@songsid/agend 2.3.0-beta.11 → 2.3.0-beta.13

package/dist/fleet-process-handlers.d.ts

@@ -0,0 +1,18 @@
+/** Synchronous evidence before shutdown: neither a network nor logger worker is required. */
+export declare function recordFleetFatal(dataDir: string, error: unknown): void;
+interface FleetProcessOptions {
+    dataDir: string;
+    manager: {
+        stopAll(): Promise<void>;
+        notifyFleetError(message: string): void;
+    };
+    runtime: Pick<NodeJS.Process, "on" | "exit">;
+    describeSignal: () => string;
+    console?: Pick<Console, "log" | "error">;
+    writeFatal?: typeof recordFleetFatal;
+}
+/** Identical process policy for cold start and the legacy in-process reload. */
+export declare function installFleetProcessHandlers(options: FleetProcessOptions): {
+    readonly stopping: boolean;
+};
+export {};

package/dist/fleet-process-handlers.js

@@ -0,0 +1,69 @@
+import { closeSync, fsyncSync, mkdirSync, openSync, writeSync } from "node:fs";
+import { join } from "node:path";
+/** Synchronous evidence before shutdown: neither a network nor logger worker is required. */
+export function recordFleetFatal(dataDir, error) {
+    mkdirSync(dataDir, { recursive: true });
+    const fd = openSync(join(dataDir, "fleet-fatal.log"), "a", 0o600);
+    try {
+        writeSync(fd, JSON.stringify({ timestamp: new Date().toISOString(), pid: process.pid,
+            argv: process.argv, reason: "uncaughtException", error: String(error),
+            stack: error instanceof Error ? error.stack : undefined }) + "\n");
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Identical process policy for cold start and the legacy in-process reload. */
+export function installFleetProcessHandlers(options) {
+    const { runtime, manager } = options;
+    const output = options.console ?? console;
+    let stopping = false;
+    const shutdown = async () => {
+        if (stopping)
+            return;
+        stopping = true;
+        output.log("\nStopping fleet...");
+        // stopAll fences new controls and drains CPU profiles before disposal.
+        await manager.stopAll().catch(error => output.error("Shutdown error:", error));
+        runtime.exit(0);
+    };
+    runtime.on("SIGINT", shutdown);
+    runtime.on("SIGTERM", () => {
+        output.log(options.describeSignal());
+        return shutdown();
+    });
+    runtime.on("uncaughtException", async (error) => {
+        output.error("Uncaught exception:", error);
+        try {
+            (options.writeFatal ?? recordFleetFatal)(options.dataDir, error);
+        }
+        catch (writeError) {
+            output.error("Failed to persist fleet fatal reason:", writeError);
+        }
+        if (stopping)
+            return;
+        stopping = true;
+        // Arbitrary uncaught exceptions still leave unknown state and remain fatal.
+        await manager.stopAll().catch(() => { });
+        runtime.exit(1);
+    });
+    runtime.on("unhandledRejection", error => {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes("409") && message.includes("getUpdates")) {
+            output.error("Bot polling conflict (409) — retrying...");
+            return;
+        }
+        output.error("Unhandled rejection (fleet continues):", error);
+        if (error instanceof Error && error.stack)
+            output.error(error.stack);
+        try {
+            manager.notifyFleetError(`⚠️ Fleet caught an unhandled error and kept running:\n\`${message}\`\nSee fleet.log for the stack trace.`);
+        }
+        catch (notifyError) {
+            output.error("Failed to report unhandled rejection:", notifyError);
+        }
+    });
+    return { get stopping() { return stopping; } };
+}
+//# sourceMappingURL=fleet-process-handlers.js.map

package/dist/fleet-process-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-process-handlers.js","sourceRoot":"","sources":["../src/fleet-process-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAc;IAC9D,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;YAClF,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YACrE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACrE,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC9B,CAAC;AAWD,gFAAgF;AAChF,MAAM,UAAU,2BAA2B,CAAC,OAA4B;IACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAClC,uEAAuE;QACvE,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QACrC,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;QAC5C,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC;YAAC,CAAC,OAAO,CAAC,UAAU,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QACzE,OAAO,UAAU,EAAE,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,UAAU,CAAC,CAAC;QAAC,CAAC;QACzF,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,4EAA4E;QAC5E,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC,EAAE;QACvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,OAAO,CAAC,gBAAgB,CAAC,2DAA2D,OAAO,wCAAwC,CAAC,CAAC;QACvI,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,WAAW,CAAC,CAAC;QAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,QAAQ,KAAK,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/dist/general-knowledge/skills/fleet-config/SKILL.md

@@ -84,6 +84,8 @@ Fix all errors before `agend reload`; warnings are advisory.
 - `topic_id` as string vs number (both work, but be consistent)
 - `backend` typo (valid: `claude-code`, `codex`, `opencode`, `kiro-cli`, `antigravity`, `grok`, `muse`); `gemini-cli` was removed in 2.1.12 — use `antigravity`
 - `model` using wrong format for the backend
+- YAML anchors/aliases (`&x` … `*x`) are fine, but a Settings or tool edit of one place gives that place its own
+  value; the others keep theirs (#2208). To change every place, edit fleet.yaml itself.
 
 **Common classicBot.yaml mistakes:**
 - `allowed_guilds` values should be quoted strings: numbers are accepted, but a Discord ID above 2^53 loses digits as a YAML integer

package/dist/general-knowledge/skills/web-appearance/SKILL.md

@@ -14,6 +14,7 @@ can shape how you look there — **only your own look, and only on the surfaces
 | Your name and role line | display name, description | `set_display_name`, `set_description` |
 | Your status stamp | persona emoji | `set_persona_emoji` (see the `persona-emoji` skill) |
 | Your chat | theme: colours, accent, bubbles, font, background picture, working label | `set_web_theme`, `set_web_theme_asset` |
+| The whole page, while your chat is open | your theme's colours on the sidebar, the header, the usage rail (a phone: the drawer, the header, the tabs) — colours only | `set_web_theme` (`page`) |
 | Your face and ring | theme picture and accent | `set_web_theme`, `set_web_theme_asset` |
 | Your identity card | portrait, banner, tagline, bio | `set_web_theme` (`card.*`), `set_web_theme_asset` |
 | Your identity colour | the colour people find you by in the sidebar, and where it shows (name, bar, ring) | `set_web_theme` (`identity`) |
@@ -23,7 +24,7 @@ can shape how you look there — **only your own look, and only on the surfaces
 | Effects in your chat | Canvas Worker animations, and Try cards an admin outside the public link may start | `upload_web_effect`, `apply_web_effect`, `preview_web_effect`, … (see Effects) |
 
 None of these tools takes a target: they always act on you. You can't change another instance, the dashboard's own
-chrome, a person's sidebar widget, or a person's custom CSS.
+chrome (beyond your colours on it while your chat is open), a person's sidebar widget, or a person's custom CSS.
 
 ## For the user: Settings → Web appearance (General, coordinators, full)
 
@@ -40,10 +41,11 @@ of this skill).
 
 | `what` | Changes | Example |
 |---|---|---|
-| `host` | `themes_shown`, `card_size` (s/m/l), `card_sizes` ({instance: s/m/l}), `colour_places` (name/bar/ring), `colours_off`, `sidebar_widget` ({spec, data}) — null puts one back to its default | `{ what: "host", set: { colour_places: ["name","ring"] } }` |
+| `host` | `themes_shown`, `card_size` (s/m/l), `card_sizes` ({instance: s/m/l}), `page_colours` ({instance: page/chat}), `colour_places` (name/bar/ring), `colours_off`, `sidebar_widget` ({spec, data}) — null puts one back to its default | `{ what: "host", set: { colour_places: ["name","ring"] } }` |
 | `agent_colour` | one agent's colour (`preset:<name>` or `#rrggbb`) and places; null resets each | `{ what: "agent_colour", instance: "atlas", colour: "preset:teal" }` |
+| `page_colours` | where one agent's theme colours go: `page` (the whole page), `chat` (only its chat) or `agent` (its own `page.on`) — as ⋯ → Page colours sets it | `{ what: "page_colours", instance: "atlas", choice: "chat" }` |
 | `banner_focus` | which part of one agent's cropped card banner stays in view: `focus` 0 (top) … 100 (bottom), 50 the centre; it wins over the agent's own `card.bannerFocus`; null follows the agent's again | `{ what: "banner_focus", instance: "atlas", focus: 20 }` |
-| `custom_css` | `save` (with `text`): goes **on trial** on their screens (it goes back by itself unless kept); `keep` (the trial), `revert` (the trial), `use` (with `version`: an earlier saved one, at once), `off` | `{ what: "custom_css", action: "save", text: "…" }`; ask how it looks, then `keep` only when they say so |
+| `custom_css` | `save` (with `text`): goes **on trial**. It waits until they open the dashboard (up to 10 minutes; never opened, it goes back unseen), then goes back by itself 20 s after it is on their screen unless kept (#2198). `keep` (with `trial`: the id `save` returned — a different trial on now, say one they saved on their page since, is refused with `trial_mismatch`, never kept instead; or, kept after that 20 s ran out, it is put back in force as `use` of it), `revert` (the trial), `use` (with `version`: an earlier saved one, at once), `off` | `{ what: "custom_css", action: "save", text: "…" }`; tell them to open the dashboard and look, then `keep` (with that `trial`) only when they say so — a `keep` that comes too late (`not_on_trial`) means use `use` with the version from `get_web_settings` |
 | `mod` | an agent's proposal: `review` (instance → `stage`, `plan`, `plan_hash`), then `install` (stage, plan_hash, `include`: the parts, `target`: the agent); `cancel`, `dismiss`, `uninstall` (id) | review, show the user the plan, install only what they asked for — never custom CSS unasked. A person has one review open at a time: while theirs is open (`mod_review_open`) ask them to finish it; a mod they imported from a file is theirs to install (`mod_not_from_an_agent`) |
 | `effect` | `apply` (instance, id, params?) or `remove` (instance, id?) an effect on a chat | |
 | `ambient` | one agent's ambient effect, set for the user: `ambient` is the same spec as `set_web_ambient`'s (it replaces the one of its kind, and the agent can't change it after); `ambient: null` clears (`which`: `loop` or `click`, default both) | `{ what: "ambient", instance: "atlas", ambient: { preset: "fall", glyphs: ["🌸","❀","✿"] } }` |
@@ -107,6 +109,17 @@ Typed values only; anything else is refused with `{ errors: [{ path, problem }]
   - `show` is a list of `name`, `bar` and `ring` (`[]` for nowhere). Left out, the host's default applies (name, bar and ring).
   - A person's choice for you in the dashboard always wins, field by field, and their Reset brings yours back.
     `get_web_appearance` says which is in force.
+- `page` (#2196): `{ on?: true | false, sidebar?: { light?, dark? } }` — `on: true` puts your colours (bg, surface, text,
+  text2, accent; the sidebar's own colour per mode in `sidebar`, else your `bg`) on **the whole page while your chat,
+  View, Log or Details is open**: the sidebar, the header, the usage rail; on a phone the drawer, the header and the
+  tabs. Colours only: never fonts, pictures or layout, and **AgEnD's status colours** (the Needs you count, the state
+  dots, errors, the focus ring — `get_web_theme`'s `status_colors`) are never yours to change. With `on: true` the
+  contrast check adds: `text` and `text2` 4.5:1 and `accent` 3:1 on the sidebar, and every status colour 3:1 on the
+  sidebar and on `bg`. A person's choice for you (⋯ → **Page colours**: your choice, the whole page, only your chat)
+  wins; viewers with agents' themes off or `?safe=1` see the page's own look.
+- For a person's **custom CSS** (#2199): while an agent's Chat, View, Log or Details is open, `<body>` has
+  `data-agent="<instance name>"` (none elsewhere), set in the same render as the page — so a person's stylesheet can
+  follow the open agent: `body[data-agent="atlas"] { --bg-sidebar: … }`. It is the person's, not yours to set.
 - `bubble`: `{ radius: 0..24, border: "none" | "thin" | "accent" }`.
 - `font`: `"inter"`, `"system"` or `"mono"`.
 - `background`: `{ image: <asset id>, fit: "cover" | "contain", opacity: 0.05..1 }`.
@@ -157,6 +170,10 @@ screen and layout. `card.bannerFocus` (0 top … 100 bottom; default 50, the cen
 near the top at `bannerFocus: 0`. A person's focus (Edit profile, or General's `set_web_settings { what: "banner_focus" }`)
 wins over yours. `preview_web_appearance` draws the banner cropped at its focus, as the page does (an M card).
 
+**In your chat** the card is hidden until the person shows it (a card button in the chat header). Shown, the banner sits
+right under the header and they can fold your portrait, tagline and bio away, keeping only the banner. Their choice,
+kept on their device; you cannot change it. So a banner that says who you are on its own reads well in your chat too.
+
 ## Your identity colour
 
 The colour people find you by in the sidebar, drawn on your name, a bar at your row's left edge and/or the ring around

package/dist/general-knowledge/skills/web-dashboard/SKILL.md

@@ -84,10 +84,12 @@ View, Settings or Needs you. To invite someone: turn it on, then tell them to se
 Settings over the public link.
 
 **Web authority (#1939, 2.3 beta).** A signed-in fleet admin's browser can speak as their own Discord or Telegram
-account. Under the composer (and in the session menu) the line says **Not verified · Authorize this browser**. Pressing it
+account. The one row under the composer (bottom left, before the Enter hint) says **Not verified · Authorize**; the
+session menu says **Not verified · Authorize this browser**. Pressing it
 sends a card to that account's DM, saying which browser (device, on this computer or the network, when, until when), with
 **Confirm** and **Not me**. A card left for 5 minutes is marked expired on the card, and the line offers Authorize
-again. Confirm within 5 minutes and the line says **Verified · speaks as you until …**. That
+again. Confirm within 5 minutes and the session menu says **Verified · speaks as you until …**; the composer's row says
+just **✓ Verified**, with the until-when in its tooltip, its accessible name and a tap. That
 browser's messages then carry the account's authority in their delivery receipt for `max_session_hours` (default 48).
 Not me signs that browser out, also after Confirm, from the same card. At most one card waits per browser, and 3 an hour
 per account. Never on the public link or for a guest; when a browser can't be authorized, the line says why (with a
@@ -98,6 +100,8 @@ Agents then see that browser's messages as `via web (verified)` and check their
 
 ## Chat
 
+A message to a paused agent wakes it through the same delivery path as Discord/Telegram, including ClassicBot. The composer shows **Waking…**; a refused wake explains why, keeps the draft/files and offers **Retry send**. No automatic resend. Stopped agents still require Start. Upload/history/Cancel do not wake agents. Existing guest/public-link send permissions are unchanged.
+
 **Sending.** Type and press Enter. A message sent while the agent works waits its turn; `/steer <text>` goes into
 the current turn, `/btw <question>` asks a side question. **Stop reply** (or Esc) interrupts the reply and drops
 queued messages. Text is capped at 16,384 characters; a paste over 4,000 characters becomes a `pasted-….txt`
@@ -191,7 +195,11 @@ Colour by kind — task (delegate_task) purple, send/query/update teal, report p
 read. "×N" = several messages share a line; failed ones belong in Needs you. A `delegate_task` also draws the work: a
 slow-moving purple line, delegator → worker, **in progress** until the worker's `report_result` with the same
 correlation id comes back (then one pink line returns); none after 4 h fades as **no report yet**. Reloads and the
-public link show the open ones. Every line ends on a card or a folded team's box. No message
+public link show the open ones. Every line ends on a card or a folded team's box. #2182: lines are routed card to card
+by libavoid (libavoid-js 0.4.5, LGPL) in a worker — around cards, through gaps in team borders, never along a border or
+across a team's name, lines sharing a stretch drawn apart; zoomed out, or where the router can't run (no WebAssembly,
+an old browser), they follow the gaps between teams as before. The worker alone may run WebAssembly and reaches nothing
+(its own CSP); the dashboard's CSP is unchanged. No message
 text is ever shown; instances with `cross_instance_visibility: hidden` are left out. On a public link it refreshes
 every 5 s.
 
@@ -215,8 +223,13 @@ to that instance's Log).
 - **Log** — [the Log tab](#the-log-tab).
 - **Details** — Configuration (display name, description, directory, bound to, tags; "Read only — change it in
   Settings." with **Edit in Settings**), Runtime (backend, model, effort, cost, context, 5 h and 7 d rate), Recent
-  activity, its identity card and widget. The ⋯ menu: Start / Restart / Stop instance, Pause / Wake, Colour…, and
+  activity, its identity card and widget. The ⋯ menu: Start / Restart / Stop instance, Pause / Wake, Colour…, **Page
+  colours** (#2196: the agent's choice / on the whole page / only its chat — host prefs `theme.pageByInstance`), and
   the theme lock/reset.
+- **Page colours (#2196):** an agent's theme with `page.on` (or a person's "on the whole page") colours the sidebar,
+  the header and the usage rail (a phone: drawer, header, tabs) while that agent's Chat/View/Log/Details is open —
+  colours only; status colours (Needs you count, state dots, errors, focus ring) never change. The header follows the
+  page, not the chat. Off with agents' themes off or `?safe=1`.
 
 Phone layout: bottom tabs Chat, Needs you, Fleet, Settings. Chat is current on any of an agent's pages and goes to its
 chat; View, Log and Details are the switch under the header.
@@ -285,6 +298,8 @@ running; kiro shows fleet events only; other backends say they have no readable
 
 ## Settings
 
+**Connections → Retry now** retries a disconnected connection without a fleet restart; a running login is reused. Startup retries continue with a five-minute cap. Local admin only, unavailable over public links. It changes no token or binding; refresh to read the later result.
+
 Tabs (`/settings/<tab>`): **Preferences**, **Web appearance**, **Agents**, **Connections**, **ClassicBot**,
 **General**, **Web**, **Developer**. Header: version, **Setup wizard**, **Help**.
 
@@ -292,7 +307,10 @@ Tabs (`/settings/<tab>`): **Preferences**, **Web appearance**, **Agents**, **Con
 **Stage change** (General/Web: **Review changes**) adds it to the bar **Changes not applied yet**, which shows the
 cost — **Immediately**, **Restart this Agent** or **Restart AgEnD** — then **Apply changes** or **Discard**.
 Confirmations (e.g. opening access) are asked at Apply. A change that loosens access waits for a fleet admin to confirm
-in the General chat ("Waiting for confirmation", **Withdraw**). After a failure, unapplied changes are staged again
+in the General chat ("Waiting for confirmation", **Withdraw**) — unless the browser is web-verified (#2170): an
+account that is a fleet admin of every connection the change affects, on their platform, confirms it by its own Apply
+("Confirmed by your account"; General gets a notice; every check runs again at execution). Not for a guest, the public
+link, an unverified browser or a change that needs the host CLI. After a failure, unapplied changes are staged again
 (secrets must be re-entered). **Restart AgEnD** restarts every agent. Preferences and Web appearance save directly.
 
 **Preferences** — follows you across devices unless marked:
@@ -472,6 +490,10 @@ fleet.yaml (Developer tab, or the file) and `agend reload`.
 
 ### Canvas Worker playback diagnostics
 
+The effect player loads only when there is something to play: the open chat has a placed effect, the person chose a
+personal effect, or a Try card is shown (#2193). Before that, nothing of it is in the page, by design. Ambient effects
+and custom CSS never need it.
+
 If an effect cannot play, the Chat notice and Effects dialog show its local refusal code. A failed Try retains its stop
 code on the offer card; the browser console also names refusals. Include the code when reporting a problem. Long chat
 history is checked separately from the bounded set of current paint holes. Moving the pointer away does not stop Try;

package/dist/instance-lifecycle.d.ts

@@ -201,6 +201,8 @@ export interface IncidentEventSource {
     /** Real daemons buffer `pty_error` raised by the startup scan until the lifecycle can handle it. */
     holdStartupIncidents?(): void;
     releaseStartupIncidents?(): void;
+    /** Reconsider a cooldown-suppressed MCP revival through daemon liveness/idle gates. */
+    deferMcpRestart?(delayMs: number): void;
 }
 /** Arguments accepted by handleCreate — mirrors CreateInstanceArgs in outbound-schemas.ts
  *  plus internal-only fields forwarded by deploy_template (profile-derived). */

package/dist/instance-lifecycle.js

@@ -696,8 +696,10 @@ export class InstanceLifecycle {
             const incident = this.mcpIncident(name);
             const generation = ++incident.gen;
             incident.deathNoticeSent = false;
-            this.ctx.eventLog?.insert(name, "mcp_died", { pid: data.pid });
-            this.ctx.logger.error({ name, pid: data.pid }, "MCP server died — instance cannot use agend tools");
+            this.ctx.eventLog?.insert(name, "mcp_died", { pid: data.pid, ...(data.neverConnected ? { neverConnected: true } : {}) });
+            this.ctx.logger.error({ name, pid: data.pid, neverConnected: data.neverConnected === true }, data.neverConnected
+                ? "MCP server never connected — instance cannot use agend tools"
+                : "MCP server died — instance cannot use agend tools");
             this.ctx.webhookEmit("mcp_died", name, { pid: data.pid });
             // Auth outranks MCP: when the CLI lost authentication, "MCP server died"
             // is a symptom and the fix is /login, not a restart. The daemon flags a
@@ -804,13 +806,16 @@ export class InstanceLifecycle {
             // The daemon object dies with the restart it asks for, so the loop guard
             // lives here: if the previous auto-restart was under the cooldown, the new
             // MCP server evidently died right back (broken install, OOM pressure) and
-            // another attempt would just cycle the instance. Leave it to the operator —
-            // the mcp_died notification for this death has already gone out.
+            // another immediate attempt would just cycle the instance. Keep a bounded
+            // reconsideration on the daemon: a one-shot suppression strands this pid
+            // forever because later health ticks dedupe the already reported death.
             const last = this.mcpAutoRestartAt.get(name) ?? 0;
             const now = Date.now();
             if (now - last < InstanceLifecycle.MCP_AUTO_RESTART_COOLDOWN_MS) {
-                this.ctx.eventLog?.insert(name, "mcp_auto_restart_suppressed", { trigger: data.trigger });
-                this.ctx.logger.error({ name, trigger: data.trigger }, "MCP auto-restart suppressed — the previous attempt is still inside the cooldown, so the restart is not fixing it");
+                const retryAfterMs = InstanceLifecycle.MCP_AUTO_RESTART_COOLDOWN_MS - (now - last);
+                this.ctx.eventLog?.insert(name, "mcp_auto_restart_suppressed", { trigger: data.trigger, retryAfterMs });
+                this.ctx.logger.warn({ name, trigger: data.trigger, retryAfterMs }, "MCP auto-restart deferred — will reconsider after the cooldown with liveness and idle checks");
+                daemon.deferMcpRestart?.(retryAfterMs);
                 return;
             }
             this.mcpAutoRestartAt.set(name, now);