@songsid/agend 2.3.4-beta.7 → 2.3.5-alpha.3

package/dist/fleet-manager.d.ts

@@ -1,4 +1,6 @@
 import { type HumanOrigin } from "./human-delivery-receipts.js";
+import { type SettingsPendingView } from "./settings-confirmation.js";
+import { type GeneralSwitchInput } from "./general-binding.js";
 import { SettingsExecution } from "./settings-transaction.js";
 import { AppIconStore } from "./web-app-icon.js";
 import { type NamedTestResult } from "./tunnel/named-link-test.js";
@@ -8,6 +10,7 @@ import type { PageShare } from "./page-share.js";
 import type { LoginCodeOwner } from "./web-login.js";
 import { type ProfileTicket } from "./runtime-cpu-profile.js";
 import type { CpuProfile } from "./cpu-profile.js";
+import { type IncomingMessage } from "node:http";
 import { type FleetMemory } from "./process-memory.js";
 import { MemoryPressure, type MemoryPressureSnapshot } from "./memory-pressure.js";
 import { ReplyDeduper } from "./reply-dedup.js";
@@ -18,7 +21,7 @@ import { EventLog } from "./event-log.js";
 import { BackendAvailabilityStore, type AvailabilityProbes, type BackendAvailability } from "./backend-availability.js";
 import { AdapterWorld } from "./adapter-world.js";
 import { CostGuard } from "./cost-guard.js";
-import { IpcClient } from "./channel/ipc-bridge.js";
+import { type InstanceClient } from "./channel/ipc-bridge.js";
 import type { AdapterHealthSnapshot, ChannelAdapter, InboundMessage, InboundReaction } from "./channel/types.js";
 import { type BackendCliVersionSnapshot } from "./backend/types.js";
 import { type Logger } from "./logger.js";
@@ -60,6 +63,9 @@ export declare function applyTaskListCap<T extends {
     hint: string;
 } | T[];
 import { type PublicPreviewForUi } from "./web-api.js";
+import { RuntimeCoordinator } from "./runtime-coordinator.js";
+import { FleetWindowsRuntime, type NativeRuntimePatch } from "./fleet-windows-runtime.js";
+import { NativeMcpSessions } from "./native-mcp.js";
 import { type LogAnswer, type LogQuery } from "./log-service.js";
 import { WebChatHistory, type WebChatPost } from "./web-chat-history.js";
 import { type WebEchoCopy } from "./web-reactions.js";
@@ -102,6 +108,7 @@ import { type CacheReport } from "./cache-service.js";
 import { type WebCommandResult } from "./web-commands.js";
 import { type SessionRecord } from "./web-session.js";
 import { WebNotices } from "./web-notices.js";
+import { WebRemoteAccess } from "./web-remote-access.js";
 import { VERIFIED_SESSION_HOURS, type HumanAuthority, type WebAuthorityRefusal, type WebAuthorityResult, type WebPeer } from "./authority/web-authority.js";
 import { type AuthorityState } from "./authority/authority-state.js";
 import { type SessionAuthorization } from "./authority/session-authorizations.js";
@@ -199,6 +206,11 @@ export interface ModelCatalog {
     note?: string;
 }
 export interface DeliveryOptions {
+    /**
+     * A Windows instance only: the sender's authority after the handoff (see NativeRuntimeDeliveryOptions.authorityCurrent).
+     * stillCurrent fences the handoff itself; this one is rechecked before the Windows process starts.
+     */
+    authorityCurrent?: () => boolean;
     /** Explicitly identify agent-to-agent delivery when metadata is unavailable. */
     isCrossInstance?: boolean;
     /** Force or bypass the idle gate. Schedules set this explicitly. */
@@ -322,6 +334,89 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Live view of lifecycle.daemons — used throughout; not deprecated. */
     get daemons(): Map<string, Daemon>;
     fleetConfig: FleetConfig | null;
+    private fleetWindowsRuntime;
+    private nativeMcpStore;
+    private paneManager;
+    private localPaneRelay;
+    private openingLocalPane;
+    private runtimeHub;
+    private runtimeExecutor;
+    private runtimeStatusScheduled;
+    private readonly reconciledRemoteResults;
+    /** Machine credentials are separate from dashboard sessions and per-turn agent capabilities. */
+    runtimeCoordinator(): RuntimeCoordinator;
+    private runtimeWindowsExecutor;
+    /** Per-turn capabilities for native MCP, separate from browser and Linux-agent credentials. */
+    nativeMcpSessions(): NativeMcpSessions;
+    /** The same instance registry and delivery entry point, with a native Windows execution adapter. */
+    nativeInstanceRuntime(): FleetWindowsRuntime;
+    /** Explicit dashboard opt-in, with the same General confirmation and ordinary topic/Daemon routing. */
+    createNativePaneInstance(profile: Record<string, unknown>, channelId: string | undefined, authorized: () => boolean, execution: SettingsExecution): Promise<{
+        name: string;
+        runtime: "windows";
+        agent: import("./windows-agents.js").WindowsAgent;
+    }>;
+    /** Admin-only settings path: validate first, then close the exact old launch before changing cold fields. */
+    updateNativePaneConfig(name: string, patch: Partial<NativeRuntimePatch>, authorized: () => boolean, transaction?: Pick<SettingsExecution, "mutate" | "complete">): Promise<ReturnType<FleetWindowsRuntime["update"]>>;
+    private localNativePaneEndpoint;
+    /** Persistent ownership is independent of the exec worker's per-turn capabilities. */
+    private nativePanes;
+    /** Prepare only bundled role files; this neither switches General nor starts a provider process. */
+    prepareWindowsGeneralWorkspace(name: string, machineId: string, cli: "codex" | "claude-code", bindingId: string, authorized: () => boolean): Promise<import("./runtime-general-protocol.js").GeneralWorkspaceReceipt>;
+    private readonly generalLocationFlights;
+    private readonly generalAttentionEpisodes;
+    private generalBindings;
+    generalLocations(): unknown;
+    /** Pure preflight for the confirmation diff and stale-tab refusal; never prepares files or starts a CLI. */
+    previewGeneralLocation(raw: unknown): {
+        input: GeneralSwitchInput;
+        summary: string[];
+        connections: string[];
+    };
+    /** All entry points, including automatic native recovery, must respect an interrupted binding switch. */
+    assertGeneralBindingStart(name: string, config: InstanceConfig): void;
+    /** Only the Settings replay's confirmed admin can enter; the whole switch owns one lifecycle transition. */
+    switchGeneralLocation(raw: unknown, authorized: () => boolean, execution: SettingsExecution): Promise<{
+        started: boolean;
+        message: string;
+    }>;
+    /** An offline PC or a confirmed binding boundary holds old waiting input; it never becomes another conversation's queue. */
+    private holdGeneralOldDeliveries;
+    generalLocationDeliveryHold(name: string): string | null;
+    private generalLocationAttention;
+    nativePaneFor(name: string, config: InstanceConfig, assertCurrent: () => void): Promise<import("./native-pane-lifecycle.js").NativePaneLifecycle>;
+    recoverNativePane(name: string, launchId: string, authorized: () => boolean): Promise<void>;
+    holdNativePaneRecovery(name: string, error: unknown): boolean;
+    startFreshNativePane(name: string, launchId: string, sessionId: string | null, authorized: () => boolean): Promise<void>;
+    nativePanePinnedSession(name: string): string | null;
+    onNativePaneRecoverySettled(name: string): void;
+    setNativePanePaused(name: string, paused: boolean): void;
+    closeRetainedNativePane(name: string): Promise<void>;
+    reconcileNativePaneBeforeStart(name: string, daemon: Daemon): Promise<boolean>;
+    /** M-2255: the Windows runtimes' switches the fleet's own state reflects (null until the start-up has applied them). */
+    private runtimeEffects;
+    private runtimeEffectsScheduled;
+    private localPaneDrain;
+    private remotePaneDrain;
+    /** Revoke admissions synchronously; keep the captured transport only long enough for exact owned closes. */
+    private drainNativeRuntime;
+    /**
+     * M-2255: Settings → Runtime's switches (fleet.yaml `runtimes`, or their environment override) in force — set each time
+     * the configuration in force changes (a load, a save, a reload's rollback), next to the web authority's. Every gate reads
+     * them at once; what the fleet itself holds (paired computers' connections, this PC's Windows process, agents' tool
+     * sessions) follows just after, outside the save that changed them (applyRuntimeSwitches): no restart is needed.
+     */
+    private observeRuntimeSwitches;
+    /**
+     * Turned off: what it allowed ends now — the paired computers' connections (their agents show as offline) or this PC's
+     * Windows process (a turn in progress is cancelled, as when the fleet stops), and those agents' tool sessions.
+     * Turned on: the Windows agents are registered and their chat history read, as at start-up.
+     */
+    private applyRuntimeSwitches;
+    /** An unavailable opt-in runtime must not prevent the Linux fleet from starting or restoring its own history. */
+    private initializeNativeInstances;
+    /** Native CLIs are headless: the manager owns the durable delivery generation instead of a tmux daemon. */
+    private deliveryBootId;
     private rawFleetConfig;
     private rawFleetDocument;
     /** #2208: the paths a saveFleetConfig() wrote, for its check that nothing else changed. */
@@ -338,7 +433,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     get primaryWorld(): AdapterWorld | undefined;
     readonly routing: RoutingEngine;
     get routingTable(): Map<string, RouteTarget>;
-    instanceIpcClients: Map<string, IpcClient>;
+    instanceIpcClients: Map<string, InstanceClient>;
     scheduler: Scheduler | null;
     private configPath;
     /** SIGHUPs received before startAll finishes are replayed once startup is safe. */
@@ -777,6 +872,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * authorizing revoked links and cookies until the fleet restarted.
      */
     private settingsGeneration;
+    /** #2942: the settings baseline the agent-requested Windows changes are checked against (set with the gate). */
+    private settingsBaselineReader;
     private settingsRuntimeRevision;
     private settingsConfirmation;
     private settingsControl;
@@ -801,7 +898,38 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * still hears it: a notice, not a step.
      */
     private settingsSelfConfirmation;
-    /** #2170: the Generals a chat card could be posted in (promptSettingsChange's rule): connected, on the platform, unaffected. */
+    /**
+     * alpha.2 (M-2300; #2973's agent requests, junsion's §6): on a fleet with no chat connection there is no General to
+     * post an agent's Windows request in — it waited for `agend settings confirm` on the host. Its owner (decision
+     * 28c2d3a3: the `agend web --code` session on this computer, web-verified) now sees and decides it from the web's
+     * Needs you. The authority is asked from the request each time, and again at execution by the store (`current`):
+     * still that owner now (this computer, not revoked, signed out or run out), still a fleet with no chat connection,
+     * never over the public link. Anyone else — a guest, a LAN or public-link session, a chat-connected fleet's admin —
+     * gets nothing (a chat fleet keeps General's card as its way).
+     */
+    /**
+     * #2997 review (Prism P2): how many times an agent's request came or was decided — in a web-only fleet's status frame,
+     * so a page that never hears the stream's ping (one polling /ui/poll, one reconnecting, a tab from before the upgrade)
+     * reads the list again when it moves. A count, nothing more.
+     */
+    private agentProposalsRev;
+    private agentProposalOwner;
+    /** alpha.2: the agents' requests waiting for this web-only fleet's owner, or null when the reader is not that owner. */
+    webAgentProposals(req: IncomingMessage): SettingsPendingView[] | null;
+    /**
+     * alpha.2: the owner's Approve or Reject of an agent's request. The store claims it before its first await (a second
+     * click, from here or the host, finds it no longer pending) and asks the owner, the request (its fleet generation and
+     * Windows switch) and the target machine again before and while it runs the same creation code the web uses. The
+     * answer is always the request as it now stands: applied (with the new agent's name), rejected, expired, stale or
+     * failed (with its reason), or already decided.
+     */
+    webDecideAgentProposal(req: IncomingMessage, id: string, decision: "confirm" | "reject"): Promise<{
+        status: number;
+        body: Record<string, unknown>;
+    }>;
+    /** A confirmation belongs to the server route/lifetime, not the availability of General's model. */
+    private settingsGeneralRoute;
+    /** Connected, same-platform, unaffected server routes can post cards even while the model is offline. */
     private settingsNoticeGenerals;
     /**
      * #2170: General's notice of a change confirmed from the web — the first General a chat card could have been posted
@@ -810,6 +938,17 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private settingsWebConfirmedNotice;
     /** Exact configured effect owners; this does not depend on prompt location. */
     private settingsChatAuthority;
+    /**
+     * #2942: a Windows create or settings change an AGENT asked for. Nothing is created or written here: it becomes a
+     * pending settings change whose General card a fleet admin must confirm (promptSettingsChange — the same admin rule
+     * as every card). Its apply runs the same creation/patch code the web uses, inside the store's SettingsExecution, with
+     * the confirming admin, the Windows switch and the target machine asked again at that moment.
+     */
+    private proposeAgentWindowsChange;
+    /** #2942: create_instance with runtime "windows" from an agent: validated like the web, then held for General. */
+    requestWindowsCreate(requester: string, rawArgs: Record<string, unknown>): Promise<SettingsPendingView>;
+    /** #2942: update_instance_config on a Windows agent: only the fields the web editor allows, held for General. */
+    requestWindowsConfig(requester: string, name: string, patch: Record<string, unknown>): Promise<SettingsPendingView>;
     private promptSettingsChange;
     private kiroMigrateDeps;
     /**
@@ -982,6 +1121,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private reconcileQueueWorkers;
     private createQueueWorker;
     private dispatchDurableDelivery;
+    /** The ordinary durable lane, with provider completion proof instead of terminal/IPC submission proof. */
+    private dispatchNativeDurableDelivery;
+    /** A runtime's persisted completion can outlive this manager. Resolve its original delivery fence, never send
+     * the prompt again, and reconstruct a missing peer report using the same durable operation ID. */
+    private reconcileRemoteDelivery;
     private waitForDurableLaneRelease;
     private spawnConcurrency;
     /** #1685: "elevated" or "critical" while host memory pressure slows or holds new agents; otherwise null (an
@@ -1706,6 +1850,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** #1742: `/start web` from a fleet admin: the /web menu right here in the DM, for the General this bot serves. */
     private startWebInDm;
     private getPublicWebLink;
+    /** The public link's wiring to this fleet (a test builds one with the tunnel itself stubbed: `ensure`, `provider`). */
+    private publicWebLinkDeps;
     private publicLinkAutoOpen;
     /**
      * #named-link-ttl: the admin who last opened a named-tunnel link from /web, with the live binding — only while they
@@ -2525,6 +2671,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private writingFleetDocument;
     getSettingsConfigPath(): string;
     removeInstance(name: string, authorization: ExplicitInstanceRemoval, execution?: SettingsExecution): Promise<void>;
+    /** Shared instance metadata goes with a native identity; its Windows workspace and provider sessions stay intact. */
+    private nativeInstanceRemoved;
     private removeInstanceOwned;
     startStatuslineWatcher(name: string): void;
     stopStatuslineWatcher(name: string): void;
@@ -3188,6 +3336,89 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * again. A fleet with a chat connection, another session, or another peer: nothing (§3 as before).
      */
     authorizeHostSession(session: SessionRecord, peer: WebPeer): void;
+    private webRemoteAccessState;
+    /** The authenticator, the outside switch and the wrong-code limiter (web-remote-access.json), read on first use. */
+    webRemoteAccess(): WebRemoteAccess | null;
+    /** "Allow connections from outside" is on (an app set up) and this is a web-only fleet. */
+    private outsideOn;
+    /** The link connections from outside opened, while it is open and still theirs: its exposure. Else null. */
+    private outsideLink;
+    /**
+     * The request's live session, asked again each time `current()` is called (its own cookie authenticated anew, the same
+     * handle): this web-only fleet's owner — this computer's admin, on this computer (`hostOnly`), or also signed in from
+     * outside — and web-verified now. Null when it is not (a guest, a LAN session, a chat fleet's admin, nobody).
+     */
+    private liveOwner;
+    /** Every session signed in from outside ends (and the authorizations kept for them). */
+    private endOutsideSessions;
+    /**
+     * #1939 §10 / #3008: a stored receipt's authority as it reads now — the web authority state, and for this computer's
+     * admin from outside the switch and the last revocation of remote authority (Prism P2 2).
+     */
+    receiptAuthorityNow(stored: HumanAuthority, state?: AuthorityState): HumanAuthority;
+    /** #3008 (the sign-in page): this exposure is the outside link, open now. */
+    isOutsideLink(exposureId: string): boolean;
+    /** What Settings shows: set up or not, the switch, a wait in force, the link — its address only to this computer. */
+    webOutsideStatus(req: IncomingMessage): {
+        webOnly: boolean;
+        here: boolean;
+        enrolled: boolean;
+        enrolledAt: number | null;
+        outside: boolean;
+        pausedForMs: number;
+        link: {
+            state: string;
+            url?: string;
+            expiresAt?: number;
+            noExpiry?: true;
+            quick: boolean;
+        } | null;
+    };
+    /** Set up (or set up again): a new secret, shown once to this computer's admin. Null: not them. */
+    webOutsideBeginEnrollment(req: IncomingMessage): {
+        secret: string;
+        uri: string;
+        expiresInMs: number;
+    } | null;
+    /** The new app's first code: on "ok" it replaces the old one, whose sessions from outside end. */
+    webOutsideConfirmEnrollment(req: IncomingMessage, code: string): "ok" | "wrong" | "expired" | "unsaved" | "not_here";
+    /** Forget the app: the switch goes off, the link closes, every session from outside ends. */
+    webOutsideRemove(req: IncomingMessage): "ok" | "unsaved" | "not_here";
+    /** The switch. On: needs an app set up; the link opens. Off: it closes and every session from outside ends. */
+    webOutsideSwitch(req: IncomingMessage, on: boolean): "ok" | "not_enrolled" | "not_here" | "not_allowed" | "unsaved";
+    private outsideAttempt;
+    private outsideOpening;
+    /**
+     * Open the outside link: an attempt after each delay in turn until one opens (#3008 B: twice more at most — the quick
+     * link's address service limits how often it may be asked). Every attempt asks again: the switch still on, the fleet
+     * running. A final failure: one Notice; the switch stays on, so the next start tries again.
+     */
+    private openOutsideLink;
+    private closeOutsideLink;
+    /** PublicWebLink.onClose for the outside link: what closed it decides what happens next (#3008 B). */
+    private outsideLinkClosed;
+    /**
+     * #3008 (auth-api POST /auth/totp): a sign-in through the outside link with the authenticator's code. "ok": the caller
+     * makes the session (SessionRecord.remote) and then calls authorizeOutsideSession. Each wrong code counts; a wait that
+     * starts is a Notice; a code that matches a step just outside the window logs how far this clock seems to be off.
+     */
+    outsideSignIn(exposureId: string | undefined, code: string): {
+        kind: "ok";
+    } | {
+        kind: "wrong";
+    } | {
+        kind: "paused";
+        retryAfterMs: number;
+    } | {
+        kind: "closed";
+    } | {
+        kind: "unavailable";
+    };
+    /**
+     * #3008: a session just made by outsideSignIn's "ok" is this computer's admin for its authorization's life. False: it
+     * could not be admitted (its handle not saved, #3015 review r3) — the caller ends it.
+     */
+    authorizeOutsideSession(session: SessionRecord, peer: WebPeer, label: string): boolean;
     private authorityStateStore;
     /**
      * #1939 §10: the switch, "Only this computer can authorize" and the revocation epoch in force for the configuration as
@@ -4082,6 +4313,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * profile's, when it is named and has one), claude's account catalog included. Read only: never a probe.
      */
     modelCatalogFor(backend: string, instance: string | null): import("./backend/types.js").ModelOption[];
+    /** Host-default fallback only: Grok has no modeled profile home. Never construct a backend or start a probe. */
+    cliModelCatalogFor(backend: string, instance: string | null): Promise<import("./backend/types.js").ModelOption[]>;
     /**
      * #2072 (#2078 review): the snapshot as THIS instance would see it. Its sign-in on a backend is its own credential
      * profile's when it has one there — the host's default login says nothing about it. A profile's login is a file check
@@ -4552,3 +4785,5 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     getUiStatus(): unknown;
     private getUiStatusSync;
 }
+/** alpha.2 (M-2300): the agent an applied Windows request created (its name, for the page's "Open chat"), or null. */
+export declare function agentNameOf(view: SettingsPendingView): string | null;