instar 1.3.398 → 1.3.400

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQ3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA6JtD,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA04BD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,GAC/F,IAAI,CAyUN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAm3TtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQ3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA6JtD,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA05BD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,GAC/F,IAAI,CAyUN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAk9TtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -341,6 +341,10 @@ let _secretSyncHandle = null;
  *  ticket store — minted by the `pool-stream-ticket` mesh verb, consumed by the
  *  WebSocketManager's /pool-stream upgrade. Constructed in the mesh-setup block. */
 let _streamTicketStore = null;
+/** Pool Dashboard Streaming requesting side (§2.2): opens upstream /pool-stream
+ *  links to peers (mint a ticket via the mesh verb, then connect). Injected into
+ *  the WebSocketManager so a remote-session subscribe streams from its owner. */
+let _poolStreamConnector = null;
 /** Recognize + apply a "move/run this on <nickname>" relocation on inbound; returns handled=true when the message WAS a relocation command (so it must not also be dispatched). */
 let _tryNicknameRelocation = null;
 /** Per-topic framework override (claude-code | codex-cli). Populated from
@@ -374,7 +378,14 @@ let _slackAdapter = null;
 // Null until startServer constructs it; the Telegram /restart handler falls
 // back to the inline kill+respawn path when null (e.g. early in boot).
 let _sessionRefresh = null;
-async function spawnSessionForTopic(sessionManager, telegram, sessionName, topicId, latestMessage, topicMemory, userProfile, precomputedContext) {
+// Subscription & Auth Standard P1.3 — quota-aware account-swap scheduler. Null
+// until wired (requires SessionRefresh + the subscription pool).
+let _quotaAwareScheduler = null;
+async function spawnSessionForTopic(sessionManager, telegram, sessionName, topicId, latestMessage, topicMemory, userProfile, precomputedContext, 
+/** Subscription & Auth Standard P1.3 (additive): launch under this account's
+ *  config home + record its id (the quota-aware account-swap mechanism).
+ *  Omitted = unchanged behaviour. */
+accountSwap) {
     const msg = latestMessage || 'Session started — send a message to continue.';
     // If memory is elevated/critical and we have the reaper, try to free memory
     // by cleaning orphans before spawning. Interactive sessions are NEVER blocked
@@ -615,6 +626,10 @@ async function spawnSessionForTopic(sessionManager, telegram, sessionName, topic
         framework,
         ...(codexLocalProvider ? { codexLocalProvider } : {}),
         ...(codexLocalModelOverride ? { defaultModel: codexLocalModelOverride } : {}),
+        // Subscription & Auth Standard P1.3 (additive): account-swap — launch under
+        // this account's config home + record its id. Unset = unchanged.
+        ...(accountSwap?.configHome ? { configHome: accountSwap.configHome } : {}),
+        ...(accountSwap?.accountId ? { subscriptionAccountId: accountSwap.accountId } : {}),
     });
     // Clear the resume entry after successful spawn to prevent stale reuse
     if (resumeSessionId) {
@@ -692,7 +707,7 @@ async function respawnSessionForTopic(sessionManager, telegram, targetSession, t
     const effectiveMessage = recoveryPrompt
         ? `${recoveryPrompt}\n\n${latestMessage || 'Session recovered — continue where you left off.'}`
         : latestMessage;
-    const newSessionName = await spawnSessionForTopic(sessionManager, telegram, topicName, topicId, effectiveMessage, topicMemory, userProfile);
+    const newSessionName = await spawnSessionForTopic(sessionManager, telegram, topicName, topicId, effectiveMessage, topicMemory, userProfile, undefined, (options?.configHome || options?.accountId) ? { configHome: options?.configHome, accountId: options?.accountId } : undefined);
     telegram.registerTopicSession(topicId, newSessionName, topicName);
     if (!options?.silent) {
         await telegram.sendToTopic(topicId, `Session respawned.`);
@@ -9257,15 +9272,72 @@ export async function startServer(options) {
                 state,
                 telegram: telegramRef,
                 topicResumeMap: _topicResumeMap,
-                respawner: async (sessionName, topicId, followUpPrompt) => {
+                respawner: async (sessionName, topicId, followUpPrompt, accountSwap) => {
                     // killSession (called inside SessionRefresh) has already fired
                     // beforeSessionKill (UUID persisted) and destroyed the tmux
                     // session. respawnSessionForTopic spawns the new tmux running
                     // `claude --resume <uuid>` and registers the topic mapping.
-                    await respawnSessionForTopic(sessionManager, telegramRef, sessionName, topicId, followUpPrompt, topicMemory);
+                    // P1.3: accountSwap (when present) re-launches the resume under a
+                    // different account's config home — the --resume uuid is account-
+                    // agnostic, so the conversation is preserved across the swap.
+                    await respawnSessionForTopic(sessionManager, telegramRef, sessionName, topicId, followUpPrompt, topicMemory, undefined, undefined, accountSwap ? { configHome: accountSwap.configHome, accountId: accountSwap.accountId } : undefined);
                     return telegramRef.getSessionForTopic(topicId) ?? sessionName;
                 },
             });
+            // ── QuotaAwareScheduler (Subscription & Auth Standard P1.3) ──
+            // Selects the optimal account + enforces the continuity guarantee: on
+            // quota pressure it resumes the session under another account (via the
+            // SessionRefresh account-swap path), never letting it die. Auto-trigger
+            // off RateLimitSentinel ships DARK behind a config flag (default off);
+            // the manual route + selection logic are always available.
+            const { QuotaAwareScheduler } = await import('../core/QuotaAwareScheduler.js');
+            _quotaAwareScheduler = new QuotaAwareScheduler({
+                listAccounts: () => subscriptionPool.list(),
+                softThresholdPct: config.subscriptionPool?.swapSoftThresholdPct,
+                refreshFn: async (o) => {
+                    if (!_sessionRefresh)
+                        return false;
+                    const r = await _sessionRefresh.refreshSession({
+                        sessionName: o.sessionName,
+                        reason: o.reason,
+                        configHome: o.configHome,
+                        accountId: o.accountId,
+                    });
+                    return r.ok;
+                },
+                onNoAlternate: (sessionName, exhaustedAccountId) => {
+                    void telegramRef.createAttentionItem({
+                        id: `subpool-no-alternate-${exhaustedAccountId}`,
+                        title: 'Subscription pool — no alternate account to swap to',
+                        summary: `Session "${sessionName}" hit account "${exhaustedAccountId}"'s quota and there's no other eligible account in the pool. The session falls back to the existing rate-limit back-off; consider enrolling another account.`,
+                        category: 'subscription-pool',
+                        priority: 'HIGH',
+                        sourceContext: 'subscription-pool:no-alternate',
+                    }).catch(() => { });
+                },
+                logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            });
+            // DARK auto-trigger: only when explicitly enabled does a rate-limit
+            // escalation drive an account swap. Default off — opt-in per Justin's
+            // tier-2 sign-off (auto-swapping live sessions is real authority).
+            if (config.subscriptionPool?.autoSwapOnRateLimit) {
+                rateLimitSentinel.on('rate-limit:escalated', (rlState) => {
+                    const sessionName = rlState?.sessionName;
+                    if (!sessionName)
+                        return;
+                    // Resolve which account this session is running under; only pool-managed
+                    // sessions are swap-eligible (others fall back to the existing back-off).
+                    const accountId = state.listSessions({ status: 'running' })
+                        .find(s => s.tmuxSession === sessionName)?.subscriptionAccountId;
+                    if (!accountId)
+                        return;
+                    void _quotaAwareScheduler?.onQuotaPressure({
+                        sessionName,
+                        exhaustedAccountId: accountId,
+                        nowMs: Date.now(),
+                    });
+                });
+            }
         }
         // ── SessionReaper (SESSION-REAPER-SPEC) ──────────────────────────────
         // Pressure-aware reaper of idle-but-alive sessions. Ships OFF + dry-run by
@@ -10266,6 +10338,64 @@ export async function startServer(options) {
                         .getActiveMachines()
                         .filter((m) => m.machineId !== meshSelfId && !!m.entry.lastKnownUrl)
                         .map((m) => ({ machineId: m.machineId, url: m.entry.lastKnownUrl }));
+                    // Pool Dashboard Streaming requesting side (§2.2): build the connector
+                    // the WebSocketManager uses to open an upstream /pool-stream to a peer.
+                    // connect() is synchronous (PeerStreamProxy contract) but the mint +
+                    // ws-open are async — so we return a transport immediately that buffers
+                    // sends until the socket opens, mints a single-use ticket over the
+                    // machine-authed mesh verb, then connects ws://<peer>/pool-stream?ticket=.
+                    // A failure at any step fires onClose (the proxy treats it as a drop →
+                    // bounded reconnect → machine-unreachable).
+                    {
+                        const { WebSocket: WsClient } = await import('ws');
+                        _poolStreamConnector = {
+                            connect: (machineId, handlers) => {
+                                const httpUrl = peerUrl(machineId);
+                                if (!httpUrl)
+                                    return null;
+                                let ws = null;
+                                let open = false;
+                                let closed = false;
+                                const pending = [];
+                                (async () => {
+                                    try {
+                                        const r = await meshClient.send({ machineId, url: httpUrl }, { type: 'pool-stream-ticket', session: '*' }, 0);
+                                        const ticket = r.ok && r.result && typeof r.result === 'object' ? r.result.ticket : undefined;
+                                        if (!ticket || closed) {
+                                            if (!closed)
+                                                handlers.onClose();
+                                            return;
+                                        }
+                                        const wsUrl = httpUrl.replace(/^http/, 'ws').replace(/\/$/, '') + `/pool-stream?ticket=${encodeURIComponent(ticket)}`;
+                                        ws = new WsClient(wsUrl);
+                                        ws.on('open', () => { open = true; for (const m of pending)
+                                            ws.send(m); pending.length = 0; handlers.onOpen(); });
+                                        ws.on('message', (d) => { try {
+                                            handlers.onFrame(JSON.parse(String(d)));
+                                        }
+                                        catch { /* @silent-fallback-ok: a non-JSON peer frame is dropped; the stream protocol is JSON-only (§2.2) */ } });
+                                        ws.on('close', () => handlers.onClose());
+                                        ws.on('error', () => { if (!open)
+                                            handlers.onClose(); });
+                                    }
+                                    catch {
+                                        if (!closed)
+                                            handlers.onClose();
+                                    }
+                                })();
+                                return {
+                                    send: (frame) => { const s = JSON.stringify(frame); if (open && ws)
+                                        ws.send(s);
+                                    else
+                                        pending.push(s); },
+                                    close: () => { closed = true; try {
+                                        ws?.close();
+                                    }
+                                    catch { /* @silent-fallback-ok: closing an unopened/dead upstream is best-effort (§2.2) */ } },
+                                };
+                            },
+                        };
+                    }
                     // ── Self-nickname convergence (§L4, 2026-06-04 live-caught fix) ──
                     // `updateNickname` (PATCH /pool/machines) is local-only, so a rename applied on a
                     // PEER's registry never reaches the owning machine — leaving that machine unable to
@@ -11152,7 +11282,7 @@ export async function startServer(options) {
         catch (err) {
             console.log(pc.dim(`  [session-pool] rollout gate not wired: ${err instanceof Error ? err.message : String(err)}`));
         }
-        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, quotaPoller, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
+        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
         // Resolve the late-bound topic-operator getter (increment 2e): routing was
         // wired before the server existed; from here on inbound binds use the
         // server's own store instance.