@songsid/agend 2.3.1 → 2.3.2-beta.10

package/dist/fleet-manager.d.ts

@@ -1,6 +1,8 @@
 import { type HumanOrigin } from "./human-delivery-receipts.js";
 import { SettingsExecution } from "./settings-transaction.js";
 import { AppIconStore } from "./web-app-icon.js";
+import { OfficeShareService } from "./office-share-service.js";
+import { type OfficeShare } from "./office-share.js";
 import type { LoginCodeOwner } from "./web-login.js";
 import { type ProfileTicket } from "./runtime-cpu-profile.js";
 import type { CpuProfile } from "./cpu-profile.js";
@@ -64,6 +66,8 @@ import { WebPrefsStore } from "./web-prefs.js";
 import { OwnerCssStore } from "./web-owner-css-store.js";
 import { ThemeStore } from "./web-theme-store.js";
 import { OfficeStore, OfficeWriteLimiter } from "./web-office-store.js";
+import { OfficeSkinStore } from "./web-office-skins.js";
+import { OfficeActs } from "./web-office-acts.js";
 import { WebAppearance } from "./web-appearance.js";
 import { WebEffectLibrary } from "./web-effect-library.js";
 import { WebEffectTrials } from "./web-effect-trials.js";
@@ -83,6 +87,7 @@ import { type CrossInstanceRecord, type XmsgVisibility } from "./search/search-d
 import { WebSettingsTools } from "./web-settings-tools.js";
 import { type Delegation, type TrafficItem } from "./fleet-traffic.js";
 import { WebBackendLogins, type SignInTarget } from "./web-backend-login.js";
+import { BrowserBackendSignIns } from "./browser-backend-signins.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
@@ -112,6 +117,25 @@ import { type CarryResult } from "./backend/claude-carry.js";
 import { StormWindow } from "./storm-window.js";
 import { SpawnGate } from "./spawn-gate.js";
 import { BackendOutageTracker } from "./backend-outage.js";
+/** #2348: how a guest sign-in code's issuance ended (issueGuestCode), for Settings → Guests' Send sign-in code. */
+export type GuestCodeOutcome = {
+    kind: "sent";
+    expiresInMs: number;
+    publicLink: boolean;
+} | {
+    kind: "nothing";
+} | {
+    kind: "paused";
+} | {
+    kind: "busy";
+} | {
+    kind: "revoked";
+} | {
+    kind: "dm_failed";
+    platform: string;
+    reason: string;
+    startUrl?: string;
+};
 export declare function resolveReplyThreadId(argsThreadId: unknown, instanceConfig?: InstanceConfig): string | undefined;
 /**
  * Pure warm-cap victim selection (extracted for testability). Given the current
@@ -225,8 +249,26 @@ export declare const CLI_ENV_PROBE_DEADLINE_MS = 16000;
  * started ten CLIs together, saturated the CPU, and healthy starts then missed
  * their startup budget — which used to cost the user their conversation. Cores
  * bound how many can actually make progress; memory bounds how many fit.
+ * `cores` is what this process may use (cpuset and cgroup quota, #749), not the host's count.
  */
 export declare function deriveSpawnConcurrency(freeMemMB: number, cores: number): number;
+/** #2499 review: one line of Settings → Guests' Recent changes (guestOverview), from the event log. */
+export type GuestAuditEntry = {
+    kind: "grant";
+    at: number;
+    account: string;
+    name: string;
+    via: "direct" | "confirmed";
+    added: string[];
+    removed: string[];
+    endedSessions: number;
+} | {
+    kind: "code";
+    at: number;
+    account: string;
+    name: string;
+    outcome: string;
+};
 export declare class FleetManager implements FleetContext, LifecycleContext, ArchiverContext, StatuslineWatcherContext, OutboundContext, AgentEndpointContext {
     dataDir: string;
     private static signalTarget;
@@ -244,6 +286,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     readonly managerBootId: `${string}-${string}-${string}-${string}-${string}`;
     deliveryOutbox: DeliveryOutbox | null;
     private deliveryOutboxRecovered;
+    private workingRecovery;
+    private workingRecoveryTimer;
+    private workingRecoveryCause;
+    private workingRecoveryGroup;
+    private recoveryEnabled;
+    private initializeWorkingRecovery;
+    private recoveryDeliveryEligible;
     /** Phase 2b: wakes paused targets for queued durable work (delivery_worker ≠ off). */
     wakeCoordinator: WakeCoordinator | null;
     /**
@@ -410,6 +459,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private pendingBackendSelects;
     /** nonce → pending button prompt (hang restart, interactive assist, clean-exit restart). */
     private pendingNonceButtons;
+    /** #2598 B2: the kiro moves waiting on a fleet admin's Confirm in General, by prompt nonce. */
+    private pendingKiroMigrations;
     /** #1386 "Needs you": the list, its live chat messages and Acknowledge. Started with the fleet (finishStartup). */
     private needsYou;
     /** When the fleet first saw an instance crashed, for its "Needs you" age; cleared when it is not. */
@@ -608,8 +659,34 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private officeStoreInstance?;
     /** Fleet → Org chart → Office: the offices people made (web-offices.json, beside web-themes.json). */
     get officeStore(): OfficeStore;
+    private officeSkinsInstance?;
+    /** #2513: the Office view's uploaded skin packs (<AGEND_HOME>/web-office-skins/). */
+    get officeSkins(): OfficeSkinStore;
+    /** How often a person may upload or delete a skin pack; memory only, as the offices' limiter. */
+    readonly officeSkinWrites: OfficeWriteLimiter;
     /** How often a person may save the offices (PUT /ui/offices); memory only, as the appearance limiter. */
     readonly officeWrites: OfficeWriteLimiter;
+    private officeSharesInstance?;
+    /**
+     * #2636: Office share links — the live Office view for people outside the fleet, read-only, on a quick tunnel of
+     * their own (a manager and lease of its own: never the fleet's one tunnel lane nor the public link's preview tunnel).
+     */
+    get officeShares(): OfficeShareService;
+    /**
+     * #2636: a share made or ended — said in General, as a sign-in is (who, which office, for how long; never its URL).
+     * `share` null with `count`: "Revoke all".
+     */
+    officeShareNotice(event: "created" | "revoked", who: string, share: OfficeShare | null, count: number): void;
+    /** A share's owner: a person (`person:<adapter>:<user>`) still a fleet admin there; the host's own admin session stays. */
+    private officeShareOwnerCurrent;
+    private officeActsInstance?;
+    /** #2578: the agents' acts in the Office view (office_view / office_set), memory only; every change is `office_acts`. */
+    get officeActs(): OfficeActs;
+    /**
+     * #2578: each instance's state as the org chart shows it (fleet-org.js orgState, from the same fields the status
+     * frame and the Needs-you list carry) and its display name (resolveInstanceIdentity, as getUiStatus) — read once.
+     */
+    private officePeople;
     /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
     get webAppearance(): WebAppearance;
     private effectLibraryInstance?;
@@ -707,6 +784,21 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Exact configured effect owners; this does not depend on prompt location. */
     private settingsChatAuthority;
     private promptSettingsChange;
+    private kiroMigrateDeps;
+    /**
+     * #2598 B2, migrate_kiro_instance: judge the move, then ask in General for a fleet admin's Confirm. Nothing changes
+     * here; the move runs on the Confirm (handleKiroMigrateCallback), judged again then.
+     */
+    requestKiroMigration(name: string, startFresh: boolean): Promise<{
+        ok: true;
+        text: string;
+        classic_conversation: string | null;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    /** A fleet admin's Confirm or Cancel on a kiro move. Any fleet admin (the default nonce authorization), in General. */
+    private handleKiroMigrateCallback;
     private handleSettingsChangeCallback;
     startSettingsConfirmationControl(): Promise<void>;
     private get webToken();
@@ -1649,7 +1741,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     guestOverview(): {
         enabled: boolean;
         chat: boolean;
+        explicit: boolean;
         instances: string[];
+        rooms: Array<{
+            name: string;
+            display_name?: string;
+        }>;
         connections: Array<{
             id: string;
             type: string;
@@ -1667,8 +1764,87 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
             lastSeen: number | null;
             devices: number;
             narrow: string[] | null;
+            grant: {
+                name?: string;
+                instances: string[];
+            } | null;
+            code?: {
+                at: number;
+                outcome: string;
+                expiresAt?: number;
+                reason?: string;
+                platform?: string;
+                startUrl?: string;
+            };
         }>;
+        audit: GuestAuditEntry[];
     };
+    /** #2667: the ClassicBot rooms' instance names now — what a settings save's validation knows besides fleet.yaml's instances. */
+    classicRoomNames(): string[];
+    /**
+     * #2499 review: the guest audit an admin reads — the newest grant changes and admin-sent codes from the event log
+     * (`fleet` rows: no agent's Log shows them). Through guestOverview only: Settings' admin gate, never over the public
+     * link, never a guest's. The person's name as the card shows it; a session handle stays on the server (`by` → whether
+     * a person saved it here or it was confirmed in General).
+     */
+    private guestAudit;
+    private static readonly GUEST_AUDIT_SHOWN;
+    /**
+     * #2348: Settings → Guests' picker — the people AgEnD has seen in chat (seen_people, from human receipts: never a bot,
+     * never the web), without fleet admins (they sign in as admins) or accounts of a connection the fleet no longer has.
+     * Admin only (settings-api.ts), never over the public link.
+     */
+    guestPeople(): {
+        people: Array<{
+            adapterId: string;
+            userId: string;
+            platform: string;
+            username: string | null;
+            name: string;
+            lastSeen: string;
+            instances: string[];
+        }>;
+    };
+    /**
+     * #2348: why this account may not be given a grant, or null. Only someone AgEnD has seen in chat, on a connection the
+     * fleet runs, who is not a fleet admin of it (an admin is never a guest).
+     */
+    guestGrantRefusal(adapterId: string, userId: string): string | null;
+    /**
+     * #2348 delta §5: a grant changed with a save — one event-log entry per person, shown in Settings → Guests' Recent
+     * changes (guestOverview: admin-only, never over the public link or to a guest): who saved it (an admin's
+     * session handle, the header token, or null when replayed for a confirmation), whether it applied at once or was
+     * confirmed in General, the agents added and taken away, and the sessions a removal ended. Never message content.
+     */
+    noteGuestGrantChange(change: {
+        by: string | null;
+        via: "direct" | "confirmed";
+        account: string;
+        added: string[];
+        removed: string[];
+        endedSessions: number;
+    }): void;
+    /** #2348: an admin's Send sign-in code, per admin (the caller): at most this many in ADMIN_CODE_WINDOW_MS. */
+    private static readonly ADMIN_CODE_MAX;
+    private static readonly ADMIN_CODE_WINDOW_MS;
+    private readonly adminCodeSends;
+    /** #2348: the last admin-sent code per account, for the Settings card ("Code sent 18:42 · expires 18:52", or why not). */
+    private readonly guestCodeSent;
+    /**
+     * #2348: Settings → Guests' "Send sign-in code" — a guest code to an account an admin granted access, by DM only (no
+     * chat to answer in, nothing posted anywhere). The same issuance as the person's own /web (one code per account, the
+     * code store's caps and breaker, the public link's audience when it is open) and the same once-a-minute limit per
+     * account, plus a per-admin cap. Refused without guest sign-in, for a fleet admin, or with nothing granted. Audited.
+     */
+    sendGuestCodeByAdmin(owner: {
+        adapterId: string;
+        userId: string;
+    }, by: string, 
+    /** #2365 review: the initiating admin is still signed in and still an admin (settings-api re-checks the session). */
+    current?: () => boolean): Promise<{
+        status: number;
+        body: Record<string, unknown>;
+    }>;
     /** #1920 phase 3 (the app shell): a guest's chip — its web name, and its connection's platform (discord, telegram). */
     guestBadge(owner: {
         adapterId: string;
@@ -1833,6 +2009,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private sweepOrphanedWebUploads;
     /** Start the shared channel adapter(s) for topic mode */
     private startSharedAdapter;
+    /** How long fleet startup waits for its chat connections before it continues without the slow ones (#2642). */
+    static ADAPTER_STARTUP_WAIT_MS: number;
+    /** Track a connection's startup outcome; a failure gets the background retry. */
+    private recordAdapterStartup;
     /** Keep trying while the fleet runs, with a five-minute cap even after a long outage. */
     private scheduleAdapterRetry;
     /** One login per connection, shared by the background timer and the operator's Retry now. */
@@ -2271,6 +2451,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * non-identity instance leaves are canonicalized to inheritance afterward.
      */
     saveFleetConfig(explicitPatches?: RawConfigPatch[]): void;
+    /** A permission tightening is effective when its save returns, independently of the later apply job or IPC. */
+    private refreshSavedDashboardPermissions;
     /** Why the config written to `candidate` must not replace fleet.yaml, or null: it does not load, or it adds errors. */
     private savedFleetConfigProblem;
     /**
@@ -2279,6 +2461,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private logConfigWarningsAtStartup;
     /** One-time upgrade migration; invalid YAML is never rewritten. */
+    private migrateNoticeDeliveryStorage;
+    private migrateOfficeStorage;
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
     private patchFleetDocument;
@@ -2749,6 +2933,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * without one); codex "unrecorded" (its rollouts don't say which login wrote them).
      */
     private usageProfileOf;
+    /** #2122 §10: a Kiro instance with a credential profile writes its classic store in that profile's home. */
+    private kiroDbPathOf;
     /** #2122: the fleet's day boundary zone — defaults.scheduler.default_timezone, else this host's. */
     usageZone(): string;
     /**
@@ -2941,6 +3127,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
             authorizedAt: number;
             until: number;
             named?: true;
+            quick?: true;
         }>;
         /** #2453 (§0.2): the admin's named-tunnel hostname, while one is configured (the named-link row shows only then). */
         namedHost: string | null;
@@ -3228,6 +3415,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private readonly loginWindow;
     private get webLogin();
+    private browserBackendSignInsInstance;
+    private structuredLoginCleanupFailed;
+    private readonly pendingBackendSince;
+    private browserSignInOwnerCurrent;
+    /** #2599: default-account controls share the exact writer reservation with chat/profile/install. */
+    get browserBackendSignIns(): BrowserBackendSignIns;
+    private needsYouBackendSignIns;
     /** #2233: sign-ins started from the web dashboard (local admin sessions), on the same controller as chat's. */
     private webBackendLoginsInstance;
     get webBackendLogins(): WebBackendLogins;
@@ -3521,6 +3715,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private cliEnvPath;
     /** Read the cached CLI env for a backend (a credential profile's own, when given), or null if missing/stale/unparseable. */
     private readCliEnv;
+    /**
+     * #2122 §10: the version the CLI probe last recorded for a backend — its cache file read whatever its age (the usage
+     * reader's version gate needs the last known version, not a fresh one); null when none was recorded. Never a probe.
+     */
+    private lastRecordedCliVersion;
     /** Return cached CLI versions immediately. Refresh is started after /sysinfo is sent. */
     getBackendCliVersionSnapshot(): BackendCliVersionSnapshot;
     /** Called only after the user-visible sysinfo send/respond has settled. */
@@ -3826,6 +4025,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     stopAll(): Promise<void>;
     private tmuxExecHelperTimer;
     private stopAllInFlight;
+    /** Signal-handler continuation, after successful graceful shutdown only. */
+    noteRequestedShutdown(): void;
+    private recordWorkingRestartIntent;
     /** Stops release memory. Reassess between batches without waiting for recovery. */
     private stopInstancesInBatches;
     private doStopAll;
@@ -3894,6 +4096,16 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     connectionsStartLive(): boolean;
     fleetSignatureMismatchKeys(): string[] | null;
+    /**
+     * #2347 restart flow: saved changes that take effect only after AgEnD restarts — the startup-only keys fleet.yaml
+     * now differs on, and the newest apply job whose fleet row can carry the restart (`job_id`, null when none can: a
+     * hand edit, or a job past its retention). Null when nothing is pending, and when a restart could not clear it
+     * (the signature mismatch the panel reports instead). The same test requestSettingsSelfRestart makes.
+     */
+    settingsRestartPending(): {
+        keys: string[];
+        job_id: string | null;
+    } | null;
     /**
      * Restart AgEnD itself on behalf of a Settings apply.
      *