@songsid/agend 2.1.4-beta.5 → 2.1.4-beta.7

package/dist/fleet-context.d.ts

@@ -100,4 +100,9 @@ export interface FleetContext {
     applyEffort?(instanceName: string, level: string): Promise<string>;
     /** TG inline-keyboard effort menu; same contract as promptModelMenu. */
     promptEffortMenu?(instanceName: string, userId: string, channelId: string, adapter: import("./channel/types.js").ChannelAdapter, chatId: string, threadId?: string): Promise<string | null>;
+    /**
+     * Post a nonce-armed confirmation before the destructive `/clear` command.
+     * Returns null when the buttons were posted, otherwise a user-facing error.
+     */
+    promptClearConfirmation?(instanceName: string, channelId: string, adapter: import("./channel/types.js").ChannelAdapter, chatId: string, threadId?: string): Promise<string | null>;
 }

package/dist/fleet-manager.d.ts

@@ -563,6 +563,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private consumeNonceCallback;
     /** Collapse a consumed prompt's buttons into a final status line. */
     private retireNonceButtons;
+    /** Post the destructive `/clear` confirmation in the invoking channel. */
+    promptClearConfirmation(instanceName: string, channelId: string, adapter: ChannelAdapter, chatId: string, threadId?: string): Promise<string | null>;
+    /** Consume `/clear` Confirm/Cancel exactly once; only Confirm reaches IPC. */
+    private handleClearConfirmation;
     /**
      * Drop every pending prompt that refers to an instance being stopped or
      * restarted — a restart offer for an instance the operator just restarted

package/dist/fleet-manager.js

@@ -30,7 +30,7 @@ import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG, resolveInstanceContext, forgetInstanceContext } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG, CLEAR_UNSUPPORTED_MSG, resolveInstanceContext, forgetInstanceContext } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -175,7 +175,9 @@ const EFFORT_SELECT_CALLBACK_PREFIX = "effort-select:";
 const INTERACTIVE_ASSIST_CALLBACK_PREFIX = "interactive-assist:";
 const EXIT_RESTART_CALLBACK_PREFIX = "exit-restart:";
 const HANG_CALLBACK_PREFIX = "hang:";
-/** One lifetime for every nonce-armed button prompt (hang / assist / exit). */
+const CLEAR_CONFIRM_CALLBACK_PREFIX = "clear-confirm:";
+const CLEAR_CONFIRM_TIMEOUT_MS = 15_000;
+/** Default lifetime for long-lived nonce prompts (clear overrides this to 15s). */
 const NONCE_BUTTON_TIMEOUT_MS = 15 * 60_000;
 const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // /model reads cached CLI env within 24h
 export class FleetManager {
@@ -600,7 +602,14 @@ export class FleetManager {
             await data.respond(t("classic.no_agent"));
             return;
         }
-        await data.respond(await this.topicCommands.sendClear(name));
+        const adapter = this.adapters.get(adapterId) ?? this.adapter;
+        if (!adapter) {
+            await data.respond(t("clear.prompt_unavailable"));
+            return;
+        }
+        const chatId = String(this.getChannelConfig(adapterId)?.group_id ?? data.channelId);
+        const fallback = await this.promptClearConfirmation(name, data.channelId, adapter, chatId, data.channelId);
+        await data.respond(fallback ?? t("clear.confirm_posted"));
     }
     /** Get the adapter bound to an instance, falling back to primary adapter */
     getAdapterForInstance(name) {
@@ -1482,9 +1491,8 @@ export class FleetManager {
         // routing does NOT go through the routing engine (single-key, can't hold two
         // bots in one channel) — it resolves per-bot via getInstanceByChannel.
         this.classicChannels = new ClassicChannelManager(this.dataDir, this.logger);
-        const primaryCh = fleet.channels?.[0] ?? fleet.channel;
-        if (primaryCh)
-            this.classicChannels.setPrimaryAdapterId(primaryCh.id ?? primaryCh.type);
+        const classicAdapters = fleet.channels?.length ? fleet.channels : (fleet.channel ? [fleet.channel] : []);
+        this.classicChannels.configureAdapters(classicAdapters);
         // Restore the persisted bot binding so replies/cancel go through the right
         // bot after a restart (before this, inbound would re-bind lazily).
         for (const ch of this.classicChannels.getAll()) {
@@ -2120,6 +2128,8 @@ export class FleetManager {
             await this.handleInboundReaction(r);
         }, this.logger, "adapter.reaction"));
         this.adapter.on("callback_query", safeHandler(async (data) => {
+            if (await this.handleClearConfirmation(data, adapterId, this.adapter ?? undefined))
+                return;
             if (await this.handleExitRestartPrompt(data, adapterId, this.adapter ?? undefined))
                 return;
             if (await this.handleInteractivePromptAssist(data, adapterId, this.adapter ?? undefined))
@@ -2410,6 +2420,8 @@ export class FleetManager {
             await this.handleInboundReaction(r);
         }, this.logger, `adapter[${adapterId}].reaction`));
         adapter.on("callback_query", safeHandler(async (data) => {
+            if (await this.handleClearConfirmation(data, adapterId, adapter))
+                return;
             if (await this.handleExitRestartPrompt(data, adapterId, adapter))
                 return;
             if (await this.handleInteractivePromptAssist(data, adapterId, adapter))
@@ -3190,7 +3202,11 @@ export class FleetManager {
                         await msgAdapter?.sendText(chatId, t("classic.no_agent_start"));
                         return;
                     }
-                    await msgAdapter?.sendText(chatId, await this.topicCommands.sendClear(clearName));
+                    if (!msgAdapter)
+                        return;
+                    const fallback = await this.promptClearConfirmation(clearName, chatId, msgAdapter, chatId);
+                    if (fallback)
+                        await msgAdapter.sendText(chatId, fallback);
                     return;
                 }
                 // Handle /cancel command
@@ -4490,12 +4506,12 @@ export class FleetManager {
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send notification (no topic)"));
         }
     }
-    // ── Nonce-armed button prompts (hang / interactive-assist / exit-restart) ──
+    // ── Nonce-armed button prompts (hang / assist / exit / clear) ──
     //
     // One shared lifecycle for every "notification with decision buttons":
-    // post with a 128-bit nonce, arm a 15-min expiry, bind the click to the
+    // post with a 128-bit nonce, arm a bounded expiry, bind the click to the
     // exact adapter+chat+thread+message that created it, require fleet admin,
-    // consume exactly once. The three features differ only in what they post
+    // consume exactly once. The features differ only in what they post
     // and what a consumed click does.
     /**
      * Post decision buttons whose callback ids are `<prefix><nonce>:<action>`.
@@ -4577,12 +4593,16 @@ export class FleetManager {
         }
         // Bind the capability to the exact message/world that created it. Telegram
         // keyboards are visible to everyone, so the click also requires fleet admin.
+        const isAuthorized = data.userId
+            ? pending.authChannelId
+                ? this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
+                : this.isFleetAdmin(data.userId, callbackAdapterId)
+            : false;
         if (pending.adapterId !== callbackAdapterId
             || data.chatId !== pending.chatId
             || (pending.threadId != null && data.threadId !== pending.threadId)
             || (pending.messageId != null && data.messageId !== pending.messageId)
-            || !data.userId
-            || !this.isFleetAdmin(data.userId, callbackAdapterId)) {
+            || !isAuthorized) {
             // Deliberately does NOT consume the nonce: the real admin can still click.
             this.logger.warn({ instanceName: pending.instanceName, prefix, userId: data.userId }, "Rejected unauthorized or mismatched button callback");
             return "consumed";
@@ -4609,6 +4629,57 @@ export class FleetManager {
             this.logger.warn({ err, instanceName: pending.instanceName }, "Failed to retire prompt buttons");
         }
     }
+    /** Post the destructive `/clear` confirmation in the invoking channel. */
+    async promptClearConfirmation(instanceName, channelId, adapter, chatId, threadId) {
+        if (!this.topicCommands.supportsClear(instanceName))
+            return CLEAR_UNSUPPORTED_MSG;
+        const adapterId = adapter.id;
+        if (!adapterId)
+            return t("clear.prompt_unavailable");
+        const nonce = await this.postNonceButtonPrompt({
+            prefix: CLEAR_CONFIRM_CALLBACK_PREFIX,
+            alertType: "clear_confirm",
+            instanceName,
+            adapter,
+            adapterId,
+            chatId,
+            threadId,
+            message: t("clear.confirm_message", instanceName),
+            choices: [
+                { action: "confirm", label: t("clear.confirm") },
+                { action: "cancel", label: t("clear.cancel") },
+            ],
+            expiredText: t("clear.expired", instanceName),
+            extra: { authChannelId: channelId },
+            timeoutMs: CLEAR_CONFIRM_TIMEOUT_MS,
+        });
+        return nonce ? null : t("clear.prompt_unavailable");
+    }
+    /** Consume `/clear` Confirm/Cancel exactly once; only Confirm reaches IPC. */
+    async handleClearConfirmation(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(CLEAR_CONFIRM_CALLBACK_PREFIX, /^clear-confirm:([0-9a-f]+):(confirm|cancel)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry: pending, action } = claimed;
+        this.eventLog?.insert(pending.instanceName, "clear_action", { action, userId: data.userId });
+        if (action === "cancel") {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("clear.cancelled", pending.instanceName));
+            return true;
+        }
+        await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("clear.clearing", pending.instanceName));
+        try {
+            const result = await this.topicCommands.sendClear(pending.instanceName);
+            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, result, pending.threadId);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            this.logger.error({ err, instanceName: pending.instanceName }, "Clear command failed");
+            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("clear.failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show clear command error"));
+        }
+        return true;
+    }
     /**
      * Drop every pending prompt that refers to an instance being stopped or
      * restarted — a restart offer for an instance the operator just restarted