instar 1.3.675 → 1.3.677

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAsmhBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8CH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAwH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA+EtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA84CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CAmfN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyrhBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -22,6 +22,8 @@ import { loadConfig, ensureStateDir, detectTmuxPath, detectGeminiPath } from '..
 import { handleProcessLevelError } from '../core/uncaughtExceptionPolicy.js';
 import { planInboundLossNotices } from '../core/inboundLossRouting.js';
 import { configureHostSpawnSemaphore } from '../core/hostSpawnSemaphore.js';
+import { SpawningTopicsRegistry } from '../core/SpawningTopicsRegistry.js';
+import { TopicReachabilityVerifier } from '../monitoring/TopicReachabilityVerifier.js';
 import { SingleInstanceLock, installReleaseHandlers } from '../core/SingleInstanceLock.js';
 import { resolveDevAgentGate, resolveStateSyncStores } from '../core/devAgentGate.js';
 import { shouldReleaseOnComplete, planClaimOnSpawn, ownershipNonce } from '../core/ownershipFollowsLiveWork.js';
@@ -440,6 +442,10 @@ let _fixDeps = null;
 // server's store at message-time — the server is constructed long after
 // routing is wired, and the store must be the server's OWN instance.
 let _agentServerRef = null;
+// F7: late-bound ref to wireTelegramRouting's spawning-topics registry so the
+// TopicReachabilityVerifier (constructed in the outer scope) can probe whether a topic
+// is stuck-spawning. Assigned inside wireTelegramRouting; null until routing is wired.
+let _spawningTopicsRegistryRef = null;
 // Module-level reference for session resume mapping.
 // Set once in startServer() and used by spawnSessionForTopic/respawnSessionForTopic.
 let _topicResumeMap = null;
@@ -1731,7 +1737,12 @@ getAttentionTopicId) {
     // Guard: tracks which topic IDs have a spawn in progress.
     // Prevents duplicate concurrent spawns for the same topic when messages
     // arrive faster than the async spawn completes.
-    const spawningTopics = new Set();
+    // F7 Piece 1: token-tagged spawn-guard. `has` guards double-spawn (as the old Set
+    // did); `add` returns a token and `clear` is token-guarded so a late `.finally` from
+    // a superseded spawn cannot delete a newer entry (the ABA fix). A hung spawn keeps its
+    // entry (no timeout/sweep) so the verifier can SURFACE it — never auto-cleared.
+    const spawningTopics = new SpawningTopicsRegistry();
+    _spawningTopicsRegistryRef = spawningTopics; // F7: expose to the outer-scope verifier
     telegram.onTopicMessage = async (msg) => {
         const topicId = msg.metadata?.messageThreadId ?? null;
         if (!topicId)
@@ -2032,7 +2043,7 @@ getAttentionTopicId) {
                         console.log(`[telegram→session] Spawn already in progress for topic ${topicId} — skipping duplicate respawn`);
                         return;
                     }
-                    spawningTopics.add(topicId);
+                    const _spawnTokA = spawningTopics.add(topicId);
                     // Remove the resume UUID so respawnSessionForTopic doesn't try --resume
                     if (_topicResumeMap) {
                         _topicResumeMap.remove(topicId);
@@ -2043,7 +2054,7 @@ getAttentionTopicId) {
                         telegram.sendToTopic(topicId, `❌ Fresh session restart failed. Try sending your message again.`).catch(() => { });
                     })
                         .finally(() => {
-                        spawningTopics.delete(topicId);
+                        spawningTopics.clear(topicId, _spawnTokA);
                     });
                 }
                 else if (!isQuotaDeath) {
@@ -2054,7 +2065,7 @@ getAttentionTopicId) {
                         console.log(`[telegram→session] Spawn already in progress for topic ${topicId} — skipping duplicate respawn`);
                         return;
                     }
-                    spawningTopics.add(topicId);
+                    const _spawnTokB = spawningTopics.add(topicId);
                     telegram.sendToTopic(topicId, `🔄 Session restarting — message queued.`).catch(() => { });
                     respawnSessionForTopic(sessionManager, telegram, targetSession, topicId, text, topicMemory, resolvedUser ?? undefined)
                         .catch(err => {
@@ -2066,7 +2077,7 @@ getAttentionTopicId) {
                         telegram.sendToTopic(topicId, userMsg).catch(() => { });
                     })
                         .finally(() => {
-                        spawningTopics.delete(topicId);
+                        spawningTopics.clear(topicId, _spawnTokB);
                     });
                 }
             }
@@ -2081,7 +2092,7 @@ getAttentionTopicId) {
                 console.log(`[telegram→session] Spawn already in progress for topic ${topicId} — skipping duplicate`);
                 return;
             }
-            spawningTopics.add(topicId);
+            const _spawnTokC = spawningTopics.add(topicId);
             // Resolve topic name — try in-memory, then active probe, then fallback
             let spawnName = storedTopicName;
             if (!spawnName || /^topic-\d+$/.test(spawnName)) {
@@ -2104,7 +2115,7 @@ getAttentionTopicId) {
                     : 'Having trouble starting a session right now. Try sending your message again in a moment.';
                 telegram.sendToTopic(topicId, userMsg).catch(() => { });
             }).finally(() => {
-                spawningTopics.delete(topicId);
+                spawningTopics.clear(topicId, _spawnTokC);
             });
         }
     };
@@ -2195,7 +2206,7 @@ getAttentionTopicId) {
             return { kind: 'handover-refused' };
         if (handover.stopRecheck())
             return { kind: 'stopped-before-inject' };
-        spawningTopics.add(topicId);
+        const _spawnTokD = spawningTopics.add(topicId);
         try {
             if (targetSession) {
                 // Dead session — respawn, AWAITED through the spawn+inject (the PIS
@@ -2214,7 +2225,7 @@ getAttentionTopicId) {
             return { kind: 'local-delivered', injectError: err instanceof Error ? err.message : String(err) };
         }
         finally {
-            spawningTopics.delete(topicId);
+            spawningTopics.clear(topicId, _spawnTokD);
         }
     };
 }
@@ -2751,10 +2762,17 @@ export async function startServer(options) {
     // so every `claude -p`/`codex exec` spawn this process makes is bounded. A
     // safety FLOOR — read with a plain `??` default (env > config > 8), never the
     // dev-agent gate; it ships ON for every agent, never dark.
+    // F5 interactive-priority reservation: `enabled` is OMITTED from ConfigDefaults so
+    // it rides the dev-agent gate (live-on-dev / dark-fleet). The reservation only
+    // SUBDIVIDES within the safety cap above — it never raises it. When off, acquire is
+    // byte-identical to the all-or-nothing cap.
+    const _ipCfg = config.intelligence?.spawnCap?.interactivePriority;
+    const _ipEnabled = resolveDevAgentGate(_ipCfg?.enabled, config);
     configureHostSpawnSemaphore({
         maxConcurrent: config.intelligence?.spawnCap?.maxConcurrent,
         acquireMs: config.intelligence?.spawnCap?.acquireMs,
         waitersMax: config.intelligence?.spawnCap?.waitersMax,
+        interactivePriority: { enabled: _ipEnabled, ri: _ipCfg?.ri ?? 2, rb: _ipCfg?.rb ?? 2 },
     });
     // LiveConfig: dynamic config re-reading for long-running server process.
     // Solves the "Written But Not Re-Read" class of bugs — sessions modify
@@ -7625,7 +7643,87 @@ export async function startServer(options) {
                 }
             }
         }
+        // ── F7 Verify-After Topic Reachability (PURE SIGNAL, dev-gated dark/fleet) ──
+        // After a destructive mutation it verifies the topic is still inbound-reachable and
+        // SURFACES a genuine orphan (one NORMAL attention item). It mutates NOTHING. The
+        // probe is conservative + fail-safe: a live session ⇒ reachable; a topic stuck-
+        // spawning past stuckSpawnMs (the registry seam) ⇒ orphan; anything else ⇒ reachable
+        // (the next inbound auto-spawns — the self-heal), so it never false-orphans an idle kill.
+        const _trvCfg = config.monitoring?.topicReachabilityVerifier;
+        const _trvEnabled = resolveDevAgentGate(_trvCfg?.enabled, config);
+        const _stuckSpawnMs = _trvCfg?.stuckSpawnMs ?? 180_000;
+        const topicReachabilityVerifier = _trvEnabled
+            ? new TopicReachabilityVerifier({
+                now: () => Date.now(),
+                graceMs: _trvCfg?.graceMs ?? 30_000,
+                probe: (topic) => {
+                    try {
+                        const session = telegram?.getSessionForTopic(topic);
+                        if (session && sessionManager.isSessionAlive(session))
+                            return { reachable: true };
+                        const stuckMs = _spawningTopicsRegistryRef?.stuckSinceMs(topic);
+                        if (stuckMs !== undefined && stuckMs >= _stuckSpawnMs)
+                            return { reachable: false, reason: 'stuck-spawn' };
+                        return { reachable: true }; // next inbound auto-spawns (self-heal)
+                    }
+                    catch {
+                        return { reachable: true }; // fail-safe: never false-orphan on a probe error
+                    }
+                },
+                surface: (item) => {
+                    void telegram
+                        ?.createAttentionItem({
+                        id: item.key,
+                        title: item.rolledUp ? 'Some conversations may be unreachable' : 'A conversation may be unreachable',
+                        summary: item.reason,
+                        category: 'reachability',
+                        priority: 'NORMAL',
+                        sourceContext: 'topic-reachability',
+                    })
+                        .catch(() => { });
+                },
+                pressureCritical: () => {
+                    try {
+                        return sessionManager.pressureTier?.() === 'critical';
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                emergencyStopActive: () => false, // wired to the operator-halt signal in a follow-up
+            })
+            : null;
+        if (topicReachabilityVerifier) {
+            const _trvTick = setInterval(() => {
+                try {
+                    topicReachabilityVerifier.tick();
+                }
+                catch {
+                    /* @silent-fallback-ok: a verifier tick error must never crash the server. */
+                }
+            }, 15_000);
+            _trvTick.unref?.();
+            guardRegistry.register('monitoring.topicReachabilityVerifier.enabled', () => ({
+                enabled: true,
+                ...topicReachabilityVerifier.status(),
+            }));
+        }
         sessionManager.on('sessionReaped', (e) => {
+            // ── F7: schedule a post-grace reachability verify for the affected topic. Both a
+            //    terminal kill AND a recovery-bounce schedule one (a recovery whose respawn
+            //    wedges is exactly the orphan to catch); the verifier's grace lets a normal
+            //    self-heal land first, so a healthy bounce never surfaces. Pure signal. ──
+            if (topicReachabilityVerifier) {
+                try {
+                    const rawTrv = telegram?.getTopicForSession(e.session.tmuxSession);
+                    const trvTopic = rawTrv == null ? null : Number.isFinite(Number(rawTrv)) ? Number(rawTrv) : null;
+                    if (trvTopic != null)
+                        topicReachabilityVerifier.recordMutation(trvTopic);
+                }
+                catch {
+                    /* @silent-fallback-ok: a verifier trigger error must never affect the reap. */
+                }
+            }
             // ── GAP-B Part B (spec: autonomous-registration-guarantee.md) — the
             //    commitment-evidence BACKSTOP for an UNregistered-but-working autonomous
             //    run. Computed ONCE here (cheap, fail-open) so its verdict feeds BOTH the