@songsid/agend 2.2.0-alpha.2 → 2.2.0-alpha.3

package/dist/fleet-manager.d.ts

@@ -52,6 +52,7 @@ export declare function applyTaskListCap<T extends {
     hint: string;
 } | T[];
 import { WebChatHistory } from "./web-chat-history.js";
+import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { WebFileLedger } from "./web-upload.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
@@ -170,6 +171,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     dataDir: string;
     private static signalTarget;
     private static sighupHandlerInstalled;
+    /** Test seam: inject a spy to verify saveFleetConfig calls fsync. Default: fsyncSync. */
+    fsyncForTest: ((fd: number) => void) | undefined;
     private children;
     readonly lifecycle: InstanceLifecycle;
     readonly stormWindow: StormWindow;
@@ -446,6 +449,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private classicSettingsOwners;
     private queueSettingsOperation;
     private settingsGate;
+    /** Exact configured effect owners; this does not depend on prompt location. */
+    private settingsChatAuthority;
     private promptSettingsChange;
     private handleSettingsChangeCallback;
     startSettingsConfirmationControl(): Promise<void>;
@@ -478,6 +483,25 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private fleetSignatureMismatch;
     private healthServerListening;
     constructor(dataDir: string);
+    /** #1266: a reply's buttons — the store (reply-buttons.db) and what a click does. Created on first use. */
+    private replyButtonsCtl;
+    /** The store could not be opened in this process: buttons are offered as text until the next start. */
+    private replyButtonsUnavailable;
+    /**
+     * The controller, or null when reply-buttons.db cannot be opened (#1500 review). That file holds only open choices,
+     * so it never stops AgEnD: the failure is logged and posted once, replies offer their choices as text, and a click on
+     * an older button is answered "closed". The file is left where it is — an open error is not proof of corruption.
+     */
+    replyButtons(): ReplyButtonsController | null;
+    private replyButtonsStore;
+    /**
+     * #1266: who may answer a reply's buttons on a platform — whoever may message that instance there: in a ClassicBot
+     * room anyone there (as a typed message), elsewhere someone the sending connection lets speak (#754/#1148), never a
+     * fleet bot.
+     */
+    private mayAnswerReplyButtons;
+    /** #1266: the choice, delivered as an ordinary inbound message from whoever made it, and shown in the web chat. */
+    private deliverReplyButtonChoice;
     private ensureDeliveryOutbox;
     /** Synchronous SQLite admission; the caller may acknowledge only after this returns. */
     admitDurableDelivery(input: {
@@ -543,6 +567,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * handled, so a rejection never escapes as an unhandled rejection.
      */
     private startExclusiveReconcile;
+    /** Pure cached admission for command continuations; no IO or update-progress lookup. */
+    isFleetStopping(): boolean;
     /**
      * Is the fleet going down (or coming back up) on purpose?
      *
@@ -555,6 +581,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     isPlannedRestart(): boolean;
     private finishStartup;
     lastActivityMs(name: string): number;
+    /** Capture the current daemon and delivery owner for a background context read. */
+    getPaneContextSource(name: string): import("./pane-context-cache.js").PaneContextSource | null;
     /**
      * Is the instance between turns?
      *
@@ -966,10 +994,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /**
      * Probe the same executable set exposed by the web backend catalog.
      *
-     * This deliberately has no cache: an install `/login` ran can add a
+     * This deliberately skips the cache: an install `/login` ran can add a
      * binary to PATH while the fleet process remains alive, and the next bare
      * `/login` must see it without requiring a restart or an explicit cache
-     * invalidation call.
+     * invalidation call. The fresh answers also refresh the shared cache that
+     * `/ui/backends` reads. #1490: async and bounded, never `which` on the event loop; a probe with no answer in time
+     * counts as not installed, as the old timeout did.
      */
     private probeInstalledBackends;
     /**
@@ -1073,6 +1103,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Telegram's typed command enters through the same strict owner and nonce path as Discord. */
     dashboardMenu(msg: InboundMessage): Promise<void>;
     private sendLocalDashboard;
+    /** Why the DM did not go, for the log only (Discord 50007 = the user does not accept DMs from this server's members). */
+    private logDashboardDmFailure;
+    /** False when the menu was not shown (the caller still owes the user an answer). */
     private showDashboardMenu;
     private handleDashboardCallback;
     /** `/dashboard revoke`: sign out every browser and withdraw any unused code. */
@@ -1282,19 +1315,26 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private inboundRouteThreadId;
     /**
-     * #1085, defense in depth: a routed Telegram target must belong to the group
-     * the message came from — its own world's group_id. Two Telegram fleet
-     * worlds can number topics alike; a coincidence is dropped, never delivered.
+     * A forum-root command has one configured General before any adapter claims
+     * dedup. Bare commands prefer the primary adapter's General in this group;
+     * explicit suffixes select their own bot. Runtime availability must not pick
+     * another administrator, so stopped owners remain selected and every copy
+     * silently refuses instead of falling back.
+     * undefined = another ingress scope; null = root command with no proven target.
      */
+    private telegramRootCommandTarget;
     /**
      * #1346: whether this copy may claim the shared dedup key for
      * command-like text. Fleet topics resolve an owning adapter and only its
      * copy proceeds. Classic targets and unknown routing keep their existing
-     * handling. At the receiving Telegram world's own forum root, an explicit
-     * suffix requires a known matching username before dedup; present-thread
+     * handling. Telegram forum-root commands select a configured General before
+     * dedup. An explicit suffix requires a known matching username; present-thread
      * copies retain their permissive handling when that identity is unknown.
      */
     private isOwnerCommandCopy;
+    /**
+     * #1085: coincident topic numbers must not route across Telegram groups.
+     */
     private resolveInboundTarget;
     private handleInboundMessage;
     /** Handle outbound tool calls from a daemon instance */
@@ -1921,6 +1961,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * The caller has passed the /ui gate (session, same origin, CSRF). Here: the prompt must be one offered
      * on the dashboard, about the instance the page named, and the action one of its own buttons.
      */
+    /** #1266: a click on a reply's button in the web chat (the /ui gate is passed: a session, or the public link). */
+    clickWebReplyButton(instance: string, id: string, index: number): Promise<{
+        status: 200 | 400 | 403 | 409;
+        error?: string;
+    }>;
     clickWebPrompt(instance: string, nonce: string, action: string): Promise<{
         status: 200 | 400 | 403 | 409;
         error?: string;
@@ -1984,6 +2029,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private retirePendingNoncePrompts;
     clearNoncePromptsForInstance(instanceName: string): void;
+    /** A lapsed prompt's buttons collapsed to its expired text — through its own interaction when it is private. */
+    private collapseNoncePrompt;
     /** A clean exit is intentional from the CLI's perspective, but often not from
      * the operator's. Keep the instance notice passive and put the action in the
      * same-world General topic where an administrator can make the choice. */
@@ -2680,6 +2727,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     get applyJobs(): ApplyJobStore;
     /** The only channel metadata exposed to the Settings secret UI. */
     listSecureConnections(): ConnectionMetadata[];
+    /**
+     * #1519 P6 (#1537 review): a connection's status from evidence, never from a start call that merely resolved. No
+     * adapter object: not running (or retrying / failed, as recorded) — never "connected". An adapter that has not logged
+     * in yet (no `started`: no bot id; for Telegram, polling not ready) is "starting". Named problems: the Message Content
+     * intent refused (4014, P3), the token refused (an explicit auth error, or Telegram's own 401 flag) — the error text
+     * itself is never passed on.
+     */
+    private connectionStatus;
     private secureConnectionChannel;
     private secureConnectionGeneration;
     /** Provider API-key rows exposed to Settings (never the env key or secret). */
@@ -2811,6 +2866,20 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * the reconcile reports as it works. A target the forecast missed (a Classic
      * instance inheriting a changed default) is added when it is first touched.
      */
+    /**
+     * #1519 P6: whether `next` differs from what this process started with only by connections appended to it, while it
+     * runs connections already (a fleet's first connection becomes its primary: a fresh process sets that up).
+     */
+    private canHotAddConnections;
+    /**
+     * #1519 P6: start connections appended to a running fleet. Each token is read from .env (that key only, under the
+     * file's lease — Settings wrote it there, and this process read .env once at start); a connection already running (a
+     * token Replace started it) is left alone. True only when every one is running; one that failed to start is retried in
+     * the background like any other, and the Apply row says a restart is still needed.
+     */
+    private hotAddConnections;
+    /** Set the named keys of the data dir's .env into this process's environment (the file's lease held by `owner`). */
+    private loadEnvKeys;
     planConfigApply(): Array<{
         target: string;
         kind: ApplyTargetKind;