@songsid/agend 2.2.0-beta.1 → 2.2.0-beta.3

package/dist/fleet-manager.js

@@ -51,6 +51,7 @@ import { startEventLoopWatch } from "./event-loop-watch.js";
 import { TmuxManager } from "./tmux-manager.js";
 import { AccessManager } from "./channel/access-manager.js";
 import { IpcClient } from "./channel/ipc-bridge.js";
+import { usesChannelAddress } from "./channel/mcp-tools.js";
 import { formatFleetTime } from "./tz-utils.js";
 import { createAdapter } from "./channel/factory.js";
 import { isWebChannelEcho, WEB_ECHO_PREFIX } from "./web-channel-echo.js";
@@ -74,7 +75,7 @@ import { InstanceLifecycle, SupersededStartError, BACKEND_INSTALLATION_INFO, che
 import { TopicArchiver } from "./topic-archiver.js";
 import { StatuslineWatcher } from "./statusline-watcher.js";
 import { outboundHandlers } from "./outbound-handlers.js";
-import { DeliveryOutbox } from "./delivery-outbox.js";
+import { DeliveryOutbox, isSilentScheduleDelivery } from "./delivery-outbox.js";
 // The target Daemon can legitimately wait 30 minutes for a busy pane before
 // deciding to defer before submission. This is an alert threshold only: the
 // active manager/target generation pair owns the lane until the daemon reports
@@ -128,10 +129,14 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
 import { handleWebRequest, broadcastSseEvent, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId } from "./web-chat-history.js";
 import { WebChatDiskStore } from "./web-chat-store.js";
+import { WebPrefsStore } from "./web-prefs.js";
 import { ReplyButtonStore, parseReplyButtons, replyButtonClickText, replyButtonsFallbackText, REPLY_BUTTON_PREFIX } from "./reply-buttons.js";
 import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { publicAttachment, sweepOrphanedUploads, WebFileLedger } from "./web-upload.js";
 import { handleViewRequest, isViewPath, profileIdentities, resolveInstanceIdentity } from "./view-api.js";
+import { downloadStickerImage } from "./channel/sticker-download.js";
+import { WebImageCache, imageMimeForFile, WEB_IMAGE_MAX_AGE_MS, WEB_IMAGE_MAX_BYTES, WEB_IMAGE_RETRY_MS } from "./web-images.js";
+import { accentColor, avatarFor, ownBotConnections } from "./instance-avatar.js";
 import { envFileKeys } from "./token-env-name.js";
 import { discordGeneralChannelId } from "./discord-general.js";
 import { parseEnvText } from "./env-file.js";
@@ -180,7 +185,7 @@ import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefu
 import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
 import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
 import { isWebPageNavigation } from "./web-shell-routes.js";
-import { tokenEpoch, WebSessionStore } from "./web-session.js";
+import { localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
 import { WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
 import { CodeRequestLimiter, ReturningDevices } from "./web-returning-device.js";
 import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
@@ -758,6 +763,15 @@ export class FleetManager {
     webChatStore = null;
     /** Uploaded files and the files the dashboard may fetch back (uploads, reply attachments). */
     webFiles = new WebFileLedger();
+    webPrefsStore;
+    /** #1665: the web preferences kept on the host (<home>/web-prefs.json), read on first use. */
+    get webPrefs() {
+        // #1664: a favorite must be an instance of this fleet now — fleet.yaml's (own keys) or a ClassicBot room's.
+        return (this.webPrefsStore ??= new WebPrefsStore(this.dataDir, {
+            exists: (name) => Object.hasOwn(this.fleetConfig?.instances ?? {}, name)
+                || (this.classicChannels?.getAll() ?? []).some((ch) => ch.instanceName === name),
+        }));
+    }
     /**
      * Read from disk on every access rather than cached at startup: `agend
      * web-token rotate` runs in a separate process, and a cached copy would keep
@@ -1215,8 +1229,13 @@ export class FleetManager {
             if (event.deliveryId && (event.state === "failed" || event.state === "uncertain")) {
                 const row = outbox.get(event.deliveryId);
                 if (row && row.kind !== "delivery_outcome_notice" && row.kind !== "post_restart_outcome_notice") {
-                    const notice = t(`delivery.fleet_${row.state}`, row.targetInstance, row.operationId, row.deliveryId);
-                    this.logger.error({ deliveryId: row.deliveryId, operationId: row.operationId, target: row.targetInstance, state: row.state }, notice);
+                    // #1647: the cause goes in the log (the notice points there), and a silent schedule's paste says what it is.
+                    const silent = isSilentScheduleDelivery(row);
+                    const notice = silent
+                        ? t(`delivery.fleet_${row.state}_silent_schedule`, row.targetInstance, row.operationId, row.deliveryId, row.lastError ?? "unknown")
+                        : t(`delivery.fleet_${row.state}`, row.targetInstance, row.operationId, row.deliveryId);
+                    this.logger.error({ deliveryId: row.deliveryId, operationId: row.operationId, target: row.targetInstance, state: row.state,
+                        cause: row.lastError, ...(silent ? { silentSchedule: true } : {}) }, notice);
                     this.notifyFleetError(notice);
                 }
             }
@@ -1274,7 +1293,20 @@ export class FleetManager {
     }
     queryDurableDeliveryStatus(callerInstance, selector) {
         this.ensureDeliveryOutbox();
-        return this.deliveryOutbox.queryStatusForInstance(callerInstance, selector);
+        const page = this.deliveryOutbox.queryStatusForInstance(callerInstance, selector);
+        // #1641: a sender that sees only `queued` cannot tell "next in line" from "the target is stuck": say which.
+        return {
+            ...page,
+            items: page.items.map(item => (item.state === "queued" || item.state === "retry_wait")
+                ? { ...item, waiting_reason: this.deliveryWaitingReason(item.target_instance) }
+                : item),
+        };
+    }
+    /** #1641: why a target is not taking queued work right now, or null when nothing known holds it. */
+    deliveryWaitingReason(target) {
+        if (this.lifecycle.isPaused(target))
+            return t("delivery.hold_state", "paused");
+        return this.daemons.get(target)?.notAcceptingReason?.() ?? null;
     }
     getDaemonBootId(instanceName) {
         return this.daemons.get(instanceName)?.bootId;
@@ -3003,13 +3035,38 @@ export class FleetManager {
         }
         return posted;
     }
-    reserveWebChannelEcho(instanceName, sendEcho) {
+    /**
+     * #1666: a delivered web chat message starts the same cancel/progress lifecycle in the instance's topic as a platform
+     * inbound (afterUserInboundDelivered): the same bubble, ticker and retire rules. Not its ✅ tracking — the web message
+     * id is no platform message, and the echo is the fleet's own post. The web send calls this on the echo's lane.
+     */
+    startWebChatProgress(instanceName) {
+        if (this.shuttingDown)
+            return Promise.resolve();
+        return this.sendCancelButton(instanceName);
+    }
+    /**
+     * `copy: false` (#1666/#1668): an entry that is not a copy of a message — the web send's Cancel/progress bubble. It
+     * keeps its place in the order, but the lane's copy rules do not apply to it: its 5 s budget starts when its turn
+     * starts (waiting behind a slow echo is not its delay), its own timeout only releases the lane (the copies queued
+     * behind it are not "behind an ambiguous copy"), and another entry's timeout never drops it. A copy reserved while
+     * any non-copy is still open starts its own budget when the last of them finishes: a slow bubble is no copy's delay,
+     * however far back the copy is. And a timeout only ever drops copies reserved AFTER the entry that timed out — with
+     * deferred budgets, deadlines no longer grow with the order, so that rule is stated, not implied (#1668 r3).
+     */
+    reserveWebChannelEcho(instanceName, sendEcho, opts = {}) {
+        const copy = opts.copy !== false;
         const epoch = this.getDeliveryEpoch(instanceName);
-        const deadlineAt = performance.now() + 5_000;
+        const queued = this.webChannelEchoTails.get(instanceName);
+        // The last open non-copy ahead of this copy: its budget starts when that one finishes.
+        const nonCopyAhead = copy && (queued?.nonCopiesOpen ?? 0) > 0 ? queued?.lastNonCopyDone : undefined;
+        let deadlineAt = copy && !nonCopyAhead ? performance.now() + 5_000 : Number.POSITIVE_INFINITY;
         let decide;
         const admission = new Promise(resolve => { decide = resolve; });
-        const queue = this.webChannelEchoTails.get(instanceName)
+        const queue = queued
             ?? { tail: Promise.resolve(), pending: new Set() };
+        const seq = queue.nextSeq ?? 0;
+        queue.nextSeq = seq + 1;
         const previous = queue.tail;
         let resolveDone;
         const tail = new Promise(resolve => { resolveDone = resolve; });
@@ -3020,6 +3077,8 @@ export class FleetManager {
             if (done)
                 return;
             done = true;
+            if (!copy)
+                queue.nonCopiesOpen = Math.max(0, (queue.nonCopiesOpen ?? 0) - 1);
             clearTimeout(timer);
             queue.pending.delete(entry);
             if (guard && this.webChannelEchoGuards.get(instanceName) === guard) {
@@ -3027,7 +3086,7 @@ export class FleetManager {
             }
             resolveDone();
         };
-        const entry = { started: false, drop: () => {
+        const entry = { seq, started: false, copy, drop: () => {
                 this.logger.warn({ instanceName }, "Queued web channel echo dropped after ordering timeout");
                 finish();
             } };
@@ -3037,14 +3096,16 @@ export class FleetManager {
             expired = true;
             this.logger.warn({ instanceName, inFlight: entry.started }, "Web channel echo ordering timed out");
             finish();
-            // Do not post copies that were queued behind an ambiguous platform send.
-            for (const pending of queue.pending)
-                if (!pending.started)
-                    pending.drop();
+            // Do not post copies that were queued behind an ambiguous platform send. A non-copy that timed out was no copy
+            // at all (nothing behind it is ambiguous), and a non-copy is never dropped as one.
+            if (copy)
+                for (const pending of queue.pending)
+                    if (pending.seq > seq && !pending.started && pending.copy)
+                        pending.drop();
         };
         const checkDeadline = () => {
-            if (done)
-                return;
+            if (done || deadlineAt === Number.POSITIVE_INFINITY)
+                return; // a non-copy's budget has not started yet
             const remaining = deadlineAt - performance.now();
             if (remaining <= 0)
                 expire();
@@ -3053,8 +3114,19 @@ export class FleetManager {
         };
         queue.pending.add(entry);
         queue.tail = tail;
+        if (!copy) {
+            queue.nonCopiesOpen = (queue.nonCopiesOpen ?? 0) + 1;
+            queue.lastNonCopyDone = tail;
+        }
         this.webChannelEchoTails.set(instanceName, queue);
         checkDeadline();
+        // Registered before the admission below (which waits on `previous`, itself after the non-copy ahead), so the budget
+        // is set by the time that runs.
+        if (nonCopyAhead)
+            void nonCopyAhead.then(() => { if (!done) {
+                deadlineAt = performance.now() + 5_000;
+                checkDeadline();
+            } });
         void Promise.all([previous, admission]).then(([, accepted]) => {
             if (done)
                 return;
@@ -3063,11 +3135,15 @@ export class FleetManager {
                 return;
             }
             // A delayed timer callback must not admit an already expired copy.
-            if (performance.now() >= deadlineAt) {
+            if (copy && performance.now() >= deadlineAt) {
                 expire();
                 return;
             }
             entry.started = true;
+            if (!copy) {
+                deadlineAt = performance.now() + 5_000;
+                checkDeadline();
+            }
             guard = { epoch, deadlineAt };
             this.webChannelEchoGuards.set(instanceName, guard);
             let request;
@@ -4152,6 +4228,33 @@ export class FleetManager {
             names.add(channel.instanceName);
         return [...names];
     }
+    /** #1624: migration cannot infer ownership from the running daemon roster.
+     * Stopped/paused ClassicBot entries count too; their workspace is exactly
+     * the one startClassicInstance builds, not this FleetManager's dataDir.
+     */
+    kiroPeerWorkingDirectories(name) {
+        if (!this.fleetConfig || !this.classicChannels)
+            throw new Error("Kiro peer configuration is not loaded");
+        const peers = [];
+        for (const [peer, cfg] of Object.entries(this.fleetConfig.instances)) {
+            if (peer === name || (cfg.backend ?? this.fleetConfig.defaults?.backend ?? "claude-code") !== "kiro-cli")
+                continue;
+            if (typeof cfg.working_directory !== "string" || !cfg.working_directory)
+                throw new Error("Kiro peer cwd is unknown");
+            peers.push(cfg.working_directory);
+        }
+        for (const ch of this.classicChannels.getAll()) {
+            if (ch.instanceName === name) {
+                if (Object.hasOwn(this.fleetConfig.instances, name))
+                    throw new Error("Kiro instance name has two configurations");
+                continue;
+            }
+            if (this.classicChannels.getBackendByInstance(ch.instanceName, this.fleetConfig.defaults?.backend) === "kiro-cli") {
+                peers.push(join(getAgendHome(), "workspaces", ch.instanceName));
+            }
+        }
+        return peers;
+    }
     /**
      * Probe the same executable set exposed by the web backend catalog.
      *
@@ -4549,6 +4652,9 @@ export class FleetManager {
             this.webSessions = new WebSessionStore({
                 dataDir: this.dataDir,
                 onWarn: message => this.logger.warn(message),
+                // #1620: fleet.yaml's web.session.local, read at every check — a Settings save or a reload applies at once
+                // (shortening ends the sessions it now outlives). The public link's policy stays fixed.
+                localPolicy: () => localSessionPolicy(this.fleetConfig?.web?.session?.local),
             });
         }
         if (!this.returningDevices) {
@@ -7710,10 +7816,12 @@ export class FleetManager {
             respond(null, "No adapter available");
             return;
         }
+        // Only channel-addressing schemas receive ClassicBot routing metadata.
+        // Non-channel calls (notably strict delivery_status) retain their arguments.
         // For classic instances: force chat_id to channelId and clear thread_id
         // (daemon may have set chat_id to guild_id which is wrong for DC; TG may have set thread_id which causes 'thread not found')
         const classicChannelId = this.classicChannels?.getChannelIdByInstance(senderInstanceName ?? instanceName);
-        if (classicChannelId) {
+        if (classicChannelId && usesChannelAddress(tool)) {
             args.chat_id = classicChannelId;
             // #1085: a Telegram forum ClassicBot replies in the topic it was asked
             // in. Any other thread_id (threadless Telegram, where it echoes the chat
@@ -9301,7 +9409,9 @@ export class FleetManager {
         else
             await this.lifecycle.remove(name, authorization);
         // A later same-name registration owns its files and caches.
-        if (this.fleetConfig?.instances[name] || this.daemons.has(name))
+        // Own keys only: an instance named "constructor" is removed as any other (its inherited namesake is not a
+        // re-registration) — #1677 review.
+        if (Object.hasOwn(this.fleetConfig?.instances ?? {}, name) || this.daemons.has(name))
             return;
         execution?.assert();
         // Clean up per-instance tracking maps so they don't grow unbounded
@@ -9313,6 +9423,13 @@ export class FleetManager {
         // must not be shown the old one's conversation, and deleted names must not pile up.
         this.webChatHistory.forget(name);
         this.webFiles.forget(name);
+        // #1664: and it is nobody's favorite any more (every device sees that at its next status frame).
+        try {
+            this.webPrefs.forgetInstance(name);
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message, name }, "Dropping a removed instance from web favorites failed");
+        }
         // Clean up statusline watcher + instance directory
         this.statuslineWatcher.unwatch(name);
         // instanceDirToClean and effectiveBackend are captured before lifecycle.remove
@@ -9502,6 +9619,151 @@ export class FleetManager {
     /** Keyed `<connection>\0<server id>`. */
     guildEmojiCache = new Map();
     guildEmojiFetches = new Map();
+    // ── #1630: what stands for an instance in the web app, and Discord server emoji in web chat ──
+    webImageCaches = null;
+    webImageCache(kind) {
+        const onError = (key, err) => this.logger.debug({ err: err?.message, key }, "web image fetch failed (kept what was cached)");
+        this.webImageCaches ??= {
+            avatars: new WebImageCache({ dir: join(this.dataDir, "cache", "avatars"), onError }),
+            emoji: new WebImageCache({ dir: join(this.dataDir, "cache", "emoji"), onError }),
+        };
+        return this.webImageCaches[kind];
+    }
+    /**
+     * instance → the connection that is its own bot: configured now (a connection removed from fleet.yaml is nobody's,
+     * whatever an instance still names — #1635 review), not the primary, and answering for it alone.
+     */
+    ownBots() {
+        const instances = this.fleetConfig?.instances ?? {};
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const configured = new Set(channels.map(ch => ch.id ?? ch.type).filter((id) => typeof id === "string"));
+        const assigned = (name) => { const c = this.getInstanceAdapterId(name); return c && configured.has(c) ? c : undefined; };
+        const assignments = Object.keys(instances).map(n => [n, assigned(n)]);
+        for (const room of this.classicChannels?.getAll() ?? []) {
+            if (!Object.hasOwn(instances, room.instanceName))
+                assignments.push([room.instanceName, assigned(room.instanceName)]);
+        }
+        return ownBotConnections(this.getPrimaryAdapterId(), assignments);
+    }
+    /**
+     * The bot a connection is now: its running adapter and that bot's own user id. Everything cached for an own bot is
+     * keyed by both, so a bot put in its place (a token replaced under the same connection id) never shows the old one's
+     * face or colour, and the old one's late answers land under the old key (#1635 review). null while it has no id.
+     */
+    botOwner(connection) {
+        const adapter = this.adapters.get(connection), id = adapter?.getBotUserId?.();
+        return adapter && id ? { adapter, id } : null;
+    }
+    /** Still the same bot behind `connection` (after an await): the same adapter object and the same bot id. */
+    botStillOwns(connection, owner) {
+        return this.adapters.get(connection) === owner.adapter && owner.adapter.getBotUserId?.() === owner.id;
+    }
+    /** keyed `<connection>\0<bot id>\0<channel>`: the bot's colour there, refreshed at most daily (monotonic), one read at a time. */
+    webAccents = new Map();
+    webAccentReads = new Set();
+    webAccent(connection, owner, channelId) {
+        const adapter = owner.adapter;
+        if (!adapter.botAccentColor)
+            return null;
+        const key = `${connection}\0${owner.id}\0${channelId ?? ""}`, now = performance.now(), cached = this.webAccents.get(key);
+        if ((!cached || now >= cached.until) && !this.webAccentReads.has(key)) {
+            this.webAccentReads.add(key);
+            adapter.botAccentColor(channelId)
+                // Keyed by the bot's id: a replaced bot's late answer lands under its own key, which the new bot never reads.
+                .then(value => { this.webAccents.set(key, { value: accentColor(value), until: performance.now() + WEB_IMAGE_MAX_AGE_MS }); }, () => { this.webAccents.set(key, { value: cached?.value ?? null, until: performance.now() + WEB_IMAGE_RETRY_MS }); })
+                .finally(() => this.webAccentReads.delete(key));
+        }
+        return cached?.value ?? null;
+    }
+    /** The cache key of an own bot's avatar, and its loader (which refuses an answer from a bot no longer there). */
+    botAvatarSource(connection, owner) {
+        return {
+            key: `bot:${connection}:${owner.id}`,
+            load: async () => {
+                const got = await owner.adapter.fetchBotAvatar();
+                if (!this.botStillOwns(connection, owner))
+                    throw new Error("the bot was replaced while its avatar was fetched");
+                return got;
+            },
+        };
+    }
+    /** One instance's avatar and ring for the status frame. Synchronous: what is cached now; fetches run behind. */
+    webIdentityImage(name, displayName, profileAvatar, own) {
+        let profileVersion = null;
+        if (profileAvatar && imageMimeForFile(profileAvatar)) {
+            try {
+                profileVersion = Math.floor(statSync(join(this.dataDir, "avatars", basename(profileAvatar))).mtimeMs).toString(36);
+            }
+            catch { /* removed */ }
+        }
+        const connection = own.get(name), owner = connection ? this.botOwner(connection) : null;
+        const source = connection && owner?.adapter.fetchBotAvatar ? this.botAvatarSource(connection, owner) : null;
+        const bot = source ? this.webImageCache("avatars").peek(source.key, source.load) : null;
+        const cfg = this.ownInstanceConfig(name);
+        const avatar = avatarFor({ name, displayName, profileVersion, bot: bot && connection ? { connection, version: bot.version } : null,
+            personaEmoji: cfg?.status_emojis?.delivered });
+        // The ring belongs to the bot's own face: only when that is what is shown.
+        const accent = !profileVersion && bot && connection && owner
+            ? this.webAccent(connection, owner, cfg ? (cfg.topic_id == null ? undefined : String(cfg.topic_id)) : this.classicChannels?.getChannelIdByInstance(name))
+            : null;
+        return accent ? { avatar, accent } : { avatar };
+    }
+    /** GET /ui/img/bot|avatar/<key>: what is cached, never a fetch. Only an own-bot connection, or a known instance's upload. */
+    webImage(kind, key) {
+        if (kind === "bot") {
+            if (![...this.ownBots().values()].includes(key))
+                return null;
+            const owner = this.botOwner(key);
+            return owner ? this.webImageCache("avatars").read(this.botAvatarSource(key, owner).key) : null;
+        }
+        const known = Object.hasOwn(this.fleetConfig?.instances ?? {}, key) || this.classicChannels?.getChannelIdByInstance(key) !== undefined;
+        if (!known)
+            return null;
+        const file = profileIdentities(this.dataDir).get(key)?.avatar_path;
+        const mime = file ? imageMimeForFile(file) : null;
+        if (!file || !mime)
+            return null;
+        try {
+            const path = join(this.dataDir, "avatars", basename(file));
+            return { bytes: readFileSync(path), mime, version: Math.floor(statSync(path).mtimeMs).toString(36) };
+        }
+        catch {
+            return null;
+        }
+    }
+    /** GET /ui/emojis: the custom emoji of every server the fleet's Discord bots are in (the Settings picker's cache). */
+    async webEmojiList() {
+        const adopted = [];
+        for (const [id, world] of [...this.worlds]) {
+            if (world.type !== "discord")
+                continue;
+            const listed = await this.listGuildEmojis(id);
+            if (listed.ok)
+                adopted.push({ id, world, emojis: listed.emojis });
+        }
+        // After the LAST await (#1635 review r2): only the lists whose world is still the one that was read — a connection
+        // removed or replaced while a later list was awaited takes its servers along, whenever it went.
+        const out = new Map();
+        for (const a of adopted) {
+            if (this.worlds.get(a.id) !== a.world)
+                continue;
+            for (const e of a.emojis)
+                if (!out.has(e.id))
+                    out.set(e.id, { id: e.id, name: e.name, animated: e.animated });
+        }
+        return [...out.values()];
+    }
+    /** GET /ui/img/emoji/<id>: only an emoji of those servers; fetched once from Discord's CDN, then from the host cache. */
+    async webEmoji(id) {
+        if (!/^\d{15,25}$/.test(id))
+            return null;
+        const emoji = (await this.webEmojiList()).find(e => e.id === id);
+        if (!emoji)
+            return null;
+        const image = await this.webImageCache("emoji").get(`emoji:${id}`, () => downloadStickerImage(`https://cdn.discordapp.com/emojis/${id}.${emoji.animated ? "gif" : "png"}?size=64`, { maxBytes: WEB_IMAGE_MAX_BYTES }));
+        // Still an emoji of the fleet's servers once it is here (a connection removed meanwhile takes its servers along).
+        return image && (await this.webEmojiList()).some(e => e.id === id) ? image : null;
+    }
     /**
      * What `instanceName` may pick as its persona emoji (the `list_emojis`
      * tool): its current status set with where each value comes from, the
@@ -10693,7 +10955,8 @@ export class FleetManager {
             // on the sign-in DM, armed by the first tap). A double tap, or a late second one from an old keyboard, lands
             // here with the spent nonce — and collapsing would wipe the message's text and the live buttons. The clicker is
             // told; the message is left alone.
-            if ([...this.pendingNonceButtons.values()].some(e => e.prefix === prefix && e.chatId === data.chatId && e.messageId === data.messageId)) {
+            // #1617: and of the same bot — two bots' DM message ids can collide; another bot's live prompt says nothing here.
+            if ([...this.pendingNonceButtons.values()].some(e => e.prefix === prefix && e.adapterId === callbackAdapterId && e.chatId === data.chatId && e.messageId === data.messageId)) {
                 data.ack?.(t("buttons.stale_notice"));
                 return "consumed";
             }
@@ -15444,6 +15707,17 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const ch = this.classicChannels.unregister(channelId, adapterId);
         if (!ch)
             return t("classic.no_agent");
+        // #1664: the room is gone (not paused or stopped): nobody's favorite any more — unless the name is still an
+        // instance (fleet.yaml's, or another room's), so a later room of the same name does not inherit an old star.
+        if (!Object.hasOwn(this.fleetConfig?.instances ?? {}, ch.instanceName)
+            && !this.classicChannels.getAll().some((c) => c.instanceName === ch.instanceName)) {
+            try {
+                this.webPrefs.forgetInstance(ch.instanceName);
+            }
+            catch (err) {
+                this.logger.warn({ err: err.message, instanceName: ch.instanceName }, "Dropping a removed room from web favorites failed");
+            }
+        }
         this.instanceWorldBinding.delete(ch.instanceName);
         await this.stopInstance(ch.instanceName).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to stop classic instance"));
         clearPausedMarker(this.getInstanceDir(ch.instanceName));
@@ -17940,7 +18214,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // Never the token: fleet.log is readable by anything that can read the
             // data dir, is copied into bug reports, and is tailed in shared terminals.
             // `/dashboard` and `agend web` are the ways to get an authorized link.
-            this.logger.info({ url: `http://localhost:${port}/ui` }, "Web UI available (open it with /dashboard or `agend web`)");
+            this.logger.info({ url: `http://localhost:${port}/ui` }, "Web UI available (open it with /web or `agend web`)");
             this.logger.info({ url: `http://localhost:${port}/view` }, "Web View available");
             // #1306: the preview listener starts once the web listener is bound — its frame-ancestors name the real port.
             const bound = this.healthServer?.address();
@@ -18082,6 +18356,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // /api/profiles (resolveInstanceIdentity) — the sidebar groups, searches and labels with it on every page.
         const classicRooms = new Map((this.classicChannels?.getAll() ?? []).map(ch => [ch.instanceName, ch]));
         const profiles = profileIdentities(this.dataDir);
+        // #1630: decorative — whatever goes wrong deciding an avatar never costs the frame (every instance gets its first character).
+        let ownBots = new Map();
+        try {
+            ownBots = this.ownBots();
+        }
+        catch (err) {
+            this.logger.debug({ err }, "own bots unreadable (getUiStatus)");
+        }
         const instances = names.map(name => {
             const statusFile = join(this.getInstanceDir(name), "statusline.json");
             let cost = 0;
@@ -18119,9 +18401,19 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             const effort = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.effort;
             const effort_source = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.source;
             const identity = resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[name], classic: classicRooms.get(name), profile: profiles.get(name) });
+            let image;
+            try {
+                image = this.webIdentityImage(name, identity.display_name, profiles.get(name)?.avatar_path, ownBots);
+            }
+            catch (err) {
+                this.logger.debug({ err, name }, "avatar unreadable (getUiStatus)");
+                image = { avatar: avatarFor({ name, displayName: identity.display_name }) };
+            }
             return {
                 name,
                 display_name: identity.display_name || undefined,
+                avatar: image.avatar,
+                ...(image.accent ? { accent: image.accent } : {}),
                 description: identity.description || undefined,
                 role: identity.role || undefined,
                 tags: identity.tags,
@@ -18144,6 +18436,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             uptime: Math.floor((Date.now() - this.startedAt) / 1000),
             // #1519 P7: how many chat connections are configured — 0 is a web-only fleet, which gets the first-run card.
             connections: (this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : [])).length,
+            // #1665: the host preferences' revision — a page that has another re-reads /ui/prefs (no values in this frame).
+            prefs_rev: this.webPrefs.rev(),
         };
     }
 }