@songsid/agend 2.3.4-beta.8 → 2.3.4-beta.9

package/dist/export-import.d.ts

@@ -1,2 +1,9 @@
+/**
+ * The archive file, private from its first byte: created here, exclusively, 0600 (the umask can only narrow it), and
+ * never through a link. The archive holds the fleet's secrets (.env), so it must never exist readable by others, not
+ * even for the moment a chmod afterwards would leave. An existing destination — a file, a directory or a symlink — is
+ * refused, never replaced or followed.
+ */
+export declare function openPrivateArchive(path: string): number;
 export declare function exportConfig(dataDir: string, outputPath: string | undefined, full: boolean): Promise<void>;
 export declare function importConfig(dataDir: string, filePath: string): Promise<void>;

package/dist/export-import.js

@@ -1,7 +1,7 @@
 import { ensureAgendHome } from "./agend-home.js";
 import { execFileSync } from "node:child_process";
 import { t } from "./locale.js";
-import { existsSync, statSync, copyFileSync, readFileSync, } from "node:fs";
+import { existsSync, statSync, copyFileSync, readFileSync, openSync, closeSync, fsyncSync, unlinkSync, constants as fsConstants, } from "node:fs";
 import { join, basename, resolve, sep as pathSep } from "node:path";
 import { homedir } from "node:os";
 const MINIMAL_FILES = ["fleet.yaml", ".env", "scheduler.db", "classicBot.yaml"];
@@ -13,6 +13,43 @@ const RUNTIME_EXCLUDES = [
     "fleet.log",
     "node_modules",
 ];
+/**
+ * The archive file, private from its first byte: created here, exclusively, 0600 (the umask can only narrow it), and
+ * never through a link. The archive holds the fleet's secrets (.env), so it must never exist readable by others, not
+ * even for the moment a chmod afterwards would leave. An existing destination — a file, a directory or a symlink — is
+ * refused, never replaced or followed.
+ */
+export function openPrivateArchive(path) {
+    // O_CREAT | O_EXCL fails on any existing path — a symlink included, which it never follows (POSIX open(2)).
+    const flags = fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL;
+    try {
+        return openSync(path, flags, 0o600);
+    }
+    catch (err) {
+        if (err.code === "EEXIST") {
+            console.error(`${path} already exists. Choose another output path, or move that file away first.`);
+            process.exit(1);
+        }
+        throw err;
+    }
+}
+/** tar into the private archive (its stdout is the archive's fd); on failure the partial archive is removed. */
+function tarInto(outFile, args) {
+    const fd = openPrivateArchive(outFile);
+    try {
+        execFileSync("tar", ["czf", "-", ...args], { stdio: ["ignore", fd, "pipe"] });
+        fsyncSync(fd);
+    }
+    catch (err) {
+        closeSync(fd);
+        try {
+            unlinkSync(outFile);
+        }
+        catch { /* already gone */ }
+        throw err;
+    }
+    closeSync(fd);
+}
 // Reject tarballs above this size to blunt zip-bomb style exhaustion.
 const MAX_IMPORT_BYTES = 500 * 1024 * 1024;
 export async function exportConfig(dataDir, outputPath, full) {
@@ -20,14 +57,13 @@ export async function exportConfig(dataDir, outputPath, full) {
         console.error(`Data directory not found: ${dataDir}`);
         process.exit(1);
     }
-    const date = new Date().toISOString().slice(0, 10);
-    const outFile = resolve(outputPath ?? `agend-export-${date}.tar.gz`);
+    // The default name carries the time to the second (UTC), so a second export on the same day gets its own file
+    // instead of meeting an existing one (which openPrivateArchive refuses). An explicit path is used as given.
+    const stamp = new Date().toISOString().slice(0, 19).replace(/[-:]/g, "").replace("T", "-");
+    const outFile = resolve(outputPath ?? `agend-export-${stamp}.tar.gz`);
     if (full) {
         const excludeArgs = RUNTIME_EXCLUDES.flatMap((p) => ["--exclude", p]);
-        execFileSync("tar", [
-            "czf", outFile, ...excludeArgs,
-            "-C", join(dataDir, ".."), basename(dataDir),
-        ], { stdio: "pipe" });
+        tarInto(outFile, [...excludeArgs, "-C", join(dataDir, ".."), basename(dataDir)]);
     }
     else {
         // Minimal: only config files that exist
@@ -37,9 +73,7 @@ export async function exportConfig(dataDir, outputPath, full) {
             process.exit(1);
         }
         const fileArgs = existing.map((f) => `${basename(dataDir)}/${f}`);
-        execFileSync("tar", [
-            "czf", outFile, "-C", join(dataDir, ".."), ...fileArgs,
-        ], { stdio: "pipe" });
+        tarInto(outFile, ["-C", join(dataDir, ".."), ...fileArgs]);
     }
     const size = statSync(outFile).size;
     const sizeStr = size < 1024

package/dist/export-import.js.map

@@ -1 +1 @@
-{"version":3,"file":"export-import.js","sourceRoot":"","sources":["../src/export-import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAChC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,YAAY,EAEZ,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAChF,MAAM,gBAAgB,GAAG;IACvB,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc;CACf,CAAC;AAEF,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,UAA8B,EAC9B,IAAa;IAEb,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,IAAI,SAAS,CAAC,CAAC;IAErE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,YAAY,CAAC,KAAK,EAAE;YAClB,KAAK,EAAE,OAAO,EAAE,GAAG,WAAW;YAC9B,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC;SAC7C,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,wCAAwC;QACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,YAAY,CAAC,KAAK,EAAE;YAClB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,QAAQ;SACvD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,MAAM,OAAO,GACX,IAAI,GAAG,IAAI;QACT,CAAC,CAAC,GAAG,IAAI,IAAI;QACb,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAClB,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;YAClC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAElD,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,KAAK,OAAO,GAAG,CAAC,CAAC;IACpD,OAAO,CAAC,IAAI,CACV,4EAA4E,CAC7E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACzC,IAAI,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,uBAAuB,gBAAgB,WAAW,SAAS,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzB,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAClD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG;YACjB,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,OAAO,GAAG,MAAM;aACb,QAAQ,CAAC,MAAM,CAAC;aAChB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,iDAAiD,KAAK,EAAE,CAAC,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,MAAM,QAAQ,SAAS,EAAE,CAAC;YAC7C,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,qEAAqE;IACrE,yEAAyE;IACzE,iCAAiC;IACjC,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;IAEvC,+BAA+B;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAQ,CAAC;QAClE,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,sBAAsB;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjE,IAAI,IAAI,EAAE,iBAAiB,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;wBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"export-import.js","sourceRoot":"","sources":["../src/export-import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAChC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,YAAY,EAEZ,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,IAAI,WAAW,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAChF,MAAM,gBAAgB,GAAG;IACvB,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;IACZ,WAAW;IACX,cAAc;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,4GAA4G;IAC5G,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC;IAC9E,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,4EAA4E,CAAC,CAAC;YACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gHAAgH;AAChH,SAAS,OAAO,CAAC,OAAe,EAAE,IAAc;IAC9C,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,CAAC;YAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,UAA8B,EAC9B,IAAa;IAEb,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8GAA8G;IAC9G,4GAA4G;IAC5G,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,KAAK,SAAS,CAAC,CAAC;IAEtE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,wCAAwC;QACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,MAAM,OAAO,GACX,IAAI,GAAG,IAAI;QACT,CAAC,CAAC,GAAG,IAAI,IAAI;QACb,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAClB,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;YAClC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAElD,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,KAAK,OAAO,GAAG,CAAC,CAAC;IACpD,OAAO,CAAC,IAAI,CACV,4EAA4E,CAC7E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACzC,IAAI,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,uBAAuB,gBAAgB,WAAW,SAAS,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzB,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAClD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG;YACjB,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,OAAO,GAAG,MAAM;aACb,QAAQ,CAAC,MAAM,CAAC;aAChB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,iDAAiD,KAAK,EAAE,CAAC,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,MAAM,QAAQ,SAAS,EAAE,CAAC;YAC7C,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,qEAAqE;IACrE,yEAAyE;IACzE,iCAAiC;IACjC,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;IAEvC,+BAA+B;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAQ,CAAC;QAClE,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,sBAAsB;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjE,IAAI,IAAI,EAAE,iBAAiB,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;wBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/fleet-context.d.ts

@@ -120,6 +120,8 @@ export interface FleetContext {
     saveFleetConfig(): void;
     getInstanceDir(name: string): string;
     createForumTopic(topicName: string, adapterId?: string): Promise<number | string>;
+    /** #3055: a topic with this id is being deleted right now (its agent was deleted); binding it waits until it is over. */
+    isTopicDeletionInFlight?(topicId: number | string): boolean;
     removeInstance(name: string, authorization: ExplicitInstanceRemoval): Promise<void>;
     /** Quarantine a provider-confirmed missing topic without deleting user data. */
     quarantineMissingTopic(threadId: string, target: RouteTarget, evidence: {

package/dist/fleet-manager.d.ts

@@ -15,6 +15,7 @@ import type { FleetConfig, RawFleetConfig, InstanceConfig, WebVerifiedAuthorityC
 import { type DeliveryStatus, type GuildEmoji, type GuildEmojiGroup, type ResolvedStatusEmojis } from "./status-emojis.js";
 import { type RouteTarget } from "./fleet-context.js";
 import { EventLog } from "./event-log.js";
+import { type TopicDeleteOutcome } from "./instance-topic-delete.js";
 import { BackendAvailabilityStore, type AvailabilityProbes, type BackendAvailability } from "./backend-availability.js";
 import { AdapterWorld } from "./adapter-world.js";
 import { CostGuard } from "./cost-guard.js";
@@ -87,6 +88,7 @@ import { WebBackendLogins, type SignInTarget } from "./web-backend-login.js";
 import { BrowserBackendSignIns } from "./browser-backend-signins.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
+import { AgentCredentials } from "./agent-credentials.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
 import { type ExplicitInstanceRemoval } from "./instance-removal.js";
 import { type SessionOomRetry } from "./session-oom-stop.js";
@@ -584,6 +586,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private discordPresenceEagerPending;
     private discordPresenceInFlight;
     private static readonly DISCORD_PRESENCE_REFRESH_MS;
+    /** #3066 §1d: how often a fleet with no Discord bot reads the quota for its history (the user's choice: 30 min). */
+    static readonly QUOTA_BACKGROUND_READ_MS: number;
+    private quotaReadTimer;
     /** Days of event/activity history to keep. */
     private static readonly EVENT_LOG_RETENTION_DAYS;
     private watchdogTimer;
@@ -884,6 +889,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * startup-only key at startup. See checkStartupSignatureConsistency(). */
     private fleetSignatureMismatch;
     private healthServerListening;
+    private agentCredentialsCache?;
+    get agentCredentials(): AgentCredentials;
     constructor(dataDir: string);
     /** #1266: a reply's buttons — the store (reply-buttons.db) and what a click does. Created on first use. */
     private replyButtonsCtl;
@@ -2046,6 +2053,35 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Start all instances from fleet config */
     startAll(configPath: string): Promise<void>;
     private startAllWithinDeadline;
+    /**
+     * #3066 §1d (the user: yes, every 30 min): the quota history (usage/quota-history.ts) records only the readings AgEnD
+     * makes. A Discord bot's presence refresh reads every 15 min; without one, nothing reads while nobody looks. So, with no
+     * Discord bot and while some account has a running agent, read every 30 min — the same cached read (its 5-minute TTL
+     * still bounds the vendor calls), recorded like any other.
+     */
+    private startQuotaBackgroundReads;
+    /** #3066 §1: the latest estimates, by `provider\0metric` (what usage-api's lookup reads, synchronously). */
+    private capacityEstimates;
+    private capacityTimer;
+    static readonly CAPACITY_REFRESH_MS: number;
+    /**
+     * #3066 §1: estimate each account's weekly 100% from the quota history (§1d) and the usage ledger's hours — both read
+     * asynchronously, the arithmetic small (usage/capacity.ts). An account is its usage provider id ("claude",
+     * "claude:hsinlin", "codex:yanxianchen"): its hours are the ledger sources of that backend under that credential profile
+     * (Codex's "unrecorded" hours are no account's). A per-model weekly ("Sonnet (weekly)") counts only that model's tokens.
+     *
+     * Prism #3073: no estimate rather than a wrong one —
+     * - a window is measured only where the ledger has its hours: kept (31 days) and scanned (`days.coverage`) for every
+     *   instance of the account's backend, and every instance whose hours count for it; the quota history goes back 12 weeks;
+     * - a profile literally named "default", "unknown" or "unrecorded" (configured, on disk, or in the quota history) makes
+     *   those hours ambiguous: neither the host
+     *   account nor the named one is estimated (each would be credited the other's use, or lose its own);
+     * - only a metric the vendor marks per-model (`scope: "model"`) is filtered by model; another named weekly pool
+     *   ("Luna Reserve (weekly)", Antigravity pools) is no model name and is not estimated.
+     */
+    refreshCapacity(): Promise<number>;
+    /** One background quota read, when nothing else reads (no Discord bot) and an account has a running agent. */
+    backgroundQuotaRead(): Promise<boolean>;
     /** Keep Discord profile activity aligned with the same cached usage source as /usage. */
     private startDiscordUsagePresence;
     /**
@@ -2428,6 +2464,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * of the schedule response on IPC.
      */
     private performScheduleOp;
+    /**
+     * `post_decision` with `supersedes` changes a decision someone else may have recorded (it stops being active): the
+     * same permission as `update_decision`, asked through the same live check (tool set + dashboard switches), on both
+     * create paths. An empty or absent value supersedes nothing and needs nothing; anything else must be an id.
+     */
+    private decisionSupersedes;
     handleDecisionCrudHttp(instance: string, op: string, args: Record<string, unknown>): Promise<unknown>;
     handleTaskCrudHttp(instance: string, args: Record<string, unknown>): Promise<unknown>;
     handleSetDisplayNameHttp(instance: string, name: string): Promise<unknown>;
@@ -2443,7 +2485,41 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private handleTaskCrud;
     /** Create a forum topic via the adapter. Returns the message_thread_id. */
     createForumTopic(topicName: string, adapterId?: string): Promise<number | string>;
-    deleteForumTopic(topicId: number | string, adapterId?: string): Promise<void>;
+    /**
+     * Delete an agent and, unless asked not to, its own chat topic (user decision: by default). The topic is planned
+     * before the removal (its id and bot go with the fleet.yaml entry) and deleted through the agent's OWN bot after it;
+     * the outcome is the platform's answer (instance-topic-delete.ts). A topic that cannot go never fails the removal.
+     */
+    removeInstanceAndTopic(name: string, authorization: ExplicitInstanceRemoval, opts: {
+        deleteTopic: boolean;
+        execution?: SettingsExecution;
+    }): Promise<TopicDeleteOutcome>;
+    /** #3055: destinations whose platform deletion is running now; a binding to one waits until it is over. */
+    private readonly topicDeletionsInFlight;
+    /** True while a topic with this id is being deleted on any connection (a new binding of it is refused meanwhile). */
+    isTopicDeletionInFlight(topicId: number | string): boolean;
+    /**
+     * #3055 review r2 (Prism P1-3): would this instance config bind a topic whose deletion is running now? Compared by
+     * physical destination, so the same thread number in another Telegram group is not held. Settings asks it at commit.
+     */
+    topicBindingInFlight(inst: {
+        channel_id?: unknown;
+        topic_id?: unknown;
+    }): boolean;
+    /** Any topic deletion running now (a connection's group or General may not be re-pointed meanwhile). */
+    topicDeletionPending(): boolean;
+    /** The physical destination of `topicId` on the bot `adapterId`. */
+    private destinationFor;
+    /** The adapter of the bot `adapterId` names — never a substitute for a bot that is not there. */
+    private instanceTopicAdapter;
+    /**
+     * Topic ownership by physical destination (#3055 review, Prism P1): an instance's topic is where its bot's platform
+     * puts it (a Telegram group + thread, a Discord channel), so two bots in one group, or two instances on one
+     * channel, are seen to share it; and every connection's own General is protected, with or without a General agent.
+     */
+    private topicOwnership;
+    /** What deleting `name`'s topic would act on: its own bot only — a bot that is not there is never substituted. */
+    private planInstanceTopicDelete;
     getForumTopicDeleter(adapterId?: string): ((topicId: number | string) => Promise<void>) | null;
     private topicCleanupTimer;
     private sessionPruneTimer;
@@ -3429,9 +3505,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * Make a tool summary safe to paste into a channel message.
      *
      * The text is agent-controlled (it is built from tool inputs — file paths,
-     * shell commands), so it gets flattened to one line, capped, and stripped of
-     * the two Discord mass-mention triggers. Neither channel renders it with a
-     * parse mode, so no markup escaping is needed beyond that.
+     * shell commands), so it gets flattened to one line, secrets masked, capped,
+     * and stripped of the two Discord mass-mention triggers. Masking comes BEFORE
+     * the cap: a cap can cut a mask's context but must never be what hides (or
+     * fails to hide) a secret. Neither channel renders it with a parse mode, so no
+     * markup escaping is needed beyond that.
      */
     private static sanitizeActivity;
     /**