instar 1.3.896 → 1.3.897

package/dashboard/index.html

@@ -3779,6 +3779,11 @@
            headline + tiles + drill-down here. Rebuilt from the old insider "guards" line.
            Nickname editing (issue #1429) lives one drill down, commits on Enter/blur. -->
       <div id="machinesGlance" class="glance-root"></div>
+      <section aria-labelledby="mutualSshTitle" style="border:1px solid var(--border);border-radius:10px;padding:16px">
+        <h3 id="mutualSshTitle" style="margin:0 0 8px">Machine-to-machine SSH</h3>
+        <p style="margin:0 0 10px;color:var(--text-dim)">Restricted Instar subsystem connectivity. This does not enable Remote Login or change personal SSH files.</p>
+        <div id="mutualSshStatus" class="glance-empty" aria-live="polite">Loading connectivity…</div>
+      </section>
       <section aria-labelledby="throughputFloorTitle" style="border:1px solid var(--border);border-radius:10px;padding:16px">
         <h3 id="throughputFloorTitle" style="margin:0 0 8px">Autonomous throughput observations</h3>
         <p style="margin:0 0 10px;color:var(--text-dim)">Pull-only evidence of project PR movement and manager communication. This view never notifies or changes a run.</p>
@@ -5541,6 +5546,7 @@
         return;
       }
       if (stamp) stamp.textContent = new Date().toLocaleTimeString();
+      await loadMutualSshStatus();
       await loadThroughputFloor();
 
       if (!pool.enabled) {
@@ -5564,6 +5570,30 @@
       glance.renderGlance(document, glanceRoot, spec);
     }
 
+    async function loadMutualSshStatus() {
+      const root = document.getElementById('mutualSshStatus');
+      if (!root) return;
+      root.textContent = '';
+      let status;
+      try { status = await apiFetch('/machines/ssh-health?scope=pool'); }
+      catch { root.textContent = 'Not enabled on this agent.'; return; }
+      if (status.dryRun) { root.textContent = 'Observation only — no peer SSH sessions are accepted.'; return; }
+      const pairs = Array.isArray(status.pairs) ? status.pairs : [];
+      if (pairs.length === 0) { root.textContent = status.listener ? 'Ready; no paired machines to verify.' : 'Waiting for the restricted listener.'; return; }
+      const healthy = pairs.filter(pair => pair && pair.mutual === true).length;
+      const summary = document.createElement('div');
+      summary.textContent = healthy === pairs.length
+        ? 'Mutual proof is current for all ' + String(pairs.length) + ' machine pair' + (pairs.length === 1 ? '.' : 's.')
+        : String(healthy) + ' of ' + String(pairs.length) + ' machine pairs have current proof in both directions.';
+      root.appendChild(summary);
+      for (const pair of pairs) {
+        const row = document.createElement('div');
+        row.style.marginTop = '8px';
+        row.textContent = (pair.mutual ? 'Verified: ' : 'Blocked: ') + (Array.isArray(pair.machines) ? pair.machines.join(' ↔ ') : 'machine pair');
+        root.appendChild(row);
+      }
+    }
+
     async function loadThroughputFloor() {
       const root = document.getElementById('throughputFloorStatus');
       if (!root) return;

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2EH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA0BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA8H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA8pDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAwtBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA41oBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2EH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA0BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA8H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA8pDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAwtBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA47oBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -4304,9 +4304,15 @@ export async function startServer(options) {
                 }
                 coherenceJournal.setReplicatedRecordCommitObserver((kind, entries) => {
                     replicatedPeerStreamReader?.observeCommittedEntries(kind, entries);
+                    if (kind === 'ssh-direction-proof')
+                        for (const entry of entries)
+                            mutualSshRuntime?.handleJournalProof(entry.data, entry.machine);
                 });
-                journalSyncApplier?.setReplicatedRecordCommitObserver((_senderMachineId, kind, entries) => {
+                journalSyncApplier?.setReplicatedRecordCommitObserver((senderMachineId, kind, entries) => {
                     replicatedPeerStreamReader?.observeCommittedEntries(kind, entries);
+                    if (kind === 'ssh-direction-proof')
+                        for (const entry of entries)
+                            mutualSshRuntime?.handleJournalProof(entry.data, senderMachineId);
                 });
                 // Author-side HLC clock — persisted under the journal dir (atomic temp+rename)
                 // so the merge total order survives restarts (§3.5). node = this machine's id.
@@ -18402,6 +18408,7 @@ export async function startServer(options) {
         // are live too. Single-machine uses the in-memory store; the cross-machine
         // git-backed store swaps in for the Track-H proof (the registry is store-agnostic).
         let meshRpcDispatcher;
+        let mutualSshRuntime = null;
         let sessionOwnershipRegistry;
         /**
          * Ownership Follows Live Work — Part B (claim-on-spawn). Assigned inside the
@@ -19810,6 +19817,18 @@ export async function startServer(options) {
                         }
                     },
                     handlers: {
+                        'ssh-bootstrap-advert': (cmd, sender) => {
+                            if (!mutualSshRuntime)
+                                return { ok: false, reason: 'mutual-ssh-disabled' };
+                            const c = cmd;
+                            return mutualSshRuntime.handleAdvert(c.advert, sender);
+                        },
+                        'ssh-proof-publish': (cmd, sender) => {
+                            if (!mutualSshRuntime)
+                                return { ok: false, reason: 'mutual-ssh-disabled' };
+                            const c = cmd;
+                            return mutualSshRuntime.handleProof(c.proof, sender);
+                        },
                         'capacity-report': () => machinePoolRegistry?.getCapacities() ?? [],
                         'session-status': () => {
                             const base = machinePoolRegistry?.getCapacity(meshSelfId) ?? { machineId: meshSelfId };
@@ -20355,6 +20374,92 @@ export async function startServer(options) {
                         nickname: m.entry.nickname,
                         lastKnownUrl: m.entry.lastKnownUrl ?? null,
                     }));
+                    // Mutual SSH phase 1: the signed HTTP mesh is the bootstrap carrier;
+                    // the resulting proof itself traverses the restricted SSH subsystem.
+                    // Hard-dark on fleet, dry-run first on the development agent.
+                    if (resolveDevAgentGate(config.multiMachine?.mutualSsh?.enabled, config)) {
+                        try {
+                            const sshMod = await import('../core/MutualSshRuntime.js');
+                            const portMod = await import('../core/PortRegistry.js');
+                            const cryptoMod = await import('node:crypto');
+                            const selfPem = meshIdMgr.getSigningPublicKeyPem(meshSelfId) ?? '';
+                            const machineFingerprint = (pem) => cryptoMod.createHash('sha256').update(pem).digest('hex');
+                            const privateHosts = (getSelfMeshEndpoints?.() ?? []).flatMap((endpoint) => {
+                                try {
+                                    const host = new URL(endpoint.url).hostname;
+                                    return host ? [host] : [];
+                                }
+                                catch {
+                                    // @silent-fallback-ok — malformed advertised URLs are omitted;
+                                    // readiness names the peer and reports the missing endpoint.
+                                    return [];
+                                }
+                            });
+                            const bindHost = privateHosts.find(host => host.startsWith('100.'))
+                                ?? privateHosts.find(host => /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(host))
+                                ?? '127.0.0.1';
+                            const bindPort = portMod.allocatePort(`${config.projectName}-mutual-ssh`, 42000, 49000);
+                            const peers = () => meshIdMgr.getActiveMachines()
+                                .filter(row => row.machineId !== meshSelfId)
+                                .map(row => ({
+                                machineId: row.machineId,
+                                // Millisecond precision is part of the revoke→re-pair replay fence;
+                                // second truncation could accidentally reuse an epoch during a fast re-pair.
+                                pairingEpoch: Math.max(1, Date.parse(row.entry.pairedAt)),
+                                machineFingerprint: machineFingerprint(meshIdMgr.getSigningPublicKeyPem(row.machineId) ?? ''),
+                                endpoints: (row.entry.endpoints ?? []).map(endpoint => endpoint.url),
+                            }));
+                            mutualSshRuntime = new sshMod.MutualSshRuntime({
+                                stateDir: config.stateDir, agentId: config.projectName, selfMachineId: meshSelfId,
+                                selfMachineFingerprint: machineFingerprint(selfPem),
+                                observerBootId: `${meshSelfId}:${process.pid}:${Date.now()}`,
+                                bindHost, bindPort, dryRun: config.multiMachine?.mutualSsh?.dryRun !== false,
+                                requiredForReadiness: config.multiMachine?.mutualSsh?.requiredForEmployeeRole === true,
+                                freshnessMs: config.multiMachine?.mutualSsh?.freshnessMs,
+                                cadenceMs: config.multiMachine?.mutualSsh?.cadenceMs,
+                                concurrency: config.multiMachine?.mutualSsh?.concurrency,
+                                listPeers: peers,
+                                send: async (machineId, command) => {
+                                    const url = peerUrl(machineId);
+                                    if (!url)
+                                        throw new Error('mutual-ssh-control-plane-unavailable');
+                                    const result = await meshClient.send({ machineId, url }, command, 0, { timeoutMs: 15_000 });
+                                    if (!result.ok)
+                                        throw new Error(result.reason ?? `mutual-ssh-mesh-${result.status}`);
+                                    return result.result;
+                                },
+                                sign: payload => idMod.sign(payload, localSigningKeyPem),
+                                verify: (machineId, payload, signature) => {
+                                    const pem = meshIdMgr.getSigningPublicKeyPem(machineId);
+                                    return pem ? idMod.verify(payload, signature, pem) : false;
+                                },
+                                emitJournalProof: proof => {
+                                    if (!proof.machineSignature)
+                                        return;
+                                    const { monotonicDeadlineMs: _, ...durable } = proof;
+                                    coherenceJournal?.emitSshDirectionProof(durable);
+                                },
+                                audit: event => {
+                                    const file = path.join(config.stateDir, 'logs', 'mutual-ssh.jsonl');
+                                    fs.mkdirSync(path.dirname(file), { recursive: true });
+                                    /* state-registry: audit-mutual-ssh */ fs.appendFileSync(file, `${JSON.stringify(event)}\n`);
+                                },
+                                notifySecurity: event => notify('IMMEDIATE', 'mutual-ssh-host-key-change', JSON.stringify(event)),
+                            });
+                            await mutualSshRuntime.start();
+                            globalThis.__instarMutualSshRuntime = mutualSshRuntime;
+                            guardRegistry.register('multiMachine.mutualSsh.enabled', () => ({
+                                enabled: true, dryRun: config.multiMachine?.mutualSsh?.dryRun !== false,
+                                status: mutualSshRuntime?.status() ?? null,
+                            }));
+                        }
+                        catch (err) {
+                            // @silent-fallback-ok — the feature fails closed and surfaces its
+                            // stable bootstrap reason while the rest of the server remains live.
+                            mutualSshRuntime = null;
+                            console.warn(`[mutual-ssh] initialization blocked: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                    }
                     // Pool Dashboard Streaming requesting side (§2.2): build the connector
                     // the WebSocketManager uses to open an upstream /pool-stream to a peer.
                     // connect() is synchronous (PeerStreamProxy contract) but the mint +
@@ -23530,6 +23635,11 @@ export async function startServer(options) {
                 stopHeartbeat?.();
             }
             catch { /* non-critical during shutdown */ }
+            try {
+                await globalThis.__instarMutualSshRuntime?.rollback();
+            }
+            catch { /* @silent-fallback-ok: shutdown continues; endpoint sockets also die with the process */ }
+            delete globalThis.__instarMutualSshRuntime;
             // pid-guarded: only remove OUR OWN registration. An unguarded
             // unregister-by-path here deletes the successor generation's fresh
             // entry during back-to-back update restarts (registry lost-update