instar 0.28.51 → 0.28.53

package/dashboard/index.html

@@ -2414,6 +2414,7 @@
           <button class="tab" data-tab="features" onclick="switchTab('features')">Features</button>
           <button class="tab" data-tab="systems" onclick="switchTab('systems')">Health</button>
           <button class="tab" data-tab="integrated-being" onclick="switchTab('integrated-being')">Integrated-Being</button>
+          <button class="tab" data-tab="pr-pipeline" onclick="switchTab('pr-pipeline')">PR Pipeline</button>
         </nav>
       </div>
       <div class="vital-signs" id="vitalSigns">
@@ -2731,6 +2732,51 @@
         </div>
         <pre id="ibChainResult" style="margin-top:10px;max-height:200px;overflow:auto;font-size:11px"></pre>
       </div>
+
+      <!-- Bindings subtab (slice 7) -->
+      <div id="ibBindingsSection" style="background:var(--panel);border-radius:8px;border:1px solid var(--border);padding:12px;display:none">
+        <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:8px">
+          <div style="font-size:13px;font-weight:600">Session bindings (v2)</div>
+          <button onclick="loadIntegratedBeingBindings()" style="padding:4px 10px;font-size:11px">Refresh</button>
+        </div>
+        <div id="ibBindingsNotice" style="font-size:11px;color:var(--text-dim);margin-bottom:8px">
+          Each registered session has a binding token. Revoke to invalidate it — subsequent writes from that session fail 401. Revocation is logged as a subsystem-asserted note.
+        </div>
+        <table style="width:100%;border-collapse:collapse;font-size:11px">
+          <thead>
+            <tr style="background:var(--bg-alt)">
+              <th style="text-align:left;padding:6px">Session ID</th>
+              <th style="text-align:left;padding:6px">Label</th>
+              <th style="text-align:left;padding:6px">Registered</th>
+              <th style="text-align:left;padding:6px">Last active</th>
+              <th style="text-align:left;padding:6px">Absolute TTL</th>
+              <th style="text-align:left;padding:6px">Status</th>
+              <th style="text-align:left;padding:6px">Action</th>
+            </tr>
+          </thead>
+          <tbody id="ibBindingsTbody">
+            <tr><td colspan="7" style="padding:14px;color:var(--text-dim);text-align:center">Loading…</td></tr>
+          </tbody>
+        </table>
+      </div>
+    </div>
+
+    <!-- PR Pipeline Tab (PR-REVIEW-HARDENING-SPEC Phase A) -->
+    <!-- Read-only: NO action buttons that mutate eligibility. All PR-authored -->
+    <!-- content rendered via textContent, never innerHTML — XSS defense rule -->
+    <!-- for the dashboard per spec §"Dashboard surface rules". -->
+    <div id="prPipelinePanel" style="display:none;flex-direction:column;padding:20px;gap:16px;overflow-y:auto">
+      <div style="display:flex;justify-content:space-between;align-items:center">
+        <h2 style="margin:0">PR Pipeline</h2>
+        <div>
+          <button onclick="loadPrPipeline()" style="padding:6px 12px">Refresh</button>
+        </div>
+      </div>
+      <div id="prPipelinePhaseNotice" style="font-size:12px;color:var(--text-dim)"></div>
+      <div id="prPipelineEmpty" style="padding:40px;text-align:center;color:var(--text-dim);display:none">
+        No PR activity to display.
+      </div>
+      <div id="prPipelineList" style="display:flex;flex-direction:column;gap:12px"></div>
     </div>
 
     <!-- Health Tab (was Systems) -->
@@ -3754,9 +3800,15 @@
         id: 'integrated-being',
         panels: ['integratedBeingPanel'],
         display: ['flex'],
-        onActivate: () => { if (typeof loadIntegratedBeing === 'function') loadIntegratedBeing(); if (typeof startIntegratedBeingPoll === 'function') startIntegratedBeingPoll(); },
+        onActivate: () => { if (typeof loadIntegratedBeing === 'function') loadIntegratedBeing(); if (typeof loadIntegratedBeingBindings === 'function') loadIntegratedBeingBindings(); if (typeof startIntegratedBeingPoll === 'function') startIntegratedBeingPoll(); },
         onDeactivate: () => { if (typeof stopIntegratedBeingPoll === 'function') stopIntegratedBeingPoll(); },
       },
+      {
+        id: 'pr-pipeline',
+        panels: ['prPipelinePanel'],
+        display: ['flex'],
+        onActivate: () => { if (typeof loadPrPipeline === 'function') loadPrPipeline(); },
+      },
     ];
 
     function switchTab(tabName) {
@@ -5545,6 +5597,108 @@
       }
     }
 
+    // ── PR Pipeline Tab (PR-REVIEW-HARDENING-SPEC Phase A) ───────
+    //
+    // Fetches /pr-gate/metrics on panel activation and renders the
+    // current pipeline state. Hard rules (enforced structurally here):
+    //   - NO action buttons that mutate eligibility (read-only tab).
+    //   - NO innerHTML — all PR content goes through textContent.
+    //   - NO form submissions to /pr-gate/* endpoints.
+    //   - On 404 (prGate.phase='off' — commit 8), render a disabled
+    //     placeholder rather than erroring.
+    async function loadPrPipeline() {
+      const list = document.getElementById('prPipelineList');
+      const notice = document.getElementById('prPipelinePhaseNotice');
+      const empty = document.getElementById('prPipelineEmpty');
+      // Reset view via DOM mutation, not innerHTML, to keep the
+      // "never inject content as HTML" invariant trivially true.
+      while (list.firstChild) list.removeChild(list.firstChild);
+      notice.textContent = 'Loading…';
+      empty.style.display = 'none';
+
+      // Use raw fetch (not apiFetch) so we can distinguish 404 (gate
+      // disabled, expected during phase=off) from other errors without
+      // apiFetch's throw-on-non-ok behavior.
+      let res = null;
+      let httpStatus = 0;
+      try {
+        const raw = await fetch('/pr-gate/metrics', {
+          headers: { 'Authorization': `Bearer ${token}` },
+        });
+        httpStatus = raw.status;
+        if (raw.ok) res = await raw.json();
+      } catch {
+        res = null;
+      }
+
+      if (httpStatus === 404 || (res && res.disabled === true)) {
+        notice.textContent = 'Gate disabled (phase=off). No pipeline activity recorded yet.';
+        empty.style.display = 'block';
+        return;
+      }
+      if (!res) {
+        notice.textContent = 'PR Pipeline metrics unavailable. Endpoint did not respond.';
+        empty.style.display = 'block';
+        return;
+      }
+
+      const phase = typeof res.phase === 'string' ? res.phase : 'unknown';
+      notice.textContent = `Phase: ${phase}`;
+
+      const entries = Array.isArray(res.entries) ? res.entries : [];
+      if (entries.length === 0) {
+        empty.style.display = 'block';
+        return;
+      }
+
+      for (const entry of entries) {
+        const card = document.createElement('div');
+        card.style.background = 'var(--panel)';
+        card.style.padding = '12px';
+        card.style.borderRadius = '6px';
+        card.style.border = '1px solid var(--border)';
+
+        const header = document.createElement('div');
+        header.style.display = 'flex';
+        header.style.justifyContent = 'space-between';
+        header.style.marginBottom = '6px';
+
+        const left = document.createElement('div');
+        left.style.fontWeight = '600';
+        const pr = typeof entry.pr_number === 'number' ? `PR #${entry.pr_number}` : 'PR #—';
+        const sha = typeof entry.head_sha === 'string' ? ` @ ${entry.head_sha.slice(0, 8)}` : '';
+        left.textContent = pr + sha;
+
+        const right = document.createElement('div');
+        right.style.fontSize = '12px';
+        right.style.color = entry.eligible ? 'var(--accent)' : 'var(--text-dim)';
+        right.textContent = entry.eligible ? 'eligible' : 'not eligible';
+
+        header.appendChild(left);
+        header.appendChild(right);
+        card.appendChild(header);
+
+        if (typeof entry.reason === 'string' && entry.reason.length > 0) {
+          const reason = document.createElement('div');
+          reason.style.fontSize = '13px';
+          reason.style.color = 'var(--text-dim)';
+          reason.textContent = entry.reason;
+          card.appendChild(reason);
+        }
+
+        if (typeof entry.created_at === 'string') {
+          const time = document.createElement('div');
+          time.style.fontSize = '11px';
+          time.style.color = 'var(--text-dim)';
+          time.style.marginTop = '4px';
+          time.textContent = entry.created_at;
+          card.appendChild(time);
+        }
+
+        list.appendChild(card);
+      }
+    }
+
     // ── Integrated-Being Tab (v1) ────────────────────────────────
     let integratedBeingPollTimer = null;
 
@@ -5568,16 +5722,98 @@
           if (entries.length === 0) {
             tbody.innerHTML = '<tr><td colspan="7" style="padding:14px;color:var(--text-dim);text-align:center">No entries</td></tr>';
           } else {
-            tbody.innerHTML = entries.map(e => `
+            // Build a map of commitmentId → effective-status derivation
+            // from supersession pointers: if a later note with subject
+            // starting "expired:" or "stranded:" or "resolved:"/"cancelled:"
+            // points back at a commitment, that commitment's effective
+            // status flips to the supersession. (Slice 5 + slice 6.)
+            const supersessionByTarget = new Map();
+            for (const ent of entries) {
+              if (ent.supersedes) {
+                const existing = supersessionByTarget.get(ent.supersedes);
+                // Prefer most-recent note with a lifecycle prefix.
+                if (!existing || new Date(ent.t) > new Date(existing.t)) {
+                  supersessionByTarget.set(ent.supersedes, ent);
+                }
+              }
+            }
+            const disputeCountByTarget = new Map();
+            for (const ent of entries) {
+              if (ent.disputes) {
+                disputeCountByTarget.set(
+                  ent.disputes,
+                  (disputeCountByTarget.get(ent.disputes) || 0) + 1,
+                );
+              }
+            }
+            const esc2 = (s) => esc(String(s == null ? '' : s));
+            const badge = (label, bg, fg) =>
+              `<span style="display:inline-block;padding:1px 6px;font-size:10px;border-radius:3px;background:${bg};color:${fg};margin-right:4px">${esc2(label)}</span>`;
+            tbody.innerHTML = entries.map(e => {
+              const ts = (e.t || '').slice(0, 19).replace('T', ' ');
+              let subjectCell = esc2(e.subject);
+              let kindCell = esc2(e.kind);
+              // Commitment-kind enrichment (slice 6): badges for mechanism
+              // type, deadline w/ overdue highlight, refStatus, and any
+              // derived effective-status from the supersession chain.
+              if (e.kind === 'commitment' && e.commitment) {
+                const mech = e.commitment.mechanism || {};
+                const mechBg = mech.type === 'passive-wait' ? '#d4a017' : '#4a6a8a';
+                kindCell = badge('commitment', '#6a4a8a', '#fff')
+                  + badge(mech.type || '(?)', mechBg, '#fff');
+                if (mech.refStatus && mech.refStatus !== 'valid') {
+                  kindCell += badge('ref:' + mech.refStatus, '#888', '#fff');
+                }
+                if (e.commitment.deadline) {
+                  const dlMs = Date.parse(e.commitment.deadline);
+                  const overdue = !Number.isNaN(dlMs) && dlMs < Date.now();
+                  const dlLabel = (e.commitment.deadline || '').slice(0, 16).replace('T', ' ');
+                  subjectCell += '<div style="font-size:11px;color:'
+                    + (overdue ? '#e74c3c' : 'var(--text-dim)')
+                    + ';margin-top:2px">'
+                    + (overdue ? '⚠ overdue ' : 'due ')
+                    + esc2(dlLabel)
+                    + '</div>';
+                }
+                // Effective status from supersession chain.
+                const superseder = supersessionByTarget.get(e.id);
+                if (superseder && typeof superseder.subject === 'string') {
+                  const s = superseder.subject;
+                  let statusLabel = 'resolved';
+                  let statusBg = '#27ae60';
+                  if (s.startsWith('expired:')) { statusLabel = 'expired'; statusBg = '#e74c3c'; }
+                  else if (s.startsWith('stranded:')) { statusLabel = 'stranded'; statusBg = '#e67e22'; }
+                  else if (s.startsWith('cancelled:')) { statusLabel = 'cancelled'; statusBg = '#7f8c8d'; }
+                  subjectCell = badge(statusLabel, statusBg, '#fff') + subjectCell;
+                }
+                const disputes = disputeCountByTarget.get(e.id) || 0;
+                if (disputes > 0) {
+                  subjectCell = badge('disputed × ' + disputes, '#c0392b', '#fff') + subjectCell;
+                }
+              } else if (e.kind === 'note' && e.disputes) {
+                // Dispute note — highlight the disputes-pointer.
+                kindCell = badge('note', '#444', '#fff') + badge('dispute', '#c0392b', '#fff');
+              } else if (e.kind === 'note' && typeof e.subject === 'string' && e.subject.startsWith('expired:')) {
+                kindCell = badge('note', '#444', '#fff') + badge('expired', '#e74c3c', '#fff');
+              } else if (e.kind === 'note' && typeof e.subject === 'string' && e.subject.startsWith('stranded:')) {
+                kindCell = badge('note', '#444', '#fff') + badge('stranded', '#e67e22', '#fff');
+              }
+              const ptr = e.supersedes
+                ? 'supersedes:' + e.supersedes
+                : e.disputes
+                ? 'disputes:' + e.disputes
+                : '';
+              return `
               <tr style="border-top:1px solid var(--border)">
-                <td style="padding:6px;font-family:monospace">${esc(e.id)}</td>
-                <td style="padding:6px">${esc((e.t || '').slice(0, 19).replace('T', ' '))}</td>
-                <td style="padding:6px">${esc(e.kind)}</td>
-                <td style="padding:6px">${esc(e.subject)}</td>
-                <td style="padding:6px">${esc(e.counterparty?.type)}/${esc(e.counterparty?.name)}</td>
-                <td style="padding:6px;font-size:11px;color:var(--text-dim)">${esc(e.provenance)}${e.source ? ' · '+esc(e.source):''}</td>
-                <td style="padding:6px;font-family:monospace;font-size:11px">${esc(e.supersedes || '')}</td>
-              </tr>`).join('');
+                <td style="padding:6px;font-family:monospace">${esc2(e.id)}</td>
+                <td style="padding:6px">${esc2(ts)}</td>
+                <td style="padding:6px">${kindCell}</td>
+                <td style="padding:6px">${subjectCell}</td>
+                <td style="padding:6px">${esc2(e.counterparty?.type)}/${esc2(e.counterparty?.name)}</td>
+                <td style="padding:6px;font-size:11px;color:var(--text-dim)">${esc2(e.provenance)}${e.source ? ' · '+esc2(e.source):''}</td>
+                <td style="padding:6px;font-family:monospace;font-size:11px">${esc2(ptr)}</td>
+              </tr>`;
+            }).join('');
           }
         }
         if (statsRes) {
@@ -5599,9 +5835,82 @@
       }
     }
 
+    async function loadIntegratedBeingBindings() {
+      // GET /shared-state/sessions returns 503 when v2Enabled=false.
+      // In that case, keep the Bindings section hidden.
+      const section = document.getElementById('ibBindingsSection');
+      const tbody = document.getElementById('ibBindingsTbody');
+      try {
+        const res = await apiFetch('/shared-state/sessions').catch(() => null);
+        if (!res || !Array.isArray(res.sessions)) {
+          if (section) section.style.display = 'none';
+          return;
+        }
+        if (section) section.style.display = 'block';
+        if (res.sessions.length === 0) {
+          tbody.innerHTML = '<tr><td colspan="7" style="padding:14px;color:var(--text-dim);text-align:center">No sessions registered</td></tr>';
+          return;
+        }
+        const nowMs = Date.now();
+        const esc2 = (s) => esc(String(s == null ? '' : s));
+        tbody.innerHTML = res.sessions.map(s => {
+          const ttlMs = Date.parse(s.absoluteExpiresAt || '') - nowMs;
+          const ttlLabel = Number.isFinite(ttlMs)
+            ? (ttlMs < 0 ? 'expired' : Math.round(ttlMs / 3600000) + 'h')
+            : '';
+          const status = s.revoked
+            ? '<span style="color:#e74c3c">revoked</span>'
+            : (Date.parse(s.absoluteExpiresAt || '') < nowMs
+              ? '<span style="color:#888">expired</span>'
+              : (s.hasWritten ? '<span style="color:#27ae60">active</span>' : '<span style="color:var(--text-dim)">bound</span>'));
+          const idShort = (s.sessionId || '').slice(0, 8) + '…';
+          const action = s.revoked
+            ? '<span style="color:var(--text-dim);font-size:10px">—</span>'
+            : `<button onclick="revokeIntegratedBeingBinding('${esc2(s.sessionId)}')" style="padding:2px 8px;font-size:10px;background:#c0392b;color:#fff;border:none;border-radius:3px;cursor:pointer">Revoke</button>`;
+          return `
+            <tr style="border-top:1px solid var(--border)">
+              <td style="padding:4px;font-family:monospace" title="${esc2(s.sessionId)}">${esc2(idShort)}</td>
+              <td style="padding:4px">${esc2(s.label || '')}</td>
+              <td style="padding:4px">${esc2((s.registeredAt || '').slice(0, 16).replace('T', ' '))}</td>
+              <td style="padding:4px">${esc2((s.lastActiveAt || '').slice(0, 16).replace('T', ' '))}</td>
+              <td style="padding:4px">${esc2(ttlLabel)}</td>
+              <td style="padding:4px">${status}</td>
+              <td style="padding:4px">${action}</td>
+            </tr>`;
+        }).join('');
+      } catch (err) {
+        console.error('[integrated-being-v2] bindings load error', err);
+        if (section) section.style.display = 'none';
+      }
+    }
+
+    async function revokeIntegratedBeingBinding(sid) {
+      if (!sid) return;
+      if (!confirm('Revoke the binding for session ' + sid.slice(0, 8) + '…?\n\nThis invalidates the session token. Subsequent writes from that session will fail 401.')) return;
+      try {
+        const res = await apiFetch(`/shared-state/sessions/${encodeURIComponent(sid)}/revoke`, {
+          method: 'POST',
+          headers: { 'X-Instar-Request': '1' },
+        });
+        if (res && res.revoked) {
+          await loadIntegratedBeingBindings();
+          await loadIntegratedBeing();
+        } else {
+          alert('Revocation did not succeed — see console for details.');
+          console.warn('[integrated-being-v2] revoke unexpected', res);
+        }
+      } catch (err) {
+        console.error('[integrated-being-v2] revoke error', err);
+        alert('Revoke failed: ' + (err && err.message ? err.message : err));
+      }
+    }
+
     function startIntegratedBeingPoll() {
       if (integratedBeingPollTimer) return;
-      integratedBeingPollTimer = setInterval(loadIntegratedBeing, 30000);
+      integratedBeingPollTimer = setInterval(() => {
+        loadIntegratedBeing();
+        loadIntegratedBeingBindings();
+      }, 30000);
     }
     function stopIntegratedBeingPoll() {
       if (integratedBeingPollTimer) {

package/dist/cli.js

@@ -1557,13 +1557,22 @@ const migrateCmd = program
 // /shared-state/render injection after an update.
 migrateCmd
     .command('sync-session-hook')
-    .description('Sync .claude/hooks/instar/session-start.sh with the latest template (Integrated-Being v1)')
+    .description('Sync .claude/hooks/instar/session-start.sh with the latest template (Integrated-Being v1 + v2)')
     .option('-d, --dir <path>', 'Project directory')
     .option('--force', 'Overwrite a divergent local hook')
+    .option('--v2-mode <mode>', 'v2 migration mode: "inject" (update only v2 section, preserve customizations) or "overwrite" (replace entire hook, save backup)')
     .action(async (opts) => {
     try {
+        if (opts.v2Mode && opts.v2Mode !== 'inject' && opts.v2Mode !== 'overwrite') {
+            console.error(JSON.stringify({ error: '--v2-mode must be "inject" or "overwrite"' }));
+            process.exit(2);
+        }
         const { syncSessionHook } = await import('./commands/migrate.js');
-        const result = await syncSessionHook(opts);
+        const result = await syncSessionHook({
+            dir: opts.dir,
+            force: opts.force,
+            v2Mode: opts.v2Mode,
+        });
         console.log(JSON.stringify(result));
     }
     catch (err) {
@@ -1898,5 +1907,45 @@ playbookCmd
     const { playbookUserAudit } = await import('./commands/playbook.js');
     return playbookUserAudit(userId, opts);
 });
+// ── `instar gate` — UnjustifiedStopGate operator tooling (PR4) ──────
+const gateCmd = program
+    .command('gate')
+    .description('Operator tooling for the UnjustifiedStopGate (context-death-pitfall-prevention)');
+gateCmd
+    .command('status')
+    .description('Show gate mode, kill-switch state, autonomous flag')
+    .option('-d, --dir <path>', 'Project directory')
+    .action(async (opts) => {
+    const { gateStatus } = await import('./commands/gate.js');
+    return gateStatus(opts);
+});
+gateCmd
+    .command('set <subject>')
+    .description('Set a gate mode. Subjects: unjustified-stop')
+    .requiredOption('--mode <mode>', 'off | shadow | enforce')
+    .option('-d, --dir <path>', 'Project directory')
+    .action(async (subject, opts) => {
+    const { gateSet } = await import('./commands/gate.js');
+    return gateSet(subject, opts);
+});
+gateCmd
+    .command('kill-switch')
+    .description('Set or clear the gate kill-switch (fast-path allow-everything override)')
+    .option('--set', 'Set the kill-switch (all evaluations short-circuit to allow)')
+    .option('--clear', 'Clear the kill-switch (restore normal evaluation)')
+    .option('-d, --dir <path>', 'Project directory')
+    .action(async (opts) => {
+    const { gateKillSwitch } = await import('./commands/gate.js');
+    return gateKillSwitch(opts);
+});
+gateCmd
+    .command('log')
+    .description('Show the most recent gate evaluation events')
+    .option('--tail <n>', 'Number of events to show (default 20)')
+    .option('-d, --dir <path>', 'Project directory')
+    .action(async (opts) => {
+    const { gateLog } = await import('./commands/gate.js');
+    return gateLog(opts);
+});
 program.parse();
 //# sourceMappingURL=cli.js.map