@songsid/agend 2.1.4-beta.25 → 2.1.4-beta.26

package/dist/channel/types.d.ts

@@ -10,7 +10,7 @@ export interface InstanceStatusData {
     costCents: number;
 }
 export interface AlertData {
-    type: "hang" | "cost_warn" | "cost_limit" | "schedule_deferred" | "rotation" | "cancel" | "interactive_prompt" | "exit_restart" | "clear_confirm" | "tip";
+    type: "hang" | "cost_warn" | "cost_limit" | "schedule_deferred" | "rotation" | "cancel" | "interactive_prompt" | "exit_restart" | "clear_confirm" | "tip" | "login";
     instanceName: string;
     message: string;
     choices?: Choice[];

package/dist/fleet-context.d.ts

@@ -93,6 +93,29 @@ export interface FleetContext {
     promptTip?(generalName: string, adapter: import("./channel/types.js").ChannelAdapter, chatId: string, threadId?: string): Promise<"posted" | "empty" | "unavailable">;
     /** Persistently enable advanced tips without waiting for the dismissal threshold. */
     unlockAdvancedTips?(userId: string): boolean;
+    /** `/login` backend chooser buttons. Caller enforces fleet-admin. */
+    promptLoginBackends?(chat: {
+        adapter: import("./channel/types.js").ChannelAdapter;
+        adapterId: string;
+        chatId: string;
+        threadId?: string;
+    }): Promise<void>;
+    /**
+     * Start a remote login session for one backend; returns a status line, or
+     * null when a still-valid-auth confirmation prompt was posted instead.
+     */
+    startLoginSession?(backend: string, chat: {
+        adapter: import("./channel/types.js").ChannelAdapter;
+        adapterId: string;
+        chatId: string;
+        threadId?: string;
+    }, opts?: {
+        skipAuthCheck?: boolean;
+    }): Promise<string | null>;
+    /** Paste admin-supplied text (auth code / start URL) into the login window. */
+    loginSubmitInput?(text: string): Promise<string>;
+    /** Abort the active login session. */
+    cancelLoginSession?(): Promise<string>;
     /** Human-readable effective model for an instance (resolves inherited defaults). */
     modelDisplayForInstance?(name: string): string;
     /**

package/dist/fleet-manager.d.ts

@@ -811,6 +811,52 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private isDeliveryEpochCurrent;
     /** Invalidate work queued before a user cancel and wake idle-gate waiters. */
     private cancelPendingDeliveries;
+    private activeLogin;
+    /** Post the backend chooser for a bare `/login`. Caller enforces admin. */
+    promptLoginBackends(chat: {
+        adapter: ChannelAdapter;
+        adapterId: string;
+        chatId: string;
+        threadId?: string;
+    }): Promise<void>;
+    /**
+     * Start a login session for one backend. Caller enforces admin.
+     * Returns a status line to post, or null when a confirmation prompt was
+     * posted instead (auth still valid — see the pre-check below).
+     */
+    startLoginSession(backendArg: string, chat: {
+        adapter: ChannelAdapter;
+        adapterId: string;
+        chatId: string;
+        threadId?: string;
+    }, opts?: {
+        skipAuthCheck?: boolean;
+    }): Promise<string | null>;
+    /** Create the login window and session (pre-check already settled). */
+    private launchLoginSession;
+    /** `/login code <text>` — paste admin-supplied text into the login window. */
+    loginSubmitInput(text: string): Promise<string>;
+    /** `/login cancel` — abort the active session and remove its window. */
+    cancelLoginSession(): Promise<string>;
+    /**
+     * The URL (+ code) is a live credential: whoever completes it binds THEIR
+     * account to this fleet's CLI. Telegram gets an HTML spoiler (same treatment
+     * as the dashboard token); other adapters get plain text with the warning.
+     */
+    private sendLoginSecret;
+    /**
+     * After a successful login: wake the paused instances of that backend AND
+     * restart the running ones — a live CLI holds the old token in memory and
+     * only re-reads credentials on process start (a paused instance's CLI is
+     * already dead, so waking it respawns with the new token for free).
+     */
+    private recoverBackendInstances;
+    /** Backend chooser button → start that backend's login session. */
+    private handleLoginBackendSelect;
+    /** Re-login confirmation (auth pre-check said credentials still work). */
+    private handleLoginConfirm;
+    /** Kiro provider button → drive the CLI's arrow-key selector. */
+    private handleLoginMenuSelect;
     queueMirrorMessage(text: string): void;
     /** Push an SSE event to all connected Web UI clients. */
     emitSseEvent(event: string, data: unknown): void;

package/dist/fleet-manager.js

@@ -44,6 +44,8 @@ import { outboundHandlers } from "./outbound-handlers.js";
 import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
 import { handleViewRequest, isViewPath } from "./view-api.js";
 import { handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
+import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
+import { LoginSession } from "./login-manager.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
@@ -209,6 +211,9 @@ const HANG_CALLBACK_PREFIX = "hang:";
 const CLEAR_CONFIRM_CALLBACK_PREFIX = "clear-confirm:";
 const TIP_DISMISS_CALLBACK_PREFIX = "tip-dismiss:";
 const TIP_UNLOCK_CALLBACK_PREFIX = "tip-unlock:";
+const LOGIN_CALLBACK_PREFIX = "login:";
+const LOGIN_MENU_CALLBACK_PREFIX = "login-menu:";
+const LOGIN_CONFIRM_CALLBACK_PREFIX = "login-confirm:";
 const CLEAR_CONFIRM_TIMEOUT_MS = 15_000;
 /** Default lifetime for long-lived nonce prompts (clear overrides this to 15s). */
 const NONCE_BUTTON_TIMEOUT_MS = 15 * 60_000;
@@ -2364,6 +2369,12 @@ export class FleetManager {
                 return;
             if (await this.handleTipUnlock(data, adapterId, this.adapter ?? undefined))
                 return;
+            if (await this.handleLoginBackendSelect(data, adapterId, this.adapter ?? undefined))
+                return;
+            if (await this.handleLoginMenuSelect(data, adapterId, this.adapter ?? undefined))
+                return;
+            if (await this.handleLoginConfirm(data, adapterId, this.adapter ?? undefined))
+                return;
             if (await this.handleClearConfirmation(data, adapterId, this.adapter ?? undefined))
                 return;
             if (await this.handleExitRestartPrompt(data, adapterId, this.adapter ?? undefined))
@@ -2737,6 +2748,12 @@ export class FleetManager {
                 return;
             if (await this.handleTipUnlock(data, adapterId, adapter))
                 return;
+            if (await this.handleLoginBackendSelect(data, adapterId, adapter))
+                return;
+            if (await this.handleLoginMenuSelect(data, adapterId, adapter))
+                return;
+            if (await this.handleLoginConfirm(data, adapterId, adapter))
+                return;
             if (await this.handleClearConfirmation(data, adapterId, adapter))
                 return;
             if (await this.handleExitRestartPrompt(data, adapterId, adapter))
@@ -6175,6 +6192,261 @@ export class FleetManager {
             check();
         return next;
     }
+    // ── Remote CLI login (`/login`) ──────────────────────────────────────────
+    //
+    // One session at a time, in a dedicated tmux window — never an instance
+    // pane. Credentials are per-backend (codex homes symlink auth.json to the
+    // shared ~/.codex; the other CLIs use one real home), so a single sign-in
+    // repairs every instance of that backend, and instance delivery, pane-state
+    // detection, tool progress, and mcp_proxy_reply never observe login output.
+    activeLogin = null;
+    /** Post the backend chooser for a bare `/login`. Caller enforces admin. */
+    async promptLoginBackends(chat) {
+        const configured = new Set();
+        for (const [, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            configured.add(config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
+        }
+        const choices = Object.keys(LOGIN_FLOWS)
+            .filter(backend => configured.size === 0 || configured.has(backend))
+            .map(backend => ({ action: backend, label: backend }));
+        if (choices.length === 0) {
+            await chat.adapter.sendText(chat.chatId, t("login.unsupported", [...configured].join(", ")), { threadId: chat.threadId });
+            return;
+        }
+        await this.postNonceButtonPrompt({
+            prefix: LOGIN_CALLBACK_PREFIX,
+            alertType: "login",
+            instanceName: "login",
+            adapter: chat.adapter,
+            adapterId: chat.adapterId,
+            chatId: chat.chatId,
+            threadId: chat.threadId,
+            message: t("login.choose_backend"),
+            choices,
+            expiredText: t("buttons.stale"),
+        });
+    }
+    /**
+     * Start a login session for one backend. Caller enforces admin.
+     * Returns a status line to post, or null when a confirmation prompt was
+     * posted instead (auth still valid — see the pre-check below).
+     */
+    async startLoginSession(backendArg, chat, opts = {}) {
+        const backend = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
+        const flow = LOGIN_FLOWS[backend];
+        if (!flow)
+            return t("login.unsupported", backendArg);
+        if (this.activeLogin)
+            return t("login.busy", this.activeLogin.backend);
+        // Token-free pre-check (5s cap): re-login while auth still works is
+        // usually a mistake, so it needs a confirmed click. An invalid OR
+        // uncertain result (timeout, missing binary) proceeds straight to login —
+        // an unreliable probe must never block the re-login the admin asked for.
+        if (!opts.skipAuthCheck && flow.authCheck) {
+            const status = await checkAuthStatus(flow.authCheck);
+            if (status === "valid") {
+                await this.postNonceButtonPrompt({
+                    prefix: LOGIN_CONFIRM_CALLBACK_PREFIX,
+                    alertType: "login",
+                    instanceName: backend,
+                    adapter: chat.adapter,
+                    adapterId: chat.adapterId,
+                    chatId: chat.chatId,
+                    threadId: chat.threadId,
+                    message: t("login.still_valid", backend),
+                    choices: [
+                        { action: "go", label: t("login.relogin_go") },
+                        { action: "cancel", label: t("login.relogin_cancel") },
+                    ],
+                    expiredText: t("buttons.stale"),
+                });
+                return null;
+            }
+        }
+        return this.launchLoginSession(flow, backend, chat);
+    }
+    /** Create the login window and session (pre-check already settled). */
+    async launchLoginSession(flow, backend, chat) {
+        if (this.activeLogin)
+            return t("login.busy", this.activeLogin.backend);
+        const sessionName = getTmuxSession();
+        await TmuxManager.ensureSession(sessionName);
+        const tmux = new TmuxManager(sessionName, "");
+        const session = new LoginSession(flow, tmux, {
+            onMenu: async (options) => {
+                await this.postNonceButtonPrompt({
+                    prefix: LOGIN_MENU_CALLBACK_PREFIX,
+                    alertType: "login",
+                    instanceName: backend,
+                    adapter: chat.adapter,
+                    adapterId: chat.adapterId,
+                    chatId: chat.chatId,
+                    threadId: chat.threadId,
+                    message: t("login.choose_provider"),
+                    choices: options.map((label, index) => ({ action: String(index), label })),
+                    expiredText: t("buttons.stale"),
+                });
+            },
+            onAuthHint: async (url, code) => {
+                await this.sendLoginSecret(chat, backend, url, code);
+            },
+            onNeedInput: async (promptExcerpt) => {
+                await chat.adapter.sendText(chat.chatId, t("login.need_input", backend, promptExcerpt), { threadId: chat.threadId }).catch(() => { });
+            },
+            onDone: async ({ ok, detail }) => {
+                this.activeLogin = null;
+                let text;
+                if (ok) {
+                    const { woken, restarted } = await this.recoverBackendInstances(backend);
+                    const none = t("login.none");
+                    text = t("login.success", backend, woken.length ? woken.join(", ") : none, restarted.length ? restarted.join(", ") : none);
+                }
+                else if (detail === "cancelled") {
+                    text = t("login.cancelled", backend);
+                }
+                else {
+                    text = t("login.failed", backend, detail);
+                }
+                await chat.adapter.sendText(chat.chatId, text, { threadId: chat.threadId }).catch(() => { });
+            },
+        }, this.logger);
+        // Claim the slot before the first await so two admins racing /login cannot
+        // both create windows; release on startup failure.
+        this.activeLogin = { session, backend, chat };
+        try {
+            await session.start();
+        }
+        catch (err) {
+            this.activeLogin = null;
+            return t("login.failed", backend, err.message);
+        }
+        return t("login.started", backend);
+    }
+    /** `/login code <text>` — paste admin-supplied text into the login window. */
+    async loginSubmitInput(text) {
+        if (!this.activeLogin)
+            return t("login.no_session");
+        const ok = await this.activeLogin.session.submitInput(text);
+        return ok ? t("login.input_sent") : t("login.input_failed");
+    }
+    /** `/login cancel` — abort the active session and remove its window. */
+    async cancelLoginSession() {
+        if (!this.activeLogin)
+            return t("login.no_session");
+        const backend = this.activeLogin.backend;
+        await this.activeLogin.session.cancel();
+        return t("login.cancelled", backend);
+    }
+    /**
+     * The URL (+ code) is a live credential: whoever completes it binds THEIR
+     * account to this fleet's CLI. Telegram gets an HTML spoiler (same treatment
+     * as the dashboard token); other adapters get plain text with the warning.
+     */
+    async sendLoginSecret(chat, backend, url, code) {
+        const codeLine = code ? `\n${t("login.auth_code", code)}` : "";
+        try {
+            if (chat.adapter.type === "telegram") {
+                const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+                await chat.adapter.sendText(chat.chatId, `${esc(t("login.auth_hint", backend))}\n<tg-spoiler>${esc(url)}${esc(codeLine)}</tg-spoiler>`, { threadId: chat.threadId, format: "html" });
+            }
+            else {
+                await chat.adapter.sendText(chat.chatId, `${t("login.auth_hint", backend)}\n${url}${codeLine}`, { threadId: chat.threadId });
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message, backend }, "Failed to deliver login URL");
+        }
+    }
+    /**
+     * After a successful login: wake the paused instances of that backend AND
+     * restart the running ones — a live CLI holds the old token in memory and
+     * only re-reads credentials on process start (a paused instance's CLI is
+     * already dead, so waking it respawns with the new token for free).
+     */
+    async recoverBackendInstances(backend) {
+        const woken = [];
+        const restarted = [];
+        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            const effective = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
+            if (effective !== backend)
+                continue;
+            const status = this.getInstanceStatus(name);
+            try {
+                if (status === "paused") {
+                    if (this.daemons.has(name))
+                        await this.lifecycle.wake(name, 30_000);
+                    else
+                        await this.startPersistedPausedInstance(name);
+                    woken.push(name);
+                }
+                else if (status === "running") {
+                    await this.restartSingleInstance(name);
+                    restarted.push(name);
+                }
+            }
+            catch (err) {
+                this.logger.warn({ err: err.message, name, status }, "Post-login recovery failed");
+            }
+        }
+        return { woken, restarted };
+    }
+    /** Backend chooser button → start that backend's login session. */
+    async handleLoginBackendSelect(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(LOGIN_CALLBACK_PREFIX, /^login:([0-9a-f]+):([a-z][a-z-]*)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action: backend } = claimed;
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("login.starting_backend", backend));
+        const text = await this.startLoginSession(backend, {
+            adapter: entry.adapter,
+            adapterId: entry.adapterId,
+            chatId: entry.chatId,
+            threadId: entry.threadId,
+        });
+        if (text)
+            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
+        return true;
+    }
+    /** Re-login confirmation (auth pre-check said credentials still work). */
+    async handleLoginConfirm(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|cancel)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action } = claimed;
+        const backend = entry.instanceName;
+        if (action === "cancel") {
+            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("login.cancelled", backend));
+            return true;
+        }
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("login.starting_backend", backend));
+        const text = await this.startLoginSession(backend, {
+            adapter: entry.adapter,
+            adapterId: entry.adapterId,
+            chatId: entry.chatId,
+            threadId: entry.threadId,
+        }, { skipAuthCheck: true });
+        if (text)
+            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
+        return true;
+    }
+    /** Kiro provider button → drive the CLI's arrow-key selector. */
+    async handleLoginMenuSelect(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(LOGIN_MENU_CALLBACK_PREFIX, /^login-menu:([0-9a-f]+):(\d)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action } = claimed;
+        const index = Number(action);
+        const label = this.activeLogin?.session.flow.menu?.options[index] ?? action;
+        const ok = await this.activeLogin?.session.selectMenuOption(index) ?? false;
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, ok ? t("login.provider_selected", label) : t("login.no_session"));
+        return true;
+    }
     queueMirrorMessage(text) {
         const mirrorTopicId = this.fleetConfig?.channel?.mirror_topic_id;
         if (mirrorTopicId == null || !this.adapter)