@songsid/agend 2.1.4 → 2.1.5-beta.10

package/dist/fleet-context.d.ts

@@ -103,6 +103,8 @@ export interface FleetContext {
     /** Persist and edit one `/update` message across the fleet process restart. */
     beginUpdateProgress?(adapter: import("./channel/types.js").ChannelAdapter, chatId: string, threadId: string | undefined, messageId: string): void;
     failUpdateProgress?(message: string): void;
+    /** Persist `/restart full`, wait for idle, then launch the environment-aware service restart. */
+    requestFullRestart?(adapter: import("./channel/types.js").ChannelAdapter, chatId: string, threadId: string | undefined, messageId: string): Promise<boolean>;
     /** Post one random, not-yet-dismissed tip with a dismiss button. */
     promptTip?(generalName: string, adapter: import("./channel/types.js").ChannelAdapter, chatId: string, threadId?: string): Promise<"posted" | "empty" | "unavailable">;
     /** Persistently enable advanced tips without waiting for the dismissal threshold. */
@@ -130,8 +132,11 @@ export interface FleetContext {
         adapterId: string;
         chatId: string;
         threadId?: string;
+        /** The requesting human — required by web mode (admin re-check, private token delivery). */
+        userId?: string;
     }, opts?: {
         skipAuthCheck?: boolean;
+        tokenPresent?: boolean;
     }): Promise<string | null>;
     /** Paste admin-supplied text (auth code / start URL) into the login window. */
     loginSubmitInput?(text: string): Promise<string>;

package/dist/fleet-manager.d.ts

@@ -66,6 +66,28 @@ export interface DeliveryOptions {
     /** Test/operational override; normal deliveries use the 60 second backstop. */
     idleTimeoutMs?: number;
 }
+/**
+ * Upper bound on a live probe driven by `/model`.
+ *
+ * A probe chains bounded leaves but is not itself bounded: claude-code runs
+ * `--version` (5s) then listModels then listApiModels (an 8s AbortController
+ * against api.anthropic.com), and several backends' probes carry no explicit
+ * timeout at all. Awaiting that inline would make `/model` the next thing to
+ * hang, so it races this deadline and falls back to the cached list.
+ *
+ * Must stay above CLI_PROBE_LONGEST_CHAIN_MS — the probe's bounded steps run
+ * back to back, so clearing only the longest single leaf would be false
+ * confidence: a deadline above 8s but below the 13s chain still truncates a
+ * probe that would have succeeded. Bounding the chain rather than the leaf is
+ * the lesson from the usage hang, and the tests assert against the derived
+ * chain constant so raising either step cannot silently break it.
+ *
+ * The deadline exists to stop a probe hanging forever, not to cut short one that
+ * would have finished: truncating a legitimate probe serves the previous list
+ * and hides exactly the newly released model the user opened `/model` to find.
+ * The wait is announced before it starts, so it reads as progress, not a stall.
+ */
+export declare const CLI_ENV_PROBE_DEADLINE_MS = 16000;
 export declare class FleetManager implements FleetContext, LifecycleContext, ArchiverContext, StatuslineWatcherContext, OutboundContext, AgentEndpointContext {
     dataDir: string;
     private static signalTarget;
@@ -199,6 +221,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private updateProgressEditRunning;
     private lastUpdateProgressText;
     private updateCompletionTipText;
+    /** Injectable only to keep the chat→CLI reload hand-off deterministic in tests. */
+    private fullRestartLauncher;
     private eventLogPruneTimer;
     private logRotateTimer;
     /** Days of event/activity history to keep. */
@@ -287,6 +311,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private isModelAdmin;
     private handlePauseWakeSlash;
     private handleUpdateSlash;
+    private handleRestartSlash;
     private handleTipsSlash;
     /** Admin-only full conversation reset for fleet-topic and Classic instances. */
     private handleClearSlash;
@@ -448,6 +473,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private startClassicInstanceUnattended;
     private backendNameOf;
+    /**
+     * Every configured instance whose backend may share credentials. ClassicBot
+     * rows live only in classicBot.yaml, so backend-wide operations must not use
+     * fleetConfig.instances as their roster. Set keeps a malformed name collision
+     * from restarting the same process twice; backendNameOf defines ownership.
+     */
+    private configuredBackendInstanceNames;
     /**
      * One fleet-level notice per burst, not one per instance: a post-update herd
      * fails many instances within the same second. Two notices per incident at
@@ -457,6 +489,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private runnableStartupCount;
     private configuredStartupInstanceNames;
     private restartProgressTarget;
+    /** Resolve only an adapter generation that can accept progress delivery.
+     * Discord exposes direct gateway readiness; adapters without a health
+     * snapshot use the fleet startup/retry state. */
+    private readyProgressAdapter;
+    /** Last-resort completion after RestartProgress could not deliver to its
+     * adopted target. It stays bounded and never wakes a not-ready gateway. */
+    private sendFleetStartCompletionFallback;
     stopInstance(name: string): Promise<void>;
     /** Restart a single instance, reloading fleet.yaml first to pick up config changes. */
     restartSingleInstance(name: string, opts?: {
@@ -479,6 +518,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         token: string | null;
     };
     beginUpdateProgress(adapter: ChannelAdapter, chatId: string, threadId: string | undefined, messageId: string): void;
+    /** Persist the public response, wait for idle, then start the canonical service restart. */
+    requestFullRestart(adapter: ChannelAdapter, chatId: string, threadId: string | undefined, messageId: string): Promise<boolean>;
+    private isOwnedFullRestartMarker;
+    /** Give current work the same bounded idle grace used by graceful reload. */
+    private waitForFullRestartIdleGrace;
+    private reportFullRestartFailure;
     failUpdateProgress(message: string): void;
     /** The old fleet edits CLI install stages; the new fleet adopts the same message below. */
     private startUpdateProgressMonitor;
@@ -629,6 +674,35 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Side effects of a routed reply: cancel-button lifecycle, logs, SSE, chat log. */
     private afterReplyRouted;
     private handleScheduleTrigger;
+    /**
+     * The adapter that can actually post into a chat, found by its group.
+     *
+     * A schedule records where it was created (reply_chat_id) separately from
+     * what it triggers (target). Those need not share a platform: a Telegram
+     * group can schedule a Discord-topic instance. Picking the adapter from the
+     * target then sends a Telegram chat id through the Discord bot, which fails
+     * with Unknown Channel — the source topic never hears that its schedule ran.
+     *
+     * When several bots share one guild, the primary wins: a persona should not
+     * be the voice announcing fleet scheduling.
+     */
+    private adapterForChat;
+    /**
+     * The adapter that can answer a schedule in the chat it was created from.
+     *
+     * A schedule records its creator (source) and its trigger (target) separately,
+     * and they need not share a platform — the live fleet has a Telegram group
+     * scheduling a Discord-topic instance. Routing by target sends a Telegram chat
+     * id through the Discord bot, which is one half of the Unknown Channel errors.
+     *
+     * The creator's own adapter comes first, and only when its world actually owns
+     * that chat. Classic keeps its own identity, so a schedule made from a
+     * persona-bound Classic channel is answered by that persona: the primary bot
+     * may not even have access there, and would be the wrong voice if it did.
+     * Falling back to the target's adapter is deliberately NOT an option — that is
+     * the misroute itself; callers say why they stayed silent instead.
+     */
+    private scheduleSourceAdapter;
     private notifySourceTopic;
     private notifyScheduleFailure;
     private handleScheduleCrud;
@@ -744,6 +818,31 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * poll cannot flood the topic and a down General does not swallow it.
      */
     private reportClassicUnrecoverableIds;
+    /**
+     * Where a fleet-wide notice can actually be posted, or null if nowhere.
+     *
+     * On Telegram a group id is itself a chat, so posting straight to it is
+     * right. On Discord it is a *guild* id, and sending there makes the adapter
+     * fetch a channel that does not exist — DiscordAPIError 10003 Unknown
+     * Channel. That is why the daily summary never arrived on a Discord fleet:
+     * it had been posting to the guild every night and only the catch handler
+     * ever saw it.
+     *
+     * Discord therefore needs a real channel: the General topic (resolved from
+     * config rather than findGeneralInstance, so a fleet-level fault can still be
+     * reported while the General daemon is down), else the adapter's configured
+     * general_channel_id. With neither, there is no safe target and the caller
+     * should say so rather than send into a guaranteed failure.
+     */
+    private fleetNoticeTarget;
+    /**
+     * Post the daily summary where fleet-wide notices go.
+     *
+     * A named method rather than an inline closure so a test can drive the real
+     * thing: asserting on fleetNoticeTarget alone leaves the call site free to go
+     * back to posting at the bare group id, which is the defect this replaced.
+     */
+    private postDailySummary;
     notifyFleetError(text: string): void;
     private static readonly FLEET_ERROR_THROTTLE_MS;
     private fleetErrorNotices;
@@ -976,6 +1075,18 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Invalidate work queued before a user cancel and wake idle-gate waiters. */
     private cancelPendingDeliveries;
     private activeLogin;
+    /**
+     * Web-terminal login (v2.1.5 default, `login.mode: web`). The relay code
+     * below (activeLogin/LoginSession) is `login.mode: relay`, kept for one
+     * release as the rollback lever and removed in 2.1.6.
+     */
+    private loginController;
+    /**
+     * One login/install window fleet-wide. Claimed synchronously before the
+     * first await by web login, relay login and install alike (sol B1).
+     */
+    private readonly loginWindow;
+    private get webLogin();
     /** Post the backend chooser for a bare `/login`. Caller enforces admin. */
     promptLoginBackends(chat: {
         adapter: ChannelAdapter;
@@ -1042,11 +1153,16 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         adapterId: string;
         chatId: string;
         threadId?: string;
+        userId?: string;
     }, opts?: {
         skipAuthCheck?: boolean;
+        tokenPresent?: boolean;
     }): Promise<string | null>;
+    private startRelayClaimed;
     /** Create the login window and session (pre-check already settled). */
     private launchLoginSession;
+    /** Fleet shutdown: end any web/relay login or install window and wait for its confirmed teardown. */
+    private shutdownLoginWindows;
     /** `/login code <text>` — paste admin-supplied text into the login window. */
     loginSubmitInput(text: string): Promise<string>;
     /** `/login cancel` — abort the active session and remove its window. */
@@ -1068,6 +1184,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private handleLoginBackendSelect;
     /** Re-login confirmation (auth pre-check said credentials still work). */
     private handleLoginConfirm;
+    /** "Resend token" button (web login): only the requester may press it; the token never enters the channel. */
+    private handleLoginTokenResend;
     /** Kiro provider button → drive the CLI's arrow-key selector. */
     private handleLoginMenuSelect;
     private activeInstall;
@@ -1168,6 +1286,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private cliEnvPath;
     /** Read the cached CLI env for a backend, or null if missing/stale/unparseable. */
     private readCliEnv;
+    /** True when a cached CLI env is old enough that `/model` should re-probe. */
+    private cliEnvNeedsRefresh;
+    /**
+     * Run a live probe under a deadline, falling back to whatever the cache holds.
+     * A model list is an aid: a vendor that stops answering must degrade to the
+     * previous list, never stall the command that asked for it.
+     */
+    private probeBackendBounded;
     /**
      * Resolve the effective model for a fleet or ClassicBot instance, plus where it
      * came from. Single source of truth for `/model` and `/ctx` — precedence: