instar 1.3.343 → 1.3.345

package/dist/commands/server.js

@@ -28,8 +28,6 @@ import { AgentServer } from '../server/AgentServer.js';
 import { TelegramAdapter, TOPIC_STYLE, selectTopicEmoji } from '../messaging/TelegramAdapter.js';
 import { getTelegramInboundDir } from '../messaging/shared/telegramInboundFiles.js';
 import { RelationshipManager } from '../core/RelationshipManager.js';
-import { ClaudeCliIntelligenceProvider } from '../core/ClaudeCliIntelligenceProvider.js';
-import { wrapIntelligenceWithCircuitBreaker } from '../core/CircuitBreakingIntelligenceProvider.js';
 import { configureLlmCircuitBreaker } from '../core/LlmCircuitBreaker.js';
 import { isClaudeForbidden } from '../core/claudeForbiddenGuard.js';
 import { FeedbackManager } from '../core/FeedbackManager.js';
@@ -2241,6 +2239,40 @@ export async function startServer(options) {
                 const ids = [...anthropicRegistration.registered, ...anthropicRegistration.alreadyRegistered];
                 console.log(pc.green(`  Providers registry: ${ids.join(', ')} registered`));
             }
+            // pi-cli adapter (PI-HARNESS-INTEGRATION-SPEC §4.2) — ships dark:
+            // registers ONLY when enabledFrameworks explicitly contains 'pi-cli'
+            // AND the binary is detectable. Own try/catch: a pi registration
+            // failure must never affect the Anthropic adapters or the boot.
+            try {
+                const { registerPiAdapters } = await import('../providers/bootRegistration.js');
+                const piRegistration = await registerPiAdapters({
+                    ...(config.enabledFrameworks ? { enabledFrameworks: config.enabledFrameworks } : {}),
+                    ...(config.sessions?.frameworkBinaryPaths?.['pi-cli']
+                        ? { piPath: config.sessions.frameworkBinaryPaths['pi-cli'] }
+                        : {}),
+                    ...(config.sessions?.frameworkDefaultModels?.['pi-cli']
+                        ? { model: config.sessions.frameworkDefaultModels['pi-cli'] }
+                        : {}),
+                    ...(config.sessions?.piCliAllowAnthropicProviders !== undefined
+                        ? { allowAnthropicProviders: config.sessions.piCliAllowAnthropicProviders }
+                        : {}),
+                    sessionDir: path.join(config.stateDir, 'pi-sessions'),
+                });
+                if (piRegistration.skippedReason) {
+                    if (piRegistration.skippedReason === 'pi-binary-missing') {
+                        // Configured-but-missing is worth a visible (non-fatal) note.
+                        console.log(pc.yellow(`  Providers registry: pi-cli enabled but binary missing — install @earendil-works/pi-coding-agent`));
+                    }
+                    // 'pi-not-enabled' is the dark default — say nothing.
+                }
+                else {
+                    const piIds = [...piRegistration.registered, ...piRegistration.alreadyRegistered];
+                    console.log(pc.green(`  Providers registry: ${piIds.join(', ')} registered`));
+                }
+            }
+            catch (err) {
+                console.warn(`  Providers registry: pi-cli registration failed (non-fatal): ${err instanceof Error ? err.message : err}`);
+            }
             // Read-only probe — `getRoutingPolicy` isn't on the public surface,
             // so we test by attempting a no-op resolve and seeing whether the
             // chain fires. Cheaper proxy: a private convention — set a marker
@@ -2713,6 +2745,11 @@ export async function startServer(options) {
         const codexThreadlineMcp = config.threadline
             ? resolveThreadlineMcpEntry(config.sessions.projectDir, config.stateDir, config.projectName)
             : undefined;
+        // Headless-spawn reroute (june15-headless-spawn-reroute, PR2): thread the
+        // subscriptionPath mode + caps so spawnSession's claude-code headless branch
+        // knows whether to reroute a `claude -p` one-shot onto the interactive
+        // (subscription) lane. Absent/'off' ⇒ today's behavior, byte-for-byte.
+        const subscriptionPathCfg = config.intelligence?.subscriptionPath;
         const sessionManagerConfig = {
             ...config.sessions,
             ...(codexThreadlineMcp ? { codexThreadlineMcp } : {}),
@@ -2720,8 +2757,21 @@ export async function startServer(options) {
                 ...(config.sessions.respawnBuildContext ?? {}),
                 enabled: config.sessions.respawnBuildContext?.enabled ?? !!config.developmentAgent,
             },
+            subscriptionPathMode: subscriptionPathCfg?.mode ?? 'off',
+            ...(subscriptionPathCfg?.maxRerouted != null ? { subscriptionMaxRerouted: subscriptionPathCfg.maxRerouted } : {}),
+            ...(subscriptionPathCfg?.maxReroutedLifetimeMinutes != null
+                ? { subscriptionReroutedLifetimeMinutes: subscriptionPathCfg.maxReroutedLifetimeMinutes }
+                : {}),
         };
         const sessionManager = new SessionManager(sessionManagerConfig, state);
+        // Wire the SAME TTL-cached SDK-credit reader PR1's routing policy uses, so
+        // the reroute 'auto' decision and the intelligence-funnel routing share one
+        // credit source and can't drift (june15-headless-spawn-reroute, PR2). Only
+        // when registration succeeded; otherwise 'auto' resolves to the subscription
+        // floor via the null-snapshot contract.
+        if (anthropicRegistration?.readSdkCredit) {
+            sessionManager.setSdkCreditReader(anthropicRegistration.readSdkCredit);
+        }
         // Input Guard is constructed later (after sharedIntelligence is available)
         // so the topic coherence reviewer can route through the IntelligenceProvider
         // abstraction instead of calling Anthropic directly.
@@ -2919,10 +2969,18 @@ export async function startServer(options) {
                         : 'Claude CLI subscription';
             }
             else {
-                // Fall back to the legacy Claude path for backwards-compat. Wrap with
-                // the circuit breaker (the factory path above is already wrapped).
+                // Fall back to the legacy Claude path for backwards-compat — via the
+                // factory, not direct construction (june15-headless-spawn-reroute,
+                // Class 8): the factory carries the breaker wrap AND the
+                // subscription-path router, so a fallback provider can't silently
+                // dodge June-15 routing. Factory-null (no claude binary) now yields
+                // an honest absence instead of a provider with an undefined path.
                 sharedIntelligence =
-                    wrapIntelligenceWithCircuitBreaker(new ClaudeCliIntelligenceProvider(config.sessions.claudePath)) ?? undefined;
+                    buildIntelligenceProvider({
+                        framework: 'claude-code',
+                        binaryPath: config.sessions.claudePath,
+                        ...(subscriptionPathOption ? { subscriptionPath: subscriptionPathOption } : {}),
+                    }) ?? undefined;
                 intelligenceSource = 'Claude CLI subscription (fallback)';
             }
         }
@@ -2958,6 +3016,19 @@ export async function startServer(options) {
                         ...(fw === 'claude-code' && subscriptionPathOption
                             ? { subscriptionPath: subscriptionPathOption }
                             : {}),
+                        // pi-cli routing (PI-HARNESS-INTEGRATION-SPEC §4.4): thread the
+                        // configured model pattern + the explicit Anthropic override.
+                        // Absent pattern ⇒ the factory degrades to null (guarded by design).
+                        ...(fw === 'pi-cli'
+                            ? {
+                                ...(config.sessions?.frameworkDefaultModels?.['pi-cli']
+                                    ? { piModel: config.sessions.frameworkDefaultModels['pi-cli'] }
+                                    : {}),
+                                ...(config.sessions?.piCliAllowAnthropicProviders !== undefined
+                                    ? { piAllowAnthropicProviders: config.sessions.piCliAllowAnthropicProviders }
+                                    : {}),
+                            }
+                            : {}),
                     }),
                     onDegrade: (info) => {
                         try {
@@ -3053,8 +3124,14 @@ export async function startServer(options) {
                 // be built but a claude binary path is still configured. Skipped on
                 // codex-only agents (isClaudeForbidden) — there, relationships run
                 // without LLM intelligence rather than silently using Claude.
+                // Via the factory (Class 8): carries breaker + subscription router.
+                const { buildIntelligenceProvider: buildFallbackIP } = await import('../core/intelligenceProviderFactory.js');
                 config.relationships.intelligence =
-                    wrapIntelligenceWithCircuitBreaker(new ClaudeCliIntelligenceProvider(config.sessions.claudePath)) ?? undefined;
+                    buildFallbackIP({
+                        framework: 'claude-code',
+                        binaryPath: config.sessions.claudePath,
+                        ...(subscriptionPathOption ? { subscriptionPath: subscriptionPathOption } : {}),
+                    }) ?? undefined;
                 intelligenceMode = 'LLM-supervised (Claude CLI subscription, fallback)';
             }
             relationships = new RelationshipManager(config.relationships);
@@ -4442,6 +4519,10 @@ export async function startServer(options) {
                 reason: e.reason,
                 disposition: e.disposition,
                 origin: e.origin,
+                // Positive-lane observability (june15-headless-spawn-reroute O4): record
+                // which billing lane the reaped session ran on so the soak can confirm
+                // rerouted sessions reach their completion from the reap-log too.
+                ...(e.session.launchLane ? { launchLane: e.session.launchLane } : {}),
             });
             reapNotifier.onReaped({ session: e.session, reason: e.reason, disposition: e.disposition, origin: e.origin });
             // Coherence journal 'reaped' (§3.3): emitted HERE, alongside the
@@ -4689,8 +4770,15 @@ export async function startServer(options) {
                 summaryIntelligence = sharedIntelligence;
             }
             else if (!isClaudeForbidden()) {
-                const { ClaudeCliIntelligenceProvider } = await import('../core/ClaudeCliIntelligenceProvider.js');
-                summaryIntelligence = wrapIntelligenceWithCircuitBreaker(new ClaudeCliIntelligenceProvider(config.sessions.claudePath));
+                // Via the factory (june15-headless-spawn-reroute, Class 8): carries
+                // the breaker wrap + the subscription-path router so topic summaries
+                // can't silently dodge June-15 routing.
+                const { buildIntelligenceProvider: buildSummaryIP } = await import('../core/intelligenceProviderFactory.js');
+                summaryIntelligence = buildSummaryIP({
+                    framework: 'claude-code',
+                    binaryPath: config.sessions.claudePath,
+                    ...(subscriptionPathOption ? { subscriptionPath: subscriptionPathOption } : {}),
+                });
             }
             // On a codex-only agent without a built Codex provider, summaryIntelligence
             // stays null — topic summaries are skipped rather than run on Claude.
@@ -7460,6 +7548,21 @@ export async function startServer(options) {
                 ?? config.maxSessions
                 ?? 5,
             getActiveSessions: () => sessionManager.listRunningSessions(),
+            // Subscription-quota gate (june15-headless-spawn-reroute, finding S1):
+            // wired ONLY when the subscription-path reroute is active — rerouted
+            // A2A cold spawns land on the operator's 5h window, so inbound peer
+            // traffic must respect the same quota gate scheduled jobs already do
+            // (otherwise a chatty peer can rate-limit the USER's own
+            // conversations). mode 'off' (the fleet default): seam absent,
+            // admission byte-for-byte unchanged.
+            ...((config.intelligence?.subscriptionPath?.mode === 'auto'
+                || config.intelligence?.subscriptionPath?.mode === 'force')
+                ? {
+                    shouldSpawnSession: (priority) => quotaTracker
+                        ? quotaTracker.shouldSpawnSession(priority)
+                        : { allowed: true, reason: 'No quota tracker — fail open' },
+                }
+                : {}),
             spawnSession: async (prompt, opts) => {
                 // Warm-session A2A (Arch Y): when the SpawnRequest is flagged interactive,
                 // launch a PERSISTENT (keep-alive) interactive worker instead of the
@@ -7855,6 +7958,21 @@ export async function startServer(options) {
                     // Same per-agent codex threadline MCP override as SessionManager, so a
                     // codex pipe-reply worker uses THIS agent's threadline MCP.
                     ...(codexThreadlineMcp ? { codexThreadlineMcp } : {}),
+                    // June-15 subscription-path gates (spec Class 7 + findings S1/S4):
+                    // live mode accessor — under 'force' a claude-code pipe spawn
+                    // refuses from inside spawn() (the only shape that both fires the
+                    // degradation event AND falls through to the rerouted A2A path);
+                    // the quota gate stops auto-mode pipe spawns from hammering a hot
+                    // 5h window. Mode 'off' (default): both accessors are inert.
+                    getSubscriptionPathMode: () => config.intelligence?.subscriptionPath?.mode ?? 'off',
+                    ...((config.intelligence?.subscriptionPath?.mode === 'auto'
+                        || config.intelligence?.subscriptionPath?.mode === 'force')
+                        ? {
+                            shouldSpawnSession: () => quotaTracker
+                                ? quotaTracker.shouldSpawnSession()
+                                : { allowed: true, reason: 'No quota tracker — fail open' },
+                        }
+                        : {}),
                 });
                 console.log(pc.dim(`  Pipe sessions: enabled (model: ${pipeConfig?.model ?? 'sonnet'}, max: ${pipeConfig?.maxConcurrent ?? 5})`));
             }