@songsid/agend 2.1.5-beta.13 → 2.1.5-beta.15

package/dist/deadline.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Run work under a wall-clock deadline without cancelling it.
+ *
+ * Nothing here aborts anything — a tmux spawn or an HTTP call keeps going after
+ * its deadline passes; the caller simply stops waiting and can say so. That is
+ * the point: a step with no deadline cannot report anything while it hangs, so
+ * the user sees silence and assumes the whole operation is stuck (#722, and the
+ * post-login recovery that silently swallowed its own success message).
+ *
+ * Rejections are reported rather than thrown, so one failed step never takes
+ * the surrounding loop down with it, and are always observed — an abandoned
+ * promise that rejects later must not surface as an unhandled rejection.
+ */
+export type DeadlineResult<T> = {
+    status: "fulfilled";
+    value: T;
+} | {
+    status: "rejected";
+    reason: unknown;
+} | {
+    status: "timeout";
+};
+export declare function runBeforeDeadline<T>(start: () => Promise<T>, deadline: number): Promise<DeadlineResult<T>>;

package/dist/deadline.js

@@ -0,0 +1,29 @@
+/** Largest delay setTimeout honours; anything above is clamped to 1ms by Node. */
+const MAX_TIMER_MS = 2_147_483_647;
+export async function runBeforeDeadline(start, deadline) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0)
+        return { status: "timeout" };
+    let work;
+    try {
+        work = start();
+    }
+    catch (reason) {
+        // A synchronous throw from `start` is a rejection like any other.
+        return { status: "rejected", reason };
+    }
+    let timer;
+    const timeout = new Promise(resolve => {
+        // Node clamps a delay above the 32-bit maximum to 1ms — so a very distant
+        // deadline would fire IMMEDIATELY and report every step as timed out, the
+        // exact opposite of what the caller asked for. Cap instead.
+        timer = setTimeout(() => resolve({ status: "timeout" }), Math.min(remaining, MAX_TIMER_MS));
+        timer.unref?.();
+    });
+    const settled = work.then(value => ({ status: "fulfilled", value }), reason => ({ status: "rejected", reason }));
+    const result = await Promise.race([settled, timeout]);
+    if (timer)
+        clearTimeout(timer);
+    return result;
+}
+//# sourceMappingURL=deadline.js.map

package/dist/deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sourceRoot":"","sources":["../src/deadline.ts"],"names":[],"mappings":"AAkBA,kFAAkF;AAClF,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAI,KAAuB,EAAE,QAAgB;IAClF,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,kEAAkE;QAClE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAoB,OAAO,CAAC,EAAE;QACvD,0EAA0E;QAC1E,0EAA0E;QAC1E,4DAA4D;QAC5D,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5F,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EACzC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAC3C,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/fleet-manager.d.ts

@@ -66,6 +66,7 @@ export interface DeliveryOptions {
     /** Test/operational override; normal deliveries use the 60 second backstop. */
     idleTimeoutMs?: number;
 }
+export declare const LOGIN_CALLBACK_PREFIX = "login:";
 /**
  * Upper bound on a live probe driven by `/model`.
  *
@@ -928,6 +929,17 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * contain usernames or secret-adjacent text and stays in daemon.log.
      */
     notifyInteractivePrompt(instanceName: string, kind: string): Promise<void>;
+    /**
+     * Offer a one-tap re-login next to an auth alert.
+     *
+     * The alert already names the remedy in words (`/login <backend>`), which
+     * still leaves the user to retype it somewhere. The button routes into the
+     * same chooser `/login` uses, so pressing it starts the flow in place.
+     *
+     * Backends with no remote login flow (opencode logs in from a terminal) get
+     * no button — the alert's own wording already tells them what to run.
+     */
+    offerBackendLogin(targetInstance: string, backend: string): Promise<void>;
     /** Consume a General assist button exactly once. */
     private handleInteractivePromptAssist;
     /** Send a "🛑 Cancel" button to the instance's topic/channel after delivery. */
@@ -1188,6 +1200,17 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * only re-reads credentials on process start (a paused instance's CLI is
      * already dead, so waking it respawns with the new token for free).
      */
+    /**
+     * Wake/restart every instance of a backend after a successful re-login.
+     *
+     * Bounded by a wall-clock deadline. This used to be an unbounded sequential
+     * loop, and the caller only built its "login completed" message AFTER it
+     * returned — so with several instances (or one slow restart) the user was
+     * told nothing at all for minutes, concluded the login had hung, and
+     * restarted things by hand. Instances that do not finish in time are NOT
+     * cancelled: they are still coming back, and are reported as pending so the
+     * message can say so instead of implying failure.
+     */
     private recoverBackendInstances;
     /** Backend chooser button → start that backend's login session. */
     private handleLoginBackendSelect;

package/dist/fleet-manager.js

@@ -48,7 +48,8 @@ import { handleViewRequest, isViewPath } from "./view-api.js";
 import { handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
-import { LoginController, LOGIN_TOKEN_RESEND_PREFIX } from "./login-controller.js";
+import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS, announcePostLoginRecovery } from "./login-controller.js";
+import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, getLocale, t } from "./locale.js";
@@ -219,7 +220,7 @@ const HANG_CALLBACK_PREFIX = "hang:";
 const CLEAR_CONFIRM_CALLBACK_PREFIX = "clear-confirm:";
 const TIP_DISMISS_CALLBACK_PREFIX = "tip-dismiss:";
 const TIP_UNLOCK_CALLBACK_PREFIX = "tip-unlock:";
-const LOGIN_CALLBACK_PREFIX = "login:";
+export const LOGIN_CALLBACK_PREFIX = "login:";
 const INSTALL_CALLBACK_PREFIX = "install-select:";
 const CLASSIC_APPROVE_CALLBACK_PREFIX = "classic-approve:";
 const LOGIN_MENU_CALLBACK_PREFIX = "login-menu:";
@@ -4785,7 +4786,9 @@ export class FleetManager {
                 // The adapter resolves only after the platform POST returns. Keep
                 // outward-facing logs/cancel state on the same confirmation boundary:
                 // a routed-but-failed reply is not a delivered reply.
-                if (!error && result != null) {
+                // `statusOnly` is daemon-owned envelope metadata, not an MCP argument:
+                // an agent cannot invent it to suppress the normal completion marker.
+                if (!error && result != null && msg.statusOnly !== true) {
                     try {
                         this.afterReplyRouted(instanceName, args, senderSessionName);
                     }
@@ -6555,6 +6558,41 @@ export class FleetManager {
             extra: { generalName, promptKind: kind },
         });
     }
+    /**
+     * Offer a one-tap re-login next to an auth alert.
+     *
+     * The alert already names the remedy in words (`/login <backend>`), which
+     * still leaves the user to retype it somewhere. The button routes into the
+     * same chooser `/login` uses, so pressing it starts the flow in place.
+     *
+     * Backends with no remote login flow (opencode logs in from a terminal) get
+     * no button — the alert's own wording already tells them what to run.
+     */
+    async offerBackendLogin(targetInstance, backend) {
+        if (!LOGIN_FLOWS[backend])
+            return;
+        const adapterId = this.getInstanceAdapterId(targetInstance);
+        const adapter = this.getAdapterForInstance(targetInstance);
+        const chatId = this.getGroupIdForInstance(targetInstance);
+        const topicId = this.fleetConfig?.instances[targetInstance]?.topic_id;
+        const threadId = topicId != null ? String(topicId) : undefined;
+        if (!adapter || !adapterId || !chatId) {
+            this.logger.warn({ targetInstance, backend, adapterId, chatId }, "Cannot address the re-login button — the alert text still names the command");
+            return;
+        }
+        await this.postNonceButtonPrompt({
+            prefix: LOGIN_CALLBACK_PREFIX,
+            alertType: "login",
+            instanceName: "login",
+            adapter,
+            adapterId,
+            chatId,
+            threadId,
+            message: t("login.offer", backend),
+            choices: [{ action: backend, label: t("login.offer_action", backend) }],
+            expiredText: t("buttons.stale"),
+        });
+    }
     /** Consume a General assist button exactly once. */
     async handleInteractivePromptAssist(data, callbackAdapterId, receivingAdapter) {
         const claimed = this.consumeNonceCallback(INTERACTIVE_ASSIST_CALLBACK_PREFIX, /^interactive-assist:([0-9a-f]+):(confirm|cancel)$/, data, callbackAdapterId, receivingAdapter);
@@ -7543,11 +7581,15 @@ export class FleetManager {
                 if (cleanupFailed) {
                     await chat.adapter.sendText(chat.chatId, t("login.web_cleanup_failed", backend), { threadId: chat.threadId }).catch(() => { });
                 }
+                const send = (text) => chat.adapter.sendText(chat.chatId, text, { threadId: chat.threadId }).catch(() => { });
                 let text;
                 if (ok) {
-                    const { woken, restarted } = await this.recoverBackendInstances(backend);
-                    const none = t("login.none");
-                    text = t("login.success", backend, woken.length ? woken.join(", ") : none, restarted.length ? restarted.join(", ") : none);
+                    // Same order as the web-login path: the login result goes out first,
+                    // then the recovery reports its own outcome. Waiting for recovery to
+                    // build this message is what made a successful login look hung.
+                    await send(t("login.completed", backend));
+                    await announcePostLoginRecovery(backend, () => this.recoverBackendInstances(backend), send);
+                    return;
                 }
                 else if (detail === "cancelled") {
                     // The cancel command's own reply already announced this — a second
@@ -7671,31 +7713,53 @@ export class FleetManager {
      * only re-reads credentials on process start (a paused instance's CLI is
      * already dead, so waking it respawns with the new token for free).
      */
-    async recoverBackendInstances(backend) {
+    /**
+     * Wake/restart every instance of a backend after a successful re-login.
+     *
+     * Bounded by a wall-clock deadline. This used to be an unbounded sequential
+     * loop, and the caller only built its "login completed" message AFTER it
+     * returned — so with several instances (or one slow restart) the user was
+     * told nothing at all for minutes, concluded the login had hung, and
+     * restarted things by hand. Instances that do not finish in time are NOT
+     * cancelled: they are still coming back, and are reported as pending so the
+     * message can say so instead of implying failure.
+     */
+    async recoverBackendInstances(backend, deadlineMs = POST_LOGIN_RECOVERY_DEADLINE_MS) {
         const woken = [];
         const restarted = [];
+        const pending = [];
+        const deadline = Date.now() + deadlineMs;
         for (const name of this.configuredBackendInstanceNames()) {
             if (this.backendNameOf(name) !== backend)
                 continue;
             const status = this.getInstanceStatus(name);
-            try {
+            if (status !== "paused" && status !== "running")
+                continue;
+            const result = await runBeforeDeadline(async () => {
                 if (status === "paused") {
                     if (this.daemons.has(name))
                         await this.lifecycle.wake(name, 30_000);
                     else
                         await this.startPersistedPausedInstance(name);
-                    woken.push(name);
                 }
-                else if (status === "running") {
+                else {
                     await this.restartSingleInstance(name);
-                    restarted.push(name);
                 }
+            }, deadline);
+            if (result.status === "fulfilled") {
+                (status === "paused" ? woken : restarted).push(name);
             }
-            catch (err) {
-                this.logger.warn({ err: err.message, name, status }, "Post-login recovery failed");
+            else if (result.status === "timeout") {
+                // Out of time: record it and stop waiting, but keep walking the list —
+                // the remaining instances are checked against the same deadline and
+                // fall straight through, so the caller still learns about all of them.
+                pending.push(name);
+            }
+            else {
+                this.logger.warn({ err: result.reason?.message, name, status }, "Post-login recovery failed");
             }
         }
-        return { woken, restarted };
+        return { woken, restarted, pending };
     }
     /** Backend chooser button → start that backend's login session. */
     async handleLoginBackendSelect(data, callbackAdapterId, receivingAdapter) {