@songsid/agend 2.1.6-beta.1 → 2.1.6-beta.3

package/dist/fleet-level-config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Which fleet settings only a fresh process can adopt.
+ *
+ * The test is mechanical, not intuitive: **read once at construction and never
+ * re-read by `reconcileInstances`**. "Feels fleet-level" is not the test —
+ * `defaults.backend` feels fleet-level and is absorbed entirely by restarting
+ * the agents.
+ *
+ * Getting this set wrong in the *narrow* direction is worse than not narrowing
+ * at all. A startup-only key left out is saved to disk, produces no instance
+ * restart and no fleet row, and therefore never takes effect and never tells
+ * anyone — where an over-broad set only asks for a restart that was not needed.
+ * `tests/fleet-level-config.test.ts` asserts both sides of the line so a new
+ * key has to be classified deliberately.
+ */
+import type { FleetConfig } from "./types.js";
+/**
+ * Startup-only, with the construction site that consumes each one.
+ *
+ * `timezone` is deliberately absent: `detectLocale()` reads only
+ * `defaults.locale` plus the host clock, and the configurable timezone lives
+ * inside `defaults.cost_guard`, which is covered whole.
+ */
+export declare const STARTUP_ONLY_FLEET_KEYS: readonly ["channel", "channels", "health_port", "defaults.locale", "defaults.cost_guard", "defaults.webhooks", "defaults.daily_summary", "defaults.scheduler.max_schedules", "defaults.scheduler.default_timezone"];
+/**
+ * Verified to be read at the point of use, so they must NOT be in the set above.
+ *
+ * Listed rather than implied: the enumeration test asserts their absence, which
+ * is what stops the set from quietly growing back into "every cold default".
+ */
+export declare const RUNTIME_READ_FLEET_KEYS: readonly ["defaults.backend", "defaults.model", "defaults.tool_set", "defaults.agent_mode", "defaults.hang_detector", "defaults.startup.concurrency", "defaults.startup.stagger_delay_ms", "defaults.max_cross_instance_message_bytes", "defaults.tips", "defaults.progress_min_elapsed", "defaults.scheduler.retry_count", "defaults.scheduler.retry_interval_ms", "web", "hostname", "login", "web_terminal"];
+/**
+ * The fleet-level configuration as one comparable string.
+ *
+ * Built by walking a fixed key list, so the output is stable regardless of the
+ * order keys appear in the YAML — two configs that differ only in key order
+ * must not look like a pending restart.
+ */
+export declare function fleetLevelSignature(config: FleetConfig | null): string;
+/** The keys whose values differ between two configs — for the log line that
+ * explains why a restart is being asked for, or why two signatures disagree. */
+export declare function fleetLevelDifferences(a: FleetConfig | null, b: FleetConfig | null): string[];

package/dist/fleet-level-config.js

@@ -0,0 +1,78 @@
+/**
+ * Startup-only, with the construction site that consumes each one.
+ *
+ * `timezone` is deliberately absent: `detectLocale()` reads only
+ * `defaults.locale` plus the host clock, and the configurable timezone lives
+ * inside `defaults.cost_guard`, which is covered whole.
+ */
+export const STARTUP_ONLY_FLEET_KEYS = [
+    "channel", // createAdapter() at startup
+    "channels", // createAdapter() at startup
+    "health_port", // startHealthServer(), once
+    "defaults.locale", // setLocale(detectLocale(fleet)), once
+    "defaults.cost_guard", // new CostGuard(...)
+    "defaults.webhooks", // new WebhookEmitter(...)
+    "defaults.daily_summary", // new DailySummary(...)
+    "defaults.scheduler.max_schedules", // Scheduler ctor config
+    "defaults.scheduler.default_timezone", // Scheduler ctor config
+];
+/**
+ * Verified to be read at the point of use, so they must NOT be in the set above.
+ *
+ * Listed rather than implied: the enumeration test asserts their absence, which
+ * is what stops the set from quietly growing back into "every cold default".
+ */
+export const RUNTIME_READ_FLEET_KEYS = [
+    // Absorbed by restarting the agent.
+    "defaults.backend",
+    "defaults.model",
+    "defaults.tool_set",
+    "defaults.agent_mode",
+    "defaults.hang_detector",
+    // Read per spawn by the SpawnGate closures.
+    "defaults.startup.concurrency",
+    "defaults.startup.stagger_delay_ms",
+    // Read per message / per post / per tick.
+    "defaults.max_cross_instance_message_bytes",
+    "defaults.tips",
+    "defaults.progress_min_elapsed",
+    // Read on every schedule trigger, unlike the two Scheduler ctor keys.
+    "defaults.scheduler.retry_count",
+    "defaults.scheduler.retry_interval_ms",
+    // Read when the value is used; no construction captures them.
+    "web",
+    "hostname",
+    "login",
+    "web_terminal",
+];
+function pick(source, path) {
+    let value = source;
+    for (const segment of path.split(".")) {
+        if (value === null || typeof value !== "object")
+            return undefined;
+        value = value[segment];
+    }
+    return value;
+}
+/**
+ * The fleet-level configuration as one comparable string.
+ *
+ * Built by walking a fixed key list, so the output is stable regardless of the
+ * order keys appear in the YAML — two configs that differ only in key order
+ * must not look like a pending restart.
+ */
+export function fleetLevelSignature(config) {
+    const snapshot = {};
+    for (const path of STARTUP_ONLY_FLEET_KEYS) {
+        const value = pick(config, path);
+        if (value !== undefined)
+            snapshot[path] = value;
+    }
+    return JSON.stringify(snapshot);
+}
+/** The keys whose values differ between two configs — for the log line that
+ * explains why a restart is being asked for, or why two signatures disagree. */
+export function fleetLevelDifferences(a, b) {
+    return STARTUP_ONLY_FLEET_KEYS.filter(path => JSON.stringify(pick(a, path) ?? null) !== JSON.stringify(pick(b, path) ?? null));
+}
+//# sourceMappingURL=fleet-level-config.js.map

package/dist/fleet-level-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-level-config.js","sourceRoot":"","sources":["../src/fleet-level-config.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAA+B,6BAA6B;IACrE,UAAU,EAA8B,6BAA6B;IACrE,aAAa,EAA2B,4BAA4B;IACpE,iBAAiB,EAAuB,uCAAuC;IAC/E,qBAAqB,EAAmB,qBAAqB;IAC7D,mBAAmB,EAAqB,0BAA0B;IAClE,wBAAwB,EAAgB,wBAAwB;IAChE,kCAAkC,EAAM,wBAAwB;IAChE,qCAAqC,EAAG,wBAAwB;CACxD,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,oCAAoC;IACpC,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;IACrB,wBAAwB;IACxB,4CAA4C;IAC5C,8BAA8B;IAC9B,mCAAmC;IACnC,0CAA0C;IAC1C,2CAA2C;IAC3C,eAAe;IACf,+BAA+B;IAC/B,sEAAsE;IACtE,gCAAgC;IAChC,sCAAsC;IACtC,8DAA8D;IAC9D,KAAK;IACL,UAAU;IACV,OAAO;IACP,cAAc;CACN,CAAC;AAEX,SAAS,IAAI,CAAC,MAAe,EAAE,IAAY;IACzC,IAAI,KAAK,GAAY,MAAM,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClE,KAAK,GAAI,KAAiC,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,CAAqB,EAAE,CAAqB;IAChF,OAAO,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AACrF,CAAC"}

package/dist/fleet-lock.d.ts

@@ -1,7 +1,16 @@
+/**
+ * What kind of process holds the lock.
+ *
+ * A record written before this field existed has no role; it can only have been
+ * a fleet, so that is what a missing value means. Never widen that default —
+ * "unknown" must not become "safe to take from".
+ */
+export type FleetLockRole = "fleet" | "setup-host";
 interface FleetLockRecord {
     pid: number;
     nonce: string;
     createdAt: string;
+    role?: FleetLockRole;
 }
 export interface FleetLockHandle {
     path: string;
@@ -11,11 +20,23 @@ export interface FleetLockHandle {
 export interface FleetLockProbe {
     pid?: number;
     nonce?: string;
+    /** Defaults to "fleet"; the pre-fleet setup host claims "setup-host". */
+    role?: FleetLockRole;
     isProcessAlive?: (pid: number) => boolean;
     readCommandLine?: (pid: number) => string;
 }
+/** Whether a process command line identifies the AgEnD setup page. */
+export declare function isSetupHostCommandLine(commandLine: string): boolean;
 /** Whether a process command line identifies an AgEnD fleet process. */
 export declare function isFleetStartCommandLine(commandLine: string): boolean;
+/**
+ * A process's command line, or "" when it cannot be read.
+ *
+ * Exported because the health-port takeover has to answer the same question
+ * before it sends a signal: an empty answer means "cannot confirm", and nothing
+ * destructive may be done on that.
+ */
+export declare function readProcessCommandLine(pid: number): string;
 /**
  * Atomically claim one fleet process per AGEND_HOME. O_EXCL is portable and,
  * unlike fleet.pid, is acquired before FleetManager can mutate tmux or sockets.

package/dist/fleet-lock.js

@@ -2,6 +2,11 @@ import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "
 import { execFileSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { join } from "node:path";
+/** Whether a process command line identifies the AgEnD setup page. */
+export function isSetupHostCommandLine(commandLine) {
+    const normalized = commandLine.replace(/\0/g, " ").replace(/\s+/g, " ").trim();
+    return /\b(?:agend|(?:cli|daemon-entry)\.(?:js|ts))\b.*\bsetup\b/i.test(normalized);
+}
 /** Whether a process command line identifies an AgEnD fleet process. */
 export function isFleetStartCommandLine(commandLine) {
     const normalized = commandLine.replace(/\0/g, " ").replace(/\s+/g, " ").trim();
@@ -16,7 +21,14 @@ function processAlive(pid) {
         return false;
     }
 }
-function processCommandLine(pid) {
+/**
+ * A process's command line, or "" when it cannot be read.
+ *
+ * Exported because the health-port takeover has to answer the same question
+ * before it sends a signal: an empty answer means "cannot confirm", and nothing
+ * destructive may be done on that.
+ */
+export function readProcessCommandLine(pid) {
     try {
         return readFileSync(`/proc/${pid}/cmdline`, "utf8").replace(/\0/g, " ").trim();
     }
@@ -57,10 +69,11 @@ export function acquireFleetLock(dataDir, probe = {}) {
         pid,
         nonce: probe.nonce ?? randomBytes(16).toString("hex"),
         createdAt: new Date().toISOString(),
+        role: probe.role ?? "fleet",
     };
     const serialized = JSON.stringify(record) + "\n";
     const isAlive = probe.isProcessAlive ?? processAlive;
-    const readCommandLine = probe.readCommandLine ?? processCommandLine;
+    const readCommandLine = probe.readCommandLine ?? readProcessCommandLine;
     for (let attempt = 0; attempt < 4; attempt++) {
         try {
             writeFileSync(lockPath, serialized, { encoding: "utf8", flag: "wx", mode: 0o600 });
@@ -81,14 +94,35 @@ export function acquireFleetLock(dataDir, probe = {}) {
         const owner = parseRecord(observed);
         if (owner && isAlive(owner.pid)) {
             const commandLine = readCommandLine(owner.pid);
-            if (isFleetStartCommandLine(commandLine)) {
-                throw new Error(`Fleet is already running (PID ${owner.pid}, lock: ${lockPath})`);
+            // A live setup host is an owner in its own right. Before the role existed
+            // its command line did not match the fleet pattern, so a starting fleet
+            // read the lock as stale and took it — and then collided with the host on
+            // the health port, where the takeover kills whatever fleet.pid names.
+            //
+            // Symmetric with the fleet case on purpose: the setup page is short-lived
+            // and often killed outright, so its pid is a prime candidate for reuse
+            // after a reboot. Positive evidence that the pid now belongs to something
+            // else makes the record stale; no evidence still refuses, because an
+            // unreadable owner must never be assumed absent.
+            if (owner.role === "setup-host") {
+                if (!commandLine) {
+                    throw new Error(`Fleet lock is owned by live PID ${owner.pid}; refusing to replace it`);
+                }
+                if (isSetupHostCommandLine(commandLine)) {
+                    throw new Error(`Setup is already running (PID ${owner.pid}, lock: ${lockPath})`);
+                }
+                // The pid was reused by an unrelated process: the lock is stale.
             }
-            // An alive PID with an unreadable command line is not safe to steal from.
-            if (!commandLine) {
-                throw new Error(`Fleet lock is owned by live PID ${owner.pid}; refusing to replace it`);
+            else {
+                if (isFleetStartCommandLine(commandLine)) {
+                    throw new Error(`Fleet is already running (PID ${owner.pid}, lock: ${lockPath})`);
+                }
+                // An alive PID with an unreadable command line is not safe to steal from.
+                if (!commandLine) {
+                    throw new Error(`Fleet lock is owned by live PID ${owner.pid}; refusing to replace it`);
+                }
+                // The PID was reused by an unrelated process: the lock is stale.
             }
-            // The PID was reused by an unrelated process: the lock is stale.
         }
         // Only unlink the exact stale record we inspected. A competing starter may
         // already have replaced it; in that case leave its lock untouched and retry.

package/dist/fleet-lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-lock.js","sourceRoot":"","sources":["../src/fleet-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAqBjC,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,mEAAmE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,SAAS,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE;gBAC/D,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,QAAwB,EAAE;IAC1E,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAoB;QAC9B,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,IAAI,YAAY,CAAC;IACrD,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,kBAAkB,CAAC;IAEpE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QAED,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC;YAAC,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAClD,MAAM,CAAC;YACL,mEAAmE;YACnE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,GAAG,WAAW,QAAQ,GAAG,CAAC,CAAC;YACpF,CAAC;YACD,0EAA0E;YAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,GAAG,0BAA0B,CAAC,CAAC;YAC1F,CAAC;YACD,iEAAiE;QACnE,CAAC;QAED,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,CAAC;YACH,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,QAAQ;gBAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,MAAmC;IAClE,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC;QACH,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC1E,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,gBAA6C,CAAC;AAElD,MAAM,UAAU,mBAAmB,CAAC,MAAuB;IACzD,gBAAgB,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC;IAChC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,gBAAgB,GAAG,SAAS,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"fleet-lock.js","sourceRoot":"","sources":["../src/fleet-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiCjC,sEAAsE;AACtE,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,2DAA2D,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACtF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,mEAAmE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,SAAS,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE;gBAC/D,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,QAAwB,EAAE;IAC1E,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAoB;QAC9B,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO;KAC5B,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,IAAI,YAAY,CAAC;IACrD,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,sBAAsB,CAAC;IAExE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QAED,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC;YAAC,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAClD,MAAM,CAAC;YACL,mEAAmE;YACnE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,EAAE;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,iDAAiD;YACjD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,GAAG,0BAA0B,CAAC,CAAC;gBAC1F,CAAC;gBACD,IAAI,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,GAAG,WAAW,QAAQ,GAAG,CAAC,CAAC;gBACpF,CAAC;gBACD,iEAAiE;YACnE,CAAC;iBAAM,CAAC;gBACR,IAAI,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,GAAG,WAAW,QAAQ,GAAG,CAAC,CAAC;gBACpF,CAAC;gBACD,0EAA0E;gBAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,GAAG,0BAA0B,CAAC,CAAC;gBAC1F,CAAC;gBACD,iEAAiE;YACjE,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,CAAC;YACH,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,QAAQ;gBAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,MAAmC;IAClE,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC;QACH,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC1E,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,gBAA6C,CAAC;AAElD,MAAM,UAAU,mBAAmB,CAAC,MAAuB;IACzD,gBAAgB,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC;IAChC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,gBAAgB,GAAG,SAAS,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/fleet-manager.d.ts

@@ -21,6 +21,7 @@ import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
 import { type ExplicitInstanceRemoval } from "./instance-removal.js";
 import type { InstanceState } from "./backend/types.js";
+import { ApplyJobStore, type ApplyJob, type ApplyTargetKind, type SelfRestartResult } from "./apply-job.js";
 import { StormWindow } from "./storm-window.js";
 import { SpawnGate } from "./spawn-gate.js";
 import { BackendOutageTracker } from "./backend-outage.js";
@@ -262,7 +263,29 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private mirrorBuffer;
     private mirrorTimer;
     private sseClients;
-    private webToken;
+    /**
+     * Read from disk on every access rather than cached at startup: `agend
+     * web-token rotate` runs in a separate process, and a cached copy would keep
+     * authorizing revoked links and cookies until the fleet restarted.
+     */
+    private get webToken();
+    /**
+     * Set while a Settings apply job is driving the reconcile. The reconcile
+     * stays the single doer; it just says out loud what it is doing to whom, so
+     * the job's rows are the work rather than a prediction of it.
+     */
+    private applyJobStoreCache;
+    /** The apply that currently owns the reconcile slot, reserved synchronously
+     * so a second request cannot slip in before the first one starts working. */
+    private activeApplyJobId;
+    /** The fleet-level signature this process actually came up on. */
+    private appliedFleetLevel;
+    /** The config behind that signature, kept so a "needs restart" log can name
+     * which keys moved rather than just asserting that something did. */
+    private startupFleetConfig;
+    /** Set when the file on disk and the in-memory config disagree on a
+     * startup-only key at startup. See checkStartupSignatureConsistency(). */
+    private fleetSignatureMismatch;
     private viewToken;
     private healthServerListening;
     constructor(dataDir: string);
@@ -273,6 +296,18 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     stormSuppressed(kind: string): boolean;
     private handleSighup;
     private scheduleReconcile;
+    /**
+     * Take the reconcile slot, or refuse.
+     *
+     * Only one reconcile may touch lifecycle and config at a time — two of them
+     * stop and start the same instance in parallel. SIGHUP and a Settings apply
+     * are the same operation from two entrances, so they share the one slot: the
+     * signal coalesces into a pending replay, the apply is told the fleet is busy.
+     *
+     * The returned promise is the caller's to handle; the stored one is already
+     * handled, so a rejection never escapes as an unhandled rejection.
+     */
+    private startExclusiveReconcile;
     /**
      * Is the fleet going down (or coming back up) on purpose?
      *
@@ -398,6 +433,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * Classic channels use their effective backend merge chain, not the raw row.
      */
     getActiveUsageProviderIds(): ReadonlySet<string>;
+    /** `[instance, effective backend, credential profile]` for everything that is
+     * running or paused — the one place both usage views agree on who is live. */
+    private activeBackendBindings;
     /** Effective backends with a running or persisted-paused fleet/Classic instance. */
     getActiveBackendIds(): ReadonlySet<string>;
     isClassicInstance(name: string): boolean;
@@ -1584,6 +1622,89 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * fields, plus cold fleet-level settings, retain restart semantics.
      */
     private reconcileInstances;
+    /**
+     * `{channel, cold defaults}` as one comparable string — the part of the config
+     * a running fleet process cannot adopt without restarting.
+     */
+    private fleetLevelSignature;
+    /**
+     * The config a reconcile is about to load, not the one held in memory.
+     *
+     * Settings mutates the in-memory object and writes the file; only the file
+     * goes back through defaults expansion. Forecasting from memory therefore
+     * misses every instance that a changed fleet default will restart — the user
+     * is told "restart AgEnD" and not told that five agents are about to go down.
+     */
+    private nextFleetConfig;
+    /**
+     * Does the config this process is running match the one a reconcile would
+     * load off disk?
+     *
+     * If not, every apply reports a fleet-level change that a restart cannot
+     * clear — restart, recompute, disagree again — a self-sustaining loop that
+     * the rate limit can only slow to three naggings an hour. Startup rewrites
+     * the file in three places before this point (slimFleetConfigAtStartup, the
+     * general auto-create, the general fixup), so the two can genuinely diverge.
+     *
+     * An offer to restart that cannot possibly succeed is worse than no offer, so
+     * the panel shows the mismatch instead of a button.
+     */
+    private checkStartupSignatureConsistency;
+    /**
+     * Is a live adapter already long-polling this bot token?
+     *
+     * Telegram's `getUpdates` has exactly one consumer: a second poller takes
+     * turns with the first and both miss messages. The setup wizard's "post in
+     * the group and I'll detect it" step is a second poller, so it has to know
+     * when the answer is "not against this token, not while I'm running".
+     */
+    isBotTokenInUse(token: string): boolean;
+    /** Non-null when startup found the running config and fleet.yaml disagreeing. */
+    fleetSignatureMismatchKeys(): string[] | null;
+    /**
+     * Restart AgEnD itself on behalf of a Settings apply.
+     *
+     * Deliberately a separate action from Apply: the panel is reachable from
+     * outside the LAN, and "restart the whole fleet" must never be something a
+     * single Apply click can carry along with it.
+     *
+     * The order below is the safety envelope, and the order matters:
+     * concurrency and consistency first (cheap, and a restart during a reconcile
+     * is the dangerous one), then the state checks, then the rate limit, then the
+     * audit notice — and only once all of that holds is the attempt written to
+     * disk and fsynced, before anything spawns.
+     */
+    requestSettingsSelfRestart(jobId: string, key: string): Promise<SelfRestartResult>;
+    /** The audit notice, and the message the restart progress will edit. */
+    private postSelfRestartNotice;
+    /** Jobs outlive this process on purpose; see apply-job.ts. */
+    get applyJobs(): ApplyJobStore;
+    /**
+     * What a reconcile is about to do, per target.
+     *
+     * A forecast, not the record: it is built from the same `classifyInstanceChange`
+     * the reconcile decides with, but the rows that end up in the job are the ones
+     * the reconcile reports as it works. A target the forecast missed (a Classic
+     * instance inheriting a changed default) is added when it is first touched.
+     */
+    planConfigApply(): Array<{
+        target: string;
+        kind: ApplyTargetKind;
+    }>;
+    /**
+     * Start (or re-join) a Settings apply.
+     *
+     * The key is the client's. Handing back the existing job for a repeated key is
+     * the whole point: the retry after a lost response must not apply everything a
+     * second time.
+     */
+    startSettingsApply(key: string): {
+        job: ApplyJob;
+        reused: boolean;
+    } | {
+        busy: ApplyJob | null;
+    };
+    private runSettingsApply;
     restartInstances(): Promise<void>;
     private checkForUpdates;
     /**