@cotal-ai/connector-claude-code 0.8.3 → 0.9.1

package/dist/extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAIA,OAAO,EAA2D,KAAK,SAAS,EAAoC,MAAM,gBAAgB,CAAC;AAoB3I;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,SA0G7B,CAAC"}
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAIA,OAAO,EAA2D,KAAK,SAAS,EAAoC,MAAM,gBAAgB,CAAC;AAoB3I;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,SAmH7B,CAAC"}

package/dist/extension.js

@@ -31,6 +31,7 @@ export const claudeConnector = {
     transcriptChannel, // the shared `tr-<name>` convention (connector-core), exposed via the contract
     pluginRoot: PLUGIN_ROOT,
     requires: ["claude"],
+    supportsResume: true, // renders `--resume <id> --fork-session` (fork-from, never hijack) — see buildLaunch
     buildLaunch(opts) {
         // Operator MCP servers shared with this agent (default none — see the --mcp-config block).
         const shared = opts.mcpServers ?? {};
@@ -124,6 +125,13 @@ export const claudeConnector = {
         // The `--model` flag wins over the agent file, and applies even with no agent file.
         if (model)
             args.push("--model", model);
+        // Fork an existing session INTO the mesh (opts.resume, an opaque host-local id). `--fork-session`
+        // is pushed in the SAME branch — resume here is fork-only, never a hijack: claude mints a NEW
+        // session id from that transcript and leaves the original untouched. The id is a single argv
+        // token (no shell), so a hostile-looking id can't inject. The persona `--append-system-prompt`
+        // above still applies, so the forked context runs under the current mesh persona.
+        if (opts.resume)
+            args.push("--resume", opts.resume, "--fork-session");
         return {
             command: "claude",
             args,

package/dist/extension.js.map

@@ -1 +1 @@
-{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAoD,MAAM,gBAAgB,CAAC;AAC3I,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEnH,wFAAwF;AACxF,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC;;;;;+EAK+E;AAC/E,MAAM,WAAW,GAAG,UAAU,eAAe,EAAE,CAAC;AAEhD;qEACqE;AACrE,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE;0DAC0D;AAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAc;IACxC,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,QAAQ;IACd,iBAAiB,EAAE,+EAA+E;IAClG,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpB,WAAW,CAAC,IAAgB;QAC1B,2FAA2F;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QACrC,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,yEAAyE;QACzE,gGAAgG;QAChG,iGAAiG;QACjG,8FAA8F;QAC9F,iFAAiF;QACjF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAA2B;YAClC,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,GAAG,MAAM,CAAC,IAAI,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,KAAK;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,gFAAgF;YAChF,mFAAmF;YACnF,aAAa,EAAE,GAAG;YAClB,oBAAoB,EAAE,OAAO,CAAC,IAAI;YAClC,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,uDAAuD;SAC5F,CAAC;QACF,oFAAoF;QACpF,uFAAuF;QACvF,+FAA+F;QAC/F,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO;YAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;QAEnD,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,yCAAyC,EAAE,WAAW,CAAC;YACvE,CAAC,CAAC,CAAC,yCAAyC,EAAE,WAAW,CAAC,CAAC;QAE7D,kFAAkF;QAClF,qFAAqF;QACrF,mFAAmF;QACnF,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,wEAAwE,CAAC,CAAC;QAEtG,0FAA0F;QAC1F,2FAA2F;QAC3F,6FAA6F;QAC7F,8FAA8F;QAC9F,yFAAyF;QACzF,+FAA+F;QAC/F,2FAA2F;QAC3F,gGAAgG;QAChG,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAC1F,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,6FAA6F;QAC7F,+FAA+F;QAC/F,8FAA8F;QAC9F,+FAA+F;QAC/F,2FAA2F;QAC3F,+FAA+F;QAC/F,IAAI,SAAiB,CAAC;QACtB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,2FAA2F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,2FAA2F;YAC3F,qFAAqF;YACrF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;YACtD,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,4EAA4E;YACvG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAClC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QAE5D,6EAA6E;QAC7E,8EAA8E;QAC9E,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClE,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,oFAAoF;QACpF,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEvC,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,IAAI;YACJ,GAAG;YACH,wEAAwE;YACxE,yEAAyE;YACzE,OAAO,EAAE,kBAAkB;YAC3B,OAAO;SACR,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC"}
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAoD,MAAM,gBAAgB,CAAC;AAC3I,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEnH,wFAAwF;AACxF,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC;;;;;+EAK+E;AAC/E,MAAM,WAAW,GAAG,UAAU,eAAe,EAAE,CAAC;AAEhD;qEACqE;AACrE,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE;0DAC0D;AAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAc;IACxC,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,QAAQ;IACd,iBAAiB,EAAE,+EAA+E;IAClG,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpB,cAAc,EAAE,IAAI,EAAE,qFAAqF;IAE3G,WAAW,CAAC,IAAgB;QAC1B,2FAA2F;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QACrC,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,yEAAyE;QACzE,gGAAgG;QAChG,iGAAiG;QACjG,8FAA8F;QAC9F,iFAAiF;QACjF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAA2B;YAClC,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,GAAG,MAAM,CAAC,IAAI,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,KAAK;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,gFAAgF;YAChF,mFAAmF;YACnF,aAAa,EAAE,GAAG;YAClB,oBAAoB,EAAE,OAAO,CAAC,IAAI;YAClC,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,uDAAuD;SAC5F,CAAC;QACF,oFAAoF;QACpF,uFAAuF;QACvF,+FAA+F;QAC/F,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO;YAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;QAEnD,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,yCAAyC,EAAE,WAAW,CAAC;YACvE,CAAC,CAAC,CAAC,yCAAyC,EAAE,WAAW,CAAC,CAAC;QAE7D,kFAAkF;QAClF,qFAAqF;QACrF,mFAAmF;QACnF,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,wEAAwE,CAAC,CAAC;QAEtG,0FAA0F;QAC1F,2FAA2F;QAC3F,6FAA6F;QAC7F,8FAA8F;QAC9F,yFAAyF;QACzF,+FAA+F;QAC/F,2FAA2F;QAC3F,gGAAgG;QAChG,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAC1F,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,6FAA6F;QAC7F,+FAA+F;QAC/F,8FAA8F;QAC9F,+FAA+F;QAC/F,2FAA2F;QAC3F,+FAA+F;QAC/F,IAAI,SAAiB,CAAC;QACtB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,2FAA2F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,2FAA2F;YAC3F,qFAAqF;YACrF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;YACtD,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,4EAA4E;YACvG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAClC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QAE5D,6EAA6E;QAC7E,8EAA8E;QAC9E,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClE,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,oFAAoF;QACpF,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEvC,kGAAkG;QAClG,8FAA8F;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,kFAAkF;QAClF,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAEtE,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,IAAI;YACJ,GAAG;YACH,wEAAwE;YACxE,yEAAyE;YACzE,OAAO,EAAE,kBAAkB;YAC3B,OAAO;SACR,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC"}

package/dist/hook.cjs

@@ -16332,18 +16332,20 @@ var SYS_LIMITS = { ...BASE_LIMITS, mem_storage: 0, disk_storage: 0 };
 // ../../packages/core/dist/streams.js
 var import_jetstream = __toESM(require_mod4(), 1);
 var import_transport_node = __toESM(require_transport_node(), 1);
+var import_kv2 = __toESM(require_mod6(), 1);
+
+// ../../packages/core/dist/acls.js
 var import_kv = __toESM(require_mod6(), 1);
+
+// ../../packages/core/dist/streams.js
 var PLANE3_DEDUP_WINDOW_MS = 2 * 60 * 60 * 1e3;
 var MEMBERSHIP_MAX_BYTES = 64 * 1024 * 1024;
 
 // ../../packages/core/dist/channels.js
-var import_kv2 = __toESM(require_mod6(), 1);
+var import_kv3 = __toESM(require_mod6(), 1);
 var import_transport_node2 = __toESM(require_transport_node(), 1);
 
 // ../../packages/core/dist/members.js
-var import_kv3 = __toESM(require_mod6(), 1);
-
-// ../../packages/core/dist/acls.js
 var import_kv4 = __toESM(require_mod6(), 1);
 
 // ../../packages/core/dist/membership-feed.js

package/dist/mcp.cjs

@@ -47533,7 +47533,56 @@ var SYS_LIMITS = { ...BASE_LIMITS, mem_storage: 0, disk_storage: 0 };
 // ../../packages/core/dist/streams.js
 var import_jetstream = __toESM(require_mod4(), 1);
 var import_transport_node = __toESM(require_transport_node(), 1);
+var import_kv2 = __toESM(require_mod6(), 1);
+
+// ../../packages/core/dist/acls.js
 var import_kv = __toESM(require_mod6(), 1);
+async function openAclRegistry(nc, space, opts = {}) {
+  const kvm = new import_kv.Kvm(nc);
+  return opts.create ? kvm.create(aclBucket(space)) : kvm.open(aclBucket(space));
+}
+async function readAcl(kv, owner) {
+  const e = await kv.get(aclKey(owner));
+  if (!e || e.operation === "DEL" || e.operation === "PURGE")
+    return void 0;
+  try {
+    const record2 = e.json();
+    if (!Array.isArray(record2.allowSubscribe))
+      return void 0;
+    return { record: record2, revision: e.revision };
+  } catch {
+    return void 0;
+  }
+}
+async function commitAcl(kv, owner, allowSubscribe) {
+  const key = aclKey(owner);
+  for (let attempt = 0; attempt < 5; attempt++) {
+    const cur = await readAcl(kv, owner);
+    const next = {
+      allowSubscribe: [...allowSubscribe],
+      revision: (cur?.record.revision ?? 0) + 1,
+      updatedAt: Date.now()
+    };
+    const data = new TextEncoder().encode(JSON.stringify(next));
+    if (!cur) {
+      try {
+        await kv.create(key, data);
+        return next;
+      } catch {
+        continue;
+      }
+    }
+    try {
+      await kv.update(key, data, cur.revision);
+      return next;
+    } catch {
+      continue;
+    }
+  }
+  throw new Error(`acl CAS exhausted retries for ${owner}`);
+}
+
+// ../../packages/core/dist/streams.js
 var MAX_MSGS_PER_SUBJECT = 1e3;
 var PLANE3_DEDUP_WINDOW_MS = 2 * 60 * 60 * 1e3;
 var DINBOX_MAX_ACK_PENDING = 1e3;
@@ -47639,7 +47688,7 @@ function fanoutDurableConfig(space, opts = {}) {
 }
 
 // ../../packages/core/dist/channels.js
-var import_kv2 = __toESM(require_mod6(), 1);
+var import_kv3 = __toESM(require_mod6(), 1);
 var import_transport_node2 = __toESM(require_transport_node(), 1);
 function parseDuration(s) {
   const m = /^(\d+)(s|m|h|d)$/.exec(s.trim());
@@ -47660,7 +47709,7 @@ function effectiveDeliveryClass(cfg, defaults) {
   return cfg?.deliveryClass ?? defaults?.deliveryClass ?? "durable";
 }
 async function openChannelRegistry(nc, space, opts = {}) {
-  const kvm = new import_kv2.Kvm(nc);
+  const kvm = new import_kv3.Kvm(nc);
   return opts.create ? kvm.create(channelBucket(space)) : kvm.open(channelBucket(space));
 }
 async function readChannelConfig(kv, channel) {
@@ -47681,7 +47730,7 @@ async function decode3(kv, key) {
 }
 
 // ../../packages/core/dist/members.js
-var import_kv3 = __toESM(require_mod6(), 1);
+var import_kv4 = __toESM(require_mod6(), 1);
 var StaleMembershipWrite = class extends Error {
   constructor(channel, owner, attempted, current) {
     super(`stale membership write for ${channel}/${owner}: generation ${attempted} < current ${current}`);
@@ -47689,7 +47738,7 @@ var StaleMembershipWrite = class extends Error {
   }
 };
 async function openMembersRegistry(nc, space, opts = {}) {
-  const kvm = new import_kv3.Kvm(nc);
+  const kvm = new import_kv4.Kvm(nc);
   return opts.create ? kvm.create(membersBucket(space)) : kvm.open(membersBucket(space));
 }
 async function readMember(kv, channel, owner) {
@@ -47788,53 +47837,6 @@ function durableEligible(rec, seq) {
   return true;
 }
 
-// ../../packages/core/dist/acls.js
-var import_kv4 = __toESM(require_mod6(), 1);
-async function openAclRegistry(nc, space, opts = {}) {
-  const kvm = new import_kv4.Kvm(nc);
-  return opts.create ? kvm.create(aclBucket(space)) : kvm.open(aclBucket(space));
-}
-async function readAcl(kv, owner) {
-  const e = await kv.get(aclKey(owner));
-  if (!e || e.operation === "DEL" || e.operation === "PURGE")
-    return void 0;
-  try {
-    const record2 = e.json();
-    if (!Array.isArray(record2.allowSubscribe))
-      return void 0;
-    return { record: record2, revision: e.revision };
-  } catch {
-    return void 0;
-  }
-}
-async function commitAcl(kv, owner, allowSubscribe) {
-  const key = aclKey(owner);
-  for (let attempt = 0; attempt < 5; attempt++) {
-    const cur = await readAcl(kv, owner);
-    const next = {
-      allowSubscribe: [...allowSubscribe],
-      revision: (cur?.record.revision ?? 0) + 1,
-      updatedAt: Date.now()
-    };
-    const data = new TextEncoder().encode(JSON.stringify(next));
-    if (!cur) {
-      try {
-        await kv.create(key, data);
-        return next;
-      } catch {
-        continue;
-      }
-    }
-    try {
-      await kv.update(key, data, cur.revision);
-      return next;
-    } catch {
-      continue;
-    }
-  }
-  throw new Error(`acl CAS exhausted retries for ${owner}`);
-}
-
 // ../../packages/core/dist/membership-feed.js
 var import_transport_node3 = __toESM(require_transport_node(), 1);
 var import_kv5 = __toESM(require_mod6(), 1);
@@ -47983,6 +47985,7 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
   ttlMs;
   doRegister;
   doWatch;
+  doWatchChannels;
   doConsume;
   ackWaitMs;
   inactiveThresholdMs;
@@ -48098,6 +48101,7 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
     this.ttlMs = opts.ttlMs ?? 6e3;
     this.doRegister = opts.registerPresence ?? true;
     this.doWatch = opts.watchPresence ?? true;
+    this.doWatchChannels = opts.watchChannels ?? true;
     this.doConsume = opts.consume ?? true;
     this.channelModes = opts.channelModes && Object.keys(opts.channelModes).length ? opts.channelModes : void 0;
     this.ackWaitMs = opts.ackWaitMs ?? 6e4;
@@ -48137,9 +48141,10 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
       await this.startPresenceWatch();
       this.sweepTimer = setInterval(() => this.sweep(), Math.max(500, Math.floor(this.ttlMs / 3)));
     }
-    if (this.doWatch || this.doConsume) {
+    const watchChannels = this.doWatch && this.doWatchChannels;
+    if (watchChannels || this.doConsume) {
       this.channelKv = await openChannelRegistry(this.nc, this.space, { create: !this.creds });
-      if (this.doWatch)
+      if (watchChannels)
         await this.startChannelWatch();
     }
     if (this.doRegister) {
@@ -48430,8 +48435,10 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
    *  PEER's reply lane (`ctl.delivery.<victim>.reply.<n>`) and turn the responder into a confused
    *  deputy — the broker does NOT permission-check the requester's embedded reply subject. With it, a
    *  reply is published only when `m.reply` is under the AUTHENTICATED request subject
-   *  (`${m.subject}.reply.…`), binding the reply to the broker-policed sender token. (The manager's
-   *  tiers reply into the per-id `_INBOX` and leave it off.) */
+   *  (`${m.subject}.reply.…`), binding the reply to the broker-policed sender token. The manager's three
+   *  lifecycle tiers ALSO require it as of closure (i): they reply on bounded `ctl.<tier>.<caller>.reply.…`
+   *  (the manager cred holds the wildcard `ctl.<tier>.*.reply.>` pub — exactly the confused-deputy
+   *  condition above), so do NOT drop `boundReply` on them. */
   serveControl(service, handler, opts = {}) {
     if (!this.nc)
       throw new Error("endpoint not started");
@@ -48466,12 +48473,25 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
     })().catch((e) => this.emit("error", e));
     return sub;
   }
-  /** Send a control request to a service and await its reply (client side). */
+  /** Send a control request to a service and await its reply (client side). Like {@link requestDelivery},
+   *  the reply rides a BOUNDED subject UNDER the request subject (`ctl.<service>.<id>.reply.<uuid>`), not
+   *  the per-id `_INBOX` — closure (i): this frees the manager's permission set from needing a position-1
+   *  inbox wildcard, so its publish surface can be an exact self-scoped allow-list (no message forging).
+   *  `noMux` lets us name the reply subject while keeping NoResponders detection. The random suffix is
+   *  defense-in-depth (a predictable suffix would let a peer target an in-flight named reply sub). The
+   *  reply sits under the sender's OWN request subject, so the responder's `boundReply` guard accepts it.
+   *
+   *  CUTOVER (not backward-compatible): an agent cred minted BEFORE closure (i) lacks the
+   *  `ctl.<tier>.<id>.reply.>` sub grant — it can still publish the request but cannot subscribe the
+   *  reply, so its control calls (spawn/despawn/purge/definePersona, self-stop) hang. The per-user-auth
+   *  atomic cutover re-mints every agent; if this change ships ahead of that, agents must be RESPAWNED. */
   async requestControl(service, req, timeoutMs = 5e3) {
     if (!this.nc)
       throw new Error(this.notLiveMsg());
+    const reqSubject = controlServiceSubject(this.space, service, this.card.id);
+    const reply = `${reqSubject}.reply.${(0, import_node_crypto.randomUUID)()}`;
     const body = { ...req, from: req.from ?? this.ref() };
-    const m = await this.nc.request(controlServiceSubject(this.space, service, this.card.id), JSON.stringify(body), { timeout: timeoutMs });
+    const m = await this.nc.request(reqSubject, JSON.stringify(body), { timeout: timeoutMs, noMux: true, reply });
     return m.json();
   }
   /** Send a durable-membership request to the SERVER-SIDE delivery daemon (`ctl.delivery`) and await its
@@ -48926,23 +48946,29 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
       return void 0;
     }
   }
-  /** Ensure + bind the manager singleton-lease bucket. NOTE: `Kvm.open` binds LAZILY — it does NOT
-   *  verify the stream exists or throw when it's missing, so it can't "create if absent" (a fresh bucket
-   *  then fails 'stream not found' on the first write — unlike the delivery bucket, which is pre-created
-   *  at `cotal up`). `create` is the ensure-exists call: it makes the bucket (bucket-level TTL) or, when
-   *  another manager already did, throws — and we bind the now-existing one. Either way the per-KEY CAS
-   *  create stays the only single-flight gate, so a lost bucket-create race never reads as "lease held".
-   *  The manager is allow-all, so it may create. */
+  /** Ensure + bind the manager singleton-lease bucket. Mirrors the presence-bucket pattern (connectAndBind):
+   *  AUTH mode OPENs the bucket pre-created at `cotal up` (the scoped `supervisor` cred holds no
+   *  STREAM.CREATE — and `open` binds direct=false, so the CAS-conflict `kv.get` inside `acquire` rides
+   *  STREAM.MSG.GET, the verb the supervisor grants, never DIRECT.GET). OPEN mode (no creds) create-firsts:
+   *  `Kvm.open` binds LAZILY — it does NOT verify the stream exists or throw when it's missing (a fresh
+   *  bucket then fails 'stream not found' on the first write), so `create` is the ensure-exists call (it
+   *  makes the bucket or, when another endpoint already did, throws and we bind the existing one). Either
+   *  way the per-KEY CAS create stays the only single-flight gate, so a lost bucket-create race never reads
+   *  as "lease held". */
   async managerLeaseRegistry() {
     if (!this.nc)
       throw new Error("endpoint not started");
     if (this.managerLeaseKv)
       return this.managerLeaseKv;
     const kvm = new import_kv7.Kvm(this.nc);
-    try {
-      this.managerLeaseKv = await kvm.create(managerBucket(this.space), { ttl: MANAGER_LEASE_TTL_MS });
-    } catch {
+    if (this.creds) {
       this.managerLeaseKv = await kvm.open(managerBucket(this.space));
+    } else {
+      try {
+        this.managerLeaseKv = await kvm.create(managerBucket(this.space), { ttl: MANAGER_LEASE_TTL_MS });
+      } catch {
+        this.managerLeaseKv = await kvm.open(managerBucket(this.space));
+      }
     }
     return this.managerLeaseKv;
   }
@@ -50069,6 +50095,8 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
     this.applyPresence(e.key, p);
   }
   applyPresence(id, raw) {
+    if (raw.card?.id !== id)
+      return;
     const prev = this.roster.get(id);
     const stale = Date.now() - raw.ts > this.ttlMs;
     const p = stale || raw.status === "offline" ? this.toOffline(raw) : raw;
@@ -50634,7 +50662,9 @@ var MeshAgent = class extends import_node_events2.EventEmitter {
    *  the harness (default the manager's `cotal`/Claude), `opts.model` overrides the
    *  persona file's `model:`, and `opts.cwd` roots the new peer at a different folder/repo
    *  than the manager's workspace — the same knobs the operator's `cotal start` carries, so
-   *  the agent and operator spawn doors share one control-op contract. */
+   *  the agent and operator spawn doors share one control-op contract. (Session `resume` is
+   *  intentionally NOT forwarded here: forking a host-local `~/.claude` transcript is an
+   *  operator-local intent, kept off the peer-facing spawn door — see #159.) */
   async spawn(name, role, opts) {
     this.assertConnected();
     return this.ep.requestControl(CONTROL_PRIVILEGED, {
@@ -50896,8 +50926,6 @@ function controlFailure(action, e) {
 function statusGlyph(s) {
   return s === "working" ? "\u25CF" : s === "waiting" ? "\u25D0" : s === "idle" ? "\u25CB" : "\xB7";
 }
-var FACE_TAG_RE = /\[\[\s*face\s*:\s*[\w-]+\s*\]\]\s?/gi;
-var stripFaceTags = (text) => text.replace(FACE_TAG_RE, "");
 var ATTENTION_DESC = {
   open: "open \u2014 you receive everything; untagged channel chatter wakes you when idle",
   dnd: "dnd \u2014 channel chatter no longer wakes you (it still arrives in your next turn); DMs, anycast, and @mentions still wake you",
@@ -51042,7 +51070,7 @@ ${all.map(fmtItem).join("\n")}`);
       },
       async run(agent, _config, { text: msg, channel, mentions }) {
         try {
-          const m = await agent.send(stripFaceTags(msg), channel, mentions);
+          const m = await agent.send(msg, channel, mentions);
           return ok(`Sent to #${m.channel}${m.mentions?.length ? ` (mentioned @${m.mentions.join(", @")})` : ""}.`);
         } catch (e) {
           return err(`Couldn't send: ${e.message}`);
@@ -51059,7 +51087,7 @@ ${all.map(fmtItem).join("\n")}`);
       },
       async run(agent, _config, { to, text: msg }) {
         try {
-          const { peer } = await agent.dm(to, stripFaceTags(msg));
+          const { peer } = await agent.dm(to, msg);
           return ok(`DM sent to ${peer.card.name}.`);
         } catch (e) {
           if (e instanceof AmbiguousPeerError) {
@@ -51081,7 +51109,7 @@ ${who2}`);
       },
       async run(agent, _config, { role, text: msg }) {
         try {
-          await agent.anycast(role, stripFaceTags(msg));
+          await agent.anycast(role, msg);
           return ok(`Sent to one @${role}.`);
         } catch (e) {
           return err(`Couldn't send: ${e.message}`);
@@ -51223,6 +51251,11 @@ ${info}${caught}`);
         agent: external_exports.string().optional().describe("Optional harness the new peer runs on \u2014 the agent/connector type (claude, opencode, hermes), NOT the persona to spawn (that's `name`). Defaults to the manager's default (Claude)."),
         model: external_exports.string().optional().describe("Optional model override (e.g. opus, sonnet) \u2014 wins over the persona file's model:."),
         cwd: external_exports.string().optional().describe("Optional working directory to root the new peer at (e.g. a different repo). A relative path resolves against the manager's workspace; omitted \u2192 it shares the manager's workspace.")
+        // NOTE: session `resume` is deliberately NOT exposed here. Forking a host-local `~/.claude`
+        // transcript is an operator-local intent; letting a spawn-capable mesh PEER name a host
+        // session id would expand `spawn` into host-transcript disclosure with no broker-enforced
+        // boundary. Resume lives only on the operator CLI (`cotal spawn --resume` / `cotal start
+        // --resume`); a peer-facing, capability-gated resume is deferred (see #159).
       },
       async run(agent, _config, { name, role, agent: agentType, model, cwd }) {
         try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/connector-claude-code",
   "description": "Cotal connector for Claude Code: an installed plugin that joins a session to the mesh.",
-  "version": "0.8.3",
+  "version": "0.9.1",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@cotal-ai/connector-core": "0.8.3"
+    "@cotal-ai/connector-core": "0.9.1"
   },
   "peerDependencies": {
     "@cotal-ai/core": ">=0.1.0"
@@ -27,7 +27,7 @@
   "devDependencies": {
     "esbuild": "^0.28.0",
     "tsx": "^4.22.4",
-    "@cotal-ai/core": "0.8.3"
+    "@cotal-ai/core": "0.9.1"
   },
   "files": [
     "dist",