instar 1.3.905 → 1.3.907

package/dist/core/sessionPoolFailoverCheck.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Subprocess failover check — the injectable `runFailoverCheck` for
+ * `SessionPoolFailoverRunner` that produces an HONEST green/red verdict by
+ * running the REAL two-node sessionPool failover E2E as a bounded subprocess.
+ *
+ * Why a subprocess (not an in-process re-implementation): the proven failover
+ * assertion already lives in `tests/e2e/sessionpool-failover-two-node.test.ts`
+ * (the merged #1551 E2E — real two servers, real ownership FSM, real force-claim
+ * takeover). Re-implementing it in-process risks a DIFFERENT, weaker check that
+ * could green a broken failover (the exact honesty-line risk the runner guards).
+ * Running the SAME vitest E2E as a bounded subprocess reuses that trusted
+ * assertion verbatim, so the recorded green means what CI's green means.
+ *
+ * ── Honesty mapping (load-bearing) ──
+ * The runner records green on a genuine pass, red on a genuine regression, and
+ * NOTHING on a throw. This check honours that three-way contract:
+ *   ran to completion, exit 0        → { outcome: 'green' }   (failover proven)
+ *   ran to completion, exit non-zero → { outcome: 'red' }     (real regression)
+ *   did NOT run to completion         → THROW                 (spawn error / timeout
+ *     (or a null exit code)              / harness couldn't run — NOT a failover
+ *                                        verdict; the runner records nothing so a
+ *                                        transient infra failure never masquerades
+ *                                        as a red demotion or a green promotion).
+ *
+ * ── Scope note ──
+ * This check requires the instar SOURCE + a vitest runner on the executing
+ * machine (a dev / test-as-self context). A deployed agent with no source cannot
+ * use it; that agent needs the separate in-process check (a tracked follow-up).
+ * The process spawn itself is INJECTED (`runProcess`) so this module is pure and
+ * unit-tests with zero real subprocess.
+ */
+import type { FailoverCheckResult } from './SessionPoolFailoverRunner.js';
+/** The default E2E the check runs — the merged #1551 real two-node failover. */
+export declare const DEFAULT_FAILOVER_E2E_PATH = "tests/e2e/sessionpool-failover-two-node.test.ts";
+export declare const DEFAULT_FAILOVER_TIMEOUT_MS = 180000;
+/** Result of the injected process runner. `ranToCompletion:false` = could not run. */
+export interface SubprocessRunResult {
+    /** true iff the runner actually executed the suite to a verdict (exit code known). */
+    ranToCompletion: boolean;
+    /** The process exit code, or null when it did not run to completion. */
+    exitCode: number | null;
+    /** A durable, human-traceable pointer to this run (a log path / run id). */
+    evidenceRef: string;
+}
+export interface SubprocessFailoverCheckDeps {
+    /**
+     * Spawn the failover E2E and resolve once it finishes (or times out). MUST
+     * resolve — a spawn failure or timeout resolves with `ranToCompletion:false`,
+     * NOT a rejection, so the mapping below owns the honesty decision.
+     */
+    runProcess: (args: {
+        testPath: string;
+        timeoutMs: number;
+    }) => Promise<SubprocessRunResult>;
+    /** Which E2E to run (defaults to the merged two-node failover E2E). */
+    testPath?: string;
+    /** Bounded wall-clock budget for the subprocess. */
+    timeoutMs?: number;
+}
+/**
+ * Build the injectable `runFailoverCheck` for `SessionPoolFailoverRunner`. It
+ * runs the real failover E2E as a bounded subprocess and maps the outcome per the
+ * honesty contract above (throws when the check could not run, so the runner
+ * records nothing).
+ */
+export declare function makeSubprocessFailoverCheck(deps: SubprocessFailoverCheckDeps): () => Promise<FailoverCheckResult>;
+//# sourceMappingURL=sessionPoolFailoverCheck.d.ts.map

package/dist/core/sessionPoolFailoverCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionPoolFailoverCheck.d.ts","sourceRoot":"","sources":["../../src/core/sessionPoolFailoverCheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAC3F,eAAO,MAAM,2BAA2B,SAAU,CAAC;AAEnD,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,eAAe,EAAE,OAAO,CAAC;IACzB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,UAAU,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,2BAA2B,GAChC,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAiBpC"}

package/dist/core/sessionPoolFailoverCheck.js

@@ -0,0 +1,57 @@
+/**
+ * Subprocess failover check — the injectable `runFailoverCheck` for
+ * `SessionPoolFailoverRunner` that produces an HONEST green/red verdict by
+ * running the REAL two-node sessionPool failover E2E as a bounded subprocess.
+ *
+ * Why a subprocess (not an in-process re-implementation): the proven failover
+ * assertion already lives in `tests/e2e/sessionpool-failover-two-node.test.ts`
+ * (the merged #1551 E2E — real two servers, real ownership FSM, real force-claim
+ * takeover). Re-implementing it in-process risks a DIFFERENT, weaker check that
+ * could green a broken failover (the exact honesty-line risk the runner guards).
+ * Running the SAME vitest E2E as a bounded subprocess reuses that trusted
+ * assertion verbatim, so the recorded green means what CI's green means.
+ *
+ * ── Honesty mapping (load-bearing) ──
+ * The runner records green on a genuine pass, red on a genuine regression, and
+ * NOTHING on a throw. This check honours that three-way contract:
+ *   ran to completion, exit 0        → { outcome: 'green' }   (failover proven)
+ *   ran to completion, exit non-zero → { outcome: 'red' }     (real regression)
+ *   did NOT run to completion         → THROW                 (spawn error / timeout
+ *     (or a null exit code)              / harness couldn't run — NOT a failover
+ *                                        verdict; the runner records nothing so a
+ *                                        transient infra failure never masquerades
+ *                                        as a red demotion or a green promotion).
+ *
+ * ── Scope note ──
+ * This check requires the instar SOURCE + a vitest runner on the executing
+ * machine (a dev / test-as-self context). A deployed agent with no source cannot
+ * use it; that agent needs the separate in-process check (a tracked follow-up).
+ * The process spawn itself is INJECTED (`runProcess`) so this module is pure and
+ * unit-tests with zero real subprocess.
+ */
+/** The default E2E the check runs — the merged #1551 real two-node failover. */
+export const DEFAULT_FAILOVER_E2E_PATH = 'tests/e2e/sessionpool-failover-two-node.test.ts';
+export const DEFAULT_FAILOVER_TIMEOUT_MS = 180_000;
+/**
+ * Build the injectable `runFailoverCheck` for `SessionPoolFailoverRunner`. It
+ * runs the real failover E2E as a bounded subprocess and maps the outcome per the
+ * honesty contract above (throws when the check could not run, so the runner
+ * records nothing).
+ */
+export function makeSubprocessFailoverCheck(deps) {
+    const testPath = deps.testPath ?? DEFAULT_FAILOVER_E2E_PATH;
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_FAILOVER_TIMEOUT_MS;
+    return async () => {
+        const r = await deps.runProcess({ testPath, timeoutMs });
+        if (!r.ranToCompletion || r.exitCode === null) {
+            // Could not run to a verdict → NOT a failover result. Throw so the runner
+            // records nothing (never a fabricated green promotion or red demotion).
+            throw new Error(`sessionPool failover check did not run to completion (evidence: ${r.evidenceRef})`);
+        }
+        return {
+            outcome: r.exitCode === 0 ? 'green' : 'red',
+            evidenceRef: r.evidenceRef,
+        };
+    };
+}
+//# sourceMappingURL=sessionPoolFailoverCheck.js.map

package/dist/core/sessionPoolFailoverCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionPoolFailoverCheck.js","sourceRoot":"","sources":["../../src/core/sessionPoolFailoverCheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,gFAAgF;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAO,CAAC;AAyBnD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAiC;IAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,2BAA2B,CAAC;IAChE,OAAO,KAAK,IAAkC,EAAE;QAC9C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9C,0EAA0E;YAC1E,wEAAwE;YACxE,MAAM,IAAI,KAAK,CACb,mEAAmE,CAAC,CAAC,WAAW,GAAG,CACpF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;YAC3C,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/types.d.ts

@@ -5921,6 +5921,39 @@ export interface MonitoringConfig {
      * Registered in DEV_GATED_FEATURES; GET /external-hog. Machine-local by design
      * (hardware-bound-resource — a host OS process is bound to one kernel).
      */
+    /**
+     * SingleMachineFailoverGapDetector (increment 2) — a pure SIGNAL-only guard that
+     * surfaces the "no failover target for active autonomous work" gap BEFORE it bites
+     * (the 2026-07-22 Codey overnight loss): single-machine (no online mesh peer) WHILE
+     * active autonomous runs → ONE deduped HIGH attention item. Never blocks, provisions,
+     * or kills. `enabled` is OMITTED so the runtime resolves it through the
+     * developmentAgent dark-feature gate (resolveDevAgentGate): LIVE on a dev agent, DARK
+     * on the fleet. `dryRun: true` is the graduated-rollout first rung — it computes +
+     * counts would-raise but raises NOTHING until a deliberate dryRun:false flip.
+     * Registered in DEV_GATED_FEATURES; GET /pool/failover-gap.
+     */
+    singleMachineFailoverGap?: {
+        enabled?: boolean;
+        dryRun?: boolean;
+    };
+    /**
+     * MissingLoginSessionDetector (increment 2) — a pure SIGNAL-only guard that
+     * surfaces the "a live session is running on an account whose local login has
+     * gone missing" gap BEFORE the session walls silently (the 2026-07-22 justin-gmail
+     * silent auth-death): a running session bound to an account the subscription pool
+     * flagged `identityDrift.repairState === 'owner-relogin-required'` /
+     * `actualAccountId === 'missing-local-login'` → ONE deduped HIGH attention item.
+     * Never swaps, re-logins, or touches a session. `enabled` is OMITTED so the
+     * runtime resolves it through the developmentAgent dark-feature gate
+     * (resolveDevAgentGate): LIVE on a dev agent, DARK on the fleet. `dryRun: true`
+     * is the graduated-rollout first rung — it computes + counts would-raise but
+     * raises NOTHING until a deliberate dryRun:false flip. Registered in
+     * DEV_GATED_FEATURES; GET /pool/missing-login.
+     */
+    missingLoginSession?: {
+        enabled?: boolean;
+        dryRun?: boolean;
+    };
     externalHogSentinel?: {
         enabled?: boolean;
         dryRun?: boolean;