instar 0.28.20 → 0.28.21

package/dist/server/routes.js

@@ -3593,7 +3593,7 @@ export function createRoutes(ctx) {
             res.status(400).json({ error: '"context" must be a string under 5KB if provided' });
             return;
         }
-        const validTypes = ['bug', 'feature', 'improvement', 'question', 'other'];
+        const validTypes = ['bug', 'feature', 'improvement', 'question', 'hallucination', 'other'];
         const feedbackType = validTypes.includes(type) ? type : 'other';
         // Semantic quality validation
         const quality = ctx.feedback.validateFeedbackQuality(title, description);
@@ -7265,7 +7265,10 @@ export function createRoutes(ctx) {
                 // Check if this message resolves a pending waitForReply request.
                 // Local delivery bypasses the relay client's gate-passed event, so we
                 // must check reply waiters here directly.
-                if (senderAgent && ctx.threadlineReplyWaiters.size > 0) {
+                // PR-3: resolve waiter by threadId (unique) rather than sender
+                // agent name (which may collide across multiple same-named agents).
+                const inboundThreadId = envelope.message?.threadId;
+                if (inboundThreadId && ctx.threadlineReplyWaiters.size > 0) {
                     let textContent;
                     const body = envelope.message?.body;
                     if (typeof body === 'string')
@@ -7275,21 +7278,35 @@ export function createRoutes(ctx) {
                     }
                     if (textContent) {
                         const isAutoAck = textContent.startsWith('Message received.') || textContent.startsWith('Message received,');
-                        const waiter = ctx.threadlineReplyWaiters.get(senderAgent);
+                        const waiter = ctx.threadlineReplyWaiters.get(inboundThreadId);
                         if (waiter && !isAutoAck) {
-                            console.log(`[relay-agent] Resolved reply waiter for ${senderAgent}`);
+                            console.log(`[relay-agent] Resolved reply waiter for thread ${inboundThreadId} (from ${senderAgent ?? 'unknown'})`);
                             waiter.resolve(textContent);
                         }
                     }
                 }
-                // If the message has a threadId and we have a ThreadlineRouter,
-                // route it through the threadline pipeline for session resume/spawn.
-                if (ctx.threadlineRouter && envelope.message?.threadId) {
-                    // Fire-and-forget — the relay is already accepted, threadline handling
-                    // is best-effort for session management.
-                    ctx.threadlineRouter.handleInboundMessage(envelope).catch(err => {
+                // If we have a ThreadlineRouter, route the message through it for
+                // session resume/spawn. We AWAIT the result so callers learn the real
+                // outcome (spawned / resumed / injected / handled:false). The message
+                // has already been accepted into the inbox, so we don't alter the HTTP
+                // status unless the router throws.
+                if (ctx.threadlineRouter) {
+                    try {
+                        const threadlineResult = await ctx.threadlineRouter.handleInboundMessage(envelope);
+                        res.json({ ok: true, threadline: threadlineResult });
+                        return;
+                    }
+                    catch (err) {
                         console.error('[routes] ThreadlineRouter handling error:', err);
-                    });
+                        res.json({
+                            ok: true,
+                            threadline: {
+                                handled: false,
+                                error: err instanceof Error ? err.message : 'Unknown error',
+                            },
+                        });
+                        return;
+                    }
                 }
                 res.json({ ok: true });
             }
@@ -7745,20 +7762,24 @@ export function createRoutes(ctx) {
     // ── Threadline Reply Waiter ─────────────────────────────────────────
     // Waits for an incoming reply from a specific agent on a specific thread.
     // Used by the relay-send endpoint when waitForReply is true.
-    function waitForThreadlineReply(routeCtx, senderAgent, _threadId, timeoutSec) {
+    function waitForThreadlineReply(routeCtx, senderAgent, threadId, timeoutSec) {
         const timeout = Math.min(Math.max(timeoutSec ?? 120, 5), 300) * 1000; // 5s–300s, default 120s
+        // PR-3: Waiters are keyed by threadId (unique per conversation) rather
+        // than sender agent name (which can collide when multiple agents share
+        // a name — e.g., two "luna" agents on different machines).
         return new Promise((resolve) => {
             const timer = setTimeout(() => {
-                routeCtx.threadlineReplyWaiters.delete(senderAgent);
+                routeCtx.threadlineReplyWaiters.delete(threadId);
                 resolve(null);
             }, timeout);
-            routeCtx.threadlineReplyWaiters.set(senderAgent, {
+            routeCtx.threadlineReplyWaiters.set(threadId, {
                 resolve: (reply) => {
                     clearTimeout(timer);
-                    routeCtx.threadlineReplyWaiters.delete(senderAgent);
+                    routeCtx.threadlineReplyWaiters.delete(threadId);
                     resolve(reply);
                 },
-                threadId: _threadId,
+                threadId,
+                senderAgent,
                 timer,
             });
         });
@@ -7782,7 +7803,10 @@ export function createRoutes(ctx) {
             return;
         }
         const msgId = `msg-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-        const effectiveThreadId = threadId ?? msgId;
+        // Mint a stable UUID threadId when caller didn't provide one so
+        // first-contact messages aren't dropped on the recipient side. Both
+        // sender and recipient will agree on this id going forward.
+        const effectiveThreadId = threadId ?? randomUUID();
         // ── Try local delivery first (same-machine agents) ──────────────
         // Read known-agents.json for local agent info. If the target is local,
         // deliver directly via their /messages/relay-agent endpoint, bypassing
@@ -7804,19 +7828,54 @@ export function createRoutes(ctx) {
                     }
                 }
                 const nameMatches = agents.filter(a => a.name === targetName || a.name?.toLowerCase() === targetName?.toLowerCase());
-                // If multiple same-named agents, disambiguate by fingerprint prefix
+                // PR-3: Fingerprint-based disambiguation. If multiple known agents
+                // share a name, require a `name:fpPrefix` qualifier to pick one.
+                // Previously this silently fell through to the relay, which then
+                // also usually failed — masking the root cause.
                 let localTarget = nameMatches.length === 1 ? nameMatches[0] : undefined;
                 if (nameMatches.length > 1 && targetFpPrefix) {
                     localTarget = nameMatches.find(a => {
                         const fp = a.fingerprint || a.publicKey?.substring(0, 32);
                         return fp?.toLowerCase().startsWith(targetFpPrefix);
                     });
+                    if (!localTarget) {
+                        res.status(409).json({
+                            success: false,
+                            error: `No agent named "${targetName}" matches fingerprint prefix "${targetFpPrefix}". Known: ${nameMatches.map(a => `${a.name}:${(a.fingerprint || a.publicKey || '').substring(0, 8)}`).join(', ')}`,
+                        });
+                        return;
+                    }
                 }
                 else if (nameMatches.length > 1 && !targetFpPrefix) {
-                    // Ambiguous — skip local delivery, let relay handle it
-                    localTarget = undefined;
+                    const hints = nameMatches.map(a => {
+                        const fp = (a.fingerprint || a.publicKey || '').substring(0, 8);
+                        return `"${a.name}:${fp}"`;
+                    }).join(', ');
+                    res.status(409).json({
+                        success: false,
+                        error: `Ambiguous target: ${nameMatches.length} known agents named "${targetName}". Use one of: ${hints}`,
+                    });
+                    return;
+                }
+                // PR-3: Self-guard by fingerprint when available, falling back to
+                // name comparison. This prevents self-delivery when the agent's
+                // name happens to match one of its own aliases in known-agents.json.
+                let isSelfTarget = localTarget?.name === ctx.config.projectName;
+                if (localTarget && !isSelfTarget) {
+                    try {
+                        const selfIdPath = path.join(ctx.config.stateDir, 'threadline', 'identity.json');
+                        if (fs.existsSync(selfIdPath)) {
+                            const selfId = JSON.parse(fs.readFileSync(selfIdPath, 'utf-8'));
+                            const selfFp = (selfId.fingerprint || '').toLowerCase();
+                            const targetFp = (localTarget.fingerprint || localTarget.publicKey?.substring(0, 32) || '').toLowerCase();
+                            if (selfFp && targetFp && selfFp === targetFp) {
+                                isSelfTarget = true;
+                            }
+                        }
+                    }
+                    catch { /* @silent-fallback-ok — identity.json read is best-effort */ }
                 }
-                if (localTarget?.port && localTarget.name !== ctx.config.projectName) {
+                if (localTarget?.port && !isSelfTarget) {
                     // Check if the local agent is actually running
                     try {
                         const healthResp = await fetch(`http://localhost:${localTarget.port}/threadline/health`, {
@@ -7874,7 +7933,20 @@ export function createRoutes(ctx) {
                                     signal: AbortSignal.timeout(10000),
                                 });
                                 if (localResp.ok) {
-                                    console.log(`[relay-send] Local delivery to ${localTarget.name}:${localTarget.port} (thread: ${effectiveThreadId})`);
+                                    let localRespBody = {};
+                                    try {
+                                        localRespBody = await localResp.json();
+                                    }
+                                    catch { /* no body */ }
+                                    const tl = localRespBody.threadline;
+                                    const outcome = tl?.injected ? 'injected into live session'
+                                        : tl?.spawned ? 'spawned new session'
+                                            : tl?.resumed ? 'resumed existing thread'
+                                                : tl?.gateDecision === 'queue-for-approval' ? 'queued for approval'
+                                                    : tl?.error ? `error: ${tl.error}`
+                                                        : tl?.handled === false ? 'queued (no live session)'
+                                                            : 'accepted';
+                                    console.log(`[relay-send] Local delivery to ${localTarget.name}:${localTarget.port} (thread: ${effectiveThreadId}) — ${outcome}`);
                                     if (waitForReply) {
                                         const reply = await waitForThreadlineReply(ctx, localTarget.name, effectiveThreadId, timeoutSeconds);
                                         res.json({
@@ -7883,6 +7955,8 @@ export function createRoutes(ctx) {
                                             threadId: effectiveThreadId,
                                             resolvedAgent: localTarget.name,
                                             deliveryPath: 'local',
+                                            deliveryOutcome: outcome,
+                                            threadline: tl,
                                             reply,
                                         });
                                     }
@@ -7893,6 +7967,8 @@ export function createRoutes(ctx) {
                                             threadId: effectiveThreadId,
                                             resolvedAgent: localTarget.name,
                                             deliveryPath: 'local',
+                                            deliveryOutcome: outcome,
+                                            threadline: tl,
                                         });
                                     }
                                     return;