talon-agent 5.26.6 → 5.28.0

package/src/core/agents/runner.ts

@@ -24,8 +24,19 @@
  * `spawnAgent` returns as soon as the run is under way: the caller (a chat
  * turn or another agent) keeps working and hears back through the wake turn
  * or its mailbox.
+ *
+ *   - **Restarts are not deaths.** Every agent is mirrored to the `agents`
+ *     table (see the registry's `persist` hook). A daemon shutdown parks the
+ *     live ones (`interruptAgentsForRestart`) before it tears the backends
+ *     down, so the abort that follows is not recorded as a kill and the
+ *     parent is not told the agent died. On the next boot
+ *     `resumeAgentsAfterRestart` brings each one back under its original id:
+ *     on a backend that can resume (Claude SDK session, Codex thread) it
+ *     continues its own conversation with a short "you were interrupted"
+ *     note; elsewhere it is re-briefed with the tail of its previous run log.
  */
 
+import { readFile } from "node:fs/promises";
 import { dirs } from "../../util/paths.js";
 import { log, logError, logWarn } from "../../util/log.js";
 import {
@@ -61,9 +72,14 @@ import {
 import {
   agentLogHeader,
   agentLogPath,
+  agentResumeLogHeader,
   buildAgentPrompt,
   buildAgentSystemPrompt,
+  buildRebriefPrompt,
+  buildResumePrompt,
 } from "./prompt.js";
+import * as agentsRepo from "../../storage/agents/repo.js";
+import type { PersistedAgent } from "../../storage/agents/repo.js";
 import { agentRegistry } from "./registry.js";
 import type {
   AgentCaps,
@@ -259,6 +275,10 @@ export async function spawnAgent(
       ...(spec.reasoningEffort
         ? { reasoningEffort: spec.reasoningEffort }
         : {}),
+      ...(spec.model ? { requestedModel: spec.model } : {}),
+      timeoutMs: spec.timeoutMs ?? capsHolder.caps.defaultTimeoutMs,
+      cwd: dirs.workspace,
+      ...(spec.preflight ? { preflight: true } : {}),
     },
     capsHolder.caps,
   );
@@ -295,6 +315,16 @@ export async function spawnAgent(
   };
 }
 
+/**
+ * How a restarted run picks up. `sessionId` set = continue that backend
+ * conversation; unset = a fresh conversation re-briefed with `prompt`.
+ */
+interface ResumePlan {
+  readonly prompt: string;
+  readonly sessionId?: string;
+  readonly interruptedAt: number;
+}
+
 /** Build the one-shot params for a run, wired to its log and text capture. */
 async function buildRunParams(
   record: AgentRecord,
@@ -302,15 +332,26 @@ async function buildRunParams(
   model: string,
   abortController: AbortController,
   capture: { last: string },
+  resume?: ResumePlan,
 ): Promise<OneShotAgentParams> {
   const appendLog = await openRunLog(
     agentLogPath(record.id),
-    agentLogHeader(record, model),
+    resume
+      ? agentResumeLogHeader(
+          record,
+          model,
+          resume.interruptedAt,
+          resume.sessionId,
+        )
+      : agentLogHeader(record, model),
   );
+  const id = record.id;
   return {
-    prompt: buildAgentPrompt(record.brief, {
-      preflight: spec.preflight === true,
-    }),
+    prompt: resume
+      ? resume.prompt
+      : buildAgentPrompt(record.brief, {
+          preflight: spec.preflight === true,
+        }),
     systemPrompt: buildAgentSystemPrompt({
       agentId: record.id,
       label: record.label,
@@ -327,6 +368,10 @@ async function buildRunParams(
       const trimmed = text.trim();
       if (trimmed) capture.last = trimmed;
     },
+    // Persisted the moment the backend reports it, so a restart at any
+    // point after the first message can resume the conversation.
+    onSessionId: (sessionId) => agentRegistry.setSessionId(id, sessionId),
+    ...(resume?.sessionId ? { resumeSessionId: resume.sessionId } : {}),
     ...(spec.reasoningEffort ? { reasoningEffort: spec.reasoningEffort } : {}),
   };
 }
@@ -389,6 +434,7 @@ async function runAgent(
   spec: AgentSpawnSpec,
   resolved: { model: string; background: BackgroundRunner },
   acquired: Awaited<ReturnType<typeof acquireBackendInstance>>,
+  resume?: ResumePlan,
 ): Promise<void> {
   const { model, background } = resolved;
   const { release } = acquired;
@@ -419,8 +465,11 @@ async function runAgent(
       model,
       abortController,
       capture,
+      resume,
     );
-    if (abortController.signal.aborted) {
+    if (agentRegistry.isInterrupted(id)) {
+      settled = null;
+    } else if (abortController.signal.aborted) {
       // A kill that lands during startup — while the backend is being
       // acquired or the log opened — must not be lost. Handing an
       // already-aborted signal to a backend relies on it checking, and not
@@ -441,18 +490,38 @@ async function runAgent(
         evictLabel: agentContextLabel(id),
       });
       recordBackendRunUsage(record.backendId, usage ?? undefined);
-      recordBackendRunSuccess(record.backendId);
-      settled = settleSuccess(id, task, capture.last, usage ?? undefined);
+      // A backend may swallow the shutdown abort and return normally — the
+      // run still did not finish, so it must not settle as done/failed, and
+      // it says nothing about the backend's health either way.
+      if (agentRegistry.isInterrupted(id)) {
+        settled = null;
+      } else {
+        recordBackendRunSuccess(record.backendId);
+        settled = settleSuccess(id, task, capture.last, usage ?? undefined);
+      }
     }
   } catch (err) {
-    recordBackendRunFailure(record.backendId, err);
-    settled = settleFailure(id, task, err);
+    if (agentRegistry.isInterrupted(id)) {
+      settled = null;
+    } else {
+      recordBackendRunFailure(record.backendId, err);
+      settled = settleFailure(id, task, err);
+    }
   } finally {
     await release().catch((err: unknown) =>
       logError("agents", `failed to release backend for ${id}`, err),
     );
   }
 
+  if (agentRegistry.isInterrupted(id)) {
+    // Parked by a daemon shutdown: the persisted row stays `running` for
+    // the next boot to resume. No settlement, no delivery, no reaping — the
+    // parent is not told its agent died, because it didn't.
+    task.fail(new Error("interrupted by daemon shutdown — will resume"));
+    agentRegistry.releaseInterrupted(id);
+    log("agents", `${id} "${record.label}" interrupted by shutdown — parked`);
+    return;
+  }
   if (!settled) return;
   log(
     "agents",
@@ -491,12 +560,264 @@ export function killAgent(agentId: string): boolean {
   return agentRegistry.requestKill(agentId);
 }
 
+/**
+ * Park every live agent for the next boot. Called FIRST in a graceful
+ * shutdown — before the frontends and the backend pool go down, since
+ * tearing a backend down aborts the runs on it and an unparked agent would
+ * record that abort as its death. Idempotent.
+ */
+export function interruptAgentsForRestart(): number {
+  const parked = agentRegistry.interruptAll();
+  if (parked > 0) {
+    log("agents", `Shutdown: parked ${parked} running agent(s) for resume`);
+  }
+  return parked;
+}
+
 /**
  * Abort every live agent — the shutdown lever, alongside heartbeat's and
- * cron's. Returns how many kills were requested.
+ * cron's. Agents are parked first (a no-op if the shutdown already did), so
+ * this abort ends the process's hold on them without ending the agents:
+ * the next boot resumes them. Returns how many aborts were requested.
  */
 export function shutdownAgents(): number {
+  interruptAgentsForRestart();
   const killed = agentRegistry.killAll();
   if (killed > 0) log("agents", `Shutdown: aborted ${killed} running agent(s)`);
   return killed;
 }
+
+// ── Resume after restart ─────────────────────────────────────────────────────
+
+/** A restart may resume one agent at most this many times. */
+export const MAX_AGENT_RESUMES = 3;
+/** An agent interrupted longer ago than this is not resumed. */
+const AGENT_RESUME_STALE_MS = 24 * 60 * 60 * 1000;
+/** A resumed run always gets at least this much wall-clock. */
+const AGENT_RESUME_MIN_TIMEOUT_MS = 10 * 60 * 1000;
+/** Settled rows are kept this long for inspection, then pruned at boot. */
+const SETTLED_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
+/** How much of the previous run log a re-briefed agent is shown. */
+const REBRIEF_LOG_TAIL_CHARS = 12_000;
+
+/** The last `max` characters of an agent's previous run log, if any. */
+async function previousLogTail(agentId: string, max: number): Promise<string> {
+  try {
+    const text = await readFile(agentLogPath(agentId), "utf-8");
+    return text.length > max ? `…${text.slice(text.length - max)}` : text;
+  } catch {
+    return "";
+  }
+}
+
+/** Settle a restored agent without running it, and tell its parent. */
+async function settleRestored(
+  record: AgentRecord,
+  patch: Parameters<typeof agentRegistry.settle>[1],
+): Promise<void> {
+  const settled = agentRegistry.settle(record.id, patch);
+  if (!settled) return;
+  log(
+    "agents",
+    `${record.id} "${record.label}" → ${settled.state} (after restart)`,
+  );
+  reapChildren(settled);
+  await deliverSettlement(settled).catch((err: unknown) =>
+    logError("agents", `delivery failed for ${record.id}`, err),
+  );
+}
+
+/** Mark a row that cannot even be restored (its parent agent is gone). */
+function abandonRow(saved: PersistedAgent, error: string): void {
+  try {
+    agentsRepo.upsert({
+      ...saved,
+      state: "failed",
+      error,
+      endedAt: Date.now(),
+      updatedAt: Date.now(),
+    });
+  } catch (err) {
+    logError("agents", `could not mark ${saved.id} abandoned`, err);
+  }
+}
+
+/**
+ * Resolve the model a resumed run uses: the one it ran on, else the one it
+ * asked for, else the backend default — a model withdrawn across the
+ * restart must not strand the agent.
+ */
+async function resolveResumeRun(
+  backend: Backend,
+  backendId: string,
+  candidates: ReadonlyArray<string | undefined>,
+): Promise<Awaited<ReturnType<typeof resolveRun>>> {
+  let last: Awaited<ReturnType<typeof resolveRun>> = {
+    ok: false,
+    error: "no model",
+  };
+  const tried = new Set<string | undefined>();
+  for (const candidate of [...candidates, undefined]) {
+    if (tried.has(candidate)) continue;
+    tried.add(candidate);
+    last = await resolveRun(backend, backendId, candidate);
+    if (last.ok) return last;
+  }
+  return last;
+}
+
+/** Bring one interrupted agent back. Never throws. */
+async function resumeOne(saved: PersistedAgent, now: number): Promise<void> {
+  // A crash leaves no interruption stamp: charge the run up to its last
+  // persisted write, which is as close as anyone can know.
+  const interruptedAt = saved.interruptedAt ?? saved.updatedAt;
+  const elapsedMs =
+    saved.interruptedAt === undefined && saved.startedAt !== undefined
+      ? saved.elapsedMs + Math.max(0, saved.updatedAt - saved.startedAt)
+      : saved.elapsedMs;
+
+  // Already back (a second resume pass in the same process) — leave it be.
+  if (agentRegistry.isLive(saved.id)) return;
+  const record = agentRegistry.restore({ ...saved, elapsedMs, interruptedAt });
+  if (!record) {
+    abandonRow(
+      saved,
+      "interrupted by a daemon restart; its parent agent did not survive it",
+    );
+    logWarn("agents", `${saved.id}: parent gone after restart — abandoned`);
+    return;
+  }
+
+  if (saved.reported) {
+    // It finished its job (report_result landed) and was only waiting to
+    // wind down — deliver what it said instead of running it again.
+    await settleRestored(record, { state: "done" });
+    return;
+  }
+  if (saved.resumeCount >= MAX_AGENT_RESUMES) {
+    await settleRestored(record, {
+      state: "failed",
+      error:
+        `interrupted by ${saved.resumeCount + 1} daemon restarts; not ` +
+        `resumed again. Its run log is ${agentLogPath(saved.id)}.`,
+    });
+    return;
+  }
+  if (now - interruptedAt > AGENT_RESUME_STALE_MS) {
+    await settleRestored(record, {
+      state: "failed",
+      error:
+        `interrupted by a daemon restart at ${new Date(interruptedAt).toISOString()} ` +
+        `and the daemon was down too long to resume it. Its run log is ` +
+        `${agentLogPath(saved.id)}.`,
+    });
+    return;
+  }
+
+  const backendId = saved.backendId;
+  let acquired: Awaited<ReturnType<typeof acquireBackendInstance>>;
+  try {
+    acquired = await acquireBackendInstance(backendId);
+  } catch (err) {
+    await settleRestored(record, {
+      state: "failed",
+      error:
+        `interrupted by a daemon restart, and its backend "${backendId}" ` +
+        `is unavailable after it: ${errText(err)}`,
+    });
+    return;
+  }
+  const resolved = await resolveResumeRun(acquired.backend, backendId, [
+    saved.model,
+    saved.requestedModel,
+  ]);
+  if (!resolved.ok) {
+    await acquired.release().catch(() => {});
+    await settleRestored(record, {
+      state: "failed",
+      error: `interrupted by a daemon restart and could not resume: ${resolved.error}`,
+    });
+    return;
+  }
+
+  const canResume =
+    resolved.background.supportsResume === true &&
+    saved.sessionId !== undefined;
+  const minutes = Math.round(elapsedMs / 60_000);
+  const plan: ResumePlan = canResume
+    ? {
+        prompt: buildResumePrompt({ interruptedAt, elapsedMinutes: minutes }),
+        sessionId: saved.sessionId!,
+        interruptedAt,
+      }
+    : {
+        prompt: buildRebriefPrompt({
+          brief: saved.brief,
+          preflight: saved.preflight === true,
+          interruptedAt,
+          elapsedMinutes: minutes,
+          logPath: agentLogPath(saved.id),
+          logTail: await previousLogTail(saved.id, REBRIEF_LOG_TAIL_CHARS),
+        }),
+        interruptedAt,
+      };
+
+  const budget =
+    (saved.timeoutMs ?? capsHolder.caps.defaultTimeoutMs) - elapsedMs;
+  const timeoutMs = Math.max(AGENT_RESUME_MIN_TIMEOUT_MS, budget);
+  const spec: AgentSpawnSpec = {
+    brief: saved.brief,
+    label: saved.label,
+    parent: record.parent,
+    backendId,
+    ...(saved.requestedModel ? { model: saved.requestedModel } : {}),
+    ...(record.reasoningEffort
+      ? { reasoningEffort: record.reasoningEffort }
+      : {}),
+    timeoutMs,
+    ...(saved.preflight ? { preflight: true } : {}),
+  };
+  agentRegistry.markResumed(record.id);
+  log(
+    "agents",
+    `${record.id} "${record.label}" resuming after restart ` +
+      `(${canResume ? `session ${saved.sessionId}` : "re-briefed"}, ` +
+      `${backendId}/${resolved.model}, ${Math.round(timeoutMs / 1000)}s left, ` +
+      `resume #${saved.resumeCount + 1})`,
+  );
+  void runAgent(record, spec, resolved, acquired, plan);
+}
+
+/**
+ * Boot-time: respawn every agent the previous process left running. Call
+ * once, after the dispatcher, backend pool and frontends are up (a resumed
+ * agent reaches its tools and its parent through them). Parents come back
+ * before their children, so a child re-attaches to its live parent.
+ * Returns how many rows were considered.
+ */
+export async function resumeAgentsAfterRestart(): Promise<number> {
+  const now = Date.now();
+  try {
+    const pruned = agentsRepo.pruneSettled(now - SETTLED_RETENTION_MS);
+    if (pruned > 0) log("agents", `Pruned ${pruned} settled agent row(s)`);
+  } catch (err) {
+    logError("agents", "prune of settled agent rows failed", err);
+  }
+  let rows: PersistedAgent[];
+  try {
+    rows = agentsRepo.listInterrupted();
+  } catch (err) {
+    logError("agents", "could not read interrupted agents", err);
+    return 0;
+  }
+  if (rows.length === 0) return 0;
+  log("agents", `Resuming ${rows.length} agent(s) interrupted by the restart`);
+  for (const saved of rows) {
+    try {
+      await resumeOne(saved, now);
+    } catch (err) {
+      logError("agents", `resume of ${saved.id} failed`, err);
+    }
+  }
+  return rows.length;
+}

package/src/core/backup/{restore-guard.ts → restore/guard.ts}

@@ -22,11 +22,11 @@
  */
 
 import { chmod } from "node:fs/promises";
-import { logWarn } from "../../util/log.js";
-import { TalonError } from "../errors.js";
-import { verifyManifest } from "./archive/manifest-auth.js";
-import { resolvePassphrase } from "./passphrase.js";
-import type { BackupSettings, Manifest } from "./types.js";
+import { logWarn } from "../../../util/log.js";
+import { TalonError } from "../../errors.js";
+import { verifyManifest } from "../archive/manifest-auth.js";
+import { resolvePassphrase } from "../passphrase.js";
+import type { BackupSettings, Manifest } from "../types.js";
 
 export type ManifestTrust = {
   /** Operator override for unauthenticated manifests. */

package/src/core/backup/restore/notice.ts

@@ -0,0 +1,164 @@
+/**
+ * Reporting a staged restore back to the chat that asked for it.
+ *
+ * `/backup restore <id>` stages the request and restarts; the restore runs
+ * in the next boot before any frontend exists (see `applyStagedRestore` in
+ * app.ts). Once the frontends are up, the "♻️ Restored snapshot …" line is
+ * delivered here: to the requesting chat, on the frontend it came from,
+ * and — when that chat can't be reached (frontend disabled, delivery
+ * failing) or the request never said who asked — to the operator's
+ * primary chat through the admin notifier, which is where it always went
+ * before.
+ *
+ * Core never imports src/frontend, so delivery goes through the same
+ * cross-send broker `send_via` uses: each enabled frontend's action
+ * handler, keyed by frontend name.
+ */
+
+import { log, logWarn } from "../../../util/log.js";
+import {
+  isNativeChatId,
+  isTelegramChatId,
+  numericChatIdFor,
+} from "../../frontend-runtime/chat-id.js";
+import { crossSendTarget } from "../../engine/gateway-actions/cross-send.js";
+import type { RestoreReport } from "../restore.js";
+
+/** Who asked for a staged restore, as recorded in restore-pending.json. */
+export type RestoreRequester = {
+  /** The requesting chat's key (Telegram id, `d_…`, `discord_…`). */
+  requestedBy?: string;
+  /** The frontend the request came from. Absent in files staged before it existed. */
+  frontend?: string;
+};
+
+/**
+ * The frontend a requester belongs to: the recorded one when the request
+ * carries it, else inferred from the shape of the chat key — Telegram's
+ * ids are numeric, native's start `d_`, Discord's `discord_`. Undefined
+ * when neither says.
+ */
+export function requesterFrontend(
+  requester: RestoreRequester,
+): string | undefined {
+  const explicit =
+    typeof requester.frontend === "string"
+      ? requester.frontend.trim().toLowerCase()
+      : "";
+  if (explicit) return explicit;
+  const key =
+    typeof requester.requestedBy === "string" ? requester.requestedBy : "";
+  if (!key) return undefined;
+  if (isTelegramChatId(key)) return "telegram";
+  if (isNativeChatId(key)) return "native";
+  if (key.startsWith("discord_")) return "discord";
+  return undefined;
+}
+
+/** The confirmation line a successful staged restore reports. */
+export function formatRestoreNotice(
+  report: Pick<RestoreReport, "id" | "checkpointId">,
+): string {
+  return (
+    `♻️ Restored snapshot ${report.id}` +
+    (report.checkpointId
+      ? ` (previous state saved as checkpoint ${report.checkpointId})`
+      : "")
+  );
+}
+
+/**
+ * Send `text` to one chat through its frontend's registered action
+ * handler. The chat key rides in `target` so a frontend that has not
+ * seen the chat since the restart (a Discord channel nobody has spoken
+ * in yet, a native chat the restored database doesn't list) can adopt it.
+ * Resolves true only when the frontend reports the message delivered.
+ */
+async function sendToRequester(
+  frontend: string,
+  chatKey: string,
+  text: string,
+): Promise<boolean> {
+  const handler = crossSendTarget(frontend);
+  if (!handler) return false;
+  const result = await handler(
+    { action: "send_message", text, target: chatKey },
+    numericChatIdFor(chatKey),
+  );
+  return Boolean(result && result.ok === true);
+}
+
+const RESTORE_NOTICE_ATTEMPTS = 6;
+const RESTORE_NOTICE_DELAY_MS = 5_000;
+
+export type RestoreNoticeOptions = {
+  text: string;
+  requester: RestoreRequester;
+  /** The operator's primary chat — the fallback. */
+  notifyAdmin: (text: string) => Promise<unknown>;
+  send?: (frontend: string, chatKey: string, text: string) => Promise<boolean>;
+  /** Whether a frontend is enabled at all (no point retrying one that isn't). */
+  isEnabled?: (frontend: string) => boolean;
+  attempts?: number;
+  sleep?: (ms: number) => Promise<void>;
+};
+
+/**
+ * Deliver the restore notice to the requesting chat, falling back to the
+ * admin's primary chat. Retries a while when the requester's frontend is
+ * enabled but can't deliver yet — the frontends have just started, and a
+ * Discord client may still be logging in. Never throws; resolves with
+ * where the notice went.
+ */
+export async function deliverRestoreNotice(
+  options: RestoreNoticeOptions,
+): Promise<"requester" | "admin"> {
+  const {
+    text,
+    requester,
+    notifyAdmin,
+    send = sendToRequester,
+    isEnabled = (name) => crossSendTarget(name) !== undefined,
+    attempts = RESTORE_NOTICE_ATTEMPTS,
+    sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms).unref?.()),
+  } = options;
+  const frontend = requesterFrontend(requester);
+  const chatKey =
+    typeof requester.requestedBy === "string" ? requester.requestedBy : "";
+
+  if (frontend && chatKey && isEnabled(frontend)) {
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+      try {
+        if (await send(frontend, chatKey, text)) {
+          log("backup", `Restore reported to ${frontend} chat ${chatKey}`);
+          return "requester";
+        }
+      } catch (err) {
+        logWarn(
+          "backup",
+          `Restore report to ${frontend} chat ${chatKey} failed: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
+      if (attempt < attempts) await sleep(RESTORE_NOTICE_DELAY_MS);
+    }
+    logWarn(
+      "backup",
+      `Could not reach ${frontend} chat ${chatKey}; reporting the restore to the admin chat instead`,
+    );
+  } else if (chatKey || frontend) {
+    logWarn(
+      "backup",
+      `Restore requester ${frontend ?? "?"}:${chatKey || "?"} is not reachable here; reporting to the admin chat`,
+    );
+  }
+
+  try {
+    await notifyAdmin(text);
+  } catch (err) {
+    logWarn(
+      "backup",
+      `Admin restore report failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+  return "admin";
+}

package/src/core/backup/restore.ts

@@ -4,7 +4,7 @@
  * The rules that make this safe to run on a live home directory:
  *
  *   1. Verify before you touch anything. The manifest's signature is
- *      checked (restore-guard.ts), then every part's sha256 and — for
+ *      checked (restore/guard.ts), then every part's sha256 and — for
  *      encrypted parts — every record's tag; a part that fails is a
  *      stopped restore, not a half-applied one.
  *   2. Stage, then swap. The archive is extracted into a staging
@@ -55,7 +55,7 @@ import {
   authenticateManifest,
   makePrivate,
   type ManifestTrust,
-} from "./restore-guard.js";
+} from "./restore/guard.js";
 import { buildSnapshot } from "./snapshot.js";
 import {
   relocateRoot,
@@ -84,6 +84,12 @@ export type RestorePending = {
   requestedAt: number;
   /** Chat key that asked, so the boot can report back. */
   requestedBy?: string;
+  /**
+   * Frontend the request came from ("telegram", "discord", "native"), so
+   * the report goes back the way it came. Absent in files staged before
+   * it was recorded — the boot then infers it from `requestedBy`.
+   */
+  frontend?: string;
 };
 
 export type RestoreReport = {
@@ -507,7 +513,7 @@ export type RestoreOptions = {
   beforeApply?: () => void | Promise<void>;
   /** Skip the automatic pre-restore checkpoint (it has already been taken). */
   skipCheckpoint?: boolean;
-  /** Restore a manifest that carries no signature (see restore-guard.ts). */
+  /** Restore a manifest that carries no signature (see restore/guard.ts). */
   allowUnauthenticated?: ManifestTrust["allowUnauthenticated"];
   /**
    * Restoring onto a different machine: relocate the session stores and
@@ -641,7 +647,9 @@ export async function applyPendingRestore(options: {
   settings: BackupSettings;
   home?: string;
   beforeApply?: () => void | Promise<void>;
-}): Promise<(RestoreReport & { requestedBy?: string }) | null> {
+}): Promise<
+  (RestoreReport & { requestedBy?: string; frontend?: string }) | null
+> {
   const home = options.home ?? dirs.root;
   const pending = await readRestorePending(home);
   if (!pending) return null;
@@ -654,7 +662,11 @@ export async function applyPendingRestore(options: {
       beforeApply: options.beforeApply,
     });
     await clearRestorePending(home);
-    return { ...report, requestedBy: pending.requestedBy };
+    return {
+      ...report,
+      requestedBy: pending.requestedBy,
+      frontend: pending.frontend,
+    };
   } catch (err) {
     logWarn("backup", `Staged restore of ${pending.id} failed: ${String(err)}`);
     await clearRestorePending(home);