@songsid/agend 2.1.4-beta.14 → 2.1.4-beta.16

package/dist/fleet-context.d.ts

@@ -54,6 +54,8 @@ export interface FleetContext {
     readonly classicChannels: ClassicChannelManager | null;
     getSysInfo(): SysInfo;
     getInstanceStatus(name: string): "running" | "paused" | "stopped" | "crashed";
+    /** Subscription provider IDs used by running or paused fleet/Classic instances. */
+    getActiveUsageProviderIds?(): ReadonlySet<string>;
     toggleFleetCollab(instanceName: string): boolean;
     /** Apply a model to an instance (runtime paste or persist + restart). Returns a status string. */
     applyModel(instanceName: string, model: string): Promise<string>;

package/dist/fleet-manager.d.ts

@@ -273,6 +273,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     bindInstanceAdapter(name: string, adapterId: string, fromInbound?: boolean): void;
     getInstanceStatus(name: string): "running" | "paused" | "stopped" | "crashed";
     getInstanceExecutionState(name: string): InstanceState | null;
+    /**
+     * Subscription providers currently relevant to this fleet. Stopped/crashed
+     * rows do not keep a usage card alive, while persisted paused instances do.
+     * Classic channels use their effective backend merge chain, not the raw row.
+     */
+    getActiveUsageProviderIds(): ReadonlySet<string>;
     isClassicInstance(name: string): boolean;
     private cacheInstanceExecutionState;
     private cancelIdleButtonRetirement;
@@ -289,6 +295,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private enforceWarmCap;
     private waitForInstanceIdle;
+    /**
+     * Ask the daemon to capture the pane before answering, then wait for any state
+     * report produced after this request. The ordinary query is intentionally
+     * cache-only (idle gates call it frequently); this opt-in refresh is reserved
+     * for lifecycle decisions where a stale state would strand UI.
+     */
+    private refreshInstanceExecutionState;
     private deliverWithIdleGate;
     /**
      * Hand a payload to an instance's IPC, waiting out a *transient* disconnect.
@@ -712,10 +725,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private startProgressTicker;
     /**
      * After a reply: give the instance REPLY_RETIRE_GRACE_MS to resume working; if
-     * it has not, retire its button. Re-arming replaces the previous timer, so a
-     * burst of replies ends with exactly one pending check.
+     * it has not, retire its button. The daemon is asked for a fresh pane capture
+     * before deciding. Reading only the transition cache stranded the first
+     * post-restart bubble when its startup "working" report never got a matching
+     * idle edge. Re-arming replaces the previous timer, so a burst of replies ends
+     * with exactly one pending check.
      */
     private armReplyGrace;
+    private finishReplyGrace;
     /** Retire (delete) every cancel button belonging to an instance. */
     private retireInstanceButtons;
     /** Begin retiring one button (delete + bounded retry on failure). Idempotent:
@@ -999,7 +1016,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /**
      * Hot-reload: re-read fleet.yaml and reconcile running instances.
      * Starts new, stops removed, restarts modified instances.
-     * Fleet-level config (access, cost_guard, etc.) requires /restart to take effect.
+     * Whitelisted runtime fields are pushed into live daemons; all other instance
+     * fields, plus cold fleet-level settings, retain restart semantics.
      */
     private reconcileInstances;
     restartInstances(): Promise<void>;

package/dist/fleet-manager.js

@@ -3,6 +3,7 @@ import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isDeepStrictEqual } from "node:util";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
 import { beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, setUpdateProgressStage, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
@@ -42,7 +43,7 @@ import { StatuslineWatcher } from "./statusline-watcher.js";
 import { outboundHandlers } from "./outbound-handlers.js";
 import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
 import { handleViewRequest, isViewPath } from "./view-api.js";
-import { handleUsageRequest, isUsagePath } from "./usage/usage-api.js";
+import { handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
@@ -107,6 +108,8 @@ const CANCEL_BTN_IDLE_RETIRE_GRACE_MS = 2_000;
  * button alone (the idle edge retires it when the run really ends).
  */
 const REPLY_RETIRE_GRACE_MS = 2 * 60_000;
+/** Bound for the daemon to capture the pane and answer a post-reply state query. */
+const REPLY_STATE_REFRESH_TIMEOUT_MS = 2_000;
 /**
  * The daemon only broadcasts execution state on TRANSITIONS, so a long
  * single-state run sends nothing for hours. The idle backstop therefore pokes a
@@ -163,6 +166,30 @@ const DELIVERY_STATUS_EMOJIS = new Set(["👀", "⏳", "✅", "❌"]);
  * emoji never changes the documented delivery-state protocol.
  */
 const IGNORED_REACTION_EMOJIS = new Set(["📷"]);
+const HOT_INSTANCE_CONFIG_KEYS = new Set([
+    "tool_progress",
+    "mcp_proxy_reply",
+    "auto_pause_after",
+    "warm_cap",
+    "display_name",
+    "description",
+    "tags",
+    "log_level",
+]);
+function splitHotColdConfig(config) {
+    const hot = {};
+    const cold = {};
+    for (const [key, value] of Object.entries(config)) {
+        (HOT_INSTANCE_CONFIG_KEYS.has(key) ? hot : cold)[key] = value;
+    }
+    return { hot, cold };
+}
+function hotConfigUpdate(config) {
+    const update = {};
+    for (const key of HOT_INSTANCE_CONFIG_KEYS)
+        update[key] = config[key] ?? null;
+    return update;
+}
 /**
  * How long a delivery waits out a disconnected instance IPC before giving up.
  *
@@ -748,6 +775,30 @@ export class FleetManager {
             return null;
         return this.instanceStateCache.get(name)?.state ?? null;
     }
+    /**
+     * Subscription providers currently relevant to this fleet. Stopped/crashed
+     * rows do not keep a usage card alive, while persisted paused instances do.
+     * Classic channels use their effective backend merge chain, not the raw row.
+     */
+    getActiveUsageProviderIds() {
+        const providers = new Set();
+        const add = (name, backend) => {
+            const status = this.getInstanceStatus(name);
+            if (status !== "running" && status !== "paused")
+                return;
+            const provider = usageProviderIdForBackend(backend);
+            if (provider)
+                providers.add(provider);
+        };
+        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            // loadFleetConfig() has already merged the fleet default into each row.
+            add(name, config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
+        }
+        for (const channel of this.classicChannels?.getAll() ?? []) {
+            add(channel.instanceName, this.classicChannels?.getBackendByInstance(channel.instanceName, this.fleetConfig?.defaults?.backend));
+        }
+        return providers;
+    }
     isClassicInstance(name) {
         return this.classicChannels?.getAll().some(channel => channel.instanceName === name) ?? false;
     }
@@ -899,6 +950,48 @@ export class FleetManager {
             query();
         });
     }
+    /**
+     * Ask the daemon to capture the pane before answering, then wait for any state
+     * report produced after this request. The ordinary query is intentionally
+     * cache-only (idle gates call it frequently); this opt-in refresh is reserved
+     * for lifecycle decisions where a stale state would strand UI.
+     */
+    refreshInstanceExecutionState(instanceName, timeoutMs) {
+        const ipc = this.instanceIpcClients.get(instanceName);
+        if (!ipc?.connected)
+            return Promise.resolve(false);
+        const previous = this.instanceStateCache.get(instanceName);
+        return new Promise(resolve => {
+            let settled = false;
+            const finish = (refreshed) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeout);
+                const waiters = this.instanceIdleWaiters.get(instanceName);
+                waiters?.delete(check);
+                if (waiters?.size === 0)
+                    this.instanceIdleWaiters.delete(instanceName);
+                resolve(refreshed);
+            };
+            const check = () => {
+                if (this.instanceStateCache.get(instanceName) !== previous)
+                    finish(true);
+            };
+            const waiters = this.instanceIdleWaiters.get(instanceName) ?? new Set();
+            waiters.add(check);
+            this.instanceIdleWaiters.set(instanceName, waiters);
+            const timeout = setTimeout(() => finish(false), timeoutMs);
+            timeout.unref?.();
+            const sent = ipc.send({
+                type: "query_instance_state",
+                requestId: `reply-grace-${Date.now()}`,
+                refresh: true,
+            });
+            if (!sent)
+                finish(false);
+        });
+    }
     async deliverWithIdleGate(instanceName, payload, timeoutMs) {
         let idleObservedAfter = this.lastDeliveryAt.get(instanceName) ?? 0;
         if (this.lifecycle.isPaused(instanceName)) {
@@ -2334,7 +2427,7 @@ export class FleetManager {
                     const { getUsageSnapshot } = await import("./usage/usage-api.js");
                     const { renderUsageMarkdown } = await import("./usage/format-rich.js");
                     // slash_command is Discord-only; editReply renders Markdown natively.
-                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot(false, this.getActiveUsageProviderIds())));
                 }
                 catch (err) {
                     await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
@@ -2636,7 +2729,7 @@ export class FleetManager {
                     const { getUsageSnapshot } = await import("./usage/usage-api.js");
                     const { renderUsageMarkdown } = await import("./usage/format-rich.js");
                     // slash_command is Discord-only; editReply renders Markdown natively.
-                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot(false, this.getActiveUsageProviderIds())));
                 }
                 catch (err) {
                     await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
@@ -5424,8 +5517,11 @@ export class FleetManager {
     }
     /**
      * After a reply: give the instance REPLY_RETIRE_GRACE_MS to resume working; if
-     * it has not, retire its button. Re-arming replaces the previous timer, so a
-     * burst of replies ends with exactly one pending check.
+     * it has not, retire its button. The daemon is asked for a fresh pane capture
+     * before deciding. Reading only the transition cache stranded the first
+     * post-restart bubble when its startup "working" report never got a matching
+     * idle edge. Re-arming replaces the previous timer, so a burst of replies ends
+     * with exactly one pending check.
      */
     armReplyGrace(instanceName) {
         for (const entry of this.cancelButtons.values()) {
@@ -5437,14 +5533,26 @@ export class FleetManager {
                 entry.replyGraceTimer = undefined;
                 if (!this.cancelButtons.has(entry.messageId))
                     return;
-                if (!this.getInstanceIdle(instanceName))
-                    return; // resumed — a long run keeps its button
-                this.logger.info({ instanceName, messageId: entry.messageId }, "Cancel button retired — no work resumed after reply");
-                this.retireButton(entry);
+                void this.finishReplyGrace(instanceName, entry);
             }, REPLY_RETIRE_GRACE_MS);
             entry.replyGraceTimer.unref?.();
         }
     }
+    async finishReplyGrace(instanceName, entry) {
+        const refreshed = await this.refreshInstanceExecutionState(instanceName, REPLY_STATE_REFRESH_TIMEOUT_MS);
+        if (!this.cancelButtons.has(entry.messageId) || entry.retiring)
+            return;
+        if (!refreshed) {
+            // Fail safe: without an authoritative answer, retain a potentially live
+            // Cancel button. The 5-minute/30-minute/24-hour safety nets still apply.
+            this.logger.debug({ instanceName, messageId: entry.messageId }, "Cancel reply-grace state refresh timed out");
+            return;
+        }
+        if (!this.getInstanceIdle(instanceName))
+            return; // genuine long run keeps its button
+        this.logger.info({ instanceName, messageId: entry.messageId }, "Cancel button retired — no work resumed after reply");
+        this.retireButton(entry);
+    }
     /** Retire (delete) every cancel button belonging to an instance. */
     retireInstanceButtons(instanceName) {
         // Snapshot first — retireButton may delete entries from the map on success.
@@ -7580,7 +7688,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /**
      * Hot-reload: re-read fleet.yaml and reconcile running instances.
      * Starts new, stops removed, restarts modified instances.
-     * Fleet-level config (access, cost_guard, etc.) requires /restart to take effect.
+     * Whitelisted runtime fields are pushed into live daemons; all other instance
+     * fields, plus cold fleet-level settings, retain restart semantics.
      */
     async reconcileInstances() {
         if (!this.configPath)
@@ -7634,9 +7743,16 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.scheduler?.reload();
         const newInstances = this.fleetConfig.instances;
         const topicMode = this.fleetConfig?.channel?.mode === "topic";
-        // Detect fleet-level config changes and warn
-        const oldFleetLevel = JSON.stringify({ channel: oldConfig?.channel, defaults: oldConfig?.defaults });
-        const newFleetLevel = JSON.stringify({ channel: this.fleetConfig?.channel, defaults: this.fleetConfig?.defaults });
+        // Detect fleet-level changes which still need a restart. Hot defaults are
+        // reconciled below and must not produce a misleading restart warning.
+        const oldDefaultCold = oldConfig?.defaults
+            ? splitHotColdConfig(oldConfig.defaults).cold
+            : {};
+        const newDefaultCold = this.fleetConfig?.defaults
+            ? splitHotColdConfig(this.fleetConfig.defaults).cold
+            : {};
+        const oldFleetLevel = JSON.stringify({ channel: oldConfig?.channel, defaults: oldDefaultCold });
+        const newFleetLevel = JSON.stringify({ channel: this.fleetConfig?.channel, defaults: newDefaultCold });
         if (oldFleetLevel !== newFleetLevel) {
             this.logger.warn("Fleet-level config changed (channel/defaults) — use /restart for full effect");
         }
@@ -7648,7 +7764,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 await this.stopInstance(name).catch(err => this.logger.error({ err, name }, "Failed to stop removed instance"));
             }
         }
-        // Start new + restart modified instances
+        // Start new + reconcile modified instances. Hot values are always sent as a
+        // complete snapshot: Settings mutates FleetManager's config before SIGHUP,
+        // so an old/new diff alone can miss the live daemon's stale value.
         for (const [name, config] of Object.entries(newInstances)) {
             if (!this.daemons.has(name)) {
                 // New instance — startInstance already calls connectIpcToInstance
@@ -7656,14 +7774,33 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 await this.startInstance(name, config, topicMode).catch(err => this.logger.error({ err, name }, "Failed to start new instance"));
             }
             else if (oldConfig?.instances[name]) {
-                // Restart if any config field changed
-                if (JSON.stringify(oldConfig.instances[name]) !== JSON.stringify(config)) {
+                const daemon = this.daemons.get(name);
+                const runtimeConfig = daemon.getConfigSnapshot?.() ?? oldConfig.instances[name];
+                const oldParts = splitHotColdConfig(runtimeConfig);
+                const newParts = splitHotColdConfig(config);
+                // Every field not explicitly classified hot is cold by default.
+                if (!isDeepStrictEqual(oldParts.cold, newParts.cold)) {
                     this.logger.info({ name }, "Instance config changed — restarting");
                     await this.stopInstance(name).catch(() => { });
                     await this.startInstance(name, config, topicMode).catch(err => this.logger.error({ err, name }, "Failed to restart modified instance"));
                 }
+                else if (!isDeepStrictEqual(oldParts.hot, newParts.hot)) {
+                    const update = hotConfigUpdate(config);
+                    const ipc = this.instanceIpcClients.get(name);
+                    const sent = ipc?.connected === true && ipc.send({ type: "config_update", config: update });
+                    if (!sent) {
+                        // Daemon is in-process, so a reconnect gap must not leave runtime
+                        // state stale. Normal operation still uses the explicit IPC contract.
+                        daemon.applyConfigUpdate(update);
+                        this.logger.warn({ name }, "Config-update IPC unavailable — applied hot config in-process");
+                    }
+                    this.logger.info({ name, fields: [...HOT_INSTANCE_CONFIG_KEYS] }, "Instance hot config reloaded");
+                }
             }
         }
+        // warm_cap is fleet-owned; enforce the reloaded value immediately against
+        // currently idle instances instead of waiting for a future state edge.
+        this.enforceWarmCap();
         this.logger.info({ running: this.daemons.size, configured: Object.keys(newInstances).length }, "Reconcile complete");
     }
     async restartInstances() {