instar 0.7.53 → 0.8.0

package/dist/core/AutoUpdater.js

@@ -54,11 +54,17 @@ export class AutoUpdater {
         if (this.interval)
             return;
         const intervalMs = this.config.checkIntervalMinutes * 60 * 1000;
-        // Warn if running from npx cache (auto-updates won't work properly)
+        // Detect npx cache — auto-apply and restart cause infinite loops when
+        // running from npx because the cache still resolves to the old version
+        // after npm installs the update. The restart finds the update again,
+        // applies it again, restarts again — forever, killing all sessions each time.
         const scriptPath = process.argv[1] || '';
-        if (scriptPath.includes('.npm/_npx') || scriptPath.includes('/_npx/')) {
-            console.warn('[AutoUpdater] WARNING: Running from npx cache. Auto-updates require a global install.\n' +
-                '[AutoUpdater] Run: npm install -g instar');
+        const runningFromNpx = scriptPath.includes('.npm/_npx') || scriptPath.includes('/_npx/');
+        if (runningFromNpx) {
+            this.config.autoApply = false;
+            this.config.autoRestart = false;
+            console.warn('[AutoUpdater] Running from npx cache. Auto-apply and auto-restart disabled to prevent restart loops.\n' +
+                '[AutoUpdater] Run: npm install -g instar  (then restart with: instar server start)');
         }
         console.log(`[AutoUpdater] Started (every ${this.config.checkIntervalMinutes}m, ` +
             `autoApply: ${this.config.autoApply}, autoRestart: ${this.config.autoRestart})`);

package/dist/core/SessionManager.d.ts

@@ -102,9 +102,10 @@ export declare class SessionManager extends EventEmitter {
     injectTelegramMessage(tmuxSession: string, topicId: number, text: string): void;
     /**
      * Send text to a tmux session via send-keys.
-     * For single-line text, uses -l (literal) flag directly.
-     * For multi-line text, writes to a temp file and uses tmux load-buffer/paste-buffer
-     * to avoid newlines being interpreted as Enter keypresses.
+     * For multi-line text, uses bracketed paste mode escape sequences so the
+     * terminal treats newlines as literal text rather than Enter keypresses.
+     * This avoids tmux load-buffer/paste-buffer which trigger macOS TCC
+     * "access data from other apps" permission prompts.
      */
     private injectMessage;
     /**

package/dist/core/SessionManager.js

@@ -470,29 +470,30 @@ export class SessionManager extends EventEmitter {
     }
     /**
      * Send text to a tmux session via send-keys.
-     * For single-line text, uses -l (literal) flag directly.
-     * For multi-line text, writes to a temp file and uses tmux load-buffer/paste-buffer
-     * to avoid newlines being interpreted as Enter keypresses.
+     * For multi-line text, uses bracketed paste mode escape sequences so the
+     * terminal treats newlines as literal text rather than Enter keypresses.
+     * This avoids tmux load-buffer/paste-buffer which trigger macOS TCC
+     * "access data from other apps" permission prompts.
      */
     injectMessage(tmuxSession, text) {
         const exactTarget = `=${tmuxSession}:`;
         try {
             if (text.includes('\n')) {
-                // Multi-line: pipe into tmux load-buffer via stdin, then paste into pane.
-                // This avoids newlines being treated as Enter keypresses which would
-                // fragment the message into multiple Claude prompts.
-                // Uses stdin pipe (load-buffer -) instead of temp files to avoid
-                // macOS TCC "access data from other apps" permission prompts.
-                execFileSync(this.config.tmuxPath, ['load-buffer', '-'], {
-                    encoding: 'utf-8', timeout: 5000, input: text,
+                // Multi-line: use bracketed paste mode.
+                // The terminal (and Claude Code's readline) treats everything between
+                // \e[200~ and \e[201~ as a single paste — newlines are literal, not Enter.
+                // This completely avoids load-buffer/paste-buffer and their TCC prompts.
+                execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, '\x1b[200~'], {
+                    encoding: 'utf-8', timeout: 5000,
+                });
+                execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, '-l', text], {
+                    encoding: 'utf-8', timeout: 5000,
                 });
-                execFileSync(this.config.tmuxPath, ['paste-buffer', '-t', exactTarget, '-p'], {
+                execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, '\x1b[201~'], {
                     encoding: 'utf-8', timeout: 5000,
                 });
-                // Brief delay to let the terminal process the paste before sending Enter.
-                // Without this, the Enter arrives before paste processing completes and
-                // the message sits in the input buffer without being submitted.
-                execFileSync('/bin/sleep', ['0.3'], { timeout: 2000 });
+                // Brief delay to let the terminal process the bracketed paste
+                execFileSync('/bin/sleep', ['0.1'], { timeout: 2000 });
                 // Send Enter to submit
                 execFileSync(this.config.tmuxPath, ['send-keys', '-t', exactTarget, 'Enter'], {
                     encoding: 'utf-8', timeout: 5000,

package/dist/server/AgentServer.d.ts

@@ -3,6 +3,9 @@
  *
  * Provides health checks, session management, job triggering,
  * and event querying over a simple REST API.
+ *
+ * Also serves the dashboard UI at /dashboard and handles
+ * WebSocket connections for real-time terminal streaming.
  */
 import { type Express } from 'express';
 import type { SessionManager } from '../core/SessionManager.js';
@@ -25,8 +28,11 @@ import type { SessionWatchdog } from '../monitoring/SessionWatchdog.js';
 export declare class AgentServer {
     private app;
     private server;
+    private wsManager;
     private config;
     private startTime;
+    private sessionManager;
+    private state;
     constructor(options: {
         config: InstarConfig;
         sessionManager: SessionManager;
@@ -46,6 +52,12 @@ export declare class AgentServer {
         evolution?: EvolutionManager;
         watchdog?: SessionWatchdog;
     });
+    /**
+     * Resolve the dashboard directory.
+     * In dev: ../../../dashboard (relative to src/server/)
+     * In dist (published): ../../dashboard (relative to dist/server/)
+     */
+    private resolveDashboardDir;
     /**
      * Start the HTTP server.
      */

package/dist/server/AgentServer.js

@@ -3,22 +3,41 @@
  *
  * Provides health checks, session management, job triggering,
  * and event querying over a simple REST API.
+ *
+ * Also serves the dashboard UI at /dashboard and handles
+ * WebSocket connections for real-time terminal streaming.
  */
 import express from 'express';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { createRoutes } from './routes.js';
 import { corsMiddleware, authMiddleware, requestTimeout, errorHandler } from './middleware.js';
+import { WebSocketManager } from './WebSocketManager.js';
 export class AgentServer {
     app;
     server = null;
+    wsManager = null;
     config;
     startTime;
+    sessionManager;
+    state;
     constructor(options) {
         this.config = options.config;
         this.startTime = new Date();
+        this.sessionManager = options.sessionManager;
+        this.state = options.state;
         this.app = express();
         // Middleware
         this.app.use(express.json({ limit: '1mb' }));
         this.app.use(corsMiddleware);
+        // Dashboard static files — served BEFORE auth middleware so the page loads
+        // without a token. Auth happens via WebSocket/API calls from the page itself.
+        const dashboardDir = this.resolveDashboardDir();
+        this.app.get('/dashboard', (_req, res) => {
+            res.sendFile(path.join(dashboardDir, 'index.html'));
+        });
+        this.app.use('/dashboard', express.static(dashboardDir));
         this.app.use(authMiddleware(options.config.authToken));
         this.app.use(requestTimeout(options.config.requestTimeoutMs));
         // Routes
@@ -46,6 +65,23 @@ export class AgentServer {
         // Error handler (must be last)
         this.app.use(errorHandler);
     }
+    /**
+     * Resolve the dashboard directory.
+     * In dev: ../../../dashboard (relative to src/server/)
+     * In dist (published): ../../dashboard (relative to dist/server/)
+     */
+    resolveDashboardDir() {
+        const thisDir = path.dirname(fileURLToPath(import.meta.url));
+        // Try dist layout first (package root/dashboard)
+        const fromDist = path.resolve(thisDir, '..', '..', 'dashboard');
+        // Try dev layout (src/server -> project root/dashboard)
+        const fromSrc = path.resolve(thisDir, '..', '..', '..', 'dashboard');
+        if (fs.existsSync(fromDist))
+            return fromDist;
+        if (fs.existsSync(fromSrc))
+            return fromSrc;
+        return fromDist;
+    }
     /**
      * Start the HTTP server.
      */
@@ -54,6 +90,14 @@ export class AgentServer {
             const host = this.config.host || '127.0.0.1';
             this.server = this.app.listen(this.config.port, host, () => {
                 console.log(`[instar] Server listening on ${host}:${this.config.port}`);
+                console.log(`[instar] Dashboard: http://${host}:${this.config.port}/dashboard`);
+                // Initialize WebSocket manager after server is listening
+                this.wsManager = new WebSocketManager({
+                    server: this.server,
+                    sessionManager: this.sessionManager,
+                    state: this.state,
+                    authToken: this.config.authToken,
+                });
                 resolve();
             });
             this.server.on('error', (err) => {
@@ -71,6 +115,11 @@ export class AgentServer {
      * Closes keep-alive connections after a timeout to prevent hanging.
      */
     async stop() {
+        // Shutdown WebSocket manager first
+        if (this.wsManager) {
+            this.wsManager.shutdown();
+            this.wsManager = null;
+        }
         return new Promise((resolve) => {
             if (!this.server) {
                 resolve();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "0.7.53",
+  "version": "0.8.0",
   "description": "Persistent autonomy infrastructure for AI agents",
   "type": "module",
   "main": "dist/index.js",