this.worlds.get(worldId)?.channelConfig : undefined) ?? this.getChannelConfig(worldId ?? undefined);
+        const channel = this.statusEmojiChannel(worldId);
         // The adapter that will react decides the vocabulary: a Telegram bot gets
         // Telegram's reaction set even if the channel lookup fell back elsewhere.
         const reacting = adapter ?? (worldId ? this.worlds.get(worldId)?.adapter : undefined) ?? this.adapter;
@@ -8833,6 +8905,22 @@ export class FleetManager {
         return { ...resolved, platform };
     }
     warnedStatusEmojis = new Set();
+    /**
+     * The connection whose `options.status_emojis` an instance on `worldId` stamps with. #1056: read from the live config
+     * first — a Settings save replaces `fleetConfig.channels`, and the running world keeps the object it started with —
+     * so a change to the connection's emojis applies at the next stamp, as an instance's own override does. Only the
+     * emoji options are taken from it: the platform is still the running adapter's (resolveStatusEmojisFor).
+     */
+    statusEmojiChannel(worldId) {
+        const started = (worldId ? this.worlds.get(worldId)?.channelConfig : undefined) ?? this.getChannelConfig(worldId ?? undefined);
+        if (!worldId)
+            return started;
+        const list = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const live = list.find(ch => (ch.id ?? ch.type) === worldId);
+        if (!live || !started)
+            return live ?? started;
+        return { ...started, options: { ...(started.options ?? {}), status_emojis: live.options?.status_emojis } };
+    }
     /**
      * A Discord connection's server emojis for the Settings picker (#1005), from
      * every server its bot can draw on (#1021): the primary `group_id` server,
@@ -8922,11 +9010,18 @@ export class FleetManager {
             return { error: this.personaEmojiMissing(instanceName) };
         const worldId = this.getInstanceAdapterId(instanceName);
         const { platform } = this.resolveStatusEmojisFor(instanceName);
-        const channel = (worldId ? this.worlds.get(worldId)?.channelConfig : undefined) ?? this.getChannelConfig(worldId ?? undefined);
+        const channel = this.statusEmojiChannel(worldId);
         const current = previewStatusEmojis({ platform, platformConfig: channel?.options?.status_emojis, instanceConfig: self?.status_emojis });
         const out = {
             platform: platform ?? null,
-            statuses: current.entries.map(e => ({ status: e.key, value: e.value, source: e.source })),
+            // #1056: progress_prefix is the emoji at the start of the progress message, not a reaction stamp.
+            statuses: current.entries.map(e => ({ status: e.key, value: e.value, source: e.source, kind: e.key === "progress_prefix" ? "text_prefix" : "reaction" })),
+            // #1056: say inline why the lists differ by platform, so an agent need not know it already.
+            platform_note: platform === "telegram"
+                ? "Telegram has no server custom emoji, so there is no server_emojis list: standard.reactions is the complete set a status reaction can use. progress_prefix is message text, not a reaction, so any single emoji works there."
+                : platform === "discord"
+                    ? "A status reaction can be any single emoji, or a server emoji from server_emojis as <:name:id> (one of the servers this bot is in). progress_prefix is message text, not a reaction."
+                    : "This instance has no chat connection, so no platform rules apply yet.",
             standard: platform === "telegram"
                 ? { reactions: [...TELEGRAM_REACTION_EMOJIS], note: "Telegram reacts only with these; progress_prefix may be any single emoji" }
                 : { suggestions: STATUS_EMOJI_SUGGESTIONS, note: "any single emoji works" },
@@ -9365,6 +9460,9 @@ export class FleetManager {
             const reactorWorlds = new Set(worlds.filter(w => w.botUserId === r.userId).map(w => w.id));
             if (reactorWorlds.size === 0)
                 return false; // a human, or a bot outside this fleet
+            // #1056: what this bot really stamped on this message, whatever its status set says now.
+            if ([...reactorWorlds].some(id => this.stampedStatus.get(`${id}:${r.messageId}`)?.has(key)))
+                return true;
             return [...names]
                 .filter(n => reactorWorlds.has(this.getInstanceAdapterId(n) ?? ""))
                 .some(n => statusMatchKeys(this.resolveStatusEmojisFor(n)).includes(key));
@@ -9372,6 +9470,8 @@ export class FleetManager {
         // Fallback: the built-in ladder (as before #1005) plus every value an
         // operator configured. Not the Telegram built-ins — 👎 is AgEnD's failed
         // stamp there, but also far too common a human reaction to swallow blind.
+        if (worlds.some(w => this.stampedStatus.get(`${w.id}:${r.messageId}`)?.has(key)))
+            return true; // #1056, as above
         const keys = new Set(statusMatchKeys(builtinStatusEmojis(undefined)));
         for (const name of names) {
             const resolved = this.resolveStatusEmojisFor(name);
@@ -9394,9 +9494,15 @@ export class FleetManager {
         const emoji = this.receivedReactionFor(instanceName, adapter, msg.adapterId);
         // Classic's system receipt is status-owned too. An ordinary react call
         // would label it as an agent/other reaction and suppress later statuses.
+        // #1056: recorded as this bot's stamp like the delivery statuses (provenance survives a status-set change) —
+        // on Telegram once the adapter took the slot, on Discord before the add (its gateway can echo it first).
         if (adapter instanceof TelegramAdapter) {
-            return adapter.reactDeliveryStatus(msg.chatId, msg.messageId, emoji, msg.timestamp.getTime()).then(() => { });
+            return adapter.reactDeliveryStatus(msg.chatId, msg.messageId, emoji, msg.timestamp.getTime()).then((took) => {
+                if (took)
+                    this.noteStamped(adapter, msg.messageId, emoji);
+            });
         }
+        this.noteStamped(adapter, msg.messageId, emoji);
         return adapter.react(msg.threadId ?? msg.chatId, msg.messageId, emoji);
     }
     reactClassicForwardedAttachment(instanceName, adapter, msg, kind) {
@@ -9482,8 +9588,10 @@ export class FleetManager {
                 if (await adapter.reactDeliveryStatus(chatId, messageId, emoji, receivedAt)) {
                     if (emoji == null)
                         this.lastStatusEmoji.delete(key);
-                    else
+                    else {
                         this.lastStatusEmoji.set(key, { emoji, status });
+                        this.noteStamped(adapter, messageId, emoji);
+                    }
                 }
                 return;
             }
@@ -9507,6 +9615,8 @@ export class FleetManager {
                 // Best effort: a failed removal must not block the new status.
                 await adapter.unreact(target, messageId, last.emoji, threadId).catch(e => this.logger.debug({ err: e.message }, "Delivery status reaction removal failed"));
             }
+            // Recorded before the add: Discord can report the reaction back before react() resolves.
+            this.noteStamped(adapter, messageId, emoji);
             await adapter.react(target, messageId, emoji, threadId);
             this.lastStatusEmoji.set(key, { emoji, status });
         }
@@ -9694,13 +9804,28 @@ export class FleetManager {
     wasDeliveryIdPrunedForCaller(deliveryId, callerInstance) {
         return this.deliveryOutbox?.wasDeliveryIdPrunedForCaller(deliveryId, callerInstance) ?? false;
     }
+    /** How long opening events.db waits for another process's lock (a field so tests need not wait 5 s). */
+    eventLogBusyTimeoutMs = 5000;
     openEventLog() {
         const dbPath = join(this.dataDir, "events.db");
         try {
-            return new EventLog(dbPath);
+            return new EventLog(dbPath, { busyTimeoutMs: this.eventLogBusyTimeoutMs });
         }
         catch (err) {
-            this.logger.error({ err, dbPath }, "events.db unusable — moving it aside and starting a fresh one");
+            // #1490: only a file SQLite proved corrupt is moved aside. A lock (it outlasted the busy timeout), a driver that
+            // cannot load (ABI), or a permission/I/O problem says nothing against the file: it stays where it is, history
+            // intact, and the fleet runs without event logging until it restarts.
+            const kind = classifySqliteOpenError(err);
+            if (kind !== "corrupt") {
+                const key = kind === "busy" ? "eventlog.locked" : kind === "abi" ? "eventlog.abi" : "eventlog.unopenable";
+                this.logger.error({ err, dbPath, kind }, `events.db not opened (${kind}) — left in place; continuing without event logging`);
+                try {
+                    this.notifyFleetError(t(key));
+                }
+                catch { /* best effort: adapters may not be up yet; the log line stands */ }
+                return null;
+            }
+            this.logger.error({ err, dbPath }, "events.db is corrupt — moving it aside and starting a fresh one");
             const stamp = new Date().toISOString().replace(/[:.]/g, "-");
             for (const suffix of ["", "-wal", "-shm"]) {
                 try {
@@ -9709,7 +9834,7 @@ export class FleetManager {
                 catch { /* may not exist */ }
             }
             try {
-                return new EventLog(dbPath);
+                return new EventLog(dbPath, { busyTimeoutMs: this.eventLogBusyTimeoutMs });
             }
             catch (retryErr) {
                 // History is worth losing; a fleet that won't start is not.
@@ -10253,6 +10378,38 @@ export class FleetManager {
             },
         });
     }
+    cacheService = null;
+    /**
+     * #1468: the prompt-cache expiry analysis for the web, per instance, over `window`. Read from each instance's
+     * ledger as it is now; the first request starts the bounded, persisted catch-up over the transcripts
+     * (cache-service.ts) — never a vendor call, never a synchronous transcript read.
+     */
+    cacheReport(window) {
+        const w = Object.prototype.hasOwnProperty.call(WINDOWS, window) ? window : "7d";
+        this.cacheService ??= new CacheService({
+            // fleet.yaml's instances, then the ClassicBot rooms (their workspace under the AgEnD home, their own backend).
+            instances: () => {
+                const fleet = Object.entries(this.fleetConfig?.instances ?? {}).map(([name, cfg]) => ({
+                    name, backend: this.backendNameOf(name), workingDirectory: cfg.working_directory, ledgerPath: join(this.getInstanceDir(name), "cache-ledger.json"),
+                }));
+                const taken = new Set(fleet.map(i => i.name));
+                const classic = (this.classicChannels?.getAll() ?? []).filter(ch => !taken.has(ch.instanceName)).map(ch => ({
+                    name: ch.instanceName,
+                    backend: this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code",
+                    workingDirectory: join(getAgendHome(), "workspaces", ch.instanceName),
+                    ledgerPath: join(this.getInstanceDir(ch.instanceName), "cache-ledger.json"),
+                }));
+                return [...fleet, ...new Map(classic.map(c => [c.name, c])).values()];
+            },
+            claudeProjectsDir: () => join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude"), "projects"),
+            claudeKey: claudeProjectKey,
+            codexSessionsDir: () => join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "sessions"),
+            listRollouts: root => sharedRolloutIndex(root).list(),
+            metaPath: join(this.dataDir, "cache-codex-rollouts.json"),
+            log: (level, msg, extra) => this.logger[level](extra ?? {}, msg),
+        });
+        return this.cacheService.report(w);
+    }
     /** The web's Acknowledge (any item; a signed-in session is fleet-admin level). */
     acknowledgeNeedsItem(id, principal) {
         if (!this.needsYou)
@@ -10680,29 +10837,18 @@ export class FleetManager {
         });
         return nonce ? null : t("clear.prompt_unavailable");
     }
-    /** Consume `/clear` Confirm/Cancel exactly once; only Confirm reaches IPC. */
-    async handleClearConfirmation(data, callbackAdapterId, receivingAdapter) {
-        const claimed = this.consumeNonceCallback(CLEAR_CONFIRM_CALLBACK_PREFIX, /^clear-confirm:([0-9a-f]+):(confirm|cancel)$/, data, callbackAdapterId, receivingAdapter);
-        if (claimed === null)
-            return false;
-        if (claimed === "consumed")
-            return true;
-        const { entry: pending, action } = claimed;
-        this.eventLog?.insert(pending.instanceName, "clear_action", { action, userId: data.userId });
-        if (action === "cancel") {
-            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("clear.cancelled", pending.instanceName));
-            return true;
-        }
-        // The nonce was claimed synchronously. Keep the exact owner across platform
-        // retirement awaits; a replacement with the same name is not this clear's
-        // target, and a role granted at claim time may be revoked while editing.
-        const ipc = this.instanceIpcClients.get(pending.instanceName);
-        const daemon = this.daemons.get(pending.instanceName);
-        const epoch = this.getDeliveryEpoch(pending.instanceName);
-        const groupId = this.getChannelConfig(callbackAdapterId)?.group_id;
+    /**
+     * What a confirmed /clear must still find when it acts — shared by the platform's Confirm button and the web
+     * (#1269): the same daemon and IPC client, the same interaction owner, lifecycle epoch and delivery epoch as when the
+     * fence was taken. Null when there is no owner to pin (then nothing may be cleared). The reads are cached and
+     * synchronous; they never probe the pane.
+     */
+    clearTargetFence(instanceName) {
+        const ipc = this.instanceIpcClients.get(instanceName);
+        const daemon = this.daemons.get(instanceName);
+        const epoch = this.getDeliveryEpoch(instanceName);
         // Object identity survives a resident daemon's respawn/freeze, and stop
         // invalidates its lifecycle epoch before the queued work replaces objects.
-        // These reads are cached and synchronous; they never probe the pane.
         const readOwner = () => {
             try {
                 const owner = daemon?.getInteractionSnapshot?.()?.owner;
@@ -10718,7 +10864,7 @@ export class FleetManager {
         };
         const readLifecycleEpoch = () => {
             try {
-                const value = this.lifecycle?.epochOf(pending.instanceName);
+                const value = this.lifecycle?.epochOf(instanceName);
                 return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
             }
             catch {
@@ -10726,8 +10872,112 @@ export class FleetManager {
             }
         };
         const owner = readOwner(), lifecycleEpoch = readLifecycleEpoch();
+        if (owner === null || lifecycleEpoch === null)
+            return null;
+        return () => {
+            try {
+                const currentOwner = readOwner();
+                return this.daemons.get(instanceName) === daemon
+                    && this.instanceIpcClients.get(instanceName) === ipc
+                    && currentOwner !== null && sameInteractionOwner(owner, currentOwner)
+                    && readLifecycleEpoch() === lifecycleEpoch
+                    && this.isDeliveryEpochCurrent(instanceName, epoch);
+            }
+            catch {
+                return false;
+            }
+        };
+    }
+    /** #1269: the web's /clear confirmations — one token per question, used once, for the instance as it was asked about. */
+    webClearTokens = new Map();
+    /** #1269: an instance's chat command from the web chat (web-commands.ts); `publicLink`: a gateway request. */
+    webCommand(input, opts) {
+        const webMeta = (instance) => {
+            const topicId = this.fleetConfig?.instances[instance]?.topic_id;
+            return {
+                chatId: this.getGroupIdForInstance(instance) || "", messageId: newWebMessageId(), username: "web-user", userId: "web-user",
+                threadId: topicId != null ? String(topicId) : undefined, adapterId: this.getAdapterForInstance(instance)?.id ?? "", source: "web",
+            };
+        };
+        const choicesFromCache = (instance) => {
+            const cached = this.readCliEnv(this.backendNameForInstance(instance)); // the cached catalog only: never a probe here
+            if (!cached?.models.length)
+                return null;
+            const current = this.resolveInstanceModel(instance).model;
+            return { current, options: cached.models.map(o => ({ id: o.id, label: this.modelChoiceLabel(o, current) })) };
+        };
+        return runWebCommand({
+            // Own entries only: a name like "__proto__" or "constructor" must not be found on the prototype (#1476 review).
+            scope: (instance) => {
+                const instances = this.fleetConfig?.instances;
+                if (instances && Object.prototype.hasOwnProperty.call(instances, instance))
+                    return isGeneralInstance(this.fleetConfig, instance) ? "general" : "fleet";
+                return this.classicChannels?.getChannelIdByInstance(instance) !== undefined ? "classic" : null;
+            },
+            ctx: (instance) => this.topicCommands.getCtxText(instance),
+            compact: (instance, instructions) => this.topicCommands.sendCompact(instance, instructions),
+            applyModel: (instance, name) => this.applyModel(instance, name),
+            modelChoices: choicesFromCache,
+            applyEffort: (instance, level) => this.applyEffort(instance, level),
+            effortChoices: (instance) => {
+                const levels = this.effortLevelsFor(instance);
+                if (!levels.length)
+                    return null;
+                const current = this.resolveInstanceEffort(instance).effort;
+                return { current, options: levels.map(l => ({ id: l, label: this.effortChoiceLabel(l, current) })) };
+            },
+            cancel: (instance) => this.cancelInstance(instance),
+            steer: (instance, text) => this.topicCommands.sendSteer(instance, text, webMeta(instance)),
+            btw: (instance, text) => this.topicCommands.sendBtw(instance, text, webMeta(instance)),
+            pauseWake: (instance, action) => this.topicCommands.runPauseWake(instance, action),
+            save: (instance, filename) => this.topicCommands.sendSave(instance, filename),
+            clearAsk: (instance) => {
+                if (!this.topicCommands.supportsClear(instance))
+                    return { refused: t("clear.unsupported") };
+                const fence = this.clearTargetFence(instance);
+                if (!fence)
+                    return { refused: t("clear.not_connected") };
+                const now = performance.now();
+                for (const [k, v] of this.webClearTokens)
+                    if (v.deadline < now)
+                        this.webClearTokens.delete(k);
+                const token = randomBytes(16).toString("hex");
+                this.webClearTokens.set(token, { instance, fence, deadline: now + CLEAR_CONFIRM_TIMEOUT_MS });
+                return { token, message: t("clear.confirm_message", instance) };
+            },
+            clearConfirm: async (instance, token) => {
+                const entry = this.webClearTokens.get(token);
+                this.webClearTokens.delete(token); // used once, whatever happens next
+                if (!entry || entry.instance !== instance || performance.now() > entry.deadline)
+                    return { status: 409, text: t("clear.expired", instance) };
+                this.eventLog?.insert(instance, "clear_action", { action: "confirm", userId: "web" });
+                // sendClear sends its first IPC synchronously: no await separates this check from the effect.
+                if (this.shuttingDown || !entry.fence())
+                    return { status: 409, text: t("menu.click_stale") };
+                return { status: 200, text: await this.topicCommands.sendClear(instance) };
+            },
+            t: (key, ...args) => t(key, ...args),
+        }, input, opts);
+    }
+    /** Consume `/clear` Confirm/Cancel exactly once; only Confirm reaches IPC. */
+    async handleClearConfirmation(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(CLEAR_CONFIRM_CALLBACK_PREFIX, /^clear-confirm:([0-9a-f]+):(confirm|cancel)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry: pending, action } = claimed;
+        this.eventLog?.insert(pending.instanceName, "clear_action", { action, userId: data.userId });
+        if (action === "cancel") {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("clear.cancelled", pending.instanceName));
+            return true;
+        }
+        // The nonce was claimed synchronously. Keep the exact owner across platform
+        // retirement awaits; a replacement with the same name is not this clear's
+        // target, and a role granted at claim time may be revoked while editing.
+        const target = this.clearTargetFence(pending.instanceName);
+        const groupId = this.getChannelConfig(callbackAdapterId)?.group_id;
         const current = () => {
-            const currentOwner = readOwner();
             try {
                 return !this.shuttingDown
                     && !!data.userId && !!pending.authChannelId
@@ -10739,11 +10989,7 @@ export class FleetManager {
                         ? pending.adapter.type !== "telegram" || pending.chatId === pending.authChannelId
                         : String(this.getChannelConfig(callbackAdapterId)?.group_id ?? "") === pending.chatId)
                     && this.getChannelConfig(callbackAdapterId)?.group_id === groupId
-                    && this.daemons.get(pending.instanceName) === daemon
-                    && this.instanceIpcClients.get(pending.instanceName) === ipc
-                    && owner !== null && currentOwner !== null && sameInteractionOwner(owner, currentOwner)
-                    && lifecycleEpoch !== null && readLifecycleEpoch() === lifecycleEpoch
-                    && this.isDeliveryEpochCurrent(pending.instanceName, epoch);
+                    && target !== null && target();
             }
             catch {
                 return false;
@@ -14623,6 +14869,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // #1386: every live "Needs you" message says the fleet stopped (capabilities revoked first) — while the
         // adapters can still edit. Bounded: a platform that does not answer must not hold the shutdown.
         const needsStopped = this.stopNeedsYou();
+        this.cacheService?.stop();
         const profileStopped = this.runtimeCpuProfiler?.shutdown("fleet shutdown");
         this.ipcStoppingInstances.add("__fleet_stopping__");
         // Release held delivery promises before awaiting daemon shutdown, then