@songsid/agend 2.1.8 → 2.1.10-beta.1

package/dist/tunnel/public-fetch.js

@@ -0,0 +1,156 @@
+/**
+ * The readiness probe's way of seeing a tunnel the way a phone does.
+ *
+ * A brand-new `*.trycloudflare.com` name resolves instantly through a public
+ * resolver and, on a corporate or WSL network, can take a minute or more
+ * through the machine's own forwarder (measured: 1.1.1.1 in ~13 ms, the system
+ * resolver 60 s+). Probing through the system resolver therefore reports a
+ * tunnel that works as "never became reachable". So the probe asks a public
+ * resolver, then connects to the address it was given with the real hostname
+ * as SNI and `Host` — certificate verification still runs against the
+ * hostname, so a wrong or forged answer yields a TLS failure, never a page.
+ *
+ * Only the probe does this. The browser that actually uses the tunnel resolves
+ * however it resolves. The one thing that leaves the machine is a DNS query
+ * for the tunnel's random hostname, sent to Cloudflare, who is already
+ * carrying the tunnel.
+ *
+ * The system resolver stays as the fallback: a network that blocks outbound
+ * DNS to 1.1.1.1 must not make a working tunnel look dead.
+ */
+import { isIPv4 } from "node:net";
+import { request as httpsRequest } from "node:https";
+import { Resolver } from "node:dns/promises";
+export const PUBLIC_RESOLVERS = ["1.1.1.1", "1.0.0.1"];
+/** One DNS attempt is short: the caller retries, and the whole probe has a deadline. */
+const RESOLVE_TIMEOUT_MS = 3_000;
+/** The probe wants a page, not a download. Exactly this many bytes are accepted; one more is refused. */
+export const MAX_PROBE_BODY = 256 * 1024;
+/** Addresses a public resolver has no business returning for a Cloudflare edge name. */
+export function isPublicIPv4(ip) {
+    if (!isIPv4(ip))
+        return false;
+    const [a, b] = ip.split(".").map(Number);
+    if (a === 0 || a === 10 || a === 127)
+        return false;
+    if (a === 100 && b >= 64 && b <= 127)
+        return false; // CGNAT
+    if (a === 169 && b === 254)
+        return false; // link-local
+    if (a === 172 && b >= 16 && b <= 31)
+        return false;
+    if (a === 192 && b === 168)
+        return false;
+    if (a >= 224)
+        return false; // multicast / reserved
+    return true;
+}
+function defaultResolve4(resolvers) {
+    const resolver = new Resolver({ timeout: RESOLVE_TIMEOUT_MS, tries: 1 });
+    resolver.setServers([...resolvers]);
+    return host => resolver.resolve4(host);
+}
+export async function fetchViaPublicResolver(url, signal, deps) {
+    const resolvers = deps.resolvers ?? PUBLIC_RESOLVERS;
+    let target;
+    try {
+        target = new URL(url);
+    }
+    catch {
+        return deps.fallback(url, signal);
+    }
+    if (resolvers.length === 0 || target.protocol !== "https:")
+        return deps.fallback(url, signal);
+    let address;
+    try {
+        const resolve4 = deps.resolve4 ?? defaultResolve4(resolvers);
+        address = (await resolve4(target.hostname)).find(isPublicIPv4);
+    }
+    catch {
+        address = undefined;
+    }
+    // No usable answer from the public resolver: say nothing about the tunnel,
+    // just let the ordinary path try.
+    if (!address)
+        return deps.fallback(url, signal);
+    return requestAt(address, target, signal, deps.request ?? httpsRequest);
+}
+function requestAt(address, target, signal, request) {
+    return new Promise((resolve, reject) => {
+        const options = {
+            host: address,
+            port: 443,
+            method: "GET",
+            path: `${target.pathname}${target.search}`,
+            // Both, and the hostname for both purposes: SNI picks the certificate,
+            // `servername` is also what the certificate is verified against, and
+            // `Host` is what the edge routes on. Never `rejectUnauthorized: false`.
+            servername: target.hostname,
+            headers: { host: target.hostname, "cache-control": "no-store" },
+            signal,
+        };
+        const req = request(options, res => {
+            const status = res.statusCode ?? 0;
+            const contentType = String(res.headers["content-type"] ?? "");
+            res.on("error", reject);
+            // Only a 200 can be the page. Any other body is discarded as it arrives, not collected.
+            if (status !== 200) {
+                res.on("end", () => resolve({ status, contentType, body: "" }));
+                res.resume();
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            res.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_PROBE_BODY) {
+                    req.destroy(new Error("probe response too large"));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            res.on("end", () => resolve({ status, contentType, body: Buffer.concat(chunks).toString("utf8") }));
+        });
+        req.on("error", reject);
+        req.end();
+    });
+}
+/**
+ * The ordinary path — the system resolver, a plain `fetch` — with the same limits as the public one.
+ *
+ * `res.text()` has no ceiling, and this is the path taken exactly when public DNS is unavailable, so the
+ * cap has to live here too. A redirect is not this page, and following one would let the edge decide
+ * what we call ready.
+ */
+export async function fetchViaSystemResolver(url, signal, fetchImpl = fetch) {
+    const res = await fetchImpl(url, { signal, redirect: "manual", cache: "no-store" });
+    const contentType = res.headers.get("content-type") ?? "";
+    if (res.status !== 200) {
+        await res.body?.cancel().catch(() => { });
+        return { status: res.status, contentType, body: "" };
+    }
+    return { status: 200, contentType, body: await readBoundedText(res.body) };
+}
+async function readBoundedText(body) {
+    if (!body)
+        return "";
+    const reader = body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_PROBE_BODY)
+                throw new Error("probe response too large");
+            chunks.push(value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+//# sourceMappingURL=public-fetch.js.map

package/dist/tunnel/public-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-fetch.js","sourceRoot":"","sources":["../../src/tunnel/public-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAuB,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAE1E,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,yGAAyG;AACzG,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAezC,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqB,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC,CAAK,QAAQ;IAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,CAAe,aAAa;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC,CAA6B,uBAAuB;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,SAA4B;IACnD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,MAAmB,EACnB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACrD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9F,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,2EAA2E;IAC3E,kCAAkC;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,MAAW,EAAE,MAAmB,EAAE,OAA4B;IAChG,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,OAAO,GAAmB;YAC9B,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,UAAU,EAAE,MAAM,CAAC,QAAQ;YAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;YAC/D,MAAM;SACP,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACjC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,wFAAwF;YACxF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBAChE,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;oBAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACtG,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,MAAmB,EACnB,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAuC;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA0B,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/dist/tunnel/types.d.ts

@@ -111,8 +111,14 @@ export declare class TunnelStartError extends Error {
         readonly identity: string | null;
     } | undefined);
 }
-/** One wall-clock budget for spawn, URL and readiness together — not per step. */
-export declare const TUNNEL_STARTUP_DEADLINE_MS = 30000;
+/**
+ * One wall-clock budget for spawn, URL and readiness together — not per step.
+ *
+ * A minute: with QUIC blocked and a slow resolver in between, a tunnel that does
+ * work can take well over thirty seconds to become reachable, and giving up on it
+ * is a worse outcome than waiting for it.
+ */
+export declare const TUNNEL_STARTUP_DEADLINE_MS = 60000;
 /** Preflight is a stat, not a network call. */
 export declare const TUNNEL_PREFLIGHT_TIMEOUT_MS = 5000;
 /** How long a polite stop is given before escalating, and again before giving up. */

package/dist/tunnel/types.js

@@ -24,8 +24,14 @@ export class TunnelStartError extends Error {
         this.name = "TunnelStartError";
     }
 }
-/** One wall-clock budget for spawn, URL and readiness together — not per step. */
-export const TUNNEL_STARTUP_DEADLINE_MS = 30_000;
+/**
+ * One wall-clock budget for spawn, URL and readiness together — not per step.
+ *
+ * A minute: with QUIC blocked and a slow resolver in between, a tunnel that does
+ * work can take well over thirty seconds to become reachable, and giving up on it
+ * is a worse outcome than waiting for it.
+ */
+export const TUNNEL_STARTUP_DEADLINE_MS = 60_000;
 /** Preflight is a stat, not a network call. */
 export const TUNNEL_PREFLIGHT_TIMEOUT_MS = 5_000;
 /** How long a polite stop is given before escalating, and again before giving up. */

package/dist/tunnel/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tunnel/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoGH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IAGA;IAJX,YACW,SAA0B,EACnC,OAAe;IACf,6EAA6E;IACpE,WAA+E;QAExF,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,cAAS,GAAT,SAAS,CAAiB;QAG1B,gBAAW,GAAX,WAAW,CAAoE;QAGxF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tunnel/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoGH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IAGA;IAJX,YACW,SAA0B,EACnC,OAAe;IACf,6EAA6E;IACpE,WAA+E;QAExF,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,cAAS,GAAT,SAAS,CAAiB;QAG1B,gBAAW,GAAX,WAAW,CAAoE;QAGxF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC"}

package/dist/types.d.ts

@@ -76,6 +76,17 @@ export interface ChannelConfig {
     /** Topic ID for mirroring all cross-instance messages (read-only observation). */
     mirror_topic_id?: number | string;
 }
+export type DeliveryWorkerMode = "off" | "wake_only" | "on";
+export declare const DELIVERY_WORKER_MODES: readonly DeliveryWorkerMode[];
+/** The delivery_worker mode for `name`: instance override, then fleet default, then "off". */
+export declare function resolveDeliveryWorkerMode(config: {
+    defaults?: {
+        delivery_worker?: unknown;
+    };
+    instances?: Record<string, {
+        delivery_worker?: unknown;
+    }>;
+} | null | undefined, name: string): DeliveryWorkerMode;
 export interface InstanceConfig {
     working_directory: string;
     /** Minutes an idle CLI may remain resident before auto-pause. 0 disables it. */
@@ -87,12 +98,26 @@ export interface InstanceConfig {
      * 0 = unlimited (default). Complementary to auto_pause_after (time-based).
      */
     warm_cap?: number;
+    /**
+     * Phase 2b: how far `defaults.warm_cap` may be exceeded to wake targets for
+     * queued durable work (delivery_worker ≠ off). Default 2. The hard cap is
+     * warm_cap + warm_overflow; with warm_cap 0 there is no cap at all.
+     */
+    warm_overflow?: number;
+    /**
+     * Phase 2 delivery owner for this target (docs/design/phase2-submit-contract.md):
+     * `off` (default) keeps the current outbox pump, `wake_only` adds the wake
+     * coordinator (2b), `on` hands claim/submit to the per-target worker (2c).
+     * Read from `defaults.delivery_worker` with a per-instance override. In 2a
+     * only the setting exists — every mode behaves as `off`.
+     */
+    delivery_worker?: DeliveryWorkerMode;
     /** Agent display name (e.g. "Kuro", "Luna") — chosen by the agent itself */
     display_name?: string;
     /**
      * #1005: this instance's own delivery-status emojis, overriding its
      * channel's `options.status_emojis` per key. Keys: received, queued,
-     * processing, delivered, failed, progress_prefix.
+     * processing, delivered, failed, progress_prefix, photo, attachment.
      */
     status_emojis?: import("./status-emojis.js").StatusEmojiConfig;
     /** Human-readable description of what this instance does */
@@ -293,12 +318,34 @@ export interface WebConfig {
     usage_panel?: boolean;
     /** Expose provider API-key verify/apply endpoints (default false until dark-shipped). */
     provider_secrets?: boolean;
+    /**
+     * Extra `Host` names the dashboard answers to, for a reverse proxy or port
+     * forward that presents a name other than localhost / 127.0.0.1 / [::1] / `hostname`.
+     * Names only (a port is ignored); anything not listed is refused with 403.
+     */
+    allowed_hosts?: string[];
 }
 /** `login:` section — remote /login behaviour. */
 export interface LoginConfig {
     /** web (default): token-gated browser terminal. relay: the pre-2.1.5 chat relay, kept for rollback in 2.1.5 only. */
     mode?: "web" | "relay";
 }
+/**
+ * `web_terminal.tunnel:` — the escape hatch for finishing a /login from somewhere that cannot
+ * reach this machine (a phone away from the desk). Off unless `allow_public` is true, and even
+ * then each login asks first and only flows marked `tunnelOk` may use it.
+ */
+export interface WebTerminalTunnelConfig {
+    /** The only provider today: a Cloudflare Quick Tunnel. */
+    provider?: "cloudflared";
+    /**
+     * Whether /login may offer to open a temporary public HTTPS link to its terminal.
+     * Default false — nothing is ever exposed beyond this machine unless you set it.
+     */
+    allow_public?: boolean;
+    /** How cloudflared reaches Cloudflare. Default http2 (QUIC is blocked on many networks); auto lets cloudflared choose. */
+    protocol?: "http2" | "quic" | "auto";
+}
 /** `web_terminal:` section — the browser terminal behind /login and /install-cli. */
 export interface WebTerminalConfig {
     /** Default true. false makes /login refuse in web mode. */
@@ -307,6 +354,8 @@ export interface WebTerminalConfig {
     bind?: string;
     /** Session time limit. 1..20 (engine hard cap 20), default 10. */
     ttl_minutes?: number;
+    /** Optional public link for /login (see WebTerminalTunnelConfig). Absent = never. */
+    tunnel?: WebTerminalTunnelConfig;
 }
 export interface FleetConfig {
     channel?: ChannelConfig;

package/dist/types.js

@@ -1,2 +1,10 @@
-export {};
+export const DELIVERY_WORKER_MODES = ["off", "wake_only", "on"];
+/** The delivery_worker mode for `name`: instance override, then fleet default, then "off". */
+export function resolveDeliveryWorkerMode(config, name) {
+    for (const value of [config?.instances?.[name]?.delivery_worker, config?.defaults?.delivery_worker]) {
+        if (typeof value === "string" && DELIVERY_WORKER_MODES.includes(value))
+            return value;
+    }
+    return "off";
+}
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAgFA,MAAM,CAAC,MAAM,qBAAqB,GAAkC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AAE/F,8FAA8F;AAC9F,MAAM,UAAU,yBAAyB,CACvC,MAAkI,EAClI,IAAY;IAEZ,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;QACpG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAA2B,CAAC;IACpI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/ui/settings.html

@@ -263,7 +263,7 @@
       description: "Description", systemPrompt: "System prompt", tags: "Tags", generalTopicField: "General topic (fleet dispatcher)",
       runtimeResources: "Runtime & Resources", autoPause: "Auto-pause after", minutes: "minutes", inheritDefault: "Inherit from defaults",
       statusEmojis: "Status emojis", statusEmojisInstance: "This agent's status emojis (override the connection's)", statusEmojisChannel: "Status emojis for this connection's bots",
-      se_received: "Received", se_queued: "Queued", se_processing: "Processing", se_delivered: "Delivered", se_failed: "Failed", se_progress_prefix: "Progress prefix",
+      se_received: "Received", se_queued: "Queued", se_processing: "Processing", se_delivered: "Delivered", se_failed: "Failed", se_progress_prefix: "Progress prefix", se_photo: "Photo saved", se_attachment: "File saved",
       se_src_instance: "agent", se_src_platform: "connection", se_src_builtin: "default", se_pick: "Pick…", se_useDefault: "Use the default", se_fallback: "the default is used instead",
       se_unicode: "Emoji", se_telegramOnly: "Telegram allows only these reactions", se_serverEmojis: "Server emojis", se_noServerEmojis: "No custom emojis on this server.", se_primaryServer: "primary", se_externalEmojiHint: "Another server's emoji needs the bot's Use External Emojis permission in the channel it reacts in.", se_unavailable: "unavailable",
       se_hint: "Empty keeps the default. The preview is resolved by AgEnD exactly as the bot will react.",
@@ -315,7 +315,7 @@
     },
     "zh-TW": {
       statusEmojis: "狀態 emoji", statusEmojisInstance: "此 Agent 的狀態 emoji（覆蓋連線設定）", statusEmojisChannel: "此連線 bot 的狀態 emoji",
-      se_received: "已收到", se_queued: "排隊中", se_processing: "處理中", se_delivered: "已送達", se_failed: "失敗", se_progress_prefix: "進度前綴",
+      se_received: "已收到", se_queued: "排隊中", se_processing: "處理中", se_delivered: "已送達", se_failed: "失敗", se_progress_prefix: "進度前綴", se_photo: "已存圖片", se_attachment: "已存檔案",
       se_src_instance: "Agent", se_src_platform: "連線", se_src_builtin: "預設", se_pick: "選擇…", se_useDefault: "使用預設", se_fallback: "改用預設值",
       se_unicode: "Emoji", se_telegramOnly: "Telegram 只允許這些反應", se_serverEmojis: "伺服器 emoji", se_noServerEmojis: "此伺服器沒有自訂 emoji。", se_primaryServer: "主伺服器", se_externalEmojiHint: "使用其他伺服器的 emoji，bot 在要加反應的頻道需有「使用外部表情符號」權限。", se_unavailable: "無法使用",
       se_hint: "留空即使用預設值。預覽由 AgEnD 依 bot 實際 react 的方式解析。",

package/dist/ui/view.html

@@ -18,6 +18,20 @@
   #sidebar { width: 240px; flex: 0 0 240px; background: var(--panel); border-right: 1px solid var(--border); display: flex; flex-direction: column; overflow: hidden; }
   /* The list scrolls; the filter stays pinned to the bottom of the sidebar. */
   #list { flex: 1 1 auto; min-height: 0; overflow-y: auto; }
+  /* The UA's default scrollbar is a light grey bar with arrows on this dark panel.
+     Tinted from the sidebar's own --dim; scoped to #list so the terminal's own
+     scrollbar (#term) is left alone. WebKit/Blink get the pseudo-elements (thin,
+     rounded, no arrows, a hover state); Chromium 121+ would ignore them if
+     scrollbar-color were also set, so the standard properties are Firefox-only. */
+  #list::-webkit-scrollbar { width: 10px; }
+  #list::-webkit-scrollbar-track { background: transparent; }
+  #list::-webkit-scrollbar-button { display: none; }
+  #list::-webkit-scrollbar-thumb { background: color-mix(in srgb, var(--dim) 35%, transparent); background-clip: padding-box; border: 2px solid transparent; border-radius: 5px; }
+  #list::-webkit-scrollbar-thumb:hover { background: color-mix(in srgb, var(--dim) 70%, transparent); background-clip: padding-box; }
+  @supports (-moz-appearance: none) {
+    #list { scrollbar-width: thin; scrollbar-color: color-mix(in srgb, var(--dim) 35%, transparent) transparent; }
+    #list:hover { scrollbar-color: color-mix(in srgb, var(--dim) 70%, transparent) transparent; }
+  }
   #filterBar { flex: 0 0 auto; border-top: 1px solid var(--border); padding: 8px 10px 9px; background: var(--panel); }
   .filter-wrap { position: relative; display: flex; align-items: center; }
   .filter-wrap .filter-icon { position: absolute; left: 8px; width: 13px; height: 13px; color: var(--dim); pointer-events: none; }

package/dist/ui/web-terminal/terminal.html

@@ -4,6 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
 <meta name="referrer" content="no-referrer">
+<meta name="agend-terminal" content="__AGEND_TERMINAL_MARKER__">
 <title>AgEnD terminal</title>
 <link rel="stylesheet" href="assets/xterm.css">
 <link rel="stylesheet" href="assets/terminal.css">

package/dist/wake-coordinator.d.ts

@@ -0,0 +1,128 @@
+import type { DeliveryWorkerMode } from "./types.js";
+import type { OutboxDelivery } from "./delivery-outbox.js";
+import type { PauseReason } from "./pause-marker.js";
+/** Row kinds that never warrant waking a target. Empty: every current kind asks for action (§1.2). */
+export declare const PASSIVE_KINDS: ReadonlySet<string>;
+export declare const isWakeEligibleKind: (kind: string) => boolean;
+export declare const WAKE_BACKOFF_BASE_MS = 1000;
+export declare const WAKE_BACKOFF_MAX_MS = 60000;
+/** Consecutive wake failures before both topics are told, once per failure episode. */
+export declare const WAKE_FAILURE_NOTICE_AFTER = 3;
+/** Pre-claim lease length (mirrors instance-lifecycle PRECLAIM_LEASE_MS). */
+export declare const PRECLAIM_WINDOW_MS = 120000;
+export declare const PARK_BASE_MS = 60000;
+export declare const PARK_MAX_MS: number;
+/** Queued work on an awake target that has not been claimed for this long is reported once (§1.4). */
+export declare const CLAIM_BLOCK_NOTICE_MS: number;
+/** How far `warm_cap` may be exceeded for leased work (§1.6). */
+export declare const DEFAULT_WARM_OVERFLOW = 2;
+export declare const WATCHDOG_INTERVAL_MS = 30000;
+export interface WakeCoordinatorDeps {
+    mode(target: string): DeliveryWorkerMode;
+    /**
+     * Whether the outbox can be read now. False once its database is closed
+     * (fleet shutdown, a test tearing down): the coordinator then does nothing,
+     * and stops itself, instead of querying a closed connection.
+     */
+    available(): boolean;
+    /** Rows still to deliver: queued, retry_wait, delivering, submission_started (created_seq order). */
+    listPending(): OutboxDelivery[];
+    isPaused(target: string): boolean;
+    pauseReason(target: string): PauseReason | null;
+    isRestarting(target: string): boolean;
+    /** The single-flight lifecycle wake, marked as the coordinator's own. */
+    wake(target: string): Promise<void>;
+    /** Instances counted against warm_cap right now (running, not paused, not general). */
+    residentNames(): string[];
+    /** warm_cap; 0 or less means unlimited. */
+    warmCap(): number;
+    warmOverflow(): number;
+    /** When the target was last woken or started for work (the pre-claim clock). */
+    wokeAt(target: string): number | undefined;
+    /** Why an awake target is not accepting input (dialog, auth hold…), or null. */
+    notAcceptingReason(target: string): string | null;
+    notifyTarget(target: string, text: string): void;
+    /**
+     * Run the outbox pump. A wake changes no outbox row, so nothing else would
+     * tell the pump that the target it skipped while paused can be claimed now.
+     */
+    kickPump(): void;
+    notifySender(source: string, text: string): void;
+    now(): number;
+    logger: {
+        info(obj: object, msg: string): void;
+        warn(obj: object, msg: string): void;
+        debug?(obj: object, msg: string): void;
+    };
+}
+export declare class WakeCoordinator {
+    private readonly deps;
+    private readonly states;
+    /** Targets whose wake is in flight (a reservation each, counted against the hard cap). */
+    private readonly reserved;
+    private scanTimer;
+    private watchdog;
+    private stopped;
+    constructor(deps: WakeCoordinatorDeps);
+    start(): void;
+    stop(): void;
+    /** Schedule a scan soon (coalesced). Safe to call from any event. */
+    kick(delayMs?: number): void;
+    private state;
+    private active;
+    /**
+     * The pump must not claim this target (§3.1, §1.4): it is paused, being
+     * woken, or awake but not accepting input by the daemon's own account
+     * (a dialog, a login failure, stuck). Called from the pump's claim
+     * callback, in the same synchronous step that reads the daemon's bootId, so
+     * the verdict and the claim are about the same daemon generation. A busy
+     * (working) target is accepting: the manager's idle gate still waits it out.
+     */
+    blocksClaim(target: string): boolean;
+    isWaking(target: string): boolean;
+    /** The last wake error, while the target is failing to wake (for the expiry reason). */
+    wakeFailure(target: string): string | null;
+    isParked(target: string): boolean;
+    /**
+     * A wake that did not come from here (an operator's /wake or wake_instance,
+     * a user's channel message) *succeeded*. Park and backoff block only
+     * automatic wakes, so such a wake always gets its one attempt (§1.6); only
+     * its success lifts them. A failed attempt, or a refusal for capacity,
+     * leaves the park and backoff exactly as they were. If the hold persists
+     * after a successful wake, the park comes back on its next window with the
+     * level kept (it is reset only by a delivery).
+     */
+    noteExternalWake(target: string): void;
+    /** A row for `target` was delivered: the hold is over, and so are the backoffs. */
+    noteDelivered(target: string): void;
+    /** Free warm slots under the hard cap, counting every target exactly once. */
+    private freeSlots;
+    /** Synchronously take a slot for `target` (before any await). */
+    tryReserve(target: string): symbol | null;
+    /** Return exactly the slot `token` holds (idempotent). */
+    release(target: string, token: symbol): void;
+    get reservedCount(): number;
+    /**
+     * One pass over the pending queue: wake what needs waking, park what will
+     * not take work. Runs from timers, so it must never throw: an exception
+     * there is uncaught and takes the whole fleet process down (e.g. a scan
+     * landing after the outbox's database was closed). The next kick or the
+     * watchdog retries.
+     */
+    scan(): void;
+    private scanOnce;
+    /**
+     * An awake target with queued work: past its pre-claim window without the
+     * work moving, it is parked (no automatic re-wake until the hold clears or
+     * the park expires), and a long pre-claim block is reported once.
+     */
+    private checkAwakeTarget;
+    /**
+     * Whether a wake completion must do nothing but return its slot: the
+     * coordinator was stopped, or the outbox went away while the wake was in
+     * flight (the coordinator stops itself then). Checked before any side
+     * effect, so a late completion can never kick a pump at a closed database.
+     */
+    private fencedCompletion;
+    private startWake;
+}