@songsid/agend 2.2.0-alpha.2 → 2.2.0-alpha.4

package/dist/fleet-manager.js

@@ -6,6 +6,8 @@ import { SettingsExecution, settingsRevision, noteSettingsWrite, settingsFileRes
 import { performance } from "node:perf_hooks";
 import { gatewayRequestContext } from "./web-request-context.js";
 import { createPublicWebGateway } from "./public-web-gateway.js";
+import { handleWebIconRequest } from "./web-icons.js";
+import { renderPublicLinkProgress, ThrottledMessageEditor } from "./public-link-progress.js";
 import { PublicWebLink, publicLinkSettings } from "./public-web-link.js";
 import { TunnelPurposeLane } from "./tunnel/purpose-lane.js";
 import { ManagedTunnel } from "./tunnel/manager.js";
@@ -14,6 +16,7 @@ import { measureSyncWork } from "./sync-work-attribution.js";
 import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
 import { ProfileControlServer } from "./profile-control.js";
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, constants as fsConstants } from "node:fs";
+import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { freemem, totalmem, cpus, homedir } from "node:os";
@@ -39,7 +42,9 @@ import { STATUS_EMOJI_CONFIG_KEYS, STATUS_EMOJI_KEYS, STATUS_EMOJI_SUGGESTIONS,
 import { isProbeableRouteTarget } from "./fleet-context.js";
 import { loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
+import { binaryProbe } from "./binary-probe.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
+import { OutboxOpenError } from "./outbox-open-error.js";
 import { AdapterWorld } from "./adapter-world.js";
 import { CostGuard, formatCents } from "./cost-guard.js";
 import { startEventLoopWatch } from "./event-loop-watch.js";
@@ -121,8 +126,14 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
 }
 import { handleWebRequest, broadcastSseEvent, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId } from "./web-chat-history.js";
+import { ReplyButtonStore, parseReplyButtons, replyButtonClickText, replyButtonsFallbackText, REPLY_BUTTON_PREFIX } from "./reply-buttons.js";
+import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { publicAttachment, sweepOrphanedUploads, WebFileLedger } from "./web-upload.js";
-import { handleViewRequest, isViewPath } from "./view-api.js";
+import { handleViewRequest, isViewPath, profileIdentities, resolveInstanceIdentity } from "./view-api.js";
+import { envFileKeys } from "./token-env-name.js";
+import { discordGeneralChannelId } from "./discord-general.js";
+import { parseEnvText } from "./env-file.js";
+import { isDisallowedIntentsError, isRejectedTokenError } from "./discord-permissions.js";
 import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
@@ -131,7 +142,8 @@ import { decideSlash } from "./slash-authz.js";
 import { commandSpec, decideCommand, ruleFor } from "./command-table.js";
 import { runVisibilityCommand } from "./cross-instance-notice.js";
 import { installedChannel, isPrereleaseVersion, updateNoticeKey } from "./update-check.js";
-import { resolveInstalledAgend, updateCommand } from "./update-dispatch.js";
+import { resolveInstalledAgend } from "./update-dispatch.js";
+import { resolveUpdateLaunch, watchUpdateLaunch } from "./update-launch.js";
 import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS } from "./login-controller.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
@@ -170,7 +182,7 @@ import { tokenEpoch, WebSessionStore } from "./web-session.js";
 import { WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
 import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
 import { createPreviewListener, previewAvailability, previewSettings } from "./web-preview.js";
-import { fleetLevelDifferences, fleetLevelSignature } from "./fleet-level-config.js";
+import { fleetLevelDifferences, fleetLevelSignature, appendedConnections } from "./fleet-level-config.js";
 import { checkSelfRestartAllowance, recordSelfRestartAttempt } from "./self-restart-limit.js";
 import { SecretStore } from "./secret-store.js";
 import { opaqueId, safeSecretError, SECRET_CHALLENGE_TTL_MS, } from "./connection-secrets.js";
@@ -340,6 +352,7 @@ const WEB_MIRRORED_PROMPT_PREFIXES = new Set([
  */
 const WEB_ONLY_REPLY_SINK = {
     type: "web",
+    supportsReplyButtons: true, // #1266: the web chat shows a reply's buttons itself
     sendText: async () => ({ chatId: "web", messageId: newWebMessageId() }),
     sendFile: async () => ({ chatId: "web", messageId: newWebMessageId() }),
 };
@@ -443,6 +456,8 @@ export class FleetManager {
     dataDir;
     static signalTarget = null;
     static sighupHandlerInstalled = false;
+    /** Test seam: inject a spy to verify saveFleetConfig calls fsync. Default: fsyncSync. */
+    fsyncForTest = undefined;
     children = new Map();
     lifecycle;
     stormWindow;
@@ -839,21 +854,66 @@ export class FleetManager {
                     return false;
                 await settlement;
                 const job = this.providerSecretJobs.get(id) ?? this.connectionSecretJobs.get(id) ?? this.connectionBindingJobs.get(id);
-                return !!job && ["applied", "applied_next_use", "reloaded"].includes(job.result);
+                // restart_required: the value is stored and committed (the receipt is checked above), only no adapter was running
+                // to take it — the change is done, and the page says it starts with the next restart (#1519 P1), never "failed".
+                return !!job && ["applied", "applied_next_use", "reloaded", "restart_required"].includes(job.result);
             },
         });
         this.settingsConfirmation = gate;
         return gate;
     }
+    /** Exact configured effect owners; this does not depend on prompt location. */
+    settingsChatAuthority(store, id) {
+        const scope = store.authorityOf(id);
+        if (!scope || scope.unknown)
+            return null;
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const targets = new Set(scope.connections);
+        let primaryGeneral;
+        const selectPrimary = () => {
+            const generals = Object.entries(this.fleetConfig?.instances ?? {}).filter(([, cfg]) => cfg.general_topic === true);
+            const selected = generals.find(([name]) => this.getInstanceAdapterId(name) === this.getPrimaryAdapterId()) ?? generals[0];
+            const owner = selected && this.getInstanceAdapterId(selected[0]);
+            return selected && owner ? { name: selected[0], owner } : undefined;
+        };
+        if (scope.primaryGeneral) {
+            primaryGeneral = selectPrimary();
+            if (!primaryGeneral)
+                return null;
+            targets.add(primaryGeneral.owner);
+        }
+        const owners = [...targets].map(id => channels.filter(ch => (ch.id ?? ch.type) === id));
+        if (!owners.length || owners.some(matches => matches.length !== 1))
+            return null;
+        const platform = owners[0][0].type;
+        if ((platform !== "telegram" && platform !== "discord") || owners.some(matches => matches[0].type !== platform))
+            return null;
+        const identities = owners.map(matches => ({ id: matches[0].id ?? matches[0].type, type: matches[0].type }));
+        const generation = this.settingsGeneration;
+        const current = () => !this.shuttingDown && this.settingsGeneration === generation
+            && identities.every(owner => {
+                const configs = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+                const matches = configs.filter(ch => (ch.id ?? ch.type) === owner.id);
+                return matches.length === 1 && matches[0].type === owner.type;
+            })
+            && (!primaryGeneral || selectPrimary()?.name === primaryGeneral.name && selectPrimary()?.owner === primaryGeneral.owner);
+        return { platform, current, admin: userId => current() && !!userId
+                && identities.every(owner => this.isFleetAdmin(userId, owner.id)) };
+    }
     async promptSettingsChange(store, view) {
         const generation = this.settingsGeneration;
+        const authority = this.settingsChatAuthority(store, view.id);
+        if (!authority) {
+            this.logger.info({ id: view.id }, "Settings authority is unknown or spans platforms; host CLI confirmation required");
+            return;
+        }
         const excluded = new Set(store.affectedConnections(view.id));
         for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
             if (!config.general_topic)
                 continue;
             const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
             const general = this.daemons.get(name);
-            if (!adapterId || !adapter || !general || excluded.has(adapterId) || !this.hasFleetAdmins(adapterId))
+            if (!adapterId || !adapter || !general || excluded.has(adapterId) || adapter.type !== authority.platform)
                 continue;
             const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
             if (!chatId || !topic)
@@ -866,7 +926,7 @@ export class FleetManager {
                 && this.adapterState.get(adapterId)?.status === "connected"
                 && this.getInstanceAdapterId(name) === adapterId && this.getAdapterForInstance(name) === adapter
                 && this.getGroupIdForInstance(name) === chatId && String(this.fleetConfig?.instances[name]?.topic_id ?? "") === topic
-                && this.hasFleetAdmins(adapterId);
+                && authority.current();
             if (!current())
                 continue;
             try {
@@ -875,7 +935,7 @@ export class FleetManager {
                     message: `🔒 Settings change awaiting fleet-admin confirmation\nSource: ${view.source}\nRequester: ${view.requested_by}\n${view.summary.join("\n")}`,
                     choices: [{ action: "confirm", label: "Confirm" }, { action: "reject", label: "Reject" }],
                     expiredText: "Settings confirmation is no longer pending.", timeoutMs: view.remaining_ms,
-                    extra: { pendingChangeId: view.id, confirmationCurrent: current },
+                    extra: { pendingChangeId: view.id, confirmationCurrent: current, confirmationAdmin: userId => current() && authority.admin(userId) },
                 });
                 void posted.then(nonce => {
                     if (!retired)
@@ -913,7 +973,7 @@ export class FleetManager {
         this.logger.info({ id: view.id }, "Settings change requires local `agend settings confirm <id>`");
     }
     async handleSettingsChangeCallback(data, adapterId, adapter) {
-        const result = this.consumeNonceCallback("settings-confirm:", /^settings-confirm:([0-9a-f]{32}):(confirm|reject)$/, data, adapterId, adapter);
+        const result = this.consumeNonceCallback("settings-confirm:", /^settings-confirm:([0-9a-f]{32}):(confirm|reject)$/, data, adapterId, adapter, undefined, (userId, entry) => entry.confirmationAdmin?.(userId) === true);
         if (!result)
             return false;
         if (result === "consumed")
@@ -923,7 +983,7 @@ export class FleetManager {
             const view = await this.settingsGate().store.decide(entry.pendingChangeId, action, {
                 label: `fleet admin ${data.userId}`,
                 current: () => entry.confirmationCurrent?.() === true && this.getAdapterForInstance(entry.instanceName) === entry.adapter
-                    && !!data.userId && this.isFleetAdmin(data.userId, entry.adapterId),
+                    && !!data.userId && entry.confirmationAdmin?.(data.userId) === true,
             });
             await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, view.outcome?.message ?? "Settings change is applying.");
         }
@@ -996,16 +1056,111 @@ export class FleetManager {
         this.topicArchiver = new TopicArchiver(this);
         this.statuslineWatcher = new StatuslineWatcher(this);
     }
+    /** #1266: a reply's buttons — the store (reply-buttons.db) and what a click does. Created on first use. */
+    replyButtonsCtl = null;
+    /** The store could not be opened in this process: buttons are offered as text until the next start. */
+    replyButtonsUnavailable = false;
+    /**
+     * The controller, or null when reply-buttons.db cannot be opened (#1500 review). That file holds only open choices,
+     * so it never stops AgEnD: the failure is logged and posted once, replies offer their choices as text, and a click on
+     * an older button is answered "closed". The file is left where it is — an open error is not proof of corruption.
+     */
+    replyButtons() {
+        if (this.replyButtonsCtl)
+            return this.replyButtonsCtl;
+        if (this.replyButtonsUnavailable)
+            return null;
+        const path = join(this.dataDir, "reply-buttons.db");
+        let store;
+        try {
+            store = new ReplyButtonStore(path);
+        }
+        catch (err) {
+            this.replyButtonsUnavailable = true;
+            this.logger.error({ err: err.message, path }, "Reply buttons unavailable: reply-buttons.db could not be opened — replies offer their choices as text");
+            try {
+                this.notifyFleetError(`⚠️ Reply buttons are off until AgEnD restarts: ${path} could not be opened (${err.message}). Replies offer their choices as text.`);
+            }
+            catch { /* the notice is best effort */ }
+            return null;
+        }
+        this.replyButtonsCtl = new ReplyButtonsController({
+            store,
+            now: () => Date.now(),
+            adapterFor: (adapterId) => this.worlds.get(adapterId)?.adapter ?? (adapterId === this.getPrimaryAdapterId() ? this.adapter ?? undefined : undefined),
+            mayClick: (set, userId) => this.mayAnswerReplyButtons(set.instance, set.adapterId, userId),
+            deliver: (set, button, by) => this.deliverReplyButtonChoice(set, button, by),
+            publish: (instance, view) => this.emitSseEvent("reply_buttons", { instance, buttons: view }),
+            logger: this.logger,
+            setTimer: (fn, ms) => { const h = setTimeout(fn, ms); h.unref?.(); return h; },
+            clearTimer: (h) => clearTimeout(h),
+        });
+        this.replyButtonsStore = store;
+        return this.replyButtonsCtl;
+    }
+    replyButtonsStore = null;
+    /**
+     * #1266: who may answer a reply's buttons on a platform — whoever may message that instance there: in a ClassicBot
+     * room anyone there (as a typed message), elsewhere someone the sending connection lets speak (#754/#1148), never a
+     * fleet bot.
+     */
+    mayAnswerReplyButtons(instance, adapterId, userId) {
+        if ([...this.worlds.values()].some(w => w.botUserId && w.botUserId === userId))
+            return false;
+        if (this.classicChannels?.getChannelIdByInstance(instance) !== undefined)
+            return true;
+        const access = this.worlds.get(adapterId)?.accessManager ?? (adapterId === this.getPrimaryAdapterId() ? this.accessManager : null);
+        return this.isFleetAdmin(userId, adapterId) || !!access?.isAllowed(userId);
+    }
+    /** #1266: the choice, delivered as an ordinary inbound message from whoever made it, and shown in the web chat. */
+    async deliverReplyButtonChoice(set, button, by) {
+        const content = replyButtonClickText(button);
+        const web = by.source === "web";
+        const ts = new Date().toISOString();
+        const messageId = web ? newWebMessageId() : (set.messageId ?? "");
+        const sent = await this.deliverToInstance(set.instance, {
+            type: "fleet_inbound",
+            content,
+            targetSession: set.instance,
+            meta: {
+                chat_id: set.chatId, message_id: messageId, user: by.username, user_id: by.userId, ts,
+                thread_id: set.threadId, adapter_id: set.adapterId === "web" ? undefined : set.adapterId,
+                source: web ? "web" : (this.worlds.get(set.adapterId)?.adapter.type ?? "web"),
+            },
+        });
+        if (sent === false)
+            return false;
+        this.lastInboundUser.set(set.instance, by.username);
+        this.emitSseEvent("message", {
+            instance: set.instance, sender: by.username, role: "user", text: content, ts, ...(web ? { messageId } : {}),
+        });
+        return true;
+    }
     ensureDeliveryOutbox() {
         if (this.deliveryOutbox)
             return;
-        const outbox = new DeliveryOutbox(join(this.dataDir, "delivery-outbox.db"), this.managerBootId);
-        this.deliveryOutbox = outbox;
-        if (!this.deliveryOutboxRecovered) {
-            const recovered = outbox.recoverForBoot(this.managerBootId);
-            this.logger.info({ ...recovered }, "Recovered durable delivery outbox for this process boot");
-            this.deliveryOutboxRecovered = true;
+        const dbPath = join(this.dataDir, "delivery-outbox.db");
+        let outbox;
+        try {
+            outbox = new DeliveryOutbox(dbPath, this.managerBootId);
+            if (!this.deliveryOutboxRecovered) {
+                const recovered = outbox.recoverForBoot(this.managerBootId);
+                this.logger.info({ ...recovered }, "Recovered durable delivery outbox for this process boot");
+            }
+        }
+        catch (cause) {
+            // Unlike events.db, these rows cannot be discarded: queued messages and uncertain submissions are authoritative.
+            // Publish only a fully recovered store. A partial open/recovery must not authorize admission on a later call.
+            try {
+                outbox?.close();
+            }
+            catch { /* preserve the original failure */ }
+            const error = new OutboxOpenError(dbPath, cause);
+            this.logger.error({ err: cause, dbPath, kind: error.kind }, error.message);
+            throw error;
         }
+        this.deliveryOutbox = outbox;
+        this.deliveryOutboxRecovered = true;
         outbox.on("admitted", () => { this.scheduleDeliveryOutboxPump(); this.wakeCoordinator?.kick(); });
         outbox.on("state", (event) => {
             this.scheduleDeliveryOutboxPump();
@@ -1520,6 +1675,10 @@ export class FleetManager {
         });
         return caller;
     }
+    /** Pure cached admission for command continuations; no IO or update-progress lookup. */
+    isFleetStopping() {
+        return this.shuttingDown;
+    }
     /**
      * Is the fleet going down (or coming back up) on purpose?
      *
@@ -1581,6 +1740,16 @@ export class FleetManager {
     lastActivityMs(name) {
         return this.lastActivity.get(name) ?? 0;
     }
+    /** Capture the current daemon and delivery owner for a background context read. */
+    getPaneContextSource(name) {
+        const daemon = this.daemons.get(name);
+        const source = daemon?.getPaneContextSource?.();
+        if (!daemon || !source || this.shuttingDown)
+            return null;
+        const epoch = this.getDeliveryEpoch(name);
+        return { ...source, generation: `${source.generation}:${epoch}`, isCurrent: () => !this.shuttingDown
+                && this.daemons.get(name) === daemon && this.getDeliveryEpoch(name) === epoch && source.isCurrent() };
+    }
     /**
      * Is the instance between turns?
      *
@@ -1856,7 +2025,7 @@ export class FleetManager {
                 await data.respond(t(`${action}.usage`));
                 return;
             }
-            if (!this.fleetConfig?.instances[requested]) {
+            if (!Object.hasOwn(this.fleetConfig?.instances ?? {}, requested)) {
                 await data.respond(t("instance.not_found", requested));
                 return;
             }
@@ -1912,11 +2081,19 @@ export class FleetManager {
         }
         const origin = `slash /update by ${adapterId}:${data.userId}`;
         recordInternalRequest(this.dataDir, "update", origin);
-        const { command, args } = updateCommand(installed.agend);
-        const child = spawn(command, args, {
+        const launch = await resolveUpdateLaunch(installed.agend);
+        if (!launch.ok) {
+            this.failUpdateProgress(`/update cannot prepare an independent updater (${launch.reason}). Run ` + "`agend update` from a host shell.");
+            return;
+        }
+        if (this.fleetAdminGate(data.userId, adapterId) !== "ok" || this.shuttingDown) {
+            this.failUpdateProgress(t("not_authorized"));
+            return;
+        }
+        const child = spawn(launch.command, launch.args, {
             detached: true, stdio: "ignore", env: withOrigin(origin),
         });
-        child.once("error", err => this.failUpdateProgress(err.message));
+        watchUpdateLaunch(child, message => this.failUpdateProgress(message));
         child.unref();
     }
     async handleProfileSlash(data, adapterId) {
@@ -1938,7 +2115,7 @@ export class FleetManager {
         await this.handleGeneralProfile(general, msg.userId, adapterId, seconds, async (text) => (await adapter.sendText(msg.chatId, text, { threadId: msg.threadId })).messageId);
     }
     async handleGeneralProfile(general, userId, ingressAdapterId, seconds, respond) {
-        if (!general || !this.fleetConfig?.instances[general]?.general_topic) {
+        if (!general || !Object.hasOwn(this.fleetConfig?.instances ?? {}, general) || !this.fleetConfig?.instances[general]?.general_topic) {
             await respond(t("profile.general_only"));
             return;
         }
@@ -3184,7 +3361,9 @@ export class FleetManager {
                     await this.sendLocalDashboard(data, adapterId);
                     return;
                 }
-                await this.showDashboardMenu(owner, data.respondButtons);
+                // Discord shows a deferred reply that is never answered as "the application did not respond".
+                if (!await this.showDashboardMenu(owner, data.respondButtons, data.retireButtons))
+                    await data.respond(t("dashboard.menu_failed"));
             }
         }
         else if (data.command === "restart") {
@@ -3924,18 +4103,17 @@ export class FleetManager {
     /**
      * Probe the same executable set exposed by the web backend catalog.
      *
-     * This deliberately has no cache: an install `/login` ran can add a
+     * This deliberately skips the cache: an install `/login` ran can add a
      * binary to PATH while the fleet process remains alive, and the next bare
      * `/login` must see it without requiring a restart or an explicit cache
-     * invalidation call.
+     * invalidation call. The fresh answers also refresh the shared cache that
+     * `/ui/backends` reads. #1490: async and bounded, never `which` on the event loop; a probe with no answer in time
+     * counts as not installed, as the old timeout did.
      */
-    probeInstalledBackends() {
-        const installed = new Set();
-        for (const [backend, info] of Object.entries(BACKEND_INSTALLATION_INFO)) {
-            if (checkBinaryInstalled(info.binary))
-                installed.add(backend);
-        }
-        return installed;
+    async probeInstalledBackends() {
+        const entries = Object.entries(BACKEND_INSTALLATION_INFO);
+        const found = await Promise.all(entries.map(([, info]) => binaryProbe.probe(info.binary, { fresh: true })));
+        return new Set(entries.filter((_, i) => { const r = found[i]; return r.known && r.path !== null; }).map(([backend]) => backend));
     }
     /**
      * One fleet-level notice per burst, not one per instance: a post-update herd
@@ -4294,24 +4472,10 @@ export class FleetManager {
         if (!existsSync(envPath))
             return;
         assertSettingsLease(settingsFileResource(envPath), owner);
-        const content = readFileSync(envPath, "utf-8");
-        for (const line of content.split("\n")) {
-            const trimmed = line.trim();
-            if (!trimmed || trimmed.startsWith("#"))
-                continue;
-            const eqIdx = trimmed.indexOf("=");
-            if (eqIdx < 0)
-                continue;
-            // Accept `export KEY=value` — the shell-style form people paste from their
-            // .bashrc. Without this the variable landed in process.env under the key
-            // "export KEY" and silently did nothing.
-            const key = trimmed.slice(0, eqIdx).replace(/^export\s+/, "").trim();
-            const raw = trimmed.slice(eqIdx + 1);
-            const value = raw.replace(/^["'](.*)["']$/, '$1');
-            // .env file always wins over inherited shell env vars, so that
-            // quickstart's newly written token overrides any stale value.
+        // .env file always wins over inherited shell env vars, so that quickstart's newly written token overrides any stale
+        // value. One parser for every reader of .env (env-file.ts): `export KEY=value` included.
+        for (const [key, value] of parseEnvText(readFileSync(envPath, "utf-8")))
             process.env[key] = value;
-        }
     }
     /** Initialize auth before any adapter can answer /dashboard. */
     initializeWebAuthTokens() {
@@ -4440,11 +4604,15 @@ export class FleetManager {
             await adapter?.sendText(msg.chatId, t("dashboard.public_general"), { threadId: msg.threadId });
             return;
         }
-        await this.showDashboardMenu(owner);
+        if (!await this.showDashboardMenu(owner)) {
+            await owner.binding.sendText(owner.chatId, t("dashboard.menu_failed"), { threadId: owner.threadId }).catch(() => undefined);
+        }
     }
     async sendLocalDashboard(data, adapterId) {
-        if (this.shuttingDown || !this.hasFleetAdmins(adapterId) || !this.isFleetAdmin(data.userId, adapterId))
+        if (this.shuttingDown || !this.hasFleetAdmins(adapterId) || !this.isFleetAdmin(data.userId, adapterId)) {
+            await data.respond(t("not_authorized"));
             return;
+        }
         const text = this.topicCommands.getDashboardText();
         const adapter = this.adapters.get(adapterId);
         const token = this.webToken;
@@ -4466,7 +4634,8 @@ export class FleetManager {
                 await withinBudget(adapter.sendDirect(data.userId, privateText, { disablePreview: true }), Math.min(deadline, performance.now() + 5_000));
                 deliveredByDm = true;
             }
-            catch {
+            catch (err) {
+                this.logDashboardDmFailure(err);
                 if (!current())
                     throw new Error("owner changed");
                 const id = await withinBudget(data.respond(privateText), deadline); // native slash response is already ephemeral
@@ -4476,15 +4645,25 @@ export class FleetManager {
             if (!current())
                 throw new Error("owner changed");
             if (deliveredByDm)
-                await withinBudget(data.respond(t("dashboard.private_sent")), deadline);
+                await withinBudget(data.respond(t("dashboard.private_sent_dm")), deadline);
         }
-        catch {
+        catch (err) {
             this.webLoginCodes.revokeIfCurrent(login.issuanceId);
+            this.logger.info({ err: err?.message }, "Dashboard private delivery was not confirmed");
+            await data.respond(t("dashboard.private_failed")).catch(() => undefined);
         }
     }
-    async showDashboardMenu(owner, respondButtons) {
-        if (!this.publicOwnerCurrent(owner))
-            return;
+    /** Why the DM did not go, for the log only (Discord 50007 = the user does not accept DMs from this server's members). */
+    logDashboardDmFailure(err) {
+        const code = err?.code;
+        this.logger.info({ code: typeof code === "string" || typeof code === "number" ? code : undefined, err: err?.message }, "Dashboard DM not delivered; answering privately where the command was used");
+    }
+    /** False when the menu was not shown (the caller still owes the user an answer). */
+    async showDashboardMenu(owner, respondButtons, retireButtons) {
+        if (!this.publicOwnerCurrent(owner)) {
+            this.logger.info("Dashboard menu not shown: the General owner changed");
+            return false;
+        }
         const adapter = owner.binding;
         const status = this.getPublicWebStatus();
         const publicAllowed = publicLinkSettings(this.fleetConfig?.web).allowed;
@@ -4494,7 +4673,7 @@ export class FleetManager {
         const choices = [{ action: "local", label: t("dashboard.local") },
             ...(publicLinkSettings(this.fleetConfig?.web).allowed ? [{ action: "public", label: t("dashboard.public_open") }] : []),
             ...(status.state !== "closed" ? [{ action: "close", label: t("dashboard.public_close") }] : [])];
-        await this.postNonceButtonPromptOrThrow({
+        const posted = await this.postNonceButtonPrompt({
             prefix: "dashboard:", alertType: "login", instanceName: "dashboard", adapter, adapterId: owner.adapterId,
             chatId: owner.chatId, threadId: owner.threadId, timeoutMs: 5 * 60_000,
             message: menuText,
@@ -4503,9 +4682,11 @@ export class FleetManager {
                     const messageId = await respondButtons(menuText, c);
                     if (!messageId)
                         throw new Error("menu refused");
-                    return { chatId: owner.chatId, threadId: owner.threadId, messageId };
+                    // The menu is the command's ephemeral reply: only that interaction can collapse it.
+                    return { chatId: owner.chatId, threadId: owner.threadId, messageId, ...(retireButtons ? { retire: retireButtons } : {}) };
                 } } : {}),
         });
+        return posted !== null;
     }
     async handleDashboardCallback(data, adapterId, adapter) {
         const claimed = this.consumeNonceCallback("dashboard:", /^dashboard:([0-9a-f]{32}):(local|public|close)$/, data, adapterId, adapter);
@@ -4525,9 +4706,26 @@ export class FleetManager {
             const result = await this.publicWebLink?.close("admin close", entry.publicExposureId);
             if (result?.confirmed === false)
                 data.ack?.(t("dashboard.public_cleanup"));
-            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("dashboard.public_closed"));
+            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("dashboard.public_closed"), data.editClicked);
             return true;
         }
+        // The click is claimed and its buttons are spent: say so on the menu now. A public link follows each of its steps
+        // there (the first one installs cloudflared, which can take a minute): on Discord through the interaction, on
+        // Telegram by editing the menu message itself. Only static words and numbers — the menu may be in General.
+        const progressEdit = data.editClicked ?? entry.retire;
+        const progress = progressEdit && action !== "public"
+            ? progressEdit(t("dashboard.private_sending")).catch(err => this.logger.debug({ err }, "Could not show the dashboard menu's progress"))
+            : Promise.resolve();
+        const stepsEdit = progressEdit ?? (entry.messageId && entry.adapter.editMessageRemoveButtons
+            ? (text) => entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, text, entry.threadId) : undefined);
+        const steps = action === "public" && stepsEdit ? new ThrottledMessageEditor({
+            edit: stepsEdit, now: () => performance.now(), heartbeatMs: 5_000,
+            // Telegram counts edits against a group's ~20 messages a minute.
+            minIntervalMs: owner.binding.type === "telegram" ? 3_000 : 2_000,
+            onError: err => this.logger.debug({ err }, "Could not show the public link's progress"),
+        }) : null;
+        let lastSteps;
+        let deliveredByDm = false;
         const send = async (url, exposureId, expiresAt, current = () => this.publicOwnerCurrent(owner)) => {
             const token = this.webToken;
             if (!token || !current())
@@ -4542,9 +4740,12 @@ export class FleetManager {
                     try {
                         if (!direct.sendDirect)
                             throw new Error("DM unavailable");
-                        return await withinBudget(direct.sendDirect(owner.userId, text, { disablePreview: true, choices: c }), Math.min(deadline, performance.now() + 5_000));
+                        const sent = await withinBudget(direct.sendDirect(owner.userId, text, { disablePreview: true, choices: c }), Math.min(deadline, performance.now() + 5_000));
+                        deliveredByDm = true;
+                        return sent;
                     }
-                    catch {
+                    catch (err) {
+                        this.logDashboardDmFailure(err);
                         if (direct.type !== "discord" || !data.respondPrivate || !current())
                             throw new Error("private delivery unavailable");
                         const sent = await withinBudget(data.respondPrivate(text, c), deadline);
@@ -4563,17 +4764,31 @@ export class FleetManager {
                     throw new Error("owner changed");
                 return true;
             }
-            catch {
+            catch (err) {
                 this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
-                this.logger.info("Dashboard private delivery was not confirmed");
+                this.logger.info({ err: err?.message }, "Dashboard private delivery was not confirmed");
                 return false;
             }
         };
-        const ok = action === "public"
-            ? await this.getPublicWebLink().deliver(owner, link => send(link.url, link.exposureId, link.expiresAt, link.isCurrent))
-            : await send(`http://${this.fleetConfig?.hostname || "localhost"}:${this.fleetConfig?.health_port ?? 19280}/signin`);
+        let ok = false;
+        try {
+            ok = action === "public"
+                ? await this.getPublicWebLink().deliver(owner, link => send(link.url, link.exposureId, link.expiresAt, link.isCurrent), p => {
+                    lastSteps = p;
+                    steps?.update(() => renderPublicLinkProgress(p, performance.now()));
+                })
+                : await send(`http://${this.fleetConfig?.hostname || "localhost"}:${this.fleetConfig?.health_port ?? 19280}/signin`);
+        }
+        catch (err) {
+            // Still closes the step editor below and tells the clicker: a throw must not leave the menu refreshing.
+            this.logger.warn({ err }, "Dashboard sign-in delivery failed");
+        }
         // Only safe, static words enter General; never link, code or platform error text.
-        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t(ok ? "dashboard.private_sent" : "dashboard.private_failed"));
+        const outcome = t(!ok ? "dashboard.private_failed"
+            : owner.binding.type !== "discord" ? "dashboard.private_sent" : deliveredByDm ? "dashboard.private_sent_dm" : "dashboard.private_sent_here");
+        await progress;
+        await steps?.close(); // the last step edit has landed: the outcome cannot be overwritten by it
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, lastSteps ? renderPublicLinkProgress(lastSteps, performance.now(), outcome) : outcome, data.editClicked);
         return true;
     }
     /** `/dashboard revoke`: sign out every browser and withdraw any unused code. */
@@ -4986,8 +5201,8 @@ export class FleetManager {
         for (const need of [...needsGeneral]) {
             const matchIdx = unboundGenerals.findIndex(([, inst]) => {
                 const topicId = String(inst.topic_id ?? "");
-                if (need.ch.type === "discord" && need.ch.options?.general_channel_id) {
-                    return topicId === String(need.ch.options.general_channel_id);
+                if (need.ch.type === "discord" && discordGeneralChannelId(need.ch)) {
+                    return topicId === discordGeneralChannelId(need.ch);
                 }
                 if (need.ch.type === "telegram") {
                     return topicId === "1" || topicId === "";
@@ -5285,6 +5500,8 @@ export class FleetManager {
         }
         // Health HTTP endpoint
         this.startHealthServer(fleet.health_port ?? 19280);
+        // #1266: buttons that ended while AgEnD was down (expired, or chosen before a restart) are shown as ended now.
+        void this.replyButtons()?.sweep().catch(err => this.logger.warn({ err }, "Reply-button sweep failed"));
         // Daily update check — first check after 1 hour, then every 24 hours
         this.updateCheckTimer = setTimeout(() => {
             this.checkForUpdates();
@@ -6438,26 +6655,64 @@ export class FleetManager {
         return undefined;
     }
     /**
-     * #1085, defense in depth: a routed Telegram target must belong to the group
-     * the message came from — its own world's group_id. Two Telegram fleet
-     * worlds can number topics alike; a coincidence is dropped, never delivered.
+     * A forum-root command has one configured General before any adapter claims
+     * dedup. Bare commands prefer the primary adapter's General in this group;
+     * explicit suffixes select their own bot. Runtime availability must not pick
+     * another administrator, so stopped owners remain selected and every copy
+     * silently refuses instead of falling back.
+     * undefined = another ingress scope; null = root command with no proven target.
      */
+    telegramRootCommandTarget(msg, threadId) {
+        if (msg.source !== "telegram" || threadId !== undefined || !/^\/\w/.test(msg.text?.trim() ?? ""))
+            return undefined;
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const receiving = channels.find(ch => (ch.id ?? ch.type) === msg.adapterId);
+        if (receiving?.type !== "telegram" || receiving.group_id == null || String(receiving.group_id) !== msg.chatId)
+            return undefined;
+        const generals = Object.entries(this.fleetConfig?.instances ?? {}).filter(([, cfg]) => cfg.general_topic === true)
+            .map(([name]) => {
+            const owner = this.getInstanceAdapterId(name);
+            return { name, owner, channel: channels.find(ch => (ch.id ?? ch.type) === owner) };
+        });
+        const candidates = generals.filter(entry => entry.owner && entry.channel?.type === "telegram"
+            && entry.channel.group_id != null && String(entry.channel.group_id) === msg.chatId);
+        const suffix = msg.text?.trim().match(/^\/[\w-]+@(\S+)/)?.[1];
+        let selected;
+        if (suffix) {
+            const matches = candidates.filter(entry => this.worlds.get(entry.owner)?.botUsername?.toLowerCase() === suffix.toLowerCase());
+            const owners = new Set(matches.map(entry => entry.owner));
+            if (owners.size !== 1)
+                return null;
+            selected = matches[0];
+        }
+        else {
+            // An unresolvable General may be the intended primary; do not silently
+            // widen authority to the next readable binding.
+            if (generals.some(entry => !entry.channel || (entry.channel.type === "telegram" && entry.channel.group_id == null)))
+                return null;
+            selected = candidates.find(entry => entry.owner === this.getPrimaryAdapterId()) ?? candidates[0];
+        }
+        return selected?.owner ? { name: selected.name, owner: selected.owner } : null;
+    }
     /**
      * #1346: whether this copy may claim the shared dedup key for
      * command-like text. Fleet topics resolve an owning adapter and only its
      * copy proceeds. Classic targets and unknown routing keep their existing
-     * handling. At the receiving Telegram world's own forum root, an explicit
-     * suffix requires a known matching username before dedup; present-thread
+     * handling. Telegram forum-root commands select a configured General before
+     * dedup. An explicit suffix requires a known matching username; present-thread
      * copies retain their permissive handling when that identity is unknown.
      */
-    isOwnerCommandCopy(msg, threadId) {
+    isOwnerCommandCopy(msg, threadId, rootCommand = this.telegramRootCommandTarget(msg, threadId)) {
+        if (rootCommand !== undefined) {
+            return rootCommand !== null && msg.adapterId === rootCommand.owner && this.daemons.has(rootCommand.name);
+        }
         if (!msg.adapterId)
             return true;
         const suffix = msg.text?.trim().match(/^\/[\w-]+@(\S+)/)?.[1];
         if (threadId === undefined) {
-            // General at the forum root belongs to the receiving world. Prove an
-            // explicit suffix before shared dedup, even when there is no message id.
-            // Classic/private/foreign-forum copies retain their own dispatch rules.
+            // Compatibility for a runtime world without configuration: preserve
+            // explicit receiver proof; Classic/private/foreign-forum copies retain
+            // their own dispatch rules.
             const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
             const channel = channels.find(ch => (ch.id ?? ch.type) === msg.adapterId)
                 ?? this.worlds.get(msg.adapterId)?.channelConfig;
@@ -6487,6 +6742,9 @@ export class FleetManager {
         }
         return true;
     }
+    /**
+     * #1085: coincident topic numbers must not route across Telegram groups.
+     */
     resolveInboundTarget(msg, threadId) {
         if (msg.source !== "telegram")
             return this.routing.resolve(threadId);
@@ -6523,6 +6781,7 @@ export class FleetManager {
             return;
         }
         const threadId = this.inboundRouteThreadId(msg);
+        const rootCommand = this.telegramRootCommandTarget(msg, threadId);
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
         // Ownership and per-adapter filtering both run before the dedup claim below.
         // When several bots share a guild they all receive the same message; a copy
@@ -6583,7 +6842,7 @@ export class FleetManager {
         // to flow — so only fleet targets are judged here; the in-handler gates
         // (owner entry check, Discord ignore) cover classic instead.
         if ((msg.messageId || (msg.source === "telegram" && threadId === undefined))
-            && /^\/\w/.test(msg.text?.trim() ?? "") && !this.isOwnerCommandCopy(msg, threadId)) {
+            && /^\/\w/.test(msg.text?.trim() ?? "") && !this.isOwnerCommandCopy(msg, threadId, rootCommand)) {
             this.logger.debug({ adapterId: msg.adapterId, threadId }, "Non-owner command copy — skipping before dedup claim");
             return;
         }
@@ -6890,7 +7149,7 @@ export class FleetManager {
             }
             // General topic: Discord /xxx gets the system note first (never a
             // command); other sources fall through to the handlers below.
-            const generalInstance = this.findGeneralInstance(msg.adapterId);
+            const generalInstance = rootCommand?.name ?? this.findGeneralInstance(msg.adapterId);
             if (generalInstance && await this.replyDiscordNotACommand(msg, generalInstance))
                 return;
             if (generalInstance && await this.topicCommands.handleInstanceCommand(msg, generalInstance))
@@ -7279,6 +7538,12 @@ export class FleetManager {
                     return;
                 }
             }
+            // #1266: buttons are checked before anything is sent, like stickers.
+            const parsedButtons = parseReplyButtons(args.buttons, args);
+            if (parsedButtons && "error" in parsedButtons) {
+                respond(null, `reply: ${parsedButtons.error}`);
+                return;
+            }
             // Stickers (#1226) are checked before anything is sent: a refused one is the reply's error, not a gap.
             const stickerProblem = await this.replyStickerProblem(outAdapter, args, threadId, contextAdapterId ?? this.getInstanceAdapterId(senderInstanceName ?? instanceName));
             if (stickerProblem) {
@@ -7291,8 +7556,33 @@ export class FleetManager {
                 ticket.subscribe(respond);
                 return;
             }
+            // #1266: the buttons' set, before the send (a click cannot match it until the message is known). Where buttons
+            // cannot be shown, the choices go into the text instead.
+            let replySet = null;
+            if (parsedButtons && "buttons" in parsedButtons) {
+                const buttons = outAdapter.supportsReplyButtons ? this.replyButtons() : null;
+                if (buttons) {
+                    const outId = outAdapter === WEB_ONLY_REPLY_SINK ? "web" : outAdapter.id ?? contextAdapterId ?? "";
+                    replySet = buttons.prepare({ instance: instanceName, adapterId: outId, chatId: String(args.chat_id ?? ""), threadId }, parsedButtons.buttons);
+                }
+                else {
+                    args.text = `${String(args.text)}\n\n${replyButtonsFallbackText(parsedButtons.buttons)}`;
+                }
+            }
             const original = respond;
             const respondAndRecord = (result, error) => {
+                let buttonsView = null;
+                if (replySet) {
+                    const sent = result;
+                    const carrying = sent?.buttonsMessageId ?? sent?.messageId;
+                    if (!error && carrying) {
+                        this.replyButtonsCtl?.bind(replySet.id, carrying);
+                        buttonsView = this.replyButtonsCtl?.viewOf(replySet.id) ?? null;
+                    }
+                    else {
+                        this.replyButtonsCtl?.discard(replySet.id);
+                    }
+                }
                 ticket.complete(result, error);
                 // Return the platform outcome first. Bookkeeping below must never turn
                 // a confirmed Discord/Telegram POST into a tool error if a secondary
@@ -7305,7 +7595,7 @@ export class FleetManager {
                 // an agent cannot invent it to suppress the normal completion marker.
                 if (!error && result != null && msg.statusOnly !== true) {
                     try {
-                        this.afterReplyRouted(instanceName, args, senderSessionName);
+                        this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView);
                     }
                     catch (err) {
                         this.logger.warn({ err, instanceName }, "Reply delivered but post-delivery bookkeeping failed");
@@ -7320,9 +7610,11 @@ export class FleetManager {
                     });
                 }
             };
-            if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord)) {
+            if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord, replySet ? { replyButtons: replySet.callbacks } : {})) {
                 return;
             }
+            if (replySet)
+                this.replyButtonsCtl?.discard(replySet.id);
             // routeToolCall knows "reply"; not handling it means the world changed.
             ticket.complete(null, "reply not handled");
             original(null, "reply not handled");
@@ -7356,7 +7648,7 @@ export class FleetManager {
     webOnlyPromptPlace() {
         return this.worlds.size === 0 && this.isWebOnlyFleet() ? { adapter: WEB_ONLY_PROMPT_SINK, adapterId: "web", chatId: "web" } : null;
     }
-    afterReplyRouted(instanceName, args, senderSessionName) {
+    afterReplyRouted(instanceName, args, senderSessionName, buttons = null) {
         // A reply is NOT proof the turn is over (#410) — but it is not proof of
         // more work either. Split the difference: an instance that is clearly
         // idle loses the button now; one that looks busy keeps it (re-posted
@@ -7387,6 +7679,7 @@ export class FleetManager {
             text: (args.text ?? "").slice(0, WEB_CHAT_TEXT_MAX),
             ts: new Date().toISOString(),
             ...(attachments.length ? { attachments } : {}),
+            ...(buttons ? { buttons } : {}), // #1266
         });
         // Log bot reply to classic instance chat-log
         const isClassic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined;
@@ -8590,22 +8883,23 @@ export class FleetManager {
         const output = String(this.rawFleetDocument);
         if (redundantPaths.length > 0)
             this.writeFleetConfigBackup(source);
-        const tempPath = `${this.configPath}.tmp-${process.pid}`;
-        writeFileSync(tempPath, output, "utf-8");
-        // #1056 (Fable's 2.2 audit): the patcher writes leaves, not configs, so a wrong patch can produce a file the
-        // validator — or the next start — refuses (a bare channels[0], a channels list with a null). Load and validate
-        // what is about to replace fleet.yaml; a result that adds an error is not written, and the save fails instead.
-        const refusal = this.savedFleetConfigProblem(tempPath);
-        if (refusal) {
-            try {
-                unlinkSync(tempPath);
-            }
-            catch { /* already gone */ }
-            throw new Error(refusal);
-        }
-        if (existsSync(this.configPath))
-            chmodSync(tempPath, statSync(this.configPath).mode);
-        renameSync(tempPath, this.configPath);
+        // Atomic write with fsync. The beforeRename hook runs after fsync and
+        // before rename so validation failures are reported before the file is
+        // replaced (#1056), and the temp file is cleaned up on any throw.
+        atomicWriteFileSync(this.configPath, output, {
+            mode: existsSync(this.configPath) ? statSync(this.configPath).mode : 0o644,
+            fsync: this.fsyncForTest,
+            beforeRename: (tempPath) => {
+                // #1056 (Fable's 2.2 audit): the patcher writes leaves, not configs, so
+                // a wrong patch can produce a file the validator — or the next start —
+                // refuses. Load and validate what is about to replace fleet.yaml.
+                const refusal = this.savedFleetConfigProblem(tempPath);
+                if (refusal)
+                    throw new Error(refusal);
+                if (existsSync(this.configPath))
+                    chmodSync(tempPath, statSync(this.configPath).mode);
+            },
+        });
         this.rawFleetConfig = loadRawFleetConfig(this.configPath);
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.logger.info({ path: this.configPath, strippedDefaults: redundantPaths.length }, "Saved fleet config (lossless patch)");
@@ -9916,9 +10210,9 @@ export class FleetManager {
         if (generalTopic != null)
             return { chatId, opts: { threadId: String(generalTopic) } };
         if (cfg?.type === "discord") {
-            const configured = cfg.options?.general_channel_id;
-            if (configured != null && String(configured)) {
-                return { chatId, opts: { threadId: String(configured) } };
+            const configured = discordGeneralChannelId(cfg);
+            if (configured) {
+                return { chatId, opts: { threadId: configured } };
             }
             return null; // a guild id is not a channel; sending would always fail
         }
@@ -10110,9 +10404,7 @@ export class FleetManager {
                 return;
             this.pendingNonceButtons.delete(nonce);
             this.webPromptGone(entry, entry.expiredText);
-            if (entry.messageId && entry.adapter.editMessageRemoveButtons) {
-                entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId).catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to expire button prompt"));
-            }
+            this.collapseNoncePrompt(entry)?.catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to expire button prompt"));
         }, opts.timeoutMs ?? NONCE_BUTTON_TIMEOUT_MS);
         entry.timer.unref?.();
         this.pendingNonceButtons.set(nonce, entry);
@@ -10136,6 +10428,8 @@ export class FleetManager {
                 entry.threadId = sent.threadId;
             }
             entry.messageId = sent.messageId;
+            if (sent.retire)
+                entry.retire = sent.retire;
             // Offered on the dashboard only once it is live on the platform (a failed post is disarmed above),
             // and only if nothing claimed or expired it meanwhile.
             if (WEB_MIRRORED_PROMPT_PREFIXES.has(opts.prefix) && this.pendingNonceButtons.get(nonce) === entry) {
@@ -10167,7 +10461,7 @@ export class FleetManager {
      * longer parses) collapses the clicked message so the dead button stops
      * inviting clicks — the same courtesy the cancel button extends.
      */
-    consumeNonceCallback(prefix, actionRe, data, callbackAdapterId, receivingAdapter, staleHandling) {
+    consumeNonceCallback(prefix, actionRe, data, callbackAdapterId, receivingAdapter, staleHandling, authorize) {
         if (!data.callbackData.startsWith(prefix))
             return null;
         const match = data.callbackData.match(actionRe);
@@ -10186,6 +10480,9 @@ export class FleetManager {
             if (staleHandling?.keepText && adapter?.removeMessageButtons) {
                 adapter.removeMessageButtons(data.chatId, data.messageId, data.threadId).catch(collapseFailed);
             }
+            else if (data.editClicked) {
+                data.editClicked(t("buttons.stale")).catch(collapseFailed);
+            }
             else {
                 adapter?.editMessageRemoveButtons?.(data.chatId, data.messageId, t("buttons.stale"), data.threadId).catch(collapseFailed);
             }
@@ -10204,11 +10501,13 @@ export class FleetManager {
         const isAuthorized = fromWeb
             ? pending.web !== undefined
             : data.userId
-                ? pending.allowAnyUser
-                    ? true
-                    : pending.authChannelId
-                        ? this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
-                        : this.isFleetAdmin(data.userId, callbackAdapterId)
+                ? authorize
+                    ? authorize(data.userId, pending)
+                    : pending.allowAnyUser
+                        ? true
+                        : pending.authChannelId
+                            ? this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
+                            : this.isFleetAdmin(data.userId, callbackAdapterId)
                 : false;
         const mismatchedFields = [];
         if (pending.adapterId !== callbackAdapterId)
@@ -10282,6 +10581,14 @@ export class FleetManager {
     }
     /** Routes a click to the handler that owns its prefix; false when none does. */
     async dispatchAdapterCallback(data, adapterId, adapter) {
+        if (data.callbackData.startsWith(REPLY_BUTTON_PREFIX)) { // #1266
+            const buttons = this.replyButtons();
+            if (!buttons) {
+                data.ack?.(t("reply_buttons.closed"));
+                return true;
+            }
+            return buttons.handleCallback(data, adapterId);
+        }
         if (this.needsYou?.handleCallback(data, adapterId))
             return true;
         if (await this.handleTipDismiss(data, adapterId, adapter))
@@ -10552,6 +10859,11 @@ export class FleetManager {
      * The caller has passed the /ui gate (session, same origin, CSRF). Here: the prompt must be one offered
      * on the dashboard, about the instance the page named, and the action one of its own buttons.
      */
+    /** #1266: a click on a reply's button in the web chat (the /ui gate is passed: a session, or the public link). */
+    clickWebReplyButton(instance, id, index) {
+        const buttons = this.replyButtons();
+        return buttons ? buttons.clickWeb(instance, id, index) : Promise.resolve({ status: 409, error: t("reply_buttons.closed") });
+    }
     async clickWebPrompt(instance, nonce, action) {
         if (!/^[0-9a-f]{32}$/.test(nonce) || !/^[a-z][a-z-]{0,23}$/.test(action))
             return { status: 400, error: "Malformed prompt answer" };
@@ -10580,9 +10892,16 @@ export class FleetManager {
             return { status: 200 };
         return { status: 409, error: notice ?? "This prompt is no longer open" };
     }
-    async retireNonceButtons(pending, messageId, text) {
+    async retireNonceButtons(pending, messageId, text, 
+    /** The click's own edit of a private prompt (AdapterCallbackData.editClicked); preferred over the prompt's. */
+    editClicked) {
         this.webPromptGone(pending, text);
         try {
+            const retire = editClicked ?? pending.retire;
+            if (retire) {
+                await retire(text);
+                return;
+            }
             if (!pending.adapter.editMessageRemoveButtons)
                 throw new Error("adapter cannot remove prompt buttons");
             await pending.adapter.editMessageRemoveButtons(pending.chatId, messageId, text, pending.threadId);
@@ -11040,8 +11359,8 @@ export class FleetManager {
             this.webPromptGone(entry, entry.expiredText);
         }
         const collapses = entries
-            .filter(entry => entry.messageId && entry.adapter.editMessageRemoveButtons)
-            .map(entry => entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId).catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to retire button prompt during shutdown")));
+            .map(entry => this.collapseNoncePrompt(entry)?.catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to retire button prompt during shutdown")))
+            .filter(collapse => collapse !== undefined);
         if (!collapses.length)
             return;
         await Promise.race([
@@ -11060,12 +11379,17 @@ export class FleetManager {
             if (entry.timer)
                 clearTimeout(entry.timer);
             this.webPromptGone(entry, entry.expiredText);
-            if (entry.messageId && entry.adapter.editMessageRemoveButtons) {
-                entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId)
-                    .catch(err => this.logger.debug({ err, instanceName, prefix: entry.prefix }, "Failed to collapse prompt during instance stop"));
-            }
+            this.collapseNoncePrompt(entry)?.catch(err => this.logger.debug({ err, instanceName, prefix: entry.prefix }, "Failed to collapse prompt during instance stop"));
         }
     }
+    /** A lapsed prompt's buttons collapsed to its expired text — through its own interaction when it is private. */
+    collapseNoncePrompt(entry) {
+        if (entry.retire)
+            return entry.retire(entry.expiredText);
+        if (!entry.messageId || !entry.adapter.editMessageRemoveButtons)
+            return undefined;
+        return entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId);
+    }
     /** A clean exit is intentional from the CLI's perspective, but often not from
      * the operator's. Keep the instance notice passive and put the action in the
      * same-world General topic where an administrator can make the choice. */
@@ -12048,7 +12372,7 @@ export class FleetManager {
         for (const name of this.configuredBackendInstanceNames()) {
             configured.add(this.backendNameOf(name));
         }
-        const installed = this.probeInstalledBackends();
+        const installed = await this.probeInstalledBackends();
         // One entry point for "get this CLI working" (#1131): a backend that is
         // not installed is offered too, and the click installs it first, then
         // signs in (startLoginSession routes it).
@@ -12680,10 +13004,16 @@ export class FleetManager {
                 attachments: Array.isArray(m.attachments) ? m.attachments : undefined,
                 messageId: typeof m.messageId === "string" ? m.messageId : undefined,
                 role: typeof m.role === "string" ? m.role : undefined,
+                buttons: m.buttons,
             });
             broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
             return;
         }
+        // #1266: a reply's buttons ended — the history shows it too (a later load, the public link's poll).
+        if (event === "reply_buttons" && data && typeof data === "object") {
+            const u = data;
+            this.webChatHistory.updateButtons(String(u.instance ?? ""), u.buttons);
+        }
         broadcastSseEvent(this.sseClients, event, data, onError);
     }
     listClaimedTasks(assignee) {
@@ -14495,6 +14825,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         return `${warn}${t("effort.restart_success", instanceName, applied)}`;
     }
     async applyModel(instanceName, model) {
+        // Reject model names with newlines or control characters: they would be
+        // persisted to fleet.yaml and pasted raw into the CLI (P3 from #1490 audit).
+        if (/[\x00-\x1f\x7f]/.test(model)) {
+            return t("model.invalid_chars");
+        }
         const backendName = this.backendNameForInstance(instanceName);
         let strategy = "restart";
         try {
@@ -14869,7 +15204,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // #1386: every live "Needs you" message says the fleet stopped (capabilities revoked first) — while the
         // adapters can still edit. Bounded: a platform that does not answer must not hold the shutdown.
         const needsStopped = this.stopNeedsYou();
-        this.cacheService?.stop();
+        // #1490 P3: stop() now returns a Promise; await it so the final
+        // ledger flush completes before process.exit(0) in doStopAll's caller.
+        const cacheStopped = this.cacheService?.stop() ?? Promise.resolve();
         const profileStopped = this.runtimeCpuProfiler?.shutdown("fleet shutdown");
         this.ipcStoppingInstances.add("__fleet_stopping__");
         // Release held delivery promises before awaiting daemon shutdown, then
@@ -14903,6 +15240,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         await profileStopped;
         await needsStopped;
         await settingsControlStopped;
+        await cacheStopped;
         await this.cpuProfileControl?.close();
         this.cpuProfileControl = null;
         await this.shutdownLoginWindows();
@@ -15035,6 +15373,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // nor revives a session that was revoked while the disk was refusing writes.
         this.webSessions?.flush();
         this.eventLog?.close();
+        this.replyButtonsCtl?.stop();
+        this.replyButtonsStore?.close();
+        this.replyButtonsCtl = null;
+        this.replyButtonsStore = null;
         const pidPath = join(this.dataDir, "fleet.pid");
         try {
             unlinkSync(pidPath);
@@ -15262,7 +15604,20 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // this process came up on: a Settings edit mutates this.fleetConfig in place
         // before the reload, so comparing the pre-load copy sees nothing at all.
         const newFleetLevel = this.fleetLevelSignature();
-        if (this.appliedFleetLevel !== null && this.appliedFleetLevel !== newFleetLevel) {
+        // #1519 P6: connections appended to a running fleet start now — no restart. Only once every one is running does
+        // this process count the configuration as applied; otherwise the row says a restart is still needed.
+        if (this.appliedFleetLevel !== null && this.appliedFleetLevel !== newFleetLevel && this.canHotAddConnections(this.fleetConfig)) {
+            observe?.(APPLY_FLEET_TARGET, "hot", "running");
+            if (await this.hotAddConnections(appendedConnections(this.startupFleetConfig, this.fleetConfig))) {
+                this.startupFleetConfig = structuredClone(this.fleetConfig);
+                this.appliedFleetLevel = newFleetLevel;
+                observe?.(APPLY_FLEET_TARGET, "hot", "done");
+            }
+            else {
+                observe?.(APPLY_FLEET_TARGET, "restart", "restart-required");
+            }
+        }
+        else if (this.appliedFleetLevel !== null && this.appliedFleetLevel !== newFleetLevel) {
             this.logger.warn({
                 keys: fleetLevelDifferences(this.startupFleetConfig, this.fleetConfig),
             }, "Fleet-level config changed — restart AgEnD for it to take effect");
@@ -15596,6 +15951,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     listSecureConnections() {
         const channels = this.fleetConfig?.channels
             ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        // A token written from Settings is in .env before this process has it (#1519 P1: a new connection's token waits for
+        // the restart that starts it) — stored is "set", not "missing". Names only; no value is read out.
+        let stored;
+        try {
+            stored = envFileKeys(this.dataDir);
+        }
+        catch {
+            stored = new Set();
+        } // unreadable: only what this process has
         return channels.map((channel, index) => {
             const id = channel.id ?? channel.type ?? `channel-${index}`;
             const world = this.worlds.get(id);
@@ -15604,16 +15968,42 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 id,
                 type: channel.type,
                 token_env: channel.bot_token_env,
-                token_present: !!process.env[channel.bot_token_env],
+                token_present: !!process.env[channel.bot_token_env] || stored.has(channel.bot_token_env),
                 group_id: channel.group_id != null ? String(channel.group_id) : null,
-                general_channel_id: channel.options?.general_channel_id != null
-                    ? String(channel.options.general_channel_id)
-                    : null,
-                status: state?.status ?? (world ? "starting" : "stopped"),
+                general_channel_id: discordGeneralChannelId(channel),
+                ...this.connectionStatus(id, state, world),
                 ...(world ? { identity: { id: world.botUserId ?? null, username: world.botUsername ?? null } } : {}),
             };
         });
     }
+    /**
+     * #1519 P6 (#1537 review): a connection's status from evidence, never from a start call that merely resolved. No
+     * adapter object: not running (or retrying / failed, as recorded) — never "connected". An adapter that has not logged
+     * in yet (no `started`: no bot id; for Telegram, polling not ready) is "starting". Named problems: the Message Content
+     * intent refused (4014, P3), the token refused (an explicit auth error, or Telegram's own 401 flag) — the error text
+     * itself is never passed on.
+     */
+    connectionStatus(id, state, world) {
+        const adapter = this.adapters.get(id);
+        const evidence = adapter?.connectionEvidence?.();
+        const recorded = state?.status;
+        const problem = evidence?.authRejected || (recorded !== "connected" && isRejectedTokenError(state?.lastError)) ? "rejected"
+            : recorded !== "connected" && isDisallowedIntentsError(state?.lastError) ? "missing_intent" : undefined;
+        let status;
+        if (!adapter || evidence?.stopped)
+            status = recorded === "retrying" || recorded === "failed" ? recorded : "stopped"; // gone, or told to stop
+        else if (recorded === "retrying" || recorded === "failed")
+            status = recorded;
+        else if (evidence?.authRejected)
+            status = "failed";
+        else if (!world?.botUserId)
+            status = "starting"; // not logged in yet
+        else if (evidence && !evidence.ready)
+            status = "retrying"; // logged in once; its polling has failed since
+        else
+            status = "connected";
+        return { status, ...(problem ? { problem } : {}) };
+    }
     secureConnectionChannel(connectionId) {
         const channels = this.fleetConfig?.channels
             ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
@@ -16402,8 +16792,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             throw new Error("adapter operation superseded"); };
         check();
         const old = this.adapters.get(connectionId);
-        if (!old && !force)
-            return false; // The secret is valid on disk; the next start adopts it.
+        // No adapter: a connection that is not the primary, in a fleet already running connections, starts now (#1519 P6);
+        // otherwise the secret is valid on disk and the next start adopts it.
+        if (!old && !force && (this.getPrimaryAdapterId() === connectionId || this.adapters.size === 0))
+            return false;
+        if (!old) {
+            const pending = this.adapterState.get(connectionId)?.retryTimer;
+            if (pending)
+                clearTimeout(pending);
+        }
         const primary = this.getPrimaryAdapterId() === connectionId;
         const previousState = this.adapterState.get(connectionId);
         this.adapterState.set(connectionId, { status: "retrying", retryCount: previousState?.retryCount ?? 0 });
@@ -16472,6 +16869,74 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * the reconcile reports as it works. A target the forecast missed (a Classic
      * instance inheriting a changed default) is added when it is first touched.
      */
+    /**
+     * #1519 P6: whether `next` differs from what this process started with only by connections appended to it, while it
+     * runs connections already (a fleet's first connection becomes its primary: a fresh process sets that up).
+     */
+    canHotAddConnections(next) {
+        return this.adapters.size > 0 && appendedConnections(this.startupFleetConfig, next) !== null;
+    }
+    /**
+     * #1519 P6: start connections appended to a running fleet. Each token is read from .env (that key only, under the
+     * file's lease — Settings wrote it there, and this process read .env once at start); a connection already running (a
+     * token Replace started it) is left alone. True only when every one is running; one that failed to start is retried in
+     * the background like any other, and the Apply row says a restart is still needed.
+     */
+    async hotAddConnections(added) {
+        const envPath = join(this.dataDir, ".env");
+        const lease = trySettingsLease([settingsFileResource(envPath)]);
+        if (!lease)
+            return false;
+        try {
+            this.loadEnvKeys(new Set(added.map(c => c.bot_token_env)), lease.owner);
+        }
+        finally {
+            lease.release();
+        }
+        let all = true;
+        for (const channel of added) {
+            const id = channel.id ?? channel.type;
+            if (this.adapters.has(id))
+                continue;
+            if (!process.env[channel.bot_token_env]) {
+                all = false;
+                continue;
+            }
+            const pending = this.adapterState.get(id)?.retryTimer;
+            if (pending)
+                clearTimeout(pending);
+            try {
+                await this.startAdditionalAdapter(channel);
+                if (!this.adapters.has(id)) {
+                    all = false;
+                    continue;
+                }
+                this.adapterState.set(id, { status: "connected", retryCount: 0 });
+                this.logger.info({ adapterId: id }, "Connection started without a restart");
+            }
+            catch (err) {
+                all = false;
+                const message = err?.message ?? String(err);
+                this.adapterState.set(id, { status: "retrying", retryCount: 0, lastError: message });
+                this.scheduleAdapterRetry(id, channel);
+            }
+        }
+        this.classicChannels?.configureAdapters(this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []));
+        this.routing.rebuild(this.fleetConfig);
+        this.reregisterClassicChannels();
+        return all;
+    }
+    /** Set the named keys of the data dir's .env into this process's environment (the file's lease held by `owner`). */
+    loadEnvKeys(keys, owner) {
+        const envPath = join(this.dataDir, ".env");
+        if (!existsSync(envPath))
+            return;
+        assertSettingsLease(settingsFileResource(envPath), owner);
+        // The same parser as the start's (env-file.ts): a token is read the same way at start and when hot-added.
+        for (const [key, value] of parseEnvText(readFileSync(envPath, "utf-8")))
+            if (keys.has(key))
+                process.env[key] = value;
+    }
     planConfigApply() {
         const rows = [];
         const nextConfig = this.nextFleetConfig();
@@ -16495,7 +16960,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 rows.push({ target: name, kind: "restart" });
         }
         if (this.appliedFleetLevel !== null && this.appliedFleetLevel !== this.fleetLevelSignature(nextConfig)) {
-            rows.push({ target: APPLY_FLEET_TARGET, kind: "restart" });
+            // #1519 P6: connections appended to a running fleet start now; anything else at fleet level waits for a restart.
+            rows.push({ target: APPLY_FLEET_TARGET, kind: this.canHotAddConnections(nextConfig) ? "hot" : "restart" });
         }
         return rows;
     }
@@ -16888,14 +17354,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 return;
             }
             const requestPath = new URL(req.url ?? "/", `http://localhost:${port}`).pathname;
-            // Browsers request this automatically and AgEnD does not ship an icon.
-            // It is neither user data nor an API route, so do not turn the harmless
-            // probe into a noisy web-token 401 in the browser console.
-            if (req.method === "GET" && requestPath === "/favicon.ico") {
-                res.writeHead(204);
-                res.end();
+            // Branding is public, after Host admission: automatic favicon requests
+            // must not become noisy web-token 401s in the browser console.
+            if (handleWebIconRequest(req, res, requestPath))
                 return;
-            }
             // Public: the health probe, /agent (instance-token auth of its own), the
             // sign-in surface, and /view's reads unless web.view_access says otherwise.
             if (bypassesWebGate(req, requestPath, this.fleetConfig, p => !gatewayRequestContext(req) && (isViewPath(p) || isUsagePath(p)))) {
@@ -16947,7 +17409,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     const backend = this.fleetConfig?.instances[name]?.backend
                         ?? this.fleetConfig?.defaults?.backend
                         ?? "claude-code";
-                    const { context } = resolveInstanceContext(this.dataDir, name, backend);
+                    const { context } = resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name) });
                     return {
                         name,
                         status: this.getInstanceStatus(name),
@@ -17336,6 +17798,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             .map(ch => ch.instanceName)
             .filter(name => !fleetNames.includes(name));
         const names = [...fleetNames, ...classicOnly];
+        // The identity every page shows (alpha.2, N1): alias, description, role and tags resolved by the same rule as
+        // /api/profiles (resolveInstanceIdentity) — the sidebar groups, searches and labels with it on every page.
+        const classicRooms = new Map((this.classicChannels?.getAll() ?? []).map(ch => [ch.instanceName, ch]));
+        const profiles = profileIdentities(this.dataDir);
         const instances = names.map(name => {
             const statusFile = join(this.getInstanceDir(name), "statusline.json");
             let cost = 0;
@@ -17353,7 +17819,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 : (this.fleetConfig?.instances[name]?.backend
                     ?? this.fleetConfig?.defaults?.backend
                     ?? "claude-code");
-            const { context } = resolveInstanceContext(this.dataDir, name, backend);
+            const { context } = resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name) });
             // context_pct: null when unavailable, not 0
             const context_pct = context ?? null;
             // Model: Only Claude Code has live statusline; others use the effective resolver.
@@ -17372,13 +17838,13 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // Only show effort if backend supports it and it's not antigravity
             const effort = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.effort;
             const effort_source = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.source;
-            // Display name: fleet config → classic channel → undefined
-            const display_name = classic
-                ? this.classicChannels?.getAll().find(ch => ch.instanceName === name)?.displayName
-                : this.fleetConfig?.instances[name]?.display_name;
+            const identity = resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[name], classic: classicRooms.get(name), profile: profiles.get(name) });
             return {
                 name,
-                display_name: display_name || undefined,
+                display_name: identity.display_name || undefined,
+                description: identity.description || undefined,
+                role: identity.role || undefined,
+                tags: identity.tags,
                 status: this.getInstanceStatus(name),
                 // `state` (presentation: may be awaiting_input) and `execution_state` (working / idle / stuck, or null —
                 // what the dashboard's activity events carry) come from instancePresentation (#1212).
@@ -17396,6 +17862,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             instances,
             publicLink: this.getPublicWebStatus(),
             uptime: Math.floor((Date.now() - this.startedAt) / 1000),
+            // #1519 P7: how many chat connections are configured — 0 is a web-only fleet, which gets the first-run card.
+            connections: (this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : [])).length,
         };
     }
 }