talon-agent 5.25.1 → 5.26.0

package/src/backend/codex/state.ts

@@ -48,6 +48,15 @@ export interface CodexState {
    * when synthesising entries for ids absent from the curated table.
    */
   discoveredModelMetadata: Map<string, DiscoveredModelMetadata>;
+  /**
+   * The Codex CLI's own default model for the signed-in ChatGPT account:
+   * the listed, API-callable entry of `~/.codex/models_cache.json` with
+   * the lowest `priority` (the CLI sorts its picker the same way and
+   * treats the first entry as the default). `null` until the cache has
+   * been read, or when it lists nothing usable. Consumed by
+   * `getCodexChatGptDefaultModel()`.
+   */
+  discoveredDefaultModel: string | null;
   /**
    * In-flight discovery promise. Non-null while a fetch is pending;
    * cleared once the fetch settles (success or failure). Callers that
@@ -70,6 +79,7 @@ const state: CodexState = {
   frontendName: "telegram",
   discoveredModels: new Set<string>(),
   discoveredModelMetadata: new Map<string, DiscoveredModelMetadata>(),
+  discoveredDefaultModel: null,
   discoveryPromise: null,
   discoveryAt: null,
 };
@@ -87,6 +97,7 @@ export function resetState(): void {
   state.frontendName = "telegram";
   state.discoveredModels.clear();
   state.discoveredModelMetadata.clear();
+  state.discoveredDefaultModel = null;
   state.discoveryPromise = null;
   state.discoveryAt = null;
 }

package/src/core/agents/abort-reason.ts

@@ -0,0 +1,46 @@
+/**
+ * Why a run's AbortSignal fired — so logs and results can say "killed" for
+ * a deliberate kill_agent instead of blaming a timeout that never happened.
+ *
+ * Abort sites pass a typed reason (`controller.abort(reason)`); consumers
+ * read it back with `abortKind(signal)`. A bare `abort()` carries the
+ * runtime's default AbortError reason and reads as a plain "aborted".
+ */
+
+/** Reason passed when an operator/agent deliberately kills a run. */
+export class RunKilledError extends Error {
+  constructor(message = "run killed on request") {
+    super(message);
+    this.name = "RunKilledError";
+  }
+}
+
+export type AbortKind = "killed" | "timeout" | "aborted";
+
+/** Classify an abort reason (typically `signal.reason`). */
+export function abortKindOf(reason: unknown): AbortKind {
+  if (reason instanceof RunKilledError) return "killed";
+  const r = reason as { name?: unknown; message?: unknown } | null;
+  const name = typeof r?.name === "string" ? r.name : "";
+  const message = typeof r?.message === "string" ? r.message : "";
+  if (name === "RunKilledError") return "killed";
+  if (/timeout/i.test(name) || /timed out/i.test(message)) return "timeout";
+  return "aborted";
+}
+
+/** Classify why `signal` fired ("aborted" when it has not, or gave no reason). */
+export function abortKind(signal: AbortSignal): AbortKind {
+  return signal.aborted ? abortKindOf(signal.reason) : "aborted";
+}
+
+/** One-line run-log sentence for an aborted run. */
+export function abortLogLine(signal: AbortSignal): string {
+  switch (abortKind(signal)) {
+    case "killed":
+      return "Run killed on request.";
+    case "timeout":
+      return "Run aborted by timeout.";
+    default:
+      return "Run aborted.";
+  }
+}

package/src/core/agents/registry.ts

@@ -26,6 +26,7 @@ import type { AgentSettledEvent, AgentSpawnedEvent } from "../bus/events.js";
 import type { ReasoningEffortLevel } from "../types.js";
 import { bus } from "../bus/index.js";
 import { logWarn } from "../../util/log.js";
+import { RunKilledError } from "./abort-reason.js";
 
 /** Settled agents kept for status queries after they leave the live map. */
 const DEFAULT_HISTORY_LIMIT = 100;
@@ -224,7 +225,7 @@ export class AgentRegistry {
     // right after start() and settles the run as "killed".
     if (entry.killRequested) {
       try {
-        binding.abort.abort();
+        binding.abort.abort(new RunKilledError(`agent ${id} killed`));
       } catch (err) {
         logWarn(
           "agents",
@@ -312,7 +313,7 @@ export class AgentRegistry {
     if (!entry.killRequested) {
       entry.killRequested = true;
       try {
-        entry.abort?.abort();
+        entry.abort?.abort(new RunKilledError(`agent ${id} killed`));
       } catch (err) {
         // An abort hook must not be able to break the kill path — but a
         // throwing one may leave the agent running, so say so.

package/src/core/background/dream/index.ts

@@ -320,11 +320,11 @@ If commands fail, log the error and continue — this stage is optional.`
   const timeoutPromise = new Promise<never>((_, reject) => {
     const t = setTimeout(() => {
       try {
-        abortController.abort();
+        abortController.abort(new Error("Dream agent timed out"));
       } catch {
         /* ignore */
       }
-      reject(new Error("Dream agent timed out"));
+      reject(abortController.signal.reason as Error);
     }, DREAM_TIMEOUT_MS);
     t.unref(); // Don't prevent Node.js from exiting cleanly during shutdown
     timeoutHandle = t;

package/src/core/background/heartbeat/agent.ts

@@ -233,7 +233,7 @@ async function runOneShotWithTimeout(
     const t = setTimeout(() => {
       timeoutFired = true;
       try {
-        abortController.abort();
+        abortController.abort(new HeartbeatTimeoutError());
       } catch {
         /* ignore */
       }

package/src/core/background/isolated-agent.ts

@@ -94,7 +94,7 @@ export async function runIsolatedAgent(
     timer = setTimeout(() => {
       timeoutError = new IsolatedAgentTimeoutError(timeoutMs);
       try {
-        params.abortController.abort();
+        params.abortController.abort(timeoutError);
       } catch {
         /* ignore */
       }

package/src/core/backup/index.ts

@@ -49,6 +49,7 @@ export {
   formatBytes,
   formatRelative,
   formatSnapshotList,
+  type BackupStatus,
 } from "./status.js";
 
 export type { SnapshotSummary } from "./types.js";

package/src/core/backup/status.ts

@@ -16,7 +16,8 @@ import {
   type BackupTarget,
 } from "./targets.js";
 import { backupSettings, schedulerStatus } from "./scheduler.js";
-import type { SnapshotSummary } from "./types.js";
+import { PASSPHRASE_ENV } from "./passphrase.js";
+import type { BackupSettings, SnapshotSummary } from "./types.js";
 
 type TargetStatus = {
   id: string;
@@ -38,8 +39,35 @@ export type BackupStatus = {
   };
   targets: TargetStatus[];
   snapshots: SnapshotSummary[];
+  /** Retention and encryption, when the subsystem is initialised. */
+  policy?: BackupPolicy;
 };
 
+/** The settings a status panel renders alongside the numbers. */
+type BackupPolicy = {
+  keepLocal: number;
+  keepRemote: number;
+  /**
+   * Snapshots are written encrypted: `backup.encryption` is configured or
+   * the passphrase comes from the environment (see passphrase.ts). Off
+   * means they stay on this machine — upload refuses plaintext.
+   */
+  encrypted: boolean;
+};
+
+function describePolicy(
+  settings: BackupSettings | null,
+  env: NodeJS.ProcessEnv = process.env,
+): BackupPolicy | undefined {
+  if (!settings) return undefined;
+  return {
+    keepLocal: settings.keepLocal,
+    keepRemote: settings.keepRemote,
+    encrypted:
+      settings.encryption !== undefined || Boolean(env[PASSPHRASE_ENV]?.trim()),
+  };
+}
+
 export function formatBytes(bytes: number): string {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -119,6 +147,7 @@ export async function collectBackupStatus(
     },
     targets,
     snapshots,
+    policy: describePolicy(settings),
   };
 }
 

package/src/core/config/index.ts

@@ -779,6 +779,14 @@ const configSchema = z.object({
    * Codex.
    */
   codexApiKey: z.string().optional(),
+  /**
+   * Model a ChatGPT-OAuth Codex session falls back to (pre-emptive swaps,
+   * mismatch retries, the default when no model is configured). Unset =
+   * the Codex CLI's own default for the signed-in account (first listed
+   * model in `~/.codex/models_cache.json`), else a bundled default. The
+   * TALON_CODEX_CHATGPT_MODEL env var overrides this.
+   */
+  codexChatGptDefaultModel: z.string().min(1).optional(),
   /**
    * OpenAI API key — used by the OpenAI Agents backend and accepted by
    * Codex only as a last-resort legacy fallback when no Codex-specific

package/src/core/engine/gateway.ts

@@ -275,6 +275,11 @@ export class Gateway {
     return this.port;
   }
 
+  /** True while the tool bridge's HTTP server is bound and accepting. */
+  isListening(): boolean {
+    return this.server?.listening === true;
+  }
+
   getActiveChats(): number {
     return this.loom.activeContextCount();
   }

package/src/core/mesh/credentials/store.ts

@@ -69,6 +69,12 @@ export type BindResult =
 
 const PERSIST_ALERT = "mesh.credentials.persist";
 
+/** Operator-minted, bind-on-first-use origins allowed to re-pair a device. */
+const REPAIR_ORIGINS: ReadonlySet<CredentialOrigin> = new Set([
+  "pair",
+  "install",
+]);
+
 export class DeviceCredentialStore {
   private records = new Map<string, DeviceCredentialRecord>();
   private loading: Promise<void> | null = null;
@@ -146,9 +152,21 @@ export class DeviceCredentialStore {
   }
 
   /**
-   * Bind an unbound credential to the device id it just named. Refused when
-   * another live credential already holds that id — a pairing link can add
-   * a device, never take one over.
+   * Bind an unbound credential to the device id it just named.
+   *
+   * When that id already holds live credentials, an operator-minted pairing
+   * or installer credential takes the device over (a re-pair): the old
+   * credentials are revoked and their live sessions dropped. This is the
+   * "the Mac's app was reset but kept its device id" case, which otherwise
+   * needs a `talon mesh revoke` before the new link can work.
+   *
+   * Trust: every unbound credential is operator-minted (`pair`/`install`,
+   * see MeshService → BridgeLinks) and binds exactly once — after this call
+   * it is bound, so a replayed link cannot bind again. Takeover is further
+   * limited to devices whose live credentials carry no scope the new one
+   * lacks: a device-only installer link can re-provision a node, but can
+   * never evict (and then impersonate) a companion holding client/operator.
+   * A credential of any other origin keeps the old rule — refused.
    */
   bind(credentialId: string, deviceId: string): BindResult {
     const record = this.records.get(credentialId);
@@ -164,19 +182,52 @@ export class DeviceCredentialStore {
     if (!id || id.length > MAX_DEVICE_ID_CHARS) {
       return { ok: false, error: "Invalid device id" };
     }
-    if (this.activeRecordsFor(id).length > 0) {
-      return {
-        ok: false,
-        error: `Device ${id} already has a credential — revoke it first (talon mesh revoke ${id})`,
-      };
+    const existing = this.activeRecordsFor(id);
+    if (existing.length > 0) {
+      const refusal = this.takeoverRefusal(record, id, existing);
+      if (refusal) return { ok: false, error: refusal };
     }
     record.deviceId = id;
     delete record.expiresAt;
     log("mesh", `Credential ${record.id} bound to device ${id}`);
-    this.persistSoon();
+    if (existing.length > 0) {
+      logWarn(
+        "mesh",
+        `Credential ${record.id} (${record.origin}) re-paired device ${id}; revoking ${existing.map((r) => r.id).join(", ")}`,
+      );
+      // Mark revoked synchronously (authenticate must reject them from this
+      // instant); revokeRecords drops their sessions and persists.
+      void this.revokeRecords(existing, `re-paired by ${record.id}`).catch(
+        (err: unknown) =>
+          logWarn("mesh", `Could not persist re-pair revocation: ${err}`),
+      );
+    } else {
+      this.persistSoon();
+    }
     return { ok: true, credential: publicView(record) };
   }
 
+  /** Why `record` may not take over `deviceId` from `existing`, if it may not. */
+  private takeoverRefusal(
+    record: DeviceCredentialRecord,
+    deviceId: string,
+    existing: readonly DeviceCredentialRecord[],
+  ): string | null {
+    const revokeHint = `revoke it first (talon mesh revoke ${deviceId})`;
+    if (!REPAIR_ORIGINS.has(record.origin)) {
+      return `Device ${deviceId} already has a credential — ${revokeHint}`;
+    }
+    const held = new Set(record.scopes);
+    const wider = existing.flatMap((r) => r.scopes).filter((s) => !held.has(s));
+    if (wider.length > 0) {
+      return (
+        `Device ${deviceId} already has a credential with scopes this link does not carry ` +
+        `(${[...new Set(wider)].join(", ")}) — ${revokeHint}`
+      );
+    }
+    return null;
+  }
+
   /** True when the operator asked for this credential to be replaced. */
   rotationDue(credentialId: string): boolean {
     const record = this.records.get(credentialId);

package/src/core/tools/bridge.ts

@@ -11,6 +11,8 @@
 import { Agent, fetch as undiciFetch } from "undici";
 import { isBunRuntime } from "../../util/runtime.js";
 import { gatewayAuthHeaders } from "../engine/gateway-auth.js";
+import { logWarn } from "../../util/log.js";
+import { TalonError } from "../errors.js";
 import type { BridgeFunction } from "./types.js";
 
 /** Default wall-clock budget for a bridge action. */
@@ -64,6 +66,26 @@ function dispatcher(): Agent {
 /** Built-in fetch's default dispatcher fails headers slower than this. */
 const BUILTIN_FETCH_HEADERS_CEILING_MS = 300_000;
 
+/** Best-effort one-line description of an abort's reason / error cause. */
+function describeAbort(err: Error, signal: AbortSignal): string {
+  const parts: string[] = [];
+  if (err.message) parts.push(err.message);
+  const cause = (err as { cause?: unknown }).cause;
+  if (cause instanceof Error && cause.message)
+    parts.push(`cause: ${cause.name}: ${cause.message}`);
+  else if (cause !== undefined && cause !== null)
+    parts.push(`cause: ${String(cause)}`);
+  if (signal.aborted && signal.reason !== undefined) {
+    const r = signal.reason as { name?: string; message?: string };
+    const reason =
+      r instanceof Error || (r && typeof r === "object" && "name" in r)
+        ? `${r.name}: ${r.message ?? ""}`
+        : String(signal.reason);
+    if (!parts.some((p) => p.includes(reason))) parts.push(`reason: ${reason}`);
+  }
+  return parts.join("; ") || err.name || "unknown abort";
+}
+
 /**
  * Create a bridge caller bound to a default URL and chat.
  *
@@ -93,13 +115,15 @@ export function createBridge(
         : null;
     const effectiveChatId = explicitChatId ?? chatId;
     const timeoutMs = LONG_ACTION_TIMEOUTS_MS[action] ?? DEFAULT_TIMEOUT_MS;
+    const signal = AbortSignal.timeout(timeoutMs);
+    const startedAt = Date.now();
     const init = {
       method: "POST",
       headers: { "Content-Type": "application/json", ...gatewayAuthHeaders() },
       // chat_id stays in body when set — gateway uses its presence as the
       // "explicit routing" signal. _chatId is the routing key either way.
       body: JSON.stringify({ action, ...params, _chatId: effectiveChatId }),
-      signal: AbortSignal.timeout(timeoutMs),
+      signal,
     };
     // Minimal common surface of DOM Response and undici's Response.
     let resp: {
@@ -123,11 +147,41 @@ export function createBridge(
           : await fetch(`${bridgeUrl}/action`, init);
     } catch (err) {
       const cause = err as Error & { name?: string };
+      const elapsedMs = Date.now() - startedAt;
       if (cause.name === "TimeoutError" || cause.name === "AbortError") {
-        throw new Error(
-          `"${action}" did not complete within ${Math.round(timeoutMs / 1000)}s. ` +
+        // Only call it a timeout when the budget actually ran out: the
+        // deadline signal fired (a TimeoutError, thrown or as the signal's
+        // reason) or the full budget elapsed. Anything earlier — a dropped socket, a daemon
+        // restart, a cancelled request — is an abort with its own cause,
+        // and mislabelling it as "did not complete within 3600s" after
+        // 780s sends the diagnosis in the wrong direction.
+        const reasonName = (signal.reason as { name?: string } | undefined)
+          ?.name;
+        const timedOut =
+          cause.name === "TimeoutError" ||
+          (signal.aborted && reasonName === "TimeoutError") ||
+          elapsedMs >= timeoutMs;
+        const detail = describeAbort(cause, signal);
+        logWarn(
+          "bridge",
+          `tool bridge "${action}" ${timedOut ? "timed out" : "aborted"} after ${elapsedMs}ms (budget ${timeoutMs}ms): ${detail}`,
+        );
+        if (timedOut) {
+          throw new Error(
+            `"${action}" did not complete within ${Math.round(timeoutMs / 1000)}s. ` +
+              `The operation may still be running on the daemon — check its ` +
+              `outcome (e.g. list the target directory) before retrying.`,
+          );
+        }
+        // Classified as a non-retryable network fault: the transport
+        // dropped mid-call, but the daemon may already have acted, so a
+        // blind retry could run the action twice.
+        throw new TalonError(
+          `"${action}" was aborted after ${Math.round(elapsedMs / 1000)}s ` +
+            `(${elapsedMs}ms; before its ${Math.round(timeoutMs / 1000)}s budget): ${detail}. ` +
             `The operation may still be running on the daemon — check its ` +
-            `outcome (e.g. list the target directory) before retrying.`,
+            `outcome before retrying.`,
+          { reason: "network", retryable: false, cause },
         );
       }
       throw new Error(

package/src/frontend/discord/callbacks/components/effort.ts

@@ -30,15 +30,15 @@ async function selectEffort(
     backendId: beId,
     config,
   });
-  if (reasoning.levels.length === 0) {
+  // Adaptive needs no model levels — reachable even when the model has none.
+  if (level === "adaptive") setChatEffort(chatId, undefined);
+  else if (reasoning.levels.length === 0) {
     await interaction.update({
       content: "No valid reasoning levels found for this model.",
       components: [],
     });
     return;
-  }
-  if (level === "adaptive") setChatEffort(chatId, undefined);
-  else if (supportsReasoningLevel(level, reasoning.levels))
+  } else if (supportsReasoningLevel(level, reasoning.levels))
     setChatEffort(chatId, level as EffortLevel);
   else {
     await interaction.update({

package/src/frontend/discord/callbacks/components/index.ts

@@ -18,6 +18,8 @@
  *   model:nav:*                 (pager)
  *   model:backend-select        (select menu)
  *   metrics:today | metrics:all
+ *   backup:panel|now|guide|list:<p>|pin:<p>:<id>|unpin:<p>:<id>|ask:<p>:<id>
+ *                               (the /backup panel, admin only)
  *   backup:restore:<id> | backup:cancel  (restore confirmation, admin only)
  *   ai:<id>                     (AI-generated buttons — forwarded to agent)
  */

package/src/frontend/discord/commands/backup-panel.ts

@@ -0,0 +1,219 @@
+/**
+ * The /backup panel on Discord — the same views and custom-id grammar as
+ * Telegram (frontend/presentation/backup-panel.ts), spelled in Discord
+ * markdown and mapped onto button rows.
+ *
+ * Discord allows five action rows per message, so snapshot pages hold
+ * three snapshots (three rows, navigation, Back). The staged restore
+ * (`backup:restore:<id>`) and the confirmation's Cancel stay in
+ * backup.ts; this module owns every other `backup:*` button, and every
+ * one of them re-checks the admin before it runs (see
+ * `handleBackupComponent`).
+ */
+
+import {
+  ActionRowBuilder,
+  ButtonBuilder,
+  ButtonStyle,
+  MessageFlags,
+  type ChatInputCommandInteraction,
+} from "discord.js";
+import {
+  collectBackupStatus,
+  listSnapshots,
+  readManifest,
+  runBackup,
+  setSnapshotPinned,
+} from "../../../core/backup/index.js";
+import { logError } from "../../../util/log.js";
+import {
+  GUIDE_BUTTONS,
+  PANEL_BUTTONS,
+  backupPanelView,
+  renderRestoreGuide,
+  restoreConfirmView,
+  snapshotPageView,
+  type BackupAction,
+  type PanelButton,
+  type PanelView,
+} from "../../presentation/backup-panel.js";
+import { DISCORD_REPORTS } from "../render.js";
+import type { ComponentInteraction } from "../callbacks/components/types.js";
+
+const DISCORD_PAGE_SIZE = 3;
+
+function buttonRows(
+  rows: readonly PanelButton[][],
+): ActionRowBuilder<ButtonBuilder>[] {
+  return rows.map((row) =>
+    new ActionRowBuilder<ButtonBuilder>().addComponents(
+      row.map((button) =>
+        new ButtonBuilder()
+          .setCustomId(button.data)
+          .setLabel(button.label)
+          .setStyle(
+            button.data.startsWith("backup:restore:")
+              ? ButtonStyle.Danger
+              : ButtonStyle.Secondary,
+          ),
+      ),
+    ),
+  );
+}
+
+function payload(view: PanelView) {
+  return {
+    content: view.text,
+    components: buttonRows(view.buttons).map((row) => row.toJSON()),
+    allowedMentions: { parse: [] as never[] },
+  };
+}
+
+/**
+ * Run one snapshot; the outcome as one markdown line. Never throws. Shared
+ * by `/backup now|checkpoint` and the panel's 📸 button.
+ */
+export async function runSnapshotLine(label?: string): Promise<string> {
+  try {
+    const manifest = await runBackup({
+      kind: label ? "checkpoint" : "backup",
+      label,
+      pinned: Boolean(label),
+      trigger: "command",
+    });
+    return (
+      `✅ \`${manifest.id}\` — ${manifest.parts.length} part(s), ` +
+      `${(manifest.sizeBytes / 1024 / 1024).toFixed(1)} MB` +
+      (label ? " (pinned)" : "")
+    );
+  } catch (err) {
+    logError("backup", "/backup now failed", err);
+    return `⚠️ Backup failed: ${err instanceof Error ? err.message : String(err)}`;
+  }
+}
+
+async function statusView(notice?: string): Promise<PanelView> {
+  return backupPanelView(
+    DISCORD_REPORTS,
+    await collectBackupStatus(),
+    Date.now(),
+    notice,
+  );
+}
+
+async function pageView(page: number): Promise<PanelView> {
+  return snapshotPageView(
+    DISCORD_REPORTS,
+    await listSnapshots(),
+    page,
+    Date.now(),
+    DISCORD_PAGE_SIZE,
+  );
+}
+
+/** Bare `/backup`: the panel, ephemeral, with its buttons. */
+export async function replyWithPanel(
+  i: ChatInputCommandInteraction,
+): Promise<void> {
+  await i.reply({
+    ...payload(await statusView()),
+    flags: MessageFlags.Ephemeral,
+  });
+}
+
+/** One panel snapshot at a time: a double tap must not take two. */
+let panelSnapshotRunning = false;
+
+/** Tests only. */
+export function _resetDiscordBackupPanel(): void {
+  panelSnapshotRunning = false;
+}
+
+async function backUpNow(interaction: ComponentInteraction): Promise<void> {
+  if (panelSnapshotRunning) {
+    await interaction.reply({
+      content: "A snapshot is already running.",
+      flags: MessageFlags.Ephemeral,
+    });
+    return;
+  }
+  panelSnapshotRunning = true;
+  try {
+    await interaction.update({
+      content:
+        "📸 **Taking a snapshot…**\nBuilding it, then pruning and uploading to any " +
+        "targets. This can take a few minutes — this message updates when it is done.",
+      components: [],
+    });
+    const line = await runSnapshotLine();
+    const view = await statusView(line).catch((err: unknown) => {
+      logError("backup", "Backup panel status read failed", err);
+      return { text: line, buttons: PANEL_BUTTONS };
+    });
+    await interaction.editReply(payload(view));
+  } finally {
+    panelSnapshotRunning = false;
+  }
+}
+
+async function viewFor(
+  action: Exclude<BackupAction, { kind: "now" | "restore" | "cancel" }>,
+): Promise<PanelView | null> {
+  switch (action.kind) {
+    case "panel":
+      return statusView();
+    case "list":
+      return pageView(action.page);
+    case "guide":
+      return {
+        text: renderRestoreGuide(DISCORD_REPORTS),
+        buttons: GUIDE_BUTTONS,
+      };
+    case "pin":
+    case "unpin":
+      await setSnapshotPinned(action.id, action.kind === "pin");
+      return pageView(action.page);
+    case "ask": {
+      // The confirmation only — the restore is its own, second tap.
+      const manifest = await readManifest(action.id);
+      return manifest
+        ? restoreConfirmView(DISCORD_REPORTS, manifest, action.page)
+        : null;
+    }
+  }
+}
+
+/**
+ * Every panel button except the staged restore and Cancel. The caller has
+ * already checked the admin.
+ */
+export async function handleBackupPanelAction(
+  interaction: ComponentInteraction,
+  action: Exclude<BackupAction, { kind: "restore" | "cancel" }>,
+): Promise<void> {
+  try {
+    if (action.kind === "now") {
+      await backUpNow(interaction);
+      return;
+    }
+    const view = await viewFor(action);
+    if (!view) {
+      await interaction.reply({
+        content: "That snapshot has no copy on this machine.",
+        flags: MessageFlags.Ephemeral,
+      });
+      return;
+    }
+    await interaction.update(payload(view));
+  } catch (err) {
+    logError("backup", `Backup panel action ${action.kind} failed`, err);
+    if (!interaction.replied && !interaction.deferred) {
+      await interaction
+        .reply({
+          content: "⚠️ That did not work — see the log.",
+          flags: MessageFlags.Ephemeral,
+        })
+        .catch(() => {});
+    }
+  }
+}