instar 1.3.340 → 1.3.342

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA65RtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAy9RtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -3733,6 +3733,51 @@ export async function startServer(options) {
         catch (err) {
             console.log(pc.yellow(`  Worktree detector: skipped (${err instanceof Error ? err.message : String(err)})`));
         }
+        // GuardPostureTripwire — a disabled guard is itself an incident.
+        // Runs once per server boot. Compares the resolved guard posture (every
+        // monitoring.* enabled flag + scheduler.enabled) against the persisted
+        // posture from the previous boot; any enabled→disabled transition gets a
+        // loud log line + a logs/guard-posture.jsonl breadcrumb + ONE aggregated
+        // HIGH Attention item (the 2026-06-05 meltdown load-shed batch-flipped
+        // five guards off and only the scheduler was noticed — issue #882 / the
+        // EXO AUP-wedge evening). Signal-only: never re-enables, never blocks a
+        // boot. Placement mirrors the worktree detector above: after the
+        // Telegram setup blocks so `telegram.createAttentionItem` is available.
+        try {
+            const tripwire = await import('../monitoring/GuardPostureTripwire.js');
+            const postureResult = await tripwire.runGuardPostureTripwire({
+                config,
+                stateDir: config.stateDir,
+                logsDir: path.join(config.stateDir, '..', 'logs'),
+                emitAttention: telegram
+                    ? async (item) => {
+                        await telegram.createAttentionItem({
+                            id: item.id,
+                            title: item.title,
+                            summary: item.summary,
+                            description: item.description,
+                            category: item.category,
+                            priority: item.priority,
+                            sourceContext: item.sourceContext,
+                        });
+                    }
+                    : undefined,
+            });
+            if (postureResult.disabled.length > 0) {
+                console.log(pc.yellow(`  Guard-posture tripwire: ${postureResult.disabled.length} guard(s) DISABLED since last boot ` +
+                    `(${postureResult.disabled.join(', ')}) — ` +
+                    `${postureResult.attentionEmitted ? 'Attention item raised' : 'breadcrumb only (no Telegram)'}`));
+            }
+            else if (postureResult.firstBoot) {
+                console.log(pc.green('  Guard-posture tripwire: baseline recorded'));
+            }
+            else {
+                console.log(pc.green('  Guard-posture tripwire: posture unchanged'));
+            }
+        }
+        catch (err) {
+            console.log(pc.yellow(`  Guard-posture tripwire: skipped (${err instanceof Error ? err.message : String(err)})`));
+        }
         // ArcCheck (Layer 3) — declared at outer scope so the instance built inside
         // the telegram block is visible at AgentServer construction below. The same
         // instance backs the HTTP route and the in-process checkOutboundMessage caller.
@@ -4428,6 +4473,18 @@ export async function startServer(options) {
         // lifeline to restart the server in a tight loop.
         await sessionManager.purgeDeadSessions();
         sessionManager.startMonitoring();
+        // Pending-inject recovery (finding 8d300555): re-deliver initial messages
+        // orphaned by the previous server process dying in the spawn→ready→inject
+        // window (the auto-updater restart race). Runs AFTER the purge so dead
+        // sessions are already settled, and in the background — the ready-waits
+        // inside can take up to 90s per session and must not block boot.
+        void sessionManager.recoverPendingInjects().catch((err) => {
+            // @silent-fallback-ok boot recovery is a backstop that must NEVER crash
+            // boot — its own internal failures already route to DegradationReporter
+            // (sweepPendingInjects.reportLoss); this outer guard only catches an
+            // unexpected throw from the sweep harness itself.
+            console.error(`[server] Pending-inject recovery failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        });
         // StuckInputSentinel — persistent, restart-safe recovery for tmux prompts
         // that hold text but never submitted Enter. Complements the in-process
         // verifyInjection timers (PR #159) which die when the server crashes.