@botiverse/raft-daemon 0.72.0 → 0.72.2

package/dist/{chunk-YAI5OK4D.js → chunk-7RB6FSFI.js}

@@ -13986,6 +13986,8 @@ For new channels, new agents, and adding members to an existing channel, post an
   - \`{type: "channel:add_member", channel: "#existing-channel", humans?: ["@alice"], agents?: ["@scout"], draftHint?}\` \u2014 at least one of humans / agents must be non-empty
 - The owner clicks the button on the card; the matching dialog opens **prefilled with your values** (editable, deselectable for add_member). They review, adjust, and submit; the action is committed under their identity.
 - Runtime / model / reasoning effort are NOT yours to prefill on \`agent:create\`. If the human request explicitly binds the agent to a computer, use a structured \`requiredComputer\` (or \`suggestedComputer\` for a soft preference) instead of burying the constraint in \`draftHint\`; otherwise stay on semantic intent (name + description).
+- The \`name\` on \`agent:create\` must be a single token: starts with a letter, then only letters/digits/hyphen/underscore, 1-32 chars \u2014 **no spaces**, and not a reserved name (all, human, humans, agent, agents, here, idle, busy, system). "Support Bot" is invalid; prefill \`support-bot\` or \`SupportBot\`. A malformed name is rejected at submit, so put a valid handle in the card rather than a display phrase.
+- Seed the people who will actually work in a new channel directly into \`initialAgents\` / \`initialHumans\` on \`channel:create\` \u2014 don't create it bare and then post a separate \`channel:add_member\` card for members you already know. Being a server admin (as you are) does NOT auto-join you or anyone else to a channel: channel membership is what gates message delivery, so an agent must be listed in \`initialAgents\` (or added later) to actually operate there. Reserve \`channel:add_member\` for people you discover are needed *after* the channel exists.
 - For \`channel:add_member\`, only suggest people who are actually likely candidates (already in the server, relevant to the channel's topic). The owner will deselect anyone they don't want \u2014 make their default-yes list useful, not exhaustive.
 - Do not just describe or list copyable specs once action cards are available \u2014 the human input cost should land at "click the card, review, submit", not "copy this name into the dialog yourself".
 - Do not imply the resource has been created or members added until the card flips to "Done".
@@ -13993,7 +13995,7 @@ For new channels, new agents, and adding members to an existing channel, post an
 Other plan elements still apply:
 - suggested channel or workstream pairing
 - first task to send after the card is committed
-- who to pull in once the channel exists (often a follow-up \`channel:add_member\` card)
+- who works in the channel \u2014 seed them into \`initialAgents\` / \`initialHumans\` at create when you already know them; a follow-up \`channel:add_member\` card is only for people you discover are needed later
 
 Do not use a rigid keyword routing table. Use examples as inspiration, then adapt to the user's context.
 If details are missing but not blocking, state reasonable defaults inside the action card payload (the owner can edit) and invite correction in chat.
@@ -14346,15 +14348,27 @@ Offer a guided walk: one card-as-conversation per turn, always with an exit back
 
 ## Setup-Scan Toolbox
 
-Only use this after explicit consent. Skill names and versions are safe to read directly \u2014 that output carries no secrets. The one exception is the MCP config (\`~/.claude/settings.json\` / \`~/.claude.json\`): it can inline API keys in its \`env\` block, so read only the server names with \`jq\` (below) \u2014 never \`cat\` that file.
+Only use this after explicit consent. The goal: understand what agent tooling the owner already has on this computer \u2014 across Claude Code AND Codex (and any other runtime) \u2014 so your team proposal fits their real setup, not a guess.
 
-- MCP names: \`jq -r '.mcpServers|keys[]' ~/.claude/settings.json\`
-- Skill names: \`ls ~/.claude/skills/\`
-- Runtime versions: \`claude --version\` and \`codex --version\`
+Instruction/config files are safe to read directly \u2014 they hold guidance, not secrets. The ONE exception is MCP config: it can inline API keys in an \`env\` block, so read only the server NAMES (never \`cat\` the whole file).
 
-After scanning, post one echo line:
+Discover first, then read only what exists \u2014 don't assume a path is there:
+- Runtimes present: \`claude --version\`, \`codex --version\` (and any other runtime binary the owner mentions).
+- Config dirs: \`ls -a ~/.claude/ ~/.codex/ 2>/dev/null\` \u2014 then read what's actually there.
 
-\`read: CC v_, MCP names [...], skill names [...] - nothing else.\`
+Read directly (guidance, no secrets) \u2014 this is where routines, loops, and conventions live:
+- Agent instructions: \`~/.claude/CLAUDE.md\`, \`~/.codex/AGENTS.md\`, plus any project-level \`CLAUDE.md\` / \`AGENTS.md\` / \`agent.md\` in the owner's working dirs.
+- Skills: \`ls ~/.claude/skills/ 2>/dev/null\` (names only).
+- Hooks / scheduled loops / routines: the \`hooks\` block in \`~/.claude/settings.json\` and any equivalent in \`~/.codex/config.toml\` \u2014 read the structure (what runs when), not any secret values.
+- Reminders/routines the owner drives through Raft: \`raft reminder list\`.
+
+Names only \u2014 never \`cat\` (these can inline API keys):
+- Claude MCP: \`jq -r '.mcpServers|keys[]' ~/.claude/settings.json ~/.claude.json 2>/dev/null\`
+- Codex MCP: the \`[mcp_servers.*]\` table headers in \`~/.codex/config.toml\` \u2014 e.g. \`grep '^\\[mcp_servers' ~/.codex/config.toml\` (header names only).
+
+After scanning, post one echo line naming ONLY what you read:
+
+\`read: CC v_, Codex v_, MCP names [...], skills [...], instruction files [...] - nothing else.\`
 
 Then post the conclusion only: inferred workflow shape + team proposal + how the agents would run. Share the raw list only if the owner asks.
 
@@ -22658,7 +22672,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-UCGBT6NS.js");
+  await import("./dist-V7E6IFYX.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];

package/dist/cli/index.js

@@ -44502,6 +44502,9 @@ var AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS = 1e3;
 var AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS = AUTH_REFRESH_ROTATION_DISCOVERY_LAG_BUDGET_MS + AUTH_REFRESH_ROTATED_TOKEN_WAIT_MS + AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS;
 var AUTH_REFRESH_ROTATION_REPLAY_GRACE_MARGIN_MS = AUTH_REFRESH_ROTATED_REPLAY_GRACE_MS - AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS;
 
+// ../shared/src/clock.ts
+init_esm_shims();
+
 // ../shared/src/daemonApiRawClient.ts
 init_esm_shims();
 function failure2(routeKey, reason, message, details = {}) {
@@ -45045,6 +45048,21 @@ var RAFT_OAUTH_SCOPES_SUPPORTED = Object.keys(RAFT_OAUTH_SCOPE_CATALOG);
 var RAFT_OAUTH_DEFAULT_ALLOWED_SCOPES = RAFT_OAUTH_SCOPES_SUPPORTED.filter((scope) => RAFT_OAUTH_SCOPE_CATALOG[scope].defaultAllowed);
 var RAFT_OAUTH_PUBLIC_DISCOVERY_SCOPES = RAFT_OAUTH_SCOPES_SUPPORTED.filter((scope) => RAFT_OAUTH_SCOPE_CATALOG[scope].publicDiscovery);
 
+// ../shared/src/sync-core/index.ts
+init_esm_shims();
+
+// ../shared/src/sync-core/core.ts
+init_esm_shims();
+
+// ../shared/src/sync-core/violations.ts
+init_esm_shims();
+
+// ../shared/src/sync-core/types.ts
+init_esm_shims();
+
+// ../shared/src/sync-core/testing.ts
+init_esm_shims();
+
 // ../shared/src/testing/failpoints.ts
 init_esm_shims();
 var NoopFailpointRegistry = class {
@@ -52010,6 +52028,12 @@ ${created}
 To follow up in each task's thread:
 ${threadHints}`;
 }
+function canonicalTaskTarget(target) {
+  return target.replace(/^dm:user:/i, "dm:@");
+}
+function taskThreadTarget(target, messageId) {
+  return `${canonicalTaskTarget(target)}:${messageId.slice(0, 8)}`;
+}
 function formatClaimResults(channel, data) {
   const lines = data.results.map((r) => {
     const label = r.taskNumber ? `#${r.taskNumber}` : `msg:${r.messageId}`;
@@ -52026,7 +52050,7 @@ function formatClaimResults(channel, data) {
   const failed = data.results.length - succeeded;
   let summary = `${succeeded} claimed`;
   if (failed > 0) summary += `, ${failed} failed`;
-  const claimedMsgs = data.results.filter((r) => r.success && r.messageId).map((r) => `#${r.taskNumber} \u2192 raft message send --target "${channel}:${r.messageId.slice(0, 8)}"`).join("\n");
+  const claimedMsgs = data.results.filter((r) => r.success && r.messageId).map((r) => `#${r.taskNumber} \u2192 raft message send --target "${taskThreadTarget(channel, r.messageId)}"`).join("\n");
   const threadHint = claimedMsgs ? `
 
 Follow up in each task's thread:

package/dist/core.js

@@ -16,7 +16,7 @@ import {
   runBundledSlockCli,
   scanWorkspaceDirectories,
   subscribeDaemonLogs
-} from "./chunk-YAI5OK4D.js";
+} from "./chunk-7RB6FSFI.js";
 export {
   AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION,
   AgentMigrationGrantRegistry,

package/dist/{dist-UCGBT6NS.js → dist-V7E6IFYX.js}

@@ -44046,6 +44046,7 @@ var AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS = 1e3;
 var AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS = AUTH_REFRESH_ROTATION_DISCOVERY_LAG_BUDGET_MS + AUTH_REFRESH_ROTATED_TOKEN_WAIT_MS + AUTH_REFRESH_ROTATION_RETRY_RTT_BUDGET_MS;
 var AUTH_REFRESH_ROTATION_REPLAY_GRACE_MARGIN_MS = AUTH_REFRESH_ROTATED_REPLAY_GRACE_MS - AUTH_REFRESH_ROTATION_LOSER_WORST_CHAIN_MS;
 init_esm_shims();
+init_esm_shims();
 function failure2(routeKey, reason, message, details = {}) {
   return {
     ok: false,
@@ -44571,6 +44572,11 @@ var RAFT_OAUTH_SCOPES_SUPPORTED = Object.keys(RAFT_OAUTH_SCOPE_CATALOG);
 var RAFT_OAUTH_DEFAULT_ALLOWED_SCOPES = RAFT_OAUTH_SCOPES_SUPPORTED.filter((scope) => RAFT_OAUTH_SCOPE_CATALOG[scope].defaultAllowed);
 var RAFT_OAUTH_PUBLIC_DISCOVERY_SCOPES = RAFT_OAUTH_SCOPES_SUPPORTED.filter((scope) => RAFT_OAUTH_SCOPE_CATALOG[scope].publicDiscovery);
 init_esm_shims();
+init_esm_shims();
+init_esm_shims();
+init_esm_shims();
+init_esm_shims();
+init_esm_shims();
 var NoopFailpointRegistry = class {
   get enabled() {
     return false;
@@ -51365,6 +51371,12 @@ ${created}
 To follow up in each task's thread:
 ${threadHints}`;
 }
+function canonicalTaskTarget(target) {
+  return target.replace(/^dm:user:/i, "dm:@");
+}
+function taskThreadTarget(target, messageId) {
+  return `${canonicalTaskTarget(target)}:${messageId.slice(0, 8)}`;
+}
 function formatClaimResults(channel, data) {
   const lines = data.results.map((r) => {
     const label = r.taskNumber ? `#${r.taskNumber}` : `msg:${r.messageId}`;
@@ -51381,7 +51393,7 @@ function formatClaimResults(channel, data) {
   const failed = data.results.length - succeeded;
   let summary = `${succeeded} claimed`;
   if (failed > 0) summary += `, ${failed} failed`;
-  const claimedMsgs = data.results.filter((r) => r.success && r.messageId).map((r) => `#${r.taskNumber} \u2192 raft message send --target "${channel}:${r.messageId.slice(0, 8)}"`).join("\n");
+  const claimedMsgs = data.results.filter((r) => r.success && r.messageId).map((r) => `#${r.taskNumber} \u2192 raft message send --target "${taskThreadTarget(channel, r.messageId)}"`).join("\n");
   const threadHint = claimedMsgs ? `
 
 Follow up in each task's thread:

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   DAEMON_CLI_USAGE,
   DaemonCore,
   parseDaemonCliArgs
-} from "./chunk-YAI5OK4D.js";
+} from "./chunk-7RB6FSFI.js";
 
 // src/index.ts
 var parsedArgs = parseDaemonCliArgs(process.argv.slice(2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botiverse/raft-daemon",
-  "version": "0.72.0",
+  "version": "0.72.2",
   "type": "module",
   "bin": {
     "raft-daemon": "dist/raft-daemon.js",