@songsid/agend 2.1.10 → 2.1.11-beta.2

package/dist/fleet-control-audit.js

@@ -0,0 +1,195 @@
+import { appendFileSync, existsSync, readFileSync, renameSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { readProcessCommandLine } from "./fleet-lock.js";
+/**
+ * Who stopped / restarted / updated the fleet (#1120).
+ *
+ * 2026-10-03 01:19 an unplanned `agend restart` ran from inside an agent's shell
+ * (a backtick in a `gh --body "..."` was command-substituted) and the only way
+ * to find the source was journal timing plus a kiro transcript: the fleet.log
+ * that would have said so is truncated by the restart itself. So the CLI writes
+ * one line to its OWN file before it acts, and a fleet-wide stop / restart /
+ * update started from a fleet agent's session — or from a test runner — has to
+ * be confirmed or is refused.
+ *
+ * Observability and a guard rail only: this changes nothing about delivery,
+ * authorisation or what a confirmed command does.
+ */
+export const AUDIT_FILE = "restart-audit.log";
+const AUDIT_MAX_BYTES = 512 * 1024;
+/** Set by the fleet's own spawn sites: an internal, already-authorised call. */
+export const ORIGIN_ENV = "AGEND_RESTART_ORIGIN";
+/** The environment for a child the fleet spawns to stop / restart / update itself. */
+export function withOrigin(origin, env = process.env) {
+    return { ...env, [ORIGIN_ENV]: origin };
+}
+/** Escape hatch for a test that really means to run the CLI against a scratch fleet (exactly "1"). */
+export const ALLOW_TEST_ENV = "AGEND_ALLOW_TEST_FLEET_CONTROL";
+/** Pure: may this call go ahead? `yes` is the explicit `--yes`. */
+export function judgeFleetControl(env, yes) {
+    // First, and even for the fleet's own spawn sites: a handler a test drives for real
+    // must not reach the live fleet just because it set its origin (fleet decision bd0c88aa).
+    const underTestRunner = !!env.VITEST || env.NODE_ENV === "test";
+    if (underTestRunner && env[ALLOW_TEST_ENV] !== "1")
+        return { ok: false, reason: "test-runner" };
+    const origin = (env[ORIGIN_ENV] ?? "").trim();
+    if (origin)
+        return { ok: true, via: "origin" };
+    if ((env.AGEND_INSTANCE_NAME ?? "").trim() && !yes)
+        return { ok: false, reason: "agent-session" };
+    return { ok: true, via: yes ? "yes" : "interactive" };
+}
+function parentPid(pid) {
+    try {
+        // "pid (comm) S ppid ..." — comm may contain spaces and parentheses.
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        const rest = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+        const ppid = Number.parseInt(rest[1] ?? "", 10);
+        return Number.isInteger(ppid) ? ppid : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+export function describeCaller(env = process.env, maxDepth = 6) {
+    const chain = [];
+    let pid = process.pid;
+    for (let depth = 0; depth < maxDepth && pid > 0; depth++) {
+        chain.push({ pid, command: readProcessCommandLine(pid).slice(0, 300) });
+        const next = parentPid(pid);
+        if (next <= 1 || next === pid)
+            break;
+        pid = next;
+    }
+    let user = "";
+    try {
+        user = env.USER ?? env.LOGNAME ?? "";
+    }
+    catch { /* ignore */ }
+    return {
+        pid: process.pid,
+        chain,
+        cwd: (() => { try {
+            return process.cwd();
+        }
+        catch {
+            return "";
+        } })(),
+        user,
+        tty: !!process.stdin.isTTY,
+        instance: (env.AGEND_INSTANCE_NAME ?? "").trim() || null,
+        origin: (env[ORIGIN_ENV] ?? "").trim() || null,
+        ssh: !!(env.SSH_CONNECTION || env.SSH_TTY),
+    };
+}
+/** Best effort: an audit line must never be the reason a restart fails. */
+export function appendAudit(dataDir, entry) {
+    try {
+        const path = join(dataDir, AUDIT_FILE);
+        try {
+            if (existsSync(path) && statSync(path).size > AUDIT_MAX_BYTES)
+                renameSync(path, `${path}.1`);
+        }
+        catch { /* rotation is a nicety */ }
+        appendFileSync(path, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
+    }
+    catch { /* unwritable data dir */ }
+}
+/** The newest entry written within `withinMs`, for the fleet to name in its own log. */
+export function readRecentAudit(dataDir, withinMs, now = Date.now()) {
+    try {
+        const lines = readFileSync(join(dataDir, AUDIT_FILE), "utf8").trimEnd().split("\n");
+        for (let i = lines.length - 1; i >= 0 && i >= lines.length - 20; i--) {
+            try {
+                const entry = JSON.parse(lines[i]);
+                if (entry.outcome !== "allowed")
+                    continue;
+                // A routine instance stop/restart sends no signal to the fleet process: naming it
+                // would blame the wrong request for a SIGUSR1/SIGTERM it did not cause.
+                if (entry.action === "instance-stop" || entry.action === "instance-restart")
+                    continue;
+                const age = now - Date.parse(entry.ts);
+                if (age >= 0 && age <= withinMs)
+                    return entry;
+            }
+            catch { /* a torn line */ }
+        }
+    }
+    catch { /* no audit file yet */ }
+    return null;
+}
+/** What the fleet writes into its own log when a signal arrives: who asked, if the CLI said so lately. */
+export function describeSignalSource(dataDir, signal, now = Date.now()) {
+    const entry = readRecentAudit(dataDir, 2 * 60_000, now);
+    return entry
+        ? `${signal}: requested by ${summariseCaller(entry)} at ${entry.ts}`
+        : `${signal}: no fleet-control request recorded in the last 2 minutes (a service manager, \`kill\`, or a program that signals the process directly)`;
+}
+/** One-line form for a log message. */
+export function summariseCaller(entry) {
+    const parent = entry.caller.chain[1];
+    return [
+        `${entry.action}${entry.target ? ` ${entry.target}` : ""}`,
+        entry.caller.instance ? `from agent session ${entry.caller.instance}` : null,
+        entry.caller.origin ? `origin ${entry.caller.origin}` : null,
+        parent ? `parent pid ${parent.pid} (${parent.command.slice(0, 120)})` : null,
+    ].filter(Boolean).join(", ");
+}
+export function refusalMessage(action, reason, instance) {
+    if (reason === "test-runner") {
+        return `Refusing \`agend ${commandOf(action)}\`: it was started from a test runner and would act on the real fleet. `
+            + `Stub the call, or set ${ALLOW_TEST_ENV}=1 if this really targets a scratch fleet.`;
+    }
+    return `Refusing \`agend ${commandOf(action)}\`: it was started from the fleet agent session "${instance}", and this stops the whole fleet and every instance in it.\n`
+        + `If that is what you mean, run it again with --yes. If you did not mean to run it at all, a backtick or $(...) inside a quoted shell argument may have executed it.`;
+}
+function commandOf(action) {
+    switch (action) {
+        case "fleet-stop": return "fleet stop";
+        case "fleet-restart": return "fleet restart";
+        case "fleet-restart-reload": return "fleet restart --reload";
+        default: return action.replace("instance-", "fleet ");
+    }
+}
+/**
+ * The CLI's gate: record the call, then let it through or refuse it. Returns
+ * whether to go ahead; the caller prints nothing and exits on `false`.
+ */
+export function gateFleetControl(dataDir, action, opts, env = process.env, report = message => console.error(message)) {
+    const caller = describeCaller(env);
+    const verdict = judgeFleetControl(env, !!opts.yes);
+    appendAudit(dataDir, {
+        ts: new Date().toISOString(),
+        action,
+        ...(opts.target ? { target: opts.target } : {}),
+        outcome: verdict.ok ? "allowed" : "refused",
+        ...(verdict.ok ? { detail: verdict.via } : { detail: verdict.reason }),
+        caller,
+    });
+    // The origin marker authorises THIS command only. Left in the environment it would be
+    // inherited by the replacement fleet the command starts, and by every agent that fleet
+    // runs: a permanent exemption from the confirmation (#1158 review).
+    delete env[ORIGIN_ENV];
+    if (verdict.ok)
+        return true;
+    report(refusalMessage(action, verdict.reason, caller.instance));
+    return false;
+}
+/** Instance-level stop/restart: recorded for the trail, never blocked (agents do this routinely). */
+export function recordInstanceControl(dataDir, action, target, env = process.env) {
+    appendAudit(dataDir, {
+        ts: new Date().toISOString(), action, target, outcome: "allowed", caller: describeCaller(env),
+    });
+}
+/**
+ * The fleet's own entry points (a /restart or /update slash command, the full-restart
+ * helper): written by the fleet process, so the signal or child it sends next can be
+ * traced to the person who asked, not just to "the fleet itself".
+ */
+export function recordInternalRequest(dataDir, action, origin, env = process.env) {
+    appendAudit(dataDir, {
+        ts: new Date().toISOString(), action, outcome: "allowed", detail: "origin",
+        caller: describeCaller(withOrigin(origin, env)),
+    });
+}
+//# sourceMappingURL=fleet-control-audit.js.map

package/dist/fleet-control-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-control-audit.js","sourceRoot":"","sources":["../src/fleet-control-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAC9C,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAC;AAEnC,gFAAgF;AAChF,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AACjD,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC7E,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AA4B/D,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,GAAsB,EAAE,GAAY;IACpE,oFAAoF;IACpF,0FAA0F;IAC1F,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;IAChE,IAAI,eAAe,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAChG,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,qEAAqE;QACrE,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC;IAC/E,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,IAAI,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QACrC,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IACD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QAAC,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACpE,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACrE,IAAI;QACJ,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;QACxD,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;QAC9C,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,OAAO,CAAC;KAC3C,CAAC;AACJ,CAAC;AAWD,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,KAAiB;IAC5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,eAAe;gBAAE,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;QACtC,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;AACvC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,QAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACjF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpF,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YACrE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAe,CAAC;gBAClD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;oBAAE,SAAS;gBAC1C,kFAAkF;gBAClF,wEAAwE;gBACxE,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB;oBAAE,SAAS;gBACtF,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACvC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,QAAQ;oBAAE,OAAO,KAAK,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACpF,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,KAAK;QACV,CAAC,CAAC,GAAG,MAAM,kBAAkB,eAAe,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,EAAE;QACpE,CAAC,CAAC,GAAG,MAAM,yIAAyI,CAAC;AACzJ,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1D,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5E,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;KAC7E,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA0B,EAAE,MAAuC,EAAE,QAAuB;IACzH,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,oBAAoB,SAAS,CAAC,MAAM,CAAC,yEAAyE;cACjH,yBAAyB,cAAc,4CAA4C,CAAC;IAC1F,CAAC;IACD,OAAO,oBAAoB,SAAS,CAAC,MAAM,CAAC,oDAAoD,QAAQ,+DAA+D;UACnK,oKAAoK,CAAC;AAC3K,CAAC;AAED,SAAS,SAAS,CAAC,MAA0B;IAC3C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,YAAY,CAAC,CAAC,OAAO,YAAY,CAAC;QACvC,KAAK,eAAe,CAAC,CAAC,OAAO,eAAe,CAAC;QAC7C,KAAK,sBAAsB,CAAC,CAAC,OAAO,wBAAwB,CAAC;QAC7D,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,MAA0B,EAC1B,IAAwC,EACxC,MAAyB,OAAO,CAAC,GAAG,EACpC,SAAoC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAErE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC3C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM;KACP,CAAC,CAAC;IACH,sFAAsF;IACtF,uFAAuF;IACvF,oEAAoE;IACpE,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,MAA4C,EAAE,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvJ,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,MAA0B,EAAE,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACrI,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ;QAC1E,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAChD,CAAC,CAAC;AACL,CAAC"}

package/dist/fleet-manager.d.ts

@@ -1,4 +1,5 @@
 import { type FleetMemory } from "./process-memory.js";
+import { MemoryPressure, type MemoryPressureSnapshot } from "./memory-pressure.js";
 import { ReplyDeduper } from "./reply-dedup.js";
 import type { FleetConfig, RawFleetConfig, InstanceConfig } from "./types.js";
 import { type DeliveryStatus, type GuildEmoji, type GuildEmojiGroup, type ResolvedStatusEmojis } from "./status-emojis.js";
@@ -123,6 +124,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     readonly lifecycle: InstanceLifecycle;
     readonly stormWindow: StormWindow;
     readonly spawnGate: SpawnGate;
+    readonly memoryPressure: MemoryPressure;
     /** Fleet-level backend reachability memory (fed by pty_error / startup panes). */
     readonly backendOutage: BackendOutageTracker;
     /** Stable for this FleetManager OS-process lifetime; Daemon objects have their own boot IDs. */
@@ -252,6 +254,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private startupRetryNotices;
     /** Unsupported-CLI refusals waiting to go out, grouped by reason (#1109). */
     private unsupportedCliNotices;
+    private kiroIncompatNotices;
     /** Backoff between automatic startup retries; the last step repeats while the backend is down. */
     static readonly STARTUP_RETRY_BACKOFF_MS: number[];
     /** Hard cap on automatic startup retries (3 backoff steps + up to 3 more during a backend outage). */
@@ -338,6 +341,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private watchdogTimer;
     private startedAt;
     private stormOpenNotifyTimer;
+    private memoryLogAt;
+    private memoryDebugAt;
+    private memoryLogLevel;
+    private memoryNoticeAt;
+    private memoryNoticeLevel;
     private mirrorBuffer;
     private mirrorTimer;
     private sseClients;
@@ -410,8 +418,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private dispatchDurableDelivery;
     private waitForDurableLaneRelease;
     private spawnConcurrency;
+    /** Separate cooldown: changing measurements must not create new text-throttle keys. */
+    private reportMemoryPressure;
     /** Wire the one fleet-wide storm into notification and recovery surfaces. */
     private bindStormWindowEvents;
+    /** What the gate allows while any storm window is open (see SpawnGate.pump). */
+    private stormWindowLossRecoveryConcurrency;
     private formatStormDelay;
     stormSuppressed(kind: string): boolean;
     private handleSighup;
@@ -464,6 +476,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     getSysInfo(): import("./fleet-context.js").SysInfo;
     /** Load fleet.yaml and build routing table */
     loadConfig(configPath: string): FleetConfig;
+    private relayLoginModeWarned;
+    /** `login.mode: relay` was removed (#1139). Still accepted so an upgrade cannot stop a fleet from starting. */
+    private warnAboutRemovedLoginMode;
     /**
      * A channel's configurable bot_token_env is an env-key writer too.  Refuse
      * an overlap with a registry API key (or a process-reserved key) before the
@@ -508,6 +523,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private isModelAdmin;
     private handlePauseWakeSlash;
+    /** SIGUSR2: restart the instances inside this process. Names who asked (#1120). */
+    private onGracefulRestartSignal;
+    /** SIGUSR1: full process reload. Names who asked (#1120). */
+    private onFullRestartSignal;
     private handleUpdateSlash;
     private handleRestartSlash;
     private handleTipsSlash;
@@ -624,6 +643,30 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     deliverToInstance(instanceName: string, payload: Record<string, unknown>, options?: DeliveryOptions): Promise<boolean | void>;
     /** Fleet admin is an explicit config allowlist entry, not merely an open/paired user. */
     isFleetAdmin(userId: string, adapterId?: string): boolean;
+    /** Whether this adapter has any fleet admin at all (an empty allowlist means the admin commands are off). */
+    hasFleetAdmins(adapterId?: string): boolean;
+    /**
+     * The one question the privileged commands (/update, /doctor, /dashboard, /collab) ask: may THIS caller,
+     * through THIS adapter, run it. `disabled` is "nobody can" — an empty list — and is told apart from
+     * `denied` only so the reply can say so. An empty list never means "everyone": these commands used to read
+     * the primary channel's list and treat empty as open, so on a fleet that had not set one anyone who could
+     * type a slash command could `/update` the host.
+     */
+    fleetAdminGate(userId: string, adapterId?: string): "ok" | "disabled" | "denied";
+    /**
+     * Every Discord slash command, for every adapter, in one place (it used to be two copies that could drift).
+     *
+     * Two checks before any command's own code runs, and the order matters: the DOOR (src/slash-authz.ts — may
+     * this caller speak here at all) and then the COMMAND TABLE (src/command-table.ts — does this command apply
+     * in this kind of channel, and which kind of admin does it need). The table can only narrow what the door
+     * let through. A command nobody registered is answered, not left to time out.
+     */
+    private dispatchSlash;
+    /**
+     * The door every Discord slash command goes through (src/slash-authz.ts has the rule and the reasoning).
+     * Answers the caller itself when it refuses, so a refused command costs one reply and does nothing else.
+     */
+    private authorizeSlash;
     /** Phase 2: delivery_worker for a target (instance override → fleet default → wake_only). */
     deliveryWorkerMode(target: string): ReturnType<typeof resolveDeliveryWorkerMode>;
     /** Active instances mid-restart: they keep their warm slot through the stop → replacement gap. */
@@ -765,6 +808,20 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * first unattended start and every scheduled retry.
      */
     private stopOnUnsupportedCli;
+    /**
+     * LifecycleContext: a kiro instance the installed kiro-cli cannot run as
+     * configured (#1109) — at start, or at a respawn after kiro-cli replaced
+     * itself. The operator already gets the plain notice; this tells every
+     * General, as an agent, so it can explain the kiro engine move when asked.
+     * One notice per refusal reason, like the operator's.
+     */
+    queueKiroIncompatNotice(name: string, reason: string): void;
+    /**
+     * Held in the delivery outbox until each General takes it: the same kiro-cli
+     * may have stopped the General too, and it should still hear once it is back.
+     * Admitted once per day per refusal (reason + names) and General.
+     */
+    private sendKiroIncompatToGenerals;
     /**
      * One notice per refusal reason: a kiro-cli that dropped the legacy UI
      * refuses every kiro instance at once, and that is one message, not ten.
@@ -893,6 +950,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
          *  reported separately because they differ by ~60x and only one of them can
          *  show a fleet-manager leak. */
         memory: FleetMemory;
+        hostMemory: MemoryPressureSnapshot;
         problems: string[];
     };
     /** Start the primary adapter (backward-compatible, sets this.adapter) */
@@ -1205,6 +1263,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private pendingCliEnvProbes;
     /** Forced vendor catalog refreshes are separate flights, but sysinfo joins either flight. */
     private pendingVendorCliEnvProbes;
+    private pendingInstanceModelProbes;
+    private readonly cliEnvProbePool;
+    private cliEnvProbeEpoch;
     /**
      * The status emojis for an instance (#1005): its own `status_emojis`, then
      * its channel's `options.status_emojis`, then the platform built-in. An
@@ -1472,7 +1533,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private receiveAdapterCallback;
     /**
      * A button from a prompt kind that no longer exists (#1131: `/install-cli`'s
-     * picker and its "sign in now?" prompt). Still on screen after an upgrade;
+     * picker and its "sign in now?" prompt; #1139: the relay login's provider picker). Still on screen after an upgrade;
      * a click gets the expired-prompt treatment — a private notice, the buttons
      * collapsed — instead of nothing.
      */
@@ -1698,16 +1759,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private isDeliveryEpochCurrent;
     /** Invalidate work queued before a user cancel and wake idle-gate waiters. */
     private cancelPendingDeliveries;
-    private activeLogin;
-    /**
-     * Web-terminal login (v2.1.5 default, `login.mode: web`). The relay code
-     * below (activeLogin/LoginSession) is `login.mode: relay`, kept for one
-     * release as the rollback lever and removed in 2.1.6.
-     */
+    /** Web-terminal login: the only sign-in path (the chat-relay mode was removed, #1139). */
     private loginController;
     /**
      * One login/install window fleet-wide. Claimed synchronously before the
-     * first await by web login, relay login and install alike (sol B1).
+     * first await by web login and install alike (sol B1).
      */
     private readonly loginWindow;
     private get webLogin();
@@ -1771,23 +1827,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     }): Promise<string | null>;
     /** Which way a `/login` went (#1131) — so the event log shows what users actually need. */
     private recordLoginFlow;
-    /** The sign-in itself (web, or the legacy relay) for a CLI that is installed. */
+    /** The sign-in itself, in the web terminal, for a CLI that is installed. */
     private launchSignIn;
-    private startRelayClaimed;
-    /** Create the login window and session (pre-check already settled). */
-    private launchLoginSession;
-    /** Fleet shutdown: end any web/relay login or install window and wait for its confirmed teardown. */
+    /** Fleet shutdown: end any web login or install window and wait for its confirmed teardown. */
     private shutdownLoginWindows;
-    /** `/login code <text>` — paste admin-supplied text into the login window. */
-    loginSubmitInput(text: string): Promise<string>;
     /** `/login cancel` — abort the active session and remove its window. */
     cancelLoginSession(): Promise<string>;
-    /**
-     * The URL (+ code) is a live credential: whoever completes it binds THEIR
-     * account to this fleet's CLI. Telegram gets an HTML spoiler (same treatment
-     * as the dashboard token); other adapters get plain text with the warning.
-     */
-    private sendLoginSecret;
     /**
      * After a successful login: wake the paused instances of that backend AND
      * restart the running ones — a live CLI holds the old token in memory and
@@ -1812,8 +1857,6 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private handleLoginConfirm;
     /** "Resend token" button (web login): only the requester may press it; the token never enters the channel. */
     private handleLoginTokenResend;
-    /** Kiro provider button → drive the CLI's arrow-key selector. */
-    private handleLoginMenuSelect;
     private activeInstall;
     /** An install that succeeded, between its success line and the sign-in it hands over to (#1131). */
     private installHandoff;
@@ -1939,6 +1982,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * previous list, never stall the command that asked for it.
      */
     private probeBackendBounded;
+    private stopCliEnvProbes;
+    private runBackendProbeWorker;
     private startCliEnvProbeWorker;
     /**
      * Resolve the effective model for a fleet or ClassicBot instance, plus where it
@@ -1955,18 +2000,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Human-readable effective model, e.g. `auto (default)`. Used by /ctx. */
     modelDisplayForInstance(instanceName: string): string;
     private modelChoiceLabel;
-    /**
-     * Probe one backend's CLI env and cache it. Best-effort; never throws.
-     *
-     * `refreshVendorCatalog` is the "🔄 Refresh models" path only (#886): first
-     * ask the CLI to refetch its own catalog, for backends whose probe merely
-     * reads a file the CLI maintains. Every other caller leaves it off, so the
-     * startup and /model probes behave exactly as before. A failed vendor
-     * refresh fails the probe (null), which the menu reports instead of passing
-     * the old list off as fresh.
-     */
-    private probeBackend;
-    /** Preserve the existing cache merge rules for both in-process and worker probes. */
+    /** Preserve the existing cache merge rules for worker probes. */
     private persistCliEnvProbeResult;
     /** Background-probe every distinct backend in use at startup (non-blocking). */
     private probeCliEnvs;