instar 1.3.753 → 1.3.754

package/dist/commands/server.d.ts

@@ -11,6 +11,7 @@ import { SessionManager } from '../core/SessionManager.js';
 import { TelegramAdapter } from '../messaging/TelegramAdapter.js';
 import { TopicMemory } from '../memory/TopicMemory.js';
 import { QuotaTracker } from '../monitoring/QuotaTracker.js';
+import type { IntelligenceProvider, InstarConfig } from '../core/types.js';
 import { UserManager } from '../users/UserManager.js';
 /**
  * Pure: should the emergency "fix command" gate intercept this message?
@@ -38,7 +39,35 @@ interface StartOptions {
      *  Commander maps --no-telegram to telegram: false. */
     telegram?: boolean;
 }
-export declare function wireTelegramRouting(telegram: TelegramAdapter, sessionManager: SessionManager, quotaTracker?: QuotaTracker, topicMemory?: TopicMemory, userManager?: UserManager, fixCommandHandler?: (topicId: number, text: string) => Promise<boolean>, getHubDeps?: () => import('../threadline/hubCommands.js').HubBindDeps | null, getTopicOperatorStore?: () => import('../users/TopicOperatorStore.js').TopicOperatorStore | null, getAttentionTopicId?: () => number | null | undefined): void;
+/**
+ * Resolve the hub-intent classifier deps (Conversion #3,
+ * docs/specs/keyword-intent-conversions-1-and-3.md) from live config + the shared
+ * IntelligenceProvider. `enabled` is DEV-GATED (resolveDevAgentGate): DARK on the
+ * fleet, LIVE on a development agent. `dryRun` defaults true (the soak) so a
+ * dev-agent classifier RUNS but the message ALWAYS passes through until a
+ * deliberate `dryRun:false`. Passed as a late-bound getter so it re-reads config
+ * at message time.
+ */
+export declare function resolveHubClassifierDeps(config: InstarConfig, intelligence: IntelligenceProvider | null): {
+    intelligence: IntelligenceProvider | null;
+    enabled: boolean;
+    dryRun: boolean;
+    minConfidence: number;
+    timeoutMs: number;
+    contextTurns: number;
+    modelTier: 'fast' | 'balanced' | 'capable';
+    stateDir: string;
+};
+export declare function wireTelegramRouting(telegram: TelegramAdapter, sessionManager: SessionManager, quotaTracker?: QuotaTracker, topicMemory?: TopicMemory, userManager?: UserManager, fixCommandHandler?: (topicId: number, text: string) => Promise<boolean>, getHubDeps?: () => import('../threadline/hubCommands.js').HubBindDeps | null, getTopicOperatorStore?: () => import('../users/TopicOperatorStore.js').TopicOperatorStore | null, getAttentionTopicId?: () => number | null | undefined, getHubClassifierDeps?: () => {
+    intelligence: import('../core/types.js').IntelligenceProvider | null;
+    enabled: boolean;
+    dryRun: boolean;
+    minConfidence: number;
+    timeoutMs: number;
+    contextTurns: number;
+    modelTier: 'fast' | 'balanced' | 'capable';
+    stateDir: string;
+} | null): void;
 export declare function startServer(options: StartOptions): Promise<void>;
 export declare function stopServer(options: {
     dir?: string;

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA8H7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA2/CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CAijBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ylBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA2/CD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAonBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ylBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -1833,6 +1833,28 @@ async function handleProfileConfirm(telegram, surface, slots, topicId, principal
     await send('That switch is no longer pending.');
     return true;
 }
+/**
+ * Resolve the hub-intent classifier deps (Conversion #3,
+ * docs/specs/keyword-intent-conversions-1-and-3.md) from live config + the shared
+ * IntelligenceProvider. `enabled` is DEV-GATED (resolveDevAgentGate): DARK on the
+ * fleet, LIVE on a development agent. `dryRun` defaults true (the soak) so a
+ * dev-agent classifier RUNS but the message ALWAYS passes through until a
+ * deliberate `dryRun:false`. Passed as a late-bound getter so it re-reads config
+ * at message time.
+ */
+export function resolveHubClassifierDeps(config, intelligence) {
+    const cfg = config.threadline?.hubIntent;
+    return {
+        intelligence,
+        enabled: resolveDevAgentGate(cfg?.enabled, config),
+        dryRun: cfg?.dryRun ?? true,
+        minConfidence: cfg?.minConfidence ?? 0.85,
+        timeoutMs: cfg?.timeoutMs ?? 4000,
+        contextTurns: cfg?.contextWindowTurns ?? 6,
+        modelTier: cfg?.modelTier ?? 'fast',
+        stateDir: config.stateDir,
+    };
+}
 export function wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManager, fixCommandHandler, 
 // Late-bound: the threadline hub deps are constructed AFTER this is wired, so
 // resolve them at message-time (CMT-529 deterministic "open this" intercept).
@@ -1846,7 +1868,15 @@ getTopicOperatorStore,
 // fix-command gate (below) only fires in that topic; everywhere else a
 // message starting with restart/fix/clean is normal conversation and must
 // route to the session instead of being swallowed.
-getAttentionTopicId) {
+getAttentionTopicId, 
+// Late-bound (same reason as getHubDeps): the hub-intent classifier deps —
+// the config-resolved dev-gate/settings + the shared IntelligenceProvider.
+// Conversion #3 (docs/specs/keyword-intent-conversions-1-and-3.md): the
+// "open this"/"tie this to <topic>" DECISION is inferred by an LLM over the
+// message + recent conversation (HubIntentClassifier), NOT a regex — the
+// regex SWALLOWED the message before the agent saw it, so a misread ATE it.
+// Resolved at the callsite where config + sharedIntelligence are in scope.
+getHubClassifierDeps) {
     // Guard: tracks which topic IDs have a spawn in progress.
     // Prevents duplicate concurrent spawns for the same topic when messages
     // arrive faster than the async spawn completes.
@@ -1942,10 +1972,19 @@ getAttentionTopicId) {
             return;
         }
         // ── Threadline hub commands: "open this" / "tie this to <topic>" (CMT-529) ──
-        // When a message in the Threadline HUB topic is a deterministic hub command,
-        // bind the conversation to a topic STRUCTURALLY — before any agent interprets
-        // it. This onTopicMessage seam is the convergence both inbound paths reach
+        // When a message in the Threadline HUB topic is a bind command, bind the
+        // conversation to a topic STRUCTURALLY — before any agent interprets it. This
+        // onTopicMessage seam is the convergence both inbound paths reach
         // (lifeline-forward AND server-polling), so one intercept covers both modes.
+        //
+        // Conversion #3 (docs/specs/keyword-intent-conversions-1-and-3.md): the
+        // "is this a bind command?" DECISION is inferred by an LLM over the message +
+        // recent conversation (HubIntentClassifier), NOT a regex. The old regex
+        // SWALLOWED the message before the agent saw it, so a misread silently ATE a
+        // real message. Dev-gated dark (resolveDevAgentGate at the callsite) +
+        // dry-run FIRST: while dark or dry-run the message ALWAYS passes through
+        // (never swallowed); the classifier still runs on a dev agent and LOGS
+        // would-swallow vs would-pass for the soak. Fail-OPEN on any uncertainty.
         // FAIL-OPEN: any error falls through to normal routing.
         const hubDeps = getHubDeps?.() ?? null;
         if (hubDeps) {
@@ -1958,17 +1997,78 @@ getAttentionTopicId) {
                     hubTopicId = undefined;
                 }
                 if (hubTopicId !== undefined && Number(topicId) === Number(hubTopicId)) {
-                    const { parseHubCommand, bindHubConversation } = await import('../threadline/hubCommands.js');
-                    const cmd = parseHubCommand(text);
-                    if (cmd) {
-                        const result = await bindHubConversation(hubDeps, { ...cmd, autoPick: true }); // human "open this" → auto-pick most-recent, never 409
-                        if (!result.ok) {
-                            await telegram.sendToTopic(topicId, result.status === 404
-                                ? 'Nothing waiting in the hub to open right now.'
-                                : `Couldn't open that — ${result.error}`).catch(() => { });
+                    const clsDeps = getHubClassifierDeps?.() ?? null;
+                    // Dark gate: when the classifier isn't enabled (fleet default), never
+                    // swallow — pass the message through to the agent (no regex fallback).
+                    if (clsDeps?.enabled) {
+                        const { bindHubConversation } = await import('../threadline/hubCommands.js');
+                        const { classifyHubIntent, toHubCommand } = await import('../threadline/HubIntentClassifier.js');
+                        // The enum of bindable topics (real existing topics) — the model can
+                        // only tie to one of these (structured-output guardrail).
+                        let bindableTopics = [];
+                        try {
+                            bindableTopics = telegram.getAllTopicMappings()
+                                .map((m) => ({ topicId: m.topicId, topicName: m.topicName ?? `topic ${m.topicId}` }));
+                        }
+                        catch { /* best-effort — an empty enum simply means only "open" is possible */ }
+                        // Bounded window of recent turns so context-dependent commands ("yes,
+                        // tie it to that one") can resolve their target. Best-effort.
+                        let conversationContext = [];
+                        try {
+                            const hist = telegram.getTopicHistory(topicId, clsDeps.contextTurns) ?? [];
+                            conversationContext = hist.map((h) => ({ fromUser: !!h.fromUser, text: String(h.text ?? '') }));
+                        }
+                        catch { /* context is best-effort; classify on the message alone */ }
+                        const result = await classifyHubIntent({
+                            text,
+                            bindableTopics,
+                            conversationContext,
+                            intelligence: clsDeps.intelligence,
+                            minConfidence: clsDeps.minConfidence,
+                            timeoutMs: clsDeps.timeoutMs,
+                            maxContextTurns: clsDeps.contextTurns,
+                            modelTier: clsDeps.modelTier,
+                        });
+                        const willAct = result.isCommand && !clsDeps.dryRun;
+                        // Audit the soak: log LLM-engaged decisions (a prefilter-skip is the
+                        // bulk of traffic and always a would-pass — skipping it cuts volume
+                        // AND the message-preview privacy surface). Never gates the message.
+                        if (result.source !== 'prefilter-skip') {
+                            try {
+                                const logDir = path.join(clsDeps.stateDir, 'logs');
+                                fs.mkdirSync(logDir, { recursive: true });
+                                const decision = result.isCommand ? (willAct ? 'swallow' : 'would-swallow') : 'pass';
+                                fs.appendFileSync(path.join(logDir, 'hub-intent.jsonl'), JSON.stringify({
+                                    ts: new Date().toISOString(),
+                                    topicId,
+                                    decision,
+                                    dryRun: clsDeps.dryRun,
+                                    source: result.source,
+                                    intent: result.intent,
+                                    targetTopicId: result.targetTopicId,
+                                    confidence: result.confidence,
+                                    reason: result.reason,
+                                    textPreview: String(text).replace(/\s+/g, ' ').trim().slice(0, 80),
+                                }) + '\n');
+                            }
+                            catch { /* audit is observability — never gates the message path */ }
+                        }
+                        // Dry-run (the soak) OR not-a-command OR fail-open → pass the message
+                        // through untouched. Real swallowing needs a deliberate dryRun:false,
+                        // AND fail-open means uncertainty never swallows.
+                        if (willAct) {
+                            const cmd = toHubCommand(result);
+                            if (cmd) {
+                                const bindResult = await bindHubConversation(hubDeps, { ...cmd, autoPick: true }); // human "open this" → auto-pick most-recent, never 409
+                                if (!bindResult.ok) {
+                                    await telegram.sendToTopic(topicId, bindResult.status === 404
+                                        ? 'Nothing waiting in the hub to open right now.'
+                                        : `Couldn't open that — ${bindResult.error}`).catch(() => { });
+                                }
+                                // On success bindHubConversation already posted the hub confirmation.
+                                return; // structural: never inject the command into a session
+                            }
                         }
-                        // On success bindHubConversation already posted the hub confirmation.
-                        return; // structural: never inject the command into a session
                     }
                 }
             }
@@ -6198,7 +6298,7 @@ export async function startServer(options) {
             const userManagerSendOnly = new UserManager(config.stateDir, config.users);
             attachUserReplication(userManagerSendOnly); // WS2.6 send-side (dark by default)
             _fixDeps = { state, liveConfig, sessionManager, telegram, config };
-            wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManagerSendOnly, (topicId, text) => handleFixCommand(topicId, text, _fixDeps), () => (collaborationSurfacer && conversationStore && telegram) ? { collaborationSurfacer, conversationStore, commitmentTracker, telegram, brief: briefDeps } : null, () => _agentServerRef?.getTopicOperatorStore() ?? null, () => state.get('agent-attention-topic'));
+            wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManagerSendOnly, (topicId, text) => handleFixCommand(topicId, text, _fixDeps), () => (collaborationSurfacer && conversationStore && telegram) ? { collaborationSurfacer, conversationStore, commitmentTracker, telegram, brief: briefDeps } : null, () => _agentServerRef?.getTopicOperatorStore() ?? null, () => state.get('agent-attention-topic'), () => resolveHubClassifierDeps(config, _sharedIntelligence));
             wireTelegramCallbacks(telegram, sessionManager, state, quotaTracker, undefined, config.sessions.claudePath, topicMemory);
             console.log(pc.green('  Telegram routing + command callbacks wired (send-only)'));
         }
@@ -6330,7 +6430,7 @@ export async function startServer(options) {
                 config,
             };
             // Wire up topic → session routing and session management callbacks
-            wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManager, (topicId, text) => handleFixCommand(topicId, text, _fixDeps), () => (collaborationSurfacer && conversationStore && telegram) ? { collaborationSurfacer, conversationStore, commitmentTracker, telegram, brief: briefDeps } : null, () => _agentServerRef?.getTopicOperatorStore() ?? null, () => state.get('agent-attention-topic'));
+            wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory, userManager, (topicId, text) => handleFixCommand(topicId, text, _fixDeps), () => (collaborationSurfacer && conversationStore && telegram) ? { collaborationSurfacer, conversationStore, commitmentTracker, telegram, brief: briefDeps } : null, () => _agentServerRef?.getTopicOperatorStore() ?? null, () => state.get('agent-attention-topic'), () => resolveHubClassifierDeps(config, _sharedIntelligence));
             wireTelegramCallbacks(telegram, sessionManager, state, quotaTracker, accountSwitcher, config.sessions.claudePath, topicMemory);
             // Wire up unknown-user handling (Multi-User Setup Wizard Phase 4.5)
             telegram.onGetRegistrationPolicy = () => ({