instar 1.3.1319 → 1.3.1321

package/dist/commands/server.js

@@ -256,6 +256,7 @@ import { loadTestIdentityKey } from '../users/testIdentityMarkers.js';
 import { formatUserContextForSession, hasUserContext } from '../users/UserContextBuilder.js';
 import { SafeFsExecutor } from '../core/SafeFsExecutor.js';
 import { mergeDefaults } from '../core/mergeDefaults.js';
+import { shouldOwnTelegramPoll } from '../lifeline/telegramPollOwnership.js';
 // setup.ts uses @inquirer/prompts which requires Node 20.12+
 // Dynamic import to avoid breaking the server on older Node versions
 // import { installAutoStart } from './setup.js';
@@ -16951,6 +16952,10 @@ export async function startServer(options) {
                 projectDir: config.projectDir,
                 port: config.port,
                 relayEnabled: config.threadline?.relayEnabled,
+                // A quiet standby never connects to the relay: the relay admits one
+                // connection per agent identity, and two machines displaced each other
+                // (instar#2122). Same per-machine flag the lifeline uses for the poll.
+                relayStandby: !shouldOwnTelegramPoll(config),
                 relayUrl: config.threadline?.relayUrl,
                 visibility: config.threadline?.visibility,
                 capabilities: config.threadline?.capabilities,
@@ -17397,6 +17402,28 @@ export async function startServer(options) {
         catch (err) {
             console.log(pc.yellow(`  Jev circles shadow: not constructed (${err?.message ?? 'unknown'})`));
         }
+        // Jev review-flag shadow (docs/specs/jev-review-flag-shadow.md) — log-only,
+        // delivers nothing. A 60 s unref'd timer tails the Telegram history; dev-gated
+        // (live on a development agent, dark on the fleet), read live per tick, inert
+        // without the vault typesafe_api_key.
+        try {
+            const { buildJevReviewFlagShadow, installJevReviewFlagShadow } = await import('../core/JevReviewFlagShadow.js');
+            const { getFeatureMetricsRecorder } = await import('../core/CircuitBreakingIntelligenceProvider.js');
+            const { SecretStore } = await import('../core/SecretStore.js');
+            const shadow = buildJevReviewFlagShadow({
+                readLiveIntelligence: () => liveConfig.get('intelligence', undefined),
+                bootBlock: config.intelligence?.jevReviewFlagShadow,
+                developmentAgent: config.developmentAgent === true,
+                readSecret: (name) => new SecretStore({ stateDir: config.stateDir, forceFileKey: config.secrets?.forceFileKey }).get(name),
+                stateDir: config.stateDir,
+                metrics: { record: (r) => getFeatureMetricsRecorder()?.record(r) },
+            });
+            installJevReviewFlagShadow(shadow);
+            shadow.start();
+        }
+        catch (err) {
+            console.log(pc.yellow(`  Jev review-flag shadow: not constructed (${err?.message ?? 'unknown'})`));
+        }
         // Outbound dedup gate — deterministic near-duplicate detection on every
         // outbound agent message. Catches respawn races and idempotency gaps.
         const { OutboundDedupGate } = await import('../core/OutboundDedupGate.js');
@@ -22751,7 +22778,7 @@ export async function startServer(options) {
                             } };
                         originRuntime.poolAudit = new OriginPoolAudit({
                             operatorScopeRequired: true,
-                            shardIds: () => [meshSelfId, ...Object.keys(meshIdMgr.loadRegistry().machines)],
+                            shardIds: () => [meshSelfId, ...meshIdMgr.getActiveMachines().map(m => m.machineId).filter(id => id !== meshSelfId)],
                             readShardMetrics: async (machineId) => {
                                 if (machineId === meshSelfId)
                                     return originRuntime.store.getFederatedMetrics(machineId);
@@ -27410,7 +27437,8 @@ export async function startServer(options) {
         // If autostart isn't installed, install it silently. If it uses the old /bin/bash entry point
         // (vulnerable to macOS TCC/FDA restrictions), regenerate it with the node + JS wrapper.
         try {
-            const hasTelegram = !!telegram;
+            const hasTelegramConfigured = (config.messaging ?? []).some((m) => m.type === 'telegram' && m.enabled !== false);
+            let hasTelegramForInstall = false;
             const autostartInstalled = isAutostartInstalled(config.projectName);
             let needsReinstall = !autostartInstalled;
             // On macOS, keep node symlink fresh and check plist format
@@ -27422,6 +27450,7 @@ export async function startServer(options) {
                 }
                 catch { /* non-critical */ }
                 if (!needsReinstall) {
+                    const { autoStartNeedsLifeline } = await import('./setup.js');
                     const label = `ai.instar.${config.projectName}`;
                     const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', `${label}.plist`);
                     try {
@@ -27436,6 +27465,15 @@ export async function startServer(options) {
                             needsReinstall = true;
                             console.log(pc.yellow(`  Auto-start uses legacy format — upgrading to TCC-safe node entry point`));
                         }
+                        else if (autoStartNeedsLifeline(plistContent, hasTelegramConfigured)) {
+                            // A joined standby is installed with `server start` (it has no
+                            // Telegram config at join time, and the lifeline needs one).
+                            // Once Telegram is configured, the lifeline must supervise the
+                            // server as it does on the first machine (instar#2122).
+                            needsReinstall = true;
+                            hasTelegramForInstall = true;
+                            console.log(pc.yellow(`  Auto-start runs the bare server although Telegram is configured — switching to the lifeline supervisor`));
+                        }
                         else if (!plistContent.includes('.instar/bin/node')) {
                             needsReinstall = true;
                             console.log(pc.yellow(`  Auto-start uses direct node path — upgrading to stable symlink`));
@@ -27456,7 +27494,7 @@ export async function startServer(options) {
             }
             if (needsReinstall) {
                 const { installAutoStart } = await import('./setup.js');
-                const installed = installAutoStart(config.projectName, config.projectDir, hasTelegram);
+                const installed = installAutoStart(config.projectName, config.projectDir, !!telegram || hasTelegramForInstall);
                 if (installed) {
                     console.log(pc.green(`  Auto-start self-healed: installed ${process.platform === 'darwin' ? 'LaunchAgent (node + JS wrapper)' : 'systemd service'}`));
                 }
@@ -27491,13 +27529,50 @@ export async function startServer(options) {
         }
         // Graceful shutdown
         let _shuttingDown = false;
+        let shutdownStep = 'start';
         const shutdown = async () => {
             // Re-entrancy guard: SIGINT+SIGTERM (or a restartDetected racing a signal)
             // must not run the teardown twice. closeAllSqlite() is itself idempotent,
             // but the resume-UUID save + sidecar flush should run once.
-            if (_shuttingDown)
-                return;
+            if (_shuttingDown) {
+                // A second signal while teardown is in flight means the operator (or
+                // launchd) wants the process gone now: exit at once rather than wait on
+                // whichever step is hanging (instar#2122: a standby that ignored SIGTERM).
+                console.error(`[shutdown] second signal during step "${shutdownStep}" — exiting now`);
+                try {
+                    closeAllSqlite();
+                }
+                catch { /* best effort */ }
+                try {
+                    singleInstanceLock.release();
+                }
+                catch { /* best effort */ }
+                process.exit(1);
+            }
             _shuttingDown = true;
+            // Hard deadline: the teardown below awaits many subsystems in sequence and
+            // any one of them (an origin worker, a tunnel, a Threadline relay, a server
+            // with an open long-poll) can hang; without a bound the process never
+            // exits and only SIGKILL stops it. launchd/the lifeline expect SIGTERM to
+            // work. The timer is unref'd so a fast teardown is never delayed by it.
+            const { armShutdownDeadline, resolveShutdownDeadlineMs } = await import('../core/shutdownDeadline.js');
+            armShutdownDeadline({
+                deadlineMs: resolveShutdownDeadlineMs(process.env.INSTAR_SHUTDOWN_DEADLINE_MS),
+                currentStep: () => shutdownStep,
+                onExpire: (step, deadlineMs) => {
+                    console.error(`[shutdown] teardown exceeded ${deadlineMs}ms during step "${step}" — exiting now`);
+                    try {
+                        closeAllSqlite();
+                    }
+                    catch { /* best effort */ }
+                    try {
+                        singleInstanceLock.release();
+                    }
+                    catch { /* best effort */ }
+                    process.exit(1);
+                },
+            });
+            shutdownStep = 'telegram-origin';
             try {
                 await telegramOriginBoot?.close();
             }
@@ -27578,6 +27653,7 @@ export async function startServer(options) {
             coherenceMonitor.stop();
             commitmentTracker.stop();
             commitmentSentinel?.stop();
+            shutdownStep = 'notification-flush';
             await notificationBatcher.flushAll(); // Drain pending notifications before exit
             notificationBatcher.stop();
             retryManager.stop();
@@ -27597,8 +27673,10 @@ export async function startServer(options) {
             autoUpdater.stop();
             autoDispatcher?.stop();
             sessionMonitor?.stop();
+            shutdownStep = 'tunnel';
             if (tunnel)
                 await tunnel.stop();
+            shutdownStep = 'threadline';
             if (threadlineShutdown)
                 await threadlineShutdown();
             wakeSocketServer?.stop();
@@ -27621,6 +27699,7 @@ export async function startServer(options) {
             }
             catch { /* ELOCKED is non-critical during shutdown */ }
             scheduler?.stop();
+            shutdownStep = 'telegram';
             if (telegram)
                 await telegram.stop();
             sessionManager.stopMonitoring();
@@ -27631,7 +27710,9 @@ export async function startServer(options) {
                 sharedStateLedger?.shutdown();
             }
             catch { /* best effort */ }
+            shutdownStep = 'http-server';
             await server.stop();
+            shutdownStep = 'sqlite';
             // Close EVERY registered SQLite handle LAST — after all writers (server,
             // scheduler, sentinels, telegram) have stopped — to prevent the
             // "mutex lock failed" SIGABRT when better-sqlite3 static destructors fire