@songsid/agend 2.2.0-alpha.1 → 2.2.0-alpha.3

package/dist/token-env-name.js

@@ -0,0 +1,93 @@
+/**
+ * #1519 P1 (docs/design/ux-onboarding-walkthrough.md §5.2): the env var that holds a connection's bot token is
+ * generated, never asked for — `AGEND_<PLATFORM>_<ID>_TOKEN`, upper-cased, the id reduced to [A-Z0-9_], a numeric
+ * suffix on collision. A name is never one another connection holds, a provider key, a reserved shell name, or a key
+ * already in the data dir's .env or this process's environment: a generated name only ever names a new value.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { isReservedProviderEnvKey, providerRegistryEnvKeys } from "./provider-secret-registry.js";
+import { parseEnvText } from "./env-file.js";
+/** What a token env name must look like (fleet.yaml and the wizard). */
+export const TOKEN_ENV_PATTERN = /^[A-Z][A-Z0-9_]{2,63}$/;
+const sanitize = (s) => s.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+/** `AGEND_<PLATFORM>_TOKEN` for the platform's own id, else `AGEND_<PLATFORM>_<ID>_TOKEN` (a leading "<platform>-" dropped). */
+export function tokenEnvBase(platform, channelId) {
+    const p = sanitize(platform) || "BOT";
+    const lowerId = channelId.toLowerCase(), lowerP = platform.toLowerCase();
+    const rest = lowerId === lowerP ? "" : sanitize(lowerId.startsWith(`${lowerP}-`) ? channelId.slice(platform.length + 1) : channelId);
+    const middle = rest ? `_${rest}` : "";
+    // AGEND_ + P + middle + _TOKEN must fit 64 characters (with room for a "_99" suffix).
+    const room = 64 - "AGEND_".length - p.length - "_TOKEN".length - 4;
+    return `AGEND_${p}${middle.slice(0, Math.max(0, room)).replace(/_+$/, "")}_TOKEN`;
+}
+/** The base name, or with `_2`, `_3`… before `_TOKEN` until it is free. */
+export function generateTokenEnvName(platform, channelId, taken) {
+    const base = tokenEnvBase(platform, channelId);
+    const free = (name) => !taken.has(name) && !isReservedProviderEnvKey(name);
+    if (free(base))
+        return base;
+    const stem = base.slice(0, -"_TOKEN".length);
+    for (let n = 2; n < 10_000; n++) {
+        const candidate = `${stem}_${n}_TOKEN`;
+        if (free(candidate))
+            return candidate;
+    }
+    throw new Error("no free token env name");
+}
+/** The .env could not be read, so which names it holds is unknown — never taken as "none" (#1529 review). */
+export class EnvFileUnreadableError extends Error {
+    constructor(cause) { super(`the data dir's .env cannot be read: ${cause?.message ?? String(cause)}`); }
+}
+/** The names already in the data dir's .env (names only). No file: none. A file that cannot be read throws. */
+export function envFileKeys(dataDir) {
+    let text;
+    try {
+        text = readFileSync(join(dataDir, ".env"), "utf-8");
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return new Set();
+        throw new EnvFileUnreadableError(err);
+    }
+    return new Set(parseEnvText(text).keys()); // the same reading as the fleet's (env-file.ts)
+}
+/**
+ * Why a GENERATED name (#1519 P1) can no longer be written, or null. A generated name only ever names a new value, so
+ * at the write it must still be free of everything the plan avoided — another connection, a provider or reserved name,
+ * a key in .env (read under the caller's lease), one in this process's environment. Throws when .env is unreadable.
+ */
+export function generatedTokenEnvStale(name, opts) {
+    const taken = takenTokenEnvNames({ channelEnvs: opts.channelEnvs, envFile: envFileKeys(opts.dataDir), processEnv: opts.processEnv ?? Object.keys(process.env) });
+    if (taken.has(name) || isReservedProviderEnvKey(name))
+        return `${name} is no longer free (it was taken after this setup was planned) — plan it again`;
+    return null;
+}
+/** Every name a new connection's token must not take. */
+export function takenTokenEnvNames(opts) {
+    const taken = new Set(providerRegistryEnvKeys());
+    for (const name of opts.channelEnvs)
+        if (name)
+            taken.add(name);
+    for (const name of opts.envFile ?? [])
+        taken.add(name);
+    for (const name of opts.processEnv ?? [])
+        taken.add(name);
+    return taken;
+}
+/**
+ * Why `name` cannot be the token env of a NEW connection, or null. Only the names that would make it another holder's
+ * value: another connection's, a provider key, a reserved shell name (a key merely present in .env is allowed when a
+ * caller names it explicitly — the pre-fleet setup form and the CLI do).
+ */
+export function newTokenEnvConflict(name, channels) {
+    if (!TOKEN_ENV_PATTERN.test(name))
+        return "token_env must be an UPPER_SNAKE env var name";
+    if (isReservedProviderEnvKey(name) || providerRegistryEnvKeys().has(name))
+        return `${name} is reserved`;
+    const owner = channels.find(channel => channel.token_env === name);
+    if (owner)
+        return `${name} already holds the token of the "${owner.id}" connection — a new connection never replaces one; use Replace token on that connection`;
+    return null;
+}
+//# sourceMappingURL=token-env-name.js.map

package/dist/token-env-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-env-name.js","sourceRoot":"","sources":["../src/token-env-name.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAEpG,gIAAgI;AAChI,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,SAAiB;IAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,EAAE,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrI,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,sFAAsF;IACtF,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC;AACpF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAiB,EAAE,KAA0B;IAClG,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC;QACvC,IAAI,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5C,CAAC;AAED,6GAA6G;AAC7G,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,KAAc,IAAI,KAAK,CAAC,uCAAwC,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;CAC5H;AAED,+GAA+G;AAC/G,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAC5D,OAAO,GAAG,EAAE,CAAC;QACX,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACxE,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAU,gDAAgD;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,IAA8F;IACjJ,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjK,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,IAAI,gFAAgF,CAAC;IACtJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,kBAAkB,CAAC,IAAyG;IAC1I,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,uBAAuB,EAAE,CAAC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAiE;IACjH,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,+CAA+C,CAAC;IAC1F,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,uBAAuB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACxG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,GAAG,IAAI,oCAAoC,KAAK,CAAC,EAAE,0FAA0F,CAAC;IAChK,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tool-permissions.js

@@ -15,13 +15,15 @@
  *    — not only the ones in cli mode.
  *
  * Which is why keeping a tool out of the schema is a way to spend fewer tokens
- * and get a clearer error, and is not a control. The control is this module,
+ * and get a clearer error, and is not an authorization check. The policy check is this module,
  * called at the points where those four paths converge: the fleet's IPC
  * dispatch and the agent endpoint. See
  * `docs/design/coordinator-tool-perms.zh-TW.md`.
  *
- * Stage 1 wires the callers and records what they would have decided. Nothing
- * here denies anything yet.
+ * This policy is enforced for the identity resolved by the IPC socket or token.
+ * Same-uid agents with a shell can read a sibling's agent.token or connect to
+ * its channel.sock and assume that identity. A tool profile is policy protection,
+ * not an isolation boundary against those agents; that requires OS isolation.
  */
 import { TOOLS } from "./channel/mcp-tools.js";
 /** Everything an agent that is doing the work needs, and nothing that runs the fleet. */

package/dist/tool-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-permissions.js","sourceRoot":"","sources":["../src/tool-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAI/C,yFAAyF;AACzF,MAAM,MAAM,GAAsB;IAChC,qBAAqB;IACrB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,qBAAqB;IACvD,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,gDAAgD;IAChD,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB;IAC3G,4DAA4D;IAC5D,gBAAgB,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa;IAClE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB;IAC5G,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB;IACzE,kBAAkB;IAClB,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB;IACpH,eAAe,EAAE,kBAAkB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,6EAA6E;IAC7E,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB;IACvD,gFAAgF;IAChF,eAAe,EAAE,cAAc;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAAsB;IACvC,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB;IACxD,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB;IACxF,iBAAiB,EAAE,qBAAqB;IACxC,aAAa,EAAE,aAAa,EAAE,aAAa;IAC3C,uBAAuB,EAAE,wBAAwB;IACjD,+EAA+E;IAC/E,iBAAiB;CAClB,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqD;IAC7E,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,MAAM;IACd,WAAW,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;IAC1C,OAAO,EAAE;QACP,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,qBAAqB;QACvD,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa;QACjH,qFAAqF;QACrF,oBAAoB;QACpB,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,eAAe,EAAE,WAAW,EAAE,iBAAiB;QAC3G,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe;QACxE,MAAM,EAAE,gBAAgB,EAAE,eAAe;QACzC,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB;QACzE,0EAA0E;QAC1E,gEAAgE;QAChE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB;QACpD,eAAe,EAAE,kBAAkB;KACpC;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,OAAO,EAAE,cAAc;QAChC,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB;QACzF,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB;QACtI,eAAe,EAAE,kBAAkB;QACnC,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB;QAC/H,gDAAgD;QAChD,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB;KAC1E;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,kEAAkE;IAClE,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,CAAC;CACzK,CAAC;AAEF,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CACrC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CACZ,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAoB;IAC3C,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAoB,EAAE,IAAY;IAC3D,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAkE,EAClE,IAAY,EACZ,eAA4B,QAAQ;IAEpC,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,MAAM,EAAE,aAAa,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAqC;IAC9D,qBAAqB,EAAE,iBAAiB;IACxC,mBAAmB,EAAE,gBAAgB;IACrC,qBAAqB,EAAE,iBAAiB;IACxC,qBAAqB,EAAE,iBAAiB;IACxC,qBAAqB,EAAE,eAAe;IACtC,mBAAmB,EAAE,gBAAgB;IACrC,qBAAqB,EAAE,iBAAiB;IACxC,UAAU,EAAE,MAAM;IAClB,sBAAsB,EAAE,kBAAkB;IAC1C,qBAAqB,EAAE,iBAAiB;IACxC,iBAAiB,EAAE,aAAa;IAChC,uBAAuB,EAAE,mBAAmB;IAC5C,oBAAoB,EAAE,gBAAgB;IACtC,mBAAmB,EAAE,eAAe;IACpC,sBAAsB,EAAE,kBAAkB;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,iBAAiB,EAAE,iBAAiB;IACpC,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,iBAAiB;IACpC,iBAAiB,EAAE,iBAAiB;IACpC,0EAA0E;IAC1E,yEAAyE;IACzE,eAAe,EAAE,eAAe;IAChC,iBAAiB,EAAE,eAAe;IAClC,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,iBAAiB;IACpC,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,kBAAkB;IAC1B,iBAAiB,EAAE,iBAAiB;IACpC,MAAM,EAAE,aAAa;IACrB,eAAe,EAAE,mBAAmB;IACpC,eAAe,EAAE,gBAAgB;IACjC,QAAQ,EAAE,eAAe;IACzB,iBAAiB,EAAE,kBAAkB;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,IAAY;IACnE,OAAO,GAAG,IAAI,yDAAyD,OAAO,mBAAmB,IAAI,6BAA6B;UAC9H,yEAAyE;UACzE,2EAA2E,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,gBAAgB,GAA6B,IAAI,GAAG,CAAc,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAI5G;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoB,EACpB,MAAc,EACd,EAAc,EACd,OAAkG;IAElG,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,EAAE,WAAW,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC1D,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,IAAI,MAAM,CAAC;QACnC,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,MAAM,GAAG,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,2EAA2E;IAC3E,qCAAqC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7D,OAAO,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EACjD,QAAQ,CAAC,MAAM,KAAK,MAAM;YACxB,CAAC,CAAC,mCAAmC,QAAQ,CAAC,MAAM,GAAG;YACvD,CAAC,CAAC,sBAAsB,QAAQ,CAAC,MAAM,eAAe,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzD,OAAO,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,SAAS,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB,CAAC,OAAoB,EAAE,IAAY,EAAE,MAAc,EAAE,SAAiB;IACnG,OAAO,GAAG,IAAI,wBAAwB,OAAO,6DAA6D;UACtG,yBAAyB,MAAM,yCAAyC,SAAS,IAAI;UACrF,sFAAsF;UACtF,yCAAyC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"tool-permissions.js","sourceRoot":"","sources":["../src/tool-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAI/C,yFAAyF;AACzF,MAAM,MAAM,GAAsB;IAChC,qBAAqB;IACrB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,qBAAqB;IACvD,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,gDAAgD;IAChD,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB;IAC3G,4DAA4D;IAC5D,gBAAgB,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa;IAClE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB;IAC5G,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB;IACzE,kBAAkB;IAClB,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB;IACpH,eAAe,EAAE,kBAAkB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,6EAA6E;IAC7E,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB;IACvD,gFAAgF;IAChF,eAAe,EAAE,cAAc;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAAsB;IACvC,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB;IACxD,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB;IACxF,iBAAiB,EAAE,qBAAqB;IACxC,aAAa,EAAE,aAAa,EAAE,aAAa;IAC3C,uBAAuB,EAAE,wBAAwB;IACjD,+EAA+E;IAC/E,iBAAiB;CAClB,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqD;IAC7E,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,MAAM;IACd,WAAW,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;IAC1C,OAAO,EAAE;QACP,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,qBAAqB;QACvD,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa;QACjH,qFAAqF;QACrF,oBAAoB;QACpB,kBAAkB,EAAE,eAAe,EAAE,qBAAqB,EAAE,eAAe,EAAE,WAAW,EAAE,iBAAiB;QAC3G,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe;QACxE,MAAM,EAAE,gBAAgB,EAAE,eAAe;QACzC,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB;QACzE,0EAA0E;QAC1E,gEAAgE;QAChE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB;QACpD,eAAe,EAAE,kBAAkB;KACpC;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,OAAO,EAAE,cAAc;QAChC,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB;QACzF,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB;QACtI,eAAe,EAAE,kBAAkB;QACnC,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB;QAC/H,gDAAgD;QAChD,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB;KAC1E;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,kEAAkE;IAClE,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,CAAC;CACzK,CAAC;AAEF,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CACrC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CACZ,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAoB;IAC3C,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAoB,EAAE,IAAY;IAC3D,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAkE,EAClE,IAAY,EACZ,eAA4B,QAAQ;IAEpC,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,MAAM,EAAE,aAAa,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAqC;IAC9D,qBAAqB,EAAE,iBAAiB;IACxC,mBAAmB,EAAE,gBAAgB;IACrC,qBAAqB,EAAE,iBAAiB;IACxC,qBAAqB,EAAE,iBAAiB;IACxC,qBAAqB,EAAE,eAAe;IACtC,mBAAmB,EAAE,gBAAgB;IACrC,qBAAqB,EAAE,iBAAiB;IACxC,UAAU,EAAE,MAAM;IAClB,sBAAsB,EAAE,kBAAkB;IAC1C,qBAAqB,EAAE,iBAAiB;IACxC,iBAAiB,EAAE,aAAa;IAChC,uBAAuB,EAAE,mBAAmB;IAC5C,oBAAoB,EAAE,gBAAgB;IACtC,mBAAmB,EAAE,eAAe;IACpC,sBAAsB,EAAE,kBAAkB;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,iBAAiB,EAAE,iBAAiB;IACpC,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,iBAAiB;IACpC,iBAAiB,EAAE,iBAAiB;IACpC,0EAA0E;IAC1E,yEAAyE;IACzE,eAAe,EAAE,eAAe;IAChC,iBAAiB,EAAE,eAAe;IAClC,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,iBAAiB;IACpC,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,kBAAkB;IAC1B,iBAAiB,EAAE,iBAAiB;IACpC,MAAM,EAAE,aAAa;IACrB,eAAe,EAAE,mBAAmB;IACpC,eAAe,EAAE,gBAAgB;IACjC,QAAQ,EAAE,eAAe;IACzB,iBAAiB,EAAE,kBAAkB;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,IAAY;IACnE,OAAO,GAAG,IAAI,yDAAyD,OAAO,mBAAmB,IAAI,6BAA6B;UAC9H,yEAAyE;UACzE,2EAA2E,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,gBAAgB,GAA6B,IAAI,GAAG,CAAc,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAI5G;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoB,EACpB,MAAc,EACd,EAAc,EACd,OAAkG;IAElG,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,EAAE,WAAW,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC1D,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,IAAI,MAAM,CAAC;QACnC,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,MAAM,GAAG,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,2EAA2E;IAC3E,qCAAqC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7D,OAAO,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EACjD,QAAQ,CAAC,MAAM,KAAK,MAAM;YACxB,CAAC,CAAC,mCAAmC,QAAQ,CAAC,MAAM,GAAG;YACvD,CAAC,CAAC,sBAAsB,QAAQ,CAAC,MAAM,eAAe,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzD,OAAO,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,SAAS,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB,CAAC,OAAoB,EAAE,IAAY,EAAE,MAAc,EAAE,SAAiB;IACnG,OAAO,GAAG,IAAI,wBAAwB,OAAO,6DAA6D;UACtG,yBAAyB,MAAM,yCAAyC,SAAS,IAAI;UACrF,sFAAsF;UACtF,yCAAyC,CAAC;AAChD,CAAC"}

package/dist/topic-commands.d.ts

@@ -147,27 +147,18 @@ export declare function scrapePaneContext(instanceName: string, backend: string)
     context: number | null;
     tokenRatio: TokenContextRatio | null;
 };
-/** Forget a deleted instance's cached context so the map can't grow forever. */
+/** Forget a deleted instance and revoke any outstanding refresh for its old pane. */
 export declare function forgetInstanceContext(instanceName: string): void;
 /**
- * Single source of truth for instance context % across /ctx, /status, and View.
- * Claude-code prefers statusline.json (authoritative, no TUI scrape); everyone
- * else scrapes the live pane with the same parsers /ctx uses.
- *
- * Non-blocking by default (stale-while-revalidate): a fresh cache entry is
- * returned as-is; a stale or missing one is returned immediately anyway while a
- * background refresh runs. This used to scrape synchronously with `execFileSync`
- * (2s timeout) on a cache miss, and the 12s TTL is LONGER than the dashboard's
- * 10s poll — so roughly every other tick did N blocking captures. With ten
- * non-claude-code instances and a slow tmux that froze the entire fleet event
- * loop for up to 20s per tick: no IPC, no message delivery, no watchdog ping.
- * Three open browser tabs ran three independent polls.
- *
- * Pass `bypassCache` for a synchronous, authoritative read — used by `/ctx`,
- * where a user is asking right now and 2s of blocking is the correct trade.
+ * Shared context percentage for /ctx, /status and View, using the same pane parsers.
+ * Claude Code prefers its authoritative statusline.json.
+ * Polled reads return cached values immediately and refresh through the captured
+ * owner after the monotonic 8s interval. A missing pane owner returns unknown.
+ * Explicit /ctx retains its synchronous authoritative read via bypassCache.
  */
 export declare function resolveInstanceContext(dataDir: string, instanceName: string, backend: string, opts?: {
     bypassCache?: boolean;
+    source?: import("./pane-context-cache.js").PaneContextSource | null;
 }): {
     context: number | null;
     tokenRatio: TokenContextRatio | null;

package/dist/topic-commands.js

@@ -1,3 +1,4 @@
+import { PaneContextCache } from "./pane-context-cache.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
 import { LOOPBACK_HOST_NAMES } from "./web-host-guard.js";
 import { WEB_REMOTE_DOCS_URL } from "./upgrade-notices.js";
@@ -20,7 +21,9 @@ import { isGeneralInstance } from "./general-instance.js";
 import { instanceSupportsSteer } from "./steer-capability.js";
 import { SYSINFO_BACKEND_IDS } from "./backend/types.js";
 import { recordInternalRequest, withOrigin } from "./fleet-control-audit.js";
-import { UPDATE_COMMAND } from "./update-check.js";
+import { resolveInstalledAgend } from "./update-dispatch.js";
+import { resolveUpdateLaunch, watchUpdateLaunch } from "./update-launch.js";
+import { selfCommand } from "./cli-entry.js";
 export { parseContextPercent, parseTokenContextRatio } from "./context-percent.js";
 /** Longest one setMyCommands call may take. */
 const TELEGRAM_COMMANDS_TIMEOUT_MS = 10_000;
@@ -382,60 +385,17 @@ export function scrapePaneContext(instanceName, backend) {
         return { context: null, tokenRatio: null };
     }
 }
-const paneContextCache = new Map();
-// Below the dashboard's 10s SSE tick on purpose: at the previous 12s the cache was
-// guaranteed to be stale on roughly every other tick, which is what made the
-// blocking scrape fire so often. Now a tick either hits the cache or triggers a
-// background refresh, never a synchronous capture.
-const PANE_CONTEXT_CACHE_MS = 8_000;
-/** Instances with a background scrape in flight, so polls don't pile up captures. */
-const paneScrapeInFlight = new Set();
-/** Async twin of scrapePaneContext — same parsers, no blocking. */
-async function scrapePaneContextAsync(instanceName, backend) {
-    try {
-        const socketName = getTmuxSocketName();
-        const baseArgs = ["capture-pane", "-t", `${getTmuxSessionName()}:${instanceName}`, "-p", "-S", "-60"];
-        const tmuxArgs = socketName ? ["-L", socketName, ...baseArgs] : baseArgs;
-        const { promisify } = await import("node:util");
-        const { execFile } = await import("node:child_process");
-        const { stdout } = await promisify(execFile)("tmux", tmuxArgs, { encoding: "utf-8", timeout: 2000 });
-        const pane = stdout.toString();
-        const tokenRatio = backend === "grok" ? parseTokenContextRatio(pane) : null;
-        return { context: tokenRatio?.percentage ?? parseContextPercent(pane), tokenRatio };
-    }
-    catch {
-        return { context: null, tokenRatio: null };
-    }
-}
-/** Refresh one instance's cached context in the background (deduped per instance). */
-function refreshPaneContext(instanceName, backend) {
-    if (paneScrapeInFlight.has(instanceName))
-        return;
-    paneScrapeInFlight.add(instanceName);
-    void scrapePaneContextAsync(instanceName, backend)
-        .then(scraped => { paneContextCache.set(instanceName, { at: Date.now(), ...scraped }); })
-        .finally(() => { paneScrapeInFlight.delete(instanceName); });
-}
-/** Forget a deleted instance's cached context so the map can't grow forever. */
+const paneContextCache = new PaneContextCache();
+/** Forget a deleted instance and revoke any outstanding refresh for its old pane. */
 export function forgetInstanceContext(instanceName) {
-    paneContextCache.delete(instanceName);
+    paneContextCache.forget(instanceName);
 }
 /**
- * Single source of truth for instance context % across /ctx, /status, and View.
- * Claude-code prefers statusline.json (authoritative, no TUI scrape); everyone
- * else scrapes the live pane with the same parsers /ctx uses.
- *
- * Non-blocking by default (stale-while-revalidate): a fresh cache entry is
- * returned as-is; a stale or missing one is returned immediately anyway while a
- * background refresh runs. This used to scrape synchronously with `execFileSync`
- * (2s timeout) on a cache miss, and the 12s TTL is LONGER than the dashboard's
- * 10s poll — so roughly every other tick did N blocking captures. With ten
- * non-claude-code instances and a slow tmux that froze the entire fleet event
- * loop for up to 20s per tick: no IPC, no message delivery, no watchdog ping.
- * Three open browser tabs ran three independent polls.
- *
- * Pass `bypassCache` for a synchronous, authoritative read — used by `/ctx`,
- * where a user is asking right now and 2s of blocking is the correct trade.
+ * Shared context percentage for /ctx, /status and View, using the same pane parsers.
+ * Claude Code prefers its authoritative statusline.json.
+ * Polled reads return cached values immediately and refresh through the captured
+ * owner after the monotonic 8s interval. A missing pane owner returns unknown.
+ * Explicit /ctx retains its synchronous authoritative read via bypassCache.
  */
 export function resolveInstanceContext(dataDir, instanceName, backend, opts) {
     if (backend === "claude-code") {
@@ -445,17 +405,10 @@ export function resolveInstanceContext(dataDir, instanceName, backend, opts) {
     }
     if (opts?.bypassCache) {
         const scraped = scrapePaneContext(instanceName, backend);
-        paneContextCache.set(instanceName, { at: Date.now(), ...scraped });
+        paneContextCache.record(dataDir, instanceName, backend, scraped, opts.source);
         return scraped;
     }
-    const hit = paneContextCache.get(instanceName);
-    if (hit && Date.now() - hit.at < PANE_CONTEXT_CACHE_MS) {
-        return { context: hit.context, tokenRatio: hit.tokenRatio };
-    }
-    // Stale or absent: kick off the refresh and answer with what we have. A brand-new
-    // instance reads as "no data" for one tick rather than blocking the fleet.
-    refreshPaneContext(instanceName, backend);
-    return hit ? { context: hit.context, tokenRatio: hit.tokenRatio } : { context: null, tokenRatio: null };
+    return paneContextCache.resolve(dataDir, instanceName, backend, opts?.source);
 }
 const PROFILE_RE = /^\/profile(?:@\w+)?(?:\s+([\s\S]*))?$/;
 const RESTART_RE = /^\/restart(?:@[A-Za-z0-9_]*)?(?:\s+(.*))?$/i;
@@ -956,7 +909,7 @@ export class TopicCommands {
         // classic channel manager for those so we don't mis-report defaults.backend.
         const backend = this.effectiveBackend(instanceName);
         // Fresh scrape for /ctx (user is asking right now) — bypass short cache.
-        const { context, tokenRatio } = resolveInstanceContext(this.ctx.dataDir, instanceName, backend, { bypassCache: true });
+        const { context, tokenRatio } = resolveInstanceContext(this.ctx.dataDir, instanceName, backend, { bypassCache: true, source: this.ctx.getPaneContextSource?.(instanceName) });
         const contextLine = context == null ? null : formatContextUsageLine(context, tokenRatio);
         // Effective model (resolves per-instance → fleet default → classic channel →
         // the CLI's own default) via the shared resolver, so /ctx and /model agree.
@@ -1368,7 +1321,7 @@ export class TopicCommands {
             // Without this, kiro/grok/codex always showed "-" in the Ctx column.
             const { context } = backend === "-"
                 ? { context: null }
-                : resolveInstanceContext(this.ctx.dataDir, name, backend);
+                : resolveInstanceContext(this.ctx.dataDir, name, backend, { source: this.ctx.getPaneContextSource?.(name) });
             const contextStr = context == null ? "-" : `${Math.round(context)}%`;
             const costCents = this.ctx.costGuard?.getDailyCostCents(name) ?? 0;
             // Merged State (#1052): lifecycle + execution state in one column. The
@@ -1535,15 +1488,29 @@ export class TopicCommands {
         }
         const sent = await adapter.sendText(chatId, t("update.progress.preparing", 0), { threadId });
         this.ctx.beginUpdateProgress?.(adapter, chatId, threadId, sent.messageId);
-        // The CLI picks the channel from the installed version it replaces; see UPDATE_COMMAND.
-        const updateCmd = UPDATE_COMMAND;
+        // The CLI picks the channel from the installed version it replaces; see UPDATE_COMMAND. #1450 C5: the INSTALLED
+        // agend, verified by identity, by absolute path — or a refusal, never whatever `agend` is first on PATH.
+        const installed = await resolveInstalledAgend();
+        if (!installed.ok) {
+            this.ctx.failUpdateProgress?.(`/update cannot verify the installed AgEnD (${installed.reason}). Run \`agend update\` from a shell.`);
+            return;
+        }
         const { spawn } = await import("node:child_process");
         const origin = `command /update by ${msg.adapterId}:${msg.userId}`;
         recordInternalRequest(this.ctx.dataDir, "update", origin);
-        const child = spawn("sh", ["-c", `sleep 2 && ${updateCmd}`], {
+        const launch = await resolveUpdateLaunch(installed.agend);
+        if (!launch.ok) {
+            this.ctx.failUpdateProgress?.(`/update cannot prepare an independent updater (${launch.reason}). Run ` + "`agend update` from a host shell.");
+            return;
+        }
+        if (!this.ctx.hasFleetAdmins(msg.adapterId) || !this.ctx.isFleetAdmin(msg.userId, msg.adapterId) || this.ctx.isFleetStopping()) {
+            this.ctx.failUpdateProgress?.(t("not_authorized"));
+            return;
+        }
+        const child = spawn(launch.command, launch.args, {
             detached: true, stdio: "ignore", env: withOrigin(origin),
         });
-        child.once("error", err => this.ctx.failUpdateProgress?.(err.message));
+        watchUpdateLaunch(child, message => this.ctx.failUpdateProgress?.(message));
         child.unref();
     }
     /** #1302: `/visibility [full|summary|hidden]` in the General topic. */
@@ -1580,7 +1547,9 @@ export class TopicCommands {
         try {
             const { execFile } = await import("node:child_process");
             const { promisify } = await import("node:util");
-            const { stdout } = await promisify(execFile)("agend", ["backend", "doctor", backend], {
+            // This CLI on this Node, not whichever `agend` is first on PATH (#1450 C5).
+            const doctor = selfCommand(["backend", "doctor", backend]);
+            const { stdout } = await promisify(execFile)(doctor.command, doctor.args, {
                 timeout: 30_000,
                 encoding: "utf-8",
             });
@@ -1651,26 +1620,22 @@ export class TopicCommands {
         if (!botToken)
             return;
         let configChanged = false;
+        const channels = this.ctx.fleetConfig?.channels ?? (this.ctx.fleetConfig?.channel ? [this.ctx.fleetConfig.channel] : []);
         for (const [name, config] of Object.entries(this.ctx.fleetConfig.instances)) {
             if (config.topic_id != null)
                 continue;
-            // General topic: determine platform type from channel_id → channels config
+            // #1549 review: the agent's own connection decides — its channel_id, else the first. A topic is made, or a
+            // General bound, only in that connection's chat: an owner that is not configured is left unbound, and nothing
+            // is borrowed from another connection (a topic in the old group, the old bot's General).
+            const ownerId = config.channel_id;
+            const owner = ownerId != null ? channels.find(c => (c.id ?? c.type) === ownerId) : channels[0];
+            if (!owner) {
+                this.ctx.logger.warn({ name, channelId: ownerId }, "Agent's connection is not configured — leaving its topic unbound");
+                continue;
+            }
             if (config.general_topic) {
-                const channels = this.ctx.fleetConfig?.channels ?? (this.ctx.fleetConfig?.channel ? [this.ctx.fleetConfig.channel] : []);
-                let platformType;
-                if (config.channel_id) {
-                    const matched = channels.find(c => (c.id ?? c.type) === config.channel_id);
-                    platformType = matched?.type;
-                }
-                if (!platformType) {
-                    if (name.includes("telegram"))
-                        platformType = "telegram";
-                    else if (name.includes("discord"))
-                        platformType = "discord";
-                }
-                if (platformType === "discord") {
-                    const ch = channels.find(c => c.type === "discord");
-                    const gcid = ch?.options?.general_channel_id;
+                if (owner.type === "discord") {
+                    const gcid = owner.options?.general_channel_id;
                     // A Discord general needs a real channel id — NOT the TG-convention
                     // "1", which makes the DC adapter throw fetching channel "1". Skip
                     // (leave unbound) if there's no valid channel to bind to.
@@ -1684,7 +1649,13 @@ export class TopicCommands {
                     config.topic_id = 1;
                 }
                 configChanged = true;
-                this.ctx.logger.info({ name, topicId: config.topic_id, platformType }, "Bound to General topic");
+                this.ctx.logger.info({ name, topicId: config.topic_id, platformType: owner.type }, "Bound to General topic");
+                continue;
+            }
+            // A new topic is made through the primary connection only (createForumTopic's adapter): an agent of another
+            // connection is not given a topic in the primary's group.
+            if (owner !== channels[0]) {
+                this.ctx.logger.info({ name, channelId: ownerId }, "Agent belongs to another connection — not auto-creating a topic in the primary group");
                 continue;
             }
             try {