instar 1.3.139 → 1.3.141

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmSH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwvDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoqPtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoSH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwvDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqvPtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -66,6 +66,7 @@ import { wireRegistrySync } from '../core/wireRegistrySync.js';
 import { assertSeamlessnessInvariants } from '../core/seamlessnessConfig.js';
 import { FencedLease } from '../core/FencedLease.js';
 import { GitLeaseStore } from '../core/GitLeaseStore.js';
+import { LocalLeaseStore } from '../core/LocalLeaseStore.js';
 import { LeaseCoordinator } from '../core/LeaseCoordinator.js';
 import { HttpLeaseTransport } from '../core/HttpLeaseTransport.js';
 import { HttpLiveTailTransport } from '../core/HttpLiveTailTransport.js';
@@ -2250,50 +2251,72 @@ export async function startServer(options) {
         // (the Phase-0 scenario) must ALREADY have it so its role-change push fires.
         // Only an awake machine pulls+pushes at boot; the durable registry push is
         // driven by the RegistrySyncDebouncer below, gated on authority.
-        if (coordinator.enabled && isGitRepo && gitBackupEnabled) {
+        if (coordinator.enabled && coordinator.identity) {
+            const idMgr = coordinator.managers.identityManager;
+            const selfMachineId = coordinator.identity.machineId;
+            // ── Git-sync substrate (OPTIONAL — not required for coordination) ──
+            // git is the durable shared-CAS substrate for the lease + the registry
+            // push channel. It is NOT required for cross-machine coordination: a
+            // credential-less standby, or an agent whose home IS the instar source
+            // tree (where SourceTreeGuard refuses GitSyncManager), has no git medium.
+            // Construct it best-effort; its failure must NOT skip the HTTP lease/
+            // handoff/live-tail transports below. (2026-05-31 bug, found live: the
+            // lease block was nested in the git-gated try, so a gitSync throw left the
+            // standby with leaseHolder=null → MeshRpc 'not-router' → transfer dead.)
+            let gitSyncRef;
+            if (isGitRepo && gitBackupEnabled) {
+                try {
+                    gitSync = new GitSyncManager({
+                        projectDir: config.projectDir,
+                        stateDir: config.stateDir,
+                        identityManager: coordinator.managers.identityManager,
+                        securityLog: coordinator.managers.securityLog,
+                        machineId: selfMachineId,
+                    });
+                    // Configure commit signing if not already done
+                    if (!gitSync.isSigningConfigured() && localSigningKeyPem) {
+                        gitSync.configureCommitSigning();
+                        console.log(pc.green('  Git commit signing configured'));
+                    }
+                    // Pull (and auto-push) latest on startup — awake machine only.
+                    if (coordinator.isAwake) {
+                        const syncResult = await gitSync.sync();
+                        if (syncResult.pulled) {
+                            console.log(pc.green(`  Git sync: pulled ${syncResult.commitsPulled} commit(s)`));
+                        }
+                    }
+                    gitSyncRef = gitSync;
+                    // ── G2 wiring (spec §8 G2) — roleChange/leaseEpoch → debounced push ──
+                    // Without a subscriber the durable registry push never fires; a
+                    // wiring-integrity test asserts this subscription exists.
+                    const gitSyncForDebounce = gitSyncRef;
+                    registrySyncDebouncer = new RegistrySyncDebouncer({
+                        commitAndPush: (msg, paths) => gitSyncForDebounce.commitAndPush(msg, paths),
+                        registryAbsPath: coordinator.managers.identityManager.registryPath,
+                        isAuthoritative: () => coordinator.isAwake,
+                        debounceMs: seamlessness.registrySyncDebounceMs,
+                        logger: (m) => console.log(pc.dim(m)),
+                    });
+                    wireRegistrySync(coordinator, registrySyncDebouncer);
+                    console.log(pc.dim('  Registry sync wired (roleChange/leaseEpoch → durable push)'));
+                }
+                catch (err) {
+                    // @silent-fallback-ok — git medium unavailable (SourceTreeGuard, no
+                    // remote, etc). The lease falls back to LocalLeaseStore + the HTTP
+                    // transport below, so cross-machine coordination still works.
+                    console.log(pc.yellow(`  Git sync setup: ${err instanceof Error ? err.message : String(err)}`));
+                    gitSyncRef = undefined;
+                }
+            }
             try {
-                gitSync = new GitSyncManager({
-                    projectDir: config.projectDir,
-                    stateDir: config.stateDir,
-                    identityManager: coordinator.managers.identityManager,
-                    securityLog: coordinator.managers.securityLog,
-                    machineId: coordinator.identity.machineId,
-                });
-                // Configure commit signing if not already done
-                if (!gitSync.isSigningConfigured() && localSigningKeyPem) {
-                    gitSync.configureCommitSigning();
-                    console.log(pc.green('  Git commit signing configured'));
-                }
-                // Pull (and auto-push) latest on startup — awake machine only.
-                if (coordinator.isAwake) {
-                    const syncResult = await gitSync.sync();
-                    if (syncResult.pulled) {
-                        console.log(pc.green(`  Git sync: pulled ${syncResult.commitsPulled} commit(s)`));
-                    }
-                }
-                // ── G2 wiring (spec §8 G2) — the Phase-0 fix, named explicitly ──
-                // MultiMachineCoordinator emits roleChange / leaseEpochChange; without
-                // a subscriber the durable push never fired. wireRegistrySync connects
-                // those events to a debounced, single-writer registry push. A
-                // wiring-integrity test asserts this subscription exists.
-                const gitSyncRef = gitSync;
-                registrySyncDebouncer = new RegistrySyncDebouncer({
-                    commitAndPush: (msg, paths) => gitSyncRef.commitAndPush(msg, paths),
-                    registryAbsPath: coordinator.managers.identityManager.registryPath,
-                    isAuthoritative: () => coordinator.isAwake,
-                    debounceMs: seamlessness.registrySyncDebounceMs,
-                    logger: (m) => console.log(pc.dim(m)),
-                });
-                wireRegistrySync(coordinator, registrySyncDebouncer);
-                console.log(pc.dim('  Registry sync wired (roleChange/leaseEpoch → durable push)'));
                 // ── G1 fenced-lease integration (spec §6) ──────────────────
-                // The lease becomes the authority for awake/standby. git is the durable
-                // CAS substrate (correct, bounded by git cadence — the tunnel accelerator
-                // is a tracked follow-on, ACT-156-adjacent). A holder that cannot refresh
-                // its lease over git for > leaseTtlMs self-suspends, preventing the
-                // partitioned-old-awake split-brain.
-                const idMgr = coordinator.managers.identityManager;
-                const selfMachineId = coordinator.identity.machineId;
+                // The lease is the authority for awake/standby + the MeshRpc router-only
+                // RBAC (deliverMessage/place/transfer). GitLeaseStore is the durable
+                // shared-CAS substrate WHEN git is available; otherwise LocalLeaseStore
+                // persists this machine's own view and the HttpLeaseTransport carries
+                // cross-machine propagation (broadcast/observe). A holder that cannot
+                // confirm its renewal over its medium for > leaseTtlMs self-suspends,
+                // preventing the partitioned-old-awake split-brain.
                 const leaseCrypto = {
                     selfMachineId,
                     sign: (canonical) => signEd25519(canonical, idMgr.loadSigningKey()),
@@ -2313,15 +2336,26 @@ export async function startServer(options) {
                     leaseTtlMs: seamlessness.leaseTtlMs,
                     failoverThresholdMs: seamlessness.failoverThresholdMs,
                 });
-                const leaseStore = new GitLeaseStore({
-                    machineId: selfMachineId,
-                    loadRegistry: () => idMgr.loadRegistry(),
-                    saveRegistry: (r) => idMgr.saveRegistry(r),
-                    registryAbsPath: idMgr.registryPath,
-                    pullRebase: () => gitSyncRef.pullRebase(),
-                    commitAndPush: (msg, paths) => gitSyncRef.commitAndPush(msg, paths),
-                    logger: (m) => console.log(pc.dim(m)),
-                });
+                let leaseStore;
+                if (gitSyncRef) {
+                    const gs = gitSyncRef;
+                    leaseStore = new GitLeaseStore({
+                        machineId: selfMachineId,
+                        loadRegistry: () => idMgr.loadRegistry(),
+                        saveRegistry: (r) => idMgr.saveRegistry(r),
+                        registryAbsPath: idMgr.registryPath,
+                        pullRebase: () => gs.pullRebase(),
+                        commitAndPush: (msg, paths) => gs.commitAndPush(msg, paths),
+                        logger: (m) => console.log(pc.dim(m)),
+                    });
+                }
+                else {
+                    leaseStore = new LocalLeaseStore({
+                        filePath: path.join(config.stateDir, 'lease-local.json'),
+                        logger: (m) => console.log(pc.dim(m)),
+                    });
+                    console.log(pc.dim('  Lease store: LocalLeaseStore (no git medium — HTTP transport carries cross-machine lease)'));
+                }
                 // Lease wire transport (spec §6) — the low-latency authoritative copy
                 // travels over the existing authenticated machine channel. For a
                 // single-machine mesh (no peers) broadcast is a no-op and isReachable()
@@ -2471,8 +2505,9 @@ export async function startServer(options) {
                 }
             }
             catch (err) {
-                // @silent-fallback-ok — git sync disabled gracefully
-                console.log(pc.yellow(`  Git sync setup: ${err instanceof Error ? err.message : String(err)}`));
+                // @silent-fallback-ok — lease/transport setup failed; the agent still
+                // serves single-machine (cross-machine coordination simply stays off).
+                console.log(pc.yellow(`  Lease/transport setup: ${err instanceof Error ? err.message : String(err)}`));
             }
         }
         // Per-agent Codex threadline MCP override. Codex reads a SHARED
@@ -8241,6 +8276,52 @@ export async function startServer(options) {
                 ? '  AgentWorktreeReaper enabled (stale-worktree reclaim — LIVE)'
                 : '  AgentWorktreeReaper enabled (stale-worktree reclaim — dry-run, report only)'));
         }
+        // ── Agent hard-sleep — SleepController (RESPONSIBLE-RESOURCE-USAGE, Stage B) ──
+        // Decides "is it safe for this idle agent to drop to near-zero footprint?" with
+        // every safety guard. Ships OFF + dry-run: observes + audits to
+        // logs/agent-sleep-events.jsonl, never stops a server. The mechanism
+        // (supervisor stop + lifeline respawn) is a later slice. GET /sleep exposes the
+        // live verdict. The shared idle signal (AgentActivityState) is bumped at the
+        // inbound-message chokepoint (/internal/telegram-forward).
+        const { AgentActivityState } = await import('../monitoring/AgentActivityState.js');
+        const agentActivityState = new AgentActivityState();
+        const { SleepController, sleepAuditSink } = await import('../monitoring/SleepController.js');
+        const _sleepCfg = config.monitoring?.agentSleep;
+        const sleepController = new SleepController({
+            sample: () => {
+                const act = agentActivityState.snapshot();
+                return {
+                    now: Date.now(),
+                    runningSessions: sessionManager.listRunningSessions().length,
+                    lastInboundAt: act.lastInboundAt,
+                    lastActivityAt: act.lastActivityAt,
+                    // Lease guard: only relevant when multi-machine coordination is active.
+                    leaseActive: coordinator.enabled,
+                    holdsLease: coordinator.enabled ? coordinator.holdsLease() : false,
+                    // In-flight: an inbound message currently being handled. (The relay/forward
+                    // in-flight + scheduler-wake signals are wired with the stop mechanism in
+                    // the next slice — this slice is dry-run, so it never acts on them.)
+                    inflightWork: (currentInboundByTopic?.size ?? 0) > 0,
+                    nextScheduledJobAt: null,
+                };
+            },
+            audit: sleepAuditSink(config.stateDir),
+        }, {
+            enabled: _sleepCfg?.enabled ?? false,
+            dryRun: _sleepCfg?.dryRun ?? true,
+            tickIntervalMs: (_sleepCfg?.tickIntervalSec ?? 60) * 1000,
+            thresholds: {
+                idleGraceMs: _sleepCfg?.idleGraceMs ?? 120_000,
+                deepIdleMs: _sleepCfg?.deepIdleMs ?? 900_000,
+                wakeLeadMs: _sleepCfg?.wakeLeadMs ?? 120_000,
+            },
+        });
+        sleepController.start();
+        if (_sleepCfg?.enabled) {
+            console.log(pc.green(_sleepCfg.dryRun === false
+                ? '  SleepController enabled (agent hard-sleep — LIVE decision)'
+                : '  SleepController enabled (agent hard-sleep — dry-run, observe only)'));
+        }
         // ── Unkillability backstop (UNIFIED-SESSION-LIFECYCLE §P5) ───────────────
         // Signal-only: raises ONE deduped Attention item (never auto-kills) when a
         // session is KEPT forever despite faking work, or is stuck indeterminate.
@@ -8846,7 +8927,7 @@ export async function startServer(options) {
         catch (err) {
             console.log(pc.dim(`  [session-pool] rollout gate not wired: ${err instanceof Error ? err.message : String(err)}`));
         }
-        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, sessionOwnershipRegistry, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
+        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, sessionOwnershipRegistry, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, sleepController, agentActivityState, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
         // Boot-recovery (tunnel-failure-resilience spec Part 6): if the agent
         // died mid-relay-episode, the persisted tunnel.json carries
         // rotationPending=true. Rotate the dashboard PIN + authToken BEFORE