instar 1.3.1582 → 1.3.1583

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAuHA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6J7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA0DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAukBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAiZjB;AA0xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAo4BN;AA+pBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAos1BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAuHA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6J7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA0DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAukBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAiZjB;AA0xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAo4BN;AA+pBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6x1BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}

package/dist/commands/server.js

@@ -4731,6 +4731,10 @@ export async function startServer(options) {
         // are on (no separate switch: for a native conversation the store is the only copy).
         const { APP_CONVERSATIONS_KIND_REGISTRATION } = await import('../core/AppConversationsReplicatedStore.js');
         replicatedKindRegistry.register(APP_CONVERSATIONS_KIND_REGISTRATION);
+        // mobile-native-conversations §4.8 — the `mobileDeviceKeyLedger` kind (inert registration; on
+        // whenever native app conversations are on, so a signed record can be checked on any machine).
+        const { DEVICE_KEY_LEDGER_KIND_REGISTRATION } = await import('../core/MobileDeviceKeyLedgerReplicatedStore.js');
+        replicatedKindRegistry.register(DEVICE_KEY_LEDGER_KIND_REGISTRATION);
         // WS2.3 (ws23-relationships-userregistry-security) — register the SECOND concrete
         // replicated kind, `relationship-record`, onto the registry: the FIRST PII kind.
         // Dual-registry's dynamic half (the static half is CoherenceJournal.JOURNAL_KINDS,
@@ -4916,6 +4920,15 @@ export async function startServer(options) {
                             _appConversationService?.ingestReplicated(entries.map((e) => appEventFromReplicatedData(e.data)));
                         }).catch(() => { });
                     }
+                    // Device-key ledger rows: each lands only when it verifies under the pinned key of the machine it names.
+                    if (kind === 'mobile-device-key-ledger-row' && _appConversationService?.deps.keyLedger) {
+                        const ledger = _appConversationService.deps.keyLedger;
+                        for (const e of entries) {
+                            const r = ledger.ingestReplicated(e.data);
+                            if (r === 'bad-signature' || r === 'unverifiable')
+                                console.warn(`  [device-key-ledger] a replicated row was not accepted (${r})`);
+                        }
+                    }
                 });
                 // Author-side HLC clock — persisted under the journal dir (atomic temp+rename)
                 // so the merge total order survives restarts (§3.5). node = this machine's id.
@@ -5023,7 +5036,7 @@ export async function startServer(options) {
         const _stateSyncStoresResolved = (() => {
             let s = _stateSyncStoresBase ?? {};
             if (_appNativeOn)
-                s = { ...s, appConversations: { enabled: true } };
+                s = { ...s, appConversations: { enabled: true }, mobileDeviceKeyLedger: { enabled: true } };
             if (_accountFollowMeEnabled)
                 s = { ...s, subscriptionAccountMeta: { enabled: true } };
             if (_pinReplicateEnabled)
@@ -8588,7 +8601,24 @@ export async function startServer(options) {
                         console.warn(`  [app-conversations] reply relay: ${[...r.errors, ...r.degraded].join('; ')}`);
                 }
                 let appDispatch = null;
+                // Signed records (§4.6): this machine's identity signer, the signing-key history lookup and
+                // the device-key ledger. No identity ⇒ messages are still stored and delivered, read `unknown`.
+                const [sigMod, ledgerMod, ledgerReplMod] = await Promise.all([
+                    import('../core/AppRecordSignatures.js'), import('../core/MobileDeviceKeyLedger.js'), import('../core/MobileDeviceKeyLedgerReplicatedStore.js'),
+                ]);
+                const appSigner = sigMod.loadMachineSigner(config.stateDir);
+                const appKeyLookup = sigMod.identityKeyLookup(config.stateDir);
+                if (!appSigner)
+                    console.warn('  [app-conversations] this machine has no identity key: app messages will read "couldn\'t check"');
+                const appKeyLedger = appSigner ? new ledgerMod.MobileDeviceKeyLedger({
+                    stateDir: config.stateDir, signer: appSigner, keyLookup: appKeyLookup,
+                    reportDegradation: (what, detail) => degradationReporter.report({
+                        feature: what, primary: 'check signed app messages against the device-key ledger', fallback: 'messages read "couldn\'t check"',
+                        reason: detail, impact: 'Signed app messages cannot be checked on this machine.',
+                    }),
+                }) : null;
                 const appSvc = new AppConversationService({
+                    signer: appSigner, keyLookup: appKeyLookup, keyLedger: appKeyLedger,
                     stateDir: config.stateDir,
                     machineId: () => _meshSelfId ?? os.hostname(),
                     registry: conversationRegistry,
@@ -8635,6 +8665,27 @@ export async function startServer(options) {
                     const emitter = replicatedRecordEmitter;
                     appSvc.store.setReplicationHook((ev) => emitter.emit(replMod.APP_CONVERSATIONS_STORE_KEY, replMod.deriveAppConversationRecordKey(ev.conversationKey, ev.eventId), replMod.buildAppConversationRecordData(ev)));
                 }
+                if (replicatedRecordEmitter && appKeyLedger) {
+                    const emitter = replicatedRecordEmitter;
+                    appKeyLedger.setReplicationHook((row) => emitter.emit(ledgerReplMod.DEVICE_KEY_LEDGER_STORE_KEY, ledgerReplMod.deriveDeviceKeyLedgerRecordKey(row), ledgerReplMod.buildDeviceKeyLedgerRecordData(row)));
+                }
+                if (replicatedPeerStreamReader && cjOwnMachineId && appKeyLedger) {
+                    try {
+                        const reader = replicatedPeerStreamReader;
+                        let landed = 0;
+                        for (const rk of reader.listRecordKeys(ledgerReplMod.DEVICE_KEY_LEDGER_STORE_KEY)) {
+                            for (const r of reader.loadOriginRecords(ledgerReplMod.DEVICE_KEY_LEDGER_STORE_KEY, rk)) {
+                                if (r.origin !== cjOwnMachineId && appKeyLedger.ingestReplicated(r.data) === 'accepted')
+                                    landed++;
+                            }
+                        }
+                        if (landed > 0)
+                            console.log(pc.dim(`  [device-key-ledger] landed ${landed} replicated row(s) at boot`));
+                    }
+                    catch (err) {
+                        console.warn(`  [device-key-ledger] boot replication read failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                }
                 if (replicatedPeerStreamReader && cjOwnMachineId) {
                     try {
                         const reader = replicatedPeerStreamReader;
@@ -17301,10 +17352,41 @@ export async function startServer(options) {
             profileFor: (peer) => _peerProfileFor?.(peer) ?? null,
             conversationFor: (threadId) => conversationStore.get(threadId) ?? null,
         });
+        // §2.7: "meant for the user?" is judged PER MESSAGE (Jev first, then the Codex fast tier,
+        // then the shared provider — so a Claude-only agent still judges; no verdict posts). Read
+        // live: `threadline.peerHomebase.perMessageClassification: false` restores first-only.
+        let peerUserMeantJudge = null;
+        try {
+            const { buildPeerUserMeantJudge } = await import('../threadline/PeerUserMeantJudge.js');
+            const { getFeatureMetricsRecorder } = await import('../core/CircuitBreakingIntelligenceProvider.js');
+            const { SecretStore } = await import('../core/SecretStore.js');
+            let userMeantCodex = null;
+            try {
+                const { LlmCircuitBreaker } = await import('../core/LlmCircuitBreaker.js');
+                const { buildIntelligenceProvider: buildUserMeantReferee } = await import('../core/intelligenceProviderFactory.js');
+                userMeantCodex = buildUserMeantReferee({ framework: 'codex-cli', breaker: new LlmCircuitBreaker() });
+            }
+            catch { /* @silent-fallback-ok — no Codex CLI; the shared provider is the next referee */ }
+            peerUserMeantJudge = buildPeerUserMeantJudge({
+                readPeerHomebaseBlock: () => liveConfig.get('threadline.peerHomebase', undefined),
+                readSecret: (name) => new SecretStore({ stateDir: config.stateDir, forceFileKey: config.secrets?.forceFileKey }).get(name),
+                referees: () => [
+                    ...(userMeantCodex ? [{ name: 'codex', provider: userMeantCodex }] : []),
+                    ...(sharedIntelligence ? [{ name: 'shared', provider: sharedIntelligence }] : []),
+                ],
+                stateDir: config.stateDir,
+                metrics: { record: (r) => getFeatureMetricsRecorder()?.record(r) },
+            });
+            console.log(pc.dim(`  Peer user-meant judge: constructed (referees: ${[userMeantCodex ? 'codex' : null, sharedIntelligence ? 'shared' : null].filter(Boolean).join(', ') || 'none'})`));
+        }
+        catch (err) {
+            console.log(pc.yellow(`  Peer user-meant judge: not constructed (${err?.message ?? 'unknown'}) — first-only rule applies`));
+        }
         const peerHomebaseRelay = telegram
             ? new PeerHomebaseRelay({
                 resolve: peerUserTopic,
                 salienceGate: new (await import('../threadline/SalienceGate.js')).SalienceGate(),
+                userMeantJudge: peerUserMeantJudge,
                 sendToTopic: (topicId, text) => withThreadlineForwardedAuthor(telegramOriginBoot?.runtime.service, 'inbound', topicId, text, () => telegram.sendToTopic(topicId, text)),
                 log: (m) => console.log(m),
             })
@@ -17924,7 +18006,11 @@ export async function startServer(options) {
         const a2aRelayForwardEnabled = () => a2aRelayForwardMod.resolveRelayForwardEnabled(liveConfig.get('threadline.relayForward.enabled', undefined), config);
         const salienceGate = new SalienceGate(); // fallback-only for v1; spec §5.4
         // §2.6: tell a spawned thread session which topic to use for the user.
-        threadlineRouter.setPeerUserTopicResolver((q) => peerUserTopic({ threadId: q.threadId, peers: q.peers }));
+        threadlineRouter.setPeerUserTopicResolver((q) => peerUserTopic({ threadId: q.threadId, peers: q.peers }), {
+            // §2.7: only where the relay has actually taken this thread under per-message judging.
+            serverPostsUserMeant: (threadId) => peerHomebaseRelay?.postsUserMeantFor(threadId) === true
+                && conversationStore.get(threadId)?.boundTopicId == null,
+        });
         let topicLinkageHandler = null;
         if (commitmentTracker) {
             topicLinkageHandler = new TopicLinkageHandler({
@@ -17985,6 +18071,15 @@ export async function startServer(options) {
                     const r = peerUserTopic({ threadId: q.threadId, peers: q.peers, existingTopicId: q.originTopicId });
                     return r.topicId;
                 },
+                // §2.7: a reply redirected to the homebase is judged per message (null when switched off).
+                judgeUserMeant: async (q) => {
+                    if (!peerUserMeantJudge || !peerUserMeantJudge.enabled())
+                        return null;
+                    const v = await peerUserMeantJudge.judge({ threadId: q.threadId, peer: q.peers[0] ?? '', senderName: q.senderName, text: q.text, deadlineMs: q.deadlineMs });
+                    if (v.firstOnly)
+                        return null; // the judge's budget is spent: the SalienceGate (first-only) decides
+                    return { verdict: v.userMeant ? 'user-visible' : 'agent-internal', reason: `per-message: ${v.decidedBy}/${v.reason}` };
+                },
                 onRemoteReplyEvent: (event) => {
                     if (event === 'ask')
                         a2aRelayForwardCtx.counters.replyAsks++;
@@ -18821,6 +18916,7 @@ export async function startServer(options) {
                                     peers: [senderFingerprint],
                                     senderName,
                                     text: textContent,
+                                    messageType: typeof msgType === 'string' ? msgType : null,
                                 }).then((r) => { if (!r.posted)
                                     hubSurface(); }, () => hubSurface());
                             }