talon-agent 5.25.1 → 5.26.1

package/src/frontend/presentation/text-commands.ts

@@ -0,0 +1,243 @@
+/**
+ * Markdown replies for the text-only command layers — `/model`, `/effort`,
+ * `/settings`, `/status`.
+ *
+ * WhatsApp and the native bridge have no inline keyboards, so where
+ * Telegram and Discord open a picker they print a listing and take a typed
+ * argument instead: `/model` prints a numbered catalog, `/model 3` (or
+ * `/model <id>`, `/model <backend>`) picks from it. The state changes come
+ * from model-commands.ts and session-status.ts; this module renders them
+ * as Markdown and routes the typed argument, so the two frontends share
+ * one wording and one parser. Each frontend translates the Markdown into
+ * its own dialect on the way out.
+ */
+
+import { getChatSettings } from "../../storage/chat-settings.js";
+import { isPulseEnabled } from "../../core/background/pulse/pulse.js";
+import {
+  DEFAULT_PULSE_INTERVAL_MS,
+  formatBytes,
+  formatDuration,
+  formatModelLabel,
+  formatTokenCount,
+  formatUsd,
+} from "./format.js";
+import {
+  collectSessionStatus,
+  type SessionStatusData,
+} from "./session-status.js";
+import { formatCacheTempLine, formatDaemonLine } from "./status-context.js";
+import {
+  describeChatEffort,
+  describeChatModels,
+  matchBackendArg,
+  resetChatBackend,
+  resetChatModel,
+  resolveChatBackendPair,
+  selectChatModel,
+  setChatEffortLevel,
+  switchChatBackend,
+  type ModelCommandDeps,
+  type ModelOverview,
+} from "./model-commands.js";
+
+/** How many catalog entries `/model` prints before pointing at `/model <id>`. */
+const MAX_LISTED_MODELS = 40;
+
+// ── Renderers ───────────────────────────────────────────────────────────────
+
+function renderModelOverview(view: ModelOverview): string {
+  const lines: string[] = [];
+  lines.push(
+    view.activeModel
+      ? `**Model:** \`${view.activeModel}\`${
+          view.activeDisplay && view.activeDisplay !== view.activeModel
+            ? ` (${view.activeDisplay})`
+            : ""
+        }${view.hasModelOverride ? " — chat override" : ""}`
+      : "**Model:** none selected — messages will be refused until you pick one",
+  );
+  lines.push(
+    `**Backend:** ${view.backendLabel} (\`${view.backendId}\`)${view.hasBackendOverride ? " — chat override" : ""}`,
+  );
+  if (view.backends.length > 1) {
+    lines.push(
+      `Backends: ${view.backends.map((b) => `\`${b.id}\``).join(", ")} — \`/model <backend>\` switches (session restarts).`,
+    );
+  }
+  if (view.choices.length === 0) {
+    lines.push(
+      "",
+      "This backend has no browsable catalog; `/model <id>` sets one directly.",
+    );
+  } else {
+    lines.push("", `**Models** (${view.choices.length}):`);
+    for (const c of view.choices.slice(0, MAX_LISTED_MODELS)) {
+      const marker = c.id === view.activeModel ? " ✓" : "";
+      const free = c.free ? " · free" : "";
+      lines.push(`${c.index}. ${c.displayName} — \`${c.id}\`${free}${marker}`);
+    }
+    if (view.choices.length > MAX_LISTED_MODELS) {
+      lines.push(
+        `… ${view.choices.length - MAX_LISTED_MODELS} more — \`/model <id>\` picks any of them.`,
+      );
+    }
+  }
+  lines.push(
+    "",
+    "`/model <number>` or `/model <id>` picks; `/model default` clears the chat's pick" +
+      (view.hasBackendOverride
+        ? "; `/model backend default` reverts the backend."
+        : "."),
+  );
+  return lines.join("\n");
+}
+
+function renderSettings(
+  view: ModelOverview,
+  effort: { current: string; levels: string[] },
+  pulseOn: boolean,
+  pulseIntervalMs: number | undefined,
+  freeOnly: boolean,
+): string {
+  const lines = [
+    "**Settings**",
+    `Model: \`${view.activeModel ?? "none selected"}\`${view.hasModelOverride ? " (chat override)" : ""}`,
+    `Backend: ${view.backendLabel} (\`${view.backendId}\`)${view.hasBackendOverride ? " (chat override)" : ""}`,
+    `Effort: ${effort.current}${effort.levels.length ? ` — levels: ${effort.levels.join(", ")}` : ""}`,
+    `Pulse: ${pulseOn ? "on" : "off"} (every ${formatDuration(pulseIntervalMs ?? DEFAULT_PULSE_INTERVAL_MS)})`,
+  ];
+  if (freeOnly) lines.push("Free-only models: on");
+  lines.push(
+    "",
+    "Change with `/model`, `/effort`; `/reset` starts a fresh session.",
+  );
+  return lines.join("\n");
+}
+
+function renderStatus(s: SessionStatusData): string {
+  const used = s.context.known ? formatTokenCount(s.context.used) : "unknown";
+  const max = s.context.max > 0 ? formatTokenCount(s.context.max) : "unknown";
+  const pct = s.context.known ? `${s.context.pct}%` : "unknown";
+  const lines = [
+    `**Talon** · \`${formatModelLabel(s.activeModel)}\`${s.backendLabel ? ` · ${s.backendLabel}` : ""} · effort: ${s.effortName}${s.turnInProgress ? " · ⏳ turn running" : ""}`,
+    "",
+    `**Context** ${used} / ${max} (${pct})${s.context.warn ? " ⚠️ consider /reset" : ""}`,
+    `\`${s.context.bar}\``,
+    "",
+    "**Session stats**",
+    `Response: last ${s.lastResponseMs ? formatDuration(s.lastResponseMs) : "—"} · avg ${s.avgResponseMs ? formatDuration(s.avgResponseMs) : "—"} · best ${s.fastestMs ? formatDuration(s.fastestMs) : "—"}`,
+    `Turns: ${s.turns}${s.turnsModelLabel ? ` (${formatModelLabel(s.turnsModelLabel)})` : ""}`,
+    `Tokens: in ${formatTokenCount(s.inputTokens)} · out ${formatTokenCount(s.outputTokens)}${s.costUsd > 0 ? ` · cost ${formatUsd(s.costUsd)}` : ""}`,
+  ];
+  if (s.cache) {
+    lines.push(
+      `Cache: ${s.cache.hitPct}% hit · read ${formatTokenCount(s.cache.read)}${s.cache.showsWrite ? ` · write ${formatTokenCount(s.cache.write)}` : ""}`,
+    );
+  }
+  if (s.cacheTemp) lines.push(formatCacheTempLine(s.cacheTemp));
+  if (s.plan) {
+    lines.push(
+      "",
+      `**Plan**${s.plan.plan ? ` ${s.plan.plan}` : ""}${s.plan.ageLabel ? ` (${s.plan.ageLabel})` : ""}`,
+      ...s.plan.windows.map(
+        (w) =>
+          `\`${w.label.padEnd(6)}${w.bar} ${String(w.percent).padStart(3)}%\`${w.resetLabel ? ` reset ${w.resetLabel}` : ""}`,
+      ),
+    );
+  }
+  lines.push(
+    "",
+    `**Pulse** ${s.pulseOn ? "on" : "off"}`,
+    `**Workspace** ${formatBytes(s.diskBytes)}`,
+    `**Session** ${s.sessionName ? `"${s.sessionName}" ` : ""}${s.sessionId ? `\`${s.sessionId.slice(0, 8)}…\`` : "(new)"} · ${s.sessionAge} old`,
+    `**Uptime** ${s.uptime} · ${s.activeSessionCount} active session${s.activeSessionCount === 1 ? "" : "s"}`,
+    `**Runtime** ${s.runtime} · ${formatBytes(s.rssBytes)} RSS`,
+    formatDaemonLine(s.daemon),
+  );
+  return lines.join("\n");
+}
+
+// ── Replies ─────────────────────────────────────────────────────────────────
+
+/**
+ * How a frontend changes backend. By default the shared switch runs, with
+ * `keepHistory` deciding whether the local chat log survives it; a
+ * frontend that owns more per-chat state than the shared stores (the
+ * native bridge's turn meta and cached readouts) supplies its own.
+ */
+export type BackendSwitchHooks = {
+  keepHistory?: boolean;
+  switchBackend?: (target: { id: string; label: string }) => Promise<string>;
+  resetBackend?: () => Promise<string>;
+};
+
+/** `/model [arg]`: the listing, or the pick the argument names. */
+export async function modelCommandReply(
+  chatId: string,
+  arg: string,
+  deps: ModelCommandDeps,
+  hooks: BackendSwitchHooks = {},
+): Promise<string> {
+  if (!arg) return renderModelOverview(await describeChatModels(chatId, deps));
+  const lower = arg.toLowerCase();
+  const keepHistory = hooks.keepHistory === true;
+  if (lower === "backend default" || lower === "backend reset") {
+    if (hooks.resetBackend) return hooks.resetBackend();
+    return (await resetChatBackend(chatId, deps, { keepHistory })).text;
+  }
+  if (lower === "reset" || lower === "default") {
+    return (await resetChatModel(chatId, deps)).text;
+  }
+  const backend = matchBackendArg(arg, deps.config);
+  if (backend) {
+    if (hooks.switchBackend) return hooks.switchBackend(backend);
+    return (await switchChatBackend(chatId, backend, deps, { keepHistory }))
+      .text;
+  }
+  return (await selectChatModel(chatId, arg, deps)).text;
+}
+
+/** `/effort [level]`: the current level and the choices, or the change. */
+export async function effortCommandReply(
+  chatId: string,
+  arg: string,
+  deps: ModelCommandDeps,
+): Promise<string> {
+  if (arg) return (await setChatEffortLevel(chatId, arg, deps)).text;
+  const effort = await describeChatEffort(chatId, deps);
+  if (effort.levels.length === 0) {
+    return `No reasoning levels available for ${effort.activeModel ?? "the active model"} on backend ${effort.backendId}.`;
+  }
+  return `**Effort:** ${effort.current}\nLevels: ${effort.levels.join(", ")}, or adaptive — \`/effort <level>\` sets one.`;
+}
+
+/** `/settings`: model, backend, effort and pulse in one listing. */
+export async function settingsCommandReply(
+  chatId: string,
+  deps: ModelCommandDeps,
+): Promise<string> {
+  const [view, effort] = await Promise.all([
+    describeChatModels(chatId, deps),
+    describeChatEffort(chatId, deps),
+  ]);
+  const sets = getChatSettings(chatId);
+  return renderSettings(
+    view,
+    effort,
+    isPulseEnabled(chatId),
+    sets.pulseIntervalMs,
+    sets.freeOnly === true,
+  );
+}
+
+/** `/status`: session, context, usage and daemon stats. */
+export async function statusCommandReply(
+  chatId: string,
+  deps: ModelCommandDeps,
+): Promise<string> {
+  const { backend, backendId } = resolveChatBackendPair(chatId, deps);
+  return renderStatus(
+    await collectSessionStatus(chatId, deps.config, backend, backendId),
+  );
+}

package/src/frontend/telegram/actions/media.ts

@@ -54,8 +54,8 @@ export function resolveMediaInput(
 
 /** Telegram's hard limit on media captions, counted after entity parsing. */
 export const TELEGRAM_MAX_CAPTION = 1024;
-/** Visible length a truncated caption is cut to, leaving room for the "…". */
-const TRUNCATED_CAPTION_LEN = 1000;
+/** Below this head budget the splitter is fighting pathological markup; give up. */
+const MIN_CAPTION_HEAD = 64;
 
 /**
  * Drop every `<...>` tag in one linear pass. Only used to *measure* the
@@ -104,35 +104,76 @@ export function visibleCaptionText(html: string): string {
 export type FittedCaption = {
   caption?: string;
   parse_mode?: "HTML";
-  /** Full caption text to deliver as a follow-up message when it was cut. */
+  /** Caption text that did not fit, to deliver as follow-up message(s). */
   overflow?: string;
 };
 
+/** Visible (Telegram-counted) length of a markdown caption once rendered. */
+export function captionUnits(markdown: string): number {
+  // Telegram counts UTF-16 code units, which is what .length measures.
+  return visibleCaptionText(markdownToTelegramHtml(markdown)).length;
+}
+
+/**
+ * Split a markdown caption into the leading part that fits `max` visible
+ * units and the remainder. Splits the *markdown source* with the shared
+ * message splitter (paragraph → newline → space boundaries, surrogate-safe,
+ * ``` fences closed/reopened), so the head is rendered to HTML on its own
+ * and can never strand a tag or entity. Returns null if no clean head fits.
+ */
+export function splitCaption(
+  text: string,
+  max: number = TELEGRAM_MAX_CAPTION,
+): { head: string; rest: string } | null {
+  // Rendering usually shrinks markdown (markers and link URLs vanish), so
+  // the first try nearly always fits; shrink the budget if it does not.
+  for (let budget = max; budget >= MIN_CAPTION_HEAD;) {
+    const chunks = splitMessage(text, budget);
+    const head = chunks[0] ?? "";
+    if (head.trim() && captionUnits(head) <= max) {
+      const at = text.indexOf(head);
+      // The splitter only trims at boundaries, so the head is normally a
+      // verbatim prefix; when it closed a ``` fence it is not, and the
+      // splitter's own reopened chunks carry the remainder instead.
+      const rest =
+        at >= 0
+          ? text.slice(at + head.length).replace(/^\s+/, "")
+          : chunks.slice(1).join("\n\n");
+      return { head, rest };
+    }
+    budget = Math.floor(budget * 0.8);
+  }
+  return null;
+}
+
 /**
  * Convert a markdown caption to what Telegram accepts. Captions over 1024
  * visible characters are rejected outright ("message caption is too long"),
- * losing the media along with them — so an oversized caption is cut to a
- * plain-text preview (no parse_mode: a cut through HTML could strand a tag
- * or entity) and the full text is returned as `overflow` for the caller to
- * send as a normal, chunked text message.
+ * losing the media along with them — so an oversized caption is split: the
+ * leading part that fits rides on the media (still formatted), and the rest
+ * is returned as `overflow` for the caller to send as follow-up text.
  */
 export function fitCaption(raw: unknown): FittedCaption {
   if (!raw) return {};
   const text = String(raw);
   const html = markdownToTelegramHtml(text);
-  const visible = visibleCaptionText(html);
-  // Telegram counts UTF-16 code units, which is what .length measures.
-  if (visible.length <= TELEGRAM_MAX_CAPTION)
+  if (visibleCaptionText(html).length <= TELEGRAM_MAX_CAPTION)
     return { caption: html, parse_mode: "HTML" };
-  let cut = visible.slice(0, TRUNCATED_CAPTION_LEN);
-  // Don't strand half a surrogate pair at the cut.
-  const last = cut.charCodeAt(cut.length - 1);
-  if (last >= 0xd800 && last <= 0xdbff) cut = cut.slice(0, -1);
-  return { caption: `${cut.trimEnd()}…`, overflow: text };
+  const split = splitCaption(text);
+  if (split) {
+    return {
+      caption: markdownToTelegramHtml(split.head),
+      parse_mode: "HTML",
+      ...(split.rest ? { overflow: split.rest } : {}),
+    };
+  }
+  // No clean boundary fits (pathological markup): send the media bare and
+  // deliver the whole caption as text rather than cut through it.
+  return { overflow: text };
 }
 
 /**
- * Deliver the full text of a caption that did not fit, threaded as a reply
+ * Deliver the part of a caption that did not fit, threaded as a reply
  * to the media it belongs to. Best-effort: the media already landed, so a
  * failure here is reported as a warning rather than failing the send.
  */
@@ -167,7 +208,7 @@ async function sendCaptionOverflow(
       `Caption overflow follow-up failed (chat=${chatId}): ${msg}`,
     );
     return {
-      warning: `Media sent with a truncated caption, but sending the full caption text failed: ${msg}`,
+      warning: `Media sent, but the rest of its caption (past Telegram's ${TELEGRAM_MAX_CAPTION}-char limit) failed to send: ${msg}`,
     };
   }
 }
@@ -176,8 +217,8 @@ function overflowResult(
   r: { message_ids: number[] } | { warning: string },
 ): Record<string, unknown> {
   return "warning" in r
-    ? { caption_truncated: true, warning: r.warning }
-    : { caption_truncated: true, caption_message_ids: r.message_ids };
+    ? { caption_split: true, warning: r.warning }
+    : { caption_split: true, caption_message_ids: r.message_ids };
 }
 
 const sendMediaFile: TelegramActionHandlers[string] = async (

package/src/frontend/telegram/actions/messaging.ts

@@ -21,6 +21,7 @@ import {
   richMessagesAvailable,
 } from "./rich-messages.js";
 import { toPositiveId } from "./coerce.js";
+import { captionUnits, TELEGRAM_MAX_CAPTION } from "./media.js";
 import { resolveThreadId } from "../topics.js";
 import { TELEGRAM_MAX_TEXT, type TelegramActionHandlers } from "./types.js";
 
@@ -260,6 +261,14 @@ export const messagingHandlers: TelegramActionHandlers = {
     // Media messages have captions, not text — editMessageText on them fails
     // with "there is no text in the message to edit".
     if (body.is_caption === true) {
+      // An edit cannot spill into a follow-up message the way a send does,
+      // so refuse up front with guidance rather than a raw Bot API 400.
+      const units = captionUnits(text);
+      if (units > TELEGRAM_MAX_CAPTION)
+        return {
+          ok: false,
+          error: `Caption too long (${units} chars, max ${TELEGRAM_MAX_CAPTION}) — shorten it, or send the rest as a separate message`,
+        };
       await withRetry(async () => {
         try {
           await bot.api.editMessageCaption(chatId, Number(body.message_id), {

package/src/frontend/telegram/admin/sessions.ts

@@ -5,8 +5,10 @@
 import type { Bot, Context } from "grammy";
 import type { TalonConfig } from "../../../core/config/index.js";
 import { escapeHtml } from "../formatting.js";
-import { resetSession, getAllSessions } from "../../../storage/sessions.js";
-import { clearHistory } from "../../../storage/history.js";
+import { getAllSessions } from "../../../storage/sessions.js";
+import { performSessionReset } from "../../presentation/session-status.js";
+import { resolveBackendForChat } from "../model-menu.js";
+import type { Backend } from "../../../core/agent-runtime/capabilities.js";
 import { getChatSettings } from "../../../storage/chat-settings.js";
 import { formatModelLabel } from "../../presentation/format.js";
 import { replyHtmlChunked } from "./chunked-reply.js";
@@ -93,13 +95,26 @@ export async function broadcast(
   );
 }
 
-export async function killSession(ctx: Context, rest: string[]): Promise<void> {
+/** The default backend; per-chat overrides are resolved from it. */
+export type AdminGateway = { backend: Backend | null };
+
+/**
+ * `/admin kill <chatId>` — the same reset /reset performs in that chat:
+ * session + history stores, pulse checkpoint, and the backend's own
+ * per-chat session (resolved through the chat's backend override).
+ */
+export async function killSession(
+  ctx: Context,
+  rest: string[],
+  _bot: Bot,
+  _config: TalonConfig,
+  gateway?: AdminGateway,
+): Promise<void> {
   const target = rest[0];
   if (!target) {
     await ctx.reply("Usage: /admin kill <chatId>");
     return;
   }
-  resetSession(target);
-  clearHistory(target);
+  await performSessionReset(target, resolveBackendForChat(target, gateway));
   await ctx.reply(`Session ${target} reset.`);
 }

package/src/frontend/telegram/admin.ts

@@ -11,7 +11,12 @@
 
 import type { Bot, Context } from "grammy";
 import type { TalonConfig } from "../../core/config/index.js";
-import { replyActiveChats, broadcast, killSession } from "./admin/sessions.js";
+import {
+  replyActiveChats,
+  broadcast,
+  killSession,
+  type AdminGateway,
+} from "./admin/sessions.js";
 import {
   replyStats,
   replyRecentErrors,
@@ -25,6 +30,7 @@ type AdminSubcommand = (
   rest: string[],
   bot: Bot,
   config: TalonConfig,
+  gateway?: AdminGateway,
 ) => Promise<void>;
 
 // Null-prototype so `/admin constructor` can't resolve an inherited
@@ -80,6 +86,7 @@ export async function handleAdminCommand(
   ctx: Context,
   bot: Bot,
   config: TalonConfig,
+  gateway?: AdminGateway,
 ): Promise<void> {
   const args = ((ctx.match as string) ?? "").trim();
   const [subcommand, ...rest] = args.split(/\s+/);
@@ -94,5 +101,5 @@ export async function handleAdminCommand(
     );
     return;
   }
-  await run(ctx, rest, bot, config);
+  await run(ctx, rest, bot, config, gateway);
 }

package/src/frontend/telegram/callbacks/backup.ts

@@ -1,39 +1,117 @@
 /**
- * `backup:*` callbacks — the /backup restore confirmation.
+ * `backup:*` callbacks — the /backup panel and the restore confirmation.
  *
- *   backup:restore:<id>  stage the restore and restart
- *   backup:cancel        do nothing, say so
+ *   backup:panel              status panel (Refresh, Back)
+ *   backup:now                take a snapshot, editing the panel in place
+ *   backup:list:<page>        a page of snapshots
+ *   backup:guide              how restore works
+ *   backup:pin|unpin:<p>:<id> pin or release, then re-render the page
+ *   backup:ask:<p>:<id>       open the restore confirmation (nothing happens yet)
+ *   backup:restore:<id>       stage the restore and restart
+ *   backup:cancel             do nothing, say so
  *
- * The button is the whole safety mechanism: a restore replaces the
- * database, the memory and the identity of a running agent, so nothing
- * here happens without a second, explicit admin tap.
+ * Every tap re-checks the admin: a button is only a message, and anyone
+ * who can see it can press it. The confirmation is the whole safety
+ * mechanism for restore — it replaces the database, the memory and the
+ * identity of a running agent, so nothing stages without a second,
+ * explicit admin tap on `backup:restore:<id>`, which only the
+ * confirmation offers. The grammar lives in
+ * frontend/presentation/backup-panel.ts.
  */
 
 import type { Context } from "grammy";
-import { isSnapshotId } from "../../../core/backup/index.js";
-import { stageRestore } from "../commands/backup.js";
+import { readManifest, setSnapshotPinned } from "../../../core/backup/index.js";
+import {
+  PANEL_BUTTONS,
+  parseBackupAction,
+  restoreConfirmView,
+  type PanelView,
+} from "../../presentation/backup-panel.js";
+import { runSnapshotForChat, stageRestore } from "../commands/backup.js";
 import { isAuthorizedAdmin } from "../commands/state.js";
+import {
+  inlineKeyboard,
+  loadSnapshotPage,
+  loadStatusPanel,
+  restoreGuideView,
+} from "../render/backup-panel.js";
+import { TELEGRAM_REPORTS } from "../render/html.js";
 import { logError } from "../../../util/log.js";
-import { answerCallbackQuerySafe } from "./query.js";
+import { answerCallbackQuerySafe, editOrIgnoreSame } from "./query.js";
 
-export async function handleBackupCallback(
-  ctx: Context,
-  data: string,
-): Promise<void> {
-  if (!isAuthorizedAdmin(ctx)) {
-    await answerCallbackQuerySafe(ctx, { text: "Not authorized." });
+/** One panel snapshot at a time: a double tap must not take two. */
+let panelSnapshotRunning = false;
+
+/** Tests only. */
+export function _resetBackupPanelState(): void {
+  panelSnapshotRunning = false;
+}
+
+function show(ctx: Context, view: PanelView): Promise<void> {
+  return editOrIgnoreSame(ctx, view.text, inlineKeyboard(view.buttons));
+}
+
+async function backUpNow(ctx: Context): Promise<void> {
+  if (panelSnapshotRunning) {
+    await answerCallbackQuerySafe(ctx, {
+      text: "A snapshot is already running.",
+    });
     return;
   }
-  const [, action, id] = data.split(":");
-  if (action === "cancel") {
-    await answerCallbackQuerySafe(ctx, { text: "Cancelled." });
-    await ctx.editMessageText("Restore cancelled.").catch(() => {});
-    return;
+  panelSnapshotRunning = true;
+  try {
+    await answerCallbackQuerySafe(ctx, { text: "📸 Snapshot started" });
+    await editOrIgnoreSame(
+      ctx,
+      "📸 <b>Taking a snapshot…</b>\n" +
+        "Building it, then pruning and uploading to any targets. " +
+        "This can take a few minutes — this message updates when it is done.",
+      [],
+    );
+    const result = await runSnapshotForChat();
+    // The snapshot's outcome must land even if the status read after it
+    // does not: fall back to the bare result line under the panel buttons.
+    const view = await loadStatusPanel(result.text).catch((err: unknown) => {
+      logError("backup", "Backup panel status read failed", err);
+      return { text: result.text, buttons: PANEL_BUTTONS };
+    });
+    await show(ctx, view);
+  } finally {
+    panelSnapshotRunning = false;
   }
-  if (action !== "restore" || !id || !isSnapshotId(id)) {
-    await answerCallbackQuerySafe(ctx, { text: "Invalid callback data" });
+}
+
+async function togglePin(
+  ctx: Context,
+  id: string,
+  page: number,
+  pinned: boolean,
+): Promise<void> {
+  const ok = await setSnapshotPinned(id, pinned);
+  await answerCallbackQuerySafe(ctx, {
+    text: ok ? (pinned ? "📌 Pinned" : "Unpinned") : "No such snapshot",
+  });
+  await show(ctx, await loadSnapshotPage(page));
+}
+
+/** The panel's Restore button: the confirmation, never the restore. */
+async function askToRestore(
+  ctx: Context,
+  id: string,
+  page: number,
+): Promise<void> {
+  const manifest = await readManifest(id);
+  if (!manifest) {
+    await answerCallbackQuerySafe(ctx, {
+      text: "That snapshot has no copy on this machine.",
+    });
     return;
   }
+  await answerCallbackQuerySafe(ctx);
+  await show(ctx, restoreConfirmView(TELEGRAM_REPORTS, manifest, page));
+}
+
+async function confirmRestore(ctx: Context, id: string): Promise<void> {
   await answerCallbackQuerySafe(ctx, { text: "Restoring…" });
   await ctx
     .editMessageText(
@@ -53,3 +131,56 @@ export async function handleBackupCallback(
       .catch(() => {});
   }
 }
+
+export async function handleBackupCallback(
+  ctx: Context,
+  data: string,
+): Promise<void> {
+  if (!isAuthorizedAdmin(ctx)) {
+    await answerCallbackQuerySafe(ctx, { text: "Not authorized." });
+    return;
+  }
+  const action = parseBackupAction(data);
+  if (!action) {
+    await answerCallbackQuerySafe(ctx, { text: "Invalid callback data" });
+    return;
+  }
+  try {
+    switch (action.kind) {
+      case "cancel":
+        await answerCallbackQuerySafe(ctx, { text: "Cancelled." });
+        await ctx.editMessageText("Restore cancelled.").catch(() => {});
+        return;
+      case "restore":
+        await confirmRestore(ctx, action.id);
+        return;
+      case "now":
+        await backUpNow(ctx);
+        return;
+      case "pin":
+      case "unpin":
+        await togglePin(ctx, action.id, action.page, action.kind === "pin");
+        return;
+      case "ask":
+        await askToRestore(ctx, action.id, action.page);
+        return;
+      case "panel":
+        await answerCallbackQuerySafe(ctx);
+        await show(ctx, await loadStatusPanel());
+        return;
+      case "list":
+        await answerCallbackQuerySafe(ctx);
+        await show(ctx, await loadSnapshotPage(action.page));
+        return;
+      case "guide":
+        await answerCallbackQuerySafe(ctx);
+        await show(ctx, restoreGuideView());
+        return;
+    }
+  } catch (err) {
+    logError("backup", `Backup panel action ${action.kind} failed`, err);
+    await answerCallbackQuerySafe(ctx, {
+      text: "⚠️ That did not work — see the log.",
+    });
+  }
+}