instar 1.3.860 → 1.3.862

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0DH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA0BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAspDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAssBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqjoBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0DH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA0BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA8H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA2pDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAwtBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgloBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -105,6 +105,7 @@ import { SessionMonitor } from '../monitoring/SessionMonitor.js';
 import { SessionRecovery } from '../monitoring/SessionRecovery.js';
 import { MultiMachineCoordinator } from '../core/MultiMachineCoordinator.js';
 import { isRemotelyHandled } from '../core/SessionRouter.js';
+import { confirmLocalPlacementAfterDelivery } from '../core/SessionPoolLocalClaim.js';
 import { decideLeaseGatedSpawn, sharedG3SoakLedger, applyBindingCleanupOnKill } from '../core/leaseGatedSpawn.js';
 import { isSlackSessionKey, reconstructSlackMessage } from '../core/SlackForwardBridge.js';
 import { formatForwardedTopicContext } from '../core/ForwardedTopicContext.js';
@@ -474,6 +475,11 @@ let _topicResumeMap = null;
 // is byte-identical to today's always-local dispatch. Set once in startServer().
 let _sessionRouter = null;
 let _sessionPoolStage = () => 'dark';
+// Self-placement deliberately falls through from SessionRouter into this file's
+// established local inject/spawn tail. Confirming inside SessionRouter would be
+// premature because handleLocally is only that fall-through marker. This callback
+// advances placing → active only after the local tail has actually succeeded.
+let _confirmLocalSessionPoolClaim = null;
 // ── Durable Inbound Message Queue (docs/specs/durable-inbound-message-queue.md) ──
 // The custody engine (null = feature dark / gate failed / invariants violated —
 // every consumer treats null as "refused → today's fall-through").
@@ -2396,6 +2402,20 @@ getHubClassifierDeps) {
                 console.warn(`[session-pool] route error for topic ${topicId} — falling back to local dispatch: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
+        // Safe after any successful local delivery. The registry-side callback is
+        // idempotent and confirms only a placing row already owned by this machine,
+        // so ordinary active-session traffic is a strict no-op.
+        const confirmLocalSessionPoolClaim = () => {
+            try {
+                _confirmLocalSessionPoolClaim?.(String(topicId));
+            }
+            catch (err) {
+                // Delivery has already succeeded. A registry read/CAS/emit error must
+                // avoid reclassifying delivery as a spawn failure (or throwing out of
+                // the live-injection handler). The row is re-read by normal routing.
+                console.warn(`[session-pool] local claim confirmation errored for topic ${topicId}; ownership outcome will be re-read: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        };
         // ── SpawnAdmission — the binding-verdict seam (ownership-gated-spawn §3.1,
         // Layer A / the Ownership-Gated Side Effects standard). Consulted before
         // EVERY local session-creating action below. Increment-1 posture: dryRun
@@ -2465,7 +2485,9 @@ getHubClassifierDeps) {
                 // Use toInjection() — types guarantee sender identity is included in the tag
                 const injection = toInjection(pipeline, targetSession);
                 console.log(`[telegram→session] Injecting into ${targetSession}: "${text.slice(0, 80)}"`);
-                sessionManager.injectTelegramMessage(targetSession, topicId, text, pipeline.topicName, pipeline.sender.firstName, pipeline.sender.telegramUserId, parseInt(pipeline.id.replace('tg-', ''), 10) || undefined);
+                const injected = sessionManager.injectTelegramMessage(targetSession, topicId, text, pipeline.topicName, pipeline.sender.firstName, pipeline.sender.telegramUserId, parseInt(pipeline.id.replace('tg-', ''), 10) || undefined);
+                if (injected)
+                    confirmLocalSessionPoolClaim();
                 // Delivery confirmation — only when WE own polling. When lifeline owns
                 // polling (--no-telegram / standby), it already sends its own confirmation.
                 if (telegram.isPolling) {
@@ -2514,6 +2536,7 @@ getHubClassifierDeps) {
                         _topicResumeMap.remove(topicId);
                     }
                     respawnSessionForTopic(sessionManager, telegram, targetSession, topicId, text, topicMemory, resolvedUser ?? undefined)
+                        .then(() => confirmLocalSessionPoolClaim())
                         .catch(err => {
                         console.error(`[telegram→session] Context exhaustion respawn failed:`, err);
                         telegram.sendToTopic(topicId, `❌ Fresh session restart failed. Try sending your message again.`).catch(() => { });
@@ -2538,6 +2561,7 @@ getHubClassifierDeps) {
                     const _spawnTokB = spawningTopics.add(topicId);
                     telegram.sendToTopic(topicId, `🔄 Session restarting — message queued.`).catch(() => { });
                     respawnSessionForTopic(sessionManager, telegram, targetSession, topicId, text, topicMemory, resolvedUser ?? undefined)
+                        .then(() => confirmLocalSessionPoolClaim())
                         .catch(err => {
                         console.error(`[telegram→session] Respawn failed:`, err);
                         // G1 "Agent Is Always Reachable" corollary (2): no silent resource
@@ -2602,6 +2626,7 @@ getHubClassifierDeps) {
             // Use the shared spawn helper that includes topic history + user context
             spawnSessionForTopic(sessionManager, telegram, spawnName, topicId, text, topicMemory, resolvedUser ?? undefined).then((newSessionName) => {
                 telegram.registerTopicSession(topicId, newSessionName, spawnName);
+                confirmLocalSessionPoolClaim();
                 telegram.sendToTopic(topicId, `Session starting up — reading your message now. One moment.`).catch(() => { });
                 console.log(`[telegram→session] Auto-spawned "${newSessionName}" for topic ${topicId}`);
             }).catch((err) => {
@@ -4570,6 +4595,7 @@ export async function startServer(options) {
         // construction (far below) can wire the /api/lease[/pull] receivers to real registry fns.
         let peerEndpointRecorder;
         let getSelfMeshEndpoints;
+        let meshResolver;
         // mesh-coherence-live-state-honesty (Fix (b) / Decision #5): the resolved server bind host,
         // a BOOT CONSTANT. Declared `let` at OUTER scope (the same scope as getSelfMeshEndpoints)
         // and assigned inside the mesh-init block so the peerPresenceTimer closure (far below) can
@@ -4740,7 +4766,7 @@ export async function startServer(options) {
                 // single-`url` legacy path (byte-for-byte today).
                 const meshCfg = config.multiMachine?.meshTransport;
                 const meshEnabled = () => meshCfg?.enabled !== false; // default ON
-                const meshResolver = new PeerEndpointResolver({
+                meshResolver = new PeerEndpointResolver({
                     config: {
                         enabled: meshCfg?.enabled !== false,
                         hedgeDelayMs: meshCfg?.hedgeDelayMs ?? 1500,
@@ -20004,7 +20030,12 @@ export async function startServer(options) {
                         nonce: () => `${meshSelfId}:r:${Date.now()}:${++routerNonce}`,
                         now: () => Date.now(),
                     });
-                    const peerUrl = (machineId) => meshIdMgr.getActiveMachines().find((m) => m.machineId === machineId)?.entry.lastKnownUrl ?? null;
+                    const peerUrl = (machineId) => {
+                        const entry = meshIdMgr.getActiveMachines().find((m) => m.machineId === machineId)?.entry;
+                        if (!entry)
+                            return null;
+                        return meshResolver.resolve(machineId, entry.endpoints, entry.lastKnownUrl)[0]?.url ?? null;
+                    };
                     _meshSelfId = meshSelfId;
                     // U4.4 — the offer transport (HOLDER side) + the post-hand-back delivery
                     // canary (PREFERRED side), both over the signed mesh RPC.
@@ -20776,6 +20807,23 @@ export async function startServer(options) {
                             });
                         },
                     });
+                    _confirmLocalSessionPoolClaim = (sk) => {
+                        return confirmLocalPlacementAfterDelivery({
+                            selfMachineId: meshSelfId,
+                            readOwnership: (sessionKey) => ownReg.read(sessionKey),
+                            claimOwnership: (sessionKey, machineId) => {
+                                const prevOwner = ownReg.read(sessionKey)?.ownerMachineId;
+                                const r = ownReg.cas({ type: 'claim', machineId }, { sessionKey, sender: meshSelfId, nonce: `${meshSelfId}:lcl:${++routerNonce}` });
+                                return {
+                                    confirmed: r.ok,
+                                    afterConfirm: () => emitPlacement(sessionKey, r, 'placed', prevOwner),
+                                };
+                            },
+                            onError: (err) => {
+                                console.warn(`[session-pool] local ownership confirmation observer failed for ${sk}; authoritative state will be re-read: ${err instanceof Error ? err.message : String(err)}`);
+                            },
+                        }, sk);
+                    };
                     _sessionRouter = new routerMod.SessionRouter({
                         selfMachineId: meshSelfId,
                         placement: new placeMod.PlacementExecutor(undefined, {
@@ -20842,6 +20890,12 @@ export async function startServer(options) {
                             const r = ownReg.cas({ type: 'claim', machineId }, { sessionKey: sk, sender: meshSelfId, nonce: `${meshSelfId}:cl:${++routerNonce}` });
                             emitPlacement(sk, r, 'placed', prevOwner); // placing→active confirmation: a real epoch bump in the registry
                         },
+                        // The local delivery tail runs outside SessionRouter. Confirm its
+                        // self-placement only after that tail reports a successful inject or
+                        // spawn; a thrown/failed spawn therefore leaves the row in placing.
+                        // Guarding the current row makes repeated live injections idempotent.
+                        // The adjacent _confirmLocalSessionPoolClaim callback shares this
+                        // authoritative registry and nonce stream for the local tail.
                         deliverMessage: async (target, env) => {
                             const url = peerUrl(target);
                             if (!url)
@@ -22900,27 +22954,26 @@ export async function startServer(options) {
         // Failure on initial start is non-fatal: the manager keeps trying
         // in the background, and the post-exhausted retry timer keeps the
         // agent recoverable without requiring a server restart.
+        let bootTunnelUrl = null;
         if (tunnel) {
             try {
-                const tunnelUrl = await tunnel.start();
-                console.log(pc.green(`  Tunnel active: ${pc.bold(tunnelUrl)}`));
-                // Mesh URL advertisement: record THIS machine's reachable URL into its
-                // registry entry so cross-machine routing (deliver/transfer/lease) can
-                // reach it. Without this, lastKnownUrl is null and every peer is filtered
-                // out (the session pool is inert across machines). The existing
-                // RegistrySyncDebouncer propagates the populated entry to peers.
-                if (coordinator.enabled && coordinator.identity) {
-                    const cfUrl = resolveAdvertisedMeshUrl(config.tunnel, tunnelUrl);
-                    advertiseSelfMeshUrl(coordinator.managers.identityManager, coordinator.identity.machineId, cfUrl, (m) => console.log(pc.dim(m)));
-                    // multi-transport-mesh-comms (Layer 0) — advertise the full endpoint set.
-                    await advertiseSelfMeshEndpointsNow(coordinator.managers.identityManager, coordinator.identity.machineId, config, cfUrl);
-                }
+                bootTunnelUrl = await tunnel.start();
+                console.log(pc.green(`  Tunnel active: ${pc.bold(bootTunnelUrl)}`));
             }
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
                 console.error(pc.red(`  Tunnel start failed (manager will keep retrying in background): ${msg}`));
             }
         }
+        // Mesh endpoint advertisement is independent of optional tunnel success.
+        // A rate-limited quick tunnel must not suppress healthy LAN/Tailscale ropes:
+        // doing so makes reachable peers appear offline and removes the HTTP lease
+        // medium. Cloudflare is simply omitted when it has no resolved URL.
+        if (coordinator.enabled && coordinator.identity) {
+            const cfUrl = resolveAdvertisedMeshUrl(config.tunnel, bootTunnelUrl);
+            advertiseSelfMeshUrl(coordinator.managers.identityManager, coordinator.identity.machineId, cfUrl, (m) => console.log(pc.dim(m)));
+            await advertiseSelfMeshEndpointsNow(coordinator.managers.identityManager, coordinator.identity.machineId, config, cfUrl);
+        }
         // ── Dashboard Topic: always-available link ──────────────────────────
         // Retroactive: creates the topic on first run for existing agents.
         // Posts tunnel URL + PIN and pins the message for instant access.