@songsid/agend 2.3.2-beta.1 → 2.3.2-beta.11

package/dist/fleet-manager.d.ts

@@ -1,6 +1,8 @@
 import { type HumanOrigin } from "./human-delivery-receipts.js";
 import { SettingsExecution } from "./settings-transaction.js";
 import { AppIconStore } from "./web-app-icon.js";
+import { OfficeShareService } from "./office-share-service.js";
+import { type OfficeShare } from "./office-share.js";
 import type { LoginCodeOwner } from "./web-login.js";
 import { type ProfileTicket } from "./runtime-cpu-profile.js";
 import type { CpuProfile } from "./cpu-profile.js";
@@ -65,6 +67,8 @@ import { OwnerCssStore } from "./web-owner-css-store.js";
 import { ThemeStore } from "./web-theme-store.js";
 import { OfficeStore, OfficeWriteLimiter } from "./web-office-store.js";
 import { OfficeSkinStore } from "./web-office-skins.js";
+import { OfficeActs } from "./web-office-acts.js";
+import { OfficePackTools } from "./web-office-pack-tools.js";
 import { WebAppearance } from "./web-appearance.js";
 import { WebEffectLibrary } from "./web-effect-library.js";
 import { WebEffectTrials } from "./web-effect-trials.js";
@@ -84,12 +88,13 @@ import { type CrossInstanceRecord, type XmsgVisibility } from "./search/search-d
 import { WebSettingsTools } from "./web-settings-tools.js";
 import { type Delegation, type TrafficItem } from "./fleet-traffic.js";
 import { WebBackendLogins, type SignInTarget } from "./web-backend-login.js";
+import { BrowserBackendSignIns } from "./browser-backend-signins.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
 import { type ExplicitInstanceRemoval } from "./instance-removal.js";
 import { type SessionOomRetry } from "./session-oom-stop.js";
-import type { InstanceState, InteractionSnapshot } from "./backend/types.js";
+import type { InstanceState, InteractionSnapshot, RemoteCard } from "./backend/types.js";
 import { type Daemon } from "./daemon.js";
 import { WakeCoordinator } from "./wake-coordinator.js";
 import { TargetQueueWorker } from "./target-queue-worker.js";
@@ -156,6 +161,8 @@ export declare function insideManagedWorkspaces(dir: string, agendHome?: string)
 export declare function isOrphanInstanceWindowName(name: string): boolean;
 /** restartSingleInstance's options. `carry` (#1753): a credential-profile switch; its outcome is written into `result`. */
 export interface RestartOpts {
+    /** Internal ownership of a complete migration workflow. Never supplied by tool input. */
+    kiroMigration?: symbol;
     freshStart?: boolean;
     explicit?: boolean;
     /** Internal receipt captured when an OOM action was offered. */
@@ -245,6 +252,7 @@ export declare const CLI_ENV_PROBE_DEADLINE_MS = 16000;
  * started ten CLIs together, saturated the CPU, and healthy starts then missed
  * their startup budget — which used to cost the user their conversation. Cores
  * bound how many can actually make progress; memory bounds how many fit.
+ * `cores` is what this process may use (cpuset and cgroup quota, #749), not the host's count.
  */
 export declare function deriveSpawnConcurrency(freeMemMB: number, cores: number): number;
 /** #2499 review: one line of Settings → Guests' Recent changes (guestOverview), from the event log. */
@@ -284,6 +292,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private workingRecovery;
     private workingRecoveryTimer;
     private workingRecoveryCause;
+    private workingRecoveryGroup;
     private recoveryEnabled;
     private initializeWorkingRecovery;
     private recoveryDeliveryEligible;
@@ -453,6 +462,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private pendingBackendSelects;
     /** nonce → pending button prompt (hang restart, interactive assist, clean-exit restart). */
     private pendingNonceButtons;
+    /** #2598 B2: the kiro moves waiting on a fleet admin's Confirm in General, by prompt nonce. */
+    private pendingKiroMigrations;
+    private kiroMigrationRuns;
     /** #1386 "Needs you": the list, its live chat messages and Acknowledge. Started with the fleet (finishStartup). */
     private needsYou;
     /** When the fleet first saw an instance crashed, for its "Needs you" age; cleared when it is not. */
@@ -465,6 +477,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * adapter emits — whatever fields its payload carries — can claim a dashboard click's authority.
      */
     private readonly webPromptClicks;
+    /** #2675: a dashboard click's typed answer, for the click it came with. */
+    private readonly webPromptTexts;
+    /** #2675: the nonce of each instance's posted card. */
+    private readonly remoteCardPosts;
+    /** #2675: replies taken as a card's answer (`<chatId>|<messageId>` → monotonic expiry), so another bot's copy is dropped. */
+    private readonly takenCardReplies;
     /** The web clicks consumeNonceCallback actually claimed (the others were refused or lost a race). */
     private readonly webPromptClaims;
     private failoverActive;
@@ -658,6 +676,45 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     readonly officeSkinWrites: OfficeWriteLimiter;
     /** How often a person may save the offices (PUT /ui/offices); memory only, as the appearance limiter. */
     readonly officeWrites: OfficeWriteLimiter;
+    private officeSharesInstance?;
+    /**
+     * #2636: Office share links — the live Office view for people outside the fleet, read-only, on a quick tunnel of
+     * their own (a manager and lease of its own: never the fleet's one tunnel lane nor the public link's preview tunnel).
+     */
+    get officeShares(): OfficeShareService;
+    /**
+     * #2636: a share made or ended — said in General, as a sign-in is (who, which office, for how long; never its URL).
+     * `share` null with `count`: "Revoke all".
+     */
+    officeShareNotice(event: "created" | "revoked", who: string, share: OfficeShare | null, count: number): void;
+    /** A share's owner: a person (`person:<adapter>:<user>`) still a fleet admin there; the host's own admin session stays. */
+    private officeShareOwnerCurrent;
+    private officeActsInstance?;
+    /** #2578: the agents' acts in the Office view (office_view / office_set), memory only; every change is `office_acts`. */
+    get officeActs(): OfficeActs;
+    private officePackToolsInstance?;
+    /** #2692: the agents' skin-pack tools — their log, the admins' approval mode and the pending changes (memory only). */
+    get officePackTools(): OfficePackTools;
+    /** #2692: the instances whose `office_packs` feature is on (their own switch, else the defaults'): the Office page lists them. */
+    private officePackAgents;
+    /** #2692: the nonce of each pending pack change's prompt in General (its buttons are retired when it is decided). */
+    private readonly officePackPrompts;
+    /**
+     * #2692: tell the fleet's admins of an agent's pack change — one short message in General (notifyFleetError, never a
+     * sign-in notice). A pending one comes with Approve / Reject (a fleet admin's, as a kiro move); where no General can
+     * carry buttons it is the plain message, and the Office page decides it.
+     */
+    private officePackNotice;
+    private retireOfficePackNonce;
+    /** #2692: a pending change was decided (here or on the page) or expired: its prompt says so and loses its buttons. */
+    private settleOfficePackPrompt;
+    /** #2692: Approve / Reject on a pending pack change. Any fleet admin (the default nonce authorization), in General. */
+    private handleOfficePackCallback;
+    /**
+     * #2578: each instance's state as the org chart shows it (fleet-org.js orgState, from the same fields the status
+     * frame and the Needs-you list carry) and its display name (resolveInstanceIdentity, as getUiStatus) — read once.
+     */
+    private officePeople;
     /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
     get webAppearance(): WebAppearance;
     private effectLibraryInstance?;
@@ -755,6 +812,21 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Exact configured effect owners; this does not depend on prompt location. */
     private settingsChatAuthority;
     private promptSettingsChange;
+    private kiroMigrateDeps;
+    /**
+     * #2598 B2, migrate_kiro_instance: judge the move, then ask in General for a fleet admin's Confirm. Nothing changes
+     * here; the move runs on the Confirm (handleKiroMigrateCallback), judged again then.
+     */
+    requestKiroMigration(name: string, startFresh: boolean): Promise<{
+        ok: true;
+        text: string;
+        classic_conversation: string | null;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    /** A fleet admin's Confirm or Cancel on a kiro move. Any fleet admin (the default nonce authorization), in General. */
+    private handleKiroMigrateCallback;
     private handleSettingsChangeCallback;
     startSettingsConfirmationControl(): Promise<void>;
     private get webToken();
@@ -1699,6 +1771,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         chat: boolean;
         explicit: boolean;
         instances: string[];
+        rooms: Array<{
+            name: string;
+            display_name?: string;
+        }>;
         connections: Array<{
             id: string;
             type: string;
@@ -1731,6 +1807,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         }>;
         audit: GuestAuditEntry[];
     };
+    /** #2667: the ClassicBot rooms' instance names now — what a settings save's validation knows besides fleet.yaml's instances. */
+    classicRoomNames(): string[];
     /**
      * #2499 review: the guest audit an admin reads — the newest grant changes and admin-sent codes from the event log
      * (`fleet` rows: no agent's Log shows them). Through guestOverview only: Settings' admin gate, never over the public
@@ -1959,6 +2037,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private sweepOrphanedWebUploads;
     /** Start the shared channel adapter(s) for topic mode */
     private startSharedAdapter;
+    /** How long fleet startup waits for its chat connections before it continues without the slow ones (#2642). */
+    static ADAPTER_STARTUP_WAIT_MS: number;
+    /** Track a connection's startup outcome; a failure gets the background retry. */
+    private recordAdapterStartup;
     /** Keep trying while the fleet runs, with a five-minute cap even after a long outage. */
     private scheduleAdapterRetry;
     /** One login per connection, shared by the background timer and the operator's Retry now. */
@@ -2397,6 +2479,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * non-identity instance leaves are canonicalized to inheritance afterward.
      */
     saveFleetConfig(explicitPatches?: RawConfigPatch[]): void;
+    /** A permission tightening is effective when its save returns, independently of the later apply job or IPC. */
+    private refreshSavedDashboardPermissions;
     /** Why the config written to `candidate` must not replace fleet.yaml, or null: it does not load, or it adds errors. */
     private savedFleetConfigProblem;
     /**
@@ -2405,6 +2489,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private logConfigWarningsAtStartup;
     /** One-time upgrade migration; invalid YAML is never rewritten. */
+    private migrateNoticeDeliveryStorage;
+    private migrateOfficeStorage;
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
     private patchFleetDocument;
@@ -2875,6 +2961,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * without one); codex "unrecorded" (its rollouts don't say which login wrote them).
      */
     private usageProfileOf;
+    /** #2122 §10: a Kiro instance with a credential profile writes its classic store in that profile's home. */
+    private kiroDbPathOf;
     /** #2122: the fleet's day boundary zone — defaults.scheduler.default_timezone, else this host's. */
     usageZone(): string;
     /**
@@ -2980,7 +3068,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         error?: string;
         options?: number[];
     }>;
-    clickWebPrompt(instance: string, nonce: string, action: string): Promise<{
+    clickWebPrompt(instance: string, nonce: string, action: string, text?: string): Promise<{
         status: 200 | 400 | 403 | 409;
         error?: string;
         outcome?: string;
@@ -3183,6 +3271,37 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     offerBackendLogin(targetInstance: string, backend: string, profile?: string): Promise<void>;
     /** Consume a General assist button exactly once. */
     private handleInteractivePromptAssist;
+    /**
+     * Where an instance's card is put to people: its own place — its topic, or its ClassicBot room — or, on a fleet with
+     * no chat platform, the dashboard. Never General: the answer is the instance's conversation.
+     */
+    private remoteCardPlace;
+    /**
+     * The daemon saw a card held still on `instanceName`'s screen (remote_card): put it to the people who talk to that
+     * instance, with a button per answer. A card already posted for the instance is retired first (the daemon said it
+     * was gone; this is the fallback).
+     */
+    postRemoteCard(instanceName: string, card: RemoteCard): Promise<void>;
+    /**
+     * The card is gone from the screen (remote_card_gone, `identity`; null: whichever is posted): its buttons collapse to
+     * `text` if nobody answered them here.
+     */
+    retireRemoteCard(instanceName: string, identity: string | null, text?: string): void;
+    /** Who may answer an instance's card: whoever may already talk to it there (a ClassicBot room is open to all). */
+    private mayAnswerRemoteCard;
+    /** A click on a card's button (platform or dashboard). */
+    private handleRemoteCardClick;
+    /**
+     * An inbound message that replies to a posted question card, by someone who may answer it: its text is the typed
+     * answer, and the message goes no further (true). Another bot's copy of a reply already taken is dropped (true).
+     */
+    private takeRemoteCardReply;
+    /**
+     * Key a claimed answer into the instance's card (the daemon checks it is still that card and walks a verified
+     * cursor), then collapse the post to what happened. When the card is still waiting and was not answered — refused
+     * or stopped part-way — it is posted again, so it can still be answered from here.
+     */
+    private answerRemoteCardFor;
     /** Send a "🛑 Cancel" button to the instance's topic/channel after delivery. */
     /**
      * Handle the DC `/save` slash command for both classic AND fleet-topic targets.
@@ -3355,6 +3474,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private readonly loginWindow;
     private get webLogin();
+    private browserBackendSignInsInstance;
+    private structuredLoginCleanupFailed;
+    private readonly pendingBackendSince;
+    private browserSignInOwnerCurrent;
+    /** #2599: default-account controls share the exact writer reservation with chat/profile/install. */
+    get browserBackendSignIns(): BrowserBackendSignIns;
+    private needsYouBackendSignIns;
     /** #2233: sign-ins started from the web dashboard (local admin sessions), on the same controller as chat's. */
     private webBackendLoginsInstance;
     get webBackendLogins(): WebBackendLogins;
@@ -3648,6 +3774,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private cliEnvPath;
     /** Read the cached CLI env for a backend (a credential profile's own, when given), or null if missing/stale/unparseable. */
     private readCliEnv;
+    /**
+     * #2122 §10: the version the CLI probe last recorded for a backend — its cache file read whatever its age (the usage
+     * reader's version gate needs the last known version, not a fresh one); null when none was recorded. Never a probe.
+     */
+    private lastRecordedCliVersion;
     /** Return cached CLI versions immediately. Refresh is started after /sysinfo is sent. */
     getBackendCliVersionSnapshot(): BackendCliVersionSnapshot;
     /** Called only after the user-visible sysinfo send/respond has settled. */