@songsid/agend 2.2.0-beta.3 → 2.2.0-beta.5

package/dist/usage/statusline-usage.d.ts

@@ -12,11 +12,15 @@ export interface StatuslineRateLimits {
     instance: string;
     /** When that instance last wrote the file. */
     observedAtMs: number;
+    /** Where claude said the conversation is (#1699: under a credential profile's own config dir for a profile). */
+    transcriptPath: string | null;
 }
 /** A statusline window's `resets_at` as epoch ms, or null when it has no usable reset time. */
 export declare function statuslineResetsAtMs(value: unknown): number | null;
 /**
  * The most recent rate-limit reading any claude-code instance has written, or
- * null when no instance has one worth using.
+ * null when no instance has one worth using. `from` keeps only the readings of
+ * one subscription (#1699): it is asked where each reading's conversation is —
+ * a credential profile's instances write under that profile's own config dir.
  */
-export declare function readStatuslineRateLimits(agendHome?: string, now?: number): StatuslineRateLimits | null;
+export declare function readStatuslineRateLimits(agendHome?: string, now?: number, from?: (transcriptPath: string | null) => boolean): StatuslineRateLimits | null;

package/dist/usage/statusline-usage.js

@@ -31,7 +31,8 @@
  * window is currently binding, or extra-usage credits; only the API has those.
  *
  * Merge rule across instances: **the freshest file wins.** Every instance on
- * this machine shares one account, so they are all observing the same counter;
+ * one subscription shares one account (a credential profile is a subscription
+ * of its own, #1699 — the caller says which), so they observe the same counter;
  * when two readings disagree the newer one is simply the more recent
  * observation. Taking the maximum instead would be wrong precisely when it
  * matters — a pre-reset 95% from an hour ago would drown out a fresh 4%.
@@ -92,13 +93,16 @@ function readOne(dir, name, now) {
     const sevenDay = parseWindow(rl.seven_day, now);
     if (!fiveHour && !sevenDay)
         return null;
-    return { fiveHour, sevenDay, instance: name, observedAtMs };
+    const transcriptPath = typeof parsed.transcript_path === "string" && parsed.transcript_path ? parsed.transcript_path : null;
+    return { fiveHour, sevenDay, instance: name, observedAtMs, transcriptPath };
 }
 /**
  * The most recent rate-limit reading any claude-code instance has written, or
- * null when no instance has one worth using.
+ * null when no instance has one worth using. `from` keeps only the readings of
+ * one subscription (#1699): it is asked where each reading's conversation is —
+ * a credential profile's instances write under that profile's own config dir.
  */
-export function readStatuslineRateLimits(agendHome = getAgendHome(), now = Date.now()) {
+export function readStatuslineRateLimits(agendHome = getAgendHome(), now = Date.now(), from) {
     const instancesDir = join(agendHome, "instances");
     let names;
     try {
@@ -116,6 +120,8 @@ export function readStatuslineRateLimits(agendHome = getAgendHome(), now = Date.
         // the failure that makes people stop believing the panel.
         if (now - reading.observedAtMs > STATUSLINE_MAX_AGE_MS)
             continue;
+        if (from && !from(reading.transcriptPath))
+            continue;
         if (!best || reading.observedAtMs > best.observedAtMs)
             best = reading;
     }

package/dist/usage/statusline-usage.js.map

@@ -1 +1 @@
-{"version":3,"file":"statusline-usage.js","sourceRoot":"","sources":["../../src/usage/statusline-usage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC;AAiBjD,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,kFAAkF;QAClF,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,GAAW;IAC5C,MAAM,CAAC,GAAG,GAAqE,CAAC;IAChF,IAAI,OAAO,CAAC,EAAE,eAAe,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/F,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErD,8EAA8E;IAC9E,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAE1D,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,GAAW;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,IAAI,YAAoB,CAAC;IACzB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;QACtC,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6DAA6D;IAC5E,CAAC;IAED,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAErF,+EAA+E;IAC/E,MAAM,EAAE,GAAG,MAAM,CAAC,WAAuE,CAAC;IAC1F,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAErB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAExC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,YAAY,EAAE,EAClC,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,GAAgC,IAAI,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,2EAA2E;QAC3E,0DAA0D;QAC1D,IAAI,GAAG,GAAG,OAAO,CAAC,YAAY,GAAG,qBAAqB;YAAE,SAAS;QACjE,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY;YAAE,IAAI,GAAG,OAAO,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"statusline-usage.js","sourceRoot":"","sources":["../../src/usage/statusline-usage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC;AAmBjD,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,kFAAkF;QAClF,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,GAAW;IAC5C,MAAM,CAAC,GAAG,GAAqE,CAAC;IAChF,IAAI,OAAO,CAAC,EAAE,eAAe,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/F,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErD,8EAA8E;IAC9E,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAE1D,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,GAAW;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,IAAI,YAAoB,CAAC;IACzB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;QACtC,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6DAA6D;IAC5E,CAAC;IAED,IAAI,MAA4D,CAAC;IACjE,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyD,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAEhH,+EAA+E;IAC/E,MAAM,EAAE,GAAG,MAAM,CAAC,WAAuE,CAAC;IAC1F,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAErB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5H,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,YAAY,EAAE,EAClC,MAAc,IAAI,CAAC,GAAG,EAAE,EACxB,IAAiD;IAEjD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,GAAgC,IAAI,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,2EAA2E;QAC3E,0DAA0D;QAC1D,IAAI,GAAG,GAAG,OAAO,CAAC,YAAY,GAAG,qBAAqB;YAAE,SAAS;QACjE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAAE,SAAS;QACpD,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY;YAAE,IAAI,GAAG,OAAO,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/web-api.d.ts

@@ -9,6 +9,7 @@ import { type WebChatHistory } from "./web-chat-history.js";
 import { type WebFileLedger } from "./web-upload.js";
 import type { WebSessionStore } from "./web-session.js";
 import { type WebPrefsStore } from "./web-prefs.js";
+import { type MentionNames, type MentionQuery } from "./web-mentions.js";
 import type { ExplicitInstanceRemoval } from "./instance-removal.js";
 /**
  * Push a single SSE frame to every client. If a client throws (closed socket
@@ -112,6 +113,8 @@ export interface WebApiContext {
     previewForUi?(hostHeader: string | undefined, secure: boolean): PreviewAvailability & {
         boot: string | null;
     };
+    /** #1723: the same for a page of the public link (exposure `exposureId`, at `dashboardOrigin`); absent: none there. */
+    publicPreviewForUi?(exposureId: string, dashboardOrigin: string): PublicPreviewForUi;
     emitSseEvent(event: string, data: unknown): void;
     /** The web chat's recent messages (history + SSE replay); absent in contexts that have no chat. */
     readonly webChatHistory?: WebChatHistory;
@@ -121,6 +124,8 @@ export interface WebApiContext {
     webImage?(kind: "bot" | "avatar", key: string): CachedImage | null;
     /** #1630: one Discord server emoji of the fleet's bots, from the host cache (fetched once); null for any other id. */
     webEmoji?(id: string): Promise<CachedImage | null>;
+    /** #1682: names for mention ids (only those asked; from memory, never a request); absent: no names. */
+    webMentionNames?(query: MentionQuery): MentionNames;
     /** #1630: the custom emoji of the servers the fleet's Discord bots are in. */
     webEmojiList?(): Promise<Array<{
         id: string;
@@ -214,6 +219,10 @@ export interface WebApiContext {
         };
         list(target?: string): unknown[];
         create(params: unknown): unknown;
+        /** #1724: the update MCP update_schedule makes (cron and at clear each other). */
+        update?(id: string, params: Record<string, unknown>): unknown;
+        /** #1426: a pending retry of a schedule's occurrence, for the row's "retrying". */
+        getRetry?(id: string): unknown;
         delete(id: string): void;
     } | null;
 }
@@ -221,10 +230,21 @@ export interface WebApiContext {
  * Handle a Web UI request. Returns true if handled, false to pass through.
  */
 export declare function handleWebRequest(req: IncomingMessage, res: ServerResponse, url: URL, ctx: WebApiContext): boolean;
+/**
+ * #1723: a public-link page's preview: where it may frame from (`frameSrc` — the quick-tunnel wildcard while its own
+ * preview tunnel is starting or up, the exact origin for a configured web.preview_origin, null for none) and, once
+ * the preview tunnel failed, why (`detail`, a fixed reason the page words).
+ */
+export type PublicPreviewForUi = PreviewAvailability & {
+    boot: string | null;
+    frameSrc: string | null;
+    detail?: string;
+};
 export interface AppShellContext {
     previewForUi?(hostHeader: string | undefined, secure: boolean): (PreviewAvailability & {
         boot: string | null;
     }) | null;
+    publicPreviewForUi?(exposureId: string, dashboardOrigin: string): PublicPreviewForUi;
     /** #1523 N3: `web.usage_panel` — the header's ◔ is offered unless it is false (the page needs no probe read for it). */
     readonly fleetConfig?: {
         web?: {

package/dist/web-api.js

@@ -1,3 +1,4 @@
+import { withSpawnHoldReply } from "./spawn-hold-reply.js";
 import { binaryProbe } from "./binary-probe.js";
 import { settingsRequestExecution, settingsWrite, isSettingsReplay } from "./settings-request-capability.js";
 import { readBoundedWebBody } from "./web-body.js";
@@ -16,7 +17,9 @@ import { shellRoute } from "./web-shell-routes.js";
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { CreateInstanceArgs, validateArgs } from "./outbound-schemas.js";
+import { CreateInstanceArgs, CreateScheduleArgs, UpdateScheduleArgs, validateArgs } from "./outbound-schemas.js";
+import { scheduleView } from "./web-schedules.js";
+import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
 import { readStatuslineModel, resolveInstanceContext } from "./topic-commands.js";
 import { z } from "zod";
 import { evaluateWebRequest, isPassiveWebRead, isSecureRequest, isWebRequestAuthorized, WEB_TOKEN_INVALID_MESSAGE } from "./web-auth.js";
@@ -25,6 +28,8 @@ import { newWebMessageId, parseLastEventId } from "./web-chat-history.js";
 import { attachmentDelivery, displayName, INLINE_MIME, isFileId, MEDIA_RANGE_MAX, publicAttachment, sniffUpload, UPLOAD_LIMITS, wellFormed } from "./web-upload.js";
 import { getAgendHome } from "./paths.js";
 import { OPERATOR } from "./web-prefs.js";
+import { commitTeamCreate, commitTeamUpdate } from "./outbound-handlers.js";
+import { parseMentionQuery } from "./web-mentions.js";
 import { authorizeExplicitInstanceRemoval } from "./instance-removal.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
 // ── Strict public-facing schemas ────────────────────────────────────────────
@@ -46,18 +51,17 @@ const TaskUpdateSchema = z.object({
     description: z.string().max(MAX_TEXT).optional(),
     priority: z.string().max(64).optional(),
 }).strict();
-const ScheduleCreateSchema = z.object({
-    cron: z.string().min(1).max(256),
-    message: z.string().min(1).max(MAX_TEXT),
-    target: z.string().min(1).max(256),
-    label: z.string().max(256).optional(),
-    timezone: z.string().max(128).optional(),
-}).strict();
 const TeamCreateSchema = z.object({
     name: z.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+$/),
     members: z.array(z.string().min(1).max(256)).min(1).max(256),
     description: z.string().max(MAX_TEXT).optional(),
 }).strict();
+// #1689: an edit of a team — its members as they should be, and its description ("" clears it). No name: a team is
+// not renamed.
+const TeamEditSchema = z.object({
+    members: z.array(z.string().min(1).max(256)).min(1).max(256),
+    description: z.string().max(MAX_TEXT).optional(),
+}).strict();
 const ConfigUpdateSchema = z.object({
     channel: z.object({
         group_id: z.union([z.number(), z.string()]).optional(),
@@ -420,6 +424,24 @@ export function handleWebRequest(req, res, url, ctx) {
         (ctx.webEmojiList ? ctx.webEmojiList() : Promise.resolve([])).then(answer, () => answer([]));
         return true;
     }
+    // #1682: the names of the mention ids a page found in what it rendered (at most MAX_MENTION_IDS, digits only) — only
+    // those, so no page (the public link included) ever gets a directory; from memory, never a request.
+    if (method === "GET" && path === "/ui/mentions") {
+        const parsed = parseMentionQuery(url.searchParams);
+        if (!parsed.ok) {
+            json(res, 400, { error: parsed.error });
+            return true;
+        }
+        let names = { u: {}, r: {}, c: {} };
+        try {
+            names = ctx.webMentionNames?.(parsed.query) ?? names;
+        }
+        catch (err) {
+            ctx.logger.debug({ err: err.message }, "mention names unavailable");
+        }
+        json(res, 200, names);
+        return true;
+    }
     // ── Fleet prompts (C4): the hang / exit / interactive-prompt buttons, answerable here too ──
     if (method === "GET" && path === "/ui/prompts") {
         json(res, 200, { prompts: ctx.listWebPrompts?.() ?? [] });
@@ -499,6 +521,18 @@ export function handleWebRequest(req, res, url, ctx) {
         });
         return true;
     }
+    // #1723: the public link page's preview, asked while it says "Preview is starting…" — its state and, once up, its
+    // origin and boot. Public link only: a local page's preview is decided by its own load.
+    if (path === "/ui/preview-status" && method === "GET") {
+        const gateway = gatewayRequestContext(req);
+        if (!gateway || !ctx.publicPreviewForUi) {
+            json(res, 404, { error: "not offered here" });
+            return true;
+        }
+        const p = ctx.publicPreviewForUi(gateway.exposureId, gateway.expectedOrigin);
+        json(res, 200, { code: p.code, previewOrigin: p.previewOrigin, boot: p.previewOrigin ? p.boot : null, detail: p.detail ?? null });
+        return true;
+    }
     // #1665: the web preferences that follow the person between devices. Read by any page of the panel, the public link
     // included (it reads what is in force); written only by a signed-in admin session or the CLI's header token — never
     // over the public link (absent from its route manifest, and refused here too), never by a read-only session.
@@ -720,13 +754,18 @@ export function handleWebRequest(req, res, url, ctx) {
         }
         const topicMode = ctx.fleetConfig?.channel?.mode === "topic";
         (async () => {
+            let held = false;
             try {
-                await ctx.startInstance(name, config, topicMode ?? false);
+                await withSpawnHoldReply(async (message) => { held = true; json(res, 202, { held: true, message, instance: name }); }, () => ctx.startInstance(name, config, topicMode ?? false));
                 ctx.emitSseEvent("status", ctx.getUiStatus());
-                json(res, 200, { started: name });
+                if (!held)
+                    json(res, 200, { started: name });
             }
             catch (err) {
-                json(res, 500, { error: err.message });
+                if (!held)
+                    json(res, 500, { error: err.message });
+                else
+                    ctx.logger.error({ err, name }, "Held instance action failed");
             }
         })();
         return true;
@@ -839,14 +878,19 @@ export function handleWebRequest(req, res, url, ctx) {
     if (method === "POST" && restartMatch) {
         const name = decodeURIComponent(restartMatch[1]);
         (async () => {
+            let held = false;
             try {
-                await ctx.restartSingleInstance(name, { explicit: true });
+                await withSpawnHoldReply(async (message) => { held = true; json(res, 202, { held: true, message, instance: name }); }, () => ctx.restartSingleInstance(name, { explicit: true }));
                 ctx.emitSseEvent("status", ctx.getUiStatus());
-                json(res, 200, { restarted: name });
+                if (!held)
+                    json(res, 200, { restarted: name });
             }
             catch (err) {
                 const status = err.message.includes("not found") ? 404 : 500;
-                json(res, status, { error: err.message });
+                if (!held)
+                    json(res, status, { error: err.message });
+                else
+                    ctx.logger.error({ err, name }, "Held instance action failed");
             }
         })();
         return true;
@@ -964,10 +1008,28 @@ export function handleWebRequest(req, res, url, ctx) {
             json(res, 200, { schedules: [] });
             return true;
         }
-        json(res, 200, { schedules: ctx.scheduler.list() });
+        // #1724: each row with its next run and one-shot time in the fleet's zone — worked out here, not on the page.
+        const scheduler = ctx.scheduler;
+        const now = Date.now();
+        json(res, 200, {
+            schedules: scheduler.list().map((s) => scheduleView(s, scheduler.getRetry?.(s.id) ?? null, now)),
+            // The zone a new schedule (and a "Once" date and time typed without one) is read in.
+            default_timezone: ctx.fleetConfig?.defaults?.scheduler?.default_timezone
+                ?? DEFAULT_SCHEDULER_CONFIG.default_timezone,
+        });
         return true;
     }
+    // #1724: who may write a schedule, asked again once the body is in (a session revoked meanwhile, a non-admin tier).
+    const scheduleWriterGone = () => {
+        const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+        return verdict.kind !== "allow" || (verdict.via === "session" && verdict.session?.tier !== "admin");
+    };
     if (method === "POST" && path === "/ui/schedules") {
+        // #1724: schedules are not created, edited or deleted over the public link (absent from its manifest too, #1689).
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "schedule_not_over_public_link" });
+            return true;
+        }
         if (!ctx.scheduler) {
             json(res, 500, { error: "Scheduler not initialized" });
             return true;
@@ -977,10 +1039,23 @@ export function handleWebRequest(req, res, url, ctx) {
                 const body = await parseBody(req);
                 if (!permitWebContinuation(req, res, ctx))
                     return;
-                const parsed = parseOrReject(ScheduleCreateSchema, body, res);
+                if (scheduleWriterGone()) {
+                    json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                    return;
+                }
+                // #1724: the create_schedule tool's own schema — cron or at (exactly one) — plus a target, which the web names.
+                const parsed = parseOrReject(CreateScheduleArgs, body, res);
                 if (!parsed)
                     return;
-                const schedule = ctx.scheduler.create(parsed);
+                if (typeof parsed.target !== "string" || !parsed.target) {
+                    json(res, 400, { error: "target: an instance is required" });
+                    return;
+                }
+                const schedule = ctx.scheduler.create({
+                    cron: parsed.cron, at: parsed.at, message: parsed.message, target: parsed.target, label: parsed.label, timezone: parsed.timezone,
+                    ...(parsed.silent !== undefined ? { silent: parsed.silent } : {}),
+                    source: "web", reply_chat_id: "", reply_thread_id: null,
+                });
                 json(res, 200, schedule);
             }
             catch (err) {
@@ -990,7 +1065,48 @@ export function handleWebRequest(req, res, url, ctx) {
         return true;
     }
     const schedDelMatch = path.match(/^\/ui\/schedules\/(.+)$/);
+    // #1724: Edit — the update_schedule tool's validation (UpdateScheduleArgs) and its call (scheduler.update): cron and at
+    // clear each other there; silent is not touched.
+    if (method === "PATCH" && schedDelMatch) {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "schedule_not_over_public_link" });
+            return true;
+        }
+        if (!ctx.scheduler || typeof ctx.scheduler.update !== "function") {
+            json(res, 500, { error: "Scheduler not initialized" });
+            return true;
+        }
+        const id = decodeURIComponent(schedDelMatch[1]);
+        (async () => {
+            try {
+                const body = await parseBody(req);
+                if (!permitWebContinuation(req, res, ctx))
+                    return;
+                if (scheduleWriterGone()) {
+                    json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                    return;
+                }
+                if (!body || typeof body !== "object" || Array.isArray(body) || Object.hasOwn(body, "id")) {
+                    json(res, 400, { error: "expected the fields to change (the id is the path's)" });
+                    return;
+                }
+                const parsed = parseOrReject(UpdateScheduleArgs, { ...body, id }, res);
+                if (!parsed)
+                    return;
+                const { id: _id, ...changes } = parsed;
+                json(res, 200, ctx.scheduler.update(id, changes));
+            }
+            catch (err) {
+                json(res, 400, { error: err.message });
+            }
+        })();
+        return true;
+    }
     if (method === "DELETE" && schedDelMatch) {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "schedule_not_over_public_link" });
+            return true;
+        }
         if (!ctx.scheduler) {
             json(res, 500, { error: "Scheduler not initialized" });
             return true;
@@ -1027,26 +1143,82 @@ export function handleWebRequest(req, res, url, ctx) {
         return true;
     }
     if (method === "POST" && path === "/ui/teams") {
+        // #1689: not over the public link (absent from its manifest too), like editing and deleting a team.
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "teams_not_over_public_link" });
+            return true;
+        }
         (async () => {
             try {
                 const body = await parseBody(req);
                 if (!permitWebContinuation(req, res, ctx))
                     return;
+                // #1692: who may write, asked again once the body is in (as the edit does).
+                const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+                if (verdict.kind !== "allow" || (verdict.via === "session" && verdict.session?.tier !== "admin")) {
+                    json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                    return;
+                }
                 const parsed = parseOrReject(TeamCreateSchema, body, res);
                 if (!parsed)
                     return;
-                if (!ctx.fleetConfig) {
-                    json(res, 500, { error: "No fleet config" });
+                // #1692: the create_team path — members checked, an existing team never overwritten, a failed save undone.
+                const r = commitTeamCreate(ctx.fleetConfig, parsed, () => ctx.saveFleetConfig());
+                if (!r.ok) {
+                    json(res, r.status, { error: r.error });
                     return;
                 }
-                if (!ctx.fleetConfig.teams)
-                    ctx.fleetConfig.teams = {};
-                ctx.fleetConfig.teams[parsed.name] = {
-                    members: parsed.members,
-                    description: parsed.description,
-                };
-                ctx.saveFleetConfig();
-                json(res, 200, { created: parsed.name });
+                json(res, 200, r.result);
+            }
+            catch (err) {
+                json(res, 400, { error: err.message });
+            }
+        })();
+        return true;
+    }
+    // #1689: edit a team — the same update as the update_team tool (applyTeamUpdate), from the members the page sends:
+    // what to add and remove is worked out against the team as it is now. Never over the public link.
+    const teamEditMatch = path.match(/^\/ui\/teams\/(.+)$/);
+    if ((method === "PATCH" || method === "PUT") && teamEditMatch) {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "teams_not_over_public_link" });
+            return true;
+        }
+        const name = decodeURIComponent(teamEditMatch[1]);
+        // Who may write, asked again once the body is in (#1693 review): a session revoked or a token rotated meanwhile
+        // writes nothing.
+        const writerNow = () => {
+            const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+            return verdict.kind === "allow" && !(verdict.via === "session" && verdict.session?.tier !== "admin");
+        };
+        (async () => {
+            try {
+                const body = await parseBody(req);
+                if (!permitWebContinuation(req, res, ctx))
+                    return;
+                if (!writerNow()) {
+                    json(res, 401, { error: WEB_TOKEN_INVALID_MESSAGE });
+                    return;
+                }
+                const parsed = parseOrReject(TeamEditSchema, body, res);
+                if (!parsed)
+                    return;
+                const teams = ctx.fleetConfig?.teams;
+                const current = teams && Object.hasOwn(teams, name) ? teams[name].members : null;
+                if (!current) {
+                    json(res, 404, { error: `Team not found: ${name}` });
+                    return;
+                }
+                const want = [...new Set(parsed.members)];
+                // The update and its save as one: a failed save leaves the team as it was (500).
+                const r = commitTeamUpdate(ctx.fleetConfig, {
+                    name, add: want.filter(m => !current.includes(m)), remove: current.filter(m => !want.includes(m)), description: parsed.description,
+                }, () => ctx.saveFleetConfig());
+                if (!r.ok) {
+                    json(res, r.status, { error: r.error });
+                    return;
+                }
+                json(res, 200, { updated: r.result });
             }
             catch (err) {
                 json(res, 400, { error: err.message });
@@ -1056,8 +1228,13 @@ export function handleWebRequest(req, res, url, ctx) {
     }
     const teamDelMatch = path.match(/^\/ui\/teams\/(.+)$/);
     if (method === "DELETE" && teamDelMatch) {
+        if (gatewayRequestContext(req)) {
+            json(res, 403, { error: "teams_not_over_public_link" });
+            return true;
+        }
         const name = decodeURIComponent(teamDelMatch[1]);
-        if (!ctx.fleetConfig?.teams?.[name]) {
+        // Own keys (#1689): a team is one fleet.yaml defines — "__proto__" or "constructor" is not found.
+        if (!ctx.fleetConfig?.teams || !Object.hasOwn(ctx.fleetConfig.teams, name)) {
             json(res, 404, { error: `Team not found: ${name}` });
             return true;
         }
@@ -1350,8 +1527,12 @@ function handleUpload(req, res, url, ctx) {
     });
 }
 function shellPreview(req, ctx, mode) {
-    if (mode !== "full" || gatewayRequestContext(req))
+    if (mode !== "full")
         return null;
+    // #1723: a page of the public link asks its own exposure's preview — never the local listener's Host-based choice.
+    const gateway = gatewayRequestContext(req);
+    if (gateway)
+        return ctx.publicPreviewForUi?.(gateway.exposureId, gateway.expectedOrigin) ?? null;
     return ctx.previewForUi?.(typeof req.headers.host === "string" ? req.headers.host : undefined, isSecureRequest(req)) ?? null;
 }
 /**
@@ -1422,6 +1603,8 @@ function shellBodyTag(req, ctx, mode) {
         + ` data-preview-boot="${attr(p?.previewOrigin ? p.boot : "")}" data-preview-reason="${attr(p ? p.reason : "Previews are not available on this fleet.")}"`
         // #1554: no availability asked (the public link, or not the full app) still says why, in the page's language.
         + ` data-preview-reason-code="${attr(p ? p.code ?? "" : gatewayRequestContext(req) ? "publicLink" : "notOffered")}"`
+        // #1723: why the public link's preview tunnel failed (a fixed reason the page words), when it did.
+        + `${p?.detail ? ` data-preview-detail="${attr(p.detail)}"` : ""}`
         // #1523 N3: whether the fleet serves /api/ai-usage (web.usage_panel), for every page's ◔.
         + ` data-usage-panel="${ctx.fleetConfig?.web?.usage_panel === false ? "0" : "1"}"`
         // #1589: the public link shows attachments as downloads only (no inline text or media): its scope is unchanged.
@@ -1438,7 +1621,10 @@ export function serveAppShell(req, res, ctx, mode) {
         const own = mode === "full" && !gatewayRequestContext(req)
             ? dashboardOriginFor(typeof req.headers.host === "string" ? req.headers.host : undefined, isSecureRequest(req)) : null;
         const mediaSrc = own ? `${own}/ui/file/` : "'none'";
-        sendPanelHtml(res, html.replace('<html lang="en">', shellHtmlTag(ctx, mode)).replace("<body>", shellBodyTag(req, ctx, mode)), 200, {}, { ...(p?.previewOrigin ? { frameSrc: `${p.previewOrigin}/frame` } : {}), mediaSrc });
+        // A public-link page frames what its exposure's preview names (the quick-tunnel wildcard: its host is not known when
+        // the page may load); every other page frames exactly the origin this load chose (#1723).
+        const frameSrc = p && "frameSrc" in p ? p.frameSrc : p?.previewOrigin ? `${p.previewOrigin}/frame` : null;
+        sendPanelHtml(res, html.replace('<html lang="en">', shellHtmlTag(ctx, mode)).replace("<body>", shellBodyTag(req, ctx, mode)), 200, {}, { ...(frameSrc ? { frameSrc } : {}), mediaSrc });
     }
     catch {
         json(res, 500, { error: "app.html not found" });