@songsid/agend 2.1.6-beta.4 → 2.1.6-beta.5

package/dist/fleet-manager.d.ts

@@ -757,6 +757,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * Pure: callers rely on being able to ask before claiming the dedup key.
      */
     private botMessageDropReason;
+    /**
+     * Say so when an adapter's access mode is coming from its state file rather
+     * than from fleet.yaml. The state file wins by design — a pairing done at
+     * runtime has to survive a restart — but that also means an edit to
+     * `access.mode` silently does nothing, which is indistinguishable from the
+     * fleet not having reloaded. Naming the file is what makes it fixable.
+     */
+    private warnIfAccessModeOverridden;
     private handleInboundMessage;
     /** Handle outbound tool calls from a daemon instance */
     /** Warn (but don't block) when rate limits are high. 30-min debounce per instance. */
@@ -1084,6 +1092,21 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * (or an assist for one they stopped) must not stay clickable for the rest
      * of its 15 minutes.
      */
+    /**
+     * Collapse every still-armed button prompt, for a fleet that is going away.
+     *
+     * The map is in memory; the buttons are in the chat for up to 24 hours. A
+     * restart therefore leaves them looking live — pressing one takes the stale
+     * branch, which acknowledges the click and drops the dismissal without
+     * saying so. Retiring them here means the user meets a spent prompt instead
+     * of a live-looking dead one.
+     *
+     * Best effort and bounded. Each collapse is a platform call, a day of tips
+     * can be many of them, and shutdown still has instances to stop. Whatever
+     * has not finished by the deadline is abandoned — that is exactly today's
+     * behaviour, so the budget can only leave things no worse than before.
+     */
+    private retirePendingNoncePrompts;
     clearNoncePromptsForInstance(instanceName: string): void;
     /** A clean exit is intentional from the CLI's perspective, but often not from
      * the operator's. Keep the instance notice passive and put the action in the

package/dist/fleet-manager.js

@@ -217,6 +217,8 @@ const CLEAR_CONFIRM_TIMEOUT_MS = 15_000;
 /** Default lifetime for long-lived nonce prompts (clear overrides this to 15s). */
 const NONCE_BUTTON_TIMEOUT_MS = 15 * 60_000;
 const TIP_BUTTON_TIMEOUT_MS = 24 * 60 * 60_000;
+/** How long shutdown will spend retiring still-armed button prompts. */
+const NONCE_RETIRE_BUDGET_MS = 5_000;
 const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // hard validity bound for the cached CLI env
 /**
  * How old the cached CLI env may be before `/model` re-probes it live.
@@ -3167,7 +3169,9 @@ export class FleetManager {
         }
         const accessDir = join(this.dataDir, "access");
         mkdirSync(accessDir, { recursive: true });
-        const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, join(accessDir, "access.json"));
+        const accessStatePath = join(accessDir, "access.json");
+        const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, accessStatePath);
+        this.warnIfAccessModeOverridden(accessManager, accessStatePath);
         this.accessManager = accessManager;
         const inboxDir = join(this.dataDir, "inbox");
         mkdirSync(inboxDir, { recursive: true });
@@ -3559,7 +3563,9 @@ export class FleetManager {
         }
         const accessDir = join(this.dataDir, "access");
         mkdirSync(accessDir, { recursive: true });
-        const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, join(accessDir, `access-${adapterId}.json`));
+        const accessStatePath = join(accessDir, `access-${adapterId}.json`);
+        const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, accessStatePath);
+        this.warnIfAccessModeOverridden(accessManager, accessStatePath);
         const inboxDir = join(this.dataDir, "inbox");
         mkdirSync(inboxDir, { recursive: true });
         const adapter = await createAdapter(channelConfig, {
@@ -4314,13 +4320,36 @@ export class FleetManager {
         const target = this.routing.resolve(threadId);
         if (!target)
             return "fleet topic: no instance routed for this thread";
-        // Fleet topic: allow if collab enabled OR access mode is open
+        // Fleet topic: this gate lets the copy through when the adapter is open OR
+        // collab is on for the instance. "Through" is not "delivered" — access
+        // control runs next, and the two arms are not symmetric there:
+        //
+        //   open adapter   → isAllowed() returns true outright: really admitted.
+        //   locked + collab → the bot's user id still has to be on the allowlist,
+        //                     so the message is normally refused a few lines later
+        //                     under "Access DENIED for non-allowed user".
+        //
+        // Collab alone therefore does not admit a bot on a locked adapter; it only
+        // declines to drop the copy here and leaves the decision to access control.
         const isOpen = this.getChannelConfig(msg.adapterId)?.access?.mode === "open";
         if (!isOpen && !this.collabInstances.has(target.name)) {
             return `fleet topic: adapter not open and collab off for ${target.name}`;
         }
         return null;
     }
+    /**
+     * Say so when an adapter's access mode is coming from its state file rather
+     * than from fleet.yaml. The state file wins by design — a pairing done at
+     * runtime has to survive a restart — but that also means an edit to
+     * `access.mode` silently does nothing, which is indistinguishable from the
+     * fleet not having reloaded. Naming the file is what makes it fixable.
+     */
+    warnIfAccessModeOverridden(accessManager, statePath) {
+        const configured = accessManager.overriddenConfigMode();
+        if (!configured)
+            return;
+        this.logger.warn({ statePath, configured, inEffect: accessManager.getMode() }, `access mode "${accessManager.getMode()}" comes from the state file and overrides "${configured}" in fleet.yaml; delete ${statePath} to go back to the configured value`);
+    }
     async handleInboundMessage(msg) {
         const threadId = msg.threadId || undefined;
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
@@ -5227,6 +5256,15 @@ export class FleetManager {
      */
     scheduleSourceAdapter(schedule) {
         const chatId = String(schedule.reply_chat_id);
+        // New schedules carry the adapter that owned the source chat at creation.
+        // Keep that persona across source-instance rebinding, but never trust a
+        // stale adapter after the chat has moved to another world.
+        const persistedWorld = schedule.reply_adapter_id
+            ? this.worlds.get(schedule.reply_adapter_id)
+            : undefined;
+        if (persistedWorld && String(persistedWorld.groupId) === chatId) {
+            return persistedWorld.adapter;
+        }
         const sourceAdapterId = schedule.source ? this.getInstanceAdapterId(schedule.source) : undefined;
         const sourceWorld = sourceAdapterId ? this.worlds.get(sourceAdapterId) : undefined;
         if (sourceWorld && String(sourceWorld.groupId) === chatId)
@@ -5337,6 +5375,7 @@ export class FleetManager {
                         target: payload.target || instanceName,
                         reply_chat_id: meta.chat_id,
                         reply_thread_id: meta.thread_id || null,
+                        reply_adapter_id: meta.adapter_id || null,
                         label: payload.label,
                         timezone: payload.timezone,
                         silent: !!(payload.silent),
@@ -7004,6 +7043,39 @@ export class FleetManager {
      * (or an assist for one they stopped) must not stay clickable for the rest
      * of its 15 minutes.
      */
+    /**
+     * Collapse every still-armed button prompt, for a fleet that is going away.
+     *
+     * The map is in memory; the buttons are in the chat for up to 24 hours. A
+     * restart therefore leaves them looking live — pressing one takes the stale
+     * branch, which acknowledges the click and drops the dismissal without
+     * saying so. Retiring them here means the user meets a spent prompt instead
+     * of a live-looking dead one.
+     *
+     * Best effort and bounded. Each collapse is a platform call, a day of tips
+     * can be many of them, and shutdown still has instances to stop. Whatever
+     * has not finished by the deadline is abandoned — that is exactly today's
+     * behaviour, so the budget can only leave things no worse than before.
+     */
+    async retirePendingNoncePrompts(budgetMs = NONCE_RETIRE_BUDGET_MS) {
+        const entries = [...this.pendingNonceButtons.values()];
+        this.pendingNonceButtons.clear();
+        for (const entry of entries)
+            if (entry.timer)
+                clearTimeout(entry.timer);
+        const collapses = entries
+            .filter(entry => entry.messageId && entry.adapter.editMessageRemoveButtons)
+            .map(entry => entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId).catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to retire button prompt during shutdown")));
+        if (!collapses.length)
+            return;
+        await Promise.race([
+            Promise.allSettled(collapses),
+            new Promise(resolve => {
+                const timer = setTimeout(resolve, budgetMs);
+                timer.unref?.();
+            }),
+        ]);
+    }
     clearNoncePromptsForInstance(instanceName) {
         for (const [nonce, entry] of this.pendingNonceButtons) {
             if (entry.instanceName !== instanceName)
@@ -8788,6 +8860,8 @@ export class FleetManager {
         // Grok reads AGENTS.md project docs; agy reads .agents/agents.md — the
         // same files their writeConfig() appends fleet instructions to.
         "grok": "AGENTS.md",
+        // muse init scaffolds AGENTS.md and the binary reads it as project rules.
+        "muse": "AGENTS.md",
         "antigravity": ".agents/agents.md",
         "mock": "CLAUDE.md",
     };
@@ -8863,6 +8937,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // vendor-canonical location is .grok/skills.
         "opencode": [".agents", "skills"],
         "grok": [".grok", "skills"],
+        // Live-verified on muse 1.3.0: `muse skills list --source project` sees
+        // .agents/skills and ignores .muse/skills.
+        "muse": [".agents", "skills"],
         "antigravity": [".agents", "skills"],
     };
     /** Copy general-knowledge steering + all role-eligible skills to General. */
@@ -10602,11 +10679,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         for (const pending of this.pendingClassicStarts.values())
             clearTimeout(pending.timer);
         this.pendingClassicStarts.clear();
-        for (const pending of this.pendingNonceButtons.values()) {
-            if (pending.timer)
-                clearTimeout(pending.timer);
-        }
-        this.pendingNonceButtons.clear();
+        // Adapters are still connected here — they are stopped further down — so
+        // this is the last moment the prompts can be collapsed.
+        await this.retirePendingNoncePrompts();
         this.topicArchiver.stop();
         this.scheduler?.shutdown();
         // Stop instances in parallel batches to avoid long sequential waits.