instar 1.3.1344 → 1.3.1346

package/dashboard/index.html

@@ -1042,6 +1042,24 @@
     .mnd-reason-cell { color: var(--text-dim); }
     .mnd-audit-head { display: flex; gap: 12px; align-items: center; margin-bottom: 8px; flex-wrap: wrap; }
     .mnd-dim { font-size: 13px; color: var(--text-dim); }
+    .pair-card { border: 1px solid var(--border); border-radius: 8px; padding: 12px; margin-top: 10px; }
+    .pair-head { display: flex; flex-wrap: wrap; gap: 8px; align-items: baseline; }
+    .pair-state { font-size: 13px; color: var(--text-dim); }
+    .pair-state-verification-failed { color: #f85149; }
+    .pair-state-mutual-verified, .pair-state-identity-verified { color: #3fb950; }
+    .pair-step { margin-top: 10px; }
+    .pair-step-title { font-size: 13px; margin-bottom: 6px; }
+    .pair-row { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; margin: 6px 0; }
+    .pair-own-words { columns: 3; font-family: ui-monospace, monospace; font-size: 15px; margin: 6px 0; }
+    .pair-words { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 6px; }
+    .pair-word { display: flex; align-items: center; gap: 4px; font-size: 12px; color: var(--text-dim); }
+    .pair-word input { flex: 1; min-width: 0; padding: 6px; font-family: ui-monospace, monospace; font-size: 15px; }
+    .pair-meta { font-size: 11px; color: var(--text-dim); margin-top: 8px; }
+    @media (max-width: 640px) {
+      .pair-own-words { columns: 2; }
+      .pair-words { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+      .pair-row .mnd-pin, .pair-row .mnd-btn { flex: 1 1 100%; width: 100%; }
+    }
     /* Mobile-first (item 5): at phone width the 5-column audit table stacks into
        labelled rows so the reason — the useful column — is never truncated. */
     @media (max-width: 640px) {
@@ -4208,6 +4226,17 @@
         <div id="tlBridgeError" style="color:var(--err, #c44);font-size:12px;display:none"></div>
       </div>
 
+      <!-- Verified pairing — the 12-word check (docs/specs/secure-a2a-verified-pairing.md §3.6) -->
+      <div id="pairCard" class="mnd-card" style="border:1px solid var(--border);border-radius:8px;padding:16px">
+        <div style="display:flex;justify-content:space-between;align-items:center;gap:8px;flex-wrap:wrap">
+          <strong>Verified pairing</strong>
+          <button onclick="startPairingPanel()" class="mnd-btn mnd-btn-quiet" style="padding:6px 12px">Refresh</button>
+        </div>
+        <div class="mnd-hint">Confirm another agent is really who it says it is: compare 12 words with its operator before it can be sent credentials.</div>
+        <div id="pairNotice" class="mnd-notice"></div>
+        <div id="pairList"></div>
+      </div>
+
       <!-- Conversation observability — threads list + message stream + search -->
       <div style="border:1px solid var(--border);border-radius:8px;padding:0;display:flex;flex-direction:column;min-height:480px">
         <!-- Toolbar -->
@@ -5990,6 +6019,7 @@
         onActivate: () => {
           if (typeof loadThreadlineBridgeConfig === 'function') loadThreadlineBridgeConfig();
           if (typeof tlObsLoadThreads === 'function') tlObsLoadThreads();
+          if (typeof startPairingPanel === 'function') startPairingPanel();
         },
       },
       {
@@ -10413,6 +10443,26 @@
       } catch { host.innerHTML = '<div style="opacity:.7">Throughput data is temporarily unavailable.</div>'; }
     }
 
+    // ── Verified pairing panel (Threadline tab; secure-a2a-verified-pairing §3.6) ──
+    // Lazy-loaded like Mandates. The PIN typed here is sent once per action, never stored.
+    let __pairController = null;
+    let __pairModule = null;
+    async function startPairingPanel() {
+      if (!__pairModule) {
+        try { __pairModule = await import('/dashboard/pairing.js'); }
+        catch (e) { console.error('[pairing] module load failed', e); return; }
+      }
+      if (!__pairController) {
+        const els = { list: document.getElementById('pairList'), notice: document.getElementById('pairNotice') };
+        const fetchImpl = (url, opts = {}) => fetch(url, {
+          ...opts,
+          headers: { 'Authorization': `Bearer ${token}`, ...(opts.headers || {}) },
+        });
+        __pairController = __pairModule.createController({ doc: document, els, fetchImpl });
+      }
+      __pairController.start();
+    }
+
     // ── Mandates tab (coordination-mandate spec, decision 2A) ──
     // Same lazy dynamic-import pattern as Process Health. The PIN typed in this
     // tab is sent once per action and never stored anywhere.

package/dashboard/pairing.js

@@ -0,0 +1,179 @@
+/**
+ * pairing.js — the Verified Pairing panel on the dashboard's Threadline tab
+ * (docs/specs/secure-a2a-verified-pairing.md §3.6, Mobile-Complete operator action).
+ *
+ * The operator's surface for the 12-word check: list pairings; for a pending one,
+ * enter the dashboard PIN to see THIS side's 12 words, then type the 12 words the
+ * OTHER side shows and confirm (the server compares all 12 in order; any difference
+ * is a denial). A denied pairing can be cleared with the PIN. The PIN is typed at
+ * action time, sent once, and never stored (no localStorage, no module state).
+ *
+ * Same shape as mandates.js: pure renderers + createController({ doc, els, fetchImpl }).
+ */
+
+const REFRESH_MS = 30_000;
+const WORD_COUNT = 12;
+
+function esc(s) {
+  return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+}
+
+const STATE_LABEL = {
+  'pending-verification': 'Waiting for you to compare the words',
+  'mutual-verified': 'Verified',
+  'identity-verified': 'Verified on another of my machines',
+  'verification-failed': 'Words did not match — blocked',
+};
+
+/** One pairing card. Primary action first; the fingerprint is support metadata. */
+export function renderPairing(p) {
+  const fp = esc(p.peerFp);
+  const name = esc(p.peerName || 'Unknown agent');
+  const state = p.state;
+  const label = esc(STATE_LABEL[state] || state || 'Unknown');
+  let actions = '';
+  if (state === 'pending-verification') {
+    const inputs = Array.from({ length: WORD_COUNT }, (_, i) =>
+      `<label class="pair-word"><span>${i + 1}</span><input type="text" autocomplete="off" autocapitalize="off" spellcheck="false" data-their-word="${fp}" data-idx="${i}" aria-label="Their word ${i + 1}" /></label>`).join('');
+    actions = `
+      <div class="pair-step">
+        <div class="pair-step-title">1. See the words on this side</div>
+        <div class="pair-row"><input type="password" class="mnd-pin" data-show-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
+        <button class="mnd-btn mnd-btn-primary" data-show-words="${fp}">Show my words</button></div>
+        <ol class="pair-own-words" data-own-words="${fp}"></ol>
+      </div>
+      <div class="pair-step">
+        <div class="pair-step-title">2. Type the 12 words the OTHER agent's operator sees</div>
+        <div class="pair-words">${inputs}</div>
+        <div class="pair-row"><input type="password" class="mnd-pin" data-confirm-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
+        <button class="mnd-btn mnd-btn-primary" data-confirm="${fp}">Confirm they match</button></div>
+        <div class="mnd-hint">Compare over a call or in person, not through the agents. Any wrong word blocks this pairing.</div>
+        <button class="mnd-btn mnd-btn-quiet mnd-btn-danger" data-deny="${fp}">They don't match</button>
+      </div>`;
+  } else if (state === 'verification-failed') {
+    actions = `
+      <div class="pair-step">
+        <div class="mnd-hint">Clear this only once you know why the words were different.</div>
+        <div class="pair-row"><input type="password" class="mnd-pin" data-clear-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
+        <button class="mnd-btn mnd-btn-quiet" data-clear="${fp}">Clear and start again</button></div>
+      </div>`;
+  }
+  return `<div class="pair-card" data-pairing="${fp}">
+    <div class="pair-head"><strong>${name}</strong> <span class="pair-state pair-state-${esc(state)}">${label}</span></div>
+    ${actions}
+    <div class="pair-meta">Agent ${fp.slice(0, 12)}…</div>
+  </div>`;
+}
+
+export function renderPairings(list) {
+  if (!Array.isArray(list) || list.length === 0) {
+    return '<div class="mnd-hint">No pairings yet. An agent starts one with <code>threadline_pair</code> start.</div>';
+  }
+  return list.map(renderPairing).join('');
+}
+
+/** Words typed into the 12 inputs for one pairing, in order. */
+export function collectTypedWords(root, fp) {
+  const inputs = Array.from(root.querySelectorAll(`[data-their-word="${fp}"]`));
+  inputs.sort((a, b) => Number(a.dataset.idx) - Number(b.dataset.idx));
+  return inputs.map((i) => String(i.value || '').trim().toLowerCase());
+}
+
+export function createController({ doc, els, fetchImpl }) {
+  let timer = null;
+
+  async function fetchJson(url, opts) {
+    const res = await fetchImpl(url, opts);
+    let body = null;
+    try { body = await res.json(); } catch { body = null; }
+    return { status: res.status, body };
+  }
+
+  function note(msg, kind) {
+    if (!els.notice) return;
+    els.notice.textContent = msg;
+    els.notice.className = kind === 'error' ? 'mnd-notice mnd-notice-err' : kind === 'success' ? 'mnd-notice mnd-notice-ok' : 'mnd-notice';
+  }
+
+  // A timed refresh must not wipe words or a PIN the operator is typing.
+  function operatorIsTyping() {
+    const inputs = els.list ? Array.from(els.list.querySelectorAll('input')) : [];
+    return inputs.some((i) => i.value);
+  }
+
+  async function load(opts = {}) {
+    if (opts.timed && operatorIsTyping()) return;
+    try {
+      const { status, body } = await fetchJson('/threadline/pairing');
+      if (status === 503) { els.list.innerHTML = '<div class="mnd-hint">Verified pairing is turned off on this agent.</div>'; return; }
+      if (status !== 200) { note(`Could not load pairings: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+      els.list.innerHTML = renderPairings(body?.pairings ?? []);
+    } catch (e) {
+      note(`Could not reach the agent: ${e?.message ?? e}`, 'error');
+    }
+  }
+
+  async function post(url, payload) {
+    return fetchJson(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) });
+  }
+
+  async function onClick(ev) {
+    const t = ev.target;
+    if (!t || !t.dataset) return;
+    const root = els.list;
+    const take = (attr, fp) => { const el = root.querySelector(`[${attr}="${fp}"]`); const v = el ? el.value : ''; if (el) el.value = ''; return v; };
+    try {
+      if (t.dataset.showWords) {
+        const fp = t.dataset.showWords;
+        const pin = take('data-show-pin', fp);
+        if (!pin) { note('Enter your PIN to see the words.', 'error'); return; }
+        const res = await fetchImpl(`/threadline/pairing/${fp}`, { headers: { 'X-Dashboard-Pin': pin } });
+        const body = await res.json().catch(() => null);
+        const words = body?.pairing?.sasWords;
+        if (!Array.isArray(words)) { note(res.status === 200 ? 'The PIN was not accepted, or this pairing is no longer waiting.' : `Refused: ${body?.error ?? `HTTP ${res.status}`}`, 'error'); return; }
+        const ol = root.querySelector(`[data-own-words="${fp}"]`);
+        if (ol) ol.innerHTML = words.map((w) => `<li>${esc(w)}</li>`).join('');
+        note('These are the words on this side. Read them to the other operator and type theirs below.', 'info');
+      } else if (t.dataset.confirm) {
+        const fp = t.dataset.confirm;
+        const words = collectTypedWords(root, fp);
+        const pin = take('data-confirm-pin', fp);
+        if (words.some((w) => !w)) { note(`Type all ${WORD_COUNT} of the other side's words first.`, 'error'); return; }
+        if (!pin) { note('Enter your PIN to confirm.', 'error'); return; }
+        const { status, body } = await post(`/threadline/pairing/${fp}/verify`, { words, pin });
+        if (status !== 200) { note(`Not confirmed — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+        note(body?.state === 'mutual-verified' ? 'Verified. Every word matched.' : 'The words did not match. This pairing is now blocked.', body?.state === 'mutual-verified' ? 'success' : 'error');
+        await load();
+      } else if (t.dataset.deny) {
+        const fp = t.dataset.deny;
+        const pin = take('data-confirm-pin', fp);
+        if (!pin) { note('Enter your PIN (in the field above) to record that the words did not match.', 'error'); return; }
+        const { status, body } = await post(`/threadline/pairing/${fp}/verify`, { match: false, pin });
+        if (status !== 200) { note(`Not recorded — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+        note('Recorded: the words did not match. This pairing is blocked.', 'success');
+        await load();
+      } else if (t.dataset.clear) {
+        const fp = t.dataset.clear;
+        const pin = take('data-clear-pin', fp);
+        if (!pin) { note('Enter your PIN to clear this pairing.', 'error'); return; }
+        const { status, body } = await post(`/threadline/pairing/${fp}/start`, { clearFailed: true, pin });
+        if (status !== 200) { note(`Not cleared — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+        note('Cleared. Compare the words again.', 'success');
+        await load();
+      }
+    } catch (e) {
+      note(`Could not reach the agent: ${e?.message ?? e}`, 'error');
+    }
+  }
+
+  return {
+    start() {
+      if (els.list && !els.list.__pairWired) { els.list.addEventListener('click', onClick); els.list.__pairWired = true; }
+      load();
+      if (!timer) timer = setInterval(() => load({ timed: true }), REFRESH_MS);
+    },
+    stop() { if (timer) { clearInterval(timer); timer = null; } },
+    load,
+    onClick,
+  };
+}

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAwGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwI7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAmFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsgBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAqYjB;AA02BD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAs+xBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAwGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAyI7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAmFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AA8gBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAqYjB;AA02BD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA42BN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8/xBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -242,7 +242,8 @@ import { ConversationStore } from '../threadline/ConversationStore.js';
 import { ThreadLog } from '../threadline/ThreadLog.js';
 import { ThreadMessageRecorder } from '../threadline/recordThreadMessage.js';
 import { recordInboundAck } from '../threadline/recordInboundAck.js';
-import { isAutoAckInbound, autoAckRecognition, looksLikeAutoAckText, createAckRateLimiter, runRelayAckStage } from '../threadline/autoAck.js';
+import { isAutoAckInbound, autoAckRecognition, looksLikeAutoAckText, createAckRateLimiter, runRelayAckStage, settleDeferredRelayAck } from '../threadline/autoAck.js';
+import { createThreadlineTopicRespawn } from '../threadline/topicRespawnHook.js';
 import { WarrantsReplyGate, evaluateAndRecordInbound } from '../threadline/WarrantsReplyGate.js';
 import { CollaborationSurfacer } from '../threadline/CollaborationSurfacer.js';
 import { ListenerSessionManager } from '../threadline/ListenerSessionManager.js';
@@ -586,6 +587,12 @@ let _sweptInboundStore = null;
 // The drain's local-delivery tail (§3.1 via:'drain') — assigned inside
 // wireTelegramRouting where the session primitives live in scope.
 let _drainLocalDeliver = null;
+// ACT-091: wake a topic's dead/reaped session for a topic-bound Threadline
+// reply — assigned inside wireTelegramRouting where the respawn primitives
+// (and the per-topic spawn guard) live in scope. Null ⇒ not wired.
+let _threadlineTopicRespawn = null;
+/** ACT-091: "is a spawn for this topic in flight?" — the spawningTopics read, for the handler. */
+let _threadlineTopicSpawning = null;
 // Emergency-stop integration (§3.6): marks a topic stopped for the drain's
 // pass/batch/chokepoint consults AND settles its custody (terminal
 // operator-stop + PIS cleanup + loss report). Set with the engine.
@@ -3049,6 +3056,72 @@ getHubClassifierDeps) {
             spawningTopics.clear(topicId, _spawnTokD);
         }
     };
+    // ── ACT-091: topic-bound Threadline reply into a dead/reaped topic session ──
+    // The decision lives in createThreadlineTopicRespawn (testable); this binds
+    // it to the REAL primitives the Telegram dead-session path uses: ownership,
+    // the G3 lease gate, the death classification, SpawnAdmission (its own
+    // journal-only callsite), the spawningTopics guard, respawnSessionForTopic
+    // (--resume) / spawnSessionForTopic, each awaited through the initial
+    // injection. A spawn already in flight is WAITED for, then the reply is typed
+    // into the live session — a second reply inside one respawn is never lost.
+    {
+        _threadlineTopicSpawning = (topicId) => spawningTopics.has(topicId);
+        _threadlineTopicRespawn = createThreadlineTopicRespawn({
+            spawning: spawningTopics,
+            ownedElsewhere: (topicId) => {
+                if (!_ownershipReadForDrain || !_meshSelfId)
+                    return false;
+                const ownRec = _ownershipReadForDrain(String(topicId));
+                return !!ownRec && ownRec.status === 'active' && ownRec.ownerMachineId !== _meshSelfId;
+            },
+            registeredSession: (topicId) => telegram.getSessionForTopic(topicId),
+            isSessionAlive: (name) => sessionManager.isSessionAlive(name),
+            injectConfirmed: (name, text) => sessionManager.injectPasteNotificationConfirmed(name, text),
+            leaseGate: (topicId) => g3ShouldSpawnLocally(topicId),
+            classifyDeath: (name) => {
+                try {
+                    const output = sessionManager.captureOutput(name, 100);
+                    if (!output)
+                        return null;
+                    const death = classifySessionDeath(output, quotaTracker?.getState() ?? null);
+                    if (death.cause === 'quota_exhaustion' && death.confidence !== 'low')
+                        return 'quota';
+                    if (death.cause === 'context_exhausted')
+                        return 'context-exhausted';
+                    return 'other';
+                }
+                catch {
+                    return null; /* @silent-fallback-ok: classification failed — respawn as the Telegram dead path does */
+                }
+            },
+            admit: (topicId) => {
+                if (!_spawnAdmission)
+                    return { allow: true };
+                try {
+                    const d = _spawnAdmission.admit({ sessionKey: String(topicId), callsite: 'threadline-topic-respawn' });
+                    if (d.allow)
+                        _ladderDryRunConsult(d, String(topicId), topicId);
+                    return { allow: d.allow, reason: d.reason };
+                }
+                catch (err) {
+                    // Same posture as the Telegram seam: an admission ERROR fails open.
+                    console.warn(`[spawn-admission] threadline-topic-respawn admit error (fail-open): ${err instanceof Error ? err.message : String(err)}`);
+                    return { allow: true };
+                }
+            },
+            respawn: async (name, topicId, text, fresh) => {
+                if (fresh)
+                    _topicResumeMap?.remove(topicId);
+                await respawnSessionForTopic(sessionManager, telegram, name, topicId, text, topicMemory, undefined, undefined, { silent: true, awaitInitialInjection: true });
+            },
+            coldSpawn: async (topicId, text) => {
+                const topicName = telegram.getTopicName(topicId) || `topic-${topicId}`;
+                const newSessionName = await spawnSessionForTopic(sessionManager, telegram, topicName, topicId, text, topicMemory, undefined, undefined, undefined, { awaitInitialInjection: true });
+                telegram.registerTopicSession(topicId, newSessionName, topicName);
+                return newSessionName;
+            },
+        });
+    }
 }
 /**
  * Wire WhatsApp message routing: incoming messages → Claude sessions.
@@ -16856,6 +16929,12 @@ export async function startServer(options) {
                 getSessionForTopic: telegram
                     ? (topicId) => telegram.getSessionForTopic(topicId)
                     : undefined,
+                // ACT-091: a reply into a reaped topic session wakes it (late-bound —
+                // Telegram routing is wired after this handler is constructed).
+                respawnTopicSession: (args) => _threadlineTopicRespawn
+                    ? _threadlineTopicRespawn(args)
+                    : Promise.resolve({ delivered: false, reason: 'telegram-routing-not-wired' }),
+                isTopicSpawning: (topicId) => _threadlineTopicSpawning?.(topicId) === true,
                 // A2A cross-machine route §5: a topic-bound reply is typed into the
                 // topic's live session on whichever machine has it. Late-bound: the
                 // mesh client exists only after the multi-machine wiring below.
@@ -17375,13 +17454,22 @@ export async function startServer(options) {
                     // Telegram mirror and the gate. Any other message gets our own ack
                     // (post-trust-verification, never for status messages, rate-limited).
                     const recordRelayDelivery = () => recordInboundAck({ a2aDeliveryTracker }, { threadId: msg.threadId, senderFingerprint, senderName: senderName ?? null });
-                    const ackStage = runRelayAckStage({
+                    // ACT-091: a topic-bound reply can reach no live session (its topic
+                    // session was reaped), so its ack — which promises a reply — waits for
+                    // the routing outcome (settleDeferredRelayAck below).
+                    const isTopicBoundReply = !!msg.threadId && threadResumeMap.get(msg.threadId)?.originTopicId !== undefined;
+                    const relayAckDeps = {
                         autoAckEnabled: config.threadline?.autoAck !== false,
                         autoAckMessage: config.threadline?.autoAckMessage,
                         isAckRateLimited,
                         sendAck: (to, text, threadId) => { threadlineRelayClient.sendAck(to, text, threadId); },
                         recordDelivery: recordRelayDelivery,
-                    }, { isAutoAck, trustLevel, msgType, senderFingerprint, threadId: msg.threadId, ticket: ledgerTicket });
+                    };
+                    const relayAckInput = {
+                        isAutoAck, trustLevel, msgType, senderFingerprint, threadId: msg.threadId, ticket: ledgerTicket,
+                        deferSend: isTopicBoundReply,
+                    };
+                    const ackStage = runRelayAckStage(relayAckDeps, relayAckInput);
                     if (ackStage === 'ack-consumed') {
                         console.log(`[relay] delivery ack from ${senderName} (thread: ${msg.threadId ?? 'none'}, by ${autoAckRecognition({ type: msgType, text: textContent })}) recorded — not acked, not routed`);
                         return;
@@ -17462,6 +17550,11 @@ export async function startServer(options) {
                                 else
                                     ledgerTicket?.recordNoReply();
                                 console.log(`[relay] warrants-reply gate suppressed reply (${decision.verdict.signal}) for ${senderName} thread ${gateThreadId.slice(0, 8)}`);
+                                // ACT-091: a deferred ack on a terminal no-reply exit becomes the
+                                // non-promising "Message received." — received, deliberately not
+                                // answered — so the sender's tracker never reads a stuck channel.
+                                if (relayAckInput.deferSend)
+                                    settleDeferredRelayAck(relayAckDeps, relayAckInput, { delivered: false, noReply: true });
                                 // On budget exhaustion, surface ONE status notice — never silently
                                 // drop. CMT-519: route it to the SILENT Threadline hub (not a
                                 // per-event attention topic, not the parent topic the operator is
@@ -17551,7 +17644,6 @@ export async function startServer(options) {
                     // for the user even though transport succeeded. (The pipe-spawn branch
                     // above is already excluded for topic-bound threads via its
                     // `!threadResumeMap.get(...)` guard, now that get() no longer nulls them.)
-                    const isTopicBoundReply = !!msg.threadId && threadResumeMap.get(msg.threadId)?.originTopicId !== undefined;
                     if (listenerManager && listenerManager.shouldUseListener(trustLevel, textContent.length) && !isTopicBoundReply) {
                         listenerManager.writeToInbox({ from: senderFingerprint, senderName, trustLevel, threadId: msg.threadId ?? getSyntheticThreadId(senderFingerprint), text: ledgerNotice ? `[server notice: ${ledgerNotice}]\n\n${textContent}` : textContent });
                         ledgerTicket?.recordHandoff('listener');
@@ -17596,6 +17688,15 @@ export async function startServer(options) {
                         console.log(`[relay] Spawned session for ${senderName} (trust: ${trustLevel}, thread: ${result.threadId})`);
                     if (result.resumed)
                         console.log(`[relay] Resumed session for ${senderName} (thread: ${result.threadId})`);
+                    if (result.handled && result.delivered === false) {
+                        console.warn(`[relay] Message from ${senderName} (thread: ${result.threadId}) accepted but not delivered to a live session${result.queued ? ' (queued)' : ''}`);
+                    }
+                    if (relayAckInput.deferSend) {
+                        const ackOutcome = settleDeferredRelayAck(relayAckDeps, relayAckInput, { delivered: result.delivered === true });
+                        if (ackOutcome === 'skipped-undelivered') {
+                            console.warn(`[relay] Auto-ack withheld for ${senderName} (thread: ${result.threadId}) — no live session received the message`);
+                        }
+                    }
                 }
                 // Relay client is passed to AgentServer → RouteContext for the /threadline/relay-send endpoint
                 // Report the client's ACTUAL state. This line used to say "connected"