instar 1.3.400 → 1.3.402

package/dashboard/index.html

@@ -212,9 +212,11 @@
       background: #3a2a1b;
       color: #fbbf24;
     }
-    /* A session running on ANOTHER machine — visible, but its terminal can't
-       stream here (open that machine's dashboard to interact). */
-    .session-item.remote { opacity: 0.8; cursor: default; }
+    /* A session running on ANOTHER machine — now clickable; selecting it
+       streams its terminal here via the cross-machine relay (§2.2). The badge
+       already names the machine, so a slightly dimmed row is enough hint. */
+    .session-item.remote { opacity: 0.9; cursor: pointer; }
+    .session-item.remote:hover { opacity: 1; }
 
     .type-badge {
       padding: 1px 6px;
@@ -3582,6 +3584,7 @@
     let remoteSessions = [];
     let selfMachineNickname = null;
     let activeSession = null;
+    let activeMachineId = null; // non-null when the active session streams from a peer (§2.2)
     let term = null;
     let fitAddon = null;
     let historyLinesLoaded = 2000; // matches initial subscribe capture
@@ -3677,6 +3680,12 @@
       ws.onopen = () => {
         reconnectAttempts = 0;
         updateConnectionStatus(true);
+        // Resubscribe the active session after a (re)connect so a server
+        // restart doesn't strand the terminal (§2.5). Remote sessions carry
+        // their machineId so the resubscribe re-opens the relay.
+        if (activeSession) {
+          wsSend({ type: 'subscribe', session: activeSession, ...(activeMachineId ? { machineId: activeMachineId } : {}) });
+        }
       };
 
       ws.onclose = () => {
@@ -3768,7 +3777,21 @@
           break;
 
         case 'error':
-          console.error('[ws]', msg.message);
+          // Pool Dashboard Streaming (§2.4): every remote-stream failure state
+          // is shown honestly in the terminal — never a frozen/black screen or
+          // a silent swallow. Only surface errors for the session in view.
+          if (msg.code && term && (msg.session === activeSession || !msg.session)) {
+            const m = {
+              'machine-unreachable': '\r\n\x1b[31m--- That machine is unreachable. ---\x1b[0m\r\n',
+              'peer-stream-lost': '\r\n\x1b[33m--- Stream lost — reconnecting… ---\x1b[0m\r\n',
+              'input-not-allowed': '\r\n\x1b[33m[remote typing is disabled on this machine — turn it on in that machine\'s settings]\x1b[0m\r\n',
+              'session-transferred': `\r\n\x1b[33m--- This session moved to ${msg.newMachineId || 'another machine'} — reselect it to follow. ---\x1b[0m\r\n`,
+              'invalid-session': '\r\n\x1b[31m--- Invalid session name. ---\x1b[0m\r\n',
+              'session-not-found': '\r\n\x1b[31m--- Session not found on that machine. ---\x1b[0m\r\n',
+            }[msg.code];
+            if (m) { term.write(m); break; }
+          }
+          console.error('[ws]', msg.code || msg.message);
           break;
       }
     }
@@ -3845,13 +3868,12 @@
           el = document.createElement('div');
           el.className = 'session-item';
           el.dataset.session = sessionRowKey(session);
-          if (session.remote) {
-            // A remote session's terminal streams on ITS machine's dashboard —
-            // clicking here can't subscribe to it, so the row is informational.
-            el.title = `Running on ${session.machineNickname || session.machineId || 'another machine'} — open that machine's dashboard to interact.`;
-          } else {
-            el.onclick = () => selectSession(session.tmuxSession, session);
-          }
+          // Pool Dashboard Streaming (§2.2): remote sessions are now clickable —
+          // selecting one streams it from its owning machine via the relay.
+          el.title = session.remote
+            ? `Running on ${session.machineNickname || session.machineId || 'another machine'} — click to stream it here.`
+            : '';
+          el.onclick = () => selectSession(session.tmuxSession, session);
           list.appendChild(el);
         }
 
@@ -3912,11 +3934,13 @@
 
     // ── Terminal ──────────────────────────────────────────────
     function selectSession(tmuxSession, session) {
-      // Unsubscribe from previous
+      // Unsubscribe from previous (carry its machineId so a remote unsub routes).
       if (activeSession) {
-        wsSend({ type: 'unsubscribe', session: activeSession });
+        wsSend({ type: 'unsubscribe', session: activeSession, ...(activeMachineId ? { machineId: activeMachineId } : {}) });
       }
 
+      // Pool Dashboard Streaming (§2.2): a remote session streams from its owner.
+      activeMachineId = session.remote ? (session.machineId || null) : null;
       activeSession = tmuxSession;
       userIsFollowing = true; // Reset scroll tracking on session switch
       hideResumeButton(); // Carry-over button from prior session would be misleading
@@ -3958,9 +3982,12 @@
         initTerminal();
       }
 
-      // Clear and subscribe
+      // Clear and subscribe (remote → carry machineId so the server relays).
       term.clear();
-      wsSend({ type: 'subscribe', session: tmuxSession });
+      if (activeMachineId) {
+        term.write(`\x1b[2m[streaming from ${session.machineNickname || activeMachineId}…]\x1b[0m\r\n`);
+      }
+      wsSend({ type: 'subscribe', session: tmuxSession, ...(activeMachineId ? { machineId: activeMachineId } : {}) });
 
       // Update active state in sidebar
       renderSessionList();
@@ -4203,25 +4230,28 @@
     }
 
     // ── Input ────────────────────────────────────────────────
+    // Remote sessions carry machineId so the server relays input to the owner
+    // (which enforces its own allowRemoteInput gate; a refusal returns an
+    // input-not-allowed error frame, surfaced in the terminal — never silent).
     function sendInput() {
       const input = document.getElementById('termInput');
       const text = input.value;
       if (!text || !activeSession) return;
 
-      wsSend({ type: 'input', session: activeSession, text });
+      wsSend({ type: 'input', session: activeSession, text, ...(activeMachineId ? { machineId: activeMachineId } : {}) });
       input.value = '';
       input.focus();
     }
 
     function sendKey(key) {
       if (!activeSession) return;
-      wsSend({ type: 'key', session: activeSession, key });
+      wsSend({ type: 'key', session: activeSession, key, ...(activeMachineId ? { machineId: activeMachineId } : {}) });
     }
 
     function sendSpecial(text) {
       if (!activeSession) return;
       // Send literal text without Enter
-      wsSend({ type: 'key', session: activeSession, key: text });
+      wsSend({ type: 'key', session: activeSession, key: text, ...(activeMachineId ? { machineId: activeMachineId } : {}) });
     }
 
     // ── New Session Modal ────────────────────────────────────

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQ3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA6JtD,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA05BD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,GAC/F,IAAI,CAyUN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAk9TtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQ3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA6JtD,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA05BD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,GAC/F,IAAI,CAyUN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0gUtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -6494,6 +6494,64 @@ export async function startServer(options) {
             quotaPoller.start();
             console.log(pc.green('  Subscription quota poller started'));
         }
+        // EnrollmentWizard — mobile-first new-account login (P2.1 of the Subscription
+        // & Auth Standard). Dark with the pool: the /subscription-pool/enroll routes
+        // do nothing until an operator starts an enrollment. The login driver reuses
+        // the proven tmux-spawn + capture-pane primitive (the same one /login uses) to
+        // scrape the PUBLIC verification URL / device code — NEVER a token. The new
+        // account's CLAUDE_CONFIG_DIR isolates the login to its own slot, so enrolling
+        // a 2nd account never clobbers the 1st.
+        const { PendingLoginStore } = await import('../core/PendingLoginStore.js');
+        const { EnrollmentWizard } = await import('../core/EnrollmentWizard.js');
+        const { FrameworkLoginDriver } = await import('../core/FrameworkLoginDriver.js');
+        const DEFAULT_ENROLL_LOGIN_COMMANDS = {
+            'claude-code': 'claude auth login',
+            'codex-cli': 'codex login',
+            'gemini-cli': 'gemini',
+            'pi-cli': 'pi login',
+        };
+        const enrollLoginCommands = {
+            ...DEFAULT_ENROLL_LOGIN_COMMANDS,
+            ...(config.subscriptionPool?.enrollment?.loginCommands ?? {}),
+        };
+        const pendingLoginStore = new PendingLoginStore({ stateDir: config.stateDir });
+        const enrollmentWizard = new EnrollmentWizard({
+            store: pendingLoginStore,
+            logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            driveLogin: new FrameworkLoginDriver({
+                capture: async (session) => sessionManager.captureOutput(session, 120) || '',
+                spawn: async ({ framework, configHome }) => {
+                    const tmuxPath = detectTmuxPath();
+                    if (!tmuxPath)
+                        throw new Error('tmux not available for enrollment login');
+                    const baseCmd = enrollLoginCommands[framework] ?? `${framework} login`;
+                    // env-prefix sets the per-account config home for the login process so
+                    // the credential lands in its own slot (CLAUDE_CONFIG_DIR isolation).
+                    const cmd = configHome
+                        ? `env CLAUDE_CONFIG_DIR=${JSON.stringify(configHome)} ${baseCmd}`
+                        : baseCmd;
+                    const slug = (configHome ?? framework).replace(/[^a-zA-Z0-9]+/g, '-').slice(-24);
+                    const session = `instar-enroll-${framework}-${slug}`;
+                    try {
+                        execFileSync(tmuxPath, ['kill-session', '-t', `=${session}`], { stdio: 'ignore' });
+                    }
+                    catch { /* @silent-fallback-ok: no prior enroll session for this slot */ }
+                    execFileSync(tmuxPath, ['new-session', '-d', '-s', session, cmd], { timeout: 10000 });
+                    return { session };
+                },
+                logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            }).asLoginDriver(),
+        });
+        // Background auto-reissue sweep — refreshes an expired login code without the
+        // operator asking (the pi-live-test gap). Inert with no pending logins; the
+        // timer is unref'd so it never holds the process open.
+        const enrollReissueTimer = setInterval(() => {
+            enrollmentWizard
+                .reissueExpired()
+                .catch(() => { });
+        }, config.subscriptionPool?.enrollment?.reissueSweepMs ?? 5 * 60_000);
+        if (enrollReissueTimer.unref)
+            enrollReissueTimer.unref();
         // Commitment Sentinel — LLM-powered scanner that finds unregistered commitments.
         let commitmentSentinel;
         if (sharedIntelligence) {
@@ -11282,7 +11340,7 @@ export async function startServer(options) {
         catch (err) {
             console.log(pc.dim(`  [session-pool] rollout gate not wired: ${err instanceof Error ? err.message : String(err)}`));
         }
-        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
+        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, enrollmentWizard, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
         // Resolve the late-bound topic-operator getter (increment 2e): routing was
         // wired before the server existed; from here on inbound binds use the
         // server's own store instance.