@songsid/agend 2.1.6-beta.9 → 2.1.7-beta.1

package/dist/daemon.d.ts

@@ -217,9 +217,13 @@ export declare class BackendUnreachableStartupError extends Error {
  * prompt. A TUI that is still completing its first redraw can swallow Enter.
  *
  * Since the adaptive settle (see {@link waitForPasteSettle}) this value is the
- * *fallback* wait — it governs only deliveries where the pane's output cannot
- * be observed (no control mode, native-queue handoff, mid-wait reconnect, or a
- * paste that never visibly renders).
+ * *minimum* settle window for the first delivery — it prevents Enter from firing
+ * before the minimum elapses even when the paste's own render goes quiet early.
+ * For observed deliveries the quiet-exit path in waitForPasteSettle now checks
+ * `now >= fallbackDeadline`, so 1750ms governs every first delivery regardless
+ * of whether output is observed. For unobserved deliveries (no control mode,
+ * native-queue handoff, mid-wait reconnect, or a paste that never visibly
+ * renders) it is the flat fallback delay, same as before.
  */
 export declare class FirstDeliveryDelay {
     private readyAt;
@@ -256,9 +260,15 @@ export interface PasteSettleResult {
  * So: watch `lastOutputAt` and send Enter only once the paste's own render has
  * been quiet for {@link PASTE_QUIET_MS}. Bounded both ways —
  *
- * - never earlier than the legacy fixed delay when the paste produces no
- *   observable output at all (`usedFallback`), so panes that don't echo keep
- *   their long-standing behaviour;
+ * - never earlier than `fallbackMs` from settle start: `fallbackMs` is a
+ *   **minimum** settle window, not merely a fallback. For first deliveries
+ *   (fallbackMs = 1750ms) the compositor may render quickly then go quiet at
+ *   ~550ms while still initialising — the minimum ensures Enter is held until
+ *   1750ms regardless of observed output. This applies to every backend's first
+ *   delivery after ready, not only codex/Luna Reserve. For normal deliveries
+ *   (fallbackMs = 500ms ≈ PASTE_QUIET_MS) the minimum adds at most a few ms
+ *   and is effectively unchanged. When the paste produces no observable output
+ *   at all (`usedFallback`), the same `fallbackMs` deadline governs;
  * - never later than {@link PASTE_SETTLE_CAP_MS} after the paste (`capHit`),
  *   so a chatty pane cannot stall delivery.
  *
@@ -268,7 +278,7 @@ export interface PasteSettleResult {
  */
 export declare function waitForPasteSettle(client: PasteSettleObservation, windowId: string, pasteStartedAt: number, fallbackMs: number): Promise<PasteSettleResult>;
 /** Redact likely credentials and control sequences before pane text reaches logs. */
-export declare function sanitizePaneTail(pane: string, lineCount?: number): string[];
+export declare function sanitizePaneTail(pane: string, lineCount?: number, excludeLine?: (line: string) => boolean): string[];
 /**
  * Distill a pane capture into text worth relaying as a proxy reply.
  *
@@ -276,13 +286,16 @@ export declare function sanitizePaneTail(pane: string, lineCount?: number): stri
  * final answer exists only on screen. Everything up to and including the last
  * line of the inbound message we pasted is cut (the reply starts after it),
  * lines with no letters or digits are dropped (borders, separators, spinners,
- * bare prompts), and the ready-prompt line is dropped by pattern. Returns null
- * when what remains is trivial — a proxy message must carry an answer, not
- * chrome. Secrets are redacted by sanitizePaneTail, same as stuck diagnostics.
+ * bare prompts), and UI chrome is dropped by a backend-specific per-line
+ * filter when available (or a legacy single-line ready pattern). Whole-pane
+ * readiness regexes cannot identify individual prompt/footer lines. Returns
+ * null when what remains is trivial — a proxy message must carry an answer,
+ * not chrome. Secrets are redacted by sanitizePaneTail, same as stuck diagnostics.
  */
 export declare function extractProxyReplyText(pane: string, opts?: {
     inboundMarker?: string;
     readyPattern?: RegExp | null;
+    isChromeLine?: (line: string) => boolean;
     maxLines?: number;
     maxChars?: number;
 }): string | null;
@@ -494,6 +507,11 @@ export declare class Daemon extends EventEmitter {
     private fatalStartupBlocked;
     /** model_error seen mid-turn: notify only if it survives to the idle screen. */
     private pendingModelErrorKey;
+    /** Optional per-instance localhost relay used to observe Muse usage events. */
+    private museUsageRelay;
+    /** Set after an in-run relay failure so subsequent Muse respawns go direct. */
+    private museRelayFallback;
+    private museRelayFallbackInFlight;
     /**
      * Let the next pause() proceed from a stuck pane. Set only for the auth-deferred
      * pause — see the pausePending consumption site for why waiting for idle there
@@ -602,6 +620,14 @@ export declare class Daemon extends EventEmitter {
     getProcessStatus(): "running" | "crashed" | "stopped";
     get lastPausedAt(): number | null;
     private getPauseWakeState;
+    /**
+     * Codex can show an exhausted-account notice while the user is switching to
+     * a reserve account. Once the live composer and Context footer are back, the
+     * notice is scrollback, not a reason to pause and send /quit.
+     */
+    private isCodexLivePaneSnapshot;
+    /** Re-check the current pane after an async quota probe before pausing it. */
+    isCodexLivePane(): Promise<boolean>;
     /** Whether this instance is in a crash loop (3+ consecutive crashes). */
     get isCrashLoop(): boolean;
     /** The most recent error type detected by the error monitor (e.g. "rate_limit", "auth_error"). */
@@ -803,8 +829,33 @@ export declare class Daemon extends EventEmitter {
      * `y` as a brand-new user message.
      */
     private confirmBackendClearDialog;
+    /**
+     * The last time AgEnD itself asked the CLI to go away, and why (#927). Read
+     * when a pane dies, to tell "AgEnD stopped it" from "the CLI exited on its
+     * own" — a codex that exits 0 on its own and one AgEnD sent /quit look the
+     * same from the pane.
+     */
+    private lastStopRequest;
+    /** Record, and log, that AgEnD is about to stop the CLI. */
+    private noteStopRequest;
+    /** Capture the pane's recent output with escape codes stripped. Never throws. */
+    private capturePaneOutput;
+    /**
+     * One record per pane death: exit status, when, who, and what the CLI printed
+     * last — the line that was missing when a codex on Luna Reserve died with
+     * status 0 and daemon.log said only "exited normally" (#927). Logging only;
+     * the caller decides what happens next.
+     */
+    private logPaneDeath;
     /** Send the backend-specific graceful quit command/key sequence. */
     private sendQuitSequence;
+    /**
+     * Kiro drops `/quit` while a turn is running. Stop that turn first, then use
+     * the same delivery readiness gate that protects Enter from the busy pane.
+     * Returning false is fail-closed: the caller skips `/quit` and enters the
+     * bounded SIGTERM -> SIGKILL fallback instead of typing into an unknown pane.
+     */
+    private drainBusyKiroForStop;
     stop(): Promise<void>;
     getHangDetector(): HangDetector | null;
     getInstanceState(): InstanceState | "paused";
@@ -1081,6 +1132,9 @@ export declare class Daemon extends EventEmitter {
      * Other backends keep the silence-based gate byte-for-byte.
      */
     private isPaneReadyForDelivery;
+    private needsStartupInputProof;
+    /** Codex can paint a prompt before the TTY enters raw mode. Both are required. */
+    private hasPositiveDeliveryInput;
     /**
      * Why a pane is not deliverable matters. "busy" may be handed to a native
      * input queue or steered (after its own dialog probe); "dialog", "transient"
@@ -1132,6 +1186,10 @@ export declare class Daemon extends EventEmitter {
      * (dropped) Enter — and an unreadable pane is not a verified absence either.
      */
     private confirmSubmittedAfterEnter;
+    /** Once Kiro returns to its prompt, its unique envelope id in history proves submission. */
+    private kiroSubmissionEvidence;
+    /** Observe the Kiro paste outside paneWriteLock; a long agent turn must not block dialog handling. */
+    private observeKiroSubmission;
     /**
      * While the CLI is parked on a fatal startup screen (see fatalStartupBlocked),
      * no pane write may happen: paste+Enter into the corrupt-config modal would
@@ -1208,6 +1266,8 @@ export declare class Daemon extends EventEmitter {
      */
     private confirmAfterEnter;
     private confirmSubmitted;
+    /** Only positive echo/queue evidence may turn an ambiguous Codex write into ✅. */
+    private lateCodexSubmissionProof;
     /**
      * What the pane currently shows of a given message. Taken once before the
      * paste and once after, so confirmSubmitted can require a NEW marker or a NEW
@@ -1293,6 +1353,12 @@ export declare class Daemon extends EventEmitter {
      * Bounded, and called BEFORE the pane lock is taken — waiting on the spawn while
      * holding the lock the spawn itself needs would deadlock.
      */
+    /**
+     * Wait for an in-flight spawn to finish, up to the cap. Returns true when no
+     * spawn is in flight afterwards; false when the cap expired with one still
+     * running. A false return is NOT settled evidence — the caller must not
+     * treat the current generation as a completed spawn.
+     */
     private waitForSpawnToSettle;
     /** Spawn a CLI window. Returns true if --resume was used successfully. */
     /**
@@ -1374,6 +1440,28 @@ export declare class Daemon extends EventEmitter {
      * Returns true if CLI is ready, false if it failed or got stuck.
      */
     private trySpawn;
+    /**
+     * One fresh pane capture judged as ready && !busy && !dialog. Transcript
+     * silence is deliberately NOT the gate: its monitor is inert for muse, so a
+     * quiet-but-working pane would read as idle and the respawn below would kill
+     * a live turn. Fail closed: an unreadable pane is never idle.
+     */
+    private isPaneAuthoritativelyIdle;
+    /**
+     * Poll the authoritative pane check until it reports idle or the budget runs
+     * out. Each poll is a fresh capture, so a turn that ends mid-wait is seen.
+     */
+    private waitForAuthoritativePaneIdle;
+    /**
+     * A relay crash must not make the daemon kill a live Muse process. The
+     * supervisor normally reclaims the same port; when that bounded recovery
+     * fails, move Muse back to a direct connection once it is authoritatively
+     * idle (session preserved via the existing resume path) and mark usage
+     * unavailable. The fallback flag also covers every later natural spawn.
+     * Never throws: the floor is the old behavior (flag set, relay stopped,
+     * next restart direct).
+     */
+    private switchMuseToDirect;
     /**
      * Tell the agent its instructions moved, once the CLI is idle.
      *