@songsid/agend 2.1.6-beta.4 → 2.1.6-beta.6

package/dist/fleet-manager.d.ts

@@ -573,6 +573,15 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * from restarting the same process twice; backendNameOf defines ownership.
      */
     private configuredBackendInstanceNames;
+    /**
+     * Probe the same executable set exposed by the web backend catalog.
+     *
+     * This deliberately has no cache: an `/install-cli` completion can add a
+     * binary to PATH while the fleet process remains alive, and the next bare
+     * `/login` must see it without requiring a restart or an explicit cache
+     * invalidation call.
+     */
+    private probeInstalledBackends;
     /**
      * One fleet-level notice per burst, not one per instance: a post-update herd
      * fails many instances within the same second. Two notices per incident at
@@ -757,6 +766,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * Pure: callers rely on being able to ask before claiming the dedup key.
      */
     private botMessageDropReason;
+    /**
+     * Say so when an adapter's access mode is coming from its state file rather
+     * than from fleet.yaml. The state file wins by design — a pairing done at
+     * runtime has to survive a restart — but that also means an edit to
+     * `access.mode` silently does nothing, which is indistinguishable from the
+     * fleet not having reloaded. Naming the file is what makes it fixable.
+     */
+    private warnIfAccessModeOverridden;
     private handleInboundMessage;
     /** Handle outbound tool calls from a daemon instance */
     /** Warn (but don't block) when rate limits are high. 30-min debounce per instance. */
@@ -1084,6 +1101,21 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * (or an assist for one they stopped) must not stay clickable for the rest
      * of its 15 minutes.
      */
+    /**
+     * Collapse every still-armed button prompt, for a fleet that is going away.
+     *
+     * The map is in memory; the buttons are in the chat for up to 24 hours. A
+     * restart therefore leaves them looking live — pressing one takes the stale
+     * branch, which acknowledges the click and drops the dismissal without
+     * saying so. Retiring them here means the user meets a spent prompt instead
+     * of a live-looking dead one.
+     *
+     * Best effort and bounded. Each collapse is a platform call, a day of tips
+     * can be many of them, and shutdown still has instances to stop. Whatever
+     * has not finished by the deadline is abandoned — that is exactly today's
+     * behaviour, so the budget can only leave things no worse than before.
+     */
+    private retirePendingNoncePrompts;
     clearNoncePromptsForInstance(instanceName: string): void;
     /** A clean exit is intentional from the CLI's perspective, but often not from
      * the operator's. Keep the instance notice passive and put the action in the

package/dist/fleet-manager.js

@@ -217,6 +217,8 @@ const CLEAR_CONFIRM_TIMEOUT_MS = 15_000;
 /** Default lifetime for long-lived nonce prompts (clear overrides this to 15s). */
 const NONCE_BUTTON_TIMEOUT_MS = 15 * 60_000;
 const TIP_BUTTON_TIMEOUT_MS = 24 * 60 * 60_000;
+/** How long shutdown will spend retiring still-armed button prompts. */
+const NONCE_RETIRE_BUDGET_MS = 5_000;
 const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // hard validity bound for the cached CLI env
 /**
  * How old the cached CLI env may be before `/model` re-probes it live.
@@ -2019,6 +2021,22 @@ export class FleetManager {
             names.add(channel.instanceName);
         return [...names];
     }
+    /**
+     * Probe the same executable set exposed by the web backend catalog.
+     *
+     * This deliberately has no cache: an `/install-cli` completion can add a
+     * binary to PATH while the fleet process remains alive, and the next bare
+     * `/login` must see it without requiring a restart or an explicit cache
+     * invalidation call.
+     */
+    probeInstalledBackends() {
+        const installed = new Set();
+        for (const [backend, info] of Object.entries(BACKEND_INSTALLATION_INFO)) {
+            if (checkBinaryInstalled(info.binary))
+                installed.add(backend);
+        }
+        return installed;
+    }
     /**
      * One fleet-level notice per burst, not one per instance: a post-update herd
      * fails many instances within the same second. Two notices per incident at
@@ -3167,7 +3185,9 @@ export class FleetManager {
         }
         const accessDir = join(this.dataDir, "access");
         mkdirSync(accessDir, { recursive: true });
-        const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, join(accessDir, "access.json"));
+        const accessStatePath = join(accessDir, "access.json");
+        const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, accessStatePath);
+        this.warnIfAccessModeOverridden(accessManager, accessStatePath);
         this.accessManager = accessManager;
         const inboxDir = join(this.dataDir, "inbox");
         mkdirSync(inboxDir, { recursive: true });
@@ -3559,7 +3579,9 @@ export class FleetManager {
         }
         const accessDir = join(this.dataDir, "access");
         mkdirSync(accessDir, { recursive: true });
-        const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, join(accessDir, `access-${adapterId}.json`));
+        const accessStatePath = join(accessDir, `access-${adapterId}.json`);
+        const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, accessStatePath);
+        this.warnIfAccessModeOverridden(accessManager, accessStatePath);
         const inboxDir = join(this.dataDir, "inbox");
         mkdirSync(inboxDir, { recursive: true });
         const adapter = await createAdapter(channelConfig, {
@@ -4314,13 +4336,36 @@ export class FleetManager {
         const target = this.routing.resolve(threadId);
         if (!target)
             return "fleet topic: no instance routed for this thread";
-        // Fleet topic: allow if collab enabled OR access mode is open
+        // Fleet topic: this gate lets the copy through when the adapter is open OR
+        // collab is on for the instance. "Through" is not "delivered" — access
+        // control runs next, and the two arms are not symmetric there:
+        //
+        //   open adapter   → isAllowed() returns true outright: really admitted.
+        //   locked + collab → the bot's user id still has to be on the allowlist,
+        //                     so the message is normally refused a few lines later
+        //                     under "Access DENIED for non-allowed user".
+        //
+        // Collab alone therefore does not admit a bot on a locked adapter; it only
+        // declines to drop the copy here and leaves the decision to access control.
         const isOpen = this.getChannelConfig(msg.adapterId)?.access?.mode === "open";
         if (!isOpen && !this.collabInstances.has(target.name)) {
             return `fleet topic: adapter not open and collab off for ${target.name}`;
         }
         return null;
     }
+    /**
+     * Say so when an adapter's access mode is coming from its state file rather
+     * than from fleet.yaml. The state file wins by design — a pairing done at
+     * runtime has to survive a restart — but that also means an edit to
+     * `access.mode` silently does nothing, which is indistinguishable from the
+     * fleet not having reloaded. Naming the file is what makes it fixable.
+     */
+    warnIfAccessModeOverridden(accessManager, statePath) {
+        const configured = accessManager.overriddenConfigMode();
+        if (!configured)
+            return;
+        this.logger.warn({ statePath, configured, inEffect: accessManager.getMode() }, `access mode "${accessManager.getMode()}" comes from the state file and overrides "${configured}" in fleet.yaml; delete ${statePath} to go back to the configured value`);
+    }
     async handleInboundMessage(msg) {
         const threadId = msg.threadId || undefined;
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
@@ -5227,6 +5272,15 @@ export class FleetManager {
      */
     scheduleSourceAdapter(schedule) {
         const chatId = String(schedule.reply_chat_id);
+        // New schedules carry the adapter that owned the source chat at creation.
+        // Keep that persona across source-instance rebinding, but never trust a
+        // stale adapter after the chat has moved to another world.
+        const persistedWorld = schedule.reply_adapter_id
+            ? this.worlds.get(schedule.reply_adapter_id)
+            : undefined;
+        if (persistedWorld && String(persistedWorld.groupId) === chatId) {
+            return persistedWorld.adapter;
+        }
         const sourceAdapterId = schedule.source ? this.getInstanceAdapterId(schedule.source) : undefined;
         const sourceWorld = sourceAdapterId ? this.worlds.get(sourceAdapterId) : undefined;
         if (sourceWorld && String(sourceWorld.groupId) === chatId)
@@ -5337,6 +5391,7 @@ export class FleetManager {
                         target: payload.target || instanceName,
                         reply_chat_id: meta.chat_id,
                         reply_thread_id: meta.thread_id || null,
+                        reply_adapter_id: meta.adapter_id || null,
                         label: payload.label,
                         timezone: payload.timezone,
                         silent: !!(payload.silent),
@@ -7004,6 +7059,39 @@ export class FleetManager {
      * (or an assist for one they stopped) must not stay clickable for the rest
      * of its 15 minutes.
      */
+    /**
+     * Collapse every still-armed button prompt, for a fleet that is going away.
+     *
+     * The map is in memory; the buttons are in the chat for up to 24 hours. A
+     * restart therefore leaves them looking live — pressing one takes the stale
+     * branch, which acknowledges the click and drops the dismissal without
+     * saying so. Retiring them here means the user meets a spent prompt instead
+     * of a live-looking dead one.
+     *
+     * Best effort and bounded. Each collapse is a platform call, a day of tips
+     * can be many of them, and shutdown still has instances to stop. Whatever
+     * has not finished by the deadline is abandoned — that is exactly today's
+     * behaviour, so the budget can only leave things no worse than before.
+     */
+    async retirePendingNoncePrompts(budgetMs = NONCE_RETIRE_BUDGET_MS) {
+        const entries = [...this.pendingNonceButtons.values()];
+        this.pendingNonceButtons.clear();
+        for (const entry of entries)
+            if (entry.timer)
+                clearTimeout(entry.timer);
+        const collapses = entries
+            .filter(entry => entry.messageId && entry.adapter.editMessageRemoveButtons)
+            .map(entry => entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId).catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to retire button prompt during shutdown")));
+        if (!collapses.length)
+            return;
+        await Promise.race([
+            Promise.allSettled(collapses),
+            new Promise(resolve => {
+                const timer = setTimeout(resolve, budgetMs);
+                timer.unref?.();
+            }),
+        ]);
+    }
     clearNoncePromptsForInstance(instanceName) {
         for (const [nonce, entry] of this.pendingNonceButtons) {
             if (entry.instanceName !== instanceName)
@@ -7944,11 +8032,39 @@ export class FleetManager {
         for (const name of this.configuredBackendInstanceNames()) {
             configured.add(this.backendNameOf(name));
         }
-        const choices = Object.keys(LOGIN_FLOWS)
-            .filter(backend => configured.size === 0 || configured.has(backend))
-            .map(backend => ({ action: backend, label: backend }));
+        const installed = this.probeInstalledBackends();
+        const candidates = new Set([...installed, ...configured]);
+        const unsupported = [];
+        const choices = [...candidates].sort().flatMap(backend => {
+            const flow = LOGIN_FLOWS[backend];
+            const remoteLogin = !!flow && flow.remoteLogin !== "unsupported";
+            const status = [];
+            if (installed.has(backend))
+                status.push(t("login.status_installed"));
+            if (configured.has(backend))
+                status.push(t("login.status_configured"));
+            if (remoteLogin)
+                status.push(t("login.status_auth"));
+            else
+                status.push(t("login.status_unsupported"));
+            if (!remoteLogin) {
+                unsupported.push({ backend, flow, status });
+                return [];
+            }
+            return [{ action: backend, label: `${backend} · ${status.join(" · ")}` }];
+        });
+        if (unsupported.length) {
+            const guidance = unsupported.map(({ backend, flow, status }) => `${backend} · ${status.join(" · ")} — ${flow?.remoteLogin === "unsupported"
+                ? t("login.remote_unsupported_agent_cli", backend, flow.command)
+                : backend === "opencode" ? t("login.unsupported", backend) : t("login.no_remote_flow", backend)}`).join("\n");
+            await chat.adapter.sendText(chat.chatId, guidance, { threadId: chat.threadId })
+                .catch(err => this.logger.warn({ err }, "Failed to post unsupported login guidance"));
+        }
         if (choices.length === 0) {
-            await chat.adapter.sendText(chat.chatId, t("login.unsupported", [...configured].join(", ")), { threadId: chat.threadId });
+            if (!unsupported.length) {
+                await chat.adapter.sendText(chat.chatId, t("login.none_available"), { threadId: chat.threadId })
+                    .catch(err => this.logger.warn({ err }, "Failed to post empty login chooser guidance"));
+            }
             return;
         }
         await this.postNonceButtonPrompt({
@@ -8537,6 +8653,12 @@ export class FleetManager {
                     await chat.adapter.sendText(chat.chatId, t("install.success_no_login", backend), { threadId: chat.threadId }).catch(() => { });
                     return;
                 }
+                // The button is deliberately best-effort: it is a short-lived
+                // capability and can be lost during an adapter reconnect.  Always
+                // publish a durable completion line first so a successful install can
+                // never look like it silently disappeared.  Include the binary that
+                // passed the fresh-login-shell verification and the exact next step.
+                await chat.adapter.sendText(chat.chatId, t("install.success", backend, info.binary), { threadId: chat.threadId }).catch(err => this.logger.warn({ err, backend }, "Failed to send durable install success notification"));
                 await this.postNonceButtonPrompt({
                     prefix: INSTALL_LOGIN_CALLBACK_PREFIX,
                     alertType: "login",
@@ -8788,6 +8910,8 @@ export class FleetManager {
         // Grok reads AGENTS.md project docs; agy reads .agents/agents.md — the
         // same files their writeConfig() appends fleet instructions to.
         "grok": "AGENTS.md",
+        // muse init scaffolds AGENTS.md and the binary reads it as project rules.
+        "muse": "AGENTS.md",
         "antigravity": ".agents/agents.md",
         "mock": "CLAUDE.md",
     };
@@ -8863,6 +8987,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // vendor-canonical location is .grok/skills.
         "opencode": [".agents", "skills"],
         "grok": [".grok", "skills"],
+        // Live-verified on muse 1.3.0: `muse skills list --source project` sees
+        // .agents/skills and ignores .muse/skills.
+        "muse": [".agents", "skills"],
         "antigravity": [".agents", "skills"],
     };
     /** Copy general-knowledge steering + all role-eligible skills to General. */
@@ -10602,11 +10729,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         for (const pending of this.pendingClassicStarts.values())
             clearTimeout(pending.timer);
         this.pendingClassicStarts.clear();
-        for (const pending of this.pendingNonceButtons.values()) {
-            if (pending.timer)
-                clearTimeout(pending.timer);
-        }
-        this.pendingNonceButtons.clear();
+        // Adapters are still connected here — they are stopped further down — so
+        // this is the last moment the prompts can be collapsed.
+        await this.retirePendingNoncePrompts();
         this.topicArchiver.stop();
         this.scheduler?.shutdown();
         // Stop instances in parallel batches to avoid long sequential waits.