@songsid/agend 2.1.2-beta.9 → 2.1.2

package/dist/general-instance.d.ts

@@ -0,0 +1,9 @@
+import type { FleetConfig } from "./types.js";
+/** Stable user-facing error shared by every manual pause entry point. */
+export declare const GENERAL_PAUSE_ERROR = "General cannot be paused";
+/**
+ * General is a coordinator, not an expendable worker. The literal-name fallback
+ * preserves the same legacy protection already used by Daemon auto-pause while
+ * general_topic covers renamed and per-world General instances.
+ */
+export declare function isGeneralInstance(config: FleetConfig | null | undefined, name: string): boolean;

package/dist/general-instance.js

@@ -0,0 +1,11 @@
+/** Stable user-facing error shared by every manual pause entry point. */
+export const GENERAL_PAUSE_ERROR = "General cannot be paused";
+/**
+ * General is a coordinator, not an expendable worker. The literal-name fallback
+ * preserves the same legacy protection already used by Daemon auto-pause while
+ * general_topic covers renamed and per-world General instances.
+ */
+export function isGeneralInstance(config, name) {
+    return name === "general" || config?.instances[name]?.general_topic === true;
+}
+//# sourceMappingURL=general-instance.js.map

package/dist/general-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"general-instance.js","sourceRoot":"","sources":["../src/general-instance.ts"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAsC,EAAE,IAAY;IACpF,OAAO,IAAI,KAAK,SAAS,IAAI,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;AAC/E,CAAC"}

package/dist/general-knowledge/skills/cross-instance-messaging/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: cross-instance-messaging
+description: Fire-and-queue cross-instance tools — send once, never resend on queued
+---
+
+## How to send
+
+Use fleet tools only (`send_to_instance`, `delegate_task`, `request_information`, `report_result`, `broadcast`):
+- Call returns immediately: `{ sent: true, queued: true }` — success, fleet owns delivery.
+- **Do not wait** for the target to go idle; **do not** treat 30s IPC timeout as failure to re-send.
+- **Error only if the target does not exist** (or similar hard reject) — then fix the name, don't spam.
+- **Never re-send because the reply said `queued`** — that means the message is already queued.
+
+## requires_reply
+
+- Means “target should later answer with `report_result` / a real reply”
+- **Not** a synchronous wait for their turn to finish
+
+## Task flow
+
+- `delegate_task` → silent work → `report_result` (zero ack-only pings)
+- Cross-instance traffic is `[from:name]` → answer with `send_to_instance` / `report_result`, never `reply`

package/dist/general-knowledge/skills/model-discovery/SKILL.md

@@ -1,36 +1,27 @@
 ---
 name: model-discovery
-description: List available models per backend, configure model in fleet.yaml
+description: Set and discover models — pass-through to the CLI, no AgEnD allowlist gate
 ---
 
-## Model Names by Backend
+## How to set a model
 
-Models are specified in fleet.yaml `defaults.model` or per-instance `model` field.
+- fleet.yaml: `defaults.model` or per-instance `model`
+- **Pass-through:** AgEnD no longer blocks unknown model ids — it may **warn**, then still pass the string to the CLI
+- **CLI is source of truth** — if the model is invalid, the backend CLI errors (fix the name there)
 
-| Backend | How to list models | Default |
-|---------|-------------------|---------|
-| **kiro-cli** | In tmux: send `/model` + Enter → read model list → Esc to close | auto (latest) |
-| **claude-code** | `sonnet`, `opus`, `haiku`, `opusplan`, `best`, `sonnet[1m]`, `opus[1m]` | sonnet |
-| **antigravity** | Run `agy models` to see available models | Gemini 3.5 Flash (Medium) |
-| **codex** | `gpt-4o`, `o3`, `o4-mini` | gpt-4o |
-| **opencode** | `opencode models` | depends on provider |
-| **grok** | `grok-4.5`, `grok-4.3`, `grok-code`, `grok-build-0.1` | grok default |
+## Discover real names
 
-**Important for antigravity (agy):**
-- `agy models` shows names like `Gemini 3.5 Flash (Medium)` — the parenthetical suffix (Medium/High/Low/Thinking) is the **effort level**, NOT part of the model name.
-- When setting model in fleet.yaml, use only the base name WITHOUT the effort suffix.
-- Example: `agy models` shows `Gemini 3.5 Flash (Medium)` → set `model: "Gemini 3.5 Flash"`
-- Example: `agy models` shows `Claude Opus 4.6 (Thinking)` → set `model: "Claude Opus 4.6"`
+| Backend | How |
+|---------|-----|
+| kiro-cli | In pane: `/model` (gpt-*, deepseek-*, minimax-*, glm-*, qwen* supported) |
+| claude-code | `sonnet` / `opus` / `haiku` / `opusplan` / `Fable` / aliases |
+| codex | pane `/model` or docs (`gpt-*`, `o*`) |
+| grok | `grok models` |
+| antigravity | `agy models` — set **base name only** (drop `(Medium)` / `(Thinking)` effort suffix) |
+| opencode | `opencode models` |
 
-**Important:** Model names vary by backend. Always check the actual CLI output rather than guessing names.
-
-Example fleet.yaml:
 ```yaml
 defaults:
   backend: kiro-cli
   model: claude-sonnet-4-20250514
-
-instances:
-  heavy-task:
-    model: claude-opus-4-20250514
 ```

package/dist/general-knowledge/skills/session-management/SKILL.md

@@ -1,46 +1,27 @@
 ---
 name: session-management
-description: Where kiro-cli and claude-code store sessions, and how to fork one to a new instance
+description: Session stores, forking, and auth-pause recovery
 ---
 
+## Auth failure (auto-pause)
+
+When AgEnD sees `auth_error` it **pauses** that instance (`pausePending` sticky):
+- One notification **per backend** (not per instance) — log in once, same-backend peers recover.
+- Auth is **per-user global** across backends: claude-code, codex, kiro, grok, opencode, antigravity.
+- Messages while paused stay in the **queue** — do not re-send.
+- After the user re-auths: `wake` / normal wake clears `pausePending`.
+
 ## Where sessions live
 
 | | kiro-cli | claude-code |
 |---|---|---|
 | Store | `~/.kiro/sessions/cli/<uuid>.json` | `~/.claude/projects/<path-encoded>/*.jsonl` |
-| Keyed by | session uuid | project (working) directory |
-| Reload | `/chat load <file>` | none — `--continue` (latest for the dir) / `--resume <id>` |
-| Text export | — | `/export` (plain text, **not** reloadable) |
-
-`<path-encoded>` = the absolute working_directory with `/` → `-`
-(e.g. `/home/han/Projects/AgEnD` → `-home-han-Projects-AgEnD`).
-
-## Fork a session to a new instance
-
-Confirm the source is **idle** first (`describe_instance` / `get_fleet_status`) — don't fork mid-task.
-
-**kiro-cli** — save, copy, load:
-1. On the source, save: `/chat save <name>.json -f` (paste via tmux if needed).
-2. `create_instance` (same backend).
-3. `cp ~/.agend/workspaces/<source>/<name>.json ~/.agend/workspaces/<target>/`
-4. Load on the target: `/chat load <name>.json`, or set `pre_task_command: "/chat load <name>.json"`.
-
-**claude-code** — copy the `.jsonl` (no save/load command):
-1. Newest source session: `ls -lt ~/.claude/projects/<source-encoded>/*.jsonl | head`
-2. `create_instance` (backend `claude-code`); note its working_directory.
-3. Copy into the target's encoded project dir:
-   ```bash
-   TARGET_ENC="$(echo '<target-working-dir>' | sed 's#/#-#g')"
-   mkdir -p ~/.claude/projects/$TARGET_ENC
-   cp ~/.claude/projects/<source-encoded>/<session>.jsonl ~/.claude/projects/$TARGET_ENC/
-   ```
-4. Start the target — claude-code resumes the newest `.jsonl` via `--continue`.
+| Reload | `/chat load <file>` | `--continue` / `--resume <id>` |
 
-**Caveats:** a claude-code session only truly makes sense under its original working_directory
-(paths inside the transcript refer to it). Pick the right `.jsonl` if several exist (newest by
-mtime; compaction/branches create new files). `/export` is text only, not reloadable.
+`<path-encoded>` = absolute cwd with `/` → `-`.
 
-## Backup
+## Fork (source must be idle)
 
-Sessions are plain files — back them up by copying the store paths above
-(e.g. `cp ~/.kiro/sessions/cli/*.json <dest>/`). Only copy while the instance is idle.
+- **kiro:** `/chat save name.json -f` → `create_instance` → copy workspace file → `/chat load name.json`
+- **claude-code:** copy newest `*.jsonl` into target's encoded project dir → start (uses `--continue`)
+- Prefer `replace_instance` when the whole session is poisoned (see instance-lifecycle)

package/dist/hang-detector.d.ts

@@ -1,16 +1,22 @@
 import { EventEmitter } from "node:events";
+/**
+ * Carries "this instance looks hung" from the daemon to the fleet manager.
+ *
+ * It is only an event bridge. Hang detection itself lives in the daemon's pane-state
+ * machine, which emits `hang` directly when a pane stops changing for the configured
+ * stuck timeout; `instance-lifecycle` subscribes to that and notifies.
+ *
+ * It used to also contain a silence-timer state machine — `start()`, `isHung()`,
+ * `hungEmitted`, and timestamps fed by `recordActivity` / `recordInbound` /
+ * `recordStatuslineUpdate`. None of it ran: `start()` was never called from
+ * anywhere, so `isHung()` was unreachable, the timestamps were written and never
+ * read, and the constructor's `timeoutMinutes` was ignored (the real stuck timeout
+ * is read separately by the pane monitor). Its tests exercised that dead logic —
+ * two had identical setup with contradictory expectations, which can only pass
+ * unnoticed when neither runs against anything real.
+ *
+ * Kept as a named class rather than a bare EventEmitter so the daemon → lifecycle
+ * wiring stays typed and greppable.
+ */
 export declare class HangDetector extends EventEmitter {
-    private lastActivityTs;
-    private lastStatuslineTs;
-    private lastInboundTs;
-    private hungEmitted;
-    private checkTimer;
-    private timeoutMs;
-    constructor(timeoutMinutes: number);
-    recordActivity(): void;
-    recordInbound(): void;
-    recordStatuslineUpdate(): void;
-    isHung(): boolean;
-    start(intervalMs?: number): void;
-    stop(): void;
 }

package/dist/hang-detector.js

@@ -1,53 +1,23 @@
 import { EventEmitter } from "node:events";
+/**
+ * Carries "this instance looks hung" from the daemon to the fleet manager.
+ *
+ * It is only an event bridge. Hang detection itself lives in the daemon's pane-state
+ * machine, which emits `hang` directly when a pane stops changing for the configured
+ * stuck timeout; `instance-lifecycle` subscribes to that and notifies.
+ *
+ * It used to also contain a silence-timer state machine — `start()`, `isHung()`,
+ * `hungEmitted`, and timestamps fed by `recordActivity` / `recordInbound` /
+ * `recordStatuslineUpdate`. None of it ran: `start()` was never called from
+ * anywhere, so `isHung()` was unreachable, the timestamps were written and never
+ * read, and the constructor's `timeoutMinutes` was ignored (the real stuck timeout
+ * is read separately by the pane monitor). Its tests exercised that dead logic —
+ * two had identical setup with contradictory expectations, which can only pass
+ * unnoticed when neither runs against anything real.
+ *
+ * Kept as a named class rather than a bare EventEmitter so the daemon → lifecycle
+ * wiring stays typed and greppable.
+ */
 export class HangDetector extends EventEmitter {
-    lastActivityTs = 0;
-    lastStatuslineTs = 0;
-    lastInboundTs = 0;
-    hungEmitted = false;
-    checkTimer = null;
-    timeoutMs;
-    constructor(timeoutMinutes) {
-        super();
-        this.timeoutMs = timeoutMinutes * 60 * 1000;
-    }
-    recordActivity() {
-        this.lastActivityTs = Date.now();
-        if (this.hungEmitted) {
-            this.hungEmitted = false;
-        }
-    }
-    recordInbound() {
-        this.lastInboundTs = Date.now();
-    }
-    recordStatuslineUpdate() {
-        this.lastStatuslineTs = Date.now();
-    }
-    isHung() {
-        if (this.lastActivityTs === 0)
-            return false;
-        if (this.lastInboundTs === 0)
-            return false;
-        const now = Date.now();
-        // Only flag as hung if:
-        // 1. There's an inbound that hasn't been answered (no activity since inbound)
-        // 2. Timeout has elapsed since that inbound
-        const noActivitySinceInbound = this.lastActivityTs < this.lastInboundTs;
-        const stale = now - this.lastInboundTs > this.timeoutMs;
-        return stale && noActivitySinceInbound;
-    }
-    start(intervalMs = 60_000) {
-        this.checkTimer = setInterval(() => {
-            if (this.isHung() && !this.hungEmitted) {
-                this.hungEmitted = true;
-                this.emit("hang");
-            }
-        }, intervalMs);
-    }
-    stop() {
-        if (this.checkTimer) {
-            clearInterval(this.checkTimer);
-            this.checkTimer = null;
-        }
-    }
 }
 //# sourceMappingURL=hang-detector.js.map

package/dist/hang-detector.js.map

@@ -1 +1 @@
-{"version":3,"file":"hang-detector.js","sourceRoot":"","sources":["../src/hang-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,OAAO,YAAa,SAAQ,YAAY;IACpC,cAAc,GAAG,CAAC,CAAC;IACnB,gBAAgB,GAAG,CAAC,CAAC;IACrB,aAAa,GAAG,CAAC,CAAC;IAClB,WAAW,GAAG,KAAK,CAAC;IACpB,UAAU,GAA0C,IAAI,CAAC;IACzD,SAAS,CAAS;IAE1B,YAAY,cAAsB;QAChC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,SAAS,GAAG,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9C,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,aAAa;QACX,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;IAED,sBAAsB;QACpB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;IAED,MAAM;QACJ,IAAI,IAAI,CAAC,cAAc,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,wBAAwB;QACxB,8EAA8E;QAC9E,4CAA4C;QAC5C,MAAM,sBAAsB,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QACxE,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC;QACxD,OAAO,KAAK,IAAI,sBAAsB,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,UAAU,GAAG,MAAM;QACvB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"hang-detector.js","sourceRoot":"","sources":["../src/hang-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,YAAa,SAAQ,YAAY;CAAG"}

package/dist/instance-lifecycle.d.ts

@@ -5,6 +5,7 @@ import type { IpcClient } from "./channel/ipc-bridge.js";
 import type { EventLog } from "./event-log.js";
 import type { TmuxControlClient } from "./tmux-control.js";
 import type { FleetInstructionsParams } from "./instructions.js";
+export { isFleetStartCommandLine } from "./fleet-lock.js";
 export interface BackendInstallationInfo {
     binary: string;
     install: string;
@@ -13,8 +14,6 @@ export interface BackendInstallationInfo {
 export declare const BACKEND_INSTALLATION_INFO: Readonly<Record<string, BackendInstallationInfo>>;
 /** Check one executable using the same PATH visible to the fleet process. */
 export declare function checkBinaryInstalled(binary: string): boolean;
-/** Whether a process command line identifies the shared AgEnD fleet process. */
-export declare function isFleetStartCommandLine(commandLine: string): boolean;
 /**
  * Return why an instance daemon PID must not receive SIGTERM, or null when the
  * stale-process cleanup may proceed. daemon.pid historically stores the shared
@@ -50,6 +49,10 @@ export interface LifecycleContext {
     touchActivity(name: string): void;
     sendHangNotification(name: string, unchangedForMs?: number): Promise<void>;
     notifyInstanceTopic(name: string, text: string): void;
+    /** True for a dynamic ClassicBot channel instance (not a fleet topic). */
+    isClassicInstance?(name: string): boolean;
+    /** True while the fleet is stopping on purpose or an `agend update` is running. */
+    isPlannedRestart(): boolean;
     /** List claimed tasks for an instance (from task board). Returns empty array if unavailable. */
     listClaimedTasks(assignee: string): Array<{
         id: string;
@@ -64,6 +67,11 @@ export interface LifecycleContext {
     reactMessageStatus(instanceName: string, chatId: string, messageId: string, emoji: string): void;
     startPersistedPausedInstance(name: string): Promise<void>;
 }
+/** What attachIncidentHandlers needs from a Daemon — the real one satisfies it. */
+export interface IncidentEventSource {
+    on(event: string, handler: (...args: any[]) => void): unknown;
+    requestPauseWhenIdle(): void;
+}
 /** Arguments accepted by handleCreate — mirrors CreateInstanceArgs in outbound-schemas.ts
  *  plus internal-only fields forwarded by deploy_template (profile-derived). */
 export interface LifecycleCreateArgs {
@@ -99,7 +107,55 @@ export declare class InstanceLifecycle {
     private ctx;
     /** Active daemon processes: instanceName → Daemon */
     readonly daemons: Map<string, import("./daemon.js").Daemon>;
+    /** backend → last auth-error alert time, so one expiry sends one alert. */
+    private lastAuthAlertAt;
+    /**
+     * Minimum gap between MCP-revival auto-restarts of one instance. Kept here —
+     * not in the daemon — because each restart replaces the daemon object, which
+     * would take an in-daemon cooldown with it and allow a tight restart loop.
+     */
+    private static readonly MCP_AUTO_RESTART_COOLDOWN_MS;
+    /** instanceName → time of the last MCP-revival auto-restart. */
+    private mcpAutoRestartAt;
     constructor(ctx: LifecycleContext);
+    /**
+     * Report an incident to the user — unless the fleet is deliberately going
+     * down, in which case the "incident" is the shutdown doing its job.
+     *
+     * `agend update` stops instances, kills their MCP servers and restarts the
+     * daemon; every one of those looked like a crash to the alert path, so an
+     * upgrade produced a burst of ⚠️ for things that were working correctly. That
+     * burst is worse than noise: it teaches the operator to ignore the same alert
+     * that matters when a process really does die on its own.
+     *
+     * The event log and daemon.log entries still happen at the call sites — this
+     * suppresses the chat message, not the record. A crash outside a planned
+     * restart notifies exactly as before.
+     */
+    private notifyIncident;
+    /** Backend a running instance uses (config → fleet default). */
+    private backendOf;
+    /**
+     * One alert per backend per cooldown, naming every affected instance — a CLI's
+     * credentials are shared, so N instances failing is ONE problem with ONE fix
+     * (re-login once). The per-instance daemon cooldown can't dedupe across
+     * instances, so the fleet-level map does it here.
+     */
+    private notifyAuthErrorOnce;
+    /**
+     * System errors from a ClassicBot belong in the operator's General topic,
+     * never in the end user's chat channel. Fleet-topic instances retain their
+     * existing local notification target.
+     */
+    private ptyErrorNotificationTarget;
+    /**
+     * Handlers for the events that mean "something went wrong".
+     *
+     * Extracted from start() so the planned-restart suppression can be exercised
+     * against a plain event emitter — the alternative is a real Daemon, which
+     * means a real tmux window, which is why this rule went untested before.
+     */
+    attachIncidentHandlers(name: string, daemon: IncidentEventSource): void;
     start(name: string, config: InstanceConfig, topicMode: boolean, runtimeIdentity?: FleetInstructionsParams["runtimeIdentity"]): Promise<void>;
     isPaused(name: string): boolean;
     getLastPausedAt(name: string): number | null;