@songsid/agend 2.1.10-beta.1 → 2.1.10-beta.3

package/dist/fleet-manager.d.ts

@@ -184,6 +184,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Reasons that describe the adapter, not one topic — counted once per adapter. */
     private static readonly TOPIC_PROBE_ADAPTER_SCOPED_REASONS;
     logger: Logger;
+    /** Report each bundled skill collision once per fleet, across instance starts. */
+    private skippedBundledSkills;
     private topicCommands;
     sessionRegistry: Map<string, string>;
     eventLog: EventLog | null;
@@ -246,6 +248,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private stopsInFlight;
     /** Aggregation window for the "N instances failed to start" notice. */
     private startupRetryNotices;
+    /** Unsupported-CLI refusals waiting to go out, grouped by reason (#1109). */
+    private unsupportedCliNotices;
     /** Backoff between automatic startup retries; the last step repeats while the backend is down. */
     static readonly STARTUP_RETRY_BACKOFF_MS: number[];
     /** Hard cap on automatic startup retries (3 backoff steps + up to 3 more during a backend outage). */
@@ -479,6 +483,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private reregisterClassicChannels;
     getInstanceDir(name: string): string;
+    /**
+     * One-time repair of what earlier versions left behind: instance directories (agent.token and the IPC
+     * socket live in them) created with the process umask — typically 0775, group-writable and traversable
+     * by everyone. They are made 0700 here, once, and said so once; new ones are born 0700 (ensureInstanceDir).
+     * Idempotent, so a restart that finds nothing to do logs nothing. Never throws.
+     */
+    private tightenInstanceDirectories;
     /** AgEnD package version (for the Settings "current version" / What's New). */
     get currentVersion(): string;
     /**
@@ -746,6 +757,17 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * fails many instances within the same second. Two notices per incident at
      * most — "N failed, retrying in X" and, if it comes to that, "gave up on N".
      */
+    /**
+     * The CLI refuses this instance as configured (#1109): the same binary would
+     * refuse every retry, so say why once and leave it stopped. Shared by the
+     * first unattended start and every scheduled retry.
+     */
+    private stopOnUnsupportedCli;
+    /**
+     * One notice per refusal reason: a kiro-cli that dropped the legacy UI
+     * refuses every kiro instance at once, and that is one message, not ten.
+     */
+    private queueUnsupportedCliNotice;
     private queueStartupRetryNotice;
     private runnableStartupCount;
     private configuredStartupInstanceNames;
@@ -1317,7 +1339,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * WatchdogSec and have systemd SIGABRT the fleet.
      */
     private runBackendDoctor;
-    /** Drop event/activity rows older than the retention window. Best-effort. */
+    /** Cap both structured runtime logs and service bootstrap diagnostics. */
+    private rotateFleetLogs;
     /**
      * Cap every instance's pipe-pane log, walking the instances **directory** rather
      * than the config.
@@ -1337,6 +1360,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * fleet down rather than one instance.
      */
     private rotateAllInstanceLogs;
+    /** Drop event/activity rows older than the retention window. Best-effort. */
     private pruneEventLog;
     private openEventLog;
     /**

package/dist/fleet-manager.js

@@ -29,7 +29,7 @@ import { IpcClient } from "./channel/ipc-bridge.js";
 import { createAdapter } from "./channel/factory.js";
 import { TelegramAdapter } from "./channel/adapters/telegram.js";
 import { createBackend } from "./backend/factory.js";
-import { isModelCompatible, SYSINFO_BACKEND_IDS } from "./backend/types.js";
+import { isModelCompatible, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
 import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
@@ -56,6 +56,7 @@ import { handleViewRequest, isViewPath } from "./view-api.js";
 import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
+import { tightenInstanceDirs } from "./private-dir.js";
 import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS, announcePostLoginRecovery } from "./login-controller.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
@@ -363,6 +364,8 @@ export class FleetManager {
         "provider-unavailable",
     ]);
     logger = createLogger("info");
+    /** Report each bundled skill collision once per fleet, across instance starts. */
+    skippedBundledSkills = new Set();
     topicCommands;
     // sessionName → instanceName mapping for external sessions
     sessionRegistry = new Map();
@@ -431,6 +434,8 @@ export class FleetManager {
     stopsInFlight = new Map();
     /** Aggregation window for the "N instances failed to start" notice. */
     startupRetryNotices = new Map();
+    /** Unsupported-CLI refusals waiting to go out, grouped by reason (#1109). */
+    unsupportedCliNotices = new Map();
     /** Backoff between automatic startup retries; the last step repeats while the backend is down. */
     static STARTUP_RETRY_BACKOFF_MS = [60_000, 5 * 60_000, 15 * 60_000];
     /** Hard cap on automatic startup retries (3 backoff steps + up to 3 more during a backend outage). */
@@ -1053,6 +1058,7 @@ export class FleetManager {
         // around to notice. Never throws: a lease that cannot be resolved blocks
         // the next tunnel and says so, it does not block the fleet.
         this.announceToolPermissionsChange();
+        this.tightenInstanceDirectories();
         void reapStaleTunnel(this.dataDir)
             .then(outcome => {
             if (outcome.kind === "manual")
@@ -1277,6 +1283,29 @@ export class FleetManager {
     getInstanceDir(name) {
         return join(this.dataDir, "instances", name);
     }
+    /**
+     * One-time repair of what earlier versions left behind: instance directories (agent.token and the IPC
+     * socket live in them) created with the process umask — typically 0775, group-writable and traversable
+     * by everyone. They are made 0700 here, once, and said so once; new ones are born 0700 (ensureInstanceDir).
+     * Idempotent, so a restart that finds nothing to do logs nothing. Never throws.
+     */
+    tightenInstanceDirectories() {
+        try {
+            const report = tightenInstanceDirs(this.dataDir);
+            if (report.tightened.length > 0) {
+                this.logger.info({
+                    count: report.tightened.length,
+                    modes: [...new Set(report.tightened.map(t => t.from))],
+                }, "Instance directories were open to other users; set to 0700 (they hold agent.token and the IPC socket)");
+            }
+            if (report.skipped.length > 0) {
+                this.logger.warn({ dirs: report.skipped.map(s => `${s.dir} (${s.why})`) }, "Could not tighten these instance directories — fix their owner/permissions by hand (chmod 700)");
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Instance directory permission check failed");
+        }
+    }
     /** AgEnD package version (for the Settings "current version" / What's New). */
     get currentVersion() {
         try {
@@ -2432,6 +2461,8 @@ export class FleetManager {
             // outcome. Retrying would start an instance the operator just stopped.
             if (err instanceof SupersededStartError)
                 return false;
+            if (this.stopOnUnsupportedCli(name, err, what))
+                return false;
             this.logger.error({ err, name }, `Failed to start ${what}`);
             this.scheduleStartupRetry(name, 0);
             return false;
@@ -2556,6 +2587,9 @@ export class FleetManager {
             // Superseded by a stop/restart: that transition owns the outcome.
             if (err instanceof SupersededStartError)
                 return;
+            // An earlier attempt could not tell (unknown probe); this one could.
+            if (this.stopOnUnsupportedCli(name, err, "instance"))
+                return;
             this.logger.error({ err, name, attempt: attempt + 1 }, "Automatic startup retry failed");
             this.scheduleStartupRetry(name, attempt + 1);
         }
@@ -2651,6 +2685,38 @@ export class FleetManager {
      * fails many instances within the same second. Two notices per incident at
      * most — "N failed, retrying in X" and, if it comes to that, "gave up on N".
      */
+    /**
+     * The CLI refuses this instance as configured (#1109): the same binary would
+     * refuse every retry, so say why once and leave it stopped. Shared by the
+     * first unattended start and every scheduled retry.
+     */
+    stopOnUnsupportedCli(name, err, what) {
+        if (!(err instanceof UnsupportedCliError))
+            return false;
+        this.logger.error({ name, reason: err.message }, `Not starting ${what}: the installed CLI cannot run it as configured`);
+        this.queueUnsupportedCliNotice(name, err.message);
+        return true;
+    }
+    /**
+     * One notice per refusal reason: a kiro-cli that dropped the legacy UI
+     * refuses every kiro instance at once, and that is one message, not ten.
+     */
+    queueUnsupportedCliNotice(name, reason) {
+        const pending = this.unsupportedCliNotices.get(reason);
+        if (pending) {
+            if (!pending.names.includes(name))
+                pending.names.push(name);
+            return;
+        }
+        const timer = setTimeout(() => {
+            const entry = this.unsupportedCliNotices.get(reason);
+            this.unsupportedCliNotices.delete(reason);
+            if (entry)
+                this.notifyFleetError(t("fleet.cli_unsupported", entry.names.join(", "), reason));
+        }, FleetManager.STARTUP_RETRY_NOTICE_AGGREGATE_MS);
+        timer.unref?.();
+        this.unsupportedCliNotices.set(reason, { names: [name], timer });
+    }
     queueStartupRetryNotice(kind, name, delayMs) {
         const pending = this.startupRetryNotices.get(kind);
         if (pending) {
@@ -3162,8 +3228,7 @@ export class FleetManager {
         this.configPath = configPath;
         this.loadEnvFile();
         this.ensureDeliveryOutbox();
-        // Rotate fleet.log if oversized (before any logging)
-        rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
+        this.rotateFleetLogs();
         const fleet = this.loadConfig(configPath);
         this.slimFleetConfigAtStartup();
         setLocale(detectLocale(fleet)); // user-facing text language (fleet.yaml defaults.locale / timezone)
@@ -3277,9 +3342,7 @@ export class FleetManager {
             // Rotate classic channel chat logs daily
             this.classicChannels?.rotateLogs();
             this.rotateInboxes();
-            // Rotate fleet.log daily too (besides the startup size check above), so a
-            // long-running fleet doesn't accumulate an unbounded log.
-            rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
+            this.rotateFleetLogs();
             // Instance output.log is pipe-pane (TUI ANSI). Daemon health ticks rotate a
             // running instance's own log; this sweep is the safety net for every other
             // kind. One implementation, so the two cannot cover different sets.
@@ -3495,11 +3558,14 @@ export class FleetManager {
         this.pruneEventLog();
         this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
         this.eventLogPruneTimer.unref?.();
-        // Same shape for pipe-pane logs, and for the same reason: the only sweep that
+        // Same shape for logs, and for the same reason: the only sweep that
         // covered them lived inside the daily-summary callback, so it did not run at
         // all when summaries were off.
         this.rotateAllInstanceLogs();
-        this.logRotateTimer = setInterval(() => this.rotateAllInstanceLogs(), 24 * 60 * 60_000);
+        this.logRotateTimer = setInterval(() => {
+            this.rotateFleetLogs();
+            this.rotateAllInstanceLogs();
+        }, 24 * 60 * 60_000);
         this.logRotateTimer.unref?.();
         // Phase 2: Start remaining instances with staggered concurrency
         if (others.length > 0) {
@@ -7769,7 +7835,11 @@ export class FleetManager {
             return stripAnsi(e.message ?? "").trim() || t("doctor.failed");
         }
     }
-    /** Drop event/activity rows older than the retention window. Best-effort. */
+    /** Cap both structured runtime logs and service bootstrap diagnostics. */
+    rotateFleetLogs() {
+        rotateLogIfNeeded(join(this.dataDir, "daemon.log"));
+        rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
+    }
     /**
      * Cap every instance's pipe-pane log, walking the instances **directory** rather
      * than the config.
@@ -7805,6 +7875,7 @@ export class FleetManager {
             rotateLogIfNeeded(join(root, entry.name, "output.log"));
         }
     }
+    /** Drop event/activity rows older than the retention window. Best-effort. */
     pruneEventLog() {
         try {
             this.eventLog?.prune(FleetManager.EVENT_LOG_RETENTION_DAYS);
@@ -10583,8 +10654,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             const dest = join(destDir, "SKILL.md");
             const isOurs = previouslyManaged.includes(name) || !existsSync(destDir);
             if (!isOurs) {
-                // Name collision with a user-authored skill: theirs wins, loudly.
-                this.logger.warn({ skill: name, destSkills }, "Skipping bundled skill — a skill of this name exists but was not published by AgEnD");
+                // The user's skill still wins on every sync; only the warning is deduped.
+                if (!this.skippedBundledSkills.has(name)) {
+                    this.skippedBundledSkills.add(name);
+                    this.logger.warn({ skill: name, destSkills }, "Skipping bundled skill — a skill of this name exists but was not published by AgEnD");
+                }
                 continue;
             }
             managed.push(name);
@@ -12898,7 +12972,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return {
                 ok: false,
                 status: 409,
-                error: `fleet.yaml and the running configuration disagree on ${this.fleetSignatureMismatch.join(", ")} — check fleet.log before restarting`,
+                error: `fleet.yaml and the running configuration disagree on ${this.fleetSignatureMismatch.join(", ")} — check daemon.log before restarting`,
             };
         }
         const job = this.applyJobs.get(jobId);
@@ -12973,7 +13047,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.applyJobs.setTargetStatus(jobId, APPLY_FLEET_TARGET, "failed", "restart could not be launched");
             this.applyJobs.finish(jobId, "restart could not be launched");
             this.emitSseEvent("apply_progress", viewOf(this.applyJobs.get(jobId)));
-            return { ok: false, status: 409, error: "the restart could not be launched — see fleet.log" };
+            return { ok: false, status: 409, error: "the restart could not be launched — see daemon.log" };
         }
         return { ok: true, jobId };
     }