@songsid/agend 2.1.4 → 2.1.5-beta.2

package/dist/fleet-manager.d.ts

@@ -976,6 +976,18 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Invalidate work queued before a user cancel and wake idle-gate waiters. */
     private cancelPendingDeliveries;
     private activeLogin;
+    /**
+     * Web-terminal login (v2.1.5 default, `login.mode: web`). The relay code
+     * below (activeLogin/LoginSession) is `login.mode: relay`, kept for one
+     * release as the rollback lever and removed in 2.1.6.
+     */
+    private loginController;
+    /**
+     * One login/install window fleet-wide. Claimed synchronously before the
+     * first await by web login, relay login and install alike (sol B1).
+     */
+    private readonly loginWindow;
+    private get webLogin();
     /** Post the backend chooser for a bare `/login`. Caller enforces admin. */
     promptLoginBackends(chat: {
         adapter: ChannelAdapter;
@@ -1042,11 +1054,16 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         adapterId: string;
         chatId: string;
         threadId?: string;
+        userId?: string;
     }, opts?: {
         skipAuthCheck?: boolean;
+        tokenPresent?: boolean;
     }): Promise<string | null>;
+    private startRelayClaimed;
     /** Create the login window and session (pre-check already settled). */
     private launchLoginSession;
+    /** Fleet shutdown: end any web/relay login or install window and wait for its confirmed teardown. */
+    private shutdownLoginWindows;
     /** `/login code <text>` — paste admin-supplied text into the login window. */
     loginSubmitInput(text: string): Promise<string>;
     /** `/login cancel` — abort the active session and remove its window. */
@@ -1068,6 +1085,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private handleLoginBackendSelect;
     /** Re-login confirmation (auth pre-check said credentials still work). */
     private handleLoginConfirm;
+    /** "Resend token" button (web login): only the requester may press it; the token never enters the channel. */
+    private handleLoginTokenResend;
     /** Kiro provider button → drive the CLI's arrow-key selector. */
     private handleLoginMenuSelect;
     private activeInstall;

package/dist/fleet-manager.js

@@ -48,6 +48,8 @@ import { handleViewRequest, isViewPath } from "./view-api.js";
 import { handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
+import { LoginController, LOGIN_TOKEN_RESEND_PREFIX } from "./login-controller.js";
+import { LoginWindowLock } from "./login-window-lock.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
@@ -1965,6 +1967,8 @@ export class FleetManager {
     }
     /** Start all instances from fleet config */
     async startAll(configPath) {
+        this.loginWindow.reopen(); // a stopAll → startAll restart must accept login windows again
+        this.loginController?.reopen();
         const startupStartedAt = Date.now();
         FleetManager.signalTarget = this;
         this.startupComplete = false;
@@ -2735,6 +2739,8 @@ export class FleetManager {
                 return;
             if (await this.handleLoginConfirm(data, adapterId, this.adapter ?? undefined))
                 return;
+            if (await this.handleLoginTokenResend(data, adapterId, this.adapter ?? undefined))
+                return;
             if (await this.handleInstallLoginConfirm(data, adapterId, this.adapter ?? undefined))
                 return;
             if (await this.handleClearConfirmation(data, adapterId, this.adapter ?? undefined))
@@ -3135,6 +3141,8 @@ export class FleetManager {
                 return;
             if (await this.handleLoginConfirm(data, adapterId, adapter))
                 return;
+            if (await this.handleLoginTokenResend(data, adapterId, adapter))
+                return;
             if (await this.handleInstallLoginConfirm(data, adapterId, adapter))
                 return;
             if (await this.handleClearConfirmation(data, adapterId, adapter))
@@ -6859,6 +6867,40 @@ export class FleetManager {
     // repairs every instance of that backend, and instance delivery, pane-state
     // detection, tool progress, and mcp_proxy_reply never observe login output.
     activeLogin = null;
+    /**
+     * Web-terminal login (v2.1.5 default, `login.mode: web`). The relay code
+     * below (activeLogin/LoginSession) is `login.mode: relay`, kept for one
+     * release as the rollback lever and removed in 2.1.6.
+     */
+    loginController = null;
+    /**
+     * One login/install window fleet-wide. Claimed synchronously before the
+     * first await by web login, relay login and install alike (sol B1).
+     */
+    loginWindow = new LoginWindowLock();
+    get webLogin() {
+        if (!this.loginController) {
+            this.loginController = new LoginController({
+                logger: this.logger,
+                fleetConfig: () => this.fleetConfig,
+                isFleetAdmin: (userId, adapterId) => this.isFleetAdmin(userId, adapterId),
+                eventLog: () => this.eventLog,
+                recoverBackendInstances: backend => this.recoverBackendInstances(backend),
+                claimWindow: backend => this.loginWindow.tryClaim("web", backend),
+                releaseWindow: claim => { this.loginWindow.release(claim); },
+                isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
+                windowBusyMessage: () => this.loginWindow.busyMessage(),
+                postButtons: async ({ prefix, instanceName, chat, message, choices, expiredText }) => {
+                    await this.postNonceButtonPrompt({
+                        prefix, alertType: "login", instanceName,
+                        adapter: chat.adapter, adapterId: chat.adapterId, chatId: chat.chatId, threadId: chat.threadId,
+                        message, choices, expiredText,
+                    });
+                },
+            });
+        }
+        return this.loginController;
+    }
     /** Post the backend chooser for a bare `/login`. Caller enforces admin. */
     async promptLoginBackends(chat) {
         const configured = new Set();
@@ -7034,21 +7076,40 @@ export class FleetManager {
      * posted instead (auth still valid — see the pre-check below).
      */
     async startLoginSession(backendArg, chat, opts = {}) {
+        if (this.webLogin.mode() === "web")
+            return this.webLogin.start(backendArg, chat, opts);
+        // ── legacy relay mode (login.mode: relay) — removed in 2.1.6 ──
         const backend = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
         const flow = LOGIN_FLOWS[backend];
         if (!flow)
             return t("login.unsupported", backendArg);
-        if (this.activeLogin)
-            return t("login.busy", this.activeLogin.backend);
-        // Install sessions share the window namespace — never run both at once.
-        if (this.activeInstall)
-            return t("install.busy");
+        // Declined in every mode — never a silent relay fallback (e.g. Antigravity).
+        if (flow.remoteLogin === "unsupported")
+            return t("login.remote_unsupported_agent_cli", backend, flow.command);
+        // Reserve the window before the pre-check await. The claim is owned by this
+        // region until it is transferred to launchLoginSession; any other exit
+        // (buttons only, throw, shutdown) releases it.
+        const claim = this.loginWindow.tryClaim("relay", backend);
+        if (!claim)
+            return this.loginWindow.busyMessage();
+        let transferred = false;
+        try {
+            return await this.startRelayClaimed(flow, backend, chat, opts, claim, () => { transferred = true; });
+        }
+        finally {
+            if (!transferred)
+                this.loginWindow.release(claim);
+        }
+    }
+    async startRelayClaimed(flow, backend, chat, opts, claim, markTransferred) {
         // Token-free pre-check (5s cap): re-login while auth still works is
         // usually a mistake, so it needs a confirmed click. An invalid OR
         // uncertain result (timeout, missing binary) proceeds straight to login —
         // an unreliable probe must never block the re-login the admin asked for.
         if (!opts.skipAuthCheck && flow.authCheck) {
             const status = await checkAuthStatus(flow.authCheck);
+            if (!this.loginWindow.isCurrent(claim))
+                return t("login.web_shutting_down"); // fleet shut down while we probed
             if (status === "valid") {
                 await this.postNonceButtonPrompt({
                     prefix: LOGIN_CONFIRM_CALLBACK_PREFIX,
@@ -7068,18 +7129,27 @@ export class FleetManager {
                 return null;
             }
         }
-        return this.launchLoginSession(flow, backend, chat);
+        markTransferred(); // launchLoginSession owns the claim from here
+        return this.launchLoginSession(flow, backend, chat, claim);
     }
     /** Create the login window and session (pre-check already settled). */
-    async launchLoginSession(flow, backend, chat) {
-        if (this.activeLogin)
-            return t("login.busy", this.activeLogin.backend);
-        // Install sessions share the window namespace — never run both at once.
-        if (this.activeInstall)
-            return t("install.busy");
-        const sessionName = getTmuxSession();
-        await TmuxManager.ensureSession(sessionName);
-        const tmux = new TmuxManager(sessionName, "");
+    async launchLoginSession(flow, backend, chat, claim) {
+        // Owns `claim`: released on any failure before the session is published,
+        // and by onDone afterwards. A shutdown during ensureSession stops us.
+        let tmux;
+        try {
+            const sessionName = getTmuxSession();
+            await TmuxManager.ensureSession(sessionName);
+            if (!this.loginWindow.isCurrent(claim)) {
+                this.loginWindow.release(claim);
+                return t("login.web_shutting_down");
+            }
+            tmux = new TmuxManager(sessionName, "");
+        }
+        catch (err) {
+            this.loginWindow.release(claim);
+            return t("login.failed", backend, err.message);
+        }
         const session = new LoginSession(flow, tmux, {
             onMenu: async (options) => {
                 await this.postNonceButtonPrompt({
@@ -7101,8 +7171,12 @@ export class FleetManager {
             onNeedInput: async (promptExcerpt) => {
                 await chat.adapter.sendText(chat.chatId, t("login.need_input", backend, promptExcerpt), { threadId: chat.threadId }).catch(() => { });
             },
-            onDone: async ({ ok, detail }) => {
+            onDone: async ({ ok, detail, cleanupFailed }) => {
                 this.activeLogin = null;
+                this.loginWindow.release(claim);
+                if (cleanupFailed) {
+                    await chat.adapter.sendText(chat.chatId, t("login.web_cleanup_failed", backend), { threadId: chat.threadId }).catch(() => { });
+                }
                 let text;
                 if (ok) {
                     const { woken, restarted } = await this.recoverBackendInstances(backend);
@@ -7128,12 +7202,68 @@ export class FleetManager {
         }
         catch (err) {
             this.activeLogin = null;
-            return t("login.failed", backend, err.message);
+            this.loginWindow.release(claim);
+            const text = t("login.failed", backend, err.message);
+            return err.cleanupFailed ? `${text}\n${t("login.web_cleanup_failed", backend)}` : text;
+        }
+        if (session.state === "done") {
+            // Cancelled (user or shutdown) while starting: start() joined the
+            // teardown, so nothing is left. onDone already released the claim.
+            this.activeLogin = null;
+            this.loginWindow.release(claim);
+            return this.loginWindow.isClosed ? t("login.web_shutting_down") : t("login.cancelled", backend);
+        }
+        if (!this.loginWindow.isCurrent(claim)) {
+            await session.cancel("cancelled").catch(() => { });
+            this.activeLogin = null;
+            this.loginWindow.release(claim);
+            return t("login.web_shutting_down");
         }
         return t("login.started", backend);
     }
+    /** Fleet shutdown: end any web/relay login or install window and wait for its confirmed teardown. */
+    async shutdownLoginWindows() {
+        // Close the lock FIRST: in-flight starts parked in a pre-check or
+        // ensureSession observe !isCurrent when they resume and stop; no new
+        // window can be claimed while we stop.
+        this.loginWindow.close();
+        // Completion semantics live INSIDE the sessions: each awaits its own
+        // confirmed cleanup, every tmux op on that path has a hard per-op bound
+        // (web: abort ≤10 s + kill ≤31 s; legacy: create/list/kill ≤10 s each,
+        // duplicates killed in parallel). This outer deadline is only a loud last
+        // resort so `agend stop` cannot hang forever on a wedged tmux; reaching it
+        // is an ERROR, logged and recorded, and it releases nothing re-claimable
+        // (the lock stays closed, the controller keeps its entry). The timer is
+        // cleared on success so a long-lived process never fires it spuriously.
+        const SHUTDOWN_DEADLINE_MS = 120_000;
+        const bounded = (p, what) => {
+            if (!p)
+                return Promise.resolve();
+            let timer;
+            const deadline = new Promise(r => {
+                timer = setTimeout(() => {
+                    this.logger.error({ what, deadlineMs: SHUTDOWN_DEADLINE_MS }, "login window teardown still in flight at the shutdown deadline — a dedicated tmux server may survive; check `tmux -L agend-term-* ls`");
+                    this.eventLog?.insert("login", "login_window_shutdown_deadline", { what });
+                    r();
+                }, SHUTDOWN_DEADLINE_MS);
+                timer.unref?.();
+            });
+            return Promise.race([p.then(() => undefined, () => this.logger.warn({ what }, "login window shutdown failed")), deadline])
+                .finally(() => { if (timer)
+                clearTimeout(timer); });
+        };
+        // "cancelled" is the detail both legacy onDone handlers keep quiet about —
+        // a stopping fleet must not announce "login failed — fleet shutdown".
+        await Promise.all([
+            bounded(this.loginController?.shutdown(), "web-login"),
+            bounded(this.activeLogin?.session.cancel("cancelled"), "relay-login"),
+            bounded(this.activeInstall?.session.cancel("cancelled"), "install"),
+        ]);
+    }
     /** `/login code <text>` — paste admin-supplied text into the login window. */
     async loginSubmitInput(text) {
+        if (this.loginController?.isActive())
+            return t("login.web_code_not_needed");
         if (!this.activeLogin)
             return t("login.no_session");
         const ok = await this.activeLogin.session.submitInput(text);
@@ -7141,6 +7271,8 @@ export class FleetManager {
     }
     /** `/login cancel` — abort the active session and remove its window. */
     async cancelLoginSession() {
+        if (this.loginController?.isActive())
+            return this.loginController.cancel();
         if (!this.activeLogin)
             return t("login.no_session");
         const backend = this.activeLogin.backend;
@@ -7214,6 +7346,7 @@ export class FleetManager {
             adapterId: entry.adapterId,
             chatId: entry.chatId,
             threadId: entry.threadId,
+            userId: data.userId,
         });
         if (text)
             await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
@@ -7221,7 +7354,7 @@ export class FleetManager {
     }
     /** Re-login confirmation (auth pre-check said credentials still work). */
     async handleLoginConfirm(data, callbackAdapterId, receivingAdapter) {
-        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|cancel)$/, data, callbackAdapterId, receivingAdapter);
+        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|go-relogin|cancel)$/, data, callbackAdapterId, receivingAdapter);
         if (claimed === null)
             return false;
         if (claimed === "consumed")
@@ -7238,11 +7371,24 @@ export class FleetManager {
             adapterId: entry.adapterId,
             chatId: entry.chatId,
             threadId: entry.threadId,
-        }, { skipAuthCheck: true });
+            userId: data.userId,
+        }, { skipAuthCheck: true, tokenPresent: action === "go-relogin" });
         if (text)
             await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
         return true;
     }
+    /** "Resend token" button (web login): only the requester may press it; the token never enters the channel. */
+    async handleLoginTokenResend(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(LOGIN_TOKEN_RESEND_PREFIX, /^login-token:([0-9a-f]+):(resend)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry } = claimed;
+        const text = await this.webLogin.resendToken(data.userId);
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, text);
+        return true;
+    }
     /** Kiro provider button → drive the CLI's arrow-key selector. */
     async handleLoginMenuSelect(data, callbackAdapterId, receivingAdapter) {
         const claimed = this.consumeNonceCallback(LOGIN_MENU_CALLBACK_PREFIX, /^login-menu:([0-9a-f]+):(\d)$/, data, callbackAdapterId, receivingAdapter);
@@ -7272,13 +7418,25 @@ export class FleetManager {
             return t("install.unsupported", backendArg);
         if (checkBinaryInstalled(info.binary))
             return t("install.already", backend, info.binary);
-        if (this.activeInstall)
-            return t("install.busy");
-        if (this.activeLogin)
-            return t("login.busy", this.activeLogin.backend);
-        const sessionName = getTmuxSession();
-        await TmuxManager.ensureSession(sessionName);
-        const tmux = new TmuxManager(sessionName, "");
+        // Reserve the fleet-wide window before the first await (shared with web/relay
+        // login). Owned by this method until the session is published.
+        const claim = this.loginWindow.tryClaim("install", backend);
+        if (!claim)
+            return this.loginWindow.busyMessage();
+        let tmux;
+        try {
+            const sessionName = getTmuxSession();
+            await TmuxManager.ensureSession(sessionName);
+            if (!this.loginWindow.isCurrent(claim)) {
+                this.loginWindow.release(claim);
+                return t("login.web_shutting_down");
+            }
+            tmux = new TmuxManager(sessionName, "");
+        }
+        catch (err) {
+            this.loginWindow.release(claim);
+            return t("install.failed", backend, err.message);
+        }
         // A synthetic login flow: success is decided by the installer's exit code
         // (LoginSession treats a clean exit as success), never by pane text — and
         // installer output that happens to contain a URL must not be forwarded as
@@ -7293,8 +7451,12 @@ export class FleetManager {
             onMenu: () => { },
             onAuthHint: () => { },
             onNeedInput: () => { },
-            onDone: async ({ ok, detail }) => {
+            onDone: async ({ ok, detail, cleanupFailed }) => {
                 this.activeInstall = null;
+                this.loginWindow.release(claim);
+                if (cleanupFailed) {
+                    await chat.adapter.sendText(chat.chatId, t("login.web_cleanup_failed", backend), { threadId: chat.threadId }).catch(() => { });
+                }
                 if (!ok) {
                     // A cancel is user-initiated — the cancel command's own reply already
                     // said so; a second message here would be a duplicate.
@@ -7336,7 +7498,20 @@ export class FleetManager {
         }
         catch (err) {
             this.activeInstall = null;
-            return t("install.failed", backend, err.message);
+            this.loginWindow.release(claim);
+            const text = t("install.failed", backend, err.message);
+            return err.cleanupFailed ? `${text}\n${t("login.web_cleanup_failed", backend)}` : text;
+        }
+        if (session.state === "done") {
+            this.activeInstall = null;
+            this.loginWindow.release(claim);
+            return this.loginWindow.isClosed ? t("login.web_shutting_down") : t("install.cancelled", backend);
+        }
+        if (!this.loginWindow.isCurrent(claim)) {
+            await session.cancel("cancelled").catch(() => { });
+            this.activeInstall = null;
+            this.loginWindow.release(claim);
+            return t("login.web_shutting_down");
         }
         return t("install.started", backend);
     }
@@ -7377,6 +7552,7 @@ export class FleetManager {
             adapterId: entry.adapterId,
             chatId: entry.chatId,
             threadId: entry.threadId,
+            userId: data.userId,
         });
         if (text)
             await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
@@ -7388,7 +7564,7 @@ export class FleetManager {
             await data.respond(t("permission.denied"));
             return;
         }
-        const chat = { adapter, adapterId, chatId: data.channelId };
+        const chat = { adapter, adapterId, chatId: data.channelId, userId: data.userId };
         if (data.options?.cancel === true) {
             await data.respond(await this.cancelLoginSession());
             return;
@@ -9255,6 +9431,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.watchdogTimer);
             this.watchdogTimer = null;
         }
+        // A login/install window is a dedicated tmux server with its own TTL
+        // timer and HTTP listener living in THIS process: without an explicit
+        // shutdown it would outlive us as an owner-less login CLI (sol B3).
+        await this.shutdownLoginWindows();
         // Cancel adapter retry timers
         for (const state of this.adapterState.values()) {
             if (state.retryTimer) {