@songsid/agend 2.2.0-beta.5 → 2.2.0-beta.7

package/dist/fleet-manager.d.ts

@@ -1,3 +1,4 @@
+import { type HumanOrigin } from "./human-delivery-receipts.js";
 import { SettingsExecution } from "./settings-transaction.js";
 import type { LoginCodeOwner } from "./web-login.js";
 import { type ProfileTicket } from "./runtime-cpu-profile.js";
@@ -63,6 +64,7 @@ import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
 import { type ExplicitInstanceRemoval } from "./instance-removal.js";
 import type { InstanceState, InteractionSnapshot } from "./backend/types.js";
+import { type Daemon } from "./daemon.js";
 import { WakeCoordinator } from "./wake-coordinator.js";
 import { TargetQueueWorker } from "./target-queue-worker.js";
 import { resolveDeliveryWorkerMode } from "./types.js";
@@ -75,6 +77,7 @@ import { type PreviewAvailability } from "./web-preview.js";
 import { type ConnectionMetadata, type ConnectionBinding, type BindingProbe, type SecretApplyJob, type ProviderSecretApplyJob } from "./connection-secrets.js";
 import { type ProviderSecretStatus } from "./provider-secret-registry.js";
 import { ApplyJobStore, type ApplyJob, type ApplyTargetKind, type SelfRestartResult } from "./apply-job.js";
+import { type CarryResult } from "./backend/claude-carry.js";
 import { StormWindow } from "./storm-window.js";
 import { SpawnGate } from "./spawn-gate.js";
 import { BackendOutageTracker } from "./backend-outage.js";
@@ -102,6 +105,17 @@ export declare function selectLruEvictions(warm: string[], cap: number, opts: {
  * must match here, or a deleted instance's CLI is left running (#1305 P2-3).
  */
 export declare function isOrphanInstanceWindowName(name: string): boolean;
+/** restartSingleInstance's options. `carry` (#1753): a credential-profile switch; its outcome is written into `result`. */
+export interface RestartOpts {
+    freshStart?: boolean;
+    explicit?: boolean;
+    carry?: {
+        backend: string;
+        from: string | null;
+        to: string | null;
+        result?: CarryResult | null;
+    };
+}
 /**
  * Answer shape for `list_models`. `scope` reports where the LIST came from —
  * "instance" only when it was read through that instance's own backend config,
@@ -206,7 +220,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private replyObligationTimer;
     private readonly activeDurableTargets;
     /** Live view of lifecycle.daemons — used throughout; not deprecated. */
-    get daemons(): Map<string, import("./daemon.js").Daemon>;
+    get daemons(): Map<string, Daemon>;
     fleetConfig: FleetConfig | null;
     private rawFleetConfig;
     private rawFleetDocument;
@@ -305,6 +319,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private webChannelEchoGuards;
     /** instanceName → restart currently executing; concurrent callers join it. */
     private restartsInFlight;
+    /**
+     * #1753: each in-flight restart's stop → start gap — the conversation carry it will run there (its own, or one a later
+     * caller joined with before the gap), and whether the gap has been reached.
+     */
+    private readonly restartGaps;
     /**
      * Delayed automatic retries for instances whose startup failed. Before this a
      * failed start was logged once and the instance stayed `stopped` until an
@@ -403,6 +422,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private connectionBindingInFlight;
     private collabInstances;
     private healthServer;
+    private healthServerDrain;
     /** #1306: the preview listener (health_port + 1 by default), and whether it is listening. */
     private previewListener;
     private previewListening;
@@ -452,6 +472,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private webChatStore;
     /** Uploaded files and the files the dashboard may fetch back (uploads, reply attachments). */
     readonly webFiles: WebFileLedger;
+    /** #1770: per instance, its last web reply still copying its files — the next one is shown after it, in order. */
+    private readonly webReplyOrder;
+    /** #1770: an instance's web-files byte cap (a field, so a test can make it small). */
+    private webReplyMaxBytes;
     /** #1682: the people seen on inbound messages (id → name), for the web chat's mention pills; bounded, in memory. */
     readonly seenUsers: SeenUsers;
     private webPrefsStore?;
@@ -537,10 +561,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         kind: string;
         correlationId: string;
         payload: Record<string, unknown>;
+        forwards?: readonly string[];
+        requestedKind?: string;
     }): {
         deliveryId: string;
         state: string;
         duplicate: boolean;
+        kind: string;
     };
     queryDurableDeliveryStatus(callerInstance: string, selector: DeliveryStatusSelector): DeliveryStatusPage;
     /** #1641: why a target is not taking queued work right now, or null when nothing known holds it. */
@@ -610,6 +637,18 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     isPlannedRestart(): boolean;
     private finishStartup;
+    /**
+     * We are the post-update fleet: the update is over by definition. Clearing it here (rather than in the update
+     * command, which exits before the new fleet is up) is what keeps the quiet window from outliving the restart.
+     * #1660 exception: an update still owing its retire outcome keeps its receipt until the cleanup watch resolves it —
+     * deleting it here is what lost the warning. Terminal stages are still cleared unconditionally.
+     * #1735: and while the watch is armed it owns the marker — even if the outcome landed after the completion posted
+     * (a launchd kickstart or a detached restart returns at once, so it can land at any point of the boot): the watch
+     * appends it, then clears.
+     * #1737 review: and only the marker this boot adopted. One written since — a `/restart full` or a new `/update`
+     * landing while this boot's completion was still being edited — belongs to its writer and is left alone.
+     */
+    private clearSettledUpdateMarker;
     lastActivityMs(name: string): number;
     /** Capture the current daemon and delivery owner for a background context read. */
     getPaneContextSource(name: string): import("./pane-context-cache.js").PaneContextSource | null;
@@ -872,6 +911,17 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     hasPendingIdleGatedDelivery(instanceName: string): boolean;
     /** The running launch's own steer capability (#1405); undefined for a backend without one, or no running Daemon. */
     instanceLaunchSupportsSteer(instanceName: string): boolean | undefined;
+    private humanReceiptDaemons;
+    /** Cached FM + lifecycle + Daemon + tmux owner; unknown ownership grants nothing. */
+    private humanReceiptOwner;
+    private listenForHumanReceipt;
+    /** Evidence-only admission. Bots/system/agent payloads have no trusted origin. */
+    private humanReceiptPayload;
+    /** Bind at the actual IPC send, after all wake/reconnect waits. No human retry lane. */
+    private bindHumanReceiptPayload;
+    deliverHumanToInstance(instanceName: string, payload: Record<string, unknown>, origin: HumanOrigin | undefined, originalBody: string, options?: DeliveryOptions): Promise<boolean | void>;
+    /** Synchronous steer/btw handoff, using the same evidence and owner binding. */
+    sendHumanControl(instanceName: string, payload: Record<string, unknown>, origin: HumanOrigin | undefined, originalBody: string): boolean;
     /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
     deliverToInstance(instanceName: string, payload: Record<string, unknown>, options?: DeliveryOptions): Promise<boolean | void>;
     /**
@@ -1105,12 +1155,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Last-resort completion after RestartProgress could not deliver to its
      * adopted target. It stays bounded and never wakes a not-ready gateway. */
     private sendFleetStartCompletionFallback;
-    stopInstance(name: string, transition?: TransitionHandle): Promise<void>;
+    stopInstance(name: string, transition?: TransitionHandle): Promise<{
+        backgroundWorkEnded: boolean;
+    }>;
     /** Restart a single instance, reloading fleet.yaml first to pick up config changes. */
-    restartSingleInstance(name: string, opts?: {
-        freshStart?: boolean;
-        explicit?: boolean;
-    }): Promise<void>;
+    restartSingleInstance(name: string, opts?: RestartOpts): Promise<void>;
     isInstanceRestarting(name: string): boolean;
     /** InstanceLifecycleContext: an explicit wake joins the restart in flight. */
     restartInFlight(name: string): Promise<void> | undefined;
@@ -1131,6 +1180,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * One-shot: the daemon deletes it on startup.
      */
     private writeFreshStartMarker;
+    /**
+     * #1753: a credential-profile switch, between the old CLI's stop and the new one's start. Where the backend can take
+     * the conversation along (claude-code), copy it into the new profile and make it the one `--continue` picks; when that
+     * cannot be done, or the backend cannot, start fresh as before. Null when nothing was tried.
+     */
+    private switchConversation;
     /** Load .env file from data dir into process.env */
     private loadEnvFile;
     /** Initialize auth before any adapter can answer /dashboard. */
@@ -1154,6 +1209,23 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private publicOwnerCurrent;
     /** Exact owning General. No primary-adapter or name fallback participates in authorization. */
     private dashboardOwner;
+    /**
+     * #1742: the General a fleet admin's DM speaks for (`/start web`): the same owner `/web` in that General would make
+     * — this bot's configured group and its one General topic. No address to match in a DM, so it must be unambiguous:
+     * no General, or more than one on this bot and group, and there is no owner (nothing is guessed).
+     */
+    private dmDashboardOwner;
+    /**
+     * #1742: a fleet admin whose Telegram `/web` could not reach them privately may next open the bot's DM and press
+     * Telegram's START, which sends a bare `/start` — read as `/start web` (the DM menu) for 10 minutes, once, for that
+     * admin on that bot. Monotonic: a wall-clock jump neither opens nor shuts it.
+     */
+    private readonly tgWebStartWindows;
+    private openTgWebStartWindow;
+    /** Uses the window up: true when it was open. */
+    private takeTgWebStartWindow;
+    /** #1742: `/start web` from a fleet admin: the /web menu right here in the DM, for the General this bot serves. */
+    private startWebInDm;
     private getPublicWebLink;
     getPublicWebStatus(): {
         state: string;
@@ -1191,6 +1263,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Why the DM did not go, for the log only (Discord 50007 = the user does not accept DMs from this server's members). */
     private logDashboardDmFailure;
     /** False when the menu was not shown (the caller still owes the user an answer). */
+    /**
+     * `dmChatId` (#1742): show it in the owner's own private chat with the bot instead of the General — the owner, its
+     * gates and the code's route are the same; only where the menu sits (and its clicks are good) changes.
+     */
     private showDashboardMenu;
     private handleDashboardCallback;
     /** `/dashboard revoke`: sign out every browser and withdraw any unused code. */
@@ -1249,6 +1325,22 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * starts this timer on that path (Prism a) — without this, the owed
      * outcome would sit in the marker unwatched. READY never waits for it.
      */
+    /**
+     * #1735: what the completion of an adopted update does about its retire outcome, read from the marker as it is now.
+     * Already landed with a warning (a detached restart returns before this fleet boots, so the updater retires first)
+     * → render it in the completion. Still owed (`cleanup: "pending"` — a service restart waits for READY, which comes
+     * after the completion) → watch for it. Anything else (no retire on this update, done silently, another receipt)
+     * → nothing.
+     */
+    /**
+     * #1716: background work this restart/update ended, scoped to the operation
+     * so an older stop never reports (`sinceAt` null = plain boot, report
+     * nothing). A method — not a module function — because the #1737
+     * extracted-completion harness runs this region verbatim with only
+     * `this`-methods plus a fixed context.
+     */
+    private collectBackgroundWorkEndedNames;
+    private updateCleanupAtCompletion;
     private armCleanupWatch;
     /**
      * #1660: append a recorded cleanup outcome to the adopted update message,
@@ -1461,6 +1553,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private resolveInboundTarget;
     private handleInboundMessage;
+    /**
+     * #1752: the bot that speaks back about an inbound message — in a fleet topic the owning instance's adapter, never
+     * the sibling that happened to win the dedup race; elsewhere (ClassicBot rooms, no routed instance) the receiver.
+     */
+    private inboundNoticeAdapter;
     private handleInboundMessageCore;
     /** Handle outbound tool calls from a daemon instance */
     /** Warn (but don't block) when rate limits are high. 30-min debounce per instance. */
@@ -1503,7 +1600,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private isWebOnlyFleet;
     /** On a fleet with no chat platform, the dashboard is where an instance-health prompt is posted (#1307 item 6). */
     private webOnlyPromptPlace;
+    /** Resolves when the reply is in the web chat (#1770: after its files are copied); the caller need not wait. */
     private afterReplyRouted;
+    /**
+     * #1770: a reply's files as the web chat shows them. Each is copied into the instance's web-files/ and served from
+     * the copy. One the copy refuses (a symlink, not a regular file, over 50 MB, a state file, missing) is not shown;
+     * one that could not be copied (I/O) is served from the agent's own path, as before — until the fleet restarts.
+     */
+    private webReplyAttachments;
     private handleScheduleTrigger;
     /**
      * The adapter that can actually post into a chat, found by its group.