@songsid/agend 2.3.0-beta.9 → 2.3.1

package/dist/fleet-manager.d.ts

@@ -1,5 +1,6 @@
 import { type HumanOrigin } from "./human-delivery-receipts.js";
 import { SettingsExecution } from "./settings-transaction.js";
+import { AppIconStore } from "./web-app-icon.js";
 import type { LoginCodeOwner } from "./web-login.js";
 import { type ProfileTicket } from "./runtime-cpu-profile.js";
 import type { CpuProfile } from "./cpu-profile.js";
@@ -38,6 +39,7 @@ export declare const TASK_LIST_CAP = 100;
  * #1336: the non-terminal statuses a bare `list` returns by default. `done`
  * and `cancelled` are excluded unless the caller passes `filter_status`.
  */
+/** Not finished: `review` is done work waiting for the person (the task board), still live. */
 export declare const LIVE_TASK_STATUSES: string[];
 /**
  * #1336 P2: shared normalization for filter_status across both task handlers
@@ -55,11 +57,13 @@ export declare function applyTaskListCap<T extends {
 } | T[];
 import { type PublicPreviewForUi } from "./web-api.js";
 import { type LogAnswer, type LogQuery } from "./log-service.js";
-import { WebChatHistory } from "./web-chat-history.js";
+import { WebChatHistory, type WebChatPost } from "./web-chat-history.js";
+import { type WebEchoCopy } from "./web-reactions.js";
 import { SeenUsers, type MentionNames, type MentionQuery } from "./web-mentions.js";
 import { WebPrefsStore } from "./web-prefs.js";
 import { OwnerCssStore } from "./web-owner-css-store.js";
 import { ThemeStore } from "./web-theme-store.js";
+import { OfficeStore, OfficeWriteLimiter } from "./web-office-store.js";
 import { WebAppearance } from "./web-appearance.js";
 import { WebEffectLibrary } from "./web-effect-library.js";
 import { WebEffectTrials } from "./web-effect-trials.js";
@@ -74,12 +78,16 @@ import { AppearanceTools } from "./web-appearance-tools.js";
 import { ModStore } from "./web-mod-store.js";
 import { AgentMods } from "./web-mod-agent.js";
 import { type CachedImage } from "./web-images.js";
+import { SearchIndex } from "./search/search-index.js";
+import { type CrossInstanceRecord, type XmsgVisibility } from "./search/search-docs.js";
 import { WebSettingsTools } from "./web-settings-tools.js";
 import { type Delegation, type TrafficItem } from "./fleet-traffic.js";
+import { WebBackendLogins, type SignInTarget } from "./web-backend-login.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
 import { type ExplicitInstanceRemoval } from "./instance-removal.js";
+import { type SessionOomRetry } from "./session-oom-stop.js";
 import type { InstanceState, InteractionSnapshot } from "./backend/types.js";
 import { type Daemon } from "./daemon.js";
 import { WakeCoordinator } from "./wake-coordinator.js";
@@ -121,17 +129,19 @@ export declare function selectLruEvictions(warm: string[], cap: number, opts: {
     lastInboundAt: (name: string) => number;
 }): string[];
 /**
- * Window-name shape this fleet recognises as an instance window: the
- * `-t<digits>` form every allocator emits, plus legacy `classic-` windows.
- * Startup cleanup reaps windows matching this that are no longer in
- * fleet.yaml. Keep in sync with `uniqueInstanceName` — every name it emits
- * must match here, or a deleted instance's CLI is left running (#1305 P2-3).
+ * #2163: whether `dir` is inside AgEnD's own workspaces (<AGEND_HOME>/workspaces/<name>/…), compared after resolving
+ * symlinks on both sides — including a missing folder's existing ancestors — so a link elsewhere is not inside, nor is a broken link.
  */
+export declare function insideManagedWorkspaces(dir: string, agendHome?: string): boolean;
 export declare function isOrphanInstanceWindowName(name: string): boolean;
 /** restartSingleInstance's options. `carry` (#1753): a credential-profile switch; its outcome is written into `result`. */
 export interface RestartOpts {
     freshStart?: boolean;
     explicit?: boolean;
+    /** Internal receipt captured when an OOM action was offered. */
+    sessionOomRetry?: SessionOomRetry;
+    /** Internal pre-invalidation owner fence for an unclear-OOM action. */
+    recoveryCurrent?: () => boolean;
     carry?: {
         backend: string;
         from: string | null;
@@ -176,6 +186,12 @@ export interface DeliveryOptions {
      * IPC hand-off itself. False drops the delivery unsent (a schedule retry past its deadline).
      */
     stillCurrent?: () => boolean;
+    /**
+     * #2484: a person's message to an instance that is in its own start-retry backoff (a retry scheduled or running, not
+     * stopped or paused by a person) waits for that retry instead of failing after the IPC grace. Called once when the
+     * wait starts, so the message can show it is queued; the delivery fails only once the retries give up.
+     */
+    onStartRetryHold?: () => void;
 }
 export declare const LOGIN_CALLBACK_PREFIX = "login:";
 /**
@@ -247,6 +263,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     fleetConfig: FleetConfig | null;
     private rawFleetConfig;
     private rawFleetDocument;
+    /** #2208: the paths a saveFleetConfig() wrote, for its check that nothing else changed. */
+    private fleetDocumentWrites;
     private savedFleetConfigSnapshot;
     adapter: ChannelAdapter | null;
     readonly worlds: Map<string, AdapterWorld>;
@@ -284,14 +302,19 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private static readonly TOPIC_PROBE_ADAPTER_SCOPED_REASONS;
     logger: Logger;
     /** Report each bundled skill collision once per fleet, across instance starts. */
-    private skippedBundledSkills;
+    /** #2482: per skills directory, the skipped set (names + their content) last said — this process's view of the record. */
+    private skippedSkillsSaid;
     private topicCommands;
     sessionRegistry: Map<string, string>;
     eventLog: EventLog | null;
     costGuard: CostGuard | null;
     private statuslineWatcher;
     private dailySummary;
+    /** #2246 step 3: the task board's daily summary for the person (task-board-summary.ts). */
+    private taskBoardSummary;
     private dailyTipScheduler;
+    /** The task board's wakes (step 2): an instance hears when someone else changes a card it owns or handed out. */
+    private taskBoardWaker;
     private webhookEmitter;
     private topicIcons;
     private lastActivity;
@@ -354,6 +377,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * backend outage during a post-update herd). instanceName → pending retry.
      */
     private startupRetries;
+    /** #2484: instances whose automatic startup retry is running now (between its timer and its outcome). */
+    private startupRetriesRunning;
     /** Bumped by every explicit stop (incl. the stop half of a restart); fences the outage hand-off. */
     private explicitStopGeneration;
     /** instanceName → outage hand-off currently executing; a repeat joins it. */
@@ -410,7 +435,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** At most one reconnect/backoff loop may exist per instance. */
     private ipcReconnectInFlight;
     private adapterRestarting;
+    /** #2175: this boot's progress message, whose completion may still be owed by its background retry. */
+    private startupProgress;
+    private startupDashboard;
     private adapterState;
+    private adapterRetryInFlight;
     /** Web Settings secret rotation is deliberately separate from reconnect
      * recovery: a rotation must build a fresh provider client with the new token,
      * and stale callbacks from the old client must not win. */
@@ -451,6 +480,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private readonly effectBootstrap;
     /** Fixed trusted document coherence, independent of the HTML preview listener; never a resource grant. */
     get effectBoot(): string;
+    canvasWorkerEnabled(): boolean;
     private healthServerDrain;
     /** #1306: the preview listener (health_port + 1 by default), and whether it is listening. */
     private previewListener;
@@ -488,6 +518,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Days of event/activity history to keep. */
     private static readonly EVENT_LOG_RETENTION_DAYS;
     private watchdogTimer;
+    private startupMemoryDeadline;
     private eventLoopWatch;
     private startedAt;
     private stormOpenNotifyTimer;
@@ -514,10 +545,28 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     readonly webChatHistory: WebChatHistory;
     /** #1565: the web chat history's files (set at fleet start, once the home and the instances are known). */
     private webChatStore;
+    /** #2293: the dashboard's global search (null: web.search.enabled is false, or the fleet has not started). */
+    searchIndex: SearchIndex | null;
     /** Uploaded files and the files the dashboard may fetch back (uploads, reply attachments). */
     readonly webFiles: WebFileLedger;
     /** #1770: per instance, its last web reply still copying its files — the next one is shown after it, in order. */
     private readonly webReplyOrder;
+    /**
+     * #1774: an instance name's reply generation — moved on when a removal of it starts, so replies sent from then on (a
+     * same-name replacement's) are told from the removed instance's. `webChatRemovals`: once a removal succeeded, the
+     * generations and the daemon whose replies are no longer anyone's to show.
+     */
+    private readonly webChatGenerations;
+    private readonly webChatRemovals;
+    /** #1774: a removal under way — its replies' fate waits for its outcome (success: theirs no more; failure: theirs). */
+    private readonly webChatRemovalsPending;
+    private webChatGeneration;
+    /** #1774: who an instance's reply is from, taken when it is sent: the name's generation and its daemon then. */
+    private webChatIdentity;
+    /** #1774: the reply's instance was not removed (a removal that failed changes nothing). */
+    private webChatIdentityCurrent;
+    /** #1774: the removal still deciding this reply's fate (it was sent by what is being removed), or null. */
+    private webChatRemovalPending;
     /** #1770: an instance's web-files byte cap (a field, so a test can make it small). */
     private webReplyMaxBytes;
     /** #1682: the people seen on inbound messages (id → name), for the web chat's mention pills; bounded, in memory. */
@@ -556,6 +605,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private webAppearanceService?;
     /** #1629: every instance's theme, placements, assets and lock (web-themes.json). */
     get themeStore(): ThemeStore;
+    private officeStoreInstance?;
+    /** Fleet → Org chart → Office: the offices people made (web-offices.json, beside web-themes.json). */
+    get officeStore(): OfficeStore;
+    /** How often a person may save the offices (PUT /ui/offices); memory only, as the appearance limiter. */
+    readonly officeWrites: OfficeWriteLimiter;
     /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
     get webAppearance(): WebAppearance;
     private effectLibraryInstance?;
@@ -600,6 +654,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         tagline?: string;
         bio?: string;
     };
+    private appIconStore?;
+    /** #2308: the person's own app icon (Settings → Web appearance), under the state dir; none set: the bundled one. */
+    get appIcon(): AppIconStore;
     private ownerCssStore?;
     /** #1629 r4 §3: each person's own CSS; which version is in force is their `css.active` in the web preferences. */
     get ownerCss(): OwnerCssStore;
@@ -623,6 +680,30 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private classicSettingsOwners;
     private queueSettingsOperation;
     private settingsGate;
+    /**
+     * #2170: a held change confirmed by the request itself — only when ALL hold, else the chat card or the host CLI, as
+     * before:
+     *   - the session is web-verified (#1939: its account confirmed this browser on Discord or Telegram), asked now;
+     *   - the change's effect owners are known and on one platform (settingsChatAuthority — the chat card's own rule), the
+     *     verified account is on that platform and an admin of every one of them;
+     *   - a chat card could have been asked: a connected General on that platform the change does not affect (else the
+     *     change goes to the host CLI, as before) — the General that then hears of it;
+     *   - and, at execution (store.decide asks `current()` again): still web-verified under the same session and account
+     *     (not expired, revoked, signed out or the switch turned off), still those owners' admin, still a General a card
+     *     could go to, the fleet unchanged.
+     * What it rests on: the account's one confirmation of this browser (#1939), kept for the session until it is revoked,
+     * expires or signs out — not a fresh confirmation per Apply. Whoever uses that verified session (a browser left signed
+     * in, its cookie) confirms the same way. A public link never qualifies (evaluateWebAuthority refuses it). General
+     * still hears it: a notice, not a step.
+     */
+    private settingsSelfConfirmation;
+    /** #2170: the Generals a chat card could be posted in (promptSettingsChange's rule): connected, on the platform, unaffected. */
+    private settingsNoticeGenerals;
+    /**
+     * #2170: General's notice of a change confirmed from the web — the first General a chat card could have been posted
+     * in, plain text, no mentions. Information only: nothing waits on it.
+     */
+    private settingsWebConfirmedNotice;
     /** Exact configured effect owners; this does not depend on prompt location. */
     private settingsChatAuthority;
     private promptSettingsChange;
@@ -741,12 +822,20 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         kind: string;
     };
     queryDurableDeliveryStatus(callerInstance: string, selector: DeliveryStatusSelector): DeliveryStatusPage;
+    /** A terminal OOM stop is not an auto-wakeable pause, including after a fleet restart. */
+    private sessionOomStopped;
+    private sessionOomStopReason;
     /** #1641: why a target is not taking queued work right now, or null when nothing known holds it. */
     private deliveryWaitingReason;
     getDaemonBootId(instanceName: string): string | undefined;
     markDurableResponseDelivered(sourceInstance: string, operationId: string): void;
     /** Called after a replacement Daemon object is installed in lifecycle.daemons. */
     onDaemonReady(name: string, daemonBootId: string): void;
+    private workingStateListeners?;
+    private workingStateErrors?;
+    /** Attach only to the published owner. Nothing here sends or resumes work. */
+    private listenForWorkingState;
+    private observeWorkingState;
     /**
      * #926: the two reply-obligation safety nets. Idle owners with an unanswered
      * request get one reminder (after the grace); requesters get one overdue
@@ -1052,6 +1141,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * Ordering is preserved by serialising behind any waiter already queued for this
      * instance, *including* when the socket happens to be up: otherwise a message
      * arriving after the reconnect could overtake one that has been waiting for it.
+     *
+     * `onStartRetryHold` (#2484, a person's message): an instance in its own start-retry backoff is waited for until that
+     * retry brings it up, however long the backoff, and fails only once the retries give up.
      */
     private sendWhenConnected;
     /** Poll for the instance's IPC to come back, then send. Throws if it does not. */
@@ -1085,8 +1177,35 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * #1920 §5.2: a web message's channel copy was sent — it is now what the channel saw. Kept so (and on disk), and sent
      * to the guests' streams only: an admin's page already has it, and nothing about it changed for them.
      */
-    webMessageInChannel(instance: string, messageId: string): void;
-    sendClassicWebEcho(instance: string, text: string, sender?: string): Promise<number>;
+    webMessageInChannel(instance: string, messageId: string, copies?: readonly WebEchoCopy[]): void;
+    /** #2305: a web message's channel copies (topic, ClassicBot rooms), newest WEB_ECHO_COPIES_MAX, this process only. */
+    private webEchoCopies;
+    private rememberWebEchoCopies;
+    /**
+     * #2305: an instance's reaction to a web chat message (`messageId`, the id it was handed): its minimal reply, as on
+     * the platforms. Kept on the message's row (and on disk), shown live (`reactions` on the stream), and put on the
+     * message's channel copies when this process sent them — in the background, each within WEB_MIRROR_TIMEOUT_MS, so a
+     * slow or rate-limited platform never holds the tool's answer (best effort: a copy's failure or timeout is logged,
+     * never the tool's). `mirrored`: how many copies took it, when that is known.
+     * The tool's errors: an emoji outside the web set or one of the instance's delivery marks (web-reactions.ts), or a
+     * message the chat does not have. An emoji the message already has is a success that changes nothing.
+     */
+    reactToWebMessage(instance: string, messageId: string, raw: unknown): Promise<{
+        ok: true;
+        mirrored: Promise<number>;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    /** #2305: `copies` collects each room's copy (its message id), for a reaction to the web message. */
+    /**
+     * `reply` (#2281): where the message a web reply quotes is on a platform. A room that has it gets the reply as a
+     * native reply to it (`reply.text`: without the quoted line); every other room gets `text`, as before.
+     */
+    sendClassicWebEcho(instance: string, text: string, sender?: string, copies?: WebEchoCopy[], reply?: {
+        posts: readonly WebChatPost[];
+        text: string;
+    }): Promise<number>;
     /**
      * #1666: a delivered web chat message starts the same cancel/progress lifecycle in the instance's topic as a platform
      * inbound (afterUserInboundDelivered): the same bubble, ticker and retire rules. Not its ✅ tracking — the web message
@@ -1118,6 +1237,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Bind at the actual IPC send, after all wake/reconnect waits. No human retry lane. */
     private bindHumanReceiptPayload;
     deliverHumanToInstance(instanceName: string, payload: Record<string, unknown>, origin: HumanOrigin | undefined, originalBody: string, options?: DeliveryOptions): Promise<boolean | void>;
+    /**
+     * #2484: a person's message waits for its instance's own start retry (DeliveryOptions.onStartRetryHold), shown as
+     * queued on the message meanwhile. A ClassicBot room message (no `msg`) has no delivery-status reactions: it only waits.
+     */
+    private startRetryHoldFor;
     /** Synchronous steer/btw handoff, using the same evidence and owner binding. */
     sendHumanControl(instanceName: string, payload: Record<string, unknown>, origin: HumanOrigin | undefined, originalBody: string): boolean;
     /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
@@ -1209,7 +1333,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * is exactly the old lifecycle wake; otherwise it goes through the shared
      * slot admission and joins any wake already in flight for the target.
      */
-    explicitWake(name: string, timeoutMs?: number): Promise<void>;
+    explicitWake(name: string, timeoutMs?: number, retryStoppedSession?: boolean): Promise<void>;
     /** The least-recently-active idle, unleased, non-general running instance other than `exclude`. */
     private lruUnleasedIdle;
     changeInstancePauseState(name: string, action: "pause" | "wake"): Promise<"paused" | "awake" | "not_idle">;
@@ -1233,12 +1357,15 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     resumePaused?: boolean, 
     /** Phase 2a: the caller's transition, for a start made from inside a restart or wake. */
     transition?: TransitionHandle, execution?: SettingsExecution): Promise<void>;
+    /** A boot's observation cannot settle a replacement boot or a newer attempt of the same instance. */
+    private trackStartupInstance;
+    private publishStartupStatus;
     /** Recreate a daemon for a marker-only paused instance after an explicit wake/delivery. */
     startPersistedPausedInstance(name: string, transition?: TransitionHandle): Promise<void>;
     /**
      * Start instances with configurable concurrency and stagger delay.
-     * Instances sharing the same working_directory are serialized within a group
-     * to avoid config file races. Stagger delay is group-to-group, not instance-to-instance.
+     * Instances sharing the same working_directory are serialized to avoid
+     * config file races. Stagger applies between outer lifecycle admissions.
      * TODO: per-instance startup timeout (existing issue, not introduced here)
      */
     private startInstancesWithConcurrency;
@@ -1262,6 +1389,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     scheduleStartupRetry(name: string, attempt: number): void;
     /** Drop a pending automatic retry (an operator start/stop/restart supersedes it). */
     cancelStartupRetry(name: string): void;
+    /** #2484: the instance's own start retry is scheduled or running, and no person paused it (a stop cancels the retry). */
+    private inStartRetryBackoff;
     /** Pending automatic retry, if any (status display / tests). */
     pendingStartupRetry(name: string): {
         attempt: number;
@@ -1357,7 +1486,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * snapshot use the fleet startup/retry state. */
     private readyProgressAdapter;
     /** Last-resort completion after RestartProgress could not deliver to its
-     * adopted target. It stays bounded and never wakes a not-ready gateway. */
+     * adopted target (or had no message: a small fleet, a failed first post). It
+     * never wakes a not-ready gateway. #2213: an outage at fleet start no longer
+     * loses it — bounded at startup, then retried in the background once the
+     * adapter is ready again, never posted twice after an uncertain attempt. */
     private sendFleetStartCompletionFallback;
     stopInstance(name: string, transition?: TransitionHandle): Promise<{
         backgroundWorkEnded: boolean;
@@ -1431,10 +1563,27 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** #1742: `/start web` from a fleet admin: the /web menu right here in the DM, for the General this bot serves. */
     private startWebInDm;
     private getPublicWebLink;
+    private publicLinkAutoOpen;
+    /**
+     * #named-link-ttl: the admin who last opened a named-tunnel link from /web, with the live binding — only while they
+     * still may own one (publicOwnerCurrent: a fleet admin of a live bot, the same General). Else null.
+     */
+    private rememberedPublicOwner;
+    /** A named-tunnel link was privately delivered: auto_open reopens it for this owner after a restart. */
+    private rememberPublicLinkOwner;
+    /** Closed on purpose (Close, /web revoke): a restart must not reopen it. The next /web remembers again. */
+    private forgetPublicLinkOwner;
+    /**
+     * #named-link-ttl: `web.public_link.auto_open` — once per start, after the web listener and the chat connections are
+     * up. Opens the named link with nothing posted (sign-in still needs a code from /web or a returning device); a final
+     * failure goes to its owner once, by DM, drawn as a failed /web is.
+     */
+    private startPublicLinkAutoOpen;
     getPublicWebStatus(): {
         state: string;
         expiresAt?: number;
         remainingSeconds?: number;
+        noExpiry?: true;
     };
     confirmPublicWebLogin(info: {
         label: string;
@@ -1660,6 +1809,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private startUpdateProgressMonitor;
     /** Start all instances from fleet config */
     startAll(configPath: string): Promise<void>;
+    private startAllWithinDeadline;
     /** Keep Discord profile activity aligned with the same cached usage source as /usage. */
     private startDiscordUsagePresence;
     /**
@@ -1683,8 +1833,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private sweepOrphanedWebUploads;
     /** Start the shared channel adapter(s) for topic mode */
     private startSharedAdapter;
-    /** Exponential backoff retry for a single failed adapter (background, non-blocking). */
+    /** Keep trying while the fleet runs, with a five-minute cap even after a long outage. */
     private scheduleAdapterRetry;
+    /** One login per connection, shared by the background timer and the operator's Retry now. */
+    private attemptAdapterRetry;
+    retryAdapterNow(adapterId: string): {
+        queued: boolean;
+        already_running?: boolean;
+    };
     /** Notify admin about adapter failure (uses any available adapter). */
     private notifyAdapterFailure;
     /** Notify admin that a retried adapter reconnected. */
@@ -2126,6 +2282,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
     private patchFleetDocument;
+    /**
+     * #2208: before every write to the raw document — the place is unshared first (an alias on the way becomes its own
+     * copy; an anchor's other aliases get theirs), so the write changes that place only; and it is recorded for the
+     * save's check that nothing else changed.
+     */
+    private writingFleetDocument;
     getSettingsConfigPath(): string;
     removeInstance(name: string, authorization: ExplicitInstanceRemoval, execution?: SettingsExecution): Promise<void>;
     private removeInstanceOwned;
@@ -2465,6 +2627,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * should say so rather than send into a guaranteed failure.
      */
     private fleetNoticeTarget;
+    /**
+     * #2246 step 3: the task board's daily summary of [since, until) (task-board-summary.ts). Each chat world's General
+     * gets its own instances' cards — a card that no world's instance holds (nobody's, a person's) goes to the primary
+     * one — and each of that world's Generals shows the same text in the web chat. A world with nothing to say gets
+     * nothing. A web-only fleet: everything, in the web chat.
+     */
+    private postTaskBoardSummary;
     /**
      * Post the daily summary where fleet-wide notices go.
      *
@@ -2608,6 +2777,40 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private stopNeedsYou;
     private startNeedsYou;
+    /**
+     * #2352: where an instance's own notices go — its topic in its world's group, or its ClassicBot room — as a Needs you
+     * lane's place; null when it has neither (or its world has no group).
+     */
+    private instanceChannelTarget;
+    /**
+     * #2352: the instance whose own channel lists a waiting card — its project's lead — when that channel can be used now
+     * (a fleet instance of a live world, with a topic or room). undefined: its assignee's world's General, as before.
+     * #2434: only a card the person handed out waits for them, so the instance that handed one out is never its lane.
+     */
+    private needsYouLane;
+    /**
+     * #2355 review: where a card's Needs you buttons belong now — read from the board and the fleet at the moment of a click
+     * or a reply, never from the last render. null: it no longer waits for the person.
+     */
+    /**
+     * #2425 follow-up: an instance that handed out a card and is no longer in the fleet — neither a configured instance nor
+     * a ClassicBot identity (deleted). Its blocked and in-review cards fall back to the person (Needs you, the summary).
+     * Not known before the config and the ClassicBot rooms are loaded: then no one is gone (a live dispatcher's cards never
+     * flash into the person's list at startup).
+     */
+    readonly dispatcherGone: (name: string) => boolean;
+    private needsYouRoute;
+    /**
+     * #2246 step 3: the task board's cards that wait for the person, for Needs you — under each card's assignee, listed in
+     * its lane's channel (#2352: its project's lead; #2434: never the instance that handed it out), else in General.
+     */
+    private needsYouTaskItems;
+    private needsYouTasks;
+    /**
+     * #2246 step 3: the person's move on a card from a chat's Needs you list — a fleet admin of that world (checked by the
+     * hub), acting as the person, through the board's rules, at the version the button showed.
+     */
+    private taskActionFromChat;
     /** The prompts open on the dashboard right now (a page that loads after one was posted asks for them). */
     listWebPrompts(): Array<{
         instance: string;
@@ -2715,6 +2918,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * it is now (a change since last seen moves the epoch first; authority-state.ts). No data directory: off.
      */
     webAuthorityState(): AuthorityState;
+    /**
+     * #2453 review: the web-authority state read on every configuration change (a Settings save, the host's confirm, a
+     * reload) — so a switch turned off and on again between two requests is still seen off: its epoch moves, and the
+     * named-link sessions' authorizations are dropped. Reads that only happen on a request would miss it.
+     */
+    private observeWebAuthority;
     /**
      * #1939 S2a: Settings → Web → Web authority — the state in force (the switch counts as off while its state cannot be
      * written), what fleet.yaml says, the hosts that make the dashboard reachable from elsewhere (the warning while
@@ -2731,7 +2940,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
             account: string;
             authorizedAt: number;
             until: number;
+            named?: true;
         }>;
+        /** #2453 (§0.2): the admin's named-tunnel hostname, while one is configured (the named-link row shows only then). */
+        namedHost: string | null;
     };
     private authorizationRequests;
     /**
@@ -2817,7 +3029,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** A clean exit is intentional from the CLI's perspective, but often not from
      * the operator's. Keep the instance notice passive and put the action in the
      * same-world General topic where an administrator can make the choice. */
-    notifyNormalExit(instanceName: string): Promise<void>;
+    notifySessionOomStop(instanceName: string, unclear?: boolean): Promise<void>;
+    notifyNormalExit(instanceName: string, oom?: boolean | "unclear"): Promise<void>;
     /** Consume a clean-exit Restart/Ignore button exactly once. */
     private handleExitRestartPrompt;
     private interactivePromptLabel;
@@ -3015,6 +3228,23 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private readonly loginWindow;
     private get webLogin();
+    /** #2233: sign-ins started from the web dashboard (local admin sessions), on the same controller as chat's. */
+    private webBackendLoginsInstance;
+    get webBackendLogins(): WebBackendLogins;
+    /** #2233: the login a paused-for-sign-in instance needs, when the dashboard can sign it in. */
+    private signInFor;
+    /**
+     * #2233: Settings → Agents' sign-in list — every backend's default login as the availability snapshot has it, then
+     * each credential profile an agent uses (its own login state, read offline).
+     */
+    backendSignInTargets(): SignInTarget[];
+    /** #2233: the session with this handle is live, admin, local and of the current dashboard token. */
+    private isLocalAdminSession;
+    /**
+     * #2233: `/login` for a dashboard requester. The same controller and checks; a CLI that is not installed is refused
+     * with its install command (chat's install-first runs a terminal of its own, which the dashboard does not offer).
+     */
+    private startWebDashboardLogin;
     /**
      * Post the backend chooser for a bare `/login`. Caller enforces admin.
      * Returns why the chooser could not be posted, for the caller to tell the
@@ -3143,6 +3373,15 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private adoptBinaryDirectory;
     /** Discord native `/login` slash — shared by every adapter dispatch block. */
     private handleLoginSlash;
+    /** #2293: whose cross-instance messages search leaves out now (web-api /ui/search). */
+    searchVisibility(): XmsgVisibility;
+    /** #2293: a cross-instance message for the search index (outbound-handlers, after it was admitted). */
+    indexCrossInstance(record: CrossInstanceRecord): void;
+    /**
+     * #2293: the global search index, at fleet start — after the web chat is restored (the backfill reads it). Its worker
+     * owns search.db; see search-index.ts. Off with web.search.enabled: false.
+     */
+    private startSearchIndex;
     queueMirrorMessage(text: string): void;
     /**
      * #1565: restore the web chat history of the configured instances from disk and keep writing it back. A file that
@@ -3155,6 +3394,16 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private publishEffectTrial;
     /** Push an SSE event to all connected Web UI clients. */
     emitSseEvent(event: string, data: unknown): void;
+    /**
+     * The task board's live side: every committed change goes to the open pages (never to a guest) — the board's new
+     * revision and the card numbers it touched; not who touched them (the page does not need it, and a public-link page
+     * must not learn a hidden instance's name from it). Its news goes to the instances whose cards someone else changed:
+     * one "[Task board]" notice per instance, gathered for 10 s, held by the delivery outbox until it is taken
+     * (task-board-waker.ts).
+     */
+    private attachTaskBoard;
+    /** A task board notice, as AgEnD's own (not a person's words): through the delivery outbox, held until delivered. */
+    private admitTaskBoardNotice;
     listClaimedTasks(assignee: string): Array<{
         id: string;
         title: string;
@@ -3185,6 +3434,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private static SKILLS_DIR_SEGMENTS;
     /** Copy general-knowledge steering + all role-eligible skills to General. */
     private syncGeneralKnowledge;
+    /** Update only AgEnD-managed skill copies; no launch or restart is needed for an experimental switch. */
+    canvasWorkerSettingChanged(): void;
+    private refreshExperimentalSkills;
     /** Publish only the bundled skills eligible for an instance role. */
     private syncRoleSkills;
     /**
@@ -3209,6 +3461,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * migration exception is the pre-manifest Kiro General layout explicitly
      * selected by adoptLegacyUnmanaged.
      */
+    /**
+     * #2482: the user's own skills that shadow bundled ones, said once per directory and change — not once per name on
+     * every start (11 lines a start on the host). The record (`skipped-skills.json` in the AgEnD home) keeps what was said
+     * across restarts; a new name or an edited SKILL.md is said again.
+     */
+    private reportSkippedSkills;
     private syncManagedSkills;
     /** Read AgEnD's roles extension from SKILL.md YAML frontmatter. */
     private readManagedSkillRoles;
@@ -3566,7 +3824,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * settles, so a later genuine stop (after a restart) still does the work.
      */
     stopAll(): Promise<void>;
+    private tmuxExecHelperTimer;
     private stopAllInFlight;
+    /** Stops release memory. Reassess between batches without waiting for recovery. */
+    private stopInstancesInBatches;
     private doStopAll;
     /**
      * Prune stale external sessions by re-querying each daemon for live sessions.
@@ -3626,6 +3887,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     isBotTokenInUse(token: string): boolean;
     /** Non-null when startup found the running config and fleet.yaml disagreeing. */
+    /**
+     * #2346 (settings schema): whether a connection added now would start at once — what canHotAddConnections would decide
+     * for the current config with one more connection appended: another one is running, and nothing else this process took
+     * at startup has changed since (a pending locale or access change, say, needs AgEnD restarted anyway).
+     */
+    connectionsStartLive(): boolean;
     fleetSignatureMismatchKeys(): string[] | null;
     /**
      * Restart AgEnD itself on behalf of a Settings apply.
@@ -3666,6 +3933,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     verifyProviderSecret(input: {
         specId: string;
         secret: string;
+        clear?: boolean;
         sessionBinding: string;
         idempotencyKey: string;
     }): Promise<{