mixdog 0.9.66 → 0.9.68

package/src/standalone/channel-admin.mjs

@@ -15,7 +15,6 @@ import {
   diagnoseDiscordTokenValue,
   getDiscordToken,
   getTelegramToken,
-  getWebhookAuthtoken,
   hasStoredSecret,
   readSection,
   saveSecret,
@@ -34,10 +33,13 @@ import {
 import {
   listEndpoints as dbListEndpoints,
   loadEndpointConfig as dbLoadEndpoint,
+  readEndpointSecret as dbReadEndpointSecret,
   upsertEndpoint as dbUpsertEndpoint,
   deleteEndpoint as dbDeleteEndpoint,
   setEndpointEnabled as dbSetEndpointEnabled,
 } from '../runtime/shared/webhooks-db.mjs';
+import { normalizeAutomationAttachments } from '../runtime/shared/automation-attachments.mjs';
+import { readHookPublicBase } from '../runtime/channels/lib/webhook/relay-tunnel.mjs';
 
 const NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
 const DEFAULT_CHANNELS = Object.freeze({
@@ -197,18 +199,6 @@ export function forgetTelegramToken() {
   return { ok: true };
 }
 
-export function saveWebhookAuthtoken(token) {
-  const value = String(token || '').trim();
-  if (!value) throw new Error('Webhook/ngrok authtoken is required');
-  saveSecret(SECRET_ACCOUNTS.webhookAuth, value);
-  return { ok: true, configured: Boolean(getWebhookAuthtoken()) };
-}
-
-export function forgetWebhookAuthtoken() {
-  deleteSecret(SECRET_ACCOUNTS.webhookAuth);
-  return { ok: true };
-}
-
 // Single-channel write: persists `cfg.channel`, keeping the per-backend id
 // fields (discordChannelId/telegramChatId) so a backend switch retains both
 // ids. `backend` selects which per-backend field the id updates; when omitted
@@ -254,7 +244,6 @@ export function setWebhookConfig(patch = {}) {
       ...(Object.prototype.hasOwnProperty.call(patch, 'enabled') ? { enabled: patch.enabled === true } : {}),
       ...(patch.port ? { port: Number(patch.port) || 3333 } : {}),
       ...(patch.domain ? { domain: String(patch.domain).trim() } : {}),
-      ...(patch.ngrokDomain ? { ngrokDomain: String(patch.ngrokDomain).trim() } : {}),
     },
   }));
 }
@@ -267,7 +256,6 @@ export async function setWebhookConfigAsync(patch = {}) {
       ...(Object.prototype.hasOwnProperty.call(patch, 'enabled') ? { enabled: patch.enabled === true } : {}),
       ...(patch.port ? { port: Number(patch.port) || 3333 } : {}),
       ...(patch.domain ? { domain: String(patch.domain).trim() } : {}),
-      ...(patch.ngrokDomain ? { ngrokDomain: String(patch.ngrokDomain).trim() } : {}),
     },
   }));
 }
@@ -371,6 +359,11 @@ function scheduleToDisplay(s) {
     channel: s.channelId || undefined,
     model: s.model || undefined,
     cwd: s.cwd || undefined,
+    workflow: s.workflow || undefined,
+    attachments: s.attachments || undefined,
+    // Delivery mode: legacy channel-target rows (pre-delivery) behaved as
+    // relay+visible, which maps to 'both'.
+    delivery: s.delivery || (s.target === 'channel' ? 'both' : 'app'),
     enabled: s.enabled !== false,
     instructions: s.prompt,
     route: s.target === 'channel' ? `channel:${s.channelId}` : 'session',
@@ -396,6 +389,9 @@ export async function saveSchedule({
   channel,
   model,
   cwd,
+  workflow,
+  attachments,
+  delivery,
   enabled,
   instructions,
   overwrite = false,
@@ -404,6 +400,11 @@ export async function saveSchedule({
   const body = String(instructions || '').trim();
   if (!body) throw new Error('schedule instructions are required');
   if (channel && !model) throw new Error('model is required when channel is set');
+  // 'app' → session-only; 'channel'/'both' → the run result relays to the
+  // main channel (target 'channel', channelId resolved at fire time).
+  const mode = ['app', 'channel', 'both'].includes(String(delivery || '').trim())
+    ? String(delivery).trim()
+    : (channel ? 'both' : 'app');
   const hasTime = time != null && String(time).trim() !== '';
   const hasAt = at != null && String(at).trim() !== '';
   if (hasTime && hasAt) throw new Error('provide either `time` (recurring) or `at` (one-shot), not both');
@@ -419,10 +420,13 @@ export async function saveSchedule({
     whenCron,
     whenAt,
     timezone: timezone ? String(timezone).trim() : null,
-    target: channel ? 'channel' : 'session',
+    target: mode === 'app' ? 'session' : 'channel',
     channelId: channel ? String(channel).trim() : null,
     model: model ? String(model).trim() : null,
     cwd: cwd ? String(cwd).trim() : null,
+    workflow: workflow ? String(workflow).trim() : null,
+    attachments: normalizeAutomationAttachments(attachments),
+    delivery: mode,
     prompt: body,
     enabled: enabled !== false,
   });
@@ -454,6 +458,10 @@ async function listWebhooks() {
     parser: ep.parser || 'github',
     ...(ep.channelId ? { channel: ep.channelId } : {}),
     ...(ep.model ? { model: ep.model } : {}),
+    ...(ep.cwd ? { cwd: ep.cwd } : {}),
+    ...(ep.workflow ? { workflow: ep.workflow } : {}),
+    ...(ep.attachments ? { attachments: ep.attachments } : {}),
+    delivery: ep.delivery || 'app',
     enabled: ep.enabled,
     // The store never projects the plaintext secret through list paths; it
     // exposes a presence flag (secretSet) instead.
@@ -471,6 +479,10 @@ export async function saveWebhook({
   secret,
   channel,
   model,
+  cwd,
+  workflow,
+  attachments,
+  delivery,
   enabled,
   instructions,
   overwrite = false,
@@ -486,13 +498,25 @@ export async function saveWebhook({
   if (overwrite !== true && (await dbLoadEndpoint(id))) {
     throw new Error(`webhook "${id}" already exists`);
   }
-  const secretValue = String(secret || randomBytes(24).toString('hex')).trim();
+  // Secret semantics: an explicit value always wins; an EMPTY value on an
+  // overwrite PRESERVES the stored secret (editing instructions must not
+  // silently rotate the key the external service was configured with); only
+  // a brand-new endpoint mints a random secret.
+  const secretValue = String(secret || '').trim()
+    || (overwrite === true ? String((await dbReadEndpointSecret(id)) || '').trim() : '')
+    || randomBytes(24).toString('hex');
   const saved = await dbUpsertEndpoint({
     name: id,
     description: String(description || '').trim(),
     parser: nextParser,
     channelId: channel ? String(channel).trim() : null,
     model: model ? String(model).trim() : null,
+    cwd: cwd ? String(cwd).trim() : null,
+    workflow: workflow ? String(workflow).trim() : null,
+    attachments: normalizeAutomationAttachments(attachments),
+    delivery: ['app', 'channel', 'both'].includes(String(delivery || '').trim())
+      ? String(delivery).trim()
+      : 'app',
     secret: secretValue,
     instructions: body,
     enabled: enabled !== false,
@@ -503,6 +527,10 @@ export async function saveWebhook({
     parser: saved.parser,
     ...(saved.channelId ? { channel: saved.channelId } : {}),
     ...(saved.model ? { model: saved.model } : {}),
+    ...(saved.cwd ? { cwd: saved.cwd } : {}),
+    ...(saved.workflow ? { workflow: saved.workflow } : {}),
+    ...(saved.attachments ? { attachments: saved.attachments } : {}),
+    delivery: saved.delivery || 'app',
     ...(enabled === false ? { enabled: false } : {}),
     secret: secretValue,
     instructions: body,
@@ -522,11 +550,32 @@ export async function setWebhookEnabled(name, enabled) {
   return { name: id, enabled: enabled !== false };
 }
 
+// Explicit single-purpose secret read for the editor's copy affordance (the
+// list path only ever exposes a presence flag). Local surfaces only — the
+// desktop blocks this capability over the remote bridge.
+export async function getWebhookSecret(name) {
+  const id = assertName(name, 'webhook name');
+  return { name: id, secret: (await dbReadEndpointSecret(id)) || '' };
+}
+
+// Automation presence: any enabled schedule or webhook endpoint. Drives the
+// worker boot decision independently of the messaging channels — schedules
+// and webhooks run sessions, so they must not require Discord/Telegram
+// tokens or an explicit remote toggle.
+export async function hasActiveAutomation() {
+  try {
+    const [schedules, webhooks] = await Promise.all([listSchedules(), listWebhooks()]);
+    return schedules.some((entry) => entry?.enabled !== false && entry?.status !== 'done')
+      || webhooks.some((entry) => entry?.enabled !== false);
+  } catch {
+    return false;
+  }
+}
+
 export async function channelSetup(config = null) {
   const cfg = normalizeChannelsConfig(config || readSection('channels'));
   const discordToken = getDiscordToken();
   const discordProblem = diagnoseDiscordTokenValue(discordToken, cfg);
-  const webhookAuth = getWebhookAuthtoken();
   const telegramToken = getTelegramToken();
   return {
     backend: cfg.backend || 'discord',
@@ -546,9 +595,9 @@ export async function channelSetup(config = null) {
     },
     webhook: {
       ...(cfg.webhook || {}),
-      authenticated: Boolean(webhookAuth),
-      stored: hasStoredSecret(SECRET_ACCOUNTS.webhookAuth),
-      status: webhookAuth ? 'Set' : 'Off',
+      // Relay-tunnel public base (null until the channel worker first
+      // connects and mints its hook identity).
+      publicUrl: readHookPublicBase(),
     },
     channel: getChannel(cfg),
     schedules: await listSchedules(),
@@ -560,7 +609,7 @@ async function renderChannelStatus(config = null) {
   const setup = await channelSetup(config);
   const lines = [];
   lines.push(`discord  ${setup.discord.status}${setup.discord.problem ? ` (${setup.discord.problem})` : ''}`);
-  lines.push(`webhook  ${setup.webhook.enabled === false ? 'disabled' : 'enabled'} · auth ${setup.webhook.status} · port ${setup.webhook.port || 3333}`);
+  lines.push(`webhook  ${setup.webhook.enabled === false ? 'disabled' : 'enabled'} · port ${setup.webhook.port || 3333}${setup.webhook.publicUrl ? ` · ${setup.webhook.publicUrl}` : ''}`);
   lines.push(`channel  ${setup.channel.channelId || '(unset)'}`);
   lines.push('schedules');
   if (setup.schedules.length === 0) lines.push('  (none)');

package/src/standalone/channel-daemon-client.mjs

@@ -147,7 +147,11 @@ export async function attachToDaemon({
       token: serverToken,
       method: 'POST',
       path: '/client/register',
-      body: { leadPid, cwd },
+      // Initial attachment is transport-only. Mark it with the legacy
+      // non-stealing registration intent as well as relying on the current
+      // daemon contract, so a newly updated desktop cannot supersede a
+      // terminal still served by an older machine-global daemon.
+      body: { leadPid, cwd, reattach: true },
       timeoutMs: 3000,
     });
   } catch (err) {

package/src/standalone/channel-daemon-transport.mjs

@@ -15,6 +15,7 @@
 import http from 'node:http';
 import { randomUUID } from 'node:crypto';
 import { rmSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
 import { writeJsonAtomicSync } from '../runtime/shared/atomic-file.mjs';
 import { readBody, sendJson, sendError } from '../runtime/memory/lib/http-wire.mjs';
 
@@ -47,9 +48,12 @@ export function createChannelDaemonTransport({
   getStatus = () => ({}),
   dispatchBind = null,
   registrationReplayTtlMs = 60_000,
+  remoteStatePath = null,
 } = {}) {
   if (typeof handleCall !== 'function') throw new Error('handleCall is required');
 
+  const resolvedRemoteStatePath = remoteStatePath
+    || (discoveryPath ? join(dirname(discoveryPath), 'channel-remote-state.json') : null);
   // token -> { token, leadPid, cwd, sse, lastSeen, registeredAt }
   const clients = new Map();
   // leadPid of the last client to claim the bridge / repoint the transcript.
@@ -68,6 +72,8 @@ export function createChannelDaemonTransport({
   // (notifications/claude/channel) stay pointer-targeted, never broadcast.
   const REMOTE_STATE_METHOD = 'notifications/mixdog/remote';
   let stickyRemoteFrame = null;
+  let remoteAcquired = false;
+  let remoteStateSignature = '';
   // Idempotency cache: callId -> { promise }. A retried /call with the SAME
   // callId awaits/returns the ORIGINAL run's result, so a transport-failure
   // retry never double-runs a non-idempotent tool (e.g. reply). Short TTL.
@@ -86,6 +92,44 @@ export function createChannelDaemonTransport({
 
   function nowMs() { return Date.now(); }
 
+  function remoteSessionIdFromBinding(name, args) {
+    if (!POINTER_TOOLS.has(name) || !args || typeof args !== 'object') return null;
+    const explicit = String(args.sessionId || '').trim();
+    if (/^[A-Za-z0-9_-]+$/.test(explicit)) return explicit;
+    const transcriptPath = String(args.transcriptPath || '').trim();
+    if (!transcriptPath) return null;
+    const inferred = basename(transcriptPath).replace(/\.[^.]+$/, '');
+    return /^[A-Za-z0-9_-]+$/.test(inferred) ? inferred : null;
+  }
+
+  function publishRemoteOwnerState() {
+    if (!resolvedRemoteStatePath) return;
+    const owner = pointerToken ? clients.get(pointerToken) : null;
+    const sessionId = String(owner?.remoteSessionId || '');
+    const state = {
+      enabled: remoteAcquired === true && Boolean(owner) && Boolean(sessionId),
+      sessionId: remoteAcquired === true && owner && sessionId ? sessionId : null,
+      ownerLeadPid: owner?.leadPid ?? null,
+      cwd: owner?.cwd ?? null,
+      daemonPid: process.pid,
+      updatedAt: nowMs(),
+    };
+    const signature = JSON.stringify([
+      state.enabled,
+      state.sessionId,
+      state.ownerLeadPid,
+      state.cwd,
+      state.daemonPid,
+    ]);
+    if (signature === remoteStateSignature) return;
+    remoteStateSignature = signature;
+    try {
+      writeJsonAtomicSync(resolvedRemoteStatePath, state, { compact: true });
+    } catch (err) {
+      log(`remote owner state write failed: ${err?.message || err}`);
+    }
+  }
+
   function pruneDeadClients() {
     for (const [token, c] of clients) {
       // A client is dead when its lead pid is gone OR its SSE stream closed and
@@ -117,6 +161,7 @@ export function createChannelDaemonTransport({
     // during stop()/close (grace shutdown owns teardown) and when no live client
     // remains (grace shutdown path).
     if (wasPointer && !closed) failoverPointer(reason);
+    publishRemoteOwnerState();
     maybeArmGrace('client removed');
   }
 
@@ -187,6 +232,7 @@ export function createChannelDaemonTransport({
       if (!best || c.lastSeen > best.lastSeen) best = c;
     }
     if (!best) return; // no live clients — let grace shutdown run
+    remoteAcquired = true;
     movePointer(best.token, 'failover');
     // Persist the acquired badge as the sticky frame so a later attachSse (or a
     // reconnect that follows the pointer) can replay it — matters when the
@@ -296,11 +342,16 @@ export function createChannelDaemonTransport({
   // re-binding to itself — it never "lost").
   function movePointer(newToken, reason) {
     const oldToken = pointerToken;
-    if (oldToken === newToken) { pointerToken = newToken; return; }
+    if (oldToken === newToken) {
+      pointerToken = newToken;
+      publishRemoteOwnerState();
+      return;
+    }
     pointerToken = newToken;
     const oldClient = oldToken ? clients.get(oldToken) : null;
     const newClient = clients.get(newToken);
     log(`routing pointer -> token=${newToken} lead=${newClient?.leadPid ?? '?'} via ${reason}`);
+    publishRemoteOwnerState();
     if (!oldClient || oldClient === newClient) return;
     if (newClient && oldClient.leadPid === newClient.leadPid) return; // same TUI
     if (isPidAlive(oldClient.leadPid)) {
@@ -326,7 +377,9 @@ export function createChannelDaemonTransport({
         // a late attach that IS the pointer can replay it. Under last-wins the
         // owner is exactly the pointer client, so deliver ONLY there — a
         // broadcast would light the badge on displaced/non-owner TUIs.
+        remoteAcquired = true;
         stickyRemoteFrame = frame;
+        publishRemoteOwnerState();
         const target = resolveTarget();
         if (!target?.sse) { log('remote-state acquired not delivered (no live pointer SSE); sticky set'); return false; }
         try { target.sse.write(`data: ${frame}\n\n`); return true; }
@@ -336,7 +389,9 @@ export function createChannelDaemonTransport({
       // other transition CLEAR the sticky and broadcast to every live client —
       // whoever holds the badge must drop it; replaying it to a future attach
       // would wrongly stop a fresh remote client.
+      remoteAcquired = false;
       stickyRemoteFrame = null;
+      publishRemoteOwnerState();
       let delivered = false;
       for (const [, c] of liveClients()) {
         if (!c.sse) continue;
@@ -420,6 +475,7 @@ export function createChannelDaemonTransport({
       // A non-owner can hold a buffered superseded frame or stored bind intent.
       if (replaced.pending?.length) fresh.pending.push(...replaced.pending.splice(0));
       if (replaced.lastBind) fresh.lastBind = replaced.lastBind;
+      if (replaced.remoteSessionId) fresh.remoteSessionId = replaced.remoteSessionId;
       if (replacedWasPointer) pointerToken = token;
       removeClientRecord(replaced.token);
       log(`client reconnect replaced token=${replaced.token} -> ${token} lead=${pid}`);
@@ -434,13 +490,14 @@ export function createChannelDaemonTransport({
     // token, migrate its buffered pending frames + last bind intent, and remove
     // the old entry WITHOUT a failover or a self-'superseded'. A live-stream
     // pointer that happens to share the pid (e.g. co-located clients) is left
-    // alone — last-wins handles a genuine fresh register below.
+    // alone — a genuine fresh attach remains an observer until it binds.
     if (pointerToken && pointerToken !== token) {
       const old = clients.get(pointerToken);
       if (old && old.leadPid === pid && !old.sse) {
         const fresh = clients.get(token);
         if (old.pending?.length) fresh.pending.push(...old.pending.splice(0));
         if (old.lastBind) fresh.lastBind = old.lastBind;
+        if (old.remoteSessionId) fresh.remoteSessionId = old.remoteSessionId;
         removeClientRecord(pointerToken);
         pointerToken = token;
         log(`pointer follows reconnect -> token=${token} lead=${pid} (old entry dropped)`);
@@ -451,15 +508,16 @@ export function createChannelDaemonTransport({
         return rememberReplacement(token);
       }
     }
-    if (reattach) {
-      // SSE-reconnect re-register: a pruned client re-registers with a FRESH
-      // token but it is NOT a new terminal — it must never steal ownership.
-      // Only adopt the pointer when none exists (avoid a notify blackhole).
-      if (!pointerToken) pointerToken = token;
-    } else {
-      // Last-wins: the NEWEST registered TUI (fresh terminal) always steals the
-      // ownership seat, and the displaced owner is told it lost (superseded).
-      movePointer(token, 'register');
+    // Registration establishes transport connectivity only. Desktop engine
+    // prewarm, automation, and remote auto-start may all attach to an existing
+    // daemon without claiming its active terminal's relay seat. Only an
+    // explicit pointer tool (/remote claim or transcript bind) may move an
+    // occupied pointer and supersede its owner. Adopt a vacant pointer so the
+    // first client still receives daemon notifications without a blackhole.
+    if (!pointerToken) {
+      pointerToken = token;
+      publishRemoteOwnerState();
+      log(`routing pointer initialized -> token=${token} lead=${pid}`);
     }
     return rememberReplacement(token);
   }
@@ -563,11 +621,28 @@ export function createChannelDaemonTransport({
         }
         c.lastSeen = nowMs();
         const name = String(body.name || '');
+        const pointerCall = Boolean(c && POINTER_TOOLS.has(name));
+        const pointerOwner = pointerToken ? clients.get(pointerToken) : null;
+        const claimIfVacant = name === 'activate_channel_bridge'
+          && body.args?.active === true
+          && body.args?.claimIfVacant === true;
+        const claimBlocked = claimIfVacant
+          && pointerToken !== clientToken
+          && remoteAcquired === true
+          && Boolean(pointerOwner?.remoteSessionId);
+        const pointerMove = pointerCall && !claimBlocked;
+        const previousRemoteSessionId = c?.remoteSessionId || null;
+        const previousRemoteAcquired = remoteAcquired;
         // Bind-intent calls re-point routing at the caller BEFORE dispatch, so a
         // notify emitted synchronously during the call already targets it.
-        if (c && POINTER_TOOLS.has(name)) {
-          // Last-wins bind claim (/remote or boot). Steals the seat AND tells
-          // the displaced owner it lost (targeted superseded).
+        if (pointerMove) {
+          const bindingSessionId = remoteSessionIdFromBinding(name, body.args);
+          if (bindingSessionId) c.remoteSessionId = bindingSessionId;
+          if (name === 'activate_channel_bridge' && body.args?.active === false) {
+            remoteAcquired = false;
+          }
+          // Explicit bind claims are last-wins. Auto claims reach here only
+          // when no live bound remote owner occupies the pointer.
           movePointer(clientToken, name);
         }
         const callId = body.callId ? String(body.callId) : null;
@@ -577,11 +652,16 @@ export function createChannelDaemonTransport({
           // side-effect) instead of dispatching handleCall a second time.
           dispatch = callCache.get(callId).promise;
         } else {
-          dispatch = Promise.resolve().then(() => handleCall(name, body.args || {}, {
-            clientToken,
-            leadPid: c?.leadPid ?? null,
-            cwd: c?.cwd ?? null,
-          }));
+          dispatch = claimBlocked
+            ? Promise.resolve({
+              content: [{ type: 'text', text: 'channel bridge claim skipped: live remote owner' }],
+              claimSkipped: true,
+            })
+            : Promise.resolve().then(() => handleCall(name, body.args || {}, {
+              clientToken,
+              leadPid: c?.leadPid ?? null,
+              cwd: c?.cwd ?? null,
+            }));
           if (callId) {
             callCache.set(callId, { promise: dispatch, at: nowMs() });
             // Start the TTL only once the call SETTLES: an in-flight call can
@@ -598,9 +678,17 @@ export function createChannelDaemonTransport({
           const result = await dispatch;
           // Record the caller's last bind intent so a failover can rebind the
           // output forwarder to THIS client's transcript when it becomes owner.
-          if (c && POINTER_TOOLS.has(name)) c.lastBind = { name, args: body.args || {} };
+          if (pointerMove) {
+            c.lastBind = { name, args: body.args || {} };
+            publishRemoteOwnerState();
+          }
           sendJson(res, { result });
         } catch (err) {
+          if (pointerMove) {
+            c.remoteSessionId = previousRemoteSessionId;
+            remoteAcquired = previousRemoteAcquired;
+            publishRemoteOwnerState();
+          }
           sendJson(res, { error: err?.message || String(err) }, 200);
         }
         return;
@@ -640,6 +728,7 @@ export function createChannelDaemonTransport({
         boundPort = server.address().port;
         server.on('error', (err) => log(`server error: ${err?.message || err}`));
         writeDiscovery();
+        publishRemoteOwnerState();
         log(`daemon transport listening on 127.0.0.1:${boundPort} pid=${process.pid}`);
         resolve({ port: boundPort, token: serverToken });
       });
@@ -651,6 +740,9 @@ export function createChannelDaemonTransport({
     cancelGrace();
     if (sweepTimer) { try { clearInterval(sweepTimer); } catch {} sweepTimer = null; }
     for (const [token] of clients) dropClient(token, 'transport stop');
+    remoteAcquired = false;
+    pointerToken = null;
+    publishRemoteOwnerState();
     clearRegistrationReplays();
     if (discoveryPath) { try { rmSync(discoveryPath, { force: true }); } catch {} }
     if (server) {

package/src/standalone/channel-daemon.mjs

@@ -187,10 +187,12 @@ async function main() {
   }
   log(`ready port=${port} pid=${process.pid} in ${(performance.now() - startedAt).toFixed(0)}ms`);
 
-  // Boot the owned channels runtime (Discord connect, transcript bind) AFTER
-  // the ready signal. Fire-and-forget — failure is non-fatal (the daemon still
-  // serves tool calls and can reconnect later) and must not delay ready.
-  void Promise.resolve().then(() => channels.start())
+  // Boot messaging only for an explicit/auto remote request. Automation may
+  // spawn the shared daemon with no remote intent; keep schedules/webhooks live
+  // without connecting the channel backend until a Remote claim arrives.
+  const remoteIntent = String(process.env.MIXDOG_REMOTE_INTENT || '');
+  const messaging = remoteIntent === 'explicit' || remoteIntent === 'auto';
+  void Promise.resolve().then(() => channels.start({ messaging }))
     .catch((e) => log(`channels.start failed (non-fatal): ${e?.message || e}`));
 
   // Fold memory startup in: eagerly ensure the memory runtime is up under the

package/src/tui/App.jsx

@@ -1881,21 +1881,6 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false })
           resumeAfterChannelPrompt(channelPrompt);
           return true;
         }
-        if (channelPrompt.kind === 'webhook-token') {
-          if (!commandText) return false;
-          store.saveWebhookAuthtoken(commandText);
-          resumeAfterChannelPrompt(channelPrompt);
-          return true;
-        }
-        if (channelPrompt.kind === 'webhook-domain') {
-          if (!commandText) return false;
-          Promise.resolve(store.setWebhookConfig?.({ ngrokDomain: commandText }))
-            .then(() => resumeAfterChannelPrompt(channelPrompt))
-            .catch((e) => {
-              store.pushNotice(`webhook config update failed: ${e?.message || e}`, 'error');
-            });
-          return true;
-        }
         const parts = commandText.split('|').map((part) => part.trim());
         if (channelPrompt.kind === 'channel-add') {
           // Single-channel: the UI asks only for the channel id. Legacy
@@ -1913,38 +1898,8 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false })
             });
           return true;
         }
-        if (channelPrompt.kind === 'schedule-add') {
-          const [name, time, instructions, channel, model] = parts;
-          // saveSchedule is async (PG-backed). Only close the prompt / open the
-          // list on success; surface a failure notice and keep the prompt open
-          // so the input is not lost and the user can retry.
-          Promise.resolve(store.saveSchedule({ name, time, instructions, channel, model }))
-            .then(() => {
-              setChannelPrompt(null);
-              void openChannelSetupPicker('schedules');
-            })
-            .catch((e) => {
-              store.pushNotice(`schedule save failed: ${e?.message || e}`, 'error');
-            });
-          return true;
-        }
-        if (channelPrompt.kind === 'webhook-add') {
-          const [name, instructions, channel, model, parser] = parts;
-          // saveWebhook is async (PG-backed). Only close the prompt / open the
-          // list on success; surface a failure notice and keep the prompt open.
-          Promise.resolve(store.saveWebhook({ name, instructions, channel, model, parser }))
-            .then((result) => {
-              if (result?.secret) {
-                store.pushNotice(`webhook secret for ${result.name}: ${result.secret}`, 'info');
-              }
-              setChannelPrompt(null);
-              void openChannelSetupPicker('webhooks');
-            })
-            .catch((e) => {
-              store.pushNotice(`webhook save failed: ${e?.message || e}`, 'error');
-            });
-          return true;
-        }
+        // schedule-add / webhook-add prompt kinds retired: schedules and
+        // webhooks are managed in the desktop app (user decision).
       } catch (e) {
         store.pushNotice(`channels update failed: ${e?.message || e}`, 'error');
         return false;