@songsid/agend 2.1.6-beta.11 → 2.1.6-beta.13

package/dist/fleet-manager.d.ts

@@ -1128,6 +1128,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * would have to make this async and change every caller.
      */
     notifyInstanceTopic(instanceName: string, text: string, extraOpts?: import("./channel/types.js").SendOpts): boolean;
+    /** A migration debt is retired only after the platform accepted the send. */
+    notifyInstanceTopicConfirmed(instanceName: string, text: string): Promise<boolean>;
     /**
      * Post decision buttons whose callback ids are `<prefix><nonce>:<action>`.
      * The entry is registered before the send and rolled back if the send
@@ -1676,7 +1678,15 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private customProviderFor;
     /** Ask a backend for its catalog using ONE instance's real config. Never throws. */
     private instanceScopedModels;
-    /** Account-wide catalog: probe cache first, live probe on miss. */
+    /**
+     * Account-wide catalog: probe cache first, live probe when the cache is
+     * missing or older than the same ~1h window `/model` uses (#888).
+     *
+     * Previously this served anything inside the 24h hard TTL, so `list_models`
+     * could answer with a day-old list `/model` had already re-probed past.
+     * The probe runs under the same deadline `/model` uses: a vendor that stops
+     * answering degrades to the previous list, never stalls the tool call.
+     */
     private globalModelCatalog;
     /** `/model` slash handler (admin only). No arg → DC menu; `/model <name>` → apply directly. */
     /** Label an effort choice, marking the one currently configured. */

package/dist/fleet-manager.js

@@ -6857,6 +6857,43 @@ export class FleetManager {
         this.logger.warn({ instanceName }, "No postable target — instance topic notification not sent");
         return false;
     }
+    /** A migration debt is retired only after the platform accepted the send. */
+    async notifyInstanceTopicConfirmed(instanceName, text) {
+        const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
+        if (!adapter)
+            return false;
+        const channelCfg = this.getChannelConfig(this.getInstanceAdapterId(instanceName));
+        const groupId = channelCfg?.group_id;
+        const threadId = this.fleetConfig?.instances[instanceName]?.topic_id;
+        let chatId;
+        let opts;
+        if (threadId != null && groupId) {
+            chatId = String(groupId);
+            opts = { threadId: String(threadId) };
+        }
+        else {
+            const classicChatId = this.classicChannels?.getChannelIdByInstance(instanceName);
+            if (classicChatId)
+                chatId = classicChatId;
+            else {
+                const target = this.fleetNoticeTarget(this.getInstanceAdapterId(instanceName));
+                if (!target)
+                    return false;
+                chatId = target.chatId;
+                opts = target.opts;
+            }
+        }
+        try {
+            await adapter.sendText(chatId, text, opts);
+            return true;
+        }
+        catch {
+            // Provider transport errors can include credential-bearing URLs. This
+            // notice is diagnostic only; never put the raw error into a fleet log.
+            this.logger.warn({ instanceName }, "Codex upgrade notice was not delivered — pending for retry");
+            return false;
+        }
+    }
     // ── Nonce-armed button prompts (hang / assist / exit / clear) ──
     //
     // One shared lifecycle for every "notification with decision buttons":
@@ -10056,17 +10093,25 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return [];
         }
     }
-    /** Account-wide catalog: probe cache first, live probe on miss. */
+    /**
+     * Account-wide catalog: probe cache first, live probe when the cache is
+     * missing or older than the same ~1h window `/model` uses (#888).
+     *
+     * Previously this served anything inside the 24h hard TTL, so `list_models`
+     * could answer with a day-old list `/model` had already re-probed past.
+     * The probe runs under the same deadline `/model` uses: a vendor that stops
+     * answering degrades to the previous list, never stalls the tool call.
+     */
     async globalModelCatalog(backend) {
         const cached = this.readCliEnv(backend);
-        if (cached?.models?.length) {
+        if (cached?.models?.length && !this.cliEnvNeedsRefresh(cached)) {
             return {
                 backend, scope: "global", current_model: cached.currentModel ?? null,
                 models: cached.models, source: "cache",
                 probed_at: new Date(cached.probedAt).toISOString(),
             };
         }
-        const env = await this.probeBackend(backend);
+        const env = await this.probeBackendBounded(backend);
         if (env?.models?.length) {
             return {
                 backend, scope: "global", current_model: env.currentModel ?? null,
@@ -10074,6 +10119,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 probed_at: new Date(env.probedAt).toISOString(),
             };
         }
+        // Probe failed or timed out: like `/model`, the previous list is still the
+        // best answer — a stale list beats an empty one.
+        if (cached?.models?.length) {
+            return {
+                backend, scope: "global", current_model: cached.currentModel ?? null,
+                models: cached.models, source: "cache",
+                probed_at: new Date(cached.probedAt).toISOString(),
+            };
+        }
         // Reported rather than thrown: "we could not enumerate" is a useful answer,
         // and the caller can still set a model by name (AgEnD passes it through).
         return {