instar 1.3.1660 → 1.3.1661

package/dashboard/desktop.css

@@ -46,6 +46,8 @@ body.desktop-live #localCursor{display:block}
 #lockedPassword[hidden],#leaveUnlockedButton[hidden]{display:none}
 #lockedPassword input{width:100%;font-size:16px;padding:.55rem}
 #lockedPassword p{margin:0;font-size:.8rem}
+#lockedPasswordReason{position:absolute;z-index:8;left:max(.5rem,env(safe-area-inset-left));right:max(.5rem,env(safe-area-inset-right));top:max(.5rem,env(safe-area-inset-top));margin:0;padding:.6rem;background:#111827f2;border:1px solid #64748b;border-radius:10px;color:#f1f5f9;font-size:.85rem;pointer-events:none}
+#lockedPasswordReason[hidden]{display:none}
 #leaveUnlockedButton{position:absolute;z-index:8;right:max(.5rem,env(safe-area-inset-right));bottom:4rem;padding:.55rem .8rem}
 #lockedCard{margin-top:.8rem}
 #lockedCard[hidden]{display:none}

package/dashboard/desktop.html

@@ -95,6 +95,7 @@
       <button type="submit">Unlock</button>
       <p>The machine serving this page and the tunnel provider can read what you type here. The Instar app is safer.</p>
     </form>
+    <p id="lockedPasswordReason" role="status" hidden></p>
     <button id="leaveUnlockedButton" type="button" hidden>Leave unlocked</button>
     <div id="keyboardBar" hidden>
       <label class="type-label" for="typeText">Type on remote desktop</label>

package/dashboard/desktop.js

@@ -415,11 +415,19 @@ let controlSequence = 0n;
 let lockedSealKey = '';
 let lockedScreenState = '';
 let lockedBoxAllowed = false;
+let lockedBoxRefusal = '';
 let secretSequence = 0;
 function syncLockedPassword() {
-  const show = lockedBoxAllowed && lockedScreenState === 'locked-in-session' && !!lockedSealKey;
+  const locked = lockedScreenState === 'locked-in-session';
+  const show = lockedBoxAllowed && !lockedBoxRefusal && locked && !!lockedSealKey;
   $('lockedPassword').hidden = !show;
   if (!show) $('lockedPasswordInput').value = '';
+  // A locked Mac whose box cannot work says why, rather than showing nothing.
+  const reason = $('lockedPasswordReason');
+  if (reason) {
+    reason.hidden = !(locked && lockedBoxRefusal);
+    reason.textContent = locked && lockedBoxRefusal ? lockedMessage(lockedBoxRefusal) : '';
+  }
 }
 function lockedMessage(reason) {
   return { 'relock-pending': 'This Mac is finishing a relock. Try again in a couple of minutes.',
@@ -428,7 +436,30 @@ function lockedMessage(reason) {
     aborted: 'Stopped before the password finished. Type it again.',
     'field-dirty': 'Clearing the password field. Try again in a moment.',
     'browser-box-off': 'Password entry from a browser is off for this Mac.',
-    'tunnel-not-first-tier': 'Password entry is off while the backup connection is in use.' }[reason]
+    'tunnel-not-first-tier': 'Password entry is off while the backup connection is in use.',
+    'tunnel-not-active': 'Password entry from a browser is off until this Mac\'s secure tunnel is up. This page updates when it is.',
+    'retained-helper-required': 'Password entry needs Instar\'s kept desktop helper on this Mac, and this install does not have one.',
+    'own-input-grant-required': 'Password entry needs macOS Accessibility permission for Instar\'s own desktop helper on this Mac.',
+    'unsupported-macos': 'Password entry is not available on this Mac\'s macOS version.',
+    'helper-unprobed': 'This Mac\'s desktop helper has not answered yet, so password entry is not ready.',
+    'shield-not-confirmed': 'This Mac\'s lock screen is not ready for a password right now. Wake the screen and try again.',
+    'not-at-the-lock-screen': 'This Mac is not at its lock screen, so the password was not typed.',
+    'not-locked': 'This Mac is not locked, so there is nothing to unlock.',
+    'not-available': 'Password entry is not available in this session.',
+    'grant-ended': 'This remote session has ended. Start a new one to try again.',
+    'repeat': 'That password was already sent. Type it again to retry.',
+    'too-long': 'That password is too long to type here.',
+    'character-not-typable': 'That password has a character this Mac\'s keyboard layout cannot type from here.',
+    'state-unavailable': 'This Mac could not read its relock record. Try again in a moment.',
+    'relock-not-owed': 'This Mac is not ready for a password in this session. Start a new session.',
+    relocking: 'This Mac is relocking now. Try again in a couple of minutes.',
+    'relock-pending-unconfirmed': 'This Mac is finishing a relock. Try again in a couple of minutes.',
+    'relock-failed': 'This Mac could not confirm its last relock. Check it before trying again.',
+    'relock-failed-producer-alive': 'This Mac could not confirm its last relock. Check it before trying again.',
+    'guard-not-alive': 'This Mac\'s relock guard is not running, so password entry is paused. Try again shortly.',
+    disabled: 'Locked-screen access is turned off on this Mac.',
+    busy: 'This Mac is busy with another password. Try again in a moment.',
+    'state-unknown': 'This Mac\'s lock state is unclear right now. Try again in a moment.' }[reason]
     ?? 'This Mac did not accept that. Try again.';
 }
 async function receiveControl(record) {
@@ -440,7 +471,11 @@ async function receiveControl(record) {
   controlSequence = sequence;
   const value = JSON.parse(new TextDecoder().decode(plain));
   if (value.type === 'seal') lockedSealKey = value.key;
-  if (value.type === 'state') { lockedScreenState = value.state; lockedBoxAllowed = value.box === true; }
+  if (value.type === 'state') {
+    lockedScreenState = value.state;
+    lockedBoxAllowed = value.box === true;
+    lockedBoxRefusal = typeof value.boxRefusal === 'string' ? value.boxRefusal : '';
+  }
   if (value.type === 'secret-result' && value.refused) status(lockedMessage(value.refused));
   if (value.type === 'secret-result' && value.sent) { $('leaveUnlockedButton').hidden = false; }
   if (value.type === 'relock') status(value.phase === 'left-unlocked' ? 'This Mac will stay unlocked.' : 'Relocking has begun.');
@@ -934,6 +969,7 @@ async function openStream(result, resume = null) {
   socket.binaryType = 'arraybuffer';
   controlSequence = 0n;
   lockedSealKey = '';
+  lockedBoxRefusal = '';
   secretSequence = 0;
   syncLockedPassword();
   return new Promise((resolve, reject) => {

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAkIA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA+J7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA+DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAymBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;4BAIwB;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAoajB;AA8xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA85BN;AAwsBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgz3BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAmIA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA+J7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA4ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA+DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AA2mBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;4BAIwB;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAoajB;AA8xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAm6BN;AA+sBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAg03BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}

package/dist/commands/server.js

@@ -5,8 +5,7 @@
  */
 import { configureClaudeChildAuth, sweepClaudeAuthEnvFiles } from '../core/claudeChildAuth.js';
 import { SlackPrincipalResolver } from '../permissions/SlackPrincipalResolver.js';
-import { MEMORY_PRIVACY_UNAVAILABLE_REPLY } from '../users/MemoryInboundTracker.js';
-import { whatsappPersonKey } from '../users/MemoryAudience.js';
+import { whatsappPersonKey, whatsappSpeakerJid } from '../users/MemoryAudience.js';
 import { slackHistoryLabel } from '../messaging/slack/threadHistoryLabel.js';
 import { readPairingOwnerName } from '../threadline/pairingOwnerName.js';
 import { buildThrowawayJobGuard, checkThrowawayExpiry, describeExpiry, takeLastAutoStartRefusal, throwawayStartupDecision } from '../core/ThrowawayAgentGuard.js';
@@ -58,6 +57,7 @@ import { setAspClassifierRef, getAspClassifierRef } from '../core/aspClassifierR
 import { resolveInboundTelegramMessageId, resolveSignedByAgent, operatorAutoBindPermitted } from '../messaging/shared/signedInbound.js';
 import { verifiedEntityName } from '../messaging/shared/channelIdentity.js';
 import { StandDownRegistry } from '../core/StandDownRegistry.js';
+import { ensureDashboardPin, persistDashboardPin, pickDashboardPin } from '../core/dashboardPin.js';
 import { getActiveOverloadShedPlanner, getMoveAftercare } from '../core/OverloadShedPlanner.js';
 import { QuietTopicScanner } from '../core/quietTopicScanner.js';
 import { RebalanceProofRunner, getActiveRebalanceProof, waitForSettledIdle, proofSpawnBrief, setActiveRebalanceProof, setActiveRebalanceProofStore } from '../core/rebalanceProof.js';
@@ -426,9 +426,11 @@ async function handleFixCommand(topicId, text, deps) {
         return true;
     }
     if (cmd === 'fix dashboard') {
-        const existing = deps.liveConfig.get('dashboardPin', '');
-        if (existing) {
-            await send(`Your dashboard already has a PIN: ${existing}`);
+        // A vault-backed config holds {secret:true}; resolve it rather than print an object.
+        const stored = deps.liveConfig.get('dashboardPin', '');
+        if (stored) {
+            const existing = pickDashboardPin(stored, deps.config.stateDir);
+            await send(existing ? `Your dashboard already has a PIN: ${existing}` : 'Your dashboard already has a PIN, kept in its secret store.');
             return true;
         }
         const pin = String(randomInt(100000, 1000000));
@@ -642,6 +644,8 @@ let _topicProfileCtxRef = null;
 let _inboundQueue = null;
 /** Memory privacy (docs/specs/memory-privacy.md): set in startServer, read at every inbound. */
 let _memoryInbound = null;
+/** The tunnel's address for a path, once a tunnel exists. The tunnel starts after memory privacy. */
+let _memoryLinkFor = null;
 function telegramConfiguredForMemory(config) {
     return (config.messaging ?? []).some((m) => m.type === 'telegram');
 }
@@ -2362,16 +2366,22 @@ getHubClassifierDeps) {
             : null;
         // Memory privacy: record who spoke and re-check the group's readers BEFORE routing.
         if (_memoryInbound) {
-            const verdict = await _memoryInbound.onInbound({
+            const memoryFacts = {
                 placeKey: telegram.memoryPlaceKey,
                 placeKind: 'shared',
                 senderKey: resolvedUser ? `user:${resolvedUser.id}` : telegramUserId ? `telegram:${telegramUserId}` : null,
                 personId: resolvedUser?.id ?? null,
                 readerCount: () => telegram.groupReaderCount(),
                 liveSession: () => telegram.getSessionForTopic(topicId),
-            });
+            };
+            const verdict = await _memoryInbound.onInbound(memoryFacts);
             if (verdict === 'unavailable') {
-                await telegram.sendToTopic(topicId, MEMORY_PRIVACY_UNAVAILABLE_REPLY);
+                await telegram.sendToTopic(topicId, await _memoryInbound.refuse(memoryFacts, async (text) => {
+                    // This DM has one fixed recipient, so it goes only when that is who asked.
+                    if (!telegramUserId || telegram.getOwnerUserId() !== telegramUserId)
+                        return false;
+                    return (await telegram.sendToOwnerDM(text)) !== null;
+                }));
                 return;
             }
         }
@@ -3268,17 +3278,23 @@ getHubClassifierDeps) {
 async function whatsappMemoryCheck(whatsapp, jid, metadata) {
     if (!_memoryInbound)
         return true;
-    const profile = _memoryUserResolver?.channel('whatsapp', jid) ?? null;
-    const verdict = await _memoryInbound.onInbound({
+    const senderJid = whatsappSpeakerJid(metadata, jid);
+    const profile = _memoryUserResolver?.channel('whatsapp', senderJid) ?? null;
+    const memoryFacts = {
         placeKey: `whatsapp:${jid}`,
         placeKind: jid.endsWith('@g.us') ? 'shared' : 'private',
-        senderKey: profile ? `user:${profile.id}` : whatsappPersonKey(metadata?.senderJid ?? jid),
+        senderKey: profile ? `user:${profile.id}` : whatsappPersonKey(senderJid),
         personId: profile?.id ?? null,
         liveSession: () => whatsapp.getSessionForChannel(jid),
-    });
+    };
+    const verdict = await _memoryInbound.onInbound(memoryFacts);
     if (verdict === 'deliver')
         return true;
-    await whatsapp.send({ userId: jid, content: MEMORY_PRIVACY_UNAVAILABLE_REPLY, channel: { type: 'whatsapp', identifier: jid } });
+    const content = await _memoryInbound.refuse(memoryFacts, async (text) => {
+        await whatsapp.send({ userId: senderJid, content: text, channel: { type: 'whatsapp', identifier: senderJid } });
+        return true;
+    });
+    await whatsapp.send({ userId: jid, content, channel: { type: 'whatsapp', identifier: jid } });
     return false;
 }
 /**
@@ -3446,16 +3462,17 @@ function wireIMessageRouting(imessage, sessionManager) {
         // with imsg, which the sandbox cannot give, so a scoped session is refused here.
         if (_memoryInbound) {
             const imProfile = _memoryUserResolver?.channel('imessage', sender) ?? null;
-            const verdict = await _memoryInbound.onInbound({
+            const memoryFacts = {
                 placeKey: `imessage:${senderNorm}`,
                 placeKind: 'private',
                 senderKey: imProfile ? `user:${imProfile.id}` : `imessage:${sender}`,
                 personId: imProfile?.id ?? null,
                 scopedUnsupported: true,
                 liveSession: () => imessage.getSessionForSender(sender),
-            });
+            };
+            const verdict = await _memoryInbound.onInbound(memoryFacts);
             if (verdict === 'unavailable') {
-                await imessage.send({ userId: sender, content: MEMORY_PRIVACY_UNAVAILABLE_REPLY, channel: { type: 'imessage', identifier: sender } });
+                await imessage.send({ userId: sender, content: await _memoryInbound.refuse(memoryFacts), channel: { type: 'imessage', identifier: sender } });
                 return;
             }
         }
@@ -6511,6 +6528,7 @@ export async function startServer(options) {
             projectName: config.projectName,
             framework: () => sessionManagerConfig.framework ?? 'claude-code',
             claudePath: sessionManagerConfig.frameworkBinaryPaths?.['claude-code'] ?? sessionManagerConfig.claudePath,
+            linkFor: (urlPath) => _memoryLinkFor?.(urlPath) ?? null,
             memoryPrivacy: () => config.memoryPrivacy,
             messaging: () => (config.messaging ?? []),
             initialUsers: config.users,
@@ -9585,16 +9603,21 @@ export async function startServer(options) {
                     // a channel or thread is shared, and a thread's audience is its channel's.
                     if (_memoryInbound) {
                         const slackProfile = slackUserId ? _memoryUserResolver?.slack(slackUserId) ?? null : null;
-                        const verdict = await _memoryInbound.onInbound({
+                        const memoryFacts = {
                             placeKey: `slack:${channelId}`,
                             placeKind: channelId.startsWith('D') ? 'private' : 'shared',
                             senderKey: slackProfile ? `user:${slackProfile.id}` : slackUserId ? `slack:${slackUserId}` : null,
                             personId: slackProfile?.id ?? null,
                             readerCount: () => slackAdapter.channelReaderCount(channelId),
                             liveSession: () => slackAdapter.getSessionForChannel(routingKey),
-                        });
+                        };
+                        const verdict = await _memoryInbound.onInbound(memoryFacts);
                         if (verdict === 'unavailable') {
-                            await slackAdapter.sendToChannel(channelId, MEMORY_PRIVACY_UNAVAILABLE_REPLY, replyThreadTs ? { thread_ts: replyThreadTs } : undefined);
+                            // Posting to a user id opens the app's direct message with them.
+                            const reply = await _memoryInbound.refuse(memoryFacts, slackUserId
+                                ? async (text) => { await slackAdapter.sendToChannel(slackUserId, text); return true; }
+                                : undefined);
+                            await slackAdapter.sendToChannel(channelId, reply, replyThreadTs ? { thread_ts: replyThreadTs } : undefined);
                             return 'refused';
                         }
                     }
@@ -13132,6 +13155,7 @@ export async function startServer(options) {
             if (!config.tunnel) {
                 liveConfig.set('tunnel', { enabled: true, type: 'quick' });
             }
+            _memoryLinkFor = (urlPath) => tunnel?.getExternalUrl(urlPath) ?? null;
             tunnel = new TunnelManager({
                 enabled: true,
                 type: config.tunnel?.type || 'quick',
@@ -29035,8 +29059,8 @@ export async function startServer(options) {
                                             const result = reply.result;
                                             if (reply.ok && result?.ok && result.operationId === operationId) {
                                                 const state = String(result.state);
-                                                if (state === 'accepted' && result.originReceiptConfirmed === true)
-                                                    return { state: 'accepted', receiptJson: JSON.stringify({ confirmedVia: 'receipt', deliveryMachineId: machineId, operationId }) };
+                                                if (state === 'accepted' && result.originReceiptConfirmed === true && result.messageIds?.length === 1 && /^[1-9]\d*$/.test(result.messageIds[0]))
+                                                    return { state: 'accepted', receiptJson: JSON.stringify({ messageId: result.messageIds[0], confirmedVia: 'receipt', deliveryMachineId: machineId, operationId }) };
                                                 // Definite non-admission: never seen, evidence only, or terminal without delivery.
                                                 if (['no-record', 'not-admitted', 'known-failed', 'expired', 'suppressed', 'superseded'].includes(state))
                                                     return { state: 'not-accepted' };
@@ -29057,7 +29081,7 @@ export async function startServer(options) {
                                     },
                                     resolve: (operationId, deliveryMachineId, receiptJson) => runtime.store.recordForwardedAcceptance({ operationId, deliveryMachineId, receiptJson }),
                                     settleUnknown: (operationId, deliveryMachineId) => runtime.store.recordForwardedOutcomeUnknown({ operationId, deliveryMachineId }),
-                                    rehold: async (operationId, detail) => { await runtime.store.recordOperationState({ operationId, state: 'held', holdReason: originForwardMod.HOLD_REASON_LEASE_NOT_HELD, holdDetail: detail }); },
+                                    rehold: async (operationId, detail) => runtime.store.recordOperationState({ operationId, state: 'held', holdReason: originForwardMod.HOLD_REASON_LEASE_NOT_HELD, holdDetail: detail }),
                                     supersede: (operationId, next, detail) => runtime.store.supersedeWithAdmission({ operationId, admission: next.admission,
                                         holdReason: originForwardMod.HOLD_REASON_LEASE_NOT_HELD, holdDetail: detail }),
                                     sendLocal: async (detail) => {
@@ -29066,6 +29090,14 @@ export async function startServer(options) {
                                     },
                                 }, row, operation);
                                 // §3.3 — a delivered/resolved forward may have emptied the topic's held set.
+                                if (outcome === 'sent' || outcome === 'resolved') {
+                                    // The original adapter call returned HELD, so it never wrote its
+                                    // outbound topic row. Only a durable receipt with a concrete
+                                    // Telegram id may fill that gap; this never sends a second copy.
+                                    const recovered = await originForwardMod.confirmedRecoveredForward(row, id => runtime.store.getOperation(id)).catch(() => null);
+                                    if (recovered)
+                                        telegram.recordRecoveredOutbound(recovered.topicId, recovered.text, recovered.messageId, row.producerKind === 'session' ? 'agent' : 'automation');
+                                }
                                 if (outcome === 'sent' || outcome === 'resolved' || outcome === 'settled')
                                     await clearHeldItemIfResolved(row.destination.topicId);
                                 return outcome;
@@ -31684,6 +31716,16 @@ export async function startServer(options) {
             advertiseSelfMeshUrl(coordinator.managers.identityManager, coordinator.identity.machineId, cfUrl, (m) => console.log(pc.dim(m)));
             await advertiseSelfMeshEndpointsNow(coordinator.managers.identityManager, coordinator.identity.machineId, config, cfUrl);
         }
+        // Every agent gets a dashboard PIN, with or without Telegram: the PIN
+        // gates every dashboard operator route, and an agent must work without
+        // Telegram. An existing PIN (or an unresolved vault reference) is kept.
+        // Runs before the Telegram dashboard broadcast below, which reads config.dashboardPin.
+        const pinStore = { at: 'config' };
+        if (ensureDashboardPin(config, pin => {
+            pinStore.at = persistDashboardPin(config.stateDir, pin, value => liveConfig.set('dashboardPin', value));
+        }).generated) {
+            console.log(pc.green(`  Auto-generated a dashboard PIN (stored in this agent's ${pinStore.at === 'vault' ? 'secret store' : 'config'})`));
+        }
         // ── Dashboard Topic: always-available link ──────────────────────────
         // Retroactive: creates the topic on first run for existing agents.
         // Posts tunnel URL + PIN and pins the message for instant access.
@@ -31692,16 +31734,6 @@ export async function startServer(options) {
                 const dashTopicId = await telegram.ensureDashboardTopic();
                 if (dashTopicId) {
                     console.log(pc.green(`  Dashboard topic: ${dashTopicId}`));
-                    // Auto-generate dashboardPin if missing — do this on every startup,
-                    // not just during upgrades. The PIN should always exist.
-                    if (!config.dashboardPin) {
-                        const { randomInt } = await import('node:crypto');
-                        const pin = String(randomInt(100000, 1000000)); // 6-digit
-                        config.dashboardPin = pin;
-                        // Persist via LiveConfig so it survives restart
-                        liveConfig.set('dashboardPin', pin);
-                        console.log(pc.green(`  Auto-generated dashboard PIN: ${pin}`));
-                    }
                     // Wire the tunnel's two-channel notifier to telegram now that
                     // both telegram + Dashboard topic exist. Per
                     // specs/dev-infrastructure/tunnel-failure-resilience.md Part 3:
@@ -31711,8 +31743,9 @@ export async function startServer(options) {
                     // at compose time so the notifier never holds stale credentials.
                     if (tunnel) {
                         tunnel.attachTelegram(telegram, () => {
-                            const live = liveConfig.get('dashboardPin', '');
-                            return live || config.dashboardPin;
+                            // A vault-backed config holds {secret:true}; resolve it to the real PIN.
+                            return pickDashboardPin(liveConfig.get('dashboardPin', ''), config.stateDir)
+                                ?? pickDashboardPin(config.dashboardPin, config.stateDir) ?? '';
                         });
                     }
                     // Only broadcast if we have a tunnel URL — posting localhost to Telegram