@songsid/agend 2.2.0-alpha.1 → 2.2.0-alpha.3

package/dist/fleet-level-config.js

@@ -50,6 +50,24 @@ export const RUNTIME_READ_FLEET_KEYS = [
     // #1386: read on every "Needs you" recompute.
     "needs_you",
 ];
+/**
+ * #1056: inside a connection, `options.status_emojis` is read at the point of use (every stamp resolves it from the
+ * live config, fleet-manager resolveStatusEmojisFor), so a change to it alone is not a pending restart. The rest of
+ * the connection — binding, access, token, other options — is still what createAdapter() took at startup.
+ */
+const RUNTIME_READ_CHANNEL_OPTIONS = ["status_emojis"];
+function withoutRuntimeOptions(channel) {
+    if (!channel || typeof channel !== "object" || Array.isArray(channel))
+        return channel;
+    const options = channel.options;
+    if (!options || typeof options !== "object" || Array.isArray(options))
+        return channel;
+    const kept = { ...options };
+    for (const key of RUNTIME_READ_CHANNEL_OPTIONS)
+        delete kept[key];
+    const { options: _options, ...rest } = channel;
+    return Object.keys(kept).length ? { ...rest, options: kept } : rest;
+}
 function pick(source, path) {
     let value = source;
     for (const segment of path.split(".")) {
@@ -57,6 +75,10 @@ function pick(source, path) {
             return undefined;
         value = value[segment];
     }
+    if (path === "channel")
+        return withoutRuntimeOptions(value);
+    if (path === "channels" && Array.isArray(value))
+        return value.map(withoutRuntimeOptions);
     return value;
 }
 /**
@@ -80,4 +102,35 @@ export function fleetLevelSignature(config) {
 export function fleetLevelDifferences(a, b) {
     return STARTUP_ONLY_FLEET_KEYS.filter(path => JSON.stringify(pick(a, path) ?? null) !== JSON.stringify(pick(b, path) ?? null));
 }
+/**
+ * #1519 P6: the connections a running fleet can start without a restart — those appended to it, and only when nothing
+ * else at startup level changed: every other startup-only key equal, the connections it started with still there, the
+ * same and in the same order (so the first, the primary, is untouched), and at least one of them (a web-only fleet's
+ * first connection becomes the primary, which only a fresh process sets up). Anything else: null — a restart.
+ */
+export function appendedConnections(before, after) {
+    for (const path of STARTUP_ONLY_FLEET_KEYS) {
+        if (path === "channel" || path === "channels")
+            continue;
+        if (JSON.stringify(pick(before, path) ?? null) !== JSON.stringify(pick(after, path) ?? null))
+            return null;
+    }
+    const list = (cfg) => (cfg?.channels ?? (cfg?.channel ? [cfg.channel] : []));
+    const was = list(before), now = list(after);
+    if (!was.length || now.length <= was.length)
+        return null;
+    const same = (a, b) => JSON.stringify(withoutRuntimeOptions(a)) === JSON.stringify(withoutRuntimeOptions(b));
+    for (let i = 0; i < was.length; i++)
+        if (!same(was[i], now[i]))
+            return null;
+    const added = now.slice(was.length);
+    const ids = new Set(was.map(c => c.id ?? c.type));
+    for (const c of added) {
+        const id = c.id ?? c.type;
+        if (!id || ids.has(id))
+            return null;
+        ids.add(id);
+    }
+    return added;
+}
 //# sourceMappingURL=fleet-level-config.js.map

package/dist/fleet-level-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-level-config.js","sourceRoot":"","sources":["../src/fleet-level-config.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAA+B,6BAA6B;IACrE,UAAU,EAA8B,6BAA6B;IACrE,aAAa,EAA2B,4BAA4B;IACpE,iBAAiB,EAAuB,uCAAuC;IAC/E,qBAAqB,EAAmB,qBAAqB;IAC7D,mBAAmB,EAAqB,0BAA0B;IAClE,wBAAwB,EAAgB,wBAAwB;IAChE,kCAAkC,EAAM,wBAAwB;IAChE,qCAAqC,EAAG,wBAAwB;IAChE,kBAAkB,EAAsB,wEAAwE;IAChH,oBAAoB,EAAoB,yDAAyD;CACzF,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,oCAAoC;IACpC,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;IACrB,wBAAwB;IACxB,4CAA4C;IAC5C,8BAA8B;IAC9B,mCAAmC;IACnC,0CAA0C;IAC1C,2CAA2C;IAC3C,eAAe;IACf,+BAA+B;IAC/B,sEAAsE;IACtE,gCAAgC;IAChC,sCAAsC;IACtC,mHAAmH;IACnH,4GAA4G;IAC5G,KAAK;IACL,UAAU;IACV,OAAO;IACP,cAAc;IACd,8CAA8C;IAC9C,WAAW;CACH,CAAC;AAEX,SAAS,IAAI,CAAC,MAAe,EAAE,IAAY;IACzC,IAAI,KAAK,GAAY,MAAM,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClE,KAAK,GAAI,KAAiC,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,CAAqB,EAAE,CAAqB;IAChF,OAAO,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AACrF,CAAC"}
+{"version":3,"file":"fleet-level-config.js","sourceRoot":"","sources":["../src/fleet-level-config.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAA+B,6BAA6B;IACrE,UAAU,EAA8B,6BAA6B;IACrE,aAAa,EAA2B,4BAA4B;IACpE,iBAAiB,EAAuB,uCAAuC;IAC/E,qBAAqB,EAAmB,qBAAqB;IAC7D,mBAAmB,EAAqB,0BAA0B;IAClE,wBAAwB,EAAgB,wBAAwB;IAChE,kCAAkC,EAAM,wBAAwB;IAChE,qCAAqC,EAAG,wBAAwB;IAChE,kBAAkB,EAAsB,wEAAwE;IAChH,oBAAoB,EAAoB,yDAAyD;CACzF,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,oCAAoC;IACpC,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;IACrB,wBAAwB;IACxB,4CAA4C;IAC5C,8BAA8B;IAC9B,mCAAmC;IACnC,0CAA0C;IAC1C,2CAA2C;IAC3C,eAAe;IACf,+BAA+B;IAC/B,sEAAsE;IACtE,gCAAgC;IAChC,sCAAsC;IACtC,mHAAmH;IACnH,4GAA4G;IAC5G,KAAK;IACL,UAAU;IACV,OAAO;IACP,cAAc;IACd,8CAA8C;IAC9C,WAAW;CACH,CAAC;AAEX;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,CAAC,eAAe,CAAU,CAAC;AAChE,SAAS,qBAAqB,CAAC,OAAgB;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACtF,MAAM,OAAO,GAAI,OAAiC,CAAC,OAAO,CAAC;IAC3D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACtF,MAAM,IAAI,GAAG,EAAE,GAAI,OAAmC,EAAE,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,4BAA4B;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAkC,CAAC;IAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,IAAI,CAAC,MAAe,EAAE,IAAY;IACzC,IAAI,KAAK,GAAY,MAAM,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClE,KAAK,GAAI,KAAiC,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,CAAqB,EAAE,CAAqB;IAChF,OAAO,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B,EAAE,KAAyB;IACvF,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU;YAAE,SAAS;QACxD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5G,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAuB,EAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAoB,CAAC;IACrI,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAE,CAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3I,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACvG,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/fleet-manager.d.ts

@@ -52,6 +52,7 @@ export declare function applyTaskListCap<T extends {
     hint: string;
 } | T[];
 import { WebChatHistory } from "./web-chat-history.js";
+import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { WebFileLedger } from "./web-upload.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
@@ -63,6 +64,8 @@ import { TargetQueueWorker } from "./target-queue-worker.js";
 import { resolveDeliveryWorkerMode } from "./types.js";
 import { type WebNeedsItem } from "./needs-you-hub.js";
 import { type OrgChart } from "./web-org.js";
+import { type CacheReport } from "./cache-service.js";
+import { type WebCommandResult } from "./web-commands.js";
 import { type PreviewAvailability } from "./web-preview.js";
 import { type ConnectionMetadata, type ConnectionBinding, type BindingProbe, type SecretApplyJob, type ProviderSecretApplyJob } from "./connection-secrets.js";
 import { type ProviderSecretStatus } from "./provider-secret-registry.js";
@@ -168,6 +171,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     dataDir: string;
     private static signalTarget;
     private static sighupHandlerInstalled;
+    /** Test seam: inject a spy to verify saveFleetConfig calls fsync. Default: fsyncSync. */
+    fsyncForTest: ((fd: number) => void) | undefined;
     private children;
     readonly lifecycle: InstanceLifecycle;
     readonly stormWindow: StormWindow;
@@ -444,6 +449,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private classicSettingsOwners;
     private queueSettingsOperation;
     private settingsGate;
+    /** Exact configured effect owners; this does not depend on prompt location. */
+    private settingsChatAuthority;
     private promptSettingsChange;
     private handleSettingsChangeCallback;
     startSettingsConfirmationControl(): Promise<void>;
@@ -476,6 +483,25 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private fleetSignatureMismatch;
     private healthServerListening;
     constructor(dataDir: string);
+    /** #1266: a reply's buttons — the store (reply-buttons.db) and what a click does. Created on first use. */
+    private replyButtonsCtl;
+    /** The store could not be opened in this process: buttons are offered as text until the next start. */
+    private replyButtonsUnavailable;
+    /**
+     * The controller, or null when reply-buttons.db cannot be opened (#1500 review). That file holds only open choices,
+     * so it never stops AgEnD: the failure is logged and posted once, replies offer their choices as text, and a click on
+     * an older button is answered "closed". The file is left where it is — an open error is not proof of corruption.
+     */
+    replyButtons(): ReplyButtonsController | null;
+    private replyButtonsStore;
+    /**
+     * #1266: who may answer a reply's buttons on a platform — whoever may message that instance there: in a ClassicBot
+     * room anyone there (as a typed message), elsewhere someone the sending connection lets speak (#754/#1148), never a
+     * fleet bot.
+     */
+    private mayAnswerReplyButtons;
+    /** #1266: the choice, delivered as an ordinary inbound message from whoever made it, and shown in the web chat. */
+    private deliverReplyButtonChoice;
     private ensureDeliveryOutbox;
     /** Synchronous SQLite admission; the caller may acknowledge only after this returns. */
     admitDurableDelivery(input: {
@@ -541,6 +567,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * handled, so a rejection never escapes as an unhandled rejection.
      */
     private startExclusiveReconcile;
+    /** Pure cached admission for command continuations; no IO or update-progress lookup. */
+    isFleetStopping(): boolean;
     /**
      * Is the fleet going down (or coming back up) on purpose?
      *
@@ -553,6 +581,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     isPlannedRestart(): boolean;
     private finishStartup;
     lastActivityMs(name: string): number;
+    /** Capture the current daemon and delivery owner for a background context read. */
+    getPaneContextSource(name: string): import("./pane-context-cache.js").PaneContextSource | null;
     /**
      * Is the instance between turns?
      *
@@ -964,10 +994,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /**
      * Probe the same executable set exposed by the web backend catalog.
      *
-     * This deliberately has no cache: an install `/login` ran can add a
+     * This deliberately skips the cache: an install `/login` ran can add a
      * binary to PATH while the fleet process remains alive, and the next bare
      * `/login` must see it without requiring a restart or an explicit cache
-     * invalidation call.
+     * invalidation call. The fresh answers also refresh the shared cache that
+     * `/ui/backends` reads. #1490: async and bounded, never `which` on the event loop; a probe with no answer in time
+     * counts as not installed, as the old timeout did.
      */
     private probeInstalledBackends;
     /**
@@ -1071,6 +1103,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Telegram's typed command enters through the same strict owner and nonce path as Discord. */
     dashboardMenu(msg: InboundMessage): Promise<void>;
     private sendLocalDashboard;
+    /** Why the DM did not go, for the log only (Discord 50007 = the user does not accept DMs from this server's members). */
+    private logDashboardDmFailure;
+    /** False when the menu was not shown (the caller still owes the user an answer). */
     private showDashboardMenu;
     private handleDashboardCallback;
     /** `/dashboard revoke`: sign out every browser and withdraw any unused code. */
@@ -1280,19 +1315,26 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private inboundRouteThreadId;
     /**
-     * #1085, defense in depth: a routed Telegram target must belong to the group
-     * the message came from — its own world's group_id. Two Telegram fleet
-     * worlds can number topics alike; a coincidence is dropped, never delivered.
+     * A forum-root command has one configured General before any adapter claims
+     * dedup. Bare commands prefer the primary adapter's General in this group;
+     * explicit suffixes select their own bot. Runtime availability must not pick
+     * another administrator, so stopped owners remain selected and every copy
+     * silently refuses instead of falling back.
+     * undefined = another ingress scope; null = root command with no proven target.
      */
+    private telegramRootCommandTarget;
     /**
      * #1346: whether this copy may claim the shared dedup key for
      * command-like text. Fleet topics resolve an owning adapter and only its
      * copy proceeds. Classic targets and unknown routing keep their existing
-     * handling. At the receiving Telegram world's own forum root, an explicit
-     * suffix requires a known matching username before dedup; present-thread
+     * handling. Telegram forum-root commands select a configured General before
+     * dedup. An explicit suffix requires a known matching username; present-thread
      * copies retain their permissive handling when that identity is unknown.
      */
     private isOwnerCommandCopy;
+    /**
+     * #1085: coincident topic numbers must not route across Telegram groups.
+     */
     private resolveInboundTarget;
     private handleInboundMessage;
     /** Handle outbound tool calls from a daemon instance */
@@ -1496,6 +1538,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * non-identity instance leaves are canonicalized to inheritance afterward.
      */
     saveFleetConfig(explicitPatches?: RawConfigPatch[]): void;
+    /** Why the config written to `candidate` must not replace fleet.yaml, or null: it does not load, or it adds errors. */
+    private savedFleetConfigProblem;
     /** One-time upgrade migration; invalid YAML is never rewritten. */
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
@@ -1513,6 +1557,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * to a plain add (never worse than the old behaviour).
      */
     private lastStatusEmoji;
+    /**
+     * #1056: every status emoji each bot really stamped, per `${adapterId}:${messageId}` (match keys). A connection's
+     * status set can change while AgEnD runs, so "is this a stamp?" cannot be answered from the current set alone: a
+     * bot's earlier stamp in the old emoji must still be plumbing, not an agent's reaction. Unbounded for the same
+     * reason as lastStatusEmoji (a few short strings per stamped message).
+     */
+    private stampedStatus;
+    private noteStamped;
     /**
      * One in-flight status update per bot+message: updates run strictly in call
      * order, so a delayed ❌ add can never land after a newer ✅'s removal —
@@ -1537,6 +1589,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         platform: string | undefined;
     };
     private warnedStatusEmojis;
+    /**
+     * The connection whose `options.status_emojis` an instance on `worldId` stamps with. #1056: read from the live config
+     * first — a Settings save replaces `fleetConfig.channels`, and the running world keeps the object it started with —
+     * so a change to the connection's emojis applies at the next stamp, as an instance's own override does. Only the
+     * emoji options are taken from it: the platform is still the running adapter's (resolveStatusEmojisFor).
+     */
+    private statusEmojiChannel;
     /**
      * A Discord connection's server emojis for the Settings picker (#1005), from
      * every server its bot can draw on (#1021): the primary `group_id` server,
@@ -1729,6 +1788,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * retention, and the caller is the original source or target (#1340 P2 🔒).
      */
     wasDeliveryIdPrunedForCaller(deliveryId: string, callerInstance: string): boolean;
+    /** How long opening events.db waits for another process's lock (a field so tests need not wait 5 s). */
+    private eventLogBusyTimeoutMs;
     private openEventLog;
     /**
      * Report a fleet-level fault (not attributable to one instance) to the General
@@ -1860,6 +1921,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * fleet.yaml's teams, each instance's description and thread link. Read on demand; the live state rides the stream.
      */
     orgChart(): OrgChart;
+    private cacheService;
+    /**
+     * #1468: the prompt-cache expiry analysis for the web, per instance, over `window`. Read from each instance's
+     * ledger as it is now; the first request starts the bounded, persisted catch-up over the transcripts
+     * (cache-service.ts) — never a vendor call, never a synchronous transcript read.
+     */
+    cacheReport(window: string): Promise<CacheReport>;
     /** The web's Acknowledge (any item; a signed-in session is fleet-admin level). */
     acknowledgeNeedsItem(id: string, principal: string): {
         status: 200 | 400 | 404 | 409 | 500;
@@ -1893,6 +1961,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * The caller has passed the /ui gate (session, same origin, CSRF). Here: the prompt must be one offered
      * on the dashboard, about the instance the page named, and the action one of its own buttons.
      */
+    /** #1266: a click on a reply's button in the web chat (the /ui gate is passed: a session, or the public link). */
+    clickWebReplyButton(instance: string, id: string, index: number): Promise<{
+        status: 200 | 400 | 403 | 409;
+        error?: string;
+    }>;
     clickWebPrompt(instance: string, nonce: string, action: string): Promise<{
         status: 200 | 400 | 403 | 409;
         error?: string;
@@ -1914,6 +1987,24 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private handleTipUnlock;
     /** Post the destructive `/clear` confirmation in the invoking channel. */
     promptClearConfirmation(instanceName: string, channelId: string, adapter: ChannelAdapter, chatId: string, threadId?: string): Promise<string | null>;
+    /**
+     * What a confirmed /clear must still find when it acts — shared by the platform's Confirm button and the web
+     * (#1269): the same daemon and IPC client, the same interaction owner, lifecycle epoch and delivery epoch as when the
+     * fence was taken. Null when there is no owner to pin (then nothing may be cleared). The reads are cached and
+     * synchronous; they never probe the pane.
+     */
+    private clearTargetFence;
+    /** #1269: the web's /clear confirmations — one token per question, used once, for the instance as it was asked about. */
+    private readonly webClearTokens;
+    /** #1269: an instance's chat command from the web chat (web-commands.ts); `publicLink`: a gateway request. */
+    webCommand(input: {
+        instance: string;
+        command: string;
+        args?: string;
+        confirm?: string;
+    }, opts: {
+        publicLink: boolean;
+    }): Promise<WebCommandResult>;
     /** Consume `/clear` Confirm/Cancel exactly once; only Confirm reaches IPC. */
     private handleClearConfirmation;
     /**
@@ -1938,6 +2029,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private retirePendingNoncePrompts;
     clearNoncePromptsForInstance(instanceName: string): void;
+    /** A lapsed prompt's buttons collapsed to its expired text — through its own interaction when it is private. */
+    private collapseNoncePrompt;
     /** A clean exit is intentional from the CLI's perspective, but often not from
      * the operator's. Keep the instance notice passive and put the action in the
      * same-world General topic where an administrator can make the choice. */
@@ -2634,6 +2727,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     get applyJobs(): ApplyJobStore;
     /** The only channel metadata exposed to the Settings secret UI. */
     listSecureConnections(): ConnectionMetadata[];
+    /**
+     * #1519 P6 (#1537 review): a connection's status from evidence, never from a start call that merely resolved. No
+     * adapter object: not running (or retrying / failed, as recorded) — never "connected". An adapter that has not logged
+     * in yet (no `started`: no bot id; for Telegram, polling not ready) is "starting". Named problems: the Message Content
+     * intent refused (4014, P3), the token refused (an explicit auth error, or Telegram's own 401 flag) — the error text
+     * itself is never passed on.
+     */
+    private connectionStatus;
     private secureConnectionChannel;
     private secureConnectionGeneration;
     /** Provider API-key rows exposed to Settings (never the env key or secret). */
@@ -2765,6 +2866,20 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * the reconcile reports as it works. A target the forecast missed (a Classic
      * instance inheriting a changed default) is added when it is first touched.
      */
+    /**
+     * #1519 P6: whether `next` differs from what this process started with only by connections appended to it, while it
+     * runs connections already (a fleet's first connection becomes its primary: a fresh process sets that up).
+     */
+    private canHotAddConnections;
+    /**
+     * #1519 P6: start connections appended to a running fleet. Each token is read from .env (that key only, under the
+     * file's lease — Settings wrote it there, and this process read .env once at start); a connection already running (a
+     * token Replace started it) is left alone. True only when every one is running; one that failed to start is retried in
+     * the background like any other, and the Apply row says a restart is still needed.
+     */
+    private hotAddConnections;
+    /** Set the named keys of the data dir's .env into this process's environment (the file's lease held by `owner`). */
+    private loadEnvKeys;
     planConfigApply(): Array<{
         target: string;
         kind: ApplyTargetKind;