instar 1.3.777 → 1.3.779

package/dashboard/index.html

@@ -2751,6 +2751,7 @@
           <button class="tab" data-tab="tokens" onclick="switchTab('tokens')">Tokens</button>
           <button class="tab" data-tab="resources" onclick="switchTab('resources')">Resource Usage</button>
           <button class="tab" data-tab="llm-activity" onclick="switchTab('llm-activity')">LLM Activity</button>
+          <button class="tab" data-tab="routing-map" onclick="switchTab('routing-map')">Routing Map</button>
           <button class="tab" data-tab="threadline" onclick="switchTab('threadline')">Threadline</button>
           <button class="tab" data-tab="evidence" onclick="switchTab('evidence')">Evidence</button>
           <button class="tab" data-tab="process-health" onclick="switchTab('process-health')">Process Health</button>
@@ -3337,6 +3338,41 @@
       </div>
     </div>
 
+    <!-- Routing Map tab — the read-only nature-axis routing map (FD11 readable canary,
+         docs/specs/nature-axis-routing.md). For every internal job-kind: which door +
+         model it uses and its full ordered fallback tier list, with injection-safe /
+         money-gated / critical-gate flags. Read-only display; data from
+         /intelligence/routing/chains. No controls — the map only DISPLAYS the routing. -->
+    <div id="routingMapPanel" style="display:none;flex-direction:column;padding:20px;gap:16px;overflow-y:auto">
+      <div style="display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap">
+        <h2 style="margin:0">Routing Map</h2>
+        <button onclick="loadRoutingMap()" style="padding:6px 12px">Refresh</button>
+      </div>
+      <div style="font-size:12px;color:var(--text-dim);line-height:1.4">
+        Where each internal job-kind sends its AI calls. Every background check, gate, and
+        sentinel has a <b>lane</b> (its "nature") and a fallback list of <b>doors</b> — the ways
+        it can reach a model. This shows, per lane, the ordered door + model list it tries, and
+        flags a door that's <b>metered</b> (a paid API, skipped for now), <b>money-gated</b>, or
+        that must never take untrusted input. Read-only: it shows the map, it changes nothing.
+      </div>
+
+      <!-- The four lanes (chains) -->
+      <div id="routingMapChainsCard" style="border:1px solid var(--border);border-radius:8px;padding:16px;display:flex;flex-direction:column;gap:12px">
+        <div style="font-weight:600">Lanes (fallback order)</div>
+        <div id="routingMapChainsBody" style="font-size:13px;overflow-x:auto">
+          <div style="color:var(--text-dim)">Loading...</div>
+        </div>
+      </div>
+
+      <!-- Per job-kind mapping -->
+      <div style="border:1px solid var(--border);border-radius:8px;padding:16px;display:flex;flex-direction:column;gap:8px">
+        <div style="font-weight:600">By job-kind</div>
+        <div id="routingMapComponentsBody" style="font-size:13px;overflow-x:auto">
+          <div style="color:var(--text-dim)">Loading...</div>
+        </div>
+      </div>
+    </div>
+
     <!-- Evidence Tab (WikiClaim Phase 4) — per-entity evidence + reverse "what cites this?" view.
          Spec: docs/specs/OPENCLAW-IMPORT-WIKICLAIM-EVIDENCE-SPEC.md § Phase 4 (line 343). -->
     <!-- process-health tab -->
@@ -5004,6 +5040,12 @@
         display: ['flex'],
         onActivate: () => { if (typeof loadLlmActivity === 'function') loadLlmActivity(); },
       },
+      {
+        id: 'routing-map',
+        panels: ['routingMapPanel'],
+        display: ['flex'],
+        onActivate: () => { if (typeof loadRoutingMap === 'function') loadRoutingMap(); },
+      },
       {
         id: 'threadline',
         panels: ['threadlineTab'],
@@ -5676,6 +5718,98 @@
       }
     }
 
+    async function loadRoutingMap() {
+      const chainsEl = document.getElementById('routingMapChainsBody');
+      const compsEl = document.getElementById('routingMapComponentsBody');
+      // Render one door+model position as a compact chip line.
+      const flags = (p) => {
+        const f = [];
+        if (p.doorClass === 'metered') f.push('metered' + (p.skippedInIncrementA ? ' · skipped now' : ''));
+        if (p.moneyGated) f.push('money-gated');
+        if (p.injectionSafe === false) f.push('unsafe for untrusted input');
+        if (p.claudeBanned) f.push('no-Claude');
+        return f.length ? ' <span style="color:var(--text-dim)">(' + f.map(escapeHtml).join(' · ') + ')</span>' : '';
+      };
+      const posLine = (p, i) => '<div style="padding:2px 0">' +
+        '<span style="color:var(--text-dim)">' + (i + 1) + '.</span> ' +
+        '<b>' + escapeHtml(p.door) + '</b> → ' + escapeHtml(p.modelId) + flags(p) + '</div>';
+      const th = (t, right) => '<th style="padding:6px 8px;' + (right ? 'text-align:right' : 'text-align:left') + '">' + t + '</th>';
+      const td = (v, right) => '<td style="padding:6px 8px;vertical-align:top;' + (right ? 'text-align:right' : '') + '">' + v + '</td>';
+      try {
+        const data = await apiFetch('/intelligence/routing/chains');
+        const chains = data.chains || [];
+        chainsEl.innerHTML =
+          '<div style="font-size:11px;color:var(--text-dim);margin-bottom:8px">Enforced default framework: <b>' +
+            escapeHtml(String(data.defaultFramework || '—')) + '</b> · injection signal: ' +
+            escapeHtml(String(data.injectionExposureSource || '—')) + '</div>' +
+          '<div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:12px">' +
+          chains.map((c) =>
+            '<div style="border:1px solid var(--border);border-radius:6px;padding:10px">' +
+            '<div style="font-weight:600;margin-bottom:4px">' + escapeHtml(c.chain) + '</div>' +
+            (c.positions || []).map(posLine).join('') +
+            '</div>').join('') +
+          '</div>';
+
+        const comps = (data.components || []).slice().sort((a, b) => {
+          // Mapped (has a chain) first, then by component name.
+          if (!!a.chain !== !!b.chain) return a.chain ? -1 : 1;
+          return String(a.component).localeCompare(String(b.component));
+        });
+        if (comps.length === 0) {
+          compsEl.innerHTML = '<div style="color:var(--text-dim)">No components mapped.</div>';
+          return;
+        }
+        const yn = (v) => v === true ? 'yes' : (v === false ? 'no' : '—');
+        compsEl.innerHTML =
+          '<table style="width:100%;border-collapse:collapse;font-size:12px;min-width:760px">' +
+          '<thead><tr style="color:var(--text-dim)">' +
+            th('Job-kind') + th('Category') + th('Lane') + th('Enforced now') +
+            th('Critical gate') + th('Injection exposure') + th('Fallback order') +
+          '</tr></thead><tbody>' +
+          comps.map((c) => {
+            const route = (c.route && c.route.length)
+              ? c.route.map(posLine).join('')
+              : '<span style="color:var(--text-dim)">legacy category routing (no nature lane)</span>';
+            const lane = c.chain
+              ? escapeHtml(c.chain) + ' <span style="color:var(--text-dim)">(' + escapeHtml(String(c.nature)) + ')</span>'
+              : '<span style="color:var(--text-dim)">—</span>';
+            // Prefer the richer FD5b exposure classification; fall back to the untrusted-input flag.
+            let exposure;
+            if (c.injectionExposure) {
+              const ch = c.injectionExposure.channels || {};
+              const chans = ['user', 'model', 'tool'].filter((k) => ch[k]);
+              exposure = c.injectionExposure.exposed
+                ? 'exposed' + (chans.length ? ' <span style="color:var(--text-dim)">(' + chans.join('/') + ')</span>' : '')
+                : 'not exposed' + (c.injectionExposure.reason ? ' <span style="color:var(--text-dim)">(' + escapeHtml(c.injectionExposure.reason) + ')</span>' : '');
+            } else if (c.untrustedInput === true) {
+              exposure = 'exposed';
+            } else if (c.untrustedInput === false) {
+              exposure = 'not exposed' + (c.untrustedInputReason ? ' <span style="color:var(--text-dim)">(' + escapeHtml(c.untrustedInputReason) + ')</span>' : '');
+            } else {
+              exposure = '—';
+            }
+            return '<tr style="border-top:1px solid var(--border)">' +
+              td('<b>' + escapeHtml(c.component) + '</b>') +
+              td(escapeHtml(String(c.category || '—'))) +
+              td(lane) +
+              td(escapeHtml(String(c.enforcedFramework || '—'))) +
+              td(c.criticalGate ? '<b>yes</b>' : 'no') +
+              td(exposure) +
+              td(route) +
+            '</tr>';
+          }).join('') +
+          '</tbody></table>';
+      } catch (err) {
+        const m = err && err.message ? String(err.message) : String(err);
+        if (/503|unavailable|not initialized/i.test(m)) {
+          chainsEl.innerHTML = '<div style="color:var(--text-dim)">The routing map isn\'t available on this agent (no AI provider configured).</div>';
+        } else {
+          chainsEl.innerHTML = '<div style="color:var(--red)">Error: ' + escapeHtml(m) + '</div>';
+        }
+        compsEl.innerHTML = '';
+      }
+    }
+
     async function loadResources() {
       const headlineEl = document.getElementById('resourcesHeadlineBody');
       const sourcesEl = document.getElementById('resourcesSourcesBody');

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAgmDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAonBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAirmBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwDH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAyBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAgmDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAonBN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6rmBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -15108,7 +15108,16 @@ export async function startServer(options) {
             if (sharedIntelligence && stopGateDb) {
                 try {
                     const { UnjustifiedStopGate } = await import('../core/UnjustifiedStopGate.js');
-                    unjustifiedStopGate = new UnjustifiedStopGate({ intelligence: sharedIntelligence });
+                    const { resolveDevAgentGate } = await import('../core/devAgentGate.js');
+                    // Turn-End Self-Deferral Guard (Phase A / shadow) — dev-gated dark:
+                    // `monitoring.selfDeferralGuard` OMITS `enabled` so resolveDevAgentGate
+                    // decides (LIVE on a dev agent, DARK on the fleet). When on, the
+                    // authority OFFERS the U_SELF_DEFERRAL rule + its four shadow fields.
+                    const selfDeferralGuardEnabled = resolveDevAgentGate(config.monitoring?.selfDeferralGuard?.enabled, config);
+                    unjustifiedStopGate = new UnjustifiedStopGate({
+                        intelligence: sharedIntelligence,
+                        selfDeferralGuardEnabled,
+                    });
                 }
                 catch (err) {
                     DegradationReporter.getInstance().report({