instar 1.2.45 → 1.2.47

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkQH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAiqDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAglLtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkQH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAiqDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuoLtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -2152,7 +2152,20 @@ export async function startServer(options) {
         // backwards-compat; INSTAR_FRAMEWORK=codex-cli routes through Codex.
         try {
             const { buildIntelligenceProvider, frameworkFromEnv } = await import('../core/intelligenceProviderFactory.js');
-            const framework = frameworkFromEnv() ?? 'claude-code';
+            // _defaultFramework is what the Telegram spawn path uses for any topic
+            // without an explicit per-topic override (resolveTopicFramework returns
+            // it). It MUST come from the agent's resolved runtime framework
+            // (config.sessions.framework — derived at load from
+            // sessions.framework | enabledFrameworks[0] | INSTAR_FRAMEWORK), NOT from
+            // INSTAR_FRAMEWORK alone. Before this fix it was `frameworkFromEnv() ??
+            // 'claude-code'`, so a codex-cli-only agent that didn't set the
+            // INSTAR_FRAMEWORK env var (the common case — the wizard sets
+            // enabledFrameworks, not the env) silently defaulted to claude-code and
+            // spawned a CLAUDE session on every Telegram message. The fresh-spawn
+            // path (spawnInteractiveSession's internal resolution) already read
+            // config.framework correctly; this aligns the Telegram path with it so
+            // both doors agree. See specs/dev-infrastructure/framework-spawn-portability.md.
+            const framework = config.sessions?.framework ?? frameworkFromEnv() ?? 'claude-code';
             resolvedFramework = framework;
             _defaultFramework = framework;
             _topicFrameworks = config.topicFrameworks ?? {};
@@ -4415,6 +4428,37 @@ export async function startServer(options) {
                 port: config.port,
                 stateDir: config.stateDir,
             });
+            // Wire credential rotation (tunnel-failure-resilience spec Part 6).
+            // The manager owns WHEN to rotate (every terminal exit from
+            // relay-active + boot-recovery); this closure owns WHAT: regenerate
+            // the dashboard PIN + authToken, persist them, and DM the owner the
+            // new PIN. Rotating authToken invalidates every previously-signed
+            // view URL and the dashboard session — the documented UX cost of
+            // having briefly routed private traffic through a third-party relay.
+            tunnel.setCredentialRotator(async () => {
+                const { randomUUID } = await import('node:crypto');
+                const newPin = String(Math.floor(100000 + Math.random() * 900000)); // 6-digit, matches startup gen
+                const newToken = randomUUID();
+                // Persist to config.json (survives restart; boot reads the new token)…
+                liveConfig.set('authToken', newToken);
+                liveConfig.set('dashboardPin', newPin);
+                // …and mutate the in-memory config the running server reads live,
+                // so the auth middleware + view-URL signing reject the old token
+                // and old signed links immediately, without a restart.
+                config.authToken = newToken;
+                config.dashboardPin = newPin;
+                console.log(pc.yellow('  [tunnel] rotated dashboard PIN + auth token after relay episode'));
+                if (telegram) {
+                    const msg = [
+                        `Security cleanup after the backup tunnel: I've rotated your dashboard PIN and access token.`,
+                        ``,
+                        `New dashboard PIN: ${newPin}`,
+                        ``,
+                        `Heads up: any dashboard tab you had open will need to sign in again with this new PIN, and any private view links you shared earlier no longer work. That's deliberate — it makes sure the backup operator can't reuse anything they may have seen while the backup was running.`,
+                    ].join('\n');
+                    await telegram.sendToOwnerDM(msg).catch(() => { });
+                }
+            });
         }
         // Set up evolution system (always enabled — the feedback loop infrastructure)
         const evolution = new EvolutionManager({
@@ -6720,6 +6764,15 @@ export async function startServer(options) {
             });
         }
         const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, proxyCoordinator, topicIntentStore, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, workingMemory, taskFlowRegistry, threadlineFlowBridge });
+        // Boot-recovery (tunnel-failure-resilience spec Part 6): if the agent
+        // died mid-relay-episode, the persisted tunnel.json carries
+        // rotationPending=true. Rotate the dashboard PIN + authToken BEFORE
+        // the server starts accepting API traffic, so a relay operator who saw
+        // the old credentials can't use them against the freshly-booted server.
+        if (tunnel && tunnel.lifecycleState.rotationPending) {
+            console.log(pc.yellow('  [tunnel] boot-recovery: relay episode was in flight at last shutdown — rotating credentials before serving'));
+            await tunnel.recoverPendingRotation();
+        }
         await server.start();
         void taskFlowSweeper;
         void taskFlowDueWaker;