instar 1.3.61 → 1.3.63

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+RH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAksDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0uNtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+RH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAksDD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAi6NtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -3880,6 +3880,54 @@ export async function startServer(options) {
         // WorkingMemoryAssembler is initialized after activitySentinel (see below)
         // so it can wire episodicMemory from the sentinel.
         let workingMemory;
+        // ── Reap observability + notify (UNIFIED-SESSION-LIFECYCLE §P3/§P4) ──
+        // Wired BEFORE the boot purge so even boot-time reaps land in the reap-log
+        // and surface a notice. The awake-checker is also wired here so the boot
+        // purge is lease-gated (a standby never reaps another machine's sessions).
+        // (The KEEP-guard is wired later, once its tracker deps exist — that is safe:
+        //  the boot purge passes knownDead and bypasses the guard, and the only other
+        //  guard consumers (monitorTick #2 age-limit / #3 idle-zombie) cannot fire a
+        //  kill in the first monitoring seconds — they require multi-hour age or 15+m
+        //  of observed idle — long after the guard is set below.)
+        const { ReapLog } = await import('../monitoring/ReapLog.js');
+        const { ReapNotifier } = await import('../monitoring/ReapNotifier.js');
+        const reapLog = new ReapLog(config.stateDir, () => (coordinator.enabled ? coordinator.identity?.machineId : undefined));
+        const reapNotifier = new ReapNotifier({
+            resolveTopic: (tmuxSession) => {
+                const t = telegram?.getTopicForSession(tmuxSession);
+                if (t == null)
+                    return null;
+                const n = typeof t === 'number' ? t : Number(t);
+                return Number.isFinite(n) ? n : null;
+            },
+            lifelineTopic: () => telegram?.getLifelineTopicId() ?? null,
+            // SUMMARY tier → through the formatter/tone-gate (HTML-escaped, quiet-hours
+            // aware). The notifier already coalesces, so a burst is one message.
+            send: (topicId, text) => notify('SUMMARY', 'session-reap', text, topicId),
+        }, {
+            enabled: config.monitoring?.reapNotify?.enabled ?? true,
+            coalesceWindowMs: config.monitoring?.reapNotify?.coalesceWindowMs ?? 60_000,
+        });
+        sessionManager.setAwakeChecker(() => !coordinator.enabled || coordinator.isAwake);
+        sessionManager.on('sessionReaped', (e) => {
+            reapLog.recordReaped({
+                session: e.session.name,
+                tmuxSession: e.session.tmuxSession,
+                reason: e.reason,
+                disposition: e.disposition,
+                origin: e.origin,
+            });
+            reapNotifier.onReaped({ session: e.session, reason: e.reason, disposition: e.disposition, origin: e.origin });
+        });
+        sessionManager.on('reapBlocked', (e) => {
+            reapLog.recordSkipped({
+                session: e.session.name,
+                tmuxSession: e.session.tmuxSession,
+                reason: e.reason,
+                skipped: e.skipped,
+                origin: e.origin,
+            });
+        });
         // Fast startup purge — remove session records for dead tmux sessions BEFORE
         // monitoring starts. Prevents the death spiral where stale sessions overwhelm
         // the health endpoint (synchronous tmux has-session calls) and cause the
@@ -5178,10 +5226,12 @@ export async function startServer(options) {
         // replace"). undefined when the corresponding sentinel is disabled.
         let socketRecoveryActive;
         let silenceRecoveryActive;
+        let wedgeRecoveryActive;
         {
             const { SocketDisconnectSentinel } = await import('../monitoring/SocketDisconnectSentinel.js');
             const { ActiveWorkSilenceSentinel } = await import('../monitoring/ActiveWorkSilenceSentinel.js');
-            const { buildSocketDisconnectDeps, buildActiveWorkSilenceDeps, OutputActivityTracker, } = await import('../monitoring/sentinelWiring.js');
+            const { ContextWedgeSentinel } = await import('../monitoring/ContextWedgeSentinel.js');
+            const { buildSocketDisconnectDeps, buildActiveWorkSilenceDeps, buildContextWedgeDeps, OutputActivityTracker, } = await import('../monitoring/sentinelWiring.js');
             const { SentinelNotifier } = await import('../monitoring/SentinelNotifier.js');
             const sessionSurface = {
                 captureOutput: (s, lines) => sessionManager.captureOutput(s, lines),
@@ -5249,6 +5299,45 @@ export async function startServer(options) {
                     ? '  ActiveWorkSilenceSentinel enabled (silent-freeze watchdog — Telegram escalation ON, consolidated)'
                     : '  ActiveWorkSilenceSentinel enabled (silent-freeze watchdog — logs only, Telegram escalation OFF)'));
             }
+            // ── ContextWedgeSentinel — thinking-block-400 fast-fail wedge ──
+            // Detection + audit ship default-ON (harmless housekeeping). The
+            // destructive fresh-respawn is gated by autoRecovery (default OFF +
+            // dryRun) and rides the Graduated Feature Rollout track. freshRespawn is
+            // late-bound to _sessionRefresh (assigned later in boot) and only invoked
+            // at recovery time; it uses fresh-mode so the new session never --resume-s
+            // the corrupted transcript. Spec: docs/specs/context-wedge-sentinel.md.
+            const wedgeCfg = config.monitoring?.contextWedgeSentinel ?? { enabled: true };
+            if (wedgeCfg.enabled !== false) {
+                const autoRecovery = wedgeCfg.autoRecovery ?? { enabled: false, dryRun: true };
+                const wedgeSentinel = new ContextWedgeSentinel(buildContextWedgeDeps({
+                    sessions: sessionSurface,
+                    escalate: (name, text) => notifier.escalate('context-wedge', name, text),
+                    autoRecovery,
+                    freshRespawn: async (name) => {
+                        if (!_sessionRefresh)
+                            return false;
+                        const result = await _sessionRefresh.refreshSession({
+                            sessionName: name,
+                            fresh: true,
+                            reason: 'context-wedge-400',
+                        });
+                        return result.ok;
+                    },
+                }), {
+                    enabled: wedgeCfg.enabled,
+                    tickIntervalMs: wedgeCfg.tickIntervalMs,
+                    confirmWindowMs: wedgeCfg.confirmWindowMs,
+                });
+                wedgeSentinel.on('detected', (e) => notifier.record('detected', 'context-wedge', e.sessionName));
+                wedgeSentinel.on('recovered', (e) => notifier.record('recovered', 'context-wedge', e.sessionName, 'fresh respawn'));
+                wedgeSentinel.on('dry-run', (e) => notifier.record('dry-run', 'context-wedge', e.sessionName, 'would fresh-respawn'));
+                wedgeSentinel.on('false-alarm', (e) => notifier.record('false-alarm', 'context-wedge', e.sessionName, 'signature scrolled out of tail'));
+                wedgeSentinel.on('recovery-error', (e) => notifier.record('recovery-error', 'context-wedge', e.sessionName, e.err instanceof Error ? e.err.message : String(e.err)));
+                wedgeSentinel.start();
+                wedgeRecoveryActive = (s) => wedgeSentinel.isRecoveryActive(s);
+                const mode = autoRecovery.enabled ? (autoRecovery.dryRun ? 'auto-recover dry-run' : 'auto-recover LIVE') : 'detect-only';
+                console.log(pc.green(`  ContextWedgeSentinel enabled (thinking-block-400 wedge — ${mode})`));
+            }
         }
         // Recompose the zombie-kill veto to include ALL four recovery sentinels now
         // that socket + silence exist (the interim set above covered only compaction
@@ -5259,7 +5348,8 @@ export async function startServer(options) {
         const composedRecoveryActive = (session) => compactionSentinel.isRecoveryActive(session.tmuxSession) ||
             rateLimitSentinel.isRecoveryActive(session.tmuxSession) ||
             (socketRecoveryActive?.(session.tmuxSession) ?? false) ||
-            (silenceRecoveryActive?.(session.tmuxSession) ?? false);
+            (silenceRecoveryActive?.(session.tmuxSession) ?? false) ||
+            (wedgeRecoveryActive?.(session.tmuxSession) ?? false);
         sessionManager.setActiveRecoveryChecker(composedRecoveryActive);
         // Trigger 1: PreCompact hook event — report to sentinel.
         hookEventReceiver.on('PreCompact', () => {
@@ -7679,14 +7769,15 @@ export async function startServer(options) {
             const n = typeof t === 'number' ? t : Number(t);
             return Number.isFinite(n) ? n : null;
         };
-        const sessionReaper = new SessionReaper({
-            listRunningSessions: () => sessionManager.listRunningSessions(),
-            captureOutput: (s, n) => sessionManager.captureOutput(s, n) ?? '',
-            hasActiveProcesses: (s) => sessionManager.hasActiveProcesses(s),
-            frameworkForSession: (s) => sessionManager.frameworkForSession(s),
+        // Shared stateless KEEP-guard deps (UNIFIED-SESSION-LIFECYCLE §P2). Built
+        // once here and used to back BOTH the SessionReaper and the ReapAuthority's
+        // guard (`sessionManager.setReapGuard`), so a killer cannot end a session the
+        // reaper would have kept — the same chain protects every kill path.
+        const reapGuardDeps = {
+            protectedSessions: () => sessionManager.getProtectedSessions(),
             isRecoveryActive: (session) => composedRecoveryActive(session),
-            isRelayLeaseActive: (id) => sessionManager.isRelayLeaseActive(id),
             hasPendingInjection: (s) => sessionManager.getPendingInjection(s) != null,
+            isRelayLeaseActive: (id) => sessionManager.isRelayLeaseActive(id),
             topicBinding: _resolveTopic,
             // Gate I is a v1 stub (returns false): active conversation is already
             // covered by the relay-lease + pending-injection gates and by render
@@ -7723,7 +7814,23 @@ export async function startServer(options) {
                     return true;
                 return fresh(path.join(config.stateDir, 'state', 'build', 'build-state.json'));
             },
-            protectedSessions: () => sessionManager.getProtectedSessions(),
+            hasActiveProcesses: (s) => sessionManager.hasActiveProcesses(s),
+        };
+        // Wire the ReapAuthority's KEEP-guard. minAgeMs:0 disables spawn-grace here —
+        // the killers that consult this guard (age-limit #2, idle-zombie #3) already
+        // gate on their own age/idle thresholds, so the reaper-specific spawn-grace
+        // would otherwise delay legitimate zombie kills for young-but-stuck sessions.
+        {
+            const { ReapGuard } = await import('../core/ReapGuard.js');
+            sessionManager.setReapGuard(new ReapGuard(reapGuardDeps, { minAgeMs: 0 }));
+        }
+        // (setAwakeChecker is wired earlier, before the boot purge, so the purge is
+        //  lease-gated — see the §P3/§P4 block above.)
+        const sessionReaper = new SessionReaper({
+            ...reapGuardDeps,
+            listRunningSessions: () => sessionManager.listRunningSessions(),
+            captureOutput: (s, n) => sessionManager.captureOutput(s, n) ?? '',
+            frameworkForSession: (s) => sessionManager.frameworkForSession(s),
             pressure: () => {
                 const total = _os.totalmem();
                 const freePct = total > 0 ? (_os.freemem() / total) * 100 : 100;
@@ -7736,6 +7843,65 @@ export async function startServer(options) {
             audit: fileAuditSink(config.stateDir),
         }, config.monitoring?.sessionReaper);
         sessionReaper.start();
+        // ── Unkillability backstop (UNIFIED-SESSION-LIFECYCLE §P5) ───────────────
+        // Signal-only: raises ONE deduped Attention item (never auto-kills) when a
+        // session is KEPT forever despite faking work, or is stuck indeterminate.
+        {
+            const { StaleSessionBackstop } = await import('../monitoring/StaleSessionBackstop.js');
+            const { probeTranscript } = await import('../monitoring/transcriptProber.js');
+            const { makeAttentionPoster } = await import('../monitoring/sentinelWiring.js');
+            const _crypto = await import('node:crypto');
+            const staleCfg = config.monitoring?.staleBackstop ?? {};
+            const progressFloorBytes = staleCfg.progressFloorBytes ?? 512;
+            const hash = (s) => _crypto.createHash('sha1').update(s).digest('hex').slice(0, 16);
+            const backstop = new StaleSessionBackstop({
+                listRunningSessions: () => sessionManager.listRunningSessions(),
+                probeLiveness: (names) => sessionManager.probeLivenessBatch(names),
+                snapshot: (session) => {
+                    const framework = session.framework ?? sessionManager.frameworkForSession(session.tmuxSession) ?? 'claude-code';
+                    const sessionId = framework === 'claude-code' ? (session.claudeSessionId ?? '') : '';
+                    const tp = probeTranscript({ framework, sessionId, projectDir: '' });
+                    // Tail hash: read the last progressFloorBytes so a heartbeat-byte append
+                    // (same tail) is NOT counted as a meaningful advance.
+                    let tailHash = null;
+                    if (tp.resolved && tp.path) {
+                        try {
+                            const fd = fs.openSync(tp.path, 'r');
+                            try {
+                                const start = Math.max(0, tp.size - progressFloorBytes);
+                                const len = tp.size - start;
+                                const buf = Buffer.alloc(len);
+                                fs.readSync(fd, buf, 0, len, start);
+                                tailHash = hash(buf.toString('utf-8'));
+                            }
+                            finally {
+                                fs.closeSync(fd);
+                            }
+                        }
+                        catch {
+                            // @silent-fallback-ok — an unreadable transcript tail just means
+                            // "no meaningful-advance signal this tick"; the backstop treats a
+                            // null tail as ambiguous (never as progress), which is safe.
+                            tailHash = null;
+                        }
+                    }
+                    const frame = sessionManager.captureOutput(session.tmuxSession, 8) ?? '';
+                    return {
+                        transcriptResolved: tp.resolved,
+                        transcriptSize: tp.size,
+                        transcriptTailHash: tailHash,
+                        mainProcessActive: sessionManager.hasActiveProcesses(session.tmuxSession),
+                        idleStateToken: hash(frame),
+                    };
+                },
+                raiseAttention: makeAttentionPoster({ port: config.port, authToken: config.authToken ?? '' }),
+                setLongIndeterminate: (id, isLong) => sessionManager.markLongIndeterminate(id, isLong),
+            }, staleCfg);
+            backstop.start();
+            if (staleCfg.enabled !== false) {
+                console.log(pc.green('  Unkillability backstop enabled (§P5 — signal-only, never auto-kills)'));
+            }
+        }
         if (config.monitoring?.sessionReaper?.enabled) {
             console.log(pc.green(config.monitoring.sessionReaper.dryRun === false
                 ? '  SessionReaper enabled (idle-session reaper — LIVE)'
@@ -7888,7 +8054,7 @@ export async function startServer(options) {
                 }
             }
         }
-        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, unjustifiedStopGate, stopGateDb, stopNotifier });
+        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, reapLog, unjustifiedStopGate, stopGateDb, stopNotifier });
         // Boot-recovery (tunnel-failure-resilience spec Part 6): if the agent
         // died mid-relay-episode, the persisted tunnel.json carries
         // rotationPending=true. Rotate the dashboard PIN + authToken BEFORE