instar 1.3.373 → 1.3.375

package/dist/commands/server.d.ts

@@ -7,6 +7,11 @@
  * When Telegram is configured, wires up message routing:
  *   topic message → find/spawn session → inject message → session replies via [telegram:N]
  */
+import { SessionManager } from '../core/SessionManager.js';
+import { TelegramAdapter } from '../messaging/TelegramAdapter.js';
+import { TopicMemory } from '../memory/TopicMemory.js';
+import { QuotaTracker } from '../monitoring/QuotaTracker.js';
+import { UserManager } from '../users/UserManager.js';
 interface StartOptions {
     foreground?: boolean;
     dir?: string;
@@ -14,6 +19,7 @@ interface StartOptions {
      *  Commander maps --no-telegram to telegram: false. */
     telegram?: boolean;
 }
+export declare function wireTelegramRouting(telegram: TelegramAdapter, sessionManager: SessionManager, quotaTracker?: QuotaTracker, topicMemory?: TopicMemory, userManager?: UserManager, fixCommandHandler?: (topicId: number, text: string) => Promise<boolean>, getHubDeps?: () => import('../threadline/hubCommands.js').HubBindDeps | null, getTopicOperatorStore?: () => import('../users/TopicOperatorStore.js').TopicOperatorStore | null): void;
 export declare function startServer(options: StartOptions): Promise<void>;
 export declare function stopServer(options: {
     dir?: string;

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6SH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuxDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAwpTtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQ3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA6JtD,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAs4BD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,GAC/F,IAAI,CAyUN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+pTtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -304,6 +304,11 @@ function isAutostartInstalled(projectName) {
 let _orphanReaper = null;
 let _memoryMonitor = null;
 let _fixDeps = null;
+// Late-bound ref to the running AgentServer: wireTelegramRouting's
+// topic-operator getter (Know Your Principal increment 2e) resolves the
+// server's store at message-time — the server is constructed long after
+// routing is wired, and the store must be the server's OWN instance.
+let _agentServerRef = null;
 // Module-level reference for session resume mapping.
 // Set once in startServer() and used by spawnSessionForTopic/respawnSessionForTopic.
 let _topicResumeMap = null;
@@ -1067,10 +1072,15 @@ function messageToPipeline(msg, topicName) {
         timestamp: msg.receivedAt,
     };
 }
-function wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManager, fixCommandHandler, 
+export function wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManager, fixCommandHandler, 
 // Late-bound: the threadline hub deps are constructed AFTER this is wired, so
 // resolve them at message-time (CMT-529 deterministic "open this" intercept).
-getHubDeps) {
+getHubDeps, 
+// Late-bound (same reason as getHubDeps): the AgentServer's TopicOperatorStore —
+// the SAME instance the routes use (a second instance on the same file would
+// lose updates between the two in-memory caches). Know Your Principal #898,
+// increment 2e: the polling-path operator auto-bind.
+getTopicOperatorStore) {
     // Guard: tracks which topic IDs have a spawn in progress.
     // Prevents duplicate concurrent spawns for the same topic when messages
     // arrive faster than the async spawn completes.
@@ -1085,6 +1095,30 @@ getHubDeps) {
         const resolvedUser = telegramUserId && userManager
             ? userManager.resolveFromTelegramUserId(telegramUserId)
             : null;
+        // Topic-operator auto-bind (Know Your Principal #898, increment 2e — the
+        // POLLING-path writer; the lifeline-forward path already binds in routes.ts
+        // #909). This onTopicMessage seam is the convergence BOTH ingress paths
+        // reach, so binding here closes the no-lifeline gap; the routes-side bind
+        // stays (idempotent — same store instance, identical record skips the
+        // write). The isAuthorizedSender check is LOAD-BEARING: the lifeline path
+        // fires this callback for unauthorized senders too (it only skips its own
+        // bind), so without the check here an unauthorized group member could seat
+        // themselves as operator — the cross-principal "Caroline" bug. Fail-soft:
+        // no store / unauthorized / error → no-op and routing continues.
+        try {
+            const opStore = getTopicOperatorStore?.() ?? null;
+            if (opStore && telegramUserId && telegram.isAuthorizedSender(telegramUserId)) {
+                opStore.setOperator(topicId, {
+                    platform: 'telegram',
+                    uid: String(telegramUserId),
+                    displayName: msg.metadata?.firstName ?? undefined,
+                });
+            }
+        }
+        catch (err) {
+            // @silent-fallback-ok — an auto-bind failure must never break message routing.
+            console.error(`[telegram] topic-operator auto-bind error (non-fatal): ${err instanceof Error ? err.message : err}`);
+        }
         // In lifeline-owned polling mode (deep-signal, echo) TelegramAdapter's
         // own poll loop never runs, so its handleCommand() never fires on forwarded
         // messages. Route slash-commands through it here so /route, /sessions, /claim,
@@ -3581,7 +3615,7 @@ export async function startServer(options) {
             // reached the AI session as plain chat text.
             const userManagerSendOnly = new UserManager(config.stateDir, config.users);
             _fixDeps = { state, liveConfig, sessionManager, telegram, config };
-            wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManagerSendOnly, (topicId, text) => handleFixCommand(topicId, text, _fixDeps), () => (collaborationSurfacer && conversationStore && telegram) ? { collaborationSurfacer, conversationStore, commitmentTracker, telegram, brief: briefDeps } : null);
+            wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManagerSendOnly, (topicId, text) => handleFixCommand(topicId, text, _fixDeps), () => (collaborationSurfacer && conversationStore && telegram) ? { collaborationSurfacer, conversationStore, commitmentTracker, telegram, brief: briefDeps } : null, () => _agentServerRef?.getTopicOperatorStore() ?? null);
             wireTelegramCallbacks(telegram, sessionManager, state, quotaTracker, undefined, config.sessions.claudePath, topicMemory);
             console.log(pc.green('  Telegram routing + command callbacks wired (send-only)'));
         }
@@ -3763,7 +3797,7 @@ export async function startServer(options) {
                 config,
             };
             // Wire up topic → session routing and session management callbacks
-            wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManager, (topicId, text) => handleFixCommand(topicId, text, _fixDeps), () => (collaborationSurfacer && conversationStore && telegram) ? { collaborationSurfacer, conversationStore, commitmentTracker, telegram, brief: briefDeps } : null);
+            wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManager, (topicId, text) => handleFixCommand(topicId, text, _fixDeps), () => (collaborationSurfacer && conversationStore && telegram) ? { collaborationSurfacer, conversationStore, commitmentTracker, telegram, brief: briefDeps } : null, () => _agentServerRef?.getTopicOperatorStore() ?? null);
             wireTelegramCallbacks(telegram, sessionManager, state, quotaTracker, accountSwitcher, config.sessions.claudePath, topicMemory);
             // Wire up unknown-user handling (Multi-User Setup Wizard Phase 4.5)
             telegram.onGetRegistrationPolicy = () => ({
@@ -10897,6 +10931,10 @@ export async function startServer(options) {
             console.log(pc.dim(`  [session-pool] rollout gate not wired: ${err instanceof Error ? err.message : String(err)}`));
         }
         const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
+        // Resolve the late-bound topic-operator getter (increment 2e): routing was
+        // wired before the server existed; from here on inbound binds use the
+        // server's own store instance.
+        _agentServerRef = server;
         // Boot-recovery (tunnel-failure-resilience spec Part 6): if the agent
         // died mid-relay-episode, the persisted tunnel.json carries
         // rotationPending=true. Rotate the dashboard PIN + authToken BEFORE