@songsid/agend 2.2.0-beta.9 → 2.3.0-beta.1

package/dist/fleet-manager.d.ts

@@ -57,8 +57,21 @@ import { type LogAnswer, type LogQuery } from "./log-service.js";
 import { WebChatHistory } from "./web-chat-history.js";
 import { SeenUsers, type MentionNames, type MentionQuery } from "./web-mentions.js";
 import { WebPrefsStore } from "./web-prefs.js";
+import { OwnerCssStore } from "./web-owner-css-store.js";
+import { ThemeStore } from "./web-theme-store.js";
+import { WebAppearance } from "./web-appearance.js";
+import { WebEffectLibrary } from "./web-effect-library.js";
+import { WebEffectTrials } from "./web-effect-trials.js";
+import { WebEffectService } from "./web-effect-service.js";
+import { WebEffectProfiles } from "./web-effect-profiles.js";
+import { WebEffectTools } from "./web-effect-tools.js";
+import { type WebAccount } from "./web-profile.js";
+import type { WebPerson as WebPersonView } from "./web-api.js";
 import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { WebFileLedger } from "./web-upload.js";
+import { AppearanceTools } from "./web-appearance-tools.js";
+import { ModStore } from "./web-mod-store.js";
+import { AgentMods } from "./web-mod-agent.js";
 import { type CachedImage } from "./web-images.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
@@ -359,6 +372,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** In-flight /effort selections, same coordinator shape as pendingModelSelects. */
     private pendingEffortSelects;
     private pendingModelSelects;
+    /** #1806: in-flight /backend steps, keyed by nonce (see handleBackendSelection). */
+    private pendingBackendSelects;
     /** nonce → pending button prompt (hang restart, interactive assist, clean-exit restart). */
     private pendingNonceButtons;
     /** #1386 "Needs you": the list, its live chat messages and Acknowledge. Started with the fleet (finishStartup). */
@@ -435,7 +450,6 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private updateProgressTimer;
     private updateProgressEditRunning;
     private lastUpdateProgressText;
-    private updateCompletionTipText;
     /**
      * #1660: an adopted update whose retire outcome is still owed. The
      * completion summary was (or will be) posted; this watch appends the
@@ -481,6 +495,85 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     readonly seenUsers: SeenUsers;
     private webPrefsStore?;
     /** #1665: the web preferences kept on the host (<home>/web-prefs.json), read on first use. */
+    /**
+     * #1827: a web person as agents and chats see them. Signed in as an account (a sign-in code DMed to it): that
+     * account's user id — still `via web`, and only for recognition — and the name they chose, else their account's name
+     * at sign-in (made safe). Otherwise (an `agend web` session): "web-user", as before, under a name the operator may set.
+     * Names are checked again now: one an instance or bot has taken since reads as the next choice down.
+     */
+    webPerson(owner?: WebAccount): WebPersonView;
+    /** #1827: set (null: clear — back to their account's name) a web person's own name; validated in full. */
+    setWebPersonName(owner: WebAccount | undefined, raw: unknown): {
+        ok: true;
+        person: WebPersonView;
+    } | {
+        ok: false;
+        status: number;
+        error: string;
+    };
+    /** #1827 (auth-api): a sign-in as this account — its display name then is the web name it starts with. */
+    noteWebSignIn(account: {
+        adapterId: string;
+        userId: string;
+        username?: string;
+    }): void;
+    /**
+     * #1827: a name that belongs to something here — an instance (or ClassicBot room), its display name, a bot. On the web
+     * send path: it never throws (a lookup that fails reserves nothing; the name was checked in full when it was set).
+     */
+    private webNameReserved;
+    private webNameTaken;
+    private themeStoreInstance?;
+    private webAppearanceService?;
+    /** #1629: every instance's theme, placements, assets and lock (web-themes.json). */
+    get themeStore(): ThemeStore;
+    /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
+    get webAppearance(): WebAppearance;
+    private effectLibraryInstance?;
+    private effectTrialsInstance?;
+    /** Lazy, single-owner storage. Register every host reference source before any operation can collect. */
+    get effectLibrary(): WebEffectLibrary;
+    /** Volatile Try offers and session-bound runs share this library. */
+    get effectTrials(): WebEffectTrials;
+    private effectProfilesInstance?;
+    get effectProfiles(): WebEffectProfiles;
+    private effectServiceInstance?;
+    get effectService(): WebEffectService;
+    private effectToolsService?;
+    /** Caller identity is supplied only by the owned IPC connection / verified agent endpoint token. */
+    get effectTools(): WebEffectTools;
+    private appearanceToolsService?;
+    /** #1629 r4 §1: get_web_appearance / preview_web_appearance — the caller's own look, resolved as the page resolves it. */
+    get appearanceTools(): AppearanceTools;
+    /** #1958: a profile, card or colour write (view-api.ts) landed: every open page gets a fresh status frame. */
+    identityChanged(): void;
+    /** A fleet.yaml instance (own key) or a ClassicBot room, now (#1629: a person's reset/lock names one). */
+    isKnownInstance(name: string): boolean;
+    private modStore?;
+    /**
+     * #1629 r4-5 / B2: installed mods use the same validated library and scoped holder claims as direct uploads.
+     */
+    get mods(): ModStore;
+    private agentModsService?;
+    /** #1629 r4-5b: export_web_mod / propose_web_mod — the caller's own look as a file, and a proposal for a person. */
+    get agentMods(): AgentMods;
+    /**
+     * #1629 r4-5c: an effect as this person may carry it away in an export — their own claim, or one a person shared —
+     * read with their principal (Sol's ACL). Being able to view or run a placed effect never grants packaging someone
+     * else's private claim: the library's reference read is runtime access, not an export path. Null: not theirs.
+     */
+    modPlacedEffect(person: string, id: string): {
+        name: string;
+        files: ReadonlyMap<string, Uint8Array>;
+    } | null;
+    /** #1629 r4-5: an instance's card text as every viewer sees it (a person's fields over the agent's). */
+    modCardText(name: string): {
+        tagline?: string;
+        bio?: string;
+    };
+    private ownerCssStore?;
+    /** #1629 r4 §3: each person's own CSS; which version is in force is their `css.active` in the web preferences. */
+    get ownerCss(): OwnerCssStore;
     get webPrefs(): WebPrefsStore;
     /**
      * Read from disk on every access rather than cached at startup: `agend
@@ -543,6 +636,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     replyButtons(): ReplyButtonsController | null;
     private replyButtonsStore;
+    /**
+     * #1823: a closed poll's results go to its instance through the delivery outbox, as a system notice keyed by the
+     * poll: durable (held until the instance can take it) and admitted once, however often this is asked. Addressed to
+     * the poll's chat, so the instance's answer (the right option, the scores) goes there.
+     */
+    private admitPollResults;
     /**
      * #1266: who may answer a reply's buttons on a platform — whoever may message that instance there: in a ClassicBot
      * room anyone there (as a typed message), elsewhere someone the sending connection lets speak (#754/#1148), never a
@@ -818,6 +917,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** #1218: the Log tab's on-demand service — made on first use; with `web.log_tab` off it answers off and does nothing. */
     private logService;
     private get log();
+    /** Board 003648ac: a web /compact followed to its end, from the transcript the Log reads (none: nothing to follow). */
+    private compactWatchService;
+    private get compactWatch();
     /** #1218: GET /ui/steps — an instance's steps, read on demand (null: no such instance). */
     logSteps(name: string, q: LogQuery): Promise<LogAnswer | null>;
     /**
@@ -901,7 +1003,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * or a rebound adapter is never posted through a stale route. A copy
      * already in flight may still land late — the contract permits that.
      */
-    sendClassicWebEcho(instance: string, text: string): Promise<number>;
+    /** `sender` (#1827): the web person's name, as the room log records them ("web-user" when none). */
+    sendClassicWebEcho(instance: string, text: string, sender?: string): Promise<number>;
     /**
      * #1666: a delivered web chat message starts the same cancel/progress lifecycle in the instance's topic as a platform
      * inbound (afterUserInboundDelivered): the same bubble, ticker and retire rules. Not its ✅ tracking — the web message
@@ -954,6 +1057,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     isFleetAdmin(userId: string, adapterId?: string): boolean;
     /** Whether this adapter has any fleet admin at all (an empty allowlist means the admin commands are off). */
     hasFleetAdmins(adapterId?: string): boolean;
+    /**
+     * Where this adapter's fleet-admin list is in fleet.yaml, as the operator wrote it, for the "disabled" replies:
+     * `channel.access.allowed_users` (the single-channel form), else the `channels:` entry — by its `id:`, or its
+     * `type:` when it has none. Read from the raw file: loading turns `channel:` into `channels` and fills in ids.
+     */
+    adminListKey(adapterId?: string): string;
     /**
      * The one question the privileged commands (/update, /doctor, /dashboard, /collab) ask: may THIS caller,
      * through THIS adapter, run it. `disabled` is "nobody can" — an empty list — and is told apart from
@@ -1459,6 +1568,22 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private disposeSettingsAdapter;
     /** Restart a channel adapter after fatal error with infinite retry + 60s cap */
     private restartAdapter;
+    /**
+     * #1990: how a reader in world `worldId`'s group reaches a place token's target — undefined (plain text) for another
+     * world's instance, an instance without a fleet topic (a ClassicBot room may be anywhere), or an id no link is built
+     * from. Discord: the channel mention; Telegram: the topic URL (General's topic included).
+     */
+    private placeLink;
+    /** #1990: a message for world `worldId`'s group with its place tokens rendered (links as text or Telegram entities). */
+    renderPlaces(worldId: string | undefined, text: string, opts?: import("./channel/types.js").SendOpts): {
+        text: string;
+        opts?: import("./channel/types.js").SendOpts;
+    };
+    /** #1990: renderPlaces for the world that owns `instanceName`'s topic. */
+    renderPlacesFor(instanceName: string, text: string, opts?: import("./channel/types.js").SendOpts): {
+        text: string;
+        opts?: import("./channel/types.js").SendOpts;
+    };
     /** Handle inbound message — transcribe voice if present, then route */
     private findGeneralInstance;
     /**
@@ -1677,6 +1802,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private refuseTypedIpc;
     private dispatchTypedIpc;
+    /**
+     * #1629: the caller's own web theme over IPC (the agent endpoint calls the same service). `name` is the instance this
+     * IPC connection belongs to — never anything the message says. A refusal is a result the agent reads (its `error`
+     * and what to do), not a transport error.
+     */
+    private handleWebTheme;
     /** `list_emojis` / `set_persona_emoji` / `preview_emojis` / `list_stickers` / `preview_stickers` over IPC; the agent endpoint calls the same methods. */
     private handlePersonaEmoji;
     private handleScheduleCrud;
@@ -1712,6 +1843,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     handleListStickersHttp(instance: string, args: Record<string, unknown>): Promise<unknown>;
     handlePreviewStickersHttp(instance: string, args: Record<string, unknown>): Promise<unknown>;
     handleSetPersonaEmojiHttp(instance: string, args: Record<string, unknown>): Promise<unknown>;
+    /** #1629: `agend-agent theme …` — the same service as the tools; `instance` is the token's. */
+    handleWebThemeHttp(instance: string, tool: string, args: Record<string, unknown>): Promise<unknown>;
     handlePreviewEmojisHttp(instance: string, args: Record<string, unknown>): Promise<unknown>;
     handleSetDescriptionHttp(instance: string, description: string): Promise<unknown>;
     private summarizeToolCall;
@@ -1782,6 +1915,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     saveFleetConfig(explicitPatches?: RawConfigPatch[]): void;
     /** Why the config written to `candidate` must not replace fleet.yaml, or null: it does not load, or it adds errors. */
     private savedFleetConfigProblem;
+    /**
+     * #1874 follow-up: the validator's warnings, once per start, in daemon.log — a setting fleet.yaml has that AgEnD
+     * ignores (e.g. `web.access`) is otherwise silent unless someone runs `agend validate`.
+     */
+    private logConfigWarningsAtStartup;
     /** One-time upgrade migration; invalid YAML is never rewritten. */
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
@@ -1865,9 +2003,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private webImageCaches;
     private webImageCache;
     /**
-     * instance → the connection that is its own bot: configured now (a connection removed from fleet.yaml is nobody's,
-     * whatever an instance still names — #1635 review), not the primary, and answering for it alone.
+     * The bots instances and ClassicBot rooms speak through, by connections configured now (a connection removed from
+     * fleet.yaml is nobody's, whatever an instance still names — #1635 review). `own`: instance → its own bot (answering
+     * for it alone; the primary too, when it serves one instance only). `speaking` (#1867): instance → the bot it speaks through — its own, a shared one,
+     * or, with none configured for it, the primary.
      */
+    private webBots;
+    /** instance → the connection that is its own bot (see webBots). */
     private ownBots;
     /**
      * The bot a connection is now: its running adapter and that bot's own user id. Everything cached for an own bot is
@@ -1883,9 +2025,15 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private webAccent;
     /** The cache key of an own bot's avatar, and its loader (which refuses an answer from a bot no longer there). */
     private botAvatarSource;
-    /** One instance's avatar and ring for the status frame. Synchronous: what is cached now; fetches run behind. */
+    /**
+     * One instance's avatar and ring for the status frame. Synchronous: what is cached now; fetches run behind. The bot
+     * is its own, else the one it speaks through (#1867) — one cache entry per bot, so a shared bot is fetched once.
+     */
     private webIdentityImage;
-    /** GET /ui/img/bot|avatar/<key>: what is cached, never a fetch. Only an own-bot connection, or a known instance's upload. */
+    /**
+     * GET /ui/img/bot|avatar/<key>: what is cached, never a fetch. Only a connection some instance or room speaks
+     * through (#1867), or a known instance's upload.
+     */
     webImage(kind: "bot" | "avatar", key: string): CachedImage | null;
     /**
      * #1682 GET /ui/mentions: names for the mention ids a page found in what it rendered — never a Discord request; in order:
@@ -2247,6 +2395,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
             label: string;
         }>;
         expiresAt: number;
+        links?: import("./topic-link.js").TextLink[];
     }>;
     /**
      * A click on a prompt in the web dashboard (web track C4). It is the platform click, made by the
@@ -2256,10 +2405,26 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * The caller has passed the /ui gate (session, same origin, CSRF). Here: the prompt must be one offered
      * on the dashboard, about the instance the page named, and the action one of its own buttons.
      */
-    /** #1266: a click on a reply's button in the web chat (the /ui gate is passed: a session, or the public link). */
-    clickWebReplyButton(instance: string, id: string, index: number): Promise<{
+    /** #1823: close_poll — `instance` closes one of its own polls before the deadline. */
+    closePollEarly(instance: string, id: string): Promise<{
+        ok: true;
+        voted: number;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    /**
+     * #1266: a click on a reply's button in the web chat (the /ui gate is passed: a session, or the public link). On a
+     * poll (#1823) it is `voter`'s vote: the page's session.
+     */
+    clickWebReplyButton(instance: string, id: string, index: number, voter?: {
+        key: string;
+        userId: string;
+        name: string;
+    }): Promise<{
         status: 200 | 400 | 403 | 409;
         error?: string;
+        options?: number[];
     }>;
     clickWebPrompt(instance: string, nonce: string, action: string): Promise<{
         status: 200 | 400 | 403 | 409;
@@ -2289,6 +2454,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * synchronous; they never probe the pane.
      */
     private clearTargetFence;
+    /** #1806: the web's /backend confirmations — one per question, used once, for the arguments and backend asked about. */
+    private readonly webBackendTokens;
     /** #1269: the web's /clear confirmations — one token per question, used once, for the instance as it was asked about. */
     private readonly webClearTokens;
     /** #1269: an instance's chat command from the web chat (web-commands.ts); `publicLink`: a gateway request. */
@@ -2299,6 +2466,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         confirm?: string;
     }, opts: {
         publicLink: boolean;
+        person?: Pick<WebPersonView, "userId" | "name">;
     }): Promise<WebCommandResult>;
     /** Consume `/clear` Confirm/Cancel exactly once; only Confirm reaches IPC. */
     private handleClearConfirmation;
@@ -2641,9 +2809,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * The absolute path a fresh login shell resolves `binary` to, or null. Only
      * a real executable file counts: `command -v` also answers with an alias
      * definition or a function name, neither of which a spawn could run.
+     * Async (runOnLoginShell): a login file that backgrounds a process holding the shell's output once froze the fleet loop here.
      */
     private locateBinaryOnLoginShell;
-    private locateBinaryOnLoginShellSync;
     /**
      * #1092: the binary in one of the directories its own installer installs to,
      * when no login shell can see it (the installer recorded its PATH in an
@@ -2663,6 +2831,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private restoreWebChat;
     /** #1565: who an instance is, for its web chat file: its working directory, or its ClassicBot room; null if neither. */
     private webChatOwner;
+    /** The only Try-card publisher: no arbitrary SSE sender/role can manufacture this metadata. */
+    private publishEffectTrial;
     /** Push an SSE event to all connected Web UI clients. */
     emitSseEvent(event: string, data: unknown): void;
     listClaimedTasks(assignee: string): Array<{
@@ -2903,6 +3073,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     effortStrategyFor(instanceName: string): "runtime" | "restart" | "unsupported";
     /** Effort levels this instance's backend actually accepts (empty = unsupported). */
     effortLevelsFor(instanceName: string): string[];
+    /** The instance's backend's effort metadata; agy's levels are its model's (#1825), the one the instance runs. */
+    private instanceEffortMetadata;
     /** Configured effort for an instance: per-instance, else fleet default, else none. */
     resolveInstanceEffort(instanceName: string): {
         effort: string | null;
@@ -2936,6 +3108,72 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * a switch saves the round trip of asking. Empty when the backend has none.
      */
     private effortSuffix;
+    /** The steps' view of this fleet (backend-command.ts). `live`: a missing or stale model list may be probed (not on the web). */
+    private backendCommandDeps;
+    /**
+     * `/effort`'s levels for a backend this instance may move to, for the model that will run there (codex's levels are
+     * per model; null: its configured default). Empty: it has no effort setting. A file read, never a CLI.
+     */
+    backendEffortLevels(instanceName: string, backend: string, model?: string | null): string[];
+    /**
+     * #1808: whether a backend takes this model name — the one rule for /backend and update_instance_config's switch.
+     * The name must be one its launch line can carry (modelNameCarried); then its offered list (the cached CLI env), and
+     * claude-code's known names (without this instance's configured model, which belongs to the backend being left).
+     * With no list known, the backend's usual name pattern decides.
+     */
+    backendModelVerdict(instanceName: string, backend: string, model: string, 
+    /** The provider the backend will run on (default: this instance's own, else the fleet's). */
+    opts?: {
+        provider: string | null;
+    }): {
+        ok: true;
+    } | {
+        ok: false;
+        choices: string[];
+    };
+    /**
+     * #1807 review r2: the model codex's next launch of this instance runs. Every launch's writeConfig copies the SHARED
+     * config.toml into the instance's codex home first, so that source decides — not the home's copy from an earlier
+     * launch. Read-only; a model chosen here (`-c model=…`) outranks it; a project file that could change it, unproven.
+     */
+    private prospectiveCodexModel;
+    /** #1811: whether a launch of `backend` here would pass a level: the same gate its builder applies. */
+    private launchEffortGate;
+    /** Installed the way the launch finds a CLI (resolveBinary): on PATH or in a known install directory. */
+    private backendInstalledHere;
+    /** The models `/model` would offer on a backend: the cached CLI env, else (live) a bounded probe. Never throws. */
+    private backendModelOptions;
+    /**
+     * #1806 review: the instance a `/backend` was asked about is still this config entry — not one deleted and created
+     * again under the same name, or replaced by a Settings edit (both put a new object there), stopped or not.
+     */
+    private backendTargetIs;
+    /** `/backend` is for fleet.yaml instances: update_instance_config does not manage a ClassicBot agent. */
+    private backendCommandRefusal;
+    /**
+     * Apply a confirmed `/backend`: judged again first (a menu lives a minute — the backend may have moved, a CLI been
+     * removed), then update_instance_config's write: backend, model and effort at once, refused and rolled back whole
+     * (its credential-profile login gate included), then one fresh relaunch of a running instance.
+     */
+    applyBackendSwitch(instanceName: string, args: readonly string[], from: string, stillCurrent: () => boolean): Promise<string>;
+    /** A step's buttons: index callbacks (a model id can be longer than Telegram's 64-byte callback data allows). */
+    private backendStepButtons;
+    /**
+     * Show a `/backend` step (a choice, or the confirmation) where the command was given: Discord edits its interaction
+     * reply; Telegram retires the previous step's keyboard and posts the next. One pending entry per step, under a fresh
+     * nonce: a click on an older step finds nothing.
+     */
+    private presentBackendStep;
+    /** Close a `/backend` menu with a last word: its buttons go (Telegram edits them away), the text stays. Returns where it was said. */
+    private endBackendMenu;
+    /** Start `/backend` for a fleet instance from Discord or Telegram; the caller has checked the channel admin. */
+    private beginBackendCommand;
+    /** `/backend` slash handler: channel admin, as `/model`. Options or typed text give the direct form. */
+    private handleBackendSlash;
+    /** Telegram `/backend` in a fleet topic (topic-commands) or a ClassicBot chat; the caller has checked the admin. */
+    runBackendCommand(instanceName: string, text: string, userId: string, channelId: string, adapter: ChannelAdapter, chatId: string, threadId?: string, adapterId?: string): Promise<void>;
+    /** Consume a `/backend` click: the next step, or on the confirmation the switch itself. True for every backend-select id. */
+    private handleBackendSelection;
     /** Read recent chat log for agent context */
     private getRecentChatLog;
     /**