@songsid/agend 2.1.5-beta.2 → 2.1.5-beta.21

package/dist/deadline.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Run work under a wall-clock deadline without cancelling it.
+ *
+ * Nothing here aborts anything — a tmux spawn or an HTTP call keeps going after
+ * its deadline passes; the caller simply stops waiting and can say so. That is
+ * the point: a step with no deadline cannot report anything while it hangs, so
+ * the user sees silence and assumes the whole operation is stuck (#722, and the
+ * post-login recovery that silently swallowed its own success message).
+ *
+ * Rejections are reported rather than thrown, so one failed step never takes
+ * the surrounding loop down with it, and are always observed — an abandoned
+ * promise that rejects later must not surface as an unhandled rejection.
+ */
+export type DeadlineResult<T> = {
+    status: "fulfilled";
+    value: T;
+} | {
+    status: "rejected";
+    reason: unknown;
+} | {
+    status: "timeout";
+};
+export declare function runBeforeDeadline<T>(start: () => Promise<T>, deadline: number): Promise<DeadlineResult<T>>;

package/dist/deadline.js

@@ -0,0 +1,29 @@
+/** Largest delay setTimeout honours; anything above is clamped to 1ms by Node. */
+const MAX_TIMER_MS = 2_147_483_647;
+export async function runBeforeDeadline(start, deadline) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0)
+        return { status: "timeout" };
+    let work;
+    try {
+        work = start();
+    }
+    catch (reason) {
+        // A synchronous throw from `start` is a rejection like any other.
+        return { status: "rejected", reason };
+    }
+    let timer;
+    const timeout = new Promise(resolve => {
+        // Node clamps a delay above the 32-bit maximum to 1ms — so a very distant
+        // deadline would fire IMMEDIATELY and report every step as timed out, the
+        // exact opposite of what the caller asked for. Cap instead.
+        timer = setTimeout(() => resolve({ status: "timeout" }), Math.min(remaining, MAX_TIMER_MS));
+        timer.unref?.();
+    });
+    const settled = work.then(value => ({ status: "fulfilled", value }), reason => ({ status: "rejected", reason }));
+    const result = await Promise.race([settled, timeout]);
+    if (timer)
+        clearTimeout(timer);
+    return result;
+}
+//# sourceMappingURL=deadline.js.map

package/dist/deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sourceRoot":"","sources":["../src/deadline.ts"],"names":[],"mappings":"AAkBA,kFAAkF;AAClF,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAI,KAAuB,EAAE,QAAgB;IAClF,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,kEAAkE;QAClE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAoB,OAAO,CAAC,EAAE;QACvD,0EAA0E;QAC1E,0EAA0E;QAC1E,4DAA4D;QAC5D,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5F,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EACzC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAC3C,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/fleet-context.d.ts

@@ -5,6 +5,7 @@ import type { Scheduler } from "./scheduler/index.js";
 import type { Logger } from "./logger.js";
 import type { CostGuard } from "./cost-guard.js";
 import type { ClassicChannelManager } from "./classic-channel-manager.js";
+import type { ExplicitInstanceRemoval } from "./instance-removal.js";
 export type RouteTarget = {
     kind: "instance";
     name: string;
@@ -88,7 +89,13 @@ export interface FleetContext {
     saveFleetConfig(): void;
     getInstanceDir(name: string): string;
     createForumTopic(topicName: string, adapterId?: string): Promise<number | string>;
-    removeInstance(name: string): Promise<void>;
+    removeInstance(name: string, authorization: ExplicitInstanceRemoval): Promise<void>;
+    /** Quarantine a provider-confirmed missing topic without deleting user data. */
+    quarantineMissingTopic(threadId: string, target: RouteTarget, evidence: {
+        source: "provider-event" | "provider-probe";
+        adapterId?: string;
+        generation?: number;
+    }): void;
     getAdapterStates?(): Map<string, {
         status: string;
         retryCount: number;
@@ -103,6 +110,8 @@ export interface FleetContext {
     /** Persist and edit one `/update` message across the fleet process restart. */
     beginUpdateProgress?(adapter: import("./channel/types.js").ChannelAdapter, chatId: string, threadId: string | undefined, messageId: string): void;
     failUpdateProgress?(message: string): void;
+    /** Persist `/restart full`, wait for idle, then launch the environment-aware service restart. */
+    requestFullRestart?(adapter: import("./channel/types.js").ChannelAdapter, chatId: string, threadId: string | undefined, messageId: string): Promise<boolean>;
     /** Post one random, not-yet-dismissed tip with a dismiss button. */
     promptTip?(generalName: string, adapter: import("./channel/types.js").ChannelAdapter, chatId: string, threadId?: string): Promise<"posted" | "empty" | "unavailable">;
     /** Persistently enable advanced tips without waiting for the dismissal threshold. */
@@ -151,6 +160,13 @@ export interface FleetContext {
     cancelInstallSession?(): Promise<string>;
     /** Human-readable effective model for an instance (resolves inherited defaults). */
     modelDisplayForInstance?(name: string): string;
+    /** How this instance's backend takes a reasoning-effort setting, if at all. */
+    effortStrategyFor?(name: string): "runtime" | "restart" | "unsupported";
+    /** Configured effort for an instance: per-instance, else fleet default, else none. */
+    resolveInstanceEffort?(name: string): {
+        effort: string | null;
+        source: "instance" | "fleet-default" | "unset";
+    };
     /**
      * Show a model-selection inline keyboard for the given instance in a TG topic.
      * Returns a fallback text message if no model list is available (caller should send it).

package/dist/fleet-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-context.js","sourceRoot":"","sources":["../src/fleet-context.ts"],"names":[],"mappings":"AAgCA,MAAM,UAAU,sBAAsB,CAAC,MAAmB;IACxD,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC;AACpC,CAAC"}
+{"version":3,"file":"fleet-context.js","sourceRoot":"","sources":["../src/fleet-context.ts"],"names":[],"mappings":"AAiCA,MAAM,UAAU,sBAAsB,CAAC,MAAmB;IACxD,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC;AACpC,CAAC"}

package/dist/fleet-manager.d.ts

@@ -19,6 +19,7 @@ import { type OutboundContext } from "./outbound-handlers.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
+import { type ExplicitInstanceRemoval } from "./instance-removal.js";
 import type { InstanceState } from "./backend/types.js";
 import { StormWindow } from "./storm-window.js";
 import { SpawnGate } from "./spawn-gate.js";
@@ -66,6 +67,38 @@ export interface DeliveryOptions {
     /** Test/operational override; normal deliveries use the 60 second backstop. */
     idleTimeoutMs?: number;
 }
+export declare const LOGIN_CALLBACK_PREFIX = "login:";
+/**
+ * Upper bound on a live probe driven by `/model`.
+ *
+ * A probe chains bounded leaves but is not itself bounded: claude-code runs
+ * `--version` (5s) then listModels then listApiModels (an 8s AbortController
+ * against api.anthropic.com), and several backends' probes carry no explicit
+ * timeout at all. Awaiting that inline would make `/model` the next thing to
+ * hang, so it races this deadline and falls back to the cached list.
+ *
+ * Must stay above CLI_PROBE_LONGEST_CHAIN_MS — the probe's bounded steps run
+ * back to back, so clearing only the longest single leaf would be false
+ * confidence: a deadline above 8s but below the 13s chain still truncates a
+ * probe that would have succeeded. Bounding the chain rather than the leaf is
+ * the lesson from the usage hang, and the tests assert against the derived
+ * chain constant so raising either step cannot silently break it.
+ *
+ * The deadline exists to stop a probe hanging forever, not to cut short one that
+ * would have finished: truncating a legitimate probe serves the previous list
+ * and hides exactly the newly released model the user opened `/model` to find.
+ * The wait is announced before it starts, so it reads as progress, not a stall.
+ */
+export declare const CLI_ENV_PROBE_DEADLINE_MS = 16000;
+/**
+ * How many CLIs may cold-start at once, from BOTH memory and cores.
+ *
+ * Memory alone said 10 on any host with roughly 3GB free, so a three-core box
+ * started ten CLIs together, saturated the CPU, and healthy starts then missed
+ * their startup budget — which used to cost the user their conversation. Cores
+ * bound how many can actually make progress; memory bounds how many fit.
+ */
+export declare function deriveSpawnConcurrency(freeMemMB: number, cores: number): number;
 export declare class FleetManager implements FleetContext, LifecycleContext, ArchiverContext, StatuslineWatcherContext, OutboundContext, AgentEndpointContext {
     dataDir: string;
     private static signalTarget;
@@ -102,6 +135,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private reloadPending;
     /** A running reconciliation; only one may mutate lifecycle/config state at a time. */
     private reconcileInFlight;
+    /** Topology checks are serialized separately from config reconciliation. */
+    private topicCleanupInFlight;
+    private topicCleanupGeneration;
+    private topicProbeWarnings;
     logger: Logger;
     private topicCommands;
     sessionRegistry: Map<string, string>;
@@ -199,6 +236,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private updateProgressEditRunning;
     private lastUpdateProgressText;
     private updateCompletionTipText;
+    /** Injectable only to keep the chat→CLI reload hand-off deterministic in tests. */
+    private fullRestartLauncher;
     private eventLogPruneTimer;
     private logRotateTimer;
     /** Days of event/activity history to keep. */
@@ -287,6 +326,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private isModelAdmin;
     private handlePauseWakeSlash;
     private handleUpdateSlash;
+    private handleRestartSlash;
     private handleTipsSlash;
     /** Admin-only full conversation reset for fleet-topic and Classic instances. */
     private handleClearSlash;
@@ -296,6 +336,26 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     getWorldForInstance(name: string): AdapterWorld | undefined;
     /** Get channel config for a specific adapter (by id), falling back to primary */
     getChannelConfig(adapterId?: string): import("./types.js").ChannelConfig | undefined;
+    /**
+     * The configured world that owns `chatId`, when that is provably NOT the
+     * world `target` lives in. Returns undefined when they agree, when there is
+     * nothing to check, or when no configured channel claims the id.
+     *
+     * Deliberately one-sided: only a POSITIVE match against another channel's
+     * group id counts as foreign. A chat id that matches nothing may still be
+     * legitimate for this world (a classic channel, a DM), and treating
+     * "unrecognised" as "wrong" would stop seeding for cases that work today.
+     *
+     * Read from config rather than the live worlds map on purpose: a channel
+     * whose adapter failed to start still owns its group id, and the coordinates
+     * are just as unusable by the target's adapter either way.
+     *
+     * This is the other half of what scheduleSourceAdapter fixed. That one stops
+     * the trigger NOTICE being sent through the wrong bot; this one stops the
+     * same coordinates being planted as the target instance's reply context,
+     * which is what made its own replies fail until someone spoke to it (#752).
+     */
+    private scheduleChatWorldMismatch;
     /** Get the group_id for an instance's bound adapter */
     getGroupIdForInstance(name: string): string;
     /** Configured primary adapter id. Never infer this from Map insertion order. */
@@ -448,6 +508,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private startClassicInstanceUnattended;
     private backendNameOf;
+    /**
+     * Every configured instance whose backend may share credentials. ClassicBot
+     * rows live only in classicBot.yaml, so backend-wide operations must not use
+     * fleetConfig.instances as their roster. Set keeps a malformed name collision
+     * from restarting the same process twice; backendNameOf defines ownership.
+     */
+    private configuredBackendInstanceNames;
     /**
      * One fleet-level notice per burst, not one per instance: a post-update herd
      * fails many instances within the same second. Two notices per incident at
@@ -457,6 +524,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private runnableStartupCount;
     private configuredStartupInstanceNames;
     private restartProgressTarget;
+    /** Resolve only an adapter generation that can accept progress delivery.
+     * Discord exposes direct gateway readiness; adapters without a health
+     * snapshot use the fleet startup/retry state. */
+    private readyProgressAdapter;
+    /** Last-resort completion after RestartProgress could not deliver to its
+     * adopted target. It stays bounded and never wakes a not-ready gateway. */
+    private sendFleetStartCompletionFallback;
     stopInstance(name: string): Promise<void>;
     /** Restart a single instance, reloading fleet.yaml first to pick up config changes. */
     restartSingleInstance(name: string, opts?: {
@@ -479,6 +553,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         token: string | null;
     };
     beginUpdateProgress(adapter: ChannelAdapter, chatId: string, threadId: string | undefined, messageId: string): void;
+    /** Persist the public response, wait for idle, then start the canonical service restart. */
+    requestFullRestart(adapter: ChannelAdapter, chatId: string, threadId: string | undefined, messageId: string): Promise<boolean>;
+    private isOwnedFullRestartMarker;
+    /** Give current work the same bounded idle grace used by graceful reload. */
+    private waitForFullRestartIdleGrace;
+    private reportFullRestartFailure;
     failUpdateProgress(message: string): void;
     /** The old fleet edits CLI install stages; the new fleet adopts the same message below. */
     private startUpdateProgressMonitor;
@@ -629,6 +709,35 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Side effects of a routed reply: cancel-button lifecycle, logs, SSE, chat log. */
     private afterReplyRouted;
     private handleScheduleTrigger;
+    /**
+     * The adapter that can actually post into a chat, found by its group.
+     *
+     * A schedule records where it was created (reply_chat_id) separately from
+     * what it triggers (target). Those need not share a platform: a Telegram
+     * group can schedule a Discord-topic instance. Picking the adapter from the
+     * target then sends a Telegram chat id through the Discord bot, which fails
+     * with Unknown Channel — the source topic never hears that its schedule ran.
+     *
+     * When several bots share one guild, the primary wins: a persona should not
+     * be the voice announcing fleet scheduling.
+     */
+    private adapterForChat;
+    /**
+     * The adapter that can answer a schedule in the chat it was created from.
+     *
+     * A schedule records its creator (source) and its trigger (target) separately,
+     * and they need not share a platform — the live fleet has a Telegram group
+     * scheduling a Discord-topic instance. Routing by target sends a Telegram chat
+     * id through the Discord bot, which is one half of the Unknown Channel errors.
+     *
+     * The creator's own adapter comes first, and only when its world actually owns
+     * that chat. Classic keeps its own identity, so a schedule made from a
+     * persona-bound Classic channel is answered by that persona: the primary bot
+     * may not even have access there, and would be the wrong voice if it did.
+     * Falling back to the target's adapter is deliberately NOT an option — that is
+     * the misroute itself; callers say why they stayed silent instead.
+     */
+    private scheduleSourceAdapter;
     private notifySourceTopic;
     private notifyScheduleFailure;
     private handleScheduleCrud;
@@ -655,8 +764,31 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private sessionPruneTimer;
     private classicReloadTimer;
     private botUserId;
-    /** Periodically check if bound topics still exist */
+    /** Periodically check if bound topics still exist. Never deletes user data. */
     private startTopicCleanupPoller;
+    /** Coalesce timer ticks; an outage must not create overlapping destructive-looking scans. */
+    private scheduleTopicCleanup;
+    private confirmedProbeFence;
+    private sameProbeFence;
+    private warnTopicProbeUnknown;
+    /** One fixed-snapshot topology pass. Automatic evidence can only quarantine. */
+    private runTopicCleanup;
+    /**
+     * A gateway event is only a hint. Confirm it through the passive REST probe;
+     * reconnecting gateways have emitted false channelDelete events in practice.
+     */
+    private handleProviderTopicClosed;
+    private bindTopicClosedHandler;
+    /**
+     * Remove only the volatile route. The instance config, daemon, schedules,
+     * teams, metadata directory, and working tree remain untouched until an
+     * authenticated explicit deletion is requested.
+     */
+    quarantineMissingTopic(threadId: string, target: RouteTarget, evidence: {
+        source: "provider-event" | "provider-probe";
+        adapterId?: string;
+        generation?: number;
+    }): void;
     /**
      * Patch only values changed in the effective config into the original YAML
      * document. Unknown keys and comments remain untouched; redundant
@@ -667,7 +799,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
     private patchFleetDocument;
-    removeInstance(name: string): Promise<void>;
+    removeInstance(name: string, authorization: ExplicitInstanceRemoval): Promise<void>;
     startStatuslineWatcher(name: string): void;
     stopStatuslineWatcher(name: string): void;
     reactMessageStatus(instanceName: string, chatId: string, messageId: string, emoji: string): void;
@@ -744,6 +876,31 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * poll cannot flood the topic and a down General does not swallow it.
      */
     private reportClassicUnrecoverableIds;
+    /**
+     * Where a fleet-wide notice can actually be posted, or null if nowhere.
+     *
+     * On Telegram a group id is itself a chat, so posting straight to it is
+     * right. On Discord it is a *guild* id, and sending there makes the adapter
+     * fetch a channel that does not exist — DiscordAPIError 10003 Unknown
+     * Channel. That is why the daily summary never arrived on a Discord fleet:
+     * it had been posting to the guild every night and only the catch handler
+     * ever saw it.
+     *
+     * Discord therefore needs a real channel: the General topic (resolved from
+     * config rather than findGeneralInstance, so a fleet-level fault can still be
+     * reported while the General daemon is down), else the adapter's configured
+     * general_channel_id. With neither, there is no safe target and the caller
+     * should say so rather than send into a guaranteed failure.
+     */
+    private fleetNoticeTarget;
+    /**
+     * Post the daily summary where fleet-wide notices go.
+     *
+     * A named method rather than an inline closure so a test can drive the real
+     * thing: asserting on fleetNoticeTarget alone leaves the call site free to go
+     * back to posting at the bare group id, which is the defect this replaced.
+     */
+    private postDailySummary;
     notifyFleetError(text: string): void;
     private static readonly FLEET_ERROR_THROTTLE_MS;
     private fleetErrorNotices;
@@ -820,6 +977,17 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * contain usernames or secret-adjacent text and stays in daemon.log.
      */
     notifyInteractivePrompt(instanceName: string, kind: string): Promise<void>;
+    /**
+     * Offer a one-tap re-login next to an auth alert.
+     *
+     * The alert already names the remedy in words (`/login <backend>`), which
+     * still leaves the user to retype it somewhere. The button routes into the
+     * same chooser `/login` uses, so pressing it starts the flow in place.
+     *
+     * Backends with no remote login flow (opencode logs in from a terminal) get
+     * no button — the alert's own wording already tells them what to run.
+     */
+    offerBackendLogin(targetInstance: string, backend: string): Promise<void>;
     /** Consume a General assist button exactly once. */
     private handleInteractivePromptAssist;
     /** Send a "🛑 Cancel" button to the instance's topic/channel after delivery. */
@@ -1080,6 +1248,17 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * only re-reads credentials on process start (a paused instance's CLI is
      * already dead, so waking it respawns with the new token for free).
      */
+    /**
+     * Wake/restart every instance of a backend after a successful re-login.
+     *
+     * Bounded by a wall-clock deadline. This used to be an unbounded sequential
+     * loop, and the caller only built its "login completed" message AFTER it
+     * returned — so with several instances (or one slow restart) the user was
+     * told nothing at all for minutes, concluded the login had hung, and
+     * restarted things by hand. Instances that do not finish in time are NOT
+     * cancelled: they are still coming back, and are reported as pending so the
+     * message can say so instead of implying failure.
+     */
     private recoverBackendInstances;
     /** Backend chooser button → start that backend's login session. */
     private handleLoginBackendSelect;
@@ -1187,6 +1366,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private cliEnvPath;
     /** Read the cached CLI env for a backend, or null if missing/stale/unparseable. */
     private readCliEnv;
+    /** True when a cached CLI env is old enough that `/model` should re-probe. */
+    private cliEnvNeedsRefresh;
+    /**
+     * Run a live probe under a deadline, falling back to whatever the cache holds.
+     * A model list is an aid: a vendor that stops answering must degrade to the
+     * previous list, never stall the command that asked for it.
+     */
+    private probeBackendBounded;
     /**
      * Resolve the effective model for a fleet or ClassicBot instance, plus where it
      * came from. Single source of truth for `/model` and `/ctx` — precedence: