jeo-code 0.12.13 → 0.12.15

package/src/messenger/discord-setup.ts

@@ -1,14 +1,16 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { loadMessengerConfig, resolveMessengerToken, validateMessengerEnvironment } from "./config";
+import { loadMessengerConfig, parseMessengerSandbox, resolveMessengerToken, validateMessengerEnvironment } from "./config";
 import { DISCORD_API, DISCORD_GATEWAY_INTENTS, discordGatewayUrl } from "./discord";
 import { MessengerHttpError, messengerFetchJson } from "./http";
 import { installMessengerService, messengerServicePlan } from "./service";
 import { isEnoent, isRecord } from "./types";
+import { notifyDir } from "../agent/notify/paths";
 
 export const DISCORD_TOKEN_ENV = "JEO_DISCORD_BOT_TOKEN";
 const TOKEN_FILE = "discord-token";
-const RUN_SCRIPT = "run-discord.sh";
+const RUN_SCRIPT_POSIX = "run-discord.sh";
+const RUN_SCRIPT_WINDOWS = "run-discord.cmd";
 const MESSAGE_CONTENT = 1 << 18;
 const MESSAGE_CONTENT_LIMITED = 1 << 19;
 /** The only application flags a bot token may change: the limited presence, member, and message intents. */
@@ -32,6 +34,28 @@ const INVITE_POLL_MS = 3_000;
 const GATEWAY_PROBE_MS = 20_000;
 const DM_TEST_MESSAGE = "jeo messenger is set up for this bot. Reply here to test the connection.";
 
+function throwIfAborted(signal?: AbortSignal): void {
+	if (signal?.aborted) throw new Error("Discord setup cancelled");
+}
+
+async function interruptibleSleep(sleep: (ms: number) => Promise<void>, ms: number, signal?: AbortSignal): Promise<void> {
+	if (!signal) return sleep(ms);
+	if (signal.aborted) throw new Error("Discord setup cancelled");
+	let cancel: (() => void) | undefined;
+	try {
+		await Promise.race([
+			sleep(ms),
+			new Promise<never>((_resolve, reject) => {
+				cancel = () => reject(new Error("Discord setup cancelled"));
+				signal.addEventListener("abort", cancel, { once: true });
+				if (signal.aborted) cancel();
+			}),
+		]);
+	} finally {
+		if (cancel) signal.removeEventListener("abort", cancel);
+	}
+}
+
 export interface DiscordSetupIO {
 	readonly interactive: boolean;
 	say(line: string): void;
@@ -60,6 +84,11 @@ export interface DiscordSetupDeps {
 	/** argv that starts this jeo build; defaults to the running runtime and entry. */
 	jeoCommand?: string[];
 	installService?: typeof installMessengerService;
+	/** Cancels invite polling and the remaining setup work (the CLI wires Ctrl+C here). */
+	signal?: AbortSignal;
+	/** Injectable platform/path separator for cross-platform release tests. */
+	platform?: NodeJS.Platform;
+	pathDelimiter?: string;
 }
 
 export interface DiscordSetupResult {
@@ -89,18 +118,23 @@ export interface RequestChannel {
 
 type DiscordApiFn = (method: string, route: string, body?: unknown) => Promise<unknown>;
 
-function discordApi(token: string, fetchImpl: typeof fetch): DiscordApiFn {
-	return (method, route, body) =>
-		messengerFetchJson(
+function discordApi(token: string, fetchImpl: typeof fetch, signal?: AbortSignal): DiscordApiFn {
+	return async (method, route, body) => {
+		throwIfAborted(signal);
+		const result = await messengerFetchJson(
 			`${DISCORD_API}${route}`,
 			{
 				method,
+				signal,
 				headers: { Authorization: `Bot ${token}`, "Content-Type": "application/json" },
 				...(body === undefined ? {} : { body: JSON.stringify(body) }),
 			},
 			undefined,
 			fetchImpl,
 		);
+		throwIfAborted(signal);
+		return result;
+	};
 }
 
 function str(value: unknown): string | undefined {
@@ -201,15 +235,21 @@ export async function waitForDiscordGuilds(
 	io: DiscordSetupIO,
 	sleep: (ms: number) => Promise<void>,
 	waitMs: number,
+	signal?: AbortSignal,
 ): Promise<Record<string, unknown>[]> {
+	throwIfAborted(signal);
 	let guilds = records(await api("GET", "/users/@me/guilds"));
+	throwIfAborted(signal);
 	if (guilds.length) return guilds;
 	if (!io.interactive) throw new Error(`Invite the bot to a server, then rerun: ${inviteUrl}`);
 	io.say(`Invite the bot to your server (choose the server and authorize):\n  ${inviteUrl}`);
 	io.say("Waiting for the bot to join…");
 	for (const deadline = Date.now() + waitMs; Date.now() < deadline; ) {
-		await sleep(INVITE_POLL_MS);
+		throwIfAborted(signal);
+		await interruptibleSleep(sleep, Math.min(INVITE_POLL_MS, Math.max(0, deadline - Date.now())), signal);
+		throwIfAborted(signal);
 		guilds = records(await api("GET", "/users/@me/guilds"));
+		throwIfAborted(signal);
 		if (guilds.length) return guilds;
 	}
 	throw new Error(`The bot has not joined a server yet; invite it, then rerun: ${inviteUrl}`);
@@ -363,8 +403,11 @@ export async function probeDiscordGateway(
 	api: DiscordApiFn,
 	token: string,
 	WebSocketImpl: typeof WebSocket,
+	signal?: AbortSignal,
 ): Promise<void> {
+	throwIfAborted(signal);
 	const discovery = await api("GET", "/gateway/bot");
+	throwIfAborted(signal);
 	const url = discordGatewayUrl(isRecord(discovery) ? discovery.url : undefined);
 	const result = Promise.withResolvers<void>();
 	const socket = new WebSocketImpl(url);
@@ -372,7 +415,11 @@ export async function probeDiscordGateway(
 		() => result.reject(new Error("Discord Gateway did not confirm the bot session in time")),
 		GATEWAY_PROBE_MS,
 	);
+	const cancel = () => result.reject(new Error("Discord setup cancelled"));
+	signal?.addEventListener("abort", cancel, { once: true });
+	if (signal?.aborted) cancel();
 	socket.addEventListener("message", (event: MessageEvent) => {
+		if (signal?.aborted) return;
 		let packet: unknown;
 		try {
 			packet = typeof event.data === "string" ? JSON.parse(event.data) : undefined;
@@ -404,8 +451,10 @@ export async function probeDiscordGateway(
 	socket.addEventListener("error", () => result.reject(new Error("Discord Gateway connection failed")));
 	try {
 		await result.promise;
+		throwIfAborted(signal);
 	} finally {
 		clearTimeout(timer);
+		signal?.removeEventListener("abort", cancel);
 		try {
 			socket.close(1000);
 		} catch {
@@ -434,6 +483,18 @@ exec ${command.map(quote).join(" ")} messenger run --config "$dir/${configName}"
 `;
 }
 
+/** The Windows launcher inherits PATH at launch; the token remains in the private sidecar. */
+export function discordRunCommand(command: string[], configName: string, tokenEnv: string): string {
+	if (!/^[A-Za-z_]/u.test(tokenEnv) || /[^A-Za-z0-9_]/u.test(tokenEnv)) throw new Error("discord.tokenEnv must name an environment variable");
+	const literal = (value: string, label: string): string => {
+		if (/["\r\n]/.test(value)) throw new Error(`Windows launcher ${label} must not contain quotes or newlines`);
+		if (/[^\x00-\x7f]/.test(value)) throw new Error(`Windows launcher ${label} must contain only ASCII characters; use ASCII paths`);
+		return value.replace(/%/g, "%%");
+	};
+	const quote = (value: string): string => `"${literal(value, "command")}"`;
+	return `@echo off\r\nsetlocal DisableDelayedExpansion\r\nset /p "${tokenEnv}="<"%~dp0${TOKEN_FILE}"\r\n${command.map(quote).join(" ")} messenger run --config "%~dp0${literal(configName, "config name")}"\r\n`;
+}
+
 async function writePrivate(file: string, content: string, mode: number): Promise<void> {
 	const temporary = `${file}.${process.pid}.tmp`;
 	await Bun.write(temporary, content);
@@ -458,9 +519,14 @@ async function readExistingConfig(configPath: string): Promise<Record<string, un
 	throw new Error(`${configPath} exists but is not a JSON object; fix or move it before setup`);
 }
 
-function currentJeoCommand(): string[] {
-	const entry = Bun.main;
-	return entry === process.execPath || entry.startsWith("/$bunfs/") ? [process.execPath] : [process.execPath, entry];
+export function currentJeoCommand(entry = Bun.main, execPath = process.execPath): string[] {
+	return entry === execPath || entry.startsWith("/$bunfs/") || entry.replaceAll("\\", "/").startsWith("B:/~BUN/") ? [execPath] : [execPath, entry];
+}
+
+export function messengerExecutablePath(execPath: string, inheritedPath: string | undefined, delimiter: string, platform: NodeJS.Platform): string {
+	const fallbackPath = platform === "win32" ? "" : "/usr/bin:/bin";
+	const runtimeDirectory = platform === "win32" ? path.win32.dirname(execPath) : path.dirname(execPath);
+	return [...new Set([runtimeDirectory, ...(inheritedPath ?? fallbackPath).split(delimiter).filter(Boolean)])].join(delimiter);
 }
 
 /** Create or repair a Discord messenger profile with as few manual steps as Discord allows. */
@@ -473,20 +539,47 @@ export async function setupDiscordMessenger(
 	const configPath = path.resolve(options.configPath);
 	const directory = path.dirname(configPath);
 	const tokenPath = path.join(directory, TOKEN_FILE);
-	const runScript = path.join(directory, RUN_SCRIPT);
+	const platform = deps.platform ?? process.platform;
+	throwIfAborted(deps.signal);
+	if (options.service && platform !== "darwin" && platform !== "linux") {
+		throw new Error("Background services are supported only on macOS and Linux");
+	}
+	const runScript = path.join(directory, platform === "win32" ? RUN_SCRIPT_WINDOWS : RUN_SCRIPT_POSIX);
+	const delimiter = deps.pathDelimiter ?? path.delimiter;
+	const envPath = messengerExecutablePath(process.execPath, env.PATH, delimiter, platform);
+	const command = deps.jeoCommand ?? currentJeoCommand();
+	const existing = await readExistingConfig(configPath);
+	const sandbox = existing?.sandbox !== undefined ? parseMessengerSandbox(existing.sandbox) : parseMessengerSandbox({
+		image: await io.ask("Existing local Linux sandbox image (no image will be pulled): "),
+		limits: {
+			memoryBytes: Number(await io.ask("Sandbox memory limit in bytes: ")),
+			pids: Number(await io.ask("Sandbox process limit: ")),
+			cpus: Number(await io.ask("Sandbox CPU limit: ")),
+		},
+	});
+	if (existing && Object.hasOwn(existing, "independentSessions")) {
+		delete existing.independentSessions;
+		io.say("Removed obsolete independentSessions setting. Discord threads now keep one persistent session.");
+	}
+	if (platform === "win32") discordRunCommand(command, path.basename(configPath), DISCORD_TOKEN_ENV);
 
 	const token = await resolveToken(env, tokenPath, io);
-	const api = discordApi(token, deps.fetch ?? fetch);
+	throwIfAborted(deps.signal);
+	const api = discordApi(token, deps.fetch ?? fetch, deps.signal);
 	const bot = await inspectDiscordBot(api);
+	throwIfAborted(deps.signal);
 	io.say(`Bot ${bot.username} (${bot.id}), application ${bot.applicationId}`);
 	await ensureMessageContentIntent(api, bot, io);
+	throwIfAborted(deps.signal);
 
 	await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+	throwIfAborted(deps.signal);
 	await writePrivate(tokenPath, `${token}\n`, 0o600);
+	throwIfAborted(deps.signal);
 
 	const inviteUrl = discordInviteUrl(bot.applicationId);
-	const guilds = await waitForDiscordGuilds(api, inviteUrl, io, deps.sleep ?? Bun.sleep, options.inviteWaitMs ?? 300_000);
-	const existing = await readExistingConfig(configPath);
+	const guilds = await waitForDiscordGuilds(api, inviteUrl, io, deps.sleep ?? Bun.sleep, options.inviteWaitMs ?? 300_000, deps.signal);
+	throwIfAborted(deps.signal);
 	const platforms = isRecord(existing?.platforms) ? existing.platforms : {};
 	const previous = isRecord(platforms.discord) ? platforms.discord : {};
 	const previousList = (key: string): string[] | undefined => {
@@ -499,14 +592,17 @@ export async function setupDiscordMessenger(
 	let channelIds: string[];
 	if (options.channelIds?.length || !previousList("allowedChannelIds")) {
 		const channels = await selectDiscordChannels(api, bot, guilds, options.channelIds, inviteUrl, io);
+		throwIfAborted(deps.signal);
 		for (const channel of channels) io.say(`Request channel: #${channel.name} in ${channel.guildName}`);
 		channelIds = channels.map(channel => channel.id);
 	} else {
 		channelIds = previousList("allowedChannelIds") as string[];
 	}
 	const dmChannel = options.dmTest === false ? undefined : await openOwnerDm(api, userIds[0]!, io);
+	throwIfAborted(deps.signal);
 	const allowedChannelIds = [...new Set([...channelIds, ...(dmChannel ? [dmChannel] : [])])];
 	const tokenEnv = str(previous.tokenEnv) ?? DISCORD_TOKEN_ENV;
+	if (platform === "win32") discordRunCommand(command, path.basename(configPath), tokenEnv);
 
 	const discord: Record<string, unknown> = { ...previous, tokenEnv, allowedUserIds: userIds, allowedChannelIds };
 	if (options.artifacts) discord.artifactDir = "./artifacts";
@@ -514,24 +610,26 @@ export async function setupDiscordMessenger(
 	const config = {
 		...existing,
 		cwd: str(existing?.cwd) ?? "./workspace",
-		sessionDir: str(existing?.sessionDir) ?? "./sessions",
+		sessionDir: str(existing?.sessionDir) ?? path.join(notifyDir(), "messenger-sessions"),
+		sandbox,
 		toolNames: options.toolNames ?? (Array.isArray(existing?.toolNames) ? existing.toolNames : defaultTools),
-		independentSessions: existing?.independentSessions !== undefined ? Boolean(existing.independentSessions) : true,
 		platforms: { ...platforms, discord },
 	};
 	for (const relative of [config.cwd, config.sessionDir, discord.artifactDir]) {
 		if (typeof relative === "string")
 			await fs.mkdir(path.resolve(directory, relative), { recursive: true, mode: 0o700 });
+		throwIfAborted(deps.signal);
 	}
 	await writePrivate(configPath, `${JSON.stringify(config, null, 2)}\n`, 0o600);
-	const envPath = [...new Set([path.dirname(process.execPath), ...(env.PATH ?? "/usr/bin:/bin").split(":")])].join(
-		":",
-	);
+	throwIfAborted(deps.signal);
 	await writePrivate(
 		runScript,
-		discordRunScript(deps.jeoCommand ?? currentJeoCommand(), path.basename(configPath), tokenEnv, envPath),
+		platform === "win32"
+			? discordRunCommand(command, path.basename(configPath), tokenEnv)
+			: discordRunScript(command, path.basename(configPath), tokenEnv, envPath),
 		0o700,
 	);
+	throwIfAborted(deps.signal);
 	// The same loader `messenger run` uses must accept what was written.
 	const written = await loadMessengerConfig(configPath);
 	validateMessengerEnvironment(
@@ -539,12 +637,14 @@ export async function setupDiscordMessenger(
 		{ [tokenEnv]: token },
 	);
 
-	await probeDiscordGateway(api, token, deps.WebSocket ?? WebSocket);
+	await probeDiscordGateway(api, token, deps.WebSocket ?? WebSocket, deps.signal);
+	throwIfAborted(deps.signal);
 	io.say("Discord Gateway accepted the bot session and intents.");
 
 	let service: string | undefined;
 	if (options.service) {
 		service = await (deps.installService ?? installMessengerService)(messengerServicePlan(directory, runScript));
+		throwIfAborted(deps.signal);
 		io.say(`Gateway running as ${service}`);
 	}
 	if (dmChannel) {
@@ -555,8 +655,10 @@ export async function setupDiscordMessenger(
 			io.say(
 				"Could not send the test DM (the owner may block DMs from server members); server requests still work.",
 			);
+			throwIfAborted(deps.signal);
 		}
 	}
+	throwIfAborted(deps.signal);
 	return {
 		configPath,
 		botName: bot.username,

package/src/messenger/discord.ts

@@ -335,14 +335,15 @@ export function createDiscordAdapter(
 ): MessengerAdapter {
 	const token = resolveMessengerToken(config.tokenEnv, env)?.trim();
 	const clock = deps.clock ?? defaultClock;
-	const createdThreads = new Map<string, { parentChannelId: string; senderId: string }>();
-	const rememberThread = (threadId: string, parentChannelId: string, senderId: string): void => {
-		createdThreads.set(threadId, { parentChannelId, senderId });
+	const createdThreads = new Map<string, { parentChannelId: string }>();
+	const rememberThread = (threadId: string, parentChannelId: string): void => {
+		createdThreads.set(threadId, { parentChannelId });
 		if (createdThreads.size > 10_000) {
 			const oldest = createdThreads.keys().next().value;
 			if (oldest !== undefined) createdThreads.delete(oldest);
 		}
 	};
+	const normalizationTails = new Map<string, Promise<void>>();
 	const activityMessages = new Map<string, string>();
 	const headers = (): Record<string, string> => {
 		if (!token) throw new DiscordConfigurationError("Discord bot token is missing");
@@ -386,57 +387,50 @@ export function createDiscordAdapter(
 						initialUrl = discordGatewayUrl(gateway.url);
 					}
 					const deliver = async (message: MessengerMessage): Promise<void> => {
-						const thread = createdThreads.get(message.channelId);
-						if (thread && thread.senderId === message.senderId) {
-							await onMessage({
-								...message,
-								threadId: message.channelId,
-								parentChannelId: thread.parentChannelId,
-							});
-						} else if (
-							!message.direct &&
-							config.allowedUserIds.includes(message.senderId) &&
-							config.allowedChannelIds &&
-							(!message.mentioned || !config.allowedChannelIds.includes(message.channelId))
-						) {
-							try {
+						const previous = normalizationTails.get(message.channelId) ?? Promise.resolve();
+						const ready = Promise.withResolvers<void>();
+						const tail = previous.then(() => ready.promise);
+						normalizationTails.set(message.channelId, tail);
+						const forward = (destination: MessengerMessage): Promise<void> => {
+							ready.resolve();
+							return onMessage(destination);
+						};
+						await previous;
+						try {
+							if (signal.aborted) return;
+							const thread = createdThreads.get(message.channelId);
+							if (thread && config.allowedUserIds.includes(message.senderId)) {
+								await forward({ ...message, threadId: message.channelId, parentChannelId: thread.parentChannelId });
+							} else if (!message.direct && config.allowedUserIds.includes(message.senderId)) {
 								const channel = await messengerFetchJson(
 									`${DISCORD_API}/channels/${encodeURIComponent(message.channelId)}`,
-									{ headers: headers() },
-									signal,
-									deps.fetch,
+									{ headers: headers() }, signal, deps.fetch,
 								);
-								if (
-									isRecord(channel) &&
-									channel.id === message.channelId &&
-									typeof channel.type === "number" &&
-									[10, 11, 12].includes(channel.type) &&
-									typeof channel.parent_id === "string" &&
-									channel.parent_id
-								) {
+								if (!isRecord(channel) || channel.id !== message.channelId) return;
+								if (typeof channel.type === "number" && [10, 11, 12].includes(channel.type)) {
+									if (typeof channel.parent_id !== "string" || !channel.parent_id) return;
 									if (!message.mentioned) {
 										const originalId = typeof channel.name === "string" ? /^Request (\d{1,20})$/.exec(channel.name)?.[1] : undefined;
 										if (channel.owner_id !== accountId || !originalId ||
-											(!config.allowedChannelIds.includes(channel.parent_id) && !config.allowedChannelIds.includes(message.channelId))) return;
+											(config.allowedChannelIds && !config.allowedChannelIds.includes(channel.parent_id) && !config.allowedChannelIds.includes(message.channelId))) return;
 										const original = await messengerFetchJson(
 											`${DISCORD_API}/channels/${encodeURIComponent(channel.parent_id)}/messages/${originalId}`,
 											{ headers: headers() }, signal, deps.fetch,
 										);
 										if (!isRecord(original) || original.id !== originalId || original.channel_id !== channel.parent_id ||
-											!isRecord(original.author) || original.author.id !== message.senderId || original.author.bot === true || original.webhook_id) return;
-										rememberThread(message.channelId, channel.parent_id, message.senderId);
+											!isRecord(original.author) || typeof original.author.id !== "string" || original.author.bot === true || original.webhook_id) return;
 									}
-									await onMessage({
-										...message,
-										threadId: message.channelId,
-										parentChannelId: channel.parent_id,
-									});
+									rememberThread(message.channelId, channel.parent_id);
+									await forward({ ...message, threadId: message.channelId, parentChannelId: channel.parent_id });
+								} else {
+									await forward(message);
 								}
-							} catch {
-								/* ignore thread lookup failure */
+							} else {
+								await forward(message);
 							}
-						} else {
-							await onMessage(message);
+						} finally {
+							ready.resolve();
+							if (normalizationTails.get(message.channelId) === tail) normalizationTails.delete(message.channelId);
 						}
 					};
 					await connectGateway(
@@ -479,7 +473,7 @@ export function createDiscordAdapter(
 		async prepare(message, signal) {
 			if (message.direct) return message;
 			if (message.threadId) {
-				if (message.parentChannelId) rememberThread(message.threadId, message.parentChannelId, message.senderId);
+				if (message.parentChannelId) rememberThread(message.threadId, message.parentChannelId);
 				return message;
 			}
 			const channel = await messengerFetchJson(
@@ -493,7 +487,7 @@ export function createDiscordAdapter(
 			if ([10, 11, 12].includes(channel.type)) {
 				if (typeof channel.parent_id !== "string" || !channel.parent_id)
 					throw new Error("Discord thread parent unavailable");
-				rememberThread(message.channelId, channel.parent_id, message.senderId);
+				rememberThread(message.channelId, channel.parent_id);
 				return { ...message, threadId: message.channelId, parentChannelId: channel.parent_id };
 			}
 			if (channel.type !== 0 && channel.type !== 5) throw new Error("Discord channel cannot host a reply thread");
@@ -505,7 +499,7 @@ export function createDiscordAdapter(
 			);
 			if (!isRecord(thread) || typeof thread.id !== "string" || !thread.id)
 				throw new Error("Discord thread creation returned no ID");
-			rememberThread(thread.id, message.channelId, message.senderId);
+			rememberThread(thread.id, message.channelId);
 			return { ...message, threadId: thread.id };
 		},
 		async status(message, state, signal) {

package/src/messenger/gateway.ts

@@ -1,4 +1,5 @@
 import { MessengerHttpError } from "./http";
+import { DiscordModelSelectionError } from "./model-selection";
 import type {
 	MessengerActivityReporter,
 	MessengerAdapter,
@@ -173,7 +174,7 @@ export type MessengerSessionIdentity = readonly [
 	channel: string,
 	thread: OptionalIdentity,
 	conversation: OptionalIdentity,
-	user: string,
+	user: OptionalIdentity,
 ];
 
 function optionalIdentity(name: string, value: string | undefined): OptionalIdentity {
@@ -201,7 +202,7 @@ export function messengerSessionIdentity(message: MessengerMessage): MessengerSe
 		message.parentChannelId ?? message.channelId,
 		optionalIdentity("thread", message.threadId),
 		optionalIdentity("conversation", message.conversationId),
-		message.senderId,
+		message.platform === "discord" && message.threadId !== undefined ? ["absent"] : ["present", message.senderId],
 	];
 }
 
@@ -217,7 +218,7 @@ export function messengerSessionRoute(cwd: string, message: MessengerMessage): s
 
 function schedulingKey(message: MessengerMessage, adapter: MessengerAdapter): string {
 	if (adapter.prepare && !message.direct && !message.threadId && !message.parentChannelId) {
-		return JSON.stringify([message.platform, message.accountId, message.channelId, message.messageId]);
+		return JSON.stringify([message.platform, message.accountId, message.guildId, message.channelId, message.platform === "discord" ? null : message.senderId]);
 	}
 	return messengerConversationKey(message);
 }
@@ -263,6 +264,8 @@ export interface MessengerGatewayOptions {
 	 * order; above 1 the reply implementation must accept concurrent turns for different conversations.
 	 */
 	concurrency?: number;
+	/** Authenticated human controls bypass model queues, including busy sessions. */
+	sandboxControl?: (message: MessengerMessage, signal: AbortSignal) => Promise<{ handled: boolean; output: string }>;
 }
 
 export function createMessengerGateway(
@@ -285,6 +288,7 @@ export function createMessengerGateway(
 	const turns = new Set<Promise<void>>();
 	/** Settles when the latest request of a prepared conversation has delivered its reply. */
 	const conversationTails = new Map<string, Promise<void>>();
+	const admissionTails = new Map<string, Promise<void>>();
 	const lifetime = new AbortController();
 	let running = false;
 	let fatalError: MessengerFatalError | undefined;
@@ -353,7 +357,9 @@ export function createMessengerGateway(
 					return;
 				}
 				if (signal.aborted) return;
-				text = "The request could not be completed. Please try again.";
+				text = error instanceof DiscordModelSelectionError
+					? "Discord could not verify a model. Ask the operator to configure an explicit Discord model, check provider credentials and live model discovery, then restart the messenger service."
+					: "The request could not be completed. Please try again.";
 			}
 			if (!signal.aborted && text.trim()) {
 				// A failed send may already have delivered a chunk: never retry the entire reply.
@@ -390,21 +396,38 @@ export function createMessengerGateway(
 		}
 	}
 
-	function handle(message: MessengerMessage, signal?: AbortSignal): Promise<void> {
+	async function handle(message: MessengerMessage, signal?: AbortSignal): Promise<void> {
 		const adapter = byPlatform.get(message.platform);
 		const effectiveSignal = signal ? AbortSignal.any([lifetime.signal, signal]) : lifetime.signal;
 		if (effectiveSignal.aborted || !adapter || !isMessengerMessageAllowed(message, config)) return Promise.resolve();
 		const id = JSON.stringify([message.platform, message.accountId, message.channelId, message.messageId]);
-		if (seen.has(id) || queue.length >= MAX_QUEUED_MESSAGES) return Promise.resolve();
+		if (seen.has(id)) return;
 		seen.add(id);
 		if (seen.size > MAX_SEEN_MESSAGES) {
 			const oldest = seen.values().next().value;
 			if (oldest !== undefined) seen.delete(oldest);
 		}
-		const { promise, resolve } = Promise.withResolvers<void>();
-		queue.push({ message, adapter, signal: effectiveSignal, resolve, key: schedulingKey(message, adapter) });
-		schedule();
-		return promise;
+		const key = schedulingKey(message, adapter);
+		const previous = admissionTails.get(key) ?? Promise.resolve();
+		const ready = Promise.withResolvers<void>();
+		const tail = previous.then(() => ready.promise);
+		admissionTails.set(key, tail);
+		void tail.then(() => { if (admissionTails.get(key) === tail) admissionTails.delete(key); });
+		try {
+			if (options.sandboxControl) {
+				const control = await options.sandboxControl(message, effectiveSignal);
+				if (control.handled) {
+					if (!effectiveSignal.aborted && control.output.trim()) await adapter.send(message, control.output, effectiveSignal);
+					return;
+				}
+			}
+			await previous;
+			if (effectiveSignal.aborted || queue.length >= MAX_QUEUED_MESSAGES) return;
+			const { promise, resolve } = Promise.withResolvers<void>();
+			queue.push({ message, adapter, signal: effectiveSignal, resolve, key });
+			schedule();
+			return promise;
+		} finally { ready.resolve(); }
 	}
 
 	return {

package/src/messenger/model-selection.ts

@@ -0,0 +1,101 @@
+import { readGlobalConfig, type Config } from "../agent/state";
+import { listProviderModels } from "../ai/model-discovery";
+import { credentialForCall, effectiveCredentialForProvider, qualifyModelId, resolveProvider } from "../ai/model-manager";
+import { resolveModelId } from "../ai/model-registry";
+import { resolveCredential, type AuthProvider, type Credential } from "../auth";
+
+export class DiscordModelSelectionError extends Error {
+  constructor(cause: unknown) {
+    super(cause instanceof Error ? cause.message : "Discord model selection failed", { cause });
+    this.name = "DiscordModelSelectionError";
+  }
+}
+
+/** Select only from the account's live catalog; never substitute a static model. */
+export async function selectDiscordModel(
+  explicit: string | undefined,
+  opts: { config?: Config; signal?: AbortSignal; list?: typeof listProviderModels; credential?: typeof resolveCredential } = {},
+): Promise<string> {
+  try {
+    return await selectDiscordModelFromCatalog(explicit, opts);
+  } catch (error) {
+    if (opts.signal?.aborted) throw error;
+    throw new DiscordModelSelectionError(error);
+  }
+}
+
+async function selectDiscordModelFromCatalog(
+  explicit: string | undefined,
+  opts: { config?: Config; signal?: AbortSignal; list?: typeof listProviderModels; credential?: typeof resolveCredential },
+): Promise<string> {
+  const config = opts.config ?? await readGlobalConfig();
+  const requested = explicit?.trim() ? await resolveModelId(explicit.trim(), config) : undefined;
+  const provider = resolveProvider(requested || await resolveModelId(config.defaultModel, config));
+  if (!requested && provider !== "anthropic" && provider !== "openai" && provider !== "antigravity") {
+    throw new Error(`Discord automatic model selection does not support provider ${provider}; configure an explicit model`);
+  }
+  const result = await (opts.list ?? listProviderModels)(provider, { config, signal: opts.signal, limit: Number.POSITIVE_INFINITY, preferOAuth: true });
+  if (opts.signal?.aborted) throw new Error("Messenger request aborted");
+  if (!result.ok || result.fallback || result.source === "none" || (result.source === "keyless" && (!requested || (provider !== "ollama" && provider !== "lmstudio"))) || !result.models.length) {
+    throw new Error(`Discord cannot verify available models for ${provider}; check login and live model discovery`);
+  }
+  const canonical = (model: string) => qualifyModelId(model, provider);
+  const verified = async (model: string): Promise<string> => {
+    const authProvider: AuthProvider | undefined = provider === "anthropic" ? "anthropic" : provider === "openai" ? "openai" : undefined;
+    if (authProvider && config.providers[authProvider]) {
+      const credential: Credential = await (opts.credential ?? resolveCredential)(authProvider);
+      const effective = effectiveCredentialForProvider(authProvider, credential, config, model);
+      const actual = credentialForCall(provider, effective, config, provider === "openai" ? config.openaiBaseUrl : undefined);
+      if (actual.kind !== result.source) {
+        throw new Error(`Discord cannot verify ${provider} model access for the credential used at runtime`);
+      }
+    }
+    return canonical(model);
+  };
+  if (requested) {
+    const prefix = `${provider}/`;
+    const requestedId = requested.startsWith(prefix) ? requested.slice(prefix.length) : requested;
+    const match = result.models.find(model => (model.startsWith(prefix) ? model.slice(prefix.length) : model) === requestedId);
+    if (!match) throw new Error(`Discord configured model is not available for ${provider}: ${requested}`);
+    return verified(match);
+  }
+  const family = provider === "anthropic" ? /sonnet/i : provider === "openai" ? /terra/i : /gemini.*flash/i;
+  const variant = /(?:^|[^a-z0-9])(?:mini|lite|codex|thinking|image)(?=$|[^a-z0-9])/i;
+  const models = [...new Set(result.models.filter(model => {
+    const name = provider === "antigravity" ? (result.displayNames?.[model] ?? model) : model;
+    return family.test(name) && !variant.test(model) && !variant.test(name);
+  }))];
+  if (!models.length) throw new Error(`Discord found no available ${provider} model in the required family`);
+  if (models.length === 1) return verified(models[0]!);
+  // Antigravity wire aliases can advertise a different version than their IDs.
+  // Only the display name from the same live response establishes recency.
+  if (provider === "antigravity" && models.some(model => !result.displayNames?.[model])) {
+    throw new Error("Discord cannot determine the newest Antigravity Flash model: live catalog is missing display names; configure an explicit model from the live catalog");
+  }
+  const ranked = models.map(model => {
+    const name = provider === "antigravity" ? result.displayNames![model]! : model;
+    const snapshot = name.match(/[-_ ](\d{4}-\d{2}-\d{2}|\d{8})$/);
+    const versionName = snapshot ? name.slice(0, -snapshot[0].length) : name;
+    const tierName = provider === "antigravity" ? name.match(/\((high|medium|low)\)\s*$/i)?.[1]?.toLowerCase() : undefined;
+    const tier = tierName === "high" ? 3 : tierName === "medium" ? 2 : tierName === "low" ? 1 : 0;
+    return { model, version: (versionName.match(/\d+/g) ?? []).map(Number), snapshot: Number(snapshot?.[1]?.replaceAll("-", "") ?? 0), tier, ambiguousVersion: provider === "openai" && /terra.*\d/i.test(versionName) };
+  });
+  if (ranked.some(item => !item.version.length || item.ambiguousVersion)) {
+    throw new Error(`Discord cannot determine the newest ${provider} model; configure an explicit model`);
+  }
+  const compare = (a: number[], b: number[]) => {
+    for (let i = 0; i < Math.max(a.length, b.length); i++) {
+      const difference = (b[i] ?? 0) - (a[i] ?? 0);
+      if (difference) return difference;
+    }
+    return 0;
+  };
+  ranked.sort((a, b) => compare(a.version, b.version) || b.snapshot - a.snapshot || b.tier - a.tier);
+  if (provider === "antigravity" && ranked.some((item, index) => index > 0 && compare(ranked[0]!.version, item.version) === 0 && ranked[0]!.snapshot === item.snapshot && (!ranked[0]!.tier || !item.tier))) {
+    throw new Error("Discord cannot distinguish the newest antigravity models; configure an explicit model");
+  }
+  if (compare(ranked[0]!.version, ranked[1]!.version) === 0 && ranked[0]!.snapshot === ranked[1]!.snapshot && ranked[0]!.tier === ranked[1]!.tier) {
+    throw new Error(`Discord cannot distinguish the newest ${provider} models; configure an explicit model`);
+  }
+  return verified(ranked[0]!.model);
+}