@cotal-ai/cli 0.50.0 → 0.51.0

package/dist/lib/seat-restore.d.ts

@@ -0,0 +1,39 @@
+import { type SeatCheckpoint } from "@cotal-ai/workspace";
+/** One admitted seat this restore is about to place, with the destination paths it lands on. */
+export interface SeatRestoreRequest {
+    readonly name: string;
+    /** The directory the checkpoint was read from, re-verified here over the files as they are now. */
+    readonly directory: string;
+    readonly checkpoint: SeatCheckpoint;
+    /** The working tree the manager will launch this seat in, from the retained inventory. */
+    readonly cwd: string;
+    /** The session id the retained inventory says this seat reopens, when it has one. A pointer that
+     *  names a different session is not this seat's pointer. */
+    readonly inventorySessionId?: string;
+}
+export interface SeatRestoreOptions {
+    /** The destination workspace root, the anchor a `workspace-root` destination resolves against. */
+    readonly root: string;
+    readonly seats: readonly SeatRestoreRequest[];
+    /** Reports each promoted seat, so the command can print what it placed. */
+    readonly onPromoted?: (seat: {
+        name: string;
+        cwd: string;
+        superseded?: string;
+    }) => void;
+}
+/** Every refusal below. The message names the seat, the step, and what git or tar actually said. */
+export declare class SeatRestoreError extends Error {
+    constructor(message: string);
+}
+/**
+ * Restore every admitted seat, or leave every live `cwd` as it was.
+ *
+ * Two phases. Every seat is staged first, so a refusal on the last seat costs nothing on the first.
+ * Only once every staging directory is complete does any promotion happen, and a failure during the
+ * promotion phase puts back what this call moved: the renames it made are undone in reverse and the
+ * session files it exclusively created are removed, so the destination is where it started and the
+ * whole set can be retried once the refusal is understood.
+ */
+export declare function restoreSeatCheckpoints(options: SeatRestoreOptions): void;
+//# sourceMappingURL=seat-restore.d.ts.map

package/dist/lib/seat-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-restore.d.ts","sourceRoot":"","sources":["../../src/lib/seat-restore.ts"],"names":[],"mappings":"AAoCA,OAAO,EAEL,KAAK,cAAc,EAGpB,MAAM,qBAAqB,CAAC;AAE7B,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;gEAC4D;IAC5D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAC1F;AAED,oGAAoG;AACpG,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AA4JD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CA+BxE"}

package/dist/lib/seat-restore.js

@@ -0,0 +1,249 @@
+/**
+ * Restore: the destination consumes an admitted seat checkpoint before the seat is alive.
+ *
+ * This is section 6 step 7 of `docs/design/session-recovery.md`, which that record gives as a shell
+ * sequence and calls manual only because no command carried it. Every rule stated there is a rule
+ * here, and the reasons are the same ones measured there:
+ *
+ * - The sequence stages. A clone lands in `<cwd>.incoming`, every verification and both applies run
+ *   inside it, and the two renames that promote it are the only steps that touch the path the seat
+ *   will use. A failed restore leaves the live `cwd` as it was.
+ * - An existing `<cwd>.incoming` refuses. A staging directory from a failed run is the only record
+ *   of what failed, so nothing here removes one: an operator inspects it and removes it by hand.
+ *   The shell version's `set -e` exists because a bare test reported and continued, and the final
+ *   `mv` then promoted a leftover directory that was never restored. Here every step throws.
+ * - `git clone` rather than a fetch into an existing repository, because the refspec form that
+ *   would populate it fails against the branch HEAD is on, and clone avoids the question.
+ * - The recorded base is verified in the clone. A bundle that does not contain it does not apply to
+ *   the tree this checkpoint describes.
+ * - Two applies, `--index` first and the worktree diff second, both `--binary --allow-empty`. The
+ *   order is what puts staged content back in the index rather than only in the worktree, and
+ *   `--allow-empty` is why the cleanest possible seat is still restorable.
+ * - A pre-existing `cwd` is moved aside under a timestamped name rather than deleted, so a wrong
+ *   checkpoint costs a rename instead of a tree.
+ *
+ * Two things this adds over the manual sequence. The session files travel with the tree, to the
+ * paths the destination's own connector will read. And the promoted tree is re-read with
+ * `git status --porcelain` and compared to what the checkpoint recorded, so a restore that applied
+ * without error and still produced a different index is a refusal rather than a silent difference.
+ *
+ * git and tar run as child processes through `execFileSync`, never a shell string.
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { closeSync, constants, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { assertSeatCheckpointIntegrity, } from "@cotal-ai/workspace";
+/** Every refusal below. The message names the seat, the step, and what git or tar actually said. */
+export class SeatRestoreError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SeatRestoreError";
+    }
+}
+function run(command, args, cwd, seat, step) {
+    try {
+        // Both streams are captured. git writes progress and advice to stderr even when it succeeds,
+        // and the default here would forward that to the operator's terminal as if the resume had
+        // failed; on a failure the same bytes are what the refusal has to name.
+        return execFileSync(command, args, {
+            cwd,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            maxBuffer: 1024 * 1024 * 1024,
+        });
+    }
+    catch (error) {
+        const failure = error;
+        const output = `${failure.stderr ?? ""}${failure.stdout ?? ""}`.trim() || failure.message || "no output";
+        throw new SeatRestoreError(`seat ${seat}: ${step} failed (${command}): ${output}`);
+    }
+}
+/**
+ * Where one captured session file lands on THIS host.
+ *
+ * The anchors are the destination's own: its workspace root, the account home it runs under, and
+ * the seat's working tree. The record carries a relative path and the reader already refused an
+ * absolute one or a `..` segment, so the result cannot leave the anchor it names.
+ */
+function destinationPath(destination, root, cwd) {
+    const anchor = destination.anchor === "workspace-root" ? root : destination.anchor === "home" ? homedir() : cwd;
+    return join(anchor, destination.path);
+}
+/**
+ * Write one captured session file where the connector will read it.
+ *
+ * Durable, private and exclusive. A file already at that path is judged by CONTENT, which is the
+ * same rule the rest of the checkpoint is judged by: a destination whose file already hashes to the
+ * recorded digest holds the bytes this step exists to place, and that is the ordinary same-host
+ * resume, where nothing removed the transcript the seat was writing. Different bytes under the path
+ * the connector is about to read are a different session, and that is refused rather than
+ * clobbered: the harness transcript is the one thing here Cotal cannot reconstruct.
+ */
+function placeSessionFile(seat, file, root, created) {
+    const path = destinationPath(file.restore, root, seat.cwd);
+    const bytes = readFileSync(join(seat.directory, file.path));
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    let fd;
+    try {
+        fd = openSync(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+    }
+    catch (error) {
+        if (error.code === "EEXIST") {
+            const present = createHash("sha256").update(readFileSync(path)).digest("hex");
+            if (present === file.sha256)
+                return;
+            throw new SeatRestoreError(`seat ${seat.name}: ${path} already holds different bytes than the checkpoint recorded (${present} against ${file.sha256}); inspect it and move it aside before resuming`);
+        }
+        throw error;
+    }
+    created.push(path);
+    try {
+        writeSync(fd, bytes);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** The sha256-verified pointer's own session id, refused when it is not the one this seat reopens. */
+function assertPointerSession(seat, pointer) {
+    const recorded = seat.checkpoint.session.sessionId ?? seat.inventorySessionId;
+    if (!recorded)
+        return;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(join(seat.directory, pointer.path), "utf8"));
+    }
+    catch (error) {
+        throw new SeatRestoreError(`seat ${seat.name}: captured session pointer is not readable JSON (${error.message})`);
+    }
+    if (typeof parsed.sessionId !== "string" || parsed.sessionId !== recorded)
+        throw new SeatRestoreError(`seat ${seat.name}: captured session pointer names session ${JSON.stringify(parsed.sessionId)}, this resume reopens ${JSON.stringify(recorded)}`);
+    if (seat.inventorySessionId && seat.checkpoint.session.sessionId && seat.inventorySessionId !== seat.checkpoint.session.sessionId)
+        throw new SeatRestoreError(`seat ${seat.name}: checkpoint records session ${seat.checkpoint.session.sessionId}, the retained inventory says ${seat.inventorySessionId}`);
+}
+/** Stage one seat: everything up to and including the extraction, inside `<cwd>.incoming` alone. */
+function stageSeat(seat, staging) {
+    // THE ONE TREE A PROMOTION MAY NOT REPLACE.
+    //
+    // A checkpoint deliberately excludes the control directory (see `UNTRACKED_SELECTION`): it holds
+    // the broker trust material, the space account, the seat's own credentials and the maintenance
+    // journal this very resume is reading, and a checkpoint carries credential references rather than
+    // values. Promotion replaces the whole `cwd`, so when the seat's `cwd` IS a workspace root, which
+    // is the ordinary layout an operator gets by running `cotal up` and `cotal spawn` in one
+    // directory, promoting a clone that cannot contain `.cotal/` moves the live control directory
+    // aside and leaves the destination with none.
+    //
+    // Moving the control directory across the promotion is not the answer: its contents are live
+    // while this command runs. So this refuses, and names the remedy rather than degrading.
+    const control = join(resolve(seat.cwd), ".cotal");
+    if (existsSync(control))
+        throw new SeatRestoreError(`seat ${seat.name}: ${resolve(seat.cwd)} holds a control directory at ${control}, and a checkpoint never carries one, so promoting the restored tree over it would move this destination's live trust material and maintenance state aside; give the seat a working tree that is not a workspace root, then resume`);
+    // The digests again, over the files as they are NOW. Gate 1 ran before custody moved; a
+    // checkpoint that changed between the gate and the bytes being applied is not the admitted one.
+    try {
+        assertSeatCheckpointIntegrity(seat.directory, seat.checkpoint);
+    }
+    catch (error) {
+        throw new SeatRestoreError(`seat ${seat.name}: re-verifying the checkpoint before restore failed: ${error.message}`);
+    }
+    // Before the clone, because this decides nothing about the tree and therefore should cost
+    // nothing: a pointer that names another session leaves no staging directory to inspect for a
+    // step that never ran.
+    if (seat.checkpoint.session.pointer)
+        assertPointerSession(seat, seat.checkpoint.session.pointer);
+    // A leftover staging directory is evidence of a failed run, never a tree to promote, and nothing
+    // here removes it.
+    if (existsSync(staging))
+        throw new SeatRestoreError(`seat ${seat.name}: ${staging} already exists; a staging directory from a failed restore is evidence - inspect it and remove it by hand, then resume`);
+    const parent = dirname(staging);
+    mkdirSync(parent, { recursive: true });
+    const repository = seat.checkpoint.repository;
+    run("git", ["clone", "--quiet", join(seat.directory, repository.bundle.path), staging], parent, seat.name, "cloning the bundle");
+    run("git", ["rev-parse", "--verify", `${repository.base}^{commit}`], staging, seat.name, `verifying the recorded base ${repository.base}`);
+    run("git", ["checkout", "--quiet", "--detach", repository.base], staging, seat.name, "checking out the recorded base");
+    run("git", ["apply", "--binary", "--allow-empty", "--index", join(seat.directory, repository.indexDiff.path)], staging, seat.name, "applying the index diff");
+    run("git", ["apply", "--binary", "--allow-empty", join(seat.directory, repository.worktreeDiff.path)], staging, seat.name, "applying the worktree diff");
+    run("tar", ["-xf", join(seat.directory, repository.untracked.path)], staging, seat.name, "extracting the untracked archive");
+}
+/**
+ * Move an existing `cwd` aside under a timestamped name, and return the name it went to.
+ *
+ * The name has to be one this call can prove it owns. A whole-second timestamp is not that: two
+ * promotions of the same seat inside one second compute the same path, and the second `rename`
+ * lands on the non-empty directory the first one just created. A refusal naming a rename instead
+ * of the real cause is not acceptable for the one step that exists to keep a superseded tree.
+ *
+ * So the rename IS the claim. Nothing creates the timestamped name ahead of the move: an
+ * exclusive `mkdir` first and a rename onto that empty directory is the replace POSIX allows, but
+ * Windows refuses to rename onto any existing directory (EPERM), so a claim made that way can never
+ * be redeemed there. Renaming onto a name that already holds a tree fails on every platform
+ * (ENOTEMPTY or EEXIST on POSIX, EPERM on Windows), and that failure is read as "taken" and retried
+ * with a counter. A rename that fails for any other reason is the error it is.
+ */
+function supersede(cwd, seat) {
+    const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+    for (let attempt = 0; attempt < 100; attempt++) {
+        const candidate = `${cwd}.superseded.${stamp}${attempt ? `.${attempt}` : ""}`;
+        try {
+            renameSync(cwd, candidate);
+            return candidate;
+        }
+        catch (error) {
+            const code = error.code;
+            if ((code === "ENOTEMPTY" || code === "EEXIST" || code === "EPERM") && existsSync(candidate))
+                continue;
+            throw error;
+        }
+    }
+    throw new SeatRestoreError(`seat ${seat}: could not claim a free superseded name beside ${cwd}; ${cwd}.superseded.${stamp}[.0-99] are all taken, so an earlier tree would be overwritten`);
+}
+/**
+ * Restore every admitted seat, or leave every live `cwd` as it was.
+ *
+ * Two phases. Every seat is staged first, so a refusal on the last seat costs nothing on the first.
+ * Only once every staging directory is complete does any promotion happen, and a failure during the
+ * promotion phase puts back what this call moved: the renames it made are undone in reverse and the
+ * session files it exclusively created are removed, so the destination is where it started and the
+ * whole set can be retried once the refusal is understood.
+ */
+export function restoreSeatCheckpoints(options) {
+    const staged = options.seats.map((seat) => ({ seat, staging: `${resolve(seat.cwd)}.incoming` }));
+    for (const { seat, staging } of staged)
+        stageSeat(seat, staging);
+    const promoted = [];
+    const created = [];
+    try {
+        for (const { seat, staging } of staged) {
+            const cwd = resolve(seat.cwd);
+            const superseded = existsSync(cwd) ? supersede(cwd, seat.name) : undefined;
+            renameSync(staging, cwd);
+            promoted.push({ cwd, staging, ...(superseded ? { superseded } : {}) });
+            // Before the status is read, for the same reason the capture read it with the store in place:
+            // a store file inside the tree is part of the state the checkpoint recorded.
+            if (seat.checkpoint.session.pointer)
+                placeSessionFile(seat, seat.checkpoint.session.pointer, options.root, created);
+            for (const file of seat.checkpoint.session.store)
+                placeSessionFile(seat, file, options.root, created);
+            // The bytes landed and git accepted them; this is the only check that sees a restore which
+            // applied cleanly and still produced a different index.
+            const status = run("git", ["status", "--porcelain"], cwd, seat.name, "re-reading the restored working tree status");
+            if (status !== seat.checkpoint.repository.status)
+                throw new SeatRestoreError(`seat ${seat.name}: the restored tree reports a different status than the checkpoint recorded\n  recorded: ${JSON.stringify(seat.checkpoint.repository.status)}\n  restored: ${JSON.stringify(status)}`);
+            options.onPromoted?.({ name: seat.name, cwd, ...(superseded ? { superseded } : {}) });
+        }
+    }
+    catch (error) {
+        for (const path of created.reverse())
+            rmSync(path, { force: true });
+        for (const entry of promoted.reverse()) {
+            renameSync(entry.cwd, entry.staging);
+            if (entry.superseded)
+                renameSync(entry.superseded, entry.cwd);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=seat-restore.js.map

package/dist/lib/seat-restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-restore.js","sourceRoot":"","sources":["../../src/lib/seat-restore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxI,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,6BAA6B,GAI9B,MAAM,qBAAqB,CAAC;AAuB7B,oGAAoG;AACpG,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,SAAS,GAAG,CAAC,OAAsB,EAAE,IAAc,EAAE,GAAW,EAAE,IAAY,EAAE,IAAY;IAC1F,IAAI,CAAC;QACH,6FAA6F;QAC7F,0FAA0F;QAC1F,wEAAwE;QACxE,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAiF,CAAC;QAClG,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC;QACzG,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,KAAK,IAAI,YAAY,OAAO,MAAM,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,WAAsC,EAAE,IAAY,EAAE,GAAW;IACxF,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAChH,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,IAAwB,EAAE,IAAwB,EAAE,IAAY,EAAE,OAAiB;IAC3G,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,OAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9E,IAAI,OAAO,KAAK,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpC,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,IAAI,gEAAgE,OAAO,YAAY,IAAI,CAAC,MAAM,iDAAiD,CAAC,CAAC;QACxM,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrB,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAS,oBAAoB,CAAC,IAAwB,EAAE,OAA2B;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,kBAAkB,CAAC;IAC9E,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,oDAAqD,KAAe,CAAC,OAAO,GAAG,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ;QACvE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,4CAA4C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/K,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS;QAC/H,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,gCAAgC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,iCAAiC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAC7K,CAAC;AAED,oGAAoG;AACpG,SAAS,SAAS,CAAC,IAAwB,EAAE,OAAe;IAC1D,4CAA4C;IAC5C,EAAE;IACF,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,kGAAkG;IAClG,yFAAyF;IACzF,8FAA8F;IAC9F,8CAA8C;IAC9C,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,OAAO,CAAC;QACrB,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,OAAO,oOAAoO,CAAC,CAAC;IAClV,wFAAwF;IACxF,gGAAgG;IAChG,IAAI,CAAC;QACH,6BAA6B,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,wDAAyD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,0FAA0F;IAC1F,6FAA6F;IAC7F,uBAAuB;IACvB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO;QAAE,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,iGAAiG;IACjG,mBAAmB;IACnB,IAAI,UAAU,CAAC,OAAO,CAAC;QACrB,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,OAAO,wHAAwH,CAAC,CAAC;IACpL,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC9C,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACjI,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,IAAI,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,+BAA+B,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3I,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACvH,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC9J,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACzJ,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;AAC/H,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,GAAG,GAAG,eAAe,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9E,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS;YACvG,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,mDAAmD,GAAG,KAAK,GAAG,eAAe,KAAK,gEAAgE,CAAC,CAAC;AAC7L,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA2B;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjG,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,MAAM;QAAE,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAAiE,EAAE,CAAC;IAClF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,8FAA8F;YAC9F,6EAA6E;YAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO;gBAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK;gBAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACtG,2FAA2F;YAC3F,wDAAwD;YACxD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,6CAA6C,CAAC,CAAC;YACpH,IAAI,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM;gBAC9C,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,4FAA4F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtO,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE;YAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACvC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,UAAU;gBAAE,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/seat-resume.d.ts

@@ -0,0 +1,24 @@
+/** One stale checkpoint the operator deliberately admitted, for the resume journal. */
+export interface StaleCheckpointConsent {
+    readonly name: string;
+    readonly capturedAt: string;
+    readonly ageMs: number;
+    readonly horizonMs: number;
+}
+/**
+ * Run section 2.2's gates over every seat checkpoint the cut wrote, restore the captured bytes,
+ * then take custody of each seat.
+ *
+ * Gate 2 is told which lifecycle uids are live. On these paths that set is empty and the reason is
+ * structural rather than an omission: a preserved resume is only reached from a `ready` journal,
+ * which `down --preserve-state` publishes after it has proven every recorded process stopped and
+ * the exact recorded endpoint unreachable. There is no roster to consult because there is no
+ * broker. A destination that resumes against a live space supplies the roster instead.
+ *
+ * The restore runs inside the admission, after every gate and before any generation is claimed, so
+ * a refusal costs nothing: no tree has been promoted, no claim has been made, nothing has started.
+ */
+export declare function admitAndRestoreSeatCheckpoints(root: string, space: string, attemptId: string, values: {
+    "accept-stale-checkpoint"?: boolean;
+}, inventory: unknown): StaleCheckpointConsent[];
+//# sourceMappingURL=seat-resume.d.ts.map

package/dist/lib/seat-resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-resume.d.ts","sourceRoot":"","sources":["../../src/lib/seat-resume.ts"],"names":[],"mappings":"AAyBA,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAAE,EAC/C,SAAS,EAAE,OAAO,GACjB,sBAAsB,EAAE,CAuF1B"}

package/dist/lib/seat-resume.js

@@ -0,0 +1,127 @@
+/**
+ * Admission plus restore for one preserved cut, as both destination paths run it.
+ *
+ * `cotal up` from a `ready` journal and `cotal up --restore <dir>` reach a preserved resume by
+ * different routes and hand the same retained inventory to the same manager operation. They
+ * therefore owe the seats the same thing: section 2.2's gates, the restore of section 6 step 7, and
+ * the writer generation, in that order, before a manager launches. Keeping one implementation is
+ * what stops the two routes from drifting into one gated path and one ungated one.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { seatCheckpointDir } from "@cotal-ai/workspace";
+import { admitSeatCheckpoints } from "./seat-admission.js";
+import { restoreSeatCheckpoints } from "./seat-restore.js";
+import { c } from "../ui.js";
+/** This host's current revision for a seat's launch config, or undefined when the file is gone.
+ *  A missing profile is not a mismatch: the manager's own relaunch check reports that separately,
+ *  and inventing a digest here would turn an absent file into a false profile refusal. */
+function digestFileOrUndefined(path) {
+    try {
+        return createHash("sha256").update(readFileSync(path)).digest("hex");
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Run section 2.2's gates over every seat checkpoint the cut wrote, restore the captured bytes,
+ * then take custody of each seat.
+ *
+ * Gate 2 is told which lifecycle uids are live. On these paths that set is empty and the reason is
+ * structural rather than an omission: a preserved resume is only reached from a `ready` journal,
+ * which `down --preserve-state` publishes after it has proven every recorded process stopped and
+ * the exact recorded endpoint unreachable. There is no roster to consult because there is no
+ * broker. A destination that resumes against a live space supplies the roster instead.
+ *
+ * The restore runs inside the admission, after every gate and before any generation is claimed, so
+ * a refusal costs nothing: no tree has been promoted, no claim has been made, nothing has started.
+ */
+export function admitAndRestoreSeatCheckpoints(root, space, attemptId, values, inventory) {
+    // The checkpoints of the CUT this resume is consuming, named by that cut's attempt id. A resume
+    // must not admit an older cut's artifacts: they describe a tree and a transcript this inventory
+    // is not about to restore.
+    const checkpointDir = seatCheckpointDir(root, attemptId);
+    // The seats this resume is about to hand the manager. Admission is reconciled against this set,
+    // because "no checkpoint" and "no seat" look identical to a reader of the checkpoint directory
+    // alone, and only one of them is safe.
+    const retainedAgents = (inventory.agents ?? []);
+    const retained = new Map(retainedAgents.map((agent) => [agent.name ?? "", agent]));
+    const admitted = admitSeatCheckpoints({
+        root,
+        checkpointDir,
+        space,
+        // This host's current revision for each seat's launch source, digested from the same file the
+        // manager re-digests before it relaunches. Passing it is what makes gate 2's profile half a
+        // decision: without it the gate has nothing to compare and the override decides nothing.
+        currentProfileConfigSha256: (name) => {
+            const source = retained.get(name)?.launch?.source;
+            return source ? digestFileOrUndefined(source.configPath) : undefined;
+        },
+        liveLifecycleUids: new Set(),
+        // Reconcile inside the admission, after the gates and BEFORE any generation is claimed. A
+        // retained seat with no checkpoint would otherwise resume with no gate run and no custody
+        // claimed, and checking after the claims had landed would leave the earlier seats' exclusive
+        // creates behind, so the retry over a repaired checkpoint set could never make them again.
+        requireCovered: (admittedNames) => {
+            const covered = new Set(admittedNames);
+            const uncovered = retainedAgents.map((agent) => agent.name ?? "").filter((name) => !covered.has(name));
+            if (uncovered.length)
+                throw new Error(`preserved resume is refused: retained seat(s) ${uncovered.map((name) => JSON.stringify(name)).join(", ")} have no admitted checkpoint under ${checkpointDir}; a seat cannot resume without passing the admission gates and claiming its writer generation`);
+        },
+        ...(values["accept-stale-checkpoint"] ? { acceptStale: true } : {}),
+        // The restore, between the gates and custody. Every admitted seat's captured bytes land in a
+        // staging directory beside its cwd and are promoted only once every seat has staged; a refusal
+        // here leaves every live cwd as it was and claims no generation, like a gate failure.
+        beforeCustody: (staged) => {
+            // THE INCARNATION RECONCILIATION, AND IT RUNS BEFORE THE RESTORE TOUCHES ANYTHING.
+            //
+            // This compares the checkpoint's recovered `lifecycleUid` against the one the inventory this
+            // resume is about to hand the manager carries, and it used to run after the whole admission
+            // returned. By then the restore had already moved each live `cwd` aside and promoted another
+            // seat's tree over it, and the generation had been claimed under the checkpoint's uid, so the
+            // refusal arrived after the two irreversible steps it exists to prevent. A mismatch means the
+            // checkpoint describes a different incarnation than the seat being resumed, which is the last
+            // moment where refusing is still free.
+            for (const seat of staged) {
+                const expected = retained.get(seat.checkpoint.name)?.identity?.lifecycleUid ?? "";
+                if (expected && expected !== seat.checkpoint.lifecycleUid)
+                    throw new Error(`seat ${seat.checkpoint.name}: checkpoint records lifecycle ${seat.checkpoint.lifecycleUid}, the retained inventory says ${expected}`);
+            }
+            restoreSeatCheckpoints({
+                root,
+                seats: staged.map((seat) => {
+                    const entry = retained.get(seat.checkpoint.name);
+                    const cwd = entry?.launch?.cwd;
+                    if (!cwd)
+                        throw new Error(`preserved resume is refused: retained seat ${JSON.stringify(seat.checkpoint.name)} records no launch cwd, so its checkpoint has no working tree to restore into`);
+                    const sessionId = entry?.launch?.sessionId;
+                    return {
+                        name: seat.checkpoint.name,
+                        directory: seat.directory,
+                        checkpoint: seat.checkpoint,
+                        cwd,
+                        ...(sessionId ? { inventorySessionId: sessionId } : {}),
+                    };
+                }),
+                onPromoted: (seat) => {
+                    console.log(c.dim(`  restored working tree: ${seat.name} -> ${seat.cwd}${seat.superseded ? ` (previous tree kept at ${seat.superseded})` : ""}`));
+                },
+            });
+        },
+    });
+    for (const seat of admitted) {
+        console.log(c.dim(`  admitted checkpoint: ${seat.checkpoint.name} (${seat.checkpoint.session.continuity}) at generation ${seat.generation}`));
+        if (seat.staleOverrideAgeMs !== undefined)
+            console.log(c.yellow(`  stale checkpoint admitted by --accept-stale-checkpoint: ${seat.checkpoint.name} is ${seat.staleOverrideAgeMs}ms past capture, horizon ${seat.checkpoint.recencyHorizonMs}ms`));
+    }
+    return admitted
+        .filter((seat) => seat.staleOverrideAgeMs !== undefined)
+        .map((seat) => ({
+        name: seat.checkpoint.name,
+        capturedAt: seat.checkpoint.capturedAt,
+        ageMs: seat.staleOverrideAgeMs,
+        horizonMs: seat.checkpoint.recencyHorizonMs,
+    }));
+}
+//# sourceMappingURL=seat-resume.js.map

package/dist/lib/seat-resume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-resume.js","sourceRoot":"","sources":["../../src/lib/seat-resume.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAmB7B;;0FAE0F;AAC1F,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,CAAC;QAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC3G,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAAY,EACZ,KAAa,EACb,SAAiB,EACjB,MAA+C,EAC/C,SAAkB;IAElB,gGAAgG;IAChG,gGAAgG;IAChG,2BAA2B;IAC3B,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzD,gGAAgG;IAChG,+FAA+F;IAC/F,uCAAuC;IACvC,MAAM,cAAc,GAAG,CAAE,SAAyC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,IAAI;QACJ,aAAa;QACb,KAAK;QACL,8FAA8F;QAC9F,4FAA4F;QAC5F,yFAAyF;QACzF,0BAA0B,EAAE,CAAC,IAAI,EAAE,EAAE;YACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC;YAClD,OAAO,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,CAAC;QACD,iBAAiB,EAAE,IAAI,GAAG,EAAU;QACpC,0FAA0F;QAC1F,0FAA0F;QAC1F,6FAA6F;QAC7F,2FAA2F;QAC3F,cAAc,EAAE,CAAC,aAAa,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACvG,IAAI,SAAS,CAAC,MAAM;gBAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,aAAa,+FAA+F,CAAC,CAAC;QACjR,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,6FAA6F;QAC7F,+FAA+F;QAC/F,sFAAsF;QACtF,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE;YACxB,mFAAmF;YACnF,EAAE;YACF,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,8FAA8F;YAC9F,uCAAuC;YACvC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC;gBAClF,IAAI,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,YAAY;oBACvD,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,kCAAkC,IAAI,CAAC,UAAU,CAAC,YAAY,iCAAiC,QAAQ,EAAE,CAAC,CAAC;YAC3J,CAAC;YACD,sBAAsB,CAAC;gBACrB,IAAI;gBACJ,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBACjD,MAAM,GAAG,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC;oBAC/B,IAAI,CAAC,GAAG;wBACN,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;oBACrL,MAAM,SAAS,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;oBAC3C,OAAO;wBACL,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;wBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,GAAG;wBACH,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACxD,CAAC;gBACJ,CAAC,CAAC;gBACF,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;oBACnB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,2BAA2B,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACpJ,CAAC;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,mBAAmB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC9I,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS;YACvC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,6DAA6D,IAAI,CAAC,UAAU,CAAC,IAAI,OAAO,IAAI,CAAC,kBAAkB,4BAA4B,IAAI,CAAC,UAAU,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC;IAC3M,CAAC;IACD,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC;SACvD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;QAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;QACtC,KAAK,EAAE,IAAI,CAAC,kBAA4B;QACxC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB;KAC5C,CAAC,CAAC,CAAC;AACR,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/cli",
   "description": "Cotal mesh CLI: up, join, watch, console, spawn, mint, channels, history, ext.",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "homepage": "https://cotal.ai",
   "license": "Apache-2.0",
   "repository": {
@@ -29,8 +29,8 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "ws": "^8.21.0",
-    "@cotal-ai/core": "0.50.0",
-    "@cotal-ai/workspace": "0.50.0"
+    "@cotal-ai/core": "0.51.0",
+    "@cotal-ai/workspace": "0.51.0"
   },
   "optionalDependencies": {
     "@eplightning/nats-server-darwin-arm64": "^2.14.0",
@@ -44,7 +44,7 @@
     "@types/react": "^19.0.0",
     "@types/ws": "^8.18.1",
     "@cotal-ai/smoke-kit": "0.0.0",
-    "@cotal-ai/auth": "0.50.0"
+    "@cotal-ai/auth": "0.51.0"
   },
   "files": [
     "dist",