instar 1.3.330 → 1.3.332

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4mRtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4uRtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -2191,22 +2191,56 @@ export async function startServer(options) {
             // ELOCKED errors from concurrent agent startups are transient.
             console.log(pc.yellow(`  Registry heartbeat failed to start (non-critical): ${err instanceof Error ? err.message : err}`));
         }
-        // Phase 5 — install the cost-aware routing policy on the global
-        // providers registry. The policy itself decides nothing today because
-        // no adapters are registered against the providers registry yet
-        // (adapter-registration at startup is tracked as a separate cycle —
-        // depends on per-machine credential discovery), but installing the
-        // policy now ensures any future call to `registry.resolve()` flows
-        // through the chain (CostAware → FirstAvailable; PinHonoringPolicy
-        // pending — recommended by the spec but not yet built) instead of
-        // defaulting to first-by-registration.
+        // Phase 5 — register the Anthropic adapters and install the cost-aware
+        // routing policy on the global providers registry. Registration is the
+        // formerly-deferred "separate cycle" (src/providers/bootRegistration.ts):
+        // gated (codex-only agents register nothing), idempotent, and LAZY (no
+        // tmux/claude spawns at boot — the pool only spawns on first use). With
+        // adapters actually registered, `registry.resolve()` decisions are real,
+        // and the policy's `readSdkCredit` is plumbed from the headless adapter's
+        // UsageMeterProvider instead of the old `() => null` stub.
         //
         // Idempotent: only installs when no policy has been set yet on the
         // module-singleton registry. Re-entering `startServer` in the same
         // process (test harnesses, in-proc respawn) won't clobber a policy
         // a caller (test or production wiring) installed first.
+        let anthropicRegistration = null;
         try {
             const { registry } = await import('../providers/registry.js');
+            const { registerAnthropicAdapters } = await import('../providers/bootRegistration.js');
+            // Scratch working dir for intelligence-pool sessions (context
+            // decontamination — no project CLAUDE.md/MCP in judgment calls).
+            const subscriptionPathConfig = config.intelligence?.subscriptionPath;
+            const poolWorkdir = subscriptionPathConfig?.workingDirectory
+                ?? path.join(config.stateDir, 'intelligence-pool');
+            try {
+                fs.mkdirSync(poolWorkdir, { recursive: true });
+            }
+            catch { /* spawn-time failure surfaces loudly */ }
+            anthropicRegistration = await registerAnthropicAdapters({
+                ...(config.enabledFrameworks ? { enabledFrameworks: config.enabledFrameworks } : {}),
+                ...(config.sessions?.claudePath ? { claudePath: config.sessions.claudePath } : {}),
+                ...(config.sessions?.tmuxPath ? { tmuxPath: config.sessions.tmuxPath } : {}),
+                pool: {
+                    poolSize: subscriptionPathConfig?.poolSize ?? 2,
+                    // One model per pool; 'haiku' default keeps sentinel chatter off
+                    // the subscription's large-model quota (types.ts rationale).
+                    model: subscriptionPathConfig?.model ?? 'haiku',
+                    workingDirectory: poolWorkdir,
+                    // Agent-scoped prefix — pool.start()'s orphan recovery kills
+                    // stale `<prefix>-*` tmux sessions from a crashed previous
+                    // process, so the prefix MUST be unique per agent on a shared
+                    // machine (an unscoped prefix would reap another agent's pool).
+                    sessionPrefix: `instar-pool-${String(config.projectName ?? 'agent').toLowerCase().replace(/[^a-z0-9-]/g, '-')}`,
+                },
+            });
+            if (anthropicRegistration.skippedReason) {
+                console.log(pc.dim(`  Providers registry: Anthropic adapters skipped (${anthropicRegistration.skippedReason})`));
+            }
+            else {
+                const ids = [...anthropicRegistration.registered, ...anthropicRegistration.alreadyRegistered];
+                console.log(pc.green(`  Providers registry: ${ids.join(', ')} registered`));
+            }
             // Read-only probe — `getRoutingPolicy` isn't on the public surface,
             // so we test by attempting a no-op resolve and seeing whether the
             // chain fires. Cheaper proxy: a private convention — set a marker
@@ -2222,10 +2256,10 @@ export async function startServer(options) {
                 const { CostAwareRoutingPolicy } = await import('../providers/costAwareRouting.js');
                 registry.setRoutingPolicy(new ChainPolicy([
                     new CostAwareRoutingPolicy({
-                        // Tier 3.C will plumb a real UsageMeterProvider here. Until
-                        // then, `null` means "state unknown" → policy falls to
-                        // subscription floor (conservative).
-                        readSdkCredit: async () => null,
+                        // Real credit reader from the headless adapter's usage meter
+                        // (TTL-cached; null = unknown → subscription floor). On a
+                        // skipped registration this stays a null-reader by contract.
+                        readSdkCredit: anthropicRegistration.readSdkCredit,
                         sdkCreditAdapterId: 'anthropic-headless',
                         subscriptionAdapterId: 'anthropic-interactive-pool',
                     }),
@@ -2236,9 +2270,18 @@ export async function startServer(options) {
             }
         }
         catch (err) {
-            // Policy install is non-critical — sessions still resolve adapters
-            // via the registry's first-match-by-registration fallback.
-            console.log(pc.yellow(`  Routing policy install failed (non-critical): ${err instanceof Error ? err.message : err}`));
+            // Registration/policy install is non-critical — sessions still resolve
+            // adapters via the registry's first-match-by-registration fallback.
+            // But it IS a degradation: the June-15 subscription-path routing is
+            // not live in this process, so report it rather than only logging.
+            console.log(pc.yellow(`  Providers registration/policy install failed (non-critical): ${err instanceof Error ? err.message : err}`));
+            DegradationReporter.getInstance().report({
+                feature: 'serverBoot.anthropicProviderRegistration',
+                primary: 'both Anthropic adapters registered + cost-aware routing policy installed at boot',
+                fallback: 'empty providers registry — internal LLM calls stay on the legacy claude -p path with no SDK-pot-vs-subscription routing',
+                reason: `registration/policy install threw: ${err instanceof Error ? err.message : String(err)}`,
+                impact: 'subscription-path routing (June-15 readiness) is unavailable for this server process until restart',
+            });
         }
         // Warn if no auth token configured — server allows unauthenticated access
         if (!config.authToken) {
@@ -2659,6 +2702,10 @@ export async function startServer(options) {
             enabled: config.intelligence?.circuitBreaker?.enabled,
             openMs: config.intelligence?.circuitBreaker?.openMs,
         });
+        // Hoisted out of the provider-build try block: the per-component
+        // IntelligenceRouter below (outside that try) reuses the same
+        // subscription-path option for its claude-code builds.
+        let subscriptionPathOption;
         // Provider-portability v1.0.0: pick the IntelligenceProvider that
         // matches the configured framework. Defaults to claude-code for
         // backwards-compat; INSTAR_FRAMEWORK=codex-cli routes through Codex.
@@ -2719,9 +2766,55 @@ export async function startServer(options) {
             catch (err) {
                 console.warn(`[server] TopicLocalModelStore failed to initialize: ${err}`);
             }
+            // June-15 subscription-path routing (spec 04 Rule 1). Built ONCE here;
+            // reused by the main provider below AND the per-component
+            // IntelligenceRouter's claude-code builds, so a component routed to
+            // claude-code while the default framework is codex still gets the
+            // same SDK-pot-vs-subscription routing. Mode 'off'/unset ⇒ option
+            // stays undefined ⇒ claude path byte-for-byte unchanged.
+            const spMode = config.intelligence?.subscriptionPath?.mode ?? 'off';
+            if ((spMode === 'auto' || spMode === 'force') && anthropicRegistration?.pool) {
+                // (string | undefined, not `= null` — a `= null;` initializer inside
+                // the preceding catch's 20-line scan window false-flags the unrelated
+                // TopicLocalModelStore catch in no-silent-fallbacks.test.ts.)
+                let lastRoutedPath;
+                subscriptionPathOption = {
+                    mode: spMode,
+                    poolAdapter: anthropicRegistration.pool,
+                    readSdkCredit: anthropicRegistration.readSdkCredit,
+                    // Transition-only logging (reaper-audit pattern): a line when the
+                    // serving path CHANGES, not per call — ~1k internal calls/day must
+                    // not become 1k log lines.
+                    onRoute: (info) => {
+                        if (info.path !== lastRoutedPath) {
+                            lastRoutedPath = info.path;
+                            console.log(pc.gray(`  [subscription-path] serving internal intelligence via ${info.path} (${info.reason})`));
+                        }
+                    },
+                    onDegrade: (info) => {
+                        try {
+                            DegradationReporter.getInstance().report({
+                                feature: 'AnthropicSubscriptionRouter',
+                                primary: `internal intelligence on ${info.from}`,
+                                fallback: `fell back to ${info.to}`,
+                                reason: info.reason,
+                                impact: `Internal LLM call${info.component ? ` (${info.component})` : ''} served by ${info.to} after ${info.from} failed.`,
+                            });
+                        }
+                        catch { /* never break the LLM path on a degradation report */ }
+                    },
+                };
+                console.log(pc.green(`  Subscription-path routing: mode '${spMode}' (pool model: ${config.intelligence?.subscriptionPath?.model ?? 'haiku'})`));
+            }
+            else if (spMode !== 'off') {
+                // Configured but unusable (codex-only gate, registration failure) —
+                // say so loudly rather than silently running the SDK path.
+                console.log(pc.yellow(`  Subscription-path routing: mode '${spMode}' configured but the interactive-pool adapter is unavailable — internal calls stay on the default claude -p path`));
+            }
             const built = buildIntelligenceProvider({
                 framework,
                 binaryPath: framework === 'claude-code' ? config.sessions.claudePath : undefined,
+                ...(subscriptionPathOption ? { subscriptionPath: subscriptionPathOption } : {}),
                 ...(framework === 'gemini-cli' && config.monitoring?.quotaTracking
                     ? {
                         quotaStateFile: config.monitoring.quotaStateFile
@@ -2768,7 +2861,16 @@ export async function startServer(options) {
                     resolveConfig: () => config.sessions?.componentFrameworks,
                     // Each non-default framework gets its OWN breaker → a Claude trip can't
                     // pause Codex (the whole point). Default framework keeps the shared one.
-                    buildProvider: (fw) => buildIP({ framework: fw, breaker: new LlmCircuitBreaker() }),
+                    // claude-code builds inherit the subscription-path routing so a
+                    // component routed to Claude under a codex default still honors
+                    // the June-15 SDK-pot-vs-subscription decision.
+                    buildProvider: (fw) => buildIP({
+                        framework: fw,
+                        breaker: new LlmCircuitBreaker(),
+                        ...(fw === 'claude-code' && subscriptionPathOption
+                            ? { subscriptionPath: subscriptionPathOption }
+                            : {}),
+                    }),
                     onDegrade: (info) => {
                         try {
                             DegradationReporter.getInstance().report({
@@ -8958,6 +9060,18 @@ export async function startServer(options) {
                 // topics with no new messages instead of rebuilding every topic's
                 // history every tick (the 2026-06-05 event-loop-stall fix).
                 getTopicVersion: (topic) => telegram.getTopicContentVersion(Number(topic)),
+                // Eternal Sentinel condition 4 (P19): a topic whose standby copy has
+                // been stale past the threshold surfaces ONCE per episode through the
+                // standard degradation channel (housekeeping — never a user ping).
+                reportStaleStandby: ({ topic, failingForMs, consecutiveFailures }) => {
+                    DegradationReporter.getInstance().report({
+                        feature: 'LiveTail.standbyFreshness',
+                        primary: 'Standby machine receives a fresh copy of each conversation tail',
+                        fallback: `Topic ${telegram.getTopicName?.(Number(topic)) ?? topic}'s standby copy is stale (flushes failing ~${Math.round(failingForMs / 60_000)}min, ${consecutiveFailures} consecutive); retries continue on capped backoff`,
+                        reason: 'Live-tail flushes to the standby peer are persistently rejected or unreachable',
+                        impact: 'A failover during this window would resume that conversation from an older tail (bounded by the outage start).',
+                    });
+                },
                 transport: sendTransport,
                 logger: (m) => console.log(pc.dim(m)),
             });
@@ -10164,6 +10278,20 @@ export async function startServer(options) {
                 return;
             _shuttingDown = true;
             console.log('\nShutting down...');
+            // Dispose the interactive-pool adapter (kills its tmux REPL sessions
+            // so they don't orphan). No-op when registration was skipped or the
+            // pool never spawned (lazy). Must run before process exit — orphaned
+            // pool sessions would silently keep drawing subscription quota.
+            if (anthropicRegistration?.pool) {
+                try {
+                    const { registry: providersRegistry } = await import('../providers/registry.js');
+                    await providersRegistry.unregister(anthropicRegistration.pool.id);
+                    console.log('[shutdown] Interactive-pool adapter disposed');
+                }
+                catch (err) {
+                    console.error('[shutdown] Interactive-pool dispose failed:', err);
+                }
+            }
             // Save resume UUIDs for ALL active topic-linked sessions before exit.
             // Without this, server restarts lose all resume mappings because:
             // 1. Resume entries are consumed (removed) on spawn