@songsid/agend 2.1.2-beta.28 → 2.1.2-beta.29

package/dist/fleet-manager.js

@@ -4,6 +4,7 @@ import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
+import { clearUpdateMarker, isUpdateInProgress } from "./update-marker.js";
 import { sdNotify, sdNotifyBlocking } from "./sd-notify.js";
 import { readFleetMemory } from "./process-memory.js";
 import { ReplyDeduper } from "./reply-dedup.js";
@@ -237,6 +238,8 @@ export class FleetManager {
     failoverActive = new Map(); // instance → current failover model
     // IPC reconnect: tracks instances being intentionally stopped (skip reconnect)
     ipcStoppingInstances = new Set();
+    /** Set the moment a graceful stop begins — see isPlannedRestart(). */
+    shuttingDown = false;
     /** Coalesce concurrent connection attempts for the same daemon socket. */
     ipcConnectInFlight = new Map();
     /** At most one reconnect/backoff loop may exist per instance. */
@@ -306,8 +309,24 @@ export class FleetManager {
             }
         });
     }
+    /**
+     * Is the fleet going down (or coming back up) on purpose?
+     *
+     * Instances dying during a planned restart is the restart working, not an
+     * incident — but the code that notices a dead pane or a dead MCP server
+     * cannot tell the difference on its own. Two sources, because the noise
+     * starts before this process is even told to stop: `agend update` replaces
+     * the package on disk while this daemon is still running and still watching.
+     */
+    isPlannedRestart() {
+        return this.shuttingDown || isUpdateInProgress(this.dataDir);
+    }
     finishStartup() {
         this.startupComplete = true;
+        // We are the post-update fleet: the update is over by definition. Clearing
+        // it here (rather than in the update command, which exits before the new
+        // fleet is up) is what keeps the quiet window from outliving the restart.
+        clearUpdateMarker(this.dataDir);
         if (this.reloadPending)
             this.scheduleReconcile();
         void this.sweepOrphanedCancelButtons();
@@ -1034,6 +1053,9 @@ export class FleetManager {
     async startAll(configPath) {
         FleetManager.signalTarget = this;
         this.startupComplete = false;
+        // Cleared here, not at the end of doStopAll: a stop has an async tail, and
+        // anything arriving during it is still part of the stop.
+        this.shuttingDown = false;
         this.configPath = configPath;
         this.loadEnvFile();
         // Rotate fleet.log if oversized (before any logging)
@@ -5995,6 +6017,10 @@ When users create specialized instances, suggest these configurations:
     async doStopAll() {
         this.startupComplete = false;
         this.reloadPending = false;
+        // Before anything is stopped: everything that dies from here on dies
+        // because we asked it to. Set synchronously — doStopAll runs to its first
+        // await in the same tick as the signal handler, so no event can slip in.
+        this.shuttingDown = true;
         this.ipcStoppingInstances.add("__fleet_stopping__");
         sdNotifyBlocking("STOPPING=1");
         if (this.watchdogTimer) {