@songsid/agend 2.3.0-beta.3 → 2.3.0-beta.5

package/dist/fleet-manager.js

@@ -48,6 +48,7 @@ import { isProbeableRouteTarget } from "./fleet-context.js";
 import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
+import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes } from "./backend-availability.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
 import { OutboxOpenError } from "./outbox-open-error.js";
 import { AdapterWorld } from "./adapter-world.js";
@@ -65,7 +66,7 @@ import { createBackend } from "./backend/factory.js";
 import { readEffortMetadata } from "./backend/effort-metadata.js";
 import { codexEffort, flagEffort } from "./backend/launch-effort.js";
 import { codexMetadataHomes, readCodexModelEffortLevels, resolveCodexLaunchModel } from "./backend/codex-metadata.js";
-import { CLI_ENV_TTL_MS, isModelCompatible, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
+import { CLI_ENV_TTL_MS, isModelCompatible, noteResolvedBinary, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
 import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
@@ -134,9 +135,9 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
     }
     return tasks;
 }
-import { handleWebRequest, broadcastSseEvent, SSE_HEARTBEAT_MS } from "./web-api.js";
+import { handleWebRequest, broadcastSseEvent, broadcastToGuests, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { LogService } from "./log-service.js";
-import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId } from "./web-chat-history.js";
+import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId, webChatFrom } from "./web-chat-history.js";
 import { WebChatDiskStore } from "./web-chat-store.js";
 import { SeenUsers, resolveMentions } from "./web-mentions.js";
 import { OPERATOR, WebPrefsStore } from "./web-prefs.js";
@@ -158,7 +159,7 @@ import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { parsePoll } from "./reply-polls.js";
 import { isUploadRequest, limitRequestReceive, publicAttachment, sweepOrphanedUploads, UPLOAD_REQUEST_TIMEOUT_MS, uploadLimits, WebFileLedger } from "./web-upload.js";
 import { REPLY_FILES_MAX_BYTES, snapshotReplyFile, sweepReplySnapshots, webFilesDir } from "./web-reply-files.js";
-import { cardPicture, handleViewRequest, humanCards, identityColors, isViewPath, personIdentityColour, profileIdentities, resolveInstanceIdentity, setPersonIdentityColour } from "./view-api.js";
+import { cardPicture, handleViewRequest, humanCards, identityColors, isViewPath, personBannerFocus, personIdentityColour, profileIdentities, resolveInstanceIdentity, setPersonBannerFocus, setPersonIdentityColour } from "./view-api.js";
 import { autoIdentityColor } from "./web-identity-color.js";
 import { AppearanceTools } from "./web-appearance-tools.js";
 import { cardVersion, resolveCard } from "./web-card.js";
@@ -181,6 +182,7 @@ import { canonicalCommand, commandSpec, decideCommand, ruleFor } from "./command
 import { crossInstanceVisibility, runVisibilityCommand } from "./cross-instance-notice.js";
 import { WebSettingsTools } from "./web-settings-tools.js";
 import { bindGuestRequest, guestRouteDecision } from "./web-guest-access.js";
+import { GUEST_ROOM_TICK_MS, GuestRoomMembership, guestGroupRooms } from "./web-guest-rooms.js";
 import { TrafficLog, trafficItem } from "./fleet-traffic.js";
 import { installedChannel, updateNoticeKey } from "./update-check.js";
 import { resolveInstalledAgend } from "./update-dispatch.js";
@@ -193,7 +195,7 @@ import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { recentChatContext } from "./log-tail.js";
 import { describeSignalSource, recordInternalRequest, withOrigin } from "./fleet-control-audit.js";
 import { handleAgentRequest, ToolNotPermittedError } from "./agent-endpoint.js";
-import { ClassicChannelManager, classicWebEchoOn, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
+import { ClassicChannelManager, classicWebEchoOn, getClassicBackendChoices, inferClassicChannelType, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { KNOWN_BACKENDS, validateFleetConfig } from "./config-validator.js";
 import { isRemovedBackend, removedBackendMessage } from "./backend/removed.js";
@@ -224,8 +226,9 @@ import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefu
 import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
 import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
 import { isWebPageNavigation } from "./web-shell-routes.js";
-import { localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
-import { WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
+import { guestSessionPolicy, localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
+import { evaluateWebAuthority, webAuthorityPolicy } from "./authority/web-authority.js";
+import { GuestLoginCodes, WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
 import { CodeRequestLimiter, ReturningDevices } from "./web-returning-device.js";
 import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
 import { createPreviewListener, normalizeOrigin, previewAvailability, previewSettings } from "./web-preview.js";
@@ -238,7 +241,7 @@ import { PROVIDER_SECRET_SPECS, providerSecretSpec, providerRegistryEnvKeys, isR
 /** A self-restart is a whole service restart; 120s is the apply budget, not this. */
 const SELF_RESTART_DEADLINE_MS = 300_000;
 import { APPLY_FLEET_TARGET, ApplyJobStore, viewOf, } from "./apply-job.js";
-import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
@@ -800,6 +803,9 @@ export class FleetManager {
     /** Injectable only to keep the chat→CLI reload hand-off deterministic in tests. */
     fullRestartLauncher = launchFullRestartHelper;
     eventLogPruneTimer = null;
+    /** #1920 §3.2: the background reads of guests' ClassicBot room membership (a minute's tick; reads only what is due). */
+    guestRoomsTimer = null;
+    guestRoomMembership = null;
     outboxPruneTimer = null;
     logRotateTimer = null;
     discordPresenceTimer = null;
@@ -1111,6 +1117,9 @@ export class FleetManager {
             colour: (name) => personIdentityColour(this.dataDir, name),
             setColour: (name, patch) => { const w = setPersonIdentityColour(this.dataDir, name, patch); if (w.ok)
                 this.identityChanged(); return w; },
+            bannerFocus: (name) => personBannerFocus(this.dataDir, name),
+            setBannerFocus: (name, focus) => { const w = setPersonBannerFocus(this.dataDir, name, focus); if (w.ok)
+                this.identityChanged(); return w; },
             placements: (name) => this.themeStore.get(name).placements.effects.map((e) => (typeof e === "string" ? { id: e } : e)),
             announce: () => { try {
                 this.emitSseEvent("status", this.getUiStatus());
@@ -1388,9 +1397,26 @@ export class FleetManager {
     sseHeartbeatMs = SSE_HEARTBEAT_MS;
     /** The dashboard's login codes. Memory only: a code that outlives the process is a code nobody can prove was not copied. */
     webLoginCodes = null;
+    /**
+     * #1920 step 4: guests' codes, apart from the admins' — one per account, so no guest's `/web` withdraws another's or
+     * an admin's code (#2093 review), at most 32 at once. Local sign-in only for now (audience "local").
+     */
+    webGuestLoginCodes = null;
+    /** #1920 step 4: when each account last got a guest code (monotonic) — one a minute, so `/web` is no DM flood. */
+    guestCodeAskedAt = new Map();
+    /** #2093 review: an account's guest /web in progress — one at a time, so two at once cannot both pass the minute. */
+    guestCodeInFlight = new Set();
+    /**
+     * #2093 review: revokes a guest /web in progress must see — every web session's (`/web revoke` from an admin) bumps
+     * the global count, an account's own bumps its entry — checked before the code is issued and while it is delivered.
+     */
+    guestRevokes = 0;
+    guestAccountRevokes = new Map();
     /** #1570: browsers that may ask the sign-in page for a fresh code, and how often they may. */
     returningDevices = null;
     codeRequestLimiter = new CodeRequestLimiter();
+    /** #1920 step 4b: guests' device code requests, limited apart — guests never use up the admins' fleet-wide budget. */
+    guestCodeRequestLimiter = new CodeRequestLimiter();
     /**
      * Set while a Settings apply job is driving the reconcile. The reconcile
      * stays the single doer; it just says out loud what it is doing to whom, so
@@ -1538,6 +1564,7 @@ export class FleetManager {
                 meta: {
                     chat_id: set.chatId, message_id: messageId, user: by.username, user_id: by.userId, ts,
                     thread_id: set.threadId, adapter_id: inbound.adapterId, source: inbound.source,
+                    ...(web && by.guest ? { web_guest: "1" } : {}), // #1920: "[user:… via web (guest), id:…]", as /ui/send
                     ...reactions.meta,
                 },
             }, by.humanOrigin, button.label)) !== false;
@@ -1558,6 +1585,9 @@ export class FleetManager {
         this.emitSseEvent("message", {
             instance: set.instance, sender: by.username, role: "user", text: content, ts, ...(web ? { messageId } : {}),
             click: { label: button.label, of: set.id },
+            // #1920: a platform click is its clicker's; it is the instance's channel's only when its buttons are there (the
+            // same rule as a reply's: a set sent to another topic or a DM is not). A web click is the web's.
+            ...(web ? {} : { from: webChatFrom(set.adapterId, by.userId), ...(this.clickInOwnChannel(set) ? { channel: true } : {}) }),
         });
         return true;
     }
@@ -2439,6 +2469,7 @@ export class FleetManager {
         this.fleetConfig = loaded;
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.warnAboutRemovedLoginMode(loaded);
+        this.enforceGuestSwitch();
         return this.fleetConfig;
     }
     relayLoginModeWarned = false;
@@ -3576,6 +3607,15 @@ export class FleetManager {
      * already in flight may still land late — the contract permits that.
      */
     /** `sender` (#1827): the web person's name, as the room log records them ("web-user" when none). */
+    /**
+     * #1920 §5.2: a web message's channel copy was sent — it is now what the channel saw. Kept so (and on disk), and sent
+     * to the guests' streams only: an admin's page already has it, and nothing about it changed for them.
+     */
+    webMessageInChannel(instance, messageId) {
+        const m = this.webChatHistory.markChannel(instance, messageId);
+        if (m)
+            broadcastToGuests(this.sseClients, "message", m, (err) => this.logger.debug({ err }, "SSE client write failed; evicting"));
+    }
     async sendClassicWebEcho(instance, text, sender = WEB_NAME_FALLBACK) {
         const guard = this.webChannelEchoGuards.get(instance);
         const handled = new Set();
@@ -3796,6 +3836,18 @@ export class FleetManager {
             return payload;
         const row = this.deliveryOutbox.createHumanReceipt({ targetInstance: instanceName, originalBody,
             origin: { ...origin }, inputKind: String(payload.type), managerBootId: this.managerBootId });
+        // #1939 §7: each ordinary verified web message, for the S1 beta to watch. No text, cookie or session id: the handle.
+        const authority = origin.authority;
+        if (authority?.kind === "web-session" && authority.actor && authority.session) {
+            try {
+                this.eventLog?.insert(instanceName, "web_authority", { receipt_id: row.receipt_id, session: authority.session.handle,
+                    peer: authority.session.peer, surface: "local", actor: `${authority.actor.adapter_id}:${authority.actor.user_id}`,
+                    input_kind: String(payload.type), outcome: "web-session", authority_epoch: authority.authority_epoch });
+            }
+            catch (err) {
+                this.logger.warn({ err, instanceName }, "Could not record web authority");
+            }
+        }
         return { ...payload, meta: { ...(payload.meta ?? {}),
                 human_receipt_id: row.receipt_id, verification_id: row.message_id } };
     }
@@ -4011,6 +4063,14 @@ export class FleetManager {
             return;
         }
         const scope = door.scope;
+        // #1920 step 4: a non-admin's /web while guest sign-in is on is theirs to sign in as a guest (or revoke their own)
+        // — before the table, which keeps /web for fleet admins. Per account: it touches no instance binding.
+        // Decided synchronously, so an admin's /web still reaches the table with no await after the door (#1399).
+        if (data.command === "dashboard" && this.isGuestWebAsk(adapterId, data.userId)) {
+            await this.guestWebCommand({ adapterId, userId: data.userId, username: data.username,
+                arg: String(data.options?.action ?? "").trim().toLowerCase(), replyHere: text => data.respond(text), replyPrivately: text => data.respond(text) });
+            return;
+        }
         const spec = commandSpec(data.command);
         if (!spec) {
             this.logger.info({ command: data.command, adapterId }, "Slash command is not in the command table");
@@ -5455,10 +5515,14 @@ export class FleetManager {
                 // #1620: fleet.yaml's web.session.local, read at every check — a Settings save or a reload applies at once
                 // (shortening ends the sessions it now outlives). The public link's policy stays fixed.
                 localPolicy: () => localSessionPolicy(this.fleetConfig?.web?.session?.local),
+                // #1920 §5.4: a guest's, from web.guests.session (never longer than the surface's own).
+                guestPolicy: () => guestSessionPolicy(this.fleetConfig?.web?.guests?.session),
             });
+            this.enforceGuestSwitch(); // #1920: guests off while the fleet was down
         }
         if (!this.returningDevices) {
             this.returningDevices = new ReturningDevices({ dataDir: this.dataDir, onWarn: message => this.logger.warn(message) });
+            this.enforceGuestSwitch(); // #1920: guests' devices too, if guests went off while down
         }
         if (!this.webLoginCodes) {
             this.webLoginCodes = new WebLoginCodes({
@@ -5470,6 +5534,16 @@ export class FleetManager {
                 },
             });
         }
+        if (!this.webGuestLoginCodes) {
+            this.webGuestLoginCodes = new GuestLoginCodes({
+                onEvent: event => {
+                    if (event === "burned")
+                        this.logger.warn("A guest web login code was used up by wrong attempts");
+                    else if (event === "breaker-open")
+                        this.logger.warn("Guest web sign-in paused: too many wrong login codes");
+                },
+            });
+        }
     }
     /**
      * A single-use login code for the dashboard, for a channel only the operator
@@ -5593,6 +5667,7 @@ export class FleetManager {
                 dispatch: (req, res) => this.dispatchWebHttp(req, res, this.fleetConfig?.health_port ?? 19280) }),
             revoke: id => {
                 this.webLoginCodes?.revokeAudience(id);
+                this.webGuestLoginCodes?.revokeAudience(id);
                 const result = this.webSessions?.revokeExposure(id);
                 if (result && !result.durable)
                     this.logger.warn("Public session revocation could not be saved; exposure remains closed");
@@ -5624,6 +5699,24 @@ export class FleetManager {
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner changed");
     }
+    /**
+     * #1920 §5.5 (step 4b): a guest signing in through the public link — said in the General of the admin who opened it
+     * (who, how many agents), awaited as an admin's public sign-in is, while that link is the open one, its opener still
+     * current, and the account still an admitted guest. A failure refuses the sign-in.
+     */
+    async confirmGuestPublicWebLogin(info, current) {
+        const admitted = () => {
+            const open = this.publicWebLink?.openSignin();
+            return current() && open && open.exposureId === info.exposureId && this.publicOwnerCurrent(open.owner) && this.guestSignInAllowed(info.account) ? open : null;
+        };
+        const open = admitted();
+        if (!open)
+            throw new Error("guest public sign-in unavailable");
+        const adapter = open.owner.binding;
+        await adapter.sendText(open.owner.chatId, t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8)), { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
+        if (!admitted())
+            throw new Error("guest public sign-in changed");
+    }
     /** Telegram's typed command enters through the same strict owner and nonce path as Discord. */
     async dashboardMenu(msg) {
         const id = msg.adapterId;
@@ -5947,6 +6040,8 @@ export class FleetManager {
         this.initializeWebSessions();
         void this.publicWebLink?.close("dashboard revoke");
         this.webLoginCodes.revoke();
+        this.webGuestLoginCodes.revokeAll();
+        this.guestRevokes++; // and every guest /web still on its way
         // #1570: no browser may ask the sign-in page for a code any more.
         const devices = this.returningDevices.revokeAll();
         const sessions = this.webSessions.revokeAll();
@@ -5957,6 +6052,183 @@ export class FleetManager {
             this.logger.warn({ count: result.count }, "Web sessions revoked in memory only — the session file could not be updated or removed");
         return result;
     }
+    /**
+     * #1920 phase 3: Settings → Web sign-ins → Guests — the switches, each connection's access mode and the agents named for
+     * an open one, and every guest account (signed in, with a returning device, or narrowed): who, its platform, what it
+     * reaches now, its sessions and devices, and its narrowing. Ids are the accounts' own (an admin's page).
+     */
+    guestOverview() {
+        this.initializeWebSessions();
+        const cfg = this.fleetConfig?.web?.guests;
+        const own = (map, key) => (map && Object.hasOwn(map, key) ? map[key] : undefined);
+        const connections = [...this.worlds.entries()].map(([id, w]) => ({ id, type: w.adapter.type, mode: (w.accessManager.getMode() === "open" ? "open" : "allowlist"),
+            named: [...(own(cfg?.open_instances, id) ?? [])] }));
+        const accounts = new Map();
+        for (const a of this.webSessions.guestActivity())
+            accounts.set(`${a.adapterId}\u0000${a.userId}`, a);
+        const devices = this.returningDevices.guestCounts();
+        for (const k of devices.keys())
+            if (!accounts.has(k)) {
+                const [adapterId, userId] = k.split("\u0000");
+                accounts.set(k, { adapterId, userId, sessions: 0, lastSeen: null });
+            }
+        for (const key of Object.keys(cfg?.narrow ?? {})) {
+            const at = key.indexOf(":"), adapterId = key.slice(0, at), userId = key.slice(at + 1), k = `${adapterId}\u0000${userId}`;
+            if (at > 0 && !accounts.has(k))
+                accounts.set(k, { adapterId, userId, sessions: 0, lastSeen: null });
+        }
+        const guests = [...accounts.entries()].map(([k, a]) => {
+            const owner = { adapterId: a.adapterId, userId: a.userId };
+            const badge = this.guestBadge(owner);
+            // `reach`: before narrowing — what Settings offers to narrow to (#2104 review: never an agent it cannot reach).
+            return { ...a, name: badge.name, platform: badge.platform, scope: [...this.guestScope(owner)].sort(), reach: [...this.guestReach(owner)].sort(),
+                devices: devices.get(k) ?? 0, narrow: own(cfg?.narrow, `${a.adapterId}:${a.userId}`) ?? null };
+        }).sort((x, y) => (y.lastSeen ?? -1) - (x.lastSeen ?? -1));
+        return { enabled: cfg?.enabled === true, chat: cfg?.chat !== false, instances: Object.keys(this.fleetConfig?.instances ?? {}).sort(), connections, guests };
+    }
+    /** #1920 phase 3 (the app shell): a guest's chip — its web name, and its connection's platform (discord, telegram). */
+    guestBadge(owner) {
+        return { name: this.webPerson(owner).name, platform: this.worlds.get(owner.adapterId)?.adapter.type ?? owner.adapterId };
+    }
+    /** #1920 step 4: whether a `/web` is a guest's — guest sign-in on, and not from a fleet admin (theirs runs as before). */
+    isGuestWebAsk(adapterId, userId) {
+        return !!adapterId && this.fleetConfig?.web?.guests?.enabled === true && !this.isFleetAdmin(userId, adapterId);
+    }
+    /** #1920 step 4 (auth-api): a guest code's account may still sign in — guests on, and something in its scope now. */
+    guestSignInAllowed(account) {
+        return this.fleetConfig?.web?.guests?.enabled === true && !this.isFleetAdmin(account.userId, account.adapterId) && this.guestScope(account).size > 0;
+    }
+    /**
+     * #1920 §5.4: a guest's own `/web revoke` — its sessions and its outstanding code; nobody else's (an admin's revokes
+     * everyone's, as before).
+     */
+    revokeGuestWebSessions(owner) {
+        this.initializeWebSessions();
+        const key = `${owner.adapterId}\u0000${owner.userId}`;
+        this.guestAccountRevokes.set(key, (this.guestAccountRevokes.get(key) ?? 0) + 1); // its /web on its way, too
+        while (this.guestAccountRevokes.size > 4096)
+            this.guestAccountRevokes.delete(this.guestAccountRevokes.keys().next().value);
+        this.webGuestLoginCodes.revokeRecipient(owner);
+        // §5.4: its sessions and its returning devices (no browser of theirs may ask for a code any more).
+        const devices = this.returningDevices.revokeGuest(owner);
+        const ended = this.webSessions.revokeAll(r => r.tier === "guest" && r.owner?.adapterId === owner.adapterId && r.owner.userId === owner.userId);
+        this.logger.info({ adapterId: owner.adapterId, count: ended.count, devices: devices.count, durable: ended.durable && devices.durable }, "Guest web sessions revoked by their account");
+        return { count: ended.count, durable: ended.durable && devices.durable };
+    }
+    /**
+     * #1920 §2.3 (step 4): `/web` from someone who is not a fleet admin, while guest sign-in is on. `revoke` ends their
+     * own guest sessions. Otherwise a guest code (tier guest, bound to this account) goes privately — a DM, else the
+     * slash command's ephemeral answer (`replyPrivately`) — once a minute at most, and only when their scope (from what
+     * they may already use in chat, rooms read at sign-in) holds something. The code itself is never posted where asked.
+     * Callers ask isGuestWebAsk first (synchronously); false here too when it is not a guest's.
+     */
+    async guestWebCommand(ask) {
+        if (!this.isGuestWebAsk(ask.adapterId, ask.userId))
+            return false;
+        const owner = { adapterId: ask.adapterId, userId: ask.userId };
+        const say = (text) => ask.replyHere(text).catch(() => undefined);
+        if (ask.arg === "revoke") {
+            const ended = this.revokeGuestWebSessions(owner);
+            await say(t(ended.durable ? "web.guest_revoked" : "web.guest_revoked_not_durable", ended.count));
+            return true;
+        }
+        const token = this.webToken;
+        const adapter = this.adapters.get(ask.adapterId);
+        if (this.shuttingDown || !token || !adapter) {
+            await say(t("dashboard.starting"));
+            return true;
+        }
+        const key = `${owner.adapterId}\u0000${owner.userId}`, asked = this.guestCodeAskedAt.get(key);
+        if (this.guestCodeInFlight.has(key) || (asked !== undefined && performance.now() - asked < 60_000)) {
+            await say(t("web.guest_wait"));
+            return true;
+        }
+        this.guestCodeInFlight.add(key);
+        try {
+            await this.issueGuestCode(ask, owner, key, adapter, token);
+        }
+        finally {
+            this.guestCodeInFlight.delete(key);
+        }
+        return true;
+    }
+    /** guestWebCommand's issuance, one per account at a time; a revoke made meanwhile (either kind) ends it unissued. */
+    async issueGuestCode(ask, owner, key, adapter, token) {
+        const say = (text) => ask.replyHere(text).catch(() => undefined);
+        const revokes = this.guestRevokes, accountRevokes = this.guestAccountRevokes.get(key) ?? 0;
+        const unrevoked = () => this.guestRevokes === revokes && (this.guestAccountRevokes.get(key) ?? 0) === accountRevokes;
+        // §3.2: its rooms are read at sign-in (bounded; never longer than the reads' own deadline).
+        await withinBudget(this.refreshGuestRooms(owner, { mode: "force" }), performance.now() + 6_000).catch(() => undefined);
+        if (!unrevoked())
+            return; // revoked while its rooms were read: no code
+        const scope = this.guestScope(owner);
+        if (!scope.size) {
+            const open = this.worlds.get(owner.adapterId)?.accessManager.getMode() === "open";
+            await say(t(open ? "web.guest_not_set_up" : "web.guest_nothing"));
+            return;
+        }
+        this.initializeWebSessions();
+        const codes = this.webGuestLoginCodes;
+        if (codes.pausedForMs() > 0) {
+            await say(t("web.guest_paused"));
+            return;
+        }
+        // §5.5 (step 4b): with the public link open, the code works through it too (an admin opened it; a guest is still a
+        // guest there) — most guests are not on the host's network. Its closing withdraws that audience (revokeAudience).
+        const open = this.publicWebLink?.openSignin() ?? null;
+        // One code per account (a new one replaces only its own); at the cap, refused — never another guest's evicted.
+        const login = codes.issue({ epoch: tokenEpoch(token), audiences: ["local", ...(open ? [open.exposureId] : [])],
+            recipient: { adapterId: owner.adapterId, userId: owner.userId, ...(ask.username ? { username: ask.username } : {}) } });
+        if (!login) {
+            await say(t("web.guest_busy"));
+            return;
+        }
+        this.guestCodeAskedAt.delete(key);
+        this.guestCodeAskedAt.set(key, performance.now());
+        while (this.guestCodeAskedAt.size > 256)
+            this.guestCodeAskedAt.delete(this.guestCodeAskedAt.keys().next().value);
+        const current = () => !this.shuttingDown && this.webToken === token && this.adapters.get(owner.adapterId) === adapter
+            && unrevoked() && this.guestSignInAllowed(owner);
+        const privateText = `${t("web.guest_intro", scope.size)}\n${this.topicCommands.getDashboardText()}${open ? `\n${t("web.guest_public", open.url)}` : ""}\n${t("dashboard.code", login.display, Math.round(LOGIN_CODE_TTL_MS / 60_000))}`;
+        const deadline = performance.now() + 10_000;
+        try {
+            let byDm = false;
+            try {
+                if (!adapter.sendDirect)
+                    throw new Error("DM unavailable");
+                await withinBudget(adapter.sendDirect(owner.userId, `${privateText}\n${t("dashboard.code_next")}`, { disablePreview: true }), Math.min(deadline, performance.now() + 5_000));
+                byDm = true;
+            }
+            catch (err) {
+                this.logDashboardDmFailure(err);
+                if (!ask.replyPrivately || !current())
+                    throw err;
+                const id = await withinBudget(ask.replyPrivately(privateText), deadline); // a slash command's answer: ephemeral
+                if (!id)
+                    throw new Error("private delivery unconfirmed");
+            }
+            if (!current())
+                throw new Error("guest no longer admitted");
+            if (byDm) {
+                await this.sendCodeAlone((body, opts) => adapter.sendDirect(owner.userId, body, opts), adapter.type, login.display);
+                if (!current())
+                    throw new Error("guest no longer admitted");
+                await say(t("web.guest_sent"));
+            }
+        }
+        catch (err) {
+            codes.revokeIfCurrent(login.issuanceId); // this flow's code only, never a later one's
+            this.logger.info({ err: err?.message, adapterId: owner.adapterId }, "Guest sign-in code was not delivered privately");
+            if (!unrevoked())
+                return; // revoked meanwhile: the revoke's own answer said so
+            const start = adapter.type === "telegram" ? this.tgStartWebUrl(owner.adapterId) : null;
+            // #1742 for guests (step 4b-3): its START button (a bare /start, or the link's /start web) then asks again, from
+            // the DM — once, within the window.
+            if (adapter.type === "telegram")
+                this.openTgWebStartWindow(owner.adapterId, owner.userId);
+            await say(start ? t("web.guest_dm_failed_link", start) : t("web.guest_dm_failed"));
+        }
+    }
     /** #1570 (auth-api): this browser becomes a returning device of the code's owner. The cookie value, or null. */
     rememberReturningDevice(owner, input) {
         const token = this.webToken;
@@ -5984,6 +6256,12 @@ export class FleetManager {
         if (!token || this.shuttingDown)
             return { kind: "refused" };
         this.initializeWebSessions();
+        // #2095 review: verified before the request's body was read — a revoke (its own, or an admin's) made meanwhile
+        // removed it, and nothing it asks for may then go out.
+        if (!this.returningDevices.current(device, tokenEpoch(token)))
+            return { kind: "refused" };
+        if (device.tier === "guest")
+            return this.requestGuestDeviceCode(device, input, token);
         const paused = this.webLoginCodes.pausedForMs();
         if (paused > 0)
             return { kind: "limited", retryAfterMs: paused };
@@ -6015,7 +6293,7 @@ export class FleetManager {
             this.logger.info({ err: err?.message, adapterId }, "Sign-in code request: the private message could not be sent");
             return { kind: "refused" };
         }
-        if (this.webToken !== token || !this.publicOwnerCurrent(owner)) {
+        if (this.webToken !== token || !this.publicOwnerCurrent(owner) || !this.returningDevices.current(device, tokenEpoch(token))) {
             this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
             return { kind: "refused" };
         }
@@ -6023,15 +6301,94 @@ export class FleetManager {
         // Asked again after the follow-up's wait: the owner, the token, shutdown, and a public request's exposure.
         const exposureGone = input.surface === "gateway"
             && (this.publicWebLink?.exposureId !== input.exposureId || this.publicWebLink?.status().state !== "open");
-        if (this.shuttingDown || this.webToken !== token || !this.publicOwnerCurrent(owner) || exposureGone) {
+        if (this.shuttingDown || this.webToken !== token || !this.publicOwnerCurrent(owner) || exposureGone || !this.returningDevices.current(device, tokenEpoch(token))) {
             this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
             return { kind: "refused" };
         }
         this.logger.info({ adapterId, surface: input.surface }, "Web sign-in code sent privately to a returning device's owner");
         return { kind: "sent" };
     }
+    /**
+     * #1920 step 4b: a guest's returning device asks for a code — a guest code for that account, by DM only, under the
+     * same rules as its /web (guests on, not an admin, something in scope now; one per account and the cap; one flow per
+     * account at a time; a revoke meanwhile ends it), its own limiter, and the guests' breaker. Asked through the public
+     * link: only while that exposure is the open one (its code then works through it alone), as an admin's device.
+     */
+    async requestGuestDeviceCode(device, input, token) {
+        const codes = this.webGuestLoginCodes;
+        const account = { adapterId: device.owner.adapterId, userId: device.owner.userId };
+        const key = `${account.adapterId}\u0000${account.userId}`;
+        const adapter = this.adapters.get(account.adapterId);
+        const viaLink = input.surface === "gateway";
+        const linkOpen = () => !!input.exposureId && this.publicWebLink?.openSignin()?.exposureId === input.exposureId;
+        if ((viaLink ? !linkOpen() : input.exposureId !== undefined) || !adapter?.sendDirect || !this.guestSignInAllowed(account)) {
+            this.logger.info({ adapterId: account.adapterId, surface: input.surface }, "Guest sign-in code request refused");
+            return { kind: "refused" };
+        }
+        const paused = codes.pausedForMs();
+        if (paused > 0)
+            return { kind: "limited", retryAfterMs: paused };
+        const asked = this.guestCodeAskedAt.get(key);
+        if (this.guestCodeInFlight.has(key))
+            return { kind: "limited", retryAfterMs: 5_000 };
+        if (asked !== undefined && performance.now() - asked < 60_000)
+            return { kind: "limited", retryAfterMs: 60_000 - (performance.now() - asked) };
+        const admitted = this.guestCodeRequestLimiter.admit(device.idHash);
+        if (!admitted.ok)
+            return { kind: "limited", retryAfterMs: admitted.retryAfterMs };
+        const revokes = this.guestRevokes, accountRevokes = this.guestAccountRevokes.get(key) ?? 0;
+        const current = () => !this.shuttingDown && this.webToken === token && this.adapters.get(account.adapterId) === adapter
+            && this.guestRevokes === revokes && (this.guestAccountRevokes.get(key) ?? 0) === accountRevokes && this.guestSignInAllowed(account)
+            && (!viaLink || linkOpen()) && this.returningDevices.current(device, tokenEpoch(token));
+        const issued = codes.issue({ epoch: tokenEpoch(token), recipient: account, audiences: [viaLink ? input.exposureId : "local"] });
+        if (!issued)
+            return { kind: "limited", retryAfterMs: 60_000 }; // the guests' cap: never someone's evicted
+        this.guestCodeInFlight.add(key);
+        this.guestCodeAskedAt.delete(key);
+        this.guestCodeAskedAt.set(key, performance.now());
+        try {
+            const text = t("web.resend_code", issued.display, Math.round(LOGIN_CODE_TTL_MS / 60_000), input.label || t("web.resend_unknown_browser"), t(viaLink ? "web.resend_public" : "web.resend_local"))
+                + "\n" + t("dashboard.code_next");
+            try {
+                await withinBudget(adapter.sendDirect(account.userId, text, { disablePreview: true }), performance.now() + 5_000);
+            }
+            catch (err) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                this.logger.info({ err: err?.message, adapterId: account.adapterId }, "Guest sign-in code request: the private message could not be sent");
+                return { kind: "refused" };
+            }
+            if (!current()) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                return { kind: "refused" };
+            }
+            await this.sendCodeAlone((body, opts) => adapter.sendDirect(account.userId, body, opts), adapter.type, issued.display);
+            if (!current()) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                return { kind: "refused" };
+            }
+            this.logger.info({ adapterId: account.adapterId }, "Guest sign-in code sent privately to a returning device's account");
+            return { kind: "sent" };
+        }
+        finally {
+            this.guestCodeInFlight.delete(key);
+        }
+    }
+    /** #1920 step 4b (auth-api): this browser becomes a guest's returning device. The cookie value, or null. */
+    rememberGuestDevice(account, input) {
+        const token = this.webToken;
+        if (!token)
+            return null;
+        this.initializeWebSessions();
+        return this.returningDevices.rememberGuest(account, { ...input, tokenEpoch: tokenEpoch(token), webToken: token });
+    }
     /** Called by the sign-in endpoint: a login the operator did not make should be visible to them. */
     onWebLogin(info) {
+        // #1920 §2.3: a guest's sign-in is always said in General (web.notify_login is the operator's own sign-ins): who,
+        // and how many agents they now reach — admins stay aware of everyone who is not one of them.
+        if (info.tier === "guest" && info.owner) {
+            this.notifyFleetError(t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8)));
+            return;
+        }
         if (this.fleetConfig?.web?.notify_login === false)
             return;
         // The session handle makes each notice distinct: notifyFleetError throttles by text, and a second
@@ -6396,6 +6753,8 @@ export class FleetManager {
         TmuxManager.setSocketName(getSocket());
         await TmuxManager.ensureSession(getTmuxSession());
         this.tmuxSessionEnsured = true;
+        // #2072: what this host can run — probed in the background, published for every picker.
+        this.startAvailabilityRefresh();
         // Pre-flight (advisory, fire-and-forget): warm the per-backend auth cache
         // before instances spawn, so a CLI that comes up on its sign-in screen gets
         // an instant 🔑 verdict instead of decaying into crash/MCP-died noise.
@@ -6719,6 +7078,11 @@ export class FleetManager {
         this.pruneEventLog();
         this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
         this.eventLogPruneTimer.unref?.();
+        // #1920 §3.2: guests' ClassicBot room membership, read in the background — now, then each key ten minutes after
+        // its answer (a minute after a failed read; the tick only finds what is due). A request only reads the answers.
+        void this.refreshAllGuestRooms();
+        this.guestRoomsTimer = setInterval(() => { void this.refreshAllGuestRooms(); }, GUEST_ROOM_TICK_MS);
+        this.guestRoomsTimer.unref?.();
         // #1335: delivery-outbox.db and Task Board retention. Same once-at-startup
         // + daily-timer pattern; chunked DELETEs so one run cannot hold the loop.
         void this.pruneOutboxAndTasks();
@@ -8371,6 +8735,13 @@ export class FleetManager {
                 if (!isPrivateChat && !cmdMatch && rawText.startsWith("/")) {
                     return; // bare slash in group — ignore silently
                 }
+                // #1920 step 4b-3: /web typed in a ClassicBot room (a group: `/web@ThisBot`) by someone who is not a fleet admin,
+                // while guest sign-in is on: their guest code, privately — as anywhere else. An admin's goes on as before.
+                if (/^\/(?:web|dashboard)(?:\s|$)/i.test(text) && msgAdapter && this.isGuestWebAsk(msg.adapterId, msg.userId)) {
+                    await this.guestWebCommand({ adapterId: msg.adapterId, userId: msg.userId, username: msg.username,
+                        arg: text.replace(/^\/(?:web|dashboard)/i, "").trim().toLowerCase(), replyHere: body => msgAdapter.sendText(chatId, body) });
+                    return;
+                }
                 // Handle /start command
                 if (text === "/start" || text.startsWith("/start ")) {
                     // #1686: intercept /start web before the ClassicBot admission flow runs.
@@ -8379,15 +8750,21 @@ export class FleetManager {
                     // #1742: a bare /start from a fleet admin whose /web just failed to reach them privately is that /start web
                     // (Telegram's START button sends it bare) — once, within the window; any other bare /start is ClassicBot's.
                     const admin = isPrivateChat && this.isFleetAdmin(msg.userId, msg.adapterId ?? "");
+                    // #1920 step 4b-3: a guest's too (guest sign-in on, not an admin) — its /web reached it no other way.
+                    const guest = isPrivateChat && !admin && this.isGuestWebAsk(msg.adapterId, msg.userId);
                     const webStart = isPrivateChat && (requestedBackend === "web"
-                        || (text === "/start" && admin && this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId)));
+                        || (text === "/start" && (admin || guest) && this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId)));
                     if (webStart) {
                         if (requestedBackend === "web")
                             this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId);
                         // #1742: the /web menu right here; the code comes to this DM.
                         if (admin)
                             await this.startWebInDm(msg, msgAdapter ?? undefined);
-                        // Non-fleet-admins: /start alone is enough to open the DM channel; no further action.
+                        // A guest: its guest code, here (this DM is where it goes).
+                        else if (guest && msgAdapter)
+                            await this.guestWebCommand({ adapterId: msg.adapterId, userId: msg.userId, username: msg.username, arg: "",
+                                replyHere: body => msgAdapter.sendText(chatId, body) });
+                        // Anyone else: /start alone is enough to open the DM channel; no further action.
                         return;
                     }
                     // All new starts, including explicit backend and later chooser callbacks,
@@ -8691,10 +9068,7 @@ export class FleetManager {
                     this.afterUserInboundDelivered(generalInstance, msg);
                     this.logger.info(`${msg.username} → ${generalInstance}: ${(text ?? "").slice(0, 100)}`);
                     this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), generalInstance);
-                    this.emitSseEvent("message", {
-                        instance: generalInstance, sender: msg.username, role: "user",
-                        text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
-                    });
+                    this.emitPlatformInbound(generalInstance, msg, text ?? "");
                 }
                 catch (err) {
                     this.logger.warn({ err: err.message, instanceName: generalInstance }, "General wake/delivery failed");
@@ -8803,9 +9177,16 @@ export class FleetManager {
         this.afterUserInboundDelivered(instanceName, msg);
         this.logger.info(`${msg.username} → ${instanceName}: ${(text ?? "").slice(0, 100)}`);
         this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), instanceName);
+        this.emitPlatformInbound(instanceName, msg, text ?? "");
+    }
+    /**
+     * A person's platform message as the web chat shows it — the user's own words, as a user (#1306), in the instance's
+     * history (#1565). #1920 §5.2: said in the instance's topic, General or room, so it is that channel's, by that account.
+     */
+    emitPlatformInbound(instance, msg, text) {
         this.emitSseEvent("message", {
-            instance: instanceName, sender: msg.username, role: "user",
-            text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
+            instance, sender: msg.username, role: "user", text: text.slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
+            channel: true, from: webChatFrom(msg.adapterId, msg.userId),
         });
     }
     /** Handle outbound tool calls from a daemon instance */
@@ -9107,7 +9488,14 @@ export class FleetManager {
                 // an agent cannot invent it to suppress the normal completion marker.
                 if (!error && result != null && msg.statusOnly !== true) {
                     try {
-                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView);
+                        // #1920 §5.2: shown to the instance's guests only when it landed in the instance's own topic or room.
+                        let inChannel = false;
+                        try {
+                            inChannel = outAdapter !== WEB_ONLY_REPLY_SINK
+                                && this.landedInOwnChannel(instanceName, contextAdapterId ?? this.getInstanceAdapterId(instanceName), result);
+                        }
+                        catch { /* not known: not the channel's (fail closed), and the bookkeeping below still runs */ }
+                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView, inChannel);
                     }
                     catch (err) {
                         this.logger.warn({ err, instanceName }, "Reply delivered but post-delivery bookkeeping failed");
@@ -9161,7 +9549,35 @@ export class FleetManager {
         return this.worlds.size === 0 && this.isWebOnlyFleet() ? { adapter: WEB_ONLY_PROMPT_SINK, adapterId: "web", chatId: "web" } : null;
     }
     /** Resolves when the reply is in the web chat (#1770: after its files are copied); the caller need not wait. */
-    afterReplyRouted(instanceName, args, senderSessionName, buttons = null) {
+    /**
+     * #1920 §5.2: whether a platform send landed in the instance's own place — its ClassicBot room, or its topic in its
+     * connection's group — so its channel's members saw it. Anything else (another chat, a DM, a context left from General,
+     * an answer without the chat it went to) is not the channel's.
+     */
+    landedInOwnChannel(instance, adapterId, sent) {
+        const s = sent && typeof sent === "object" ? sent : {};
+        if (!adapterId || typeof s.chatId !== "string" || !s.chatId)
+            return false;
+        const roomId = this.classicChannels?.getChannelIdByInstance(instance);
+        if (roomId !== undefined)
+            return (this.classicChannels?.getAdapterIdByInstance(instance) ?? this.getPrimaryAdapterId()) === adapterId && roomId === s.chatId;
+        const cfg = this.fleetConfig?.instances && Object.hasOwn(this.fleetConfig.instances, instance) ? this.fleetConfig.instances[instance] : undefined;
+        const world = this.worlds.get(adapterId);
+        if (!cfg || this.getInstanceAdapterId(instance) !== adapterId || !world?.groupId || s.chatId !== world.groupId)
+            return false;
+        const thread = typeof s.threadId === "string" && s.threadId ? s.threadId : null;
+        return cfg.topic_id == null ? thread === null : thread === String(cfg.topic_id);
+    }
+    /** #1920 §5.2 (#2085 review): a platform click's buttons are in the instance's own place — else not its channel's. */
+    clickInOwnChannel(set) {
+        try {
+            return this.landedInOwnChannel(set.instance, set.adapterId, { chatId: set.chatId, threadId: set.threadId || undefined });
+        }
+        catch {
+            return false;
+        }
+    }
+    afterReplyRouted(instanceName, args, senderSessionName, buttons = null, inChannel = false) {
         // A reply is NOT proof the turn is over (#410) — but it is not proof of
         // more work either. Split the difference: an instance that is clearly
         // idle loses the button now; one that looks busy keeps it (re-posted
@@ -9197,6 +9613,7 @@ export class FleetManager {
                 ts,
                 ...(attachments.length ? { attachments } : {}),
                 ...(buttons ? { buttons } : {}), // #1266
+                ...(inChannel ? { channel: true } : {}), // #1920 §5.2
             });
         };
         const before = this.webReplyOrder.get(instanceName);
@@ -10450,6 +10867,7 @@ export class FleetManager {
      */
     saveFleetConfig(explicitPatches = []) {
         this.publicWebLink?.refresh();
+        this.enforceGuestSwitch(); // #1920: a Settings save turning guests off ends their sessions
         if (!this.fleetConfig || !this.configPath)
             return;
         if (!this.savedFleetConfigSnapshot)
@@ -13153,6 +13571,19 @@ export class FleetManager {
     webBackendTokens = new Map();
     /** #1269: the web's /clear confirmations — one token per question, used once, for the instance as it was asked about. */
     webClearTokens = new Map();
+    /**
+     * #1939 S1: the design's §3 for one web request (authority/web-authority.ts), with this fleet's admins, policy and
+     * token; `instance` once the body has named it. Observe only: receipts record it, no agent acts on it yet.
+     */
+    webAuthority(input) {
+        return evaluateWebAuthority({
+            session: input.session, gateway: input.gateway, peer: input.peer,
+            tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
+            ...(input.instance !== undefined ? { target: { adapterId: this.getInstanceAdapterId(input.instance) } } : {}),
+            isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
+            policy: webAuthorityPolicy(this.fleetConfig?.web), epoch: 0, now: Date.now(),
+        });
+    }
     /** #1269: an instance's chat command from the web chat (web-commands.ts); `publicLink`: a gateway request. */
     webCommand(input, opts) {
         const webMeta = (instance) => {
@@ -13161,7 +13592,7 @@ export class FleetManager {
                 // #1827: a /steer or /btw reaches the agent as the web person who wrote it.
                 chatId: this.getGroupIdForInstance(instance) || "", messageId: newWebMessageId(),
                 username: opts.person?.name ?? WEB_NAME_FALLBACK, userId: opts.person?.userId ?? WEB_NAME_FALLBACK,
-                threadId: topicId != null ? String(topicId) : undefined, adapterId: this.getAdapterForInstance(instance)?.id ?? "", source: "web", humanOrigin: webHumanOrigin(true),
+                threadId: topicId != null ? String(topicId) : undefined, adapterId: this.getAdapterForInstance(instance)?.id ?? "", source: "web", humanOrigin: webHumanOrigin(true, opts.authority),
             };
         };
         const choicesFromCache = (instance) => {
@@ -13217,7 +13648,7 @@ export class FleetManager {
                     return step.noop ? { text: step.text } : { error: step.text };
                 if (step.kind === "choose") {
                     const id = (token) => joinBackendArgs([...step.args, token]);
-                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => ({ id: id(c.token), label: c.label })) } };
+                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => ({ id: id(c.token), label: c.label, ...(c.disabled ? { disabled: c.disabled } : {}) })) } };
                 }
                 const now = performance.now();
                 for (const [k, v] of this.webBackendTokens)
@@ -14355,7 +14786,12 @@ export class FleetManager {
                 fleetConfig: () => this.fleetConfig,
                 isFleetAdmin: (userId, adapterId) => this.isFleetAdmin(userId, adapterId),
                 eventLog: () => this.eventLog,
-                recoverBackendInstances: (backend, profile) => this.recoverBackendInstances(backend, undefined, profile ?? null),
+                recoverBackendInstances: (backend, profile) => {
+                    // #2072: a sign-in just finished — the pickers learn it now, not at the next pass.
+                    if (!profile)
+                        void this.backendAvailability.refresh([backend], { force: true });
+                    return this.recoverBackendInstances(backend, undefined, profile ?? null);
+                },
                 claimWindow: backend => this.loginWindow.tryClaim("web", backend),
                 releaseWindow: claim => { this.loginWindow.release(claim); },
                 isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
@@ -14874,6 +15310,8 @@ export class FleetManager {
                 // binary the same way, so a binary only a login shell could see was
                 // installed, reported as verified, and then offered nowhere.
                 this.adoptBinaryDirectory(installedAt, backend);
+                // #2072: an install just finished — the pickers learn it now, not at the next pass.
+                void this.backendAvailability.refresh([backend], { force: true });
                 if (!LOGIN_FLOWS[backend]) {
                     this.installHandoff = null;
                     await chat.adapter.sendText(chat.chatId, t("install.success_no_login", backend), { threadId: chat.threadId }).catch(() => { });
@@ -15108,6 +15546,8 @@ export class FleetManager {
                 buttons: m.buttons,
                 click: m.click,
                 links: m.links,
+                channel: m.channel,
+                from: m.from,
             });
             broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
             // #1629: live-only receipt after the recorded agent reply. Never persist/replay it or give it an SSE cursor.
@@ -15908,10 +16348,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.logger.info(`${msg.username} → ${instanceName} (classic): ${text.slice(0, 100)}`);
         // #1592: the web chat shows what was asked, as for every other inbound — the user's own words (no chat-log
         // context), as a user (#1306: never a role read from text), in the room's history (#1565).
-        this.emitSseEvent("message", {
-            instance: instanceName, sender: msg.username, role: "user",
-            text: text.slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
-        });
+        this.emitPlatformInbound(instanceName, msg, text);
     }
     /** Paste raw text directly to a classic instance's CLI (no [user:] wrapping) */
     /** #1690: our own runtime switches awaiting the daemon's outcome, by id. */
@@ -17148,7 +17585,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         return {
             currentBackend: (name) => this.backendNameForInstance(name),
             currentDisplay: (name) => `${this.backendNameForInstance(name)} · ${this.resolveInstanceModel(name).display}`,
-            installedBackends: () => KNOWN_BACKENDS.filter(b => b !== "mock" && this.backendInstalledHere(b)),
+            availability: () => this.backendAvailabilityFor(instanceName),
             models: (backend) => this.backendModelOptions(backend, opts),
             // #1808: the same rule update_instance_config's switch applies (backendModelVerdict).
             modelKnown: (backend, model) => this.backendModelVerdict(instanceName, backend, model).ok,
@@ -17247,10 +17684,76 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // kiro-cli gates its own --effort by version at launch (a quiet console note otherwise); muse always passes it.
         return () => true;
     }
-    /** Installed the way the launch finds a CLI (resolveBinary): on PATH or in a known install directory. */
-    backendInstalledHere(backend) {
-        const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
-        return !!binary && resolveBinary(binary) !== binary;
+    /**
+     * #2072: what this host can run, from the published availability snapshot (backend-availability.ts). Read only: a
+     * handler never starts a probe, not even in the background — launch, the timer, and /login install or sign-in do.
+     */
+    backendAvailabilityRows() {
+        return this.backendAvailability.snapshot();
+    }
+    /**
+     * #2072 part 3: the models a Settings field offers for `backend` — the cached catalog (an instance's own credential
+     * profile's, when it is named and has one), claude's account catalog included. Read only: never a probe.
+     */
+    modelCatalogFor(backend, instance) {
+        if (!KNOWN_BACKENDS.includes(backend) || backend === "mock")
+            return [];
+        const own = instance && Object.prototype.hasOwnProperty.call(this.fleetConfig?.instances ?? {}, instance) ? instance
+            : instance && this.classicChannels?.getChannelIdByInstance(instance) !== undefined ? instance : null;
+        const env = this.readCliEnv(backend, this.catalogProfile(backend, own));
+        const seen = new Set(), out = [];
+        for (const m of [...(env?.models ?? []), ...(env?.apiModels ?? [])])
+            if (!seen.has(m.id)) {
+                seen.add(m.id);
+                out.push(m);
+            }
+        return out;
+    }
+    /**
+     * #2072 (#2078 review): the snapshot as THIS instance would see it. Its sign-in on a backend is its own credential
+     * profile's when it has one there — the host's default login says nothing about it. A profile's login is a file check
+     * (credentialProfileLogin), no process.
+     */
+    backendAvailabilityFor(instanceName) {
+        return this.backendAvailabilityRows().map(row => {
+            const profile = this.credentialProfileOf(instanceName, row.backend);
+            if (!profile || (row.state !== "usable" && row.state !== "not_signed_in" && row.state !== "unknown") || !row.path)
+                return row;
+            let login = "unknown";
+            try {
+                login = credentialProfileLogin(this.dataDir, row.backend, profile).state;
+            }
+            catch { /* unknown */ }
+            // Signed in there: usable for this instance. Signed out (or unknown): the host's default login says nothing about
+            // it, so no "not signed in" claim from it — update_instance_config's profile gate refuses a signed-out profile
+            // when applied, naming the profile and the command that signs it in.
+            if (login === "logged-in")
+                return { ...row, auth: "valid", state: "usable" };
+            return row.state === "not_signed_in" ? { ...row, auth: "unknown", state: "unknown" } : row;
+        });
+    }
+    /** The probes the snapshot runs (tests replace them: no CLI, no account, no network). */
+    availabilityProbes = hostAvailabilityProbes;
+    availabilityStore = null;
+    availabilityTimer = null;
+    get backendAvailability() {
+        return this.availabilityStore ??= new BackendAvailabilityStore(KNOWN_BACKENDS.filter(b => b !== "mock" && !!BACKEND_INSTALLATION_INFO[b]), this.availabilityProbes, { onChange: () => this.noteAvailabilityPaths() });
+    }
+    /** A launch need not look the binary up again (a synchronous `which` on the loop) when the snapshot found it. */
+    noteAvailabilityPaths() {
+        for (const row of this.availabilityStore?.snapshot() ?? []) {
+            const binary = BACKEND_INSTALLATION_INFO[row.backend]?.binary;
+            if (binary)
+                noteResolvedBinary(binary, row.state === "not_installed" ? null : row.path);
+        }
+    }
+    /** Probe now and then every AVAILABILITY_STALE_MS; a pass that finds nothing changed starts no CLI. */
+    startAvailabilityRefresh() {
+        void this.backendAvailability.refresh();
+        if (this.availabilityTimer)
+            clearInterval(this.availabilityTimer);
+        this.availabilityTimer = setInterval(() => { void this.backendAvailability.refresh(); }, AVAILABILITY_STALE_MS);
+        this.availabilityTimer.unref?.();
     }
     /** The models `/model` would offer on a backend: the cached CLI env, else (live) a bounded probe. Never throws. */
     async backendModelOptions(backend, opts) {
@@ -17592,9 +18095,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         return undefined;
     }
+    /** #2072: from the published snapshot (no `which` on the loop); not checked yet counts as installed (no false alarm). */
     isBackendInstalled(backend) {
-        const installation = BACKEND_INSTALLATION_INFO[backend];
-        return !!installation && checkBinaryInstalled(installation.binary);
+        if (!BACKEND_INSTALLATION_INFO[backend])
+            return false;
+        return this.backendAvailability.get(backend)?.state !== "not_installed";
     }
     getMissingBackendWarning(backend) {
         if (!backend)
@@ -17932,6 +18437,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.eventLogPruneTimer);
             this.eventLogPruneTimer = null;
         }
+        if (this.guestRoomsTimer) {
+            clearInterval(this.guestRoomsTimer);
+            this.guestRoomsTimer = null;
+        }
         this.logService?.unwatchAll(); // #1218: a Log's watch timers end with the fleet
         this.compactWatchService?.stopAll();
         if (this.outboxPruneTimer) {
@@ -18031,6 +18540,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.adapters.clear();
         this.controlClient?.stop();
         this.controlClient = null;
+        if (this.availabilityTimer) {
+            clearInterval(this.availabilityTimer);
+            this.availabilityTimer = null;
+        }
         if (this.healthServer) {
             this.healthServerListening = false;
             const server = this.healthServer;
@@ -20016,11 +20529,157 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.logger.warn({ host: name }, "Web request refused: Host is not allowed (add it to web.allowed_hosts if this is a proxy you run)");
     }
     /**
-     * #1920: the instances a guest session may see — derived on every request, never stored. Phase 2 derives it from
-     * the account's chat access (and an admin's naming for an open connection); until then a guest sees nothing.
+     * #1920 §3: the instances a guest session may see — derived on every request from the account's chat access, never
+     * stored; nothing while `web.guests.enabled` is not true.
+     * - Its connection's fleet topics and General (what it may talk to in chat): when that connection's access lets the
+     *   account in (AccessManager.isAllowed — allowed_users or paired). An `open` connection lets everyone in, so it gives
+     *   only the instances an admin named for its guests (`web.guests.open_instances`; the user's decision: least
+     *   privilege, as an open group has no list of people).
+     * - A Telegram private ClassicBot room that is the account's own (its chat id is the user id).
+     * - A ClassicBot group or guild room on its connection: only while its membership is verified (§3.2 — a "member"
+     *   answer read in the background, at most 15 minutes old; unknown, failed or stale hides it).
+     * - Then an admin's narrowing (`web.guests.narrow`), which only takes away.
+     * A fleet admin is not a guest: an admin outside the connection's access gets nothing here (admins sign in as admins).
+     */
+    guestScope(owner) {
+        const guests = this.fleetConfig?.web?.guests;
+        if (!owner || guests?.enabled !== true)
+            return NO_GUEST_SCOPE;
+        const scope = new Set(this.guestReach(owner));
+        const narrow = guests.narrow && Object.hasOwn(guests.narrow, `${owner.adapterId}:${owner.userId}`) ? guests.narrow[`${owner.adapterId}:${owner.userId}`] : undefined;
+        if (narrow) {
+            const keep = new Set(narrow);
+            for (const name of [...scope])
+                if (!keep.has(name))
+                    scope.delete(name);
+        }
+        return scope.size ? scope : NO_GUEST_SCOPE;
+    }
+    /**
+     * #1920 (#2104 review): what an account reaches before an admin's narrowing — its connection's topics (an open one's
+     * named agents), its own Telegram private room, its verified group rooms. Narrowing can only take from this set, so it
+     * is what Settings offers to narrow to. Empty while guest sign-in is off.
+     */
+    guestReach(owner) {
+        const guests = this.fleetConfig?.web?.guests;
+        const scope = new Set();
+        if (guests?.enabled !== true)
+            return scope;
+        const own = (map, key) => (map && Object.hasOwn(map, key) ? map[key] : undefined);
+        const world = this.worlds.get(owner.adapterId);
+        if (world && world.accessManager.isAllowed(owner.userId)) {
+            const named = world.accessManager.getMode() === "open" ? new Set(own(guests.open_instances, owner.adapterId) ?? []) : null;
+            for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+                if (this.getInstanceAdapterId(name) !== owner.adapterId || this.isClassicInstance(name))
+                    continue;
+                if (!named || named.has(name))
+                    scope.add(name);
+            }
+        }
+        const rooms = this.classicChannels?.getAll() ?? [];
+        for (const room of rooms) {
+            if (this.isOwnPrivateRoom(owner, room))
+                scope.add(room.instanceName);
+        }
+        const members = this.guestRooms();
+        for (const room of guestGroupRooms(rooms, owner)) {
+            if (members.verified(room, owner.userId))
+                scope.add(room.instance);
+        }
+        return scope;
+    }
+    /**
+     * #1920 §3.5: a guest session still admitted — current, with something in scope. A scope that became empty (guest
+     * sign-in off, the account removed from the connection's access, everything narrowed away) ends the session here,
+     * so the next request and the open stream find it gone.
      */
-    guestScope(_owner) {
-        return NO_GUEST_SCOPE;
+    guestStillAdmitted(record) {
+        return this.guestAdmission(record) === "ok";
+    }
+    /**
+     * The same, with a third answer (§3.2): "pending" — nothing in scope now, but a room's membership is not read yet
+     * (a restart, a room just created). The request is refused and the session kept; its read starts in the background.
+     */
+    guestAdmission(record) {
+        if (!this.webSessions || !this.webToken || !this.webSessions.isCurrent(record, tokenEpoch(this.webToken)))
+            return "gone";
+        const owner = record.owner;
+        if (this.guestScope(owner).size)
+            return "ok";
+        if (owner && this.fleetConfig?.web?.guests?.enabled === true) {
+            const members = this.guestRooms(), rooms = guestGroupRooms(this.classicChannels?.getAll() ?? [], owner);
+            if (rooms.some((room) => members.pending(room, owner.userId))) {
+                void this.refreshGuestRooms(owner, { mode: "triggered" }); // rate-limited per room (30 s), single-flight
+                return "pending";
+            }
+        }
+        this.enforceGuestSwitch();
+        const ended = this.webSessions.revokeByHandle(record.handle);
+        if (ended.found)
+            this.logger.info({ adapterId: record.owner?.adapterId, durable: ended.durable }, "Guest web session ended: nothing left in its scope");
+        return "gone";
+    }
+    /** #1920 §3.2: the membership answers; the read goes to the room's own connection, never waits past its deadline. */
+    guestRooms() {
+        this.guestRoomMembership ??= new GuestRoomMembership({
+            now: () => performance.now(),
+            read: (room, userId) => {
+                const adapter = this.worlds.get(room.adapterId)?.adapter;
+                return room.kind === "telegram" ? adapter?.isGroupMember?.(room.channelId, userId) : adapter?.canViewChannel?.(room.channelId, userId);
+            },
+            // Said once per key while its reads keep failing (no user id: the room and connection are what an admin fixes).
+            onPersistentFailure: (room, failures) => this.logger.warn({ adapterId: room.adapterId, instance: room.instance, failures }, "Guest room membership keeps failing to read (the bot may lack the permission, or was removed); retrying with backoff up to 10 minutes"),
+            onRecovered: (room) => this.logger.info({ adapterId: room.adapterId, instance: room.instance }, "Guest room membership reads again"),
+        });
+        return this.guestRoomMembership;
+    }
+    /** #1920 §3.2: read this guest's rooms that are due (GuestRoomMembership.refresh says when each mode reads). */
+    async refreshGuestRooms(owner, opts = {}) {
+        if (this.fleetConfig?.web?.guests?.enabled !== true)
+            return;
+        try {
+            await this.guestRooms().refresh(owner, guestGroupRooms(this.classicChannels?.getAll() ?? [], owner), opts);
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message }, "Guest room membership could not be read");
+        }
+    }
+    /** Every account with a live guest session, one after another (the guest caps bound them); one pass at a time. */
+    async refreshAllGuestRooms() {
+        if (this.guestRoomsPass || this.fleetConfig?.web?.guests?.enabled !== true || !this.webSessions)
+            return;
+        this.guestRoomsPass = true;
+        try {
+            for (const owner of this.webSessions.guestOwners())
+                await this.refreshGuestRooms(owner);
+        }
+        finally {
+            this.guestRoomsPass = false;
+        }
+    }
+    guestRoomsPass = false;
+    /**
+     * #1920 §3.5: guest sign-in turned off ends every guest session — checked when the configuration is read or saved
+     * and when the sessions are opened, so turning it back on never revives one.
+     */
+    enforceGuestSwitch() {
+        if (this.fleetConfig?.web?.guests?.enabled === true || !this.webSessions)
+            return;
+        const ended = this.webSessions.revokeAll((r) => r.tier === "guest");
+        if (ended.count)
+            this.logger.info({ count: ended.count, durable: ended.durable }, "Guest web sign-in is off: every guest session ended");
+        // #1920 step 4b: and every guest's returning device — turning it back on lets no old browser ask for a code.
+        const devices = this.returningDevices?.revokeGuest();
+        if (devices?.count)
+            this.logger.info({ count: devices.count, durable: devices.durable }, "Guest web sign-in is off: every guest's returning device forgotten");
+    }
+    /** #1920 §5.2: whether this instance is the account's own Telegram private ClassicBot room (its chat id is the user id). */
+    guestOwnRoom(owner, instance) {
+        return (this.classicChannels?.getAll() ?? []).some((room) => room.instanceName === instance && this.isOwnPrivateRoom(owner, room));
+    }
+    /** A private room's chat id is its one user's id (a group's is negative, so never equal); Telegram only. */
+    isOwnPrivateRoom(owner, room) {
+        return room.adapterId === owner.adapterId && room.channelId === owner.userId && inferClassicChannelType(room.channelId) === "telegram";
     }
     /** Shared handler dispatcher; gateway admission is enforced by its separate listener. */
     dispatchWebHttp(req, res, port, closing = false) {
@@ -20086,6 +20745,19 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 // handler, on this listener and the public link's gateway alike (both come through here).
                 if (decision.via === "session" && decision.session.tier === "guest") {
                     const owner = decision.session.owner;
+                    const admitted = decision.session;
+                    const admission = this.guestAdmission(admitted);
+                    if (admission === "pending") {
+                        // §3.2: a room's membership is being read — try again shortly; the session stays.
+                        res.writeHead(503, { "Retry-After": "5" });
+                        res.end(JSON.stringify({ error: "guest_scope_pending" }));
+                        return;
+                    }
+                    if (admission === "gone") {
+                        res.writeHead(401);
+                        res.end(JSON.stringify({ error: "guest_scope_empty" }));
+                        return;
+                    }
                     const verdict = guestRouteDecision(req.method ?? "GET", parsedUrl, this.guestScope(owner));
                     if (verdict.kind === "deny") {
                         res.writeHead(verdict.status);
@@ -20093,10 +20765,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                         return;
                     }
                     // Phase 1b: the handlers that answer per recipient (the stream, the poll, a file) know it is a guest's, and
-                    // ask its scope anew each time.
-                    const admitted = decision.session;
-                    bindGuestRequest(req, { owner, scope: () => this.guestScope(owner),
-                        current: () => !!this.webSessions && !!this.webToken && this.webSessions.isCurrent(admitted, tokenEpoch(this.webToken)) });
+                    // ask its scope anew each time; an emptied scope ends the session (and closes its stream).
+                    bindGuestRequest(req, { owner, scope: () => this.guestScope(owner), current: () => this.guestStillAdmitted(admitted),
+                        // #1920 §5.2: its own Telegram private room shows it everything; the kept messages place ticks and buttons.
+                        ownRoom: (instance) => this.guestOwnRoom(owner, instance),
+                        // §3.2: a stream that connects reads its rooms again (in the background; at most once a minute).
+                        streamOpened: () => { void this.refreshGuestRooms(owner, { mode: "force" }); },
+                        history: () => this.webChatHistory,
+                        // #1920 §5.1: guests chat unless the host made them read-only (web.guests.chat: false).
+                        chat: () => this.fleetConfig?.web?.guests?.chat !== false });
                 }
             }
             if (req.method === "GET" && req.url === "/health") {