instar 1.3.629 → 1.3.630

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAkH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAy8etE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA2EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAohftE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -85,7 +85,8 @@ import { MultiMachineCoordinator } from '../core/MultiMachineCoordinator.js';
 import { isRemotelyHandled } from '../core/SessionRouter.js';
 import { isSlackSessionKey, reconstructSlackMessage } from '../core/SlackForwardBridge.js';
 import { formatForwardedTopicContext } from '../core/ForwardedTopicContext.js';
-import { resolveAdvertisedMeshUrl, advertiseSelfMeshUrl } from '../core/MeshUrlAdvertiser.js';
+import { resolveAdvertisedMeshUrl, advertiseSelfMeshUrl, detectTailscaleIp, pickPrimaryLanIp, computeSelfMeshEndpoints, advertiseSelfMeshEndpoints } from '../core/MeshUrlAdvertiser.js';
+import { PeerEndpointResolver } from '../core/PeerEndpointResolver.js';
 import { relayOutbound } from '../core/TelegramRelay.js';
 import { GitSyncManager } from '../core/GitSync.js';
 import { RegistrySyncDebouncer } from '../core/RegistrySyncDebouncer.js';
@@ -174,6 +175,58 @@ import { toInjection } from '../types/pipeline.js';
 import { UserManager } from '../users/UserManager.js';
 import { formatUserContextForSession, hasUserContext } from '../users/UserContextBuilder.js';
 import { SafeFsExecutor } from '../core/SafeFsExecutor.js';
+// setup.ts uses @inquirer/prompts which requires Node 20.12+
+// Dynamic import to avoid breaking the server on older Node versions
+// import { installAutoStart } from './setup.js';
+/**
+ * multi-transport-mesh-comms — this machine's own IPv4 CIDRs (for the
+ * PeerEndpointResolver LAN-subnet gate). Each non-internal IPv4 interface address
+ * with its prefix length, e.g. '192.168.87.67/24'. Pure read of os.networkInterfaces().
+ */
+function ownIpv4Cidrs() {
+    const out = [];
+    const ifaces = os.networkInterfaces();
+    for (const addrs of Object.values(ifaces)) {
+        for (const a of addrs ?? []) {
+            const isV4 = a.family === 'IPv4' || a.family === 4;
+            if (isV4 && !a.internal && typeof a.cidr === 'string' && a.cidr)
+                out.push(a.cidr);
+        }
+    }
+    return out;
+}
+/**
+ * multi-transport-mesh-comms (Layer 0) — compute + advertise THIS machine's mesh
+ * endpoint set (Tailscale / LAN / Cloudflare) into its registry entry, co-located
+ * with the lastKnownUrl advertise. Best-effort + idempotent: detection failures
+ * fail silent (an absent rope is simply not advertised). No-op when the mesh
+ * transport is disabled. Called at boot + on sleep/wake tunnel restart.
+ */
+async function advertiseSelfMeshEndpointsNow(identityManager, machineId, cfg, cloudflareUrl) {
+    try {
+        if (!cfg.multiMachine?.enabled || cfg.multiMachine?.meshTransport?.enabled === false)
+            return;
+        const tailscaleEnabled = cfg.multiMachine?.meshTransport?.tailscaleEnabled !== false;
+        const tailscaleIp = tailscaleEnabled ? await detectTailscaleIp() : null;
+        const lanIp = pickPrimaryLanIp(os.networkInterfaces());
+        const endpoints = computeSelfMeshEndpoints({
+            cloudflareUrl,
+            lanIp,
+            tailscaleIp,
+            port: cfg.port ?? 4042,
+            tailscaleEnabled,
+        });
+        // E2E-PAIRING: EXEMPT — this commit is comment-only (@silent-fallback-ok ratchet
+        // tags); it adds NO new route. The mesh routes/fields shipped in the prior commit
+        // (1cd2618e) with their integration + 2-server tests.
+        advertiseSelfMeshEndpoints(identityManager, machineId, endpoints, (m) => console.log(pc.dim(m)));
+    }
+    catch {
+        // @silent-fallback-ok: best-effort — endpoint advertisement must never break boot
+        // (a Tailscale-detect/registry hiccup just means fewer advertised ropes this tick;
+        // the next heartbeat retries and the mesh degrades to the remaining ropes).
+    }
+}
 /**
  * Pure: should the emergency "fix command" gate intercept this message?
  *
@@ -3895,14 +3948,47 @@ export async function startServer(options) {
                 // stays true, so the lease behaves exactly as git-only. Multi-machine
                 // meshes get RTT-bounded acquisition + the renewal-requires-medium rule.
                 let leaseSeq = Date.now();
+                // multi-transport-mesh-comms (Layer 1) — the hedged-failover resolver,
+                // built from the FLAT meshTransport config. Injected into the transport;
+                // when meshTransport.enabled is false the transport falls back to the
+                // single-`url` legacy path (byte-for-byte today).
+                const meshCfg = config.multiMachine?.meshTransport;
+                const meshEnabled = () => meshCfg?.enabled !== false; // default ON
+                const meshResolver = new PeerEndpointResolver({
+                    config: {
+                        enabled: meshCfg?.enabled !== false,
+                        hedgeDelayMs: meshCfg?.hedgeDelayMs ?? 1500,
+                        priorityTailscale: meshCfg?.priorityTailscale ?? 10,
+                        priorityLan: meshCfg?.priorityLan ?? 20,
+                        priorityCloudflare: meshCfg?.priorityCloudflare ?? 30,
+                        tailscaleEnabled: meshCfg?.tailscaleEnabled !== false,
+                        lanSubnetGate: meshCfg?.lanSubnetGate !== false,
+                        unhealthyAfterFailures: meshCfg?.unhealthyAfterFailures ?? 3,
+                        endpointEvictionMs: meshCfg?.endpointEvictionMs ?? 3_600_000,
+                        maxProbeBackoffMs: meshCfg?.maxProbeBackoffMs ?? 300_000,
+                        requestTimeoutMs: Math.min(seamlessness.leaseTtlMs / 2, 30_000),
+                    },
+                    ownCidrs: () => ownIpv4Cidrs(),
+                    logger: (m) => console.log(pc.dim(m)),
+                });
                 leaseTransport = new HttpLeaseTransport({
                     selfMachineId,
                     signingKeyPem: idMgr.loadSigningKey(),
                     peers: () => {
                         const reg = idMgr.loadRegistry();
                         return Object.entries(reg.machines ?? {})
-                            .filter(([id, e]) => id !== selfMachineId && !!e.lastKnownUrl && !e.revokedAt)
-                            .map(([id, e]) => ({ machineId: id, url: e.lastKnownUrl }));
+                            .filter(([id, e]) => id !== selfMachineId && (!!e.lastKnownUrl || (e.endpoints?.length ?? 0) > 0) && !e.revokedAt)
+                            .map(([id, e]) => ({
+                            machineId: id,
+                            url: (e.lastKnownUrl ?? ''),
+                            endpoints: e.endpoints,
+                            publicKeyPem: idMgr.getSigningPublicKeyPem(id),
+                            // Rolling-deploy gate: a peer that advertises an endpoint set is
+                            // running THIS build (the field + the accept-ack receiver ship
+                            // atomically), so it is ack-capable. An older peer (no endpoints,
+                            // or no resolvable pubkey) stays on the 2xx back-compat path.
+                            meshAckCapable: (e.endpoints?.length ?? 0) > 0 && !!idMgr.getSigningPublicKeyPem(id),
+                        }));
                     },
                     nextSequence: () => ++leaseSeq,
                     reachabilityWindowMs: seamlessness.leaseTtlMs,
@@ -3911,6 +3997,9 @@ export async function startServer(options) {
                     // the whole TTL, but ABOVE the fleet's 5-40s receiver-stall envelope
                     // so a slow-but-alive peer isn't converted into "no medium".
                     requestTimeoutMs: Math.min(seamlessness.leaseTtlMs / 2, 30_000),
+                    resolver: meshResolver,
+                    meshTransportEnabled: meshEnabled,
+                    hedgeDelayMs: meshCfg?.hedgeDelayMs ?? 1500,
                     logger: (m) => console.log(pc.dim(m)),
                 });
                 const leaseCoordinator = new LeaseCoordinator({
@@ -3940,6 +4029,30 @@ export async function startServer(options) {
                             return null;
                         return { enabled: true, nonRenewalMissedObservations: sht.nonRenewalMissedObservations ?? 6 };
                     },
+                    // multi-transport-mesh-comms Layer 3 (soloCaptainHold) — DARK by default.
+                    // Resolved live; the three gates are EXISTING signals: the F4 preferred-awake
+                    // config (this machine is the named preferred), every peer presumed-gone by
+                    // the same liveness timeout presumedDeadHolders uses, and (checked inside the
+                    // coordinator) no higher epoch.
+                    soloCaptainHold: () => {
+                        const sch = config.multiMachine?.leaseSelfHeal?.soloCaptainHold;
+                        return sch?.enabled ? { enabled: true } : null;
+                    },
+                    isPreferredAwakeAgreed: () => {
+                        const pref = config.multiMachine?.leaseSelfHeal?.preferredAwakeMachineId;
+                        return !!pref && pref === selfMachineId;
+                    },
+                    allPeersPresumedGone: () => {
+                        const reg = idMgr.loadRegistry();
+                        const nowMs = Date.now();
+                        const peerIds = Object.keys(reg.machines ?? {}).filter((id) => id !== selfMachineId && !reg.machines[id].revokedAt);
+                        if (peerIds.length === 0)
+                            return false; // a solo machine never "holds against" a peer
+                        return peerIds.every((id) => {
+                            const last = Date.parse(reg.machines[id].lastSeen);
+                            return !Number.isNaN(last) && nowMs - last > seamlessness.failoverThresholdMs;
+                        });
+                    },
                     onSelfSuspend: (reason) => console.log(pc.yellow(`  [lease] self-suspend: ${reason}`)),
                     onEscalate: (info) => console.log(pc.yellow(`  [lease] split-brain escalation: ${info.reason} (holder ${info.holder})`)),
                     logger: (m) => console.log(pc.dim(m)),
@@ -11128,7 +11241,10 @@ export async function startServer(options) {
                             // now stale; peers must learn the new one or cross-machine routing
                             // silently breaks post-wake.
                             if (coordinator.enabled && coordinator.identity) {
-                                advertiseSelfMeshUrl(coordinator.managers.identityManager, coordinator.identity.machineId, resolveAdvertisedMeshUrl(config.tunnel, tunnelUrl), (m) => console.log(pc.dim(m)));
+                                const cfUrl = resolveAdvertisedMeshUrl(config.tunnel, tunnelUrl);
+                                advertiseSelfMeshUrl(coordinator.managers.identityManager, coordinator.identity.machineId, cfUrl, (m) => console.log(pc.dim(m)));
+                                // multi-transport-mesh-comms — re-advertise endpoints post-wake.
+                                await advertiseSelfMeshEndpointsNow(coordinator.managers.identityManager, coordinator.identity.machineId, config, cfUrl);
                             }
                             // Re-broadcast dashboard URL after tunnel restart (quick tunnels get new URL)
                             if (tunnelUrl) {
@@ -17584,7 +17700,10 @@ export async function startServer(options) {
                 // out (the session pool is inert across machines). The existing
                 // RegistrySyncDebouncer propagates the populated entry to peers.
                 if (coordinator.enabled && coordinator.identity) {
-                    advertiseSelfMeshUrl(coordinator.managers.identityManager, coordinator.identity.machineId, resolveAdvertisedMeshUrl(config.tunnel, tunnelUrl), (m) => console.log(pc.dim(m)));
+                    const cfUrl = resolveAdvertisedMeshUrl(config.tunnel, tunnelUrl);
+                    advertiseSelfMeshUrl(coordinator.managers.identityManager, coordinator.identity.machineId, cfUrl, (m) => console.log(pc.dim(m)));
+                    // multi-transport-mesh-comms (Layer 0) — advertise the full endpoint set.
+                    await advertiseSelfMeshEndpointsNow(coordinator.managers.identityManager, coordinator.identity.machineId, config, cfUrl);
                 }
             }
             catch (err) {