instar 1.3.536 → 1.3.538

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAm3CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAo1atE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAm3CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA67atE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -6223,6 +6223,33 @@ export async function startServer(options) {
                             return;
                         notify('SUMMARY', 'session-resume', `🔁 I restarted this session to pick the work back up after it was shut down mid-work.`, entry.topicId);
                     },
+                    // Build-Session Yield Safety (ACT-839) R2.2: present ONLY when the
+                    // dev-gated feature is live (its presence is the gate). Registers a
+                    // durable, beacon-enabled obligation so a STALLED revived session is
+                    // re-surfaced by PromiseBeacon; deduped per stableKey so a re-revival
+                    // refreshes rather than floods. The die-again case is covered by the
+                    // dev-live OrphanedWorkSentinel (#1113) — no duplicate scanner here.
+                    onWorktreeRevival: resolveDevAgentGate(config.monitoring?.yieldSafety?.enabled, config)
+                        ? (entry) => {
+                            if (!commitmentTracker || entry.topicId == null)
+                                return;
+                            const externalKey = `yield-safety:${entry.stableKey}`;
+                            try {
+                                if (commitmentTracker.getActive().some((c) => c.externalKey === externalKey))
+                                    return; // dedup
+                                commitmentTracker.record({
+                                    type: 'one-time-action',
+                                    topicId: entry.topicId,
+                                    source: 'sentinel',
+                                    beaconEnabled: true,
+                                    externalKey,
+                                    userRequest: 'Session revived because its worktree held uncommitted work (ACT-839 yield-safety).',
+                                    agentResponse: 'Commit the uncommitted worktree changes with a real, descriptive commit, or deliberately preserve/discard them, before yielding again.',
+                                });
+                            }
+                            catch { /* @silent-fallback-ok: best-effort obligation registration; a CommitmentTracker failure must never endanger the revival. */ }
+                        }
+                        : undefined,
                     raiseAggregated: raiseResumeAggregated,
                     audit: auditResumeQueue,
                     tier1Check: async (entry) => {
@@ -8488,6 +8515,60 @@ export async function startServer(options) {
         if (subscriptionPool.size() > 0) {
             console.log(pc.green(`  Subscription pool: ${subscriptionPool.size()} account(s) registered`));
         }
+        // ── Live credential re-pointing — census consumer re-routing (WS5.2 Step 6) ──
+        // The CredentialLocationLedger is the machine-local source of truth for "which account is in
+        // which config-home slot" once re-pointing is enabled. The CredentialLocationGate re-routes
+        // the §2.2 census consumers (quota poll, spawn placement, in-use badge) through it. Ships DARK:
+        // the gate reads `subscriptionPool.credentialRepointing.enabled` LIVE per call — with the flag
+        // off (always, while dark) every gate read returns the enrollment-home fallback, so every
+        // consumer is byte-for-byte today's behavior. A never-seeded ledger is the same fallback (back-
+        // compat); only UNKNOWN mode (corrupt on-disk) raises a HIGH attention item, never throws.
+        const { CredentialLocationLedger } = await import('../core/CredentialLocationLedger.js');
+        const { CredentialIdentityOracle } = await import('../core/CredentialIdentityOracle.js');
+        const { CredentialLocationGate } = await import('../core/CredentialLocationGate.js');
+        const credentialGateEmitAttention = telegram
+            ? (item) => void telegram.createAttentionItem({
+                id: item.id,
+                title: item.title,
+                summary: item.summary,
+                description: item.description,
+                category: item.category,
+                priority: item.priority,
+                sourceContext: item.sourceContext,
+            })
+            : undefined;
+        const credentialLocationLedger = new CredentialLocationLedger({
+            stateDir: config.stateDir,
+            pool: subscriptionPool,
+            oracle: new CredentialIdentityOracle(),
+            emitAttention: credentialGateEmitAttention,
+        });
+        const credentialLocationGate = new CredentialLocationGate({
+            // Live flag read — a restartless config flip is honored on the next read.
+            isEnabled: () => config.subscriptionPool?.credentialRepointing?.enabled === true,
+            ledger: credentialLocationLedger,
+            emitAttention: credentialGateEmitAttention,
+        });
+        // Census #9: the manager-level competing-writer refusal gate. Installed process-wide so
+        // AccountSwitcher / `/switch-account` / autoMigrate refuse a write to a repointing-owned slot
+        // at the funnel chokepoint, not just on a route. Refuses ONLY when re-pointing is enabled AND
+        // the ledger holds a tenant for the (canonicalized) slot.
+        const { setCredentialWriteRefusalGate } = await import('../monitoring/CredentialProvider.js');
+        const { credentialSlotKey: canonicalizeSlot } = await import('../core/OAuthRefresher.js');
+        setCredentialWriteRefusalGate({
+            shouldRefuse: (canonicalSlot) => {
+                if (config.subscriptionPool?.credentialRepointing?.enabled !== true)
+                    return false;
+                // The funnel passes a canonicalized slot key, but the ledger stores raw enrollment-home
+                // spellings (`~/.claude`, an enrollment path). Compare canonical-to-canonical so a
+                // repointing-owned slot is recognized regardless of spelling.
+                return credentialLocationLedger
+                    .getAssignments()
+                    .some((a) => !!a.accountId && canonicalizeSlot(a.slot) === canonicalSlot);
+            },
+        });
+        // Census #5/#6: spawn placement resolves a pinned account's home through the gate (no-op dark).
+        sessionManager.setCredentialLocationGate(credentialLocationGate);
         // QuotaPoller — per-account live quota reader (P1.2 of the Subscription &
         // Auth Standard). Reads each account's 5h/weekly utilization + reset dates
         // via the OAuth usage endpoint (transient per-account token, never persisted)
@@ -8499,6 +8580,8 @@ export async function startServer(options) {
         const quotaPoller = new QuotaPoller({
             pool: subscriptionPool,
             logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            // Census #1–#4: resolve each account's LIVE slot through the ledger (no-op while dark).
+            locationGate: credentialLocationGate,
         });
         if (subscriptionPool.size() > 0) {
             quotaPoller.start();
@@ -8508,7 +8591,9 @@ export async function startServer(options) {
         // right now" for the dashboard "in use" badge (read-only; cached probe of
         // `claude auth status`). One shared instance so the TTL cache is honored.
         const { InUseAccountResolver } = await import('../core/InUseAccountResolver.js');
-        const inUseAccountResolver = new InUseAccountResolver({});
+        // Census #8 (the E4a liar): when re-pointing is enabled and the ledger knows the `~/.claude`
+        // tenant, the badge resolves from the ledger — NOT a stale `claude auth status` re-probe.
+        const inUseAccountResolver = new InUseAccountResolver({ locationGate: credentialLocationGate });
         // EnrollmentWizard — mobile-first new-account login (P2.1 of the Subscription
         // & Auth Standard). Dark with the pool: the /subscription-pool/enroll routes
         // do nothing until an operator starts an enrollment. The login driver reuses
@@ -11948,8 +12033,29 @@ export async function startServer(options) {
         }
         // (setAwakeChecker is wired earlier, before the boot purge, so the purge is
         //  lease-gated — see the §P3/§P4 block above.)
+        // Build-Session Yield Safety (ACT-839): construct the bounded, cached
+        // worktreeDirtyCheck and inject it into the reaper ONLY when the dev-gated
+        // yieldSafety feature is live (its mere presence is the gate). Dev-enabled,
+        // dark on the fleet, per the Maturation Path standard.
+        let _yieldSafetyDirtyCheck;
+        if (resolveDevAgentGate(config.monitoring?.yieldSafety?.enabled, config)) {
+            const ysCfg = config.monitoring?.yieldSafety ?? {};
+            const { makeWorktreeDirtyCheck } = await import('../core/worktreeDirtyCheck.js');
+            const { SafeGitExecutor } = await import('../core/SafeGitExecutor.js');
+            _yieldSafetyDirtyCheck = makeWorktreeDirtyCheck({
+                readGit: (args, cwd) => SafeGitExecutor.readSync(args, {
+                    cwd, encoding: 'utf-8',
+                    timeout: ysCfg.dirtyCheckTimeoutMs ?? 5_000,
+                    operation: 'src/core/worktreeDirtyCheck.ts (yield-safety)',
+                    sourceTreeReadOk: true,
+                    sourceTreeWorktreeManagerOk: true,
+                }),
+                config: { residueDenylist: ysCfg.residueDenylist, cacheTtlMs: ysCfg.dirtyCheckCacheTtlMs },
+            });
+        }
         const sessionReaper = new SessionReaper({
             ...reapGuardDeps,
+            dirtyCheck: _yieldSafetyDirtyCheck,
             listRunningSessions: () => sessionManager.listRunningSessions(),
             captureOutput: (s, n) => sessionManager.captureOutput(s, n) ?? '',
             frameworkForSession: (s) => sessionManager.frameworkForSession(s),