instar 1.2.51 → 1.2.53

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkQH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAiqDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAksLtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoQH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAiqDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0xLtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -25,11 +25,13 @@ import { AgentServer } from '../server/AgentServer.js';
 import { TelegramAdapter, TOPIC_STYLE, selectTopicEmoji } from '../messaging/TelegramAdapter.js';
 import { RelationshipManager } from '../core/RelationshipManager.js';
 import { ClaudeCliIntelligenceProvider } from '../core/ClaudeCliIntelligenceProvider.js';
+import { isClaudeForbidden } from '../core/claudeForbiddenGuard.js';
 import { FeedbackManager } from '../core/FeedbackManager.js';
 import { FeedbackAnomalyDetector } from '../monitoring/FeedbackAnomalyDetector.js';
 import { DispatchManager } from '../core/DispatchManager.js';
 import { UpdateChecker } from '../core/UpdateChecker.js';
 import { AutoUpdater } from '../core/AutoUpdater.js';
+import { UpdateRestartHandshake, verifyRestartHandshake } from '../core/UpdateRestartHandshake.js';
 import { AutoDispatcher } from '../core/AutoDispatcher.js';
 import { DispatchExecutor } from '../core/DispatchExecutor.js';
 import { registerAgent, unregisterAgent, startHeartbeat } from '../core/AgentRegistry.js';
@@ -2147,6 +2149,24 @@ export async function startServer(options) {
             console.log(pc.yellow('  intelligenceProvider: "anthropic-api" is no longer supported — using Claude CLI subscription instead.\n'
                 + '  Remove the field from config.json. See specs/provider-portability/04-anthropic-path-constraints.md.'));
         }
+        // Codex-only enforcement (Justin 2026-05-23 absolute requirement): if
+        // this agent's enabledFrameworks excludes 'claude-code', forbid ALL
+        // Claude provider construction process-wide. Any internal LLM path that
+        // tries to fall back to Claude (relationships, summaries, gates) then
+        // throws ClaudeForbiddenError instead of silently using Claude on a
+        // machine where the claude binary happens to be installed. Set BEFORE
+        // any provider is built so the guard is active for the whole boot.
+        try {
+            const { setClaudeForbidden, isCodexOnly } = await import('../core/claudeForbiddenGuard.js');
+            const ef = config.enabledFrameworks;
+            if (isCodexOnly(ef)) {
+                setClaudeForbidden(`enabledFrameworks=${JSON.stringify(ef)} (no claude-code)`);
+                console.log(pc.cyan('  Codex-only mode: Claude provider construction is forbidden process-wide.'));
+            }
+        }
+        catch (err) {
+            console.warn(`[server] codex-only guard init failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        }
         // Provider-portability v1.0.0: pick the IntelligenceProvider that
         // matches the configured framework. Defaults to claude-code for
         // backwards-compat; INSTAR_FRAMEWORK=codex-cli routes through Codex.
@@ -2293,9 +2313,11 @@ export async function startServer(options) {
                 config.relationships.intelligence = sharedIntelligence;
                 intelligenceMode = `LLM-supervised (${intelligenceSource})`;
             }
-            else if (config.sessions.claudePath) {
+            else if (config.sessions.claudePath && !isClaudeForbidden()) {
                 // Last-ditch fallback for installs where sharedIntelligence couldn't
-                // be built but a claude binary path is still configured.
+                // be built but a claude binary path is still configured. Skipped on
+                // codex-only agents (isClaudeForbidden) — there, relationships run
+                // without LLM intelligence rather than silently using Claude.
                 config.relationships.intelligence = new ClaudeCliIntelligenceProvider(config.sessions.claudePath);
                 intelligenceMode = 'LLM-supervised (Claude CLI subscription, fallback)';
             }
@@ -3711,30 +3733,37 @@ export async function startServer(options) {
             // get Codex-summarized topics. Last-ditch ClaudeCli fallback
             // preserves v0.x behavior when sharedIntelligence couldn't be
             // built but a claude binary is still on disk.
-            let summaryIntelligence;
+            let summaryIntelligence = null;
             if (sharedIntelligence) {
                 summaryIntelligence = sharedIntelligence;
             }
-            else {
+            else if (!isClaudeForbidden()) {
                 const { ClaudeCliIntelligenceProvider } = await import('../core/ClaudeCliIntelligenceProvider.js');
                 summaryIntelligence = new ClaudeCliIntelligenceProvider(config.sessions.claudePath);
             }
-            const summarizer = new TopicSummarizer(summaryIntelligence, topicMemory);
-            sessionManager.on('sessionComplete', (session) => {
-                // Find the topic linked to this session
-                const sessionTopicId = telegram.getTopicForSession(session.tmuxSession);
-                if (!sessionTopicId)
-                    return;
-                // Check if this topic needs a summary update (async, fire-and-forget)
-                summarizer.summarize(sessionTopicId).then((result) => {
-                    if (result) {
-                        console.log(`[TopicSummarizer] Updated summary for topic ${sessionTopicId}: ${result.messagesProcessed} messages processed in ${result.durationMs}ms`);
-                    }
-                }).catch((err) => {
-                    console.error(`[TopicSummarizer] Failed for topic ${sessionTopicId}: ${err instanceof Error ? err.message : err}`);
+            // On a codex-only agent without a built Codex provider, summaryIntelligence
+            // stays null — topic summaries are skipped rather than run on Claude.
+            if (summaryIntelligence) {
+                const summarizer = new TopicSummarizer(summaryIntelligence, topicMemory);
+                sessionManager.on('sessionComplete', (session) => {
+                    // Find the topic linked to this session
+                    const sessionTopicId = telegram.getTopicForSession(session.tmuxSession);
+                    if (!sessionTopicId)
+                        return;
+                    // Check if this topic needs a summary update (async, fire-and-forget)
+                    summarizer.summarize(sessionTopicId).then((result) => {
+                        if (result) {
+                            console.log(`[TopicSummarizer] Updated summary for topic ${sessionTopicId}: ${result.messagesProcessed} messages processed in ${result.durationMs}ms`);
+                        }
+                    }).catch((err) => {
+                        console.error(`[TopicSummarizer] Failed for topic ${sessionTopicId}: ${err instanceof Error ? err.message : err}`);
+                    });
                 });
-            });
-            console.log(pc.green('  Topic auto-summarization enabled (on session end)'));
+                console.log(pc.green('  Topic auto-summarization enabled (on session end)'));
+            }
+            else {
+                console.log(pc.dim('  Topic auto-summarization skipped (no LLM provider; codex-only without Codex provider)'));
+            }
         }
         // Session Activity Sentinel — episodic memory digestion.
         // Creates mid-session mini-digests via LLM, and session syntheses on completion.
@@ -4346,6 +4375,58 @@ export async function startServer(options) {
                 console.log(pc.green(`  Instar ${info.currentVersion} is up to date`));
             }
         }).catch(() => { });
+        // codex-instar audit Item 4 — restart-handshake verification.
+        //
+        // If the previous process applied an update and triggered a restart, it
+        // wrote a pending-handshake marker describing what version it expected
+        // to be running and the notification it would have sent. We now verify
+        // that against the NEW process's runningVersion. The "Just updated, ...
+        // restarting" notification only fires AFTER the restart actually took
+        // effect — eliminating the bug where users were told the update was
+        // live before it really was.
+        const restartHandshake = new UpdateRestartHandshake(config.stateDir);
+        try {
+            const outcome = verifyRestartHandshake({
+                handshake: restartHandshake,
+                runningVersion: processIntegrity.runningVersion,
+            });
+            if (outcome.kind === 'verified') {
+                const topicId = state.get('agent-updates-topic') || 0;
+                if (telegram && topicId) {
+                    try {
+                        await telegram.sendToTopic(topicId, outcome.deferredNotification);
+                    }
+                    catch (err) {
+                        console.warn(`[restart-handshake] verified notification failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                }
+                else {
+                    console.log(`[restart-handshake] verified v${outcome.expectedVersion} (no telegram/topic — skipping notification)`);
+                }
+                restartHandshake.clearHandshake();
+            }
+            else if (outcome.kind === 'failed') {
+                const msg = outcome.escalate
+                    ? `Heads up — I tried to update to v${outcome.expectedVersion} but the restart didn't pick up the new code. Still running v${outcome.runningVersion}. Retry ${outcome.retryCount}.`
+                    : `Update to v${outcome.expectedVersion} was applied but I'm still running v${outcome.runningVersion}. The next restart should pick it up.`;
+                const topicId = state.get('agent-updates-topic') || 0;
+                if (telegram && topicId) {
+                    try {
+                        await telegram.sendToTopic(topicId, msg);
+                    }
+                    catch (err) {
+                        console.warn(`[restart-handshake] failure notification failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                }
+                else {
+                    console.warn(`[restart-handshake] ${msg}`);
+                }
+            }
+        }
+        catch (err) {
+            // Verification must never block startup — log and continue.
+            console.warn(`[restart-handshake] verification error (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        }
         // Start auto-updater — periodic check + auto-apply + notify + restart
         // Notifications routed dynamically to Updates topic (see getNotificationTopicId)
         const autoUpdater = new AutoUpdater(updateChecker, state, config.stateDir, {
@@ -4354,6 +4435,9 @@ export async function startServer(options) {
             autoRestart: true,
             restartWindow: config.updates?.restartWindow ?? null,
             restartCascadeDampenerWindowMs: config.updates?.restartCascadeDampenerWindowMs,
+            // codex-instar audit Item 4 — wire the handshake into AutoUpdater so
+            // the pre-restart notification is DEFERRED into the marker file.
+            restartHandshake,
         }, telegram, liveConfig);
         // Wire session deps for session-aware restart gating (Phase 2B)
         autoUpdater.setSessionDeps(sessionManager, sessionMonitor);
@@ -5099,6 +5183,9 @@ export async function startServer(options) {
                     stateDir: config.stateDir,
                     intelligence: sharedIntelligence,
                     agentName: config.projectName ?? 'the agent',
+                    // Resolved default framework so idle/stall detection uses the right
+                    // pane signals (Codex panes don't match Claude prompt patterns).
+                    agentFramework: _defaultFramework,
                     hasAgentRespondedSince: (topicId, sinceMs) => {
                         const sinceIso = new Date(sinceMs).toISOString();
                         // Check Telegram log
@@ -5863,6 +5950,15 @@ export async function startServer(options) {
         let spawnManager;
         spawnManager = new SpawnRequestManager({
             maxSessions: config.sessions.maxSessions ?? 5,
+            // Live accessor — read config on every admission check so operators
+            // raising sessions.maxSessions don't have to rebuild the manager.
+            // Resolves the split-brain where /status reflected the new cap but
+            // spawn denials kept reporting the constructor value (codex-instar
+            // audit Item 2). Reads the canonical key first; if absent, falls back
+            // to the legacy top-level maxSessions for older configs.
+            getMaxSessions: () => config.sessions?.maxSessions
+                ?? config.maxSessions
+                ?? 5,
             getActiveSessions: () => sessionManager.listRunningSessions(),
             spawnSession: async (prompt, opts) => {
                 const session = await sessionManager.spawnSession({