@songsid/agend 2.1.5-beta.9 → 2.1.6-beta.1

package/dist/deadline.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Run work under a wall-clock deadline without cancelling it.
+ *
+ * Nothing here aborts anything — a tmux spawn or an HTTP call keeps going after
+ * its deadline passes; the caller simply stops waiting and can say so. That is
+ * the point: a step with no deadline cannot report anything while it hangs, so
+ * the user sees silence and assumes the whole operation is stuck (#722, and the
+ * post-login recovery that silently swallowed its own success message).
+ *
+ * Rejections are reported rather than thrown, so one failed step never takes
+ * the surrounding loop down with it, and are always observed — an abandoned
+ * promise that rejects later must not surface as an unhandled rejection.
+ */
+export type DeadlineResult<T> = {
+    status: "fulfilled";
+    value: T;
+} | {
+    status: "rejected";
+    reason: unknown;
+} | {
+    status: "timeout";
+};
+export declare function runBeforeDeadline<T>(start: () => Promise<T>, deadline: number): Promise<DeadlineResult<T>>;

package/dist/deadline.js

@@ -0,0 +1,29 @@
+/** Largest delay setTimeout honours; anything above is clamped to 1ms by Node. */
+const MAX_TIMER_MS = 2_147_483_647;
+export async function runBeforeDeadline(start, deadline) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0)
+        return { status: "timeout" };
+    let work;
+    try {
+        work = start();
+    }
+    catch (reason) {
+        // A synchronous throw from `start` is a rejection like any other.
+        return { status: "rejected", reason };
+    }
+    let timer;
+    const timeout = new Promise(resolve => {
+        // Node clamps a delay above the 32-bit maximum to 1ms — so a very distant
+        // deadline would fire IMMEDIATELY and report every step as timed out, the
+        // exact opposite of what the caller asked for. Cap instead.
+        timer = setTimeout(() => resolve({ status: "timeout" }), Math.min(remaining, MAX_TIMER_MS));
+        timer.unref?.();
+    });
+    const settled = work.then(value => ({ status: "fulfilled", value }), reason => ({ status: "rejected", reason }));
+    const result = await Promise.race([settled, timeout]);
+    if (timer)
+        clearTimeout(timer);
+    return result;
+}
+//# sourceMappingURL=deadline.js.map

package/dist/deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sourceRoot":"","sources":["../src/deadline.ts"],"names":[],"mappings":"AAkBA,kFAAkF;AAClF,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAI,KAAuB,EAAE,QAAgB;IAClF,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,kEAAkE;QAClE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAoB,OAAO,CAAC,EAAE;QACvD,0EAA0E;QAC1E,0EAA0E;QAC1E,4DAA4D;QAC5D,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5F,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EACzC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAC3C,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/fleet-context.d.ts

@@ -5,6 +5,7 @@ import type { Scheduler } from "./scheduler/index.js";
 import type { Logger } from "./logger.js";
 import type { CostGuard } from "./cost-guard.js";
 import type { ClassicChannelManager } from "./classic-channel-manager.js";
+import type { ExplicitInstanceRemoval } from "./instance-removal.js";
 export type RouteTarget = {
     kind: "instance";
     name: string;
@@ -88,7 +89,13 @@ export interface FleetContext {
     saveFleetConfig(): void;
     getInstanceDir(name: string): string;
     createForumTopic(topicName: string, adapterId?: string): Promise<number | string>;
-    removeInstance(name: string): Promise<void>;
+    removeInstance(name: string, authorization: ExplicitInstanceRemoval): Promise<void>;
+    /** Quarantine a provider-confirmed missing topic without deleting user data. */
+    quarantineMissingTopic(threadId: string, target: RouteTarget, evidence: {
+        source: "provider-event" | "provider-probe";
+        adapterId?: string;
+        generation?: number;
+    }): void;
     getAdapterStates?(): Map<string, {
         status: string;
         retryCount: number;
@@ -153,6 +160,13 @@ export interface FleetContext {
     cancelInstallSession?(): Promise<string>;
     /** Human-readable effective model for an instance (resolves inherited defaults). */
     modelDisplayForInstance?(name: string): string;
+    /** How this instance's backend takes a reasoning-effort setting, if at all. */
+    effortStrategyFor?(name: string): "runtime" | "restart" | "unsupported";
+    /** Configured effort for an instance: per-instance, else fleet default, else none. */
+    resolveInstanceEffort?(name: string): {
+        effort: string | null;
+        source: "instance" | "fleet-default" | "unset";
+    };
     /**
      * Show a model-selection inline keyboard for the given instance in a TG topic.
      * Returns a fallback text message if no model list is available (caller should send it).

package/dist/fleet-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-context.js","sourceRoot":"","sources":["../src/fleet-context.ts"],"names":[],"mappings":"AAgCA,MAAM,UAAU,sBAAsB,CAAC,MAAmB;IACxD,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC;AACpC,CAAC"}
+{"version":3,"file":"fleet-context.js","sourceRoot":"","sources":["../src/fleet-context.ts"],"names":[],"mappings":"AAiCA,MAAM,UAAU,sBAAsB,CAAC,MAAmB;IACxD,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC;AACpC,CAAC"}

package/dist/fleet-manager.d.ts

@@ -19,6 +19,7 @@ import { type OutboundContext } from "./outbound-handlers.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
+import { type ExplicitInstanceRemoval } from "./instance-removal.js";
 import type { InstanceState } from "./backend/types.js";
 import { StormWindow } from "./storm-window.js";
 import { SpawnGate } from "./spawn-gate.js";
@@ -66,6 +67,7 @@ export interface DeliveryOptions {
     /** Test/operational override; normal deliveries use the 60 second backstop. */
     idleTimeoutMs?: number;
 }
+export declare const LOGIN_CALLBACK_PREFIX = "login:";
 /**
  * Upper bound on a live probe driven by `/model`.
  *
@@ -88,6 +90,15 @@ export interface DeliveryOptions {
  * The wait is announced before it starts, so it reads as progress, not a stall.
  */
 export declare const CLI_ENV_PROBE_DEADLINE_MS = 16000;
+/**
+ * How many CLIs may cold-start at once, from BOTH memory and cores.
+ *
+ * Memory alone said 10 on any host with roughly 3GB free, so a three-core box
+ * started ten CLIs together, saturated the CPU, and healthy starts then missed
+ * their startup budget — which used to cost the user their conversation. Cores
+ * bound how many can actually make progress; memory bounds how many fit.
+ */
+export declare function deriveSpawnConcurrency(freeMemMB: number, cores: number): number;
 export declare class FleetManager implements FleetContext, LifecycleContext, ArchiverContext, StatuslineWatcherContext, OutboundContext, AgentEndpointContext {
     dataDir: string;
     private static signalTarget;
@@ -124,6 +135,20 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private reloadPending;
     /** A running reconciliation; only one may mutate lifecycle/config state at a time. */
     private reconcileInFlight;
+    /** Topology checks are serialized separately from config reconciliation. */
+    private topicCleanupInFlight;
+    private topicCleanupGeneration;
+    private topicProbeWarnings;
+    /**
+     * Consecutive unknown probe results per route (or per adapter for outage
+     * class reasons). A single transient never reaches the operator; only a
+     * streak of TOPIC_PROBE_UNKNOWN_ESCALATION does.
+     */
+    private topicProbeUnknownStreak;
+    /** Unknown results in a row before the operator is told. 3 × 5 min poller = 15 min. */
+    static readonly TOPIC_PROBE_UNKNOWN_ESCALATION = 3;
+    /** Reasons that describe the adapter, not one topic — counted once per adapter. */
+    private static readonly TOPIC_PROBE_ADAPTER_SCOPED_REASONS;
     logger: Logger;
     private topicCommands;
     sessionRegistry: Map<string, string>;
@@ -156,6 +181,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private instanceIdleWaiters;
     private lastInboundUser;
     private cancelButtons;
+    /** Latest publication generation per instance. Late results from older
+     * generations are retired without touching the current button. */
+    private cancelButtonPublications;
+    private nextCancelButtonPublicationGeneration;
     /** Pending idle-edge retirement, one timer per instance. */
     private cancelButtonIdleRetireTimers;
     /** Duplicate-reply suppression across both the MCP and HTTP reply paths. */
@@ -321,6 +350,26 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     getWorldForInstance(name: string): AdapterWorld | undefined;
     /** Get channel config for a specific adapter (by id), falling back to primary */
     getChannelConfig(adapterId?: string): import("./types.js").ChannelConfig | undefined;
+    /**
+     * The configured world that owns `chatId`, when that is provably NOT the
+     * world `target` lives in. Returns undefined when they agree, when there is
+     * nothing to check, or when no configured channel claims the id.
+     *
+     * Deliberately one-sided: only a POSITIVE match against another channel's
+     * group id counts as foreign. A chat id that matches nothing may still be
+     * legitimate for this world (a classic channel, a DM), and treating
+     * "unrecognised" as "wrong" would stop seeding for cases that work today.
+     *
+     * Read from config rather than the live worlds map on purpose: a channel
+     * whose adapter failed to start still owns its group id, and the coordinates
+     * are just as unusable by the target's adapter either way.
+     *
+     * This is the other half of what scheduleSourceAdapter fixed. That one stops
+     * the trigger NOTICE being sent through the wrong bot; this one stops the
+     * same coordinates being planted as the target instance's reply context,
+     * which is what made its own replies fail until someone spoke to it (#752).
+     */
+    private scheduleChatWorldMismatch;
     /** Get the group_id for an instance's bound adapter */
     getGroupIdForInstance(name: string): string;
     /** Configured primary adapter id. Never infer this from Map insertion order. */
@@ -402,8 +451,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Fleet admin is an explicit config allowlist entry, not merely an open/paired user. */
     isFleetAdmin(userId: string, adapterId?: string): boolean;
     changeInstancePauseState(name: string, action: "pause" | "wake"): Promise<"paused" | "awake" | "not_idle">;
+    /** Deliver an already-resolved hot snapshot without depending on IPC timing. */
+    private applyHotConfigUpdate;
+    private classicBehaviorUpdate;
     /** Apply a Settings edit to a ClassicBot channel without waiting for the poller. */
-    restartClassicInstanceFromSettings(instanceName: string): Promise<void>;
+    restartClassicInstanceFromSettings(instanceName: string, changedFields?: string[]): Promise<void>;
+    /** Reload classicBot.yaml once. Kept callable so the periodic production
+     * path is covered without relying on fake timers around startAll(). */
+    private reloadClassicConfigFromDisk;
     startInstance(name: string, config: InstanceConfig, topicMode: boolean, kind?: "fleet-topic" | "classic", 
     /**
      * Explicit starts (CLI/API) may resume a paused or failed daemon.  Startup
@@ -674,6 +729,35 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Side effects of a routed reply: cancel-button lifecycle, logs, SSE, chat log. */
     private afterReplyRouted;
     private handleScheduleTrigger;
+    /**
+     * The adapter that can actually post into a chat, found by its group.
+     *
+     * A schedule records where it was created (reply_chat_id) separately from
+     * what it triggers (target). Those need not share a platform: a Telegram
+     * group can schedule a Discord-topic instance. Picking the adapter from the
+     * target then sends a Telegram chat id through the Discord bot, which fails
+     * with Unknown Channel — the source topic never hears that its schedule ran.
+     *
+     * When several bots share one guild, the primary wins: a persona should not
+     * be the voice announcing fleet scheduling.
+     */
+    private adapterForChat;
+    /**
+     * The adapter that can answer a schedule in the chat it was created from.
+     *
+     * A schedule records its creator (source) and its trigger (target) separately,
+     * and they need not share a platform — the live fleet has a Telegram group
+     * scheduling a Discord-topic instance. Routing by target sends a Telegram chat
+     * id through the Discord bot, which is one half of the Unknown Channel errors.
+     *
+     * The creator's own adapter comes first, and only when its world actually owns
+     * that chat. Classic keeps its own identity, so a schedule made from a
+     * persona-bound Classic channel is answered by that persona: the primary bot
+     * may not even have access there, and would be the wrong voice if it did.
+     * Falling back to the target's adapter is deliberately NOT an option — that is
+     * the misroute itself; callers say why they stayed silent instead.
+     */
+    private scheduleSourceAdapter;
     private notifySourceTopic;
     private notifyScheduleFailure;
     private handleScheduleCrud;
@@ -700,8 +784,56 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private sessionPruneTimer;
     private classicReloadTimer;
     private botUserId;
-    /** Periodically check if bound topics still exist */
+    /** Periodically check if bound topics still exist. Never deletes user data. */
     private startTopicCleanupPoller;
+    /** Coalesce timer ticks; an outage must not create overlapping destructive-looking scans. */
+    private scheduleTopicCleanup;
+    private confirmedProbeFence;
+    private sameProbeFence;
+    private topicProbeStreakKey;
+    /** A definite answer (present or missing) ends the unknown streak for that route and its adapter. */
+    private clearTopicProbeUnknownStreak;
+    /**
+     * Record one unknown probe result. Nothing here can touch quarantine or
+     * removal: unknown is always retained data. The only question is whether
+     * the operator hears about it, and a single transient (one flaky HTTP call
+     * out of dozens per pass) must not — only a streak does.
+     *
+     * Used directly for single-route events (channelDelete, the pre-action
+     * fence). The periodic scan goes through a TopicProbePass instead, so one
+     * pass over N routes of a dead adapter counts as ONE check, not N.
+     */
+    private warnTopicProbeUnknown;
+    /** One scan's worth of probe outcomes, applied to the streaks after the loop. */
+    private newTopicProbePass;
+    private passTopicProbeUnknown;
+    private passTopicProbeDefinite;
+    /**
+     * Apply a pass: a definite answer resets its keys, and an adapter that
+     * answered for any route this pass is evidently alive, so an unknown for the
+     * same adapter key in the same pass does not count — regardless of the order
+     * the routes happened to be probed in.
+     */
+    private applyTopicProbePass;
+    private noteTopicProbeUnknown;
+    /** One fixed-snapshot topology pass. Automatic evidence can only quarantine. */
+    private runTopicCleanup;
+    /**
+     * A gateway event is only a hint. Confirm it through the passive REST probe;
+     * reconnecting gateways have emitted false channelDelete events in practice.
+     */
+    private handleProviderTopicClosed;
+    private bindTopicClosedHandler;
+    /**
+     * Remove only the volatile route. The instance config, daemon, schedules,
+     * teams, metadata directory, and working tree remain untouched until an
+     * authenticated explicit deletion is requested.
+     */
+    quarantineMissingTopic(threadId: string, target: RouteTarget, evidence: {
+        source: "provider-event" | "provider-probe";
+        adapterId?: string;
+        generation?: number;
+    }): void;
     /**
      * Patch only values changed in the effective config into the original YAML
      * document. Unknown keys and comments remain untouched; redundant
@@ -712,7 +844,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
     private patchFleetDocument;
-    removeInstance(name: string): Promise<void>;
+    removeInstance(name: string, authorization: ExplicitInstanceRemoval): Promise<void>;
     startStatuslineWatcher(name: string): void;
     stopStatuslineWatcher(name: string): void;
     reactMessageStatus(instanceName: string, chatId: string, messageId: string, emoji: string): void;
@@ -789,6 +921,31 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * poll cannot flood the topic and a down General does not swallow it.
      */
     private reportClassicUnrecoverableIds;
+    /**
+     * Where a fleet-wide notice can actually be posted, or null if nowhere.
+     *
+     * On Telegram a group id is itself a chat, so posting straight to it is
+     * right. On Discord it is a *guild* id, and sending there makes the adapter
+     * fetch a channel that does not exist — DiscordAPIError 10003 Unknown
+     * Channel. That is why the daily summary never arrived on a Discord fleet:
+     * it had been posting to the guild every night and only the catch handler
+     * ever saw it.
+     *
+     * Discord therefore needs a real channel: the General topic (resolved from
+     * config rather than findGeneralInstance, so a fleet-level fault can still be
+     * reported while the General daemon is down), else the adapter's configured
+     * general_channel_id. With neither, there is no safe target and the caller
+     * should say so rather than send into a guaranteed failure.
+     */
+    private fleetNoticeTarget;
+    /**
+     * Post the daily summary where fleet-wide notices go.
+     *
+     * A named method rather than an inline closure so a test can drive the real
+     * thing: asserting on fleetNoticeTarget alone leaves the call site free to go
+     * back to posting at the bare group id, which is the defect this replaced.
+     */
+    private postDailySummary;
     notifyFleetError(text: string): void;
     private static readonly FLEET_ERROR_THROTTLE_MS;
     private fleetErrorNotices;
@@ -865,6 +1022,17 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * contain usernames or secret-adjacent text and stays in daemon.log.
      */
     notifyInteractivePrompt(instanceName: string, kind: string): Promise<void>;
+    /**
+     * Offer a one-tap re-login next to an auth alert.
+     *
+     * The alert already names the remedy in words (`/login <backend>`), which
+     * still leaves the user to retype it somewhere. The button routes into the
+     * same chooser `/login` uses, so pressing it starts the flow in place.
+     *
+     * Backends with no remote login flow (opencode logs in from a terminal) get
+     * no button — the alert's own wording already tells them what to run.
+     */
+    offerBackendLogin(targetInstance: string, backend: string): Promise<void>;
     /** Consume a General assist button exactly once. */
     private handleInteractivePromptAssist;
     /** Send a "🛑 Cancel" button to the instance's topic/channel after delivery. */
@@ -892,6 +1060,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private handleCancelClick;
     private hasCancelButton;
+    private beginCancelButtonPublication;
+    /** Remember a clear/cancel/idle decision that arrived before notifyAlert
+     * returned a message id. `expected` fences an idle timer to its generation. */
+    private markCancelButtonPublicationForRetirement;
     sendCancelButton(instanceName: string, correlationId?: string, preserveProgress?: boolean): Promise<void>;
     /**
      * The cancel button's text for a given elapsed time.
@@ -1125,6 +1297,17 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * only re-reads credentials on process start (a paused instance's CLI is
      * already dead, so waking it respawns with the new token for free).
      */
+    /**
+     * Wake/restart every instance of a backend after a successful re-login.
+     *
+     * Bounded by a wall-clock deadline. This used to be an unbounded sequential
+     * loop, and the caller only built its "login completed" message AFTER it
+     * returned — so with several instances (or one slow restart) the user was
+     * told nothing at all for minutes, concluded the login had hung, and
+     * restarted things by hand. Instances that do not finish in time are NOT
+     * cancelled: they are still coming back, and are reported as pending so the
+     * message can say so instead of implying failure.
+     */
     private recoverBackendInstances;
     /** Backend chooser button → start that backend's login session. */
     private handleLoginBackendSelect;