instar 1.3.139 → 1.3.140
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/server.d.ts.map +1 -1
- package/dist/commands/server.js +88 -53
- package/dist/commands/server.js.map +1 -1
- package/dist/core/LeaseCoordinator.d.ts.map +1 -1
- package/dist/core/LeaseCoordinator.js +12 -1
- package/dist/core/LeaseCoordinator.js.map +1 -1
- package/dist/core/LocalLeaseStore.d.ts +55 -0
- package/dist/core/LocalLeaseStore.d.ts.map +1 -0
- package/dist/core/LocalLeaseStore.js +103 -0
- package/dist/core/LocalLeaseStore.js.map +1 -0
- package/package.json +1 -1
- package/src/data/builtin-manifest.json +2 -2
- package/upgrades/1.3.140.md +47 -0
- package/upgrades/side-effects/standby-lease-holder-sync.md +70 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"LeaseCoordinator.d.ts","sourceRoot":"","sources":["../../src/core/LeaseCoordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,IAAI,IAAI;QAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE;YAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC1G;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;CACtC;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,iFAAiF;IACjF,QAAQ,IAAI;QAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACrF,wDAAwD;IACxD,WAAW,IAAI,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,kGAAkG;IAClG,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5F,8EAA8E;IAC9E,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAuB;IACzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAc;IACjC,OAAO,CAAC,YAAY,CAAK;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,SAAS,CAAS;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAA4B;gBAElC,IAAI,EAAE,oBAAoB;IAMtC,OAAO,CAAC,GAAG;IAGX;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAIpB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAGnB,OAAO,CAAC,GAAG;IAGX,OAAO,CAAC,SAAS;IAIjB,IAAI,aAAa,IAAI,MAAM,CAE1B;IACD,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;;OAIG;IACH,OAAO,CAAC,aAAa;
|
|
1
|
+
{"version":3,"file":"LeaseCoordinator.d.ts","sourceRoot":"","sources":["../../src/core/LeaseCoordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,IAAI,IAAI;QAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE;YAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC1G;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;CACtC;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,iFAAiF;IACjF,QAAQ,IAAI;QAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACrF,wDAAwD;IACxD,WAAW,IAAI,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,kGAAkG;IAClG,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC5F,8EAA8E;IAC9E,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAuB;IACzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAc;IACjC,OAAO,CAAC,YAAY,CAAK;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,SAAS,CAAS;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAA4B;gBAElC,IAAI,EAAE,oBAAoB;IAMtC,OAAO,CAAC,GAAG;IAGX;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAIpB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAGnB,OAAO,CAAC,GAAG;IAGX,OAAO,CAAC,SAAS;IAIjB,IAAI,aAAa,IAAI,MAAM,CAE1B;IACD,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAkCrB,6EAA6E;IAC7E,UAAU,IAAI,OAAO;IAerB,+DAA+D;IAC/D,YAAY,IAAI,MAAM;IAItB,aAAa,IAAI,MAAM,GAAG,IAAI;IAI9B;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;IA6C3C;;;;;;;;;;;;OAYG;IACG,gBAAgB,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0BpE;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;YA2CjB,SAAS;IAUvB,OAAO,CAAC,SAAS;IAOjB;;;;OAIG;IACH,yBAAyB,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI;CAc5D"}
|
|
@@ -91,7 +91,18 @@ export class LeaseCoordinator {
|
|
|
91
91
|
if (this.d.tunnel) {
|
|
92
92
|
const obs = this.d.tunnel.observed();
|
|
93
93
|
if (obs.lease) {
|
|
94
|
-
|
|
94
|
+
// acceptTunnelLease re-checks signature + git-floor + nonce-replay. The
|
|
95
|
+
// transport already replay-guarded obs.lease on RECEIVE (recordObserved),
|
|
96
|
+
// and by design its watermark for obs.lease's holder == obs.lease.nonce —
|
|
97
|
+
// so passing the raw watermark here would self-reject the very lease we're
|
|
98
|
+
// validating (nonce <= watermark). Exclude obs.lease's own holder from the
|
|
99
|
+
// nonce floor so a genuine standby broadcast is folded in; the transport
|
|
100
|
+
// remains the replay guard and the signature/git-floor checks still run.
|
|
101
|
+
// (2026-05-31: this self-rejection silently broke the git-less tunnel-
|
|
102
|
+
// observe path — a standby never learned the holder → MeshRpc not-router.)
|
|
103
|
+
const { [obs.lease.holder]: _self, ...nonceFloor } = obs.lastNonceByHolder;
|
|
104
|
+
void _self;
|
|
105
|
+
const decision = this.fl.acceptTunnelLease(obs.lease, git.epoch, nonceFloor);
|
|
95
106
|
if (decision.accept && obs.lease.epoch > epoch) {
|
|
96
107
|
bestLease = obs.lease;
|
|
97
108
|
epoch = obs.lease.epoch;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"LeaseCoordinator.js","sourceRoot":"","sources":["../../src/core/LeaseCoordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAyEH,MAAM,OAAO,gBAAgB;IACV,CAAC,CAAuB;IACxB,EAAE,CAAc;IACzB,YAAY,GAAG,CAAC,CAAC;IACzB;;;;;;OAMG;IACK,iBAAiB,GAAG,CAAC,CAAC;IACtB,iBAAiB,GAAG,CAAC,CAAC;IACtB,SAAS,GAAG,KAAK,CAAC;IAC1B;;;;;;OAMG;IACK,UAAU,GAAuB,IAAI,CAAC;IAE9C,YAAY,IAA0B;QACpC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IACD;;;;;OAKG;IACK,YAAY;QAClB,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,QAAU,CAAC,CAAC;IACtD,CAAC;IACD;;;OAGG;IACK,WAAW;QACjB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAC/C,CAAC;IACO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACO,SAAS;QACf,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC;IAC/B,CAAC;IACD,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACK,aAAa;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;QAC1B,IAAI,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACtB,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,
|
|
1
|
+
{"version":3,"file":"LeaseCoordinator.js","sourceRoot":"","sources":["../../src/core/LeaseCoordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAyEH,MAAM,OAAO,gBAAgB;IACV,CAAC,CAAuB;IACxB,EAAE,CAAc;IACzB,YAAY,GAAG,CAAC,CAAC;IACzB;;;;;;OAMG;IACK,iBAAiB,GAAG,CAAC,CAAC;IACtB,iBAAiB,GAAG,CAAC,CAAC;IACtB,SAAS,GAAG,KAAK,CAAC;IAC1B;;;;;;OAMG;IACK,UAAU,GAAuB,IAAI,CAAC;IAE9C,YAAY,IAA0B;QACpC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IACD;;;;;OAKG;IACK,YAAY;QAClB,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,QAAU,CAAC,CAAC;IACtD,CAAC;IACD;;;OAGG;IACK,WAAW;QACjB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAC/C,CAAC;IACO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACO,SAAS;QACf,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC;IAC/B,CAAC;IACD,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACK,aAAa;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;QAC1B,IAAI,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACtB,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,yEAAyE;gBACzE,yEAAyE;gBACzE,uEAAuE;gBACvE,2EAA2E;gBAC3E,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,CAAC,iBAAiB,CAAC;gBAC3E,KAAK,KAAK,CAAC;gBACX,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC7E,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;oBAC/C,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;oBACtB,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC;YACvG,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;YAC5B,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,UAAU;QACR,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,mEAAmE;QACnE,oEAAoE;QACpE,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,YAAY;QACV,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,oEAAoE;YACpE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,iDAAiD;QACjD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,qDAAqD;YACrD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBACzG,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,CAAC,oBAAoB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACrF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAChC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,GAAG,CAAC,2BAA2B,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,uEAAuE;YACvE,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzC,IAAI,aAAa,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;gBACrC,IAAI,CAAC,GAAG,CAAC,qBAAqB,aAAa,mBAAmB,SAAS,CAAC,KAAK,cAAc,CAAC,CAAC;gBAC7F,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBAC9B,0EAA0E;gBAC1E,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG;oBAAE,OAAO,KAAK,CAAC;YAClF,CAAC;YACD,OAAO,EAAE,CAAC;YACV,IAAI,IAAI,CAAC,EAAE,CAAC,4BAA4B,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpF,IAAI,CAAC,GAAG,CAAC,0BAA0B,OAAO,2BAA2B,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,CAAC;gBAC5F,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,gBAAgB,CAAC,kBAA0B;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;QAC1C,IAAI,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,CAAC,+BAA+B;QAC9C,CAAC;QACD,IAAI,MAAM,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAC5C,IAAI,CAAC,GAAG,CAAC,uCAAuC,kBAAkB,0BAA0B,MAAM,EAAE,CAAC,CAAC;YACtG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,sCAAsC,SAAS,CAAC,KAAK,gBAAgB,kBAAkB,GAAG,CAAC,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,qCAAqC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAE1E,wEAAwE;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,CAC/B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,KAAK,CAAC,UAAU,EACrB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAClD,IAAI,CAAC,SAAS,EAAE,CACjB,CAAC;QAEF,4EAA4E;QAC5E,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,SAAkB,CAAC;QACvB,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAClB,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;YAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACjE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CACpB,gCAAgC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,sBAAsB,IAAI,CAAC,EAAE,CAAC,KAAK,+BAA+B,CACnI,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAkB;QACxC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,OAAO;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,EAAE;gBAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,IAAI,KAAK,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACrC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;YAC/B,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,yBAAyB,CAAC,kBAA0B;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3E,IAAI,UAAU,IAAI,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAC5E,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClB,kBAAkB;gBAClB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;gBACzB,MAAM,EAAE,gFAAgF;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* LocalLeaseStore — a git-less LeaseStore for LeaseCoordinator.
|
|
3
|
+
*
|
|
4
|
+
* The git-backed GitLeaseStore is the durable CAS substrate WHEN a machine has
|
|
5
|
+
* git-sync available. But two real deployments have no git medium yet still need
|
|
6
|
+
* lease coordination:
|
|
7
|
+
* 1. A credential-less standby (the HTTP-transport "Build B" design): it joins
|
|
8
|
+
* the pool and must learn the holder WITHOUT pulling/pushing git.
|
|
9
|
+
* 2. An agent whose home IS the instar source tree (e.g. the instar developer's
|
|
10
|
+
* agent home), where the SourceTreeGuard refuses GitSyncManager — so the
|
|
11
|
+
* git medium is unavailable even though gitBackup is enabled.
|
|
12
|
+
*
|
|
13
|
+
* Without lease coordination, a machine's `coordinator.leaseHolder` is null, so
|
|
14
|
+
* MeshRpc rejects the holder's router-only commands (deliverMessage/place/
|
|
15
|
+
* transfer) as `not-router` — which blocks cross-machine session transfer
|
|
16
|
+
* entirely. (Found live, 2026-05-31: the lease block was nested inside the
|
|
17
|
+
* git-gated try, so a gitSync throw skipped the HTTP lease transport too.)
|
|
18
|
+
*
|
|
19
|
+
* This store persists THIS machine's own view of the lease to a local JSON file
|
|
20
|
+
* (durable across restarts) and implements the LeaseStore CAS locally. It is NOT
|
|
21
|
+
* a shared substrate: cross-machine propagation is carried by HttpLeaseTransport
|
|
22
|
+
* (broadcast/observe), which LeaseCoordinator folds into its effectiveView. The
|
|
23
|
+
* fenced-lease acquire/observe rules prevent split-brain over the tunnel (a
|
|
24
|
+
* machine that observes a valid peer lease declines to acquire). When git-sync
|
|
25
|
+
* IS available, GitLeaseStore remains the stronger shared-CAS substrate.
|
|
26
|
+
*/
|
|
27
|
+
import type { LeaseStore } from './LeaseCoordinator.js';
|
|
28
|
+
import type { LeaseRecord } from './types.js';
|
|
29
|
+
export interface LocalLeaseStoreDeps {
|
|
30
|
+
/** Absolute path of the local lease file (persisted across restarts). */
|
|
31
|
+
filePath: string;
|
|
32
|
+
logger?: (msg: string) => void;
|
|
33
|
+
}
|
|
34
|
+
export declare class LocalLeaseStore implements LeaseStore {
|
|
35
|
+
private readonly d;
|
|
36
|
+
private cached;
|
|
37
|
+
private loaded;
|
|
38
|
+
constructor(deps: LocalLeaseStoreDeps);
|
|
39
|
+
private log;
|
|
40
|
+
private load;
|
|
41
|
+
private persist;
|
|
42
|
+
read(): {
|
|
43
|
+
lease: LeaseRecord | null;
|
|
44
|
+
epoch: number;
|
|
45
|
+
};
|
|
46
|
+
casWrite(candidate: LeaseRecord): {
|
|
47
|
+
ok: boolean;
|
|
48
|
+
observed: {
|
|
49
|
+
lease: LeaseRecord | null;
|
|
50
|
+
epoch: number;
|
|
51
|
+
};
|
|
52
|
+
};
|
|
53
|
+
refresh(lease: LeaseRecord): boolean;
|
|
54
|
+
}
|
|
55
|
+
//# sourceMappingURL=LocalLeaseStore.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"LocalLeaseStore.d.ts","sourceRoot":"","sources":["../../src/core/LocalLeaseStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,qBAAa,eAAgB,YAAW,UAAU;IAChD,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAsB;IACxC,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,MAAM,CAAS;gBAEX,IAAI,EAAE,mBAAmB;IAIrC,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,OAAO;IAaf,IAAI,IAAI;QAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAKpD,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE;YAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;IAezG,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO;CAWrC"}
|
|
@@ -0,0 +1,103 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* LocalLeaseStore — a git-less LeaseStore for LeaseCoordinator.
|
|
3
|
+
*
|
|
4
|
+
* The git-backed GitLeaseStore is the durable CAS substrate WHEN a machine has
|
|
5
|
+
* git-sync available. But two real deployments have no git medium yet still need
|
|
6
|
+
* lease coordination:
|
|
7
|
+
* 1. A credential-less standby (the HTTP-transport "Build B" design): it joins
|
|
8
|
+
* the pool and must learn the holder WITHOUT pulling/pushing git.
|
|
9
|
+
* 2. An agent whose home IS the instar source tree (e.g. the instar developer's
|
|
10
|
+
* agent home), where the SourceTreeGuard refuses GitSyncManager — so the
|
|
11
|
+
* git medium is unavailable even though gitBackup is enabled.
|
|
12
|
+
*
|
|
13
|
+
* Without lease coordination, a machine's `coordinator.leaseHolder` is null, so
|
|
14
|
+
* MeshRpc rejects the holder's router-only commands (deliverMessage/place/
|
|
15
|
+
* transfer) as `not-router` — which blocks cross-machine session transfer
|
|
16
|
+
* entirely. (Found live, 2026-05-31: the lease block was nested inside the
|
|
17
|
+
* git-gated try, so a gitSync throw skipped the HTTP lease transport too.)
|
|
18
|
+
*
|
|
19
|
+
* This store persists THIS machine's own view of the lease to a local JSON file
|
|
20
|
+
* (durable across restarts) and implements the LeaseStore CAS locally. It is NOT
|
|
21
|
+
* a shared substrate: cross-machine propagation is carried by HttpLeaseTransport
|
|
22
|
+
* (broadcast/observe), which LeaseCoordinator folds into its effectiveView. The
|
|
23
|
+
* fenced-lease acquire/observe rules prevent split-brain over the tunnel (a
|
|
24
|
+
* machine that observes a valid peer lease declines to acquire). When git-sync
|
|
25
|
+
* IS available, GitLeaseStore remains the stronger shared-CAS substrate.
|
|
26
|
+
*/
|
|
27
|
+
import fs from 'node:fs';
|
|
28
|
+
import path from 'node:path';
|
|
29
|
+
export class LocalLeaseStore {
|
|
30
|
+
d;
|
|
31
|
+
cached = null;
|
|
32
|
+
loaded = false;
|
|
33
|
+
constructor(deps) {
|
|
34
|
+
this.d = deps;
|
|
35
|
+
}
|
|
36
|
+
log(m) {
|
|
37
|
+
this.d.logger?.(`[local-lease] ${m}`);
|
|
38
|
+
}
|
|
39
|
+
load() {
|
|
40
|
+
if (this.loaded)
|
|
41
|
+
return;
|
|
42
|
+
try {
|
|
43
|
+
if (fs.existsSync(this.d.filePath)) {
|
|
44
|
+
const raw = JSON.parse(fs.readFileSync(this.d.filePath, 'utf-8'));
|
|
45
|
+
const lease = raw?.lease;
|
|
46
|
+
if (lease && typeof lease.epoch === 'number' && typeof lease.holder === 'string') {
|
|
47
|
+
this.cached = lease;
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
catch {
|
|
52
|
+
// @silent-fallback-ok — corrupt local lease file: start clean. The lease is
|
|
53
|
+
// re-acquired (holder) or re-observed over the tunnel (standby), so a lost
|
|
54
|
+
// local copy is self-healing, never authoritative-loss.
|
|
55
|
+
this.cached = null;
|
|
56
|
+
}
|
|
57
|
+
this.loaded = true;
|
|
58
|
+
}
|
|
59
|
+
persist(lease) {
|
|
60
|
+
this.cached = lease;
|
|
61
|
+
try {
|
|
62
|
+
const dir = path.dirname(this.d.filePath);
|
|
63
|
+
if (!fs.existsSync(dir))
|
|
64
|
+
fs.mkdirSync(dir, { recursive: true });
|
|
65
|
+
const tmp = `${this.d.filePath}.${process.pid}.tmp`;
|
|
66
|
+
fs.writeFileSync(tmp, JSON.stringify({ lease }, null, 2));
|
|
67
|
+
fs.renameSync(tmp, this.d.filePath); // atomic swap
|
|
68
|
+
}
|
|
69
|
+
catch (err) {
|
|
70
|
+
this.log(`persist failed: ${err instanceof Error ? err.message : String(err)}`);
|
|
71
|
+
}
|
|
72
|
+
}
|
|
73
|
+
read() {
|
|
74
|
+
this.load();
|
|
75
|
+
return { lease: this.cached, epoch: this.cached?.epoch ?? 0 };
|
|
76
|
+
}
|
|
77
|
+
casWrite(candidate) {
|
|
78
|
+
this.load();
|
|
79
|
+
const committedEpoch = this.cached?.epoch ?? 0;
|
|
80
|
+
// Only a strict advance over the locally-committed epoch is a valid CAS —
|
|
81
|
+
// mirrors GitLeaseStore so LeaseCoordinator's acquire/yield logic is identical
|
|
82
|
+
// regardless of which store backs it.
|
|
83
|
+
if (candidate.epoch <= committedEpoch) {
|
|
84
|
+
this.log(`CAS pre-check failed: candidate epoch ${candidate.epoch} <= committed ${committedEpoch}`);
|
|
85
|
+
return { ok: false, observed: { lease: this.cached, epoch: committedEpoch } };
|
|
86
|
+
}
|
|
87
|
+
this.persist(candidate);
|
|
88
|
+
this.log(`lease epoch ${candidate.epoch} committed locally → ${candidate.holder}`);
|
|
89
|
+
return { ok: true, observed: { lease: candidate, epoch: candidate.epoch } };
|
|
90
|
+
}
|
|
91
|
+
refresh(lease) {
|
|
92
|
+
this.load();
|
|
93
|
+
const committedEpoch = this.cached?.epoch ?? 0;
|
|
94
|
+
// Don't overwrite a higher epoch with a same-epoch refresh (superseded).
|
|
95
|
+
if (committedEpoch > lease.epoch) {
|
|
96
|
+
this.log(`refresh declined: superseded (committed ${committedEpoch} > ${lease.epoch})`);
|
|
97
|
+
return false;
|
|
98
|
+
}
|
|
99
|
+
this.persist(lease); // same epoch, fresh expiry + nonce
|
|
100
|
+
return true;
|
|
101
|
+
}
|
|
102
|
+
}
|
|
103
|
+
//# sourceMappingURL=LocalLeaseStore.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"LocalLeaseStore.js","sourceRoot":"","sources":["../../src/core/LocalLeaseStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,MAAM,OAAO,eAAe;IACT,CAAC,CAAsB;IAChC,MAAM,GAAuB,IAAI,CAAC;IAClC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,IAAyB;QACnC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAwB,CAAC;gBACzF,MAAM,KAAK,GAAG,GAAG,EAAE,KAAgC,CAAC;gBACpD,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACjF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,2EAA2E;YAC3E,wDAAwD;YACxD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAEO,OAAO,CAAC,KAAyB;QACvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACpD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,QAAQ,CAAC,SAAsB;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;QAC/C,0EAA0E;QAC1E,+EAA+E;QAC/E,sCAAsC;QACtC,IAAI,SAAS,CAAC,KAAK,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,yCAAyC,SAAS,CAAC,KAAK,iBAAiB,cAAc,EAAE,CAAC,CAAC;YACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,eAAe,SAAS,CAAC,KAAK,wBAAwB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO,CAAC,KAAkB;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;QAC/C,yEAAyE;QACzE,IAAI,cAAc,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,2CAA2C,cAAc,MAAM,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "./builtin-manifest.schema.json",
|
|
3
3
|
"schemaVersion": 1,
|
|
4
|
-
"generatedAt": "2026-05-
|
|
5
|
-
"instarVersion": "1.3.
|
|
4
|
+
"generatedAt": "2026-05-31T04:01:41.213Z",
|
|
5
|
+
"instarVersion": "1.3.140",
|
|
6
6
|
"entryCount": 193,
|
|
7
7
|
"entries": {
|
|
8
8
|
"hook:session-start": {
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
# Upgrade Guide — vNEXT
|
|
2
|
+
|
|
3
|
+
<!-- bump: patch -->
|
|
4
|
+
|
|
5
|
+
## What Changed
|
|
6
|
+
|
|
7
|
+
**Multi-machine: a standby machine can now actually receive a transferred session.**
|
|
8
|
+
When you run one agent across two machines, the machines agree on which one is "in
|
|
9
|
+
charge" via a lease (a who-is-the-captain token). Cross-machine commands — like
|
|
10
|
+
moving a conversation to the other machine — are only accepted from the recognized
|
|
11
|
+
captain. A live two-machine test surfaced that the standby machine had no idea who
|
|
12
|
+
the captain was, so it refused every hand-off. Root cause: the code that runs the
|
|
13
|
+
captain-tracking system was bundled with git backup, and on machines where git
|
|
14
|
+
backup is blocked or off (including an agent whose home is the instar source tree),
|
|
15
|
+
the whole system silently never started. This change runs the captain-tracking
|
|
16
|
+
system over the machines' existing secure connection whenever multi-machine is on,
|
|
17
|
+
independent of git — so a standby learns the captain and accepts the hand-off. A
|
|
18
|
+
second, latent bug (the standby discarding the captain's announcements due to an
|
|
19
|
+
over-strict duplicate check) is fixed too. Single-machine agents are unaffected.
|
|
20
|
+
|
|
21
|
+
## What to Tell Your User
|
|
22
|
+
|
|
23
|
+
If you run on one machine, nothing changes. If you run one agent across two
|
|
24
|
+
machines, moving a conversation to the other machine now works end to end —
|
|
25
|
+
previously the second machine would quietly refuse the hand-off because it never
|
|
26
|
+
learned which machine was in charge. Nothing to configure.
|
|
27
|
+
|
|
28
|
+
## Summary of New Capabilities
|
|
29
|
+
|
|
30
|
+
| Capability | How to Use |
|
|
31
|
+
|-----------|-----------|
|
|
32
|
+
| Git-less lease coordination | Automatic. A machine with no git medium (a credential-less standby, or an agent home that is the instar source tree) now coordinates the lease over the existing HTTP channel and learns the holder, so cross-machine transfer is authorized. No configuration. |
|
|
33
|
+
|
|
34
|
+
## Evidence
|
|
35
|
+
|
|
36
|
+
- New `LocalLeaseStore` (git-less lease store) unit tests:
|
|
37
|
+
`tests/unit/LocalLeaseStore.test.ts` (5 cases — strict-advance CAS, durable
|
|
38
|
+
persistence across instances, refresh/supersede, corrupt-file self-heal).
|
|
39
|
+
- Regression: `tests/unit/StandbyLeaseObservation.test.ts` (3 cases — a git-less
|
|
40
|
+
standby resolves the holder from a real HttpLeaseTransport broadcast; the holder
|
|
41
|
+
acquires + broadcasts). This is the gap the mocked suites missed.
|
|
42
|
+
- Existing `LeaseCoordinator` (16), `FencedLease` (21), `HttpLeaseTransport` (6)
|
|
43
|
+
suites stay green — no replay-semantic regression. `server` (17) + `middleware`
|
|
44
|
+
(27) green — boot wiring unaffected. `tsc --noEmit` + repo lint clean.
|
|
45
|
+
- Live Tier-3: re-run the two-machine "move this to the other machine" transfer
|
|
46
|
+
after deploy; the standby accepts the forwarded message and serves the session.
|
|
47
|
+
- Side-effects: `upgrades/side-effects/standby-lease-holder-sync.md`.
|
|
@@ -0,0 +1,70 @@
|
|
|
1
|
+
# Side-Effects Review — Standby lease-holder propagation
|
|
2
|
+
|
|
3
|
+
**Version / slug:** `standby-lease-holder-sync`
|
|
4
|
+
**Date:** `2026-05-31`
|
|
5
|
+
**Author:** `echo`
|
|
6
|
+
**Second-pass reviewer:** `not required`
|
|
7
|
+
|
|
8
|
+
## Summary of the change
|
|
9
|
+
|
|
10
|
+
Decouple cross-machine lease coordination from git. The lease coordinator +
|
|
11
|
+
`HttpLeaseTransport` (and the handoff / reply-marker / live-tail transports) now
|
|
12
|
+
run whenever `coordinator.enabled && coordinator.identity`, instead of being
|
|
13
|
+
nested inside a single `try` gated on `gitBackupEnabled` whose first statement
|
|
14
|
+
(`new GitSyncManager`) throws on an instar-source-tree home (SourceTreeGuard) and
|
|
15
|
+
discarded everything. Git-sync is now an internal best-effort optional; when no
|
|
16
|
+
git medium exists the lease uses a new `LocalLeaseStore` (local-file backed) and
|
|
17
|
+
the HTTP transport carries cross-machine propagation. Also fixes a self-rejection
|
|
18
|
+
in `LeaseCoordinator.effectiveView` (it passed the transport's self-inclusive
|
|
19
|
+
nonce watermark to `acceptTunnelLease`, rejecting the very lease it validated).
|
|
20
|
+
|
|
21
|
+
## Decision-point inventory
|
|
22
|
+
|
|
23
|
+
1. **`gitSyncRef` defined vs undefined** → `GitLeaseStore` vs `LocalLeaseStore`.
|
|
24
|
+
2. **`effectiveView` tunnel-fold** → accept the observed lease iff sig + git-floor
|
|
25
|
+
+ epoch-newer pass (nonce floor now excludes the lease's own holder).
|
|
26
|
+
|
|
27
|
+
## 1. Over-block
|
|
28
|
+
|
|
29
|
+
**What legitimate inputs does this reject?** None added. The lease coordinator now
|
|
30
|
+
runs in MORE cases (git-less machines) than before, not fewer. `acceptTunnelLease`
|
|
31
|
+
still rejects forged/below-floor/older-nonce leases (signature + git-floor +
|
|
32
|
+
replay checks all run); excluding the observed lease's own holder from the nonce
|
|
33
|
+
floor does not weaken this — the transport's `recordObserved` already dropped
|
|
34
|
+
replays on receive, and a forged lease is still caught by the signature check
|
|
35
|
+
before it is ever folded.
|
|
36
|
+
|
|
37
|
+
## 2. Under-block
|
|
38
|
+
|
|
39
|
+
**What does this still miss?** A git-less mesh inherits the tunnel's coordination
|
|
40
|
+
(RTT-bounded acquisition + observe-before-acquire), not git's shared CAS — so its
|
|
41
|
+
split-brain guarantees are exactly the documented tunnel-path guarantees, no
|
|
42
|
+
stronger. This matches the spec non-goal. In the current 1-awake/1-standby
|
|
43
|
+
topology the standby never acquires, so there is no acquisition contention to
|
|
44
|
+
resolve. When git IS available, `GitLeaseStore` (shared CAS) is still used.
|
|
45
|
+
|
|
46
|
+
## 3. Blast radius
|
|
47
|
+
|
|
48
|
+
- New file `LocalLeaseStore.ts` is only constructed when `gitSyncRef` is undefined
|
|
49
|
+
(no git medium). On any git-backed agent the behavior is byte-identical to today
|
|
50
|
+
(`GitLeaseStore` path unchanged).
|
|
51
|
+
- The `effectiveView` change runs for ALL lease-coordinator users (git and
|
|
52
|
+
git-less). It only RELAXES a redundant nonce self-check; existing
|
|
53
|
+
`LeaseCoordinator`/`FencedLease`/`HttpLeaseTransport` unit suites (51 tests
|
|
54
|
+
across these + the new ones) stay green, confirming no replay-semantic
|
|
55
|
+
regression.
|
|
56
|
+
- The server.ts restructure moves the lease/handoff/live-tail setup out of the
|
|
57
|
+
git-gated `try`. A failure in lease setup is still caught (now with a
|
|
58
|
+
"Lease/transport setup" message) so a single-machine agent is unaffected.
|
|
59
|
+
|
|
60
|
+
## 4. Rollback
|
|
61
|
+
|
|
62
|
+
Pure code (no migration, no config default, no schema). Rollback = revert the PR;
|
|
63
|
+
`lease-local.json` becomes inert (no reader). No data is mutated or deleted.
|
|
64
|
+
|
|
65
|
+
## 5. Failure modes
|
|
66
|
+
|
|
67
|
+
- `LocalLeaseStore` persist fails (disk) → logged, in-memory view still serves;
|
|
68
|
+
cross-machine propagation continues over the tunnel. Never blocks boot.
|
|
69
|
+
- Git medium unavailable → caught, lease falls back to LocalLeaseStore. This is
|
|
70
|
+
the intended path, not an error.
|