@songsid/agend 2.3.0-beta.12 → 2.3.0-beta.14

package/dist/fleet-manager.js

@@ -38,6 +38,7 @@ import { readFleetMemory } from "./process-memory.js";
 import { MemoryPressure } from "./memory-pressure.js";
 import { replyDedupText, ReplyDeduper } from "./reply-dedup.js";
 import { isMap, isScalar, parseDocument } from "yaml";
+import { changedOutside, detachForWrite } from "./yaml-shared-nodes.js";
 import { kiroLogGate } from "./kiro-log-gate.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -73,7 +74,7 @@ import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { escapeTelegramHtml, scheduleClock, scheduleRetryLabel } from "./scheduler/retry-label.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, parseCompactCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext, readStatuslineModel } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, parseCompactCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext, readStatuslineJson, statuslineModel } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -227,7 +228,7 @@ import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } f
 import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
 import { isWebPageNavigation } from "./web-shell-routes.js";
 import { guestSessionPolicy, localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
-import { authorityNow, evaluateWebAuthority, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
+import { authorityNow, classifyWebPeer, evaluateWebAuthority, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
 import { AuthorityStateStore } from "./authority/authority-state.js";
 import { SessionAuthorizations } from "./authority/session-authorizations.js";
 import { SessionAuthorizationRequests } from "./web-session-authorization.js";
@@ -250,7 +251,7 @@ import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome,
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
-import { cleanupWatchVerdict, formatRestartProgressCompletion, RESTART_PROGRESS_TERMINAL_TIMEOUT_MS, RestartProgress, } from "./restart-progress.js";
+import { cleanupWatchVerdict, formatRestartProgressCompletion, RestartProgress, } from "./restart-progress.js";
 import { launchFullRestartHelper } from "./full-restart.js";
 import { SYSTEMD_RESTART_INDETERMINATE_EXIT_CODE } from "./service-restart-selection.js";
 import { collectRedundantInstanceDefaultPaths } from "./fleet-yaml-slim.js";
@@ -589,6 +590,8 @@ export class FleetManager {
     fleetConfig = null;
     rawFleetConfig = {};
     rawFleetDocument = null;
+    /** #2208: the paths a saveFleetConfig() wrote, for its check that nothing else changed. */
+    fleetDocumentWrites = null;
     savedFleetConfigSnapshot = null;
     adapter = null;
     worlds = new Map();
@@ -1284,6 +1287,7 @@ export class FleetManager {
                     current: () => current() && sessions === this.webSessions && !!this.webToken
                         && sessions.isCurrent(record, tokenEpoch(this.webToken)) && (!exposure || exposure.isCurrent()) };
             }, baseline: () => baselines.read(), snapshot: () => baselines.snapshot(),
+            selfConfirm: (req, id) => this.settingsSelfConfirmation(store, req, id),
             job: async (id) => {
                 const settlement = this.settingsJobSettlements.get(id);
                 if (!settlement)
@@ -1298,6 +1302,86 @@ export class FleetManager {
         this.settingsConfirmation = gate;
         return gate;
     }
+    /**
+     * #2170: a held change confirmed by the request itself — only when ALL hold, else the chat card or the host CLI, as
+     * before:
+     *   - the session is web-verified (#1939: its account confirmed this browser on Discord or Telegram), asked now;
+     *   - the change's effect owners are known and on one platform (settingsChatAuthority — the chat card's own rule), the
+     *     verified account is on that platform and an admin of every one of them;
+     *   - a chat card could have been asked: a connected General on that platform the change does not affect (else the
+     *     change goes to the host CLI, as before) — the General that then hears of it;
+     *   - and, at execution (store.decide asks `current()` again): still web-verified under the same session and account
+     *     (not expired, revoked, signed out or the switch turned off), still those owners' admin, still a General a card
+     *     could go to, the fleet unchanged.
+     * What it rests on: the account's one confirmation of this browser (#1939), kept for the session until it is revoked,
+     * expires or signs out — not a fresh confirmation per Apply. Whoever uses that verified session (a browser left signed
+     * in, its cookie) confirms the same way. A public link never qualifies (evaluateWebAuthority refuses it). General
+     * still hears it: a notice, not a step.
+     */
+    settingsSelfConfirmation(store, req, id) {
+        const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
+        if (auth.kind !== "ok")
+            return null;
+        const record = auth.session, gateway = !!gatewayRequestContext(req), peer = classifyWebPeer(req);
+        const verified = () => {
+            const now = this.webAuthority({ session: record, gateway, peer });
+            // A refusal carries no authority (kind "none"); the handle pins the session, and with it its one account.
+            return now.authority.kind === "web-verified" && now.authority.actor && now.authority.session?.handle === record.handle ? now.authority.actor : null;
+        };
+        const actor = verified();
+        if (!actor)
+            return null;
+        const chat = this.settingsChatAuthority(store, id);
+        if (!chat)
+            return null;
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const own = channels.filter(ch => (ch.id ?? ch.type) === actor.adapter_id);
+        if (own.length !== 1 || own[0].type !== chat.platform || !chat.admin(actor.user_id))
+            return null;
+        const affected = [...store.affectedConnections(id)]; // read now: a finished change no longer has them
+        if (!this.settingsNoticeGenerals(affected, chat.platform).length)
+            return null;
+        const name = this.webPerson({ adapterId: actor.adapter_id, userId: actor.user_id }).name;
+        return {
+            label: `${name} (web-verified)`,
+            // admin() asks chat.current() too; a General a card could go to must still be there (else the host CLI's).
+            current: () => !!verified() && chat.admin(actor.user_id) && this.settingsNoticeGenerals(affected, chat.platform).length > 0,
+            done: view => this.settingsWebConfirmedNotice(view, affected, name, chat.platform),
+        };
+    }
+    /** #2170: the Generals a chat card could be posted in (promptSettingsChange's rule): connected, on the platform, unaffected. */
+    settingsNoticeGenerals(affected, platform) {
+        const excluded = new Set(affected), found = [];
+        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            if (!config.general_topic || !this.daemons.get(name))
+                continue;
+            const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
+            if (!adapterId || !adapter || excluded.has(adapterId) || adapter.type !== platform || this.adapterState.get(adapterId)?.status !== "connected")
+                continue;
+            const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
+            if (chatId && topic)
+                found.push({ adapterId, adapter, chatId, topic });
+        }
+        return found;
+    }
+    /**
+     * #2170: General's notice of a change confirmed from the web — the first General a chat card could have been posted
+     * in, plain text, no mentions. Information only: nothing waits on it.
+     */
+    async settingsWebConfirmedNotice(view, affected, who, platform) {
+        const outcome = view.outcome ? view.outcome.message : view.state;
+        const text = `✅ Settings change confirmed from the web by ${who} (web-verified)\nSource: ${view.source}\nRequester: ${view.requested_by}\n${view.summary.join("\n")}\nOutcome: ${outcome}`;
+        for (const { adapterId, adapter, chatId, topic } of this.settingsNoticeGenerals(affected, platform)) {
+            try {
+                await adapter.sendText(chatId, text, { threadId: topic, allowedMentions: { parse: [] } });
+                return;
+            }
+            catch {
+                this.logger.info({ id: view.id, adapterId }, "Settings web-confirmation notice unavailable; trying another General");
+            }
+        }
+        this.logger.info({ id: view.id }, "Settings change confirmed from the web: no General reachable for the notice");
+    }
     /** Exact configured effect owners; this does not depend on prompt location. */
     settingsChatAuthority(store, id) {
         const scope = store.authorityOf(id);
@@ -5298,34 +5382,18 @@ export class FleetManager {
         return this.adapterState.get(adapterId)?.status === "connected" ? adapter : undefined;
     }
     /** Last-resort completion after RestartProgress could not deliver to its
-     * adopted target. It stays bounded and never wakes a not-ready gateway. */
+     * adopted target (or had no message: a small fleet, a failed first post). It
+     * never wakes a not-ready gateway. #2213: an outage at fleet start no longer
+     * loses it — bounded at startup, then retried in the background once the
+     * adapter is ready again, never posted twice after an uncertain attempt. */
     async sendFleetStartCompletionFallback(chatId, text, threadId) {
         const adapterId = this.getPrimaryAdapterId();
-        const adapter = adapterId ? this.readyProgressAdapter(adapterId) : undefined;
-        if (!adapter) {
-            this.logger.error({ adapterId }, "Fleet start completion fallback skipped because the primary adapter is not ready");
+        if (!adapterId) {
+            this.logger.error({ adapterId }, "Fleet start completion fallback skipped because there is no primary adapter");
             return false;
         }
-        let timer;
-        const timeout = new Promise(resolve => {
-            timer = setTimeout(() => resolve({ status: "timeout" }), RESTART_PROGRESS_TERMINAL_TIMEOUT_MS);
-            timer.unref?.();
-        });
-        const delivery = Promise.resolve()
-            .then(() => adapter.sendText(chatId, text, { threadId }))
-            .then(() => ({ status: "sent" }), err => ({ status: "failed", err }));
-        const result = await Promise.race([delivery, timeout]);
-        if (timer)
-            clearTimeout(timer);
-        if (result.status === "sent")
-            return true;
-        if (result.status === "failed") {
-            this.logger.error({ err: result.err }, "Failed to send fleet start completion fallback");
-        }
-        else {
-            this.logger.error({ timeout_ms: RESTART_PROGRESS_TERMINAL_TIMEOUT_MS }, "Timed out sending fleet start completion fallback");
-        }
-        return false;
+        const poster = new RestartProgress(0, Date.now(), this.logger);
+        return poster.postCompletion({ resolveAdapter: () => this.readyProgressAdapter(adapterId), chatId, threadId }, text);
     }
     async stopInstance(name, transition) {
         this.explicitStopGeneration.set(name, (this.explicitStopGeneration.get(name) ?? 0) + 1);
@@ -11081,6 +11149,10 @@ export class FleetManager {
             throw new Error(`Refusing to overwrite invalid fleet.yaml: ${this.rawFleetDocument.errors[0].message}`);
         }
         this.rawFleetConfig = loadRawFleetConfig(this.configPath);
+        // #2208: what the file says before this save, aliases expanded — every write below is recorded, and anything that
+        // changes outside them (a place sharing a node with one written) refuses the save.
+        const fileBefore = this.rawFleetDocument.toJS({ maxAliasCount: -1 });
+        const writes = this.fleetDocumentWrites = []; // a throw below leaves it to the next save
         this.patchFleetDocument(this.rawFleetDocument, [], this.savedFleetConfigSnapshot, this.fleetConfig);
         // Settings edits are expressed against the raw config, so apply them before
         // canonicalization. A non-identity value equal to its inherited default is
@@ -11091,6 +11163,7 @@ export class FleetManager {
                 // (or a legacy scalar occupies that parent). Removing an override which
                 // is already absent is an idempotent no-op, not a failed Settings save.
                 if (this.rawFleetDocument.hasIn(patch.path)) {
+                    this.writingFleetDocument(this.rawFleetDocument, patch.path);
                     this.rawFleetDocument.deleteIn(patch.path);
                 }
             }
@@ -11102,8 +11175,10 @@ export class FleetManager {
         const rawAfterPatches = this.rawFleetDocument.toJS();
         const redundantPaths = collectRedundantInstanceDefaultPaths(rawAfterPatches);
         for (const path of redundantPaths) {
-            if (this.rawFleetDocument.hasIn(path))
+            if (this.rawFleetDocument.hasIn(path)) {
+                this.writingFleetDocument(this.rawFleetDocument, path);
                 this.rawFleetDocument.deleteIn(path);
+            }
             // Avoid leaving empty operational maps such as `terminal: {}` while
             // preserving the instance mapping itself and all surrounding comments.
             for (let depth = path.length - 1; depth > 2; depth--) {
@@ -11111,9 +11186,14 @@ export class FleetManager {
                 const parent = this.rawFleetDocument.getIn(parentPath, true);
                 if (!isMap(parent) || parent.items.length > 0)
                     break;
+                this.writingFleetDocument(this.rawFleetDocument, parentPath);
                 this.rawFleetDocument.deleteIn(parentPath);
             }
         }
+        this.fleetDocumentWrites = null;
+        const stray = changedOutside(fileBefore, this.rawFleetDocument.toJS({ maxAliasCount: -1 }), writes);
+        if (stray)
+            throw new Error(`Refusing to save fleet.yaml: this change would also change ${stray}, which shares a value with what it edits. Give each its own value in fleet.yaml.`);
         noteSettingsWrite(this.configPath, this.savedFleetConfigSnapshot, this.fleetConfig);
         const output = String(this.rawFleetDocument);
         if (redundantPaths.length > 0)
@@ -11224,11 +11304,15 @@ export class FleetManager {
             // Remove from the end so YAML sequence indexes do not shift underneath us.
             for (let i = before.length - 1; i >= after.length; i--) {
                 const itemPath = [...path, i];
-                if (document.hasIn(itemPath))
+                if (document.hasIn(itemPath)) {
+                    this.writingFleetDocument(document, itemPath);
                     document.deleteIn(itemPath);
+                }
             }
-            for (let i = shared; i < after.length; i++)
+            for (let i = shared; i < after.length; i++) {
+                this.writingFleetDocument(document, [...path, i]);
                 document.setIn([...path, i], after[i]);
+            }
             return;
         }
         const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -11244,6 +11328,7 @@ export class FleetManager {
                 if (isMap(fresh)) {
                     const list = document.createNode([]);
                     list.items.push(fresh.clone());
+                    this.writingFleetDocument(document, ["channels"]);
                     document.setIn(["channels"], list);
                 }
             }
@@ -11265,13 +11350,17 @@ export class FleetManager {
             // Effective config contains inherited objects that may not exist in the
             // raw YAML at all. yaml.deleteIn() is not idempotent for a missing nested
             // parent, so guard it explicitly.
-            if (document.hasIn(path))
+            if (document.hasIn(path)) {
+                this.writingFleetDocument(document, path);
                 document.deleteIn(path);
+            }
         }
         else if (path.length === 0) {
+            this.writingFleetDocument(document, path);
             document.contents = document.createNode(after);
         }
         else {
+            this.writingFleetDocument(document, path);
             const currentNode = document.getIn(path, true);
             if (isScalar(currentNode) && (after === null || typeof after !== "object")) {
                 currentNode.value = after;
@@ -11286,6 +11375,15 @@ export class FleetManager {
             }
         }
     }
+    /**
+     * #2208: before every write to the raw document — the place is unshared first (an alias on the way becomes its own
+     * copy; an anchor's other aliases get theirs), so the write changes that place only; and it is recorded for the
+     * save's check that nothing else changed.
+     */
+    writingFleetDocument(document, path) {
+        detachForWrite(document, path);
+        this.fleetDocumentWrites?.push([...path]);
+    }
     getSettingsConfigPath() { return this.configPath; }
     async removeInstance(name, authorization, execution) {
         if (execution)
@@ -21732,15 +21830,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.debug({ err }, "bots unreadable (getUiStatus)");
         }
         const instances = names.map(name => {
-            const statusFile = join(this.getInstanceDir(name), "statusline.json");
-            let cost = 0;
-            try {
-                const data = JSON.parse(readFileSync(statusFile, "utf-8"));
-                cost = data.cost?.total_cost_usd ?? 0;
-            }
-            catch (err) {
-                this.logger.debug({ err, name }, "statusline.json read failed (getUiStatus)");
-            }
+            // #1956: read once for this instance; its cost, context and model come from it.
+            const statusline = readStatuslineJson(this.dataDir, name);
+            const cost = statusline?.cost?.total_cost_usd ?? 0;
             // Align with /ctx: statusline for claude-code, pane scrape for kiro/grok/codex.
             const classic = classicOnly.includes(name);
             const backend = classic
@@ -21748,14 +21840,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 : (this.fleetConfig?.instances[name]?.backend
                     ?? this.fleetConfig?.defaults?.backend
                     ?? "claude-code");
-            const { context } = resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name) });
+            const { context } = resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name), statusline });
             // context_pct: null when unavailable, not 0
             const context_pct = context ?? null;
             // Model: Only Claude Code has live statusline; others use the effective resolver.
-            // readStatuslineModel provides the /ctx-aligned display_name+id combo for Claude.
+            // statuslineModel gives the /ctx-aligned display_name+id combo for Claude (readStatuslineModel's rule).
             // Non-Claude backends must NOT read statusline.json model (may be stale from previous Claude run).
             const resolved = this.resolveInstanceModel(name);
-            const liveModel = backend === "claude-code" ? readStatuslineModel(this.dataDir, name) : null;
+            const liveModel = backend === "claude-code" ? statuslineModel(statusline) : null;
             // Display value: live model for Claude, resolved.display for others (includes "auto (default)" for Kiro)
             const model = liveModel ?? resolved.display;
             // model_source: "live" when Claude statusline succeeded, else the resolver's source