instar 1.3.507 → 1.3.509

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAyG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA4zCD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgqYtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA0G7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAw0CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgyYtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -144,6 +144,7 @@ import { WarmSessionPool } from '../threadline/WarmSessionPool.js';
 import { resolveThreadlineMcpEntry } from '../threadline/mcpEntry.js';
 import { ThreadResumeMap } from '../threadline/ThreadResumeMap.js';
 import { ConversationStore } from '../threadline/ConversationStore.js';
+import { recordInboundAck } from '../threadline/recordInboundAck.js';
 import { WarrantsReplyGate, evaluateAndRecordInbound } from '../threadline/WarrantsReplyGate.js';
 import { CollaborationSurfacer } from '../threadline/CollaborationSurfacer.js';
 import { ListenerSessionManager } from '../threadline/ListenerSessionManager.js';
@@ -384,6 +385,10 @@ let _inboundQueueStop = null;
  *  (forward/spawn on another machine → must NOT also dispatch locally) from a
  *  self placement. Set once in startServer()'s mesh block. */
 let _meshSelfId = null;
+/** WS1.2: the owner-side drain runner (null = pool dark / deps unavailable).
+ *  Presence IS the heartbeat-advertised ws12DrainReceive capability — a
+ *  machine only advertises what it can actually execute. */
+let _drainRunner = null;
 /** WS1.1: read-only ownership lookup for the drain's spawn-boundary re-check
  *  (the registry is constructed later in startServer's pool block). */
 let _ownershipReadForDrain = null;
@@ -395,6 +400,10 @@ let _resolveRouterUrl = null;
 /** Every OTHER active machine with a known URL — backs GET /sessions?scope=pool
  *  (pool-wide session aggregation for the dashboard). Set in the same mesh block. */
 let _resolvePeerUrls = null;
+/** WS1.2 sender leg: order a REMOTE owner to drain `sessionKey` for a transfer
+ *  to `target` (signed mesh `drain` verb). Set in the mesh-client block; null =
+ *  pool dark / no client — the transfer route degrades to today's pin path. */
+let _sendDrain = null;
 let _listPoolMachines = null;
 /** Multi-Machine Session Pool §L4: per-topic placement pin store ("move this to <nickname>"). */
 let _topicPinStore = null;
@@ -10267,18 +10276,11 @@ export async function startServer(options) {
                     // ack (a reply on the thread = processed-ack of our prior send) fires.
                     // Same-machine local delivery is recorded separately in the
                     // /messages/relay-agent route. Recording-only — never gates routing.
-                    if (a2aDeliveryTracker) {
-                        try {
-                            a2aDeliveryTracker.recordInboundFrom(senderFingerprint, senderName ?? null);
-                            if (msg.threadId)
-                                a2aDeliveryTracker.recordAckByThread(msg.threadId);
-                        }
-                        catch (err) {
-                            // @silent-fallback-ok: recording-only — A2A delivery/liveness tracking must
-                            // never break inbound routing (the message was already accepted above). Logged.
-                            console.warn(`[relay] A2A inbound record failed (non-fatal): ${err instanceof Error ? err.message : err}`);
-                        }
-                    }
+                    // Robustness Phase 1 (D-E): funnelled through the shared recordInboundAck
+                    // so every inbound-receive path records the ack via one helper. Here the
+                    // senderFingerprint is the peer's real routing fingerprint, so liveness
+                    // keys correctly without a thread-owner lookup. Recording-only.
+                    recordInboundAck({ a2aDeliveryTracker }, { threadId: msg.threadId, senderFingerprint, senderName: senderName ?? null });
                     // Threadline → Telegram bridge: mirror inbound message into a per-thread
                     // Telegram topic so the user has visibility into agent-to-agent
                     // conversations. Relay-only — TelegramBridgeConfig owns the gate
@@ -11935,7 +11937,7 @@ export async function startServer(options) {
                                 // WS1.1 capability advertisement (spec invariant 5): a bounded
                                 // fixed-size summary, never an inventory. Reported live each
                                 // heartbeat so a queue going dark withdraws the capability.
-                                seamlessnessFlags: { ws11DeliverReceive: !!_inboundQueue },
+                                seamlessnessFlags: { ws11DeliverReceive: !!_inboundQueue, ws12DrainReceive: !!_drainRunner },
                                 // Durable Inbound Message Queue §5.1: depth + oldest + tenure +
                                 // bounded top-K — the survivor's loss-SUSPECTED item, capped
                                 // re-placement arm, and supersede-dedupe key all read these.
@@ -12325,6 +12327,85 @@ export async function startServer(options) {
                         });
                     },
                 });
+                // ── WS1.2 owner-side drain runner (MULTI-MACHINE-SEAMLESSNESS-SPEC) ──
+                // Constructed here because every dep lives in this scope. Presence IS
+                // the heartbeat-advertised ws12DrainReceive capability. All I/O
+                // injected; the runner itself is the unit-tested pure sequence.
+                try {
+                    const drainMod = await import('../core/SessionDrainRunner.js');
+                    const autoMod = await import('../core/AutonomousSessions.js');
+                    let drainNonce = 0;
+                    _drainRunner = new drainMod.SessionDrainRunner({
+                        selfMachineId: meshSelfId,
+                        readOwnership: (sk) => ownReg.read(sk),
+                        cas: (action, c) => {
+                            const prev = ownReg.read(c.sessionKey)?.ownerMachineId;
+                            const r = ownReg.cas(action, c);
+                            // Journal pairing (§3.3): the drain's transfer/abort/claim CASes
+                            // record placement history like every other CAS site.
+                            emitPlacement(c.sessionKey, r, 'user-move', prev);
+                            return r;
+                        },
+                        suspendAutonomousRun: (topic, target) => autoMod.suspendAutonomousTopicForMove(config.stateDir, topic, target, coherenceJournal ?? undefined),
+                        sessionQuiet: (sk) => {
+                            const topicNum = Number(sk);
+                            if (!Number.isFinite(topicNum) || !telegram)
+                                return true; // nothing local to drain
+                            const tmux = telegram.getSessionForTopic(topicNum);
+                            if (!tmux || !sessionManager.isSessionAlive(tmux))
+                                return true;
+                            return !sessionManager.isSessionActivelyWorking(tmux);
+                        },
+                        // Emergency stop: the durable flag file freshly touched (within the
+                        // drain window's scale) — a stale flag from an old stop must not
+                        // permanently veto every future transfer.
+                        emergencyStopActive: () => {
+                            try {
+                                const flagAt = fs.statSync(path.join(config.projectDir, '.instar', 'autonomous-emergency-stop')).mtimeMs;
+                                return Date.now() - flagAt < 120_000;
+                            }
+                            catch { /* @silent-fallback-ok — no flag file = no emergency stop (the defined absent-state, not a degradation) */
+                                return false;
+                            }
+                        },
+                        terminateSession: async (sk, reason, opts) => {
+                            const topicNum = Number(sk);
+                            const tmux = Number.isFinite(topicNum) ? telegram?.getSessionForTopic(topicNum) : null;
+                            const rec = tmux ? state.listSessions().find((s) => s.tmuxSession === tmux) : undefined;
+                            if (!rec)
+                                return { terminated: false, skipped: 'no-local-session' };
+                            return sessionManager.terminateSession(rec.id, reason, {
+                                origin: 'autonomous',
+                                via: 'ws12-drain',
+                                bypassActiveProcessKeep: opts.force,
+                                workEvidence: opts.force ? ['active-build-or-autonomous-run'] : undefined,
+                            });
+                        },
+                        markInterrupted: (topic) => { autoMod.markAutonomousInterruptedMidTask(config.stateDir, topic); },
+                        notifyInterrupted: (topic, target, detail) => {
+                            const topicNum = Number(topic);
+                            if (!telegram || !Number.isFinite(topicNum))
+                                return;
+                            void telegram
+                                .sendToTopic(topicNum, `This conversation moved machines mid-task (${detail}). Work resumes on the new machine — the final turn before the move may be partial.`)
+                                .catch(() => { });
+                        },
+                        audit: (event) => {
+                            try {
+                                console.log(pc.dim(`  [ws12-drain] ${JSON.stringify(event)}`));
+                            }
+                            catch { /* @silent-fallback-ok — observability only */ }
+                        },
+                        now: () => Date.now(),
+                        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+                        nonce: () => `${meshSelfId}:drain:${Date.now()}:${++drainNonce}`,
+                    });
+                    console.log(pc.dim('  [ws12-drain] owner-side drain runner wired (capability advertised)'));
+                }
+                catch (err) {
+                    // @silent-fallback-ok — runner stays null (capability un-advertised → no peer sends a drain order; the transfer route degrades to today's pin path). Logged with context; not a degradation worth a report.
+                    console.log(pc.dim(`  [ws12-drain] runner not wired: ${err instanceof Error ? err.message : String(err)}`));
+                }
                 // ── Secret-sync inbound handler (cross-machine secret distribution, spec Phase 4) ──
                 // Dark by default; live on the dev agent via the developmentAgent gate. An inbound
                 // `secret-share` command is decrypted to THIS machine's X25519 key and stored in the
@@ -12514,6 +12595,30 @@ export async function startServer(options) {
                         transfer: ownAction,
                         release: ownAction,
                         deliverMessage: deliverMessageHandler,
+                        // WS1.2 owner-side drain (MULTI-MACHINE-SEAMLESSNESS-SPEC): the
+                        // router orders THIS machine — the topic's current owner — to
+                        // finish the live turn (bounded), close the local session, and
+                        // land the target's claim, releasing the queue's barrier exactly
+                        // at drain completion. RBAC is router-only ('drain-unauthorized');
+                        // the runner re-validates ownership + epoch at its CAS fence
+                        // regardless (reach ≠ authority). Answers 'drain disabled' until
+                        // the runner is constructed (pool dark / deps unavailable) — the
+                        // sender's capability gate means a doomed order is never sent to
+                        // a machine that advertises the flag honestly.
+                        drain: async (cmd) => {
+                            const c = cmd;
+                            if (!_drainRunner)
+                                return { ok: false, reason: 'drain disabled' };
+                            const outcome = await _drainRunner.run({
+                                sessionKey: c.session,
+                                target: c.target,
+                                senderObservedEpoch: c.ownershipEpoch,
+                            });
+                            return {
+                                ok: outcome.status === 'drained' || outcome.status === 'drained-interrupted',
+                                ...outcome,
+                            };
+                        },
                         'secret-share': (cmd, sender) => _secretShareHandler
                             ? _secretShareHandler.handle(cmd, sender)
                             : { ok: false, reason: 'secret-sync disabled' },
@@ -12538,6 +12643,42 @@ export async function startServer(options) {
                     });
                     const peerUrl = (machineId) => meshIdMgr.getActiveMachines().find((m) => m.machineId === machineId)?.entry.lastKnownUrl ?? null;
                     _meshSelfId = meshSelfId;
+                    // WS1.2 sender leg: signed drain order to a remote owner. Bounded by
+                    // the drain bound + slack so a clean drain (≤30s wait + close) can
+                    // complete within one call; every failure shape maps to an explicit
+                    // outcome — the transfer route NEVER hangs on this and degrades to
+                    // today's pin path on anything but a real abort.
+                    _sendDrain = async (ownerMachineId, sessionKey, target, ownershipEpoch) => {
+                        // Local-owner arm: the live swap topology (owner == holder == this
+                        // machine) drains via the SAME runner the mesh handler uses — one
+                        // code path, no HTTP round-trip to ourselves.
+                        if (ownerMachineId === meshSelfId) {
+                            if (!_drainRunner)
+                                return { ok: false, reason: 'drain disabled' };
+                            const o = await _drainRunner.run({ sessionKey, target, senderObservedEpoch: ownershipEpoch });
+                            return {
+                                ok: o.status === 'drained' || o.status === 'drained-interrupted',
+                                status: o.status,
+                                reason: o.detail,
+                                runSuspended: o.autonomousRunSuspended,
+                            };
+                        }
+                        const url = peerUrl(ownerMachineId);
+                        if (!url)
+                            return { ok: false, reason: 'no-peer-url' };
+                        try {
+                            const res = await meshClient.send({ machineId: ownerMachineId, url }, { type: 'drain', session: sessionKey, target, ownershipEpoch }, ownershipEpoch, { timeoutMs: 50_000 });
+                            if (res.ok) {
+                                const r = (res.result ?? {});
+                                return { ok: r.ok === true, status: typeof r.status === 'string' ? r.status : undefined, reason: typeof r.reason === 'string' ? r.reason : undefined };
+                            }
+                            return { ok: false, reason: res.reason ?? `status-${res.status}`, noHandler: res.status === 501 };
+                        }
+                        catch (err) {
+                            // @silent-fallback-ok — a failed drain RPC returns ok:false to the route, which records it and degrades to today's pin path (never a stuck/half transfer); the reason is surfaced in the response's drain field.
+                            return { ok: false, reason: err instanceof Error ? err.message : String(err) };
+                        }
+                    };
                     _resolveRouterUrl = () => {
                         const h = coordinator.getSyncStatus().leaseHolder;
                         return h && h !== meshSelfId ? peerUrl(h) : null;