@cotal-ai/connector-hermes 0.8.0 → 0.8.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/connector-hermes",
   "description": "Cotal connector for the Hermes (Nous Research) agent.",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -23,14 +23,14 @@
   "dependencies": {
     "tsx": "^4.22.4",
     "zod": "^4.4.3",
-    "@cotal-ai/connector-core": "0.8.0"
+    "@cotal-ai/connector-core": "0.8.1"
   },
   "peerDependencies": {
     "@cotal-ai/core": ">=0.1.0"
   },
   "devDependencies": {
     "esbuild": "^0.28.0",
-    "@cotal-ai/core": "0.8.0"
+    "@cotal-ai/core": "0.8.1"
   },
   "files": [
     "bin",

package/plugin/cotal/_sidecar/standalone.cjs

@@ -14858,6 +14858,10 @@ function deliveryBucket(space) {
 function leaseKey(shardIndex) {
   return `lease.${shardIndex}`;
 }
+function managerBucket(space) {
+  return `cotal_manager_${token(space)}`;
+}
+var MANAGER_LEASE_KEY = "lease";
 function chatStream(space) {
   return `CHAT_${token(space)}`;
 }
@@ -16615,6 +16619,7 @@ var import_kv = __toESM(require_mod6(), 1);
 var MAX_MSGS_PER_SUBJECT = 1e3;
 var PLANE3_DEDUP_WINDOW_MS = 2 * 60 * 60 * 1e3;
 var DINBOX_MAX_ACK_PENDING = 1e3;
+var MANAGER_LEASE_TTL_MS = 1e4;
 var MEMBERSHIP_MAX_BYTES = 64 * 1024 * 1024;
 async function createSpaceStreams(jsm, space) {
   const p = spacePrefix(space);
@@ -17070,6 +17075,7 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
   membersKv;
   aclKv;
   deliveryKv;
+  managerLeaseKv;
   membershipKv;
   /** The live `ctl.delivery` serve subscription (delivery daemon) — re-created on every (re)connect by
    *  {@link armDeliveryControl}; tracked so the stale one is dropped on reconnect. */
@@ -17999,6 +18005,68 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
       return void 0;
     }
   }
+  /** Ensure + bind the manager singleton-lease bucket. NOTE: `Kvm.open` binds LAZILY — it does NOT
+   *  verify the stream exists or throw when it's missing, so it can't "create if absent" (a fresh bucket
+   *  then fails 'stream not found' on the first write — unlike the delivery bucket, which is pre-created
+   *  at `cotal up`). `create` is the ensure-exists call: it makes the bucket (bucket-level TTL) or, when
+   *  another manager already did, throws — and we bind the now-existing one. Either way the per-KEY CAS
+   *  create stays the only single-flight gate, so a lost bucket-create race never reads as "lease held".
+   *  The manager is allow-all, so it may create. */
+  async managerLeaseRegistry() {
+    if (!this.nc)
+      throw new Error("endpoint not started");
+    if (this.managerLeaseKv)
+      return this.managerLeaseKv;
+    const kvm = new import_kv7.Kvm(this.nc);
+    try {
+      this.managerLeaseKv = await kvm.create(managerBucket(this.space), { ttl: MANAGER_LEASE_TTL_MS });
+    } catch {
+      this.managerLeaseKv = await kvm.open(managerBucket(this.space));
+    }
+    return this.managerLeaseKv;
+  }
+  encodeManagerLease(info) {
+    return new TextEncoder().encode(JSON.stringify(info));
+  }
+  /** Acquire the singleton manager lease via ATOMIC CAS create. THROWS if a live lease exists (a loud
+   *  refusal-to-start, never a retry) so two managers never split control. A crashed holder's lease
+   *  auto-expires (bucket TTL). Returns the lease revision (for renew). */
+  async acquireManagerLease(info) {
+    return (await this.managerLeaseRegistry()).create(MANAGER_LEASE_KEY, this.encodeManagerLease({ ...info, since: Date.now() }));
+  }
+  /** Renew the held lease (CAS update against `revision`) before the bucket TTL expires it. Throws if the
+   *  revision moved (lost the lease). Returns the new revision. */
+  async renewManagerLease(info, revision) {
+    return (await this.managerLeaseRegistry()).update(MANAGER_LEASE_KEY, this.encodeManagerLease({ ...info, since: Date.now() }), revision);
+  }
+  /** Release the held lease on clean shutdown so a replacement manager acquires immediately. CAS-guarded
+   *  by `revision`: if we already LOST the lease (renew gap / another manager took over) the stored
+   *  revision has moved, the conditional delete no-ops, and we never delete the replacement's live lease. */
+  async releaseManagerLease(revision) {
+    try {
+      const kv = await this.managerLeaseRegistry();
+      if (revision === void 0)
+        await kv.delete(MANAGER_LEASE_KEY);
+      else
+        await kv.delete(MANAGER_LEASE_KEY, { previousSeq: revision });
+    } catch {
+    }
+  }
+  /** Read the live manager lease, or undefined if none (bucket absent / key deleted/expired). Open-only —
+   *  never creates the bucket, so a probe that finds no manager leaves none behind. */
+  async readManagerLease() {
+    if (!this.nc)
+      return void 0;
+    try {
+      const kv = await new import_kv7.Kvm(this.nc).open(managerBucket(this.space));
+      const e = await kv.get(MANAGER_LEASE_KEY);
+      if (!e || e.operation === "DEL" || e.operation === "PURGE")
+        return void 0;
+      return e.json();
+    } catch {
+      return void 0;
+    }
+  }
   /** Privileged: one owner's NON-TOMBSTONED durable memberships as `{channel, generation, activated}` —
    *  the server-side delivery daemon serves this to a connecting agent (the `listMemberships` op on
    *  `ctl.delivery`). The agent seeds its leave mirror from the ACTIVATED ones (the confirmed backstops),
@@ -19635,14 +19703,15 @@ var MeshAgent = class extends import_node_events2.EventEmitter {
   /** Ask the manager to spawn a new teammate into this space (its `start` op).
    *  How it lands — a detached PTY, a tmux window, a cmux tab — is the manager's
    *  runtime; from here it just joins the mesh as a lateral peer. `opts.agent` picks
-   *  the harness (default the manager's `cotal`/Claude) and `opts.model` overrides the
-   *  persona file's `model:` — the same knobs the operator's `cotal start` carries, so
+   *  the harness (default the manager's `cotal`/Claude), `opts.model` overrides the
+   *  persona file's `model:`, and `opts.cwd` roots the new peer at a different folder/repo
+   *  than the manager's workspace — the same knobs the operator's `cotal start` carries, so
    *  the agent and operator spawn doors share one control-op contract. */
   async spawn(name, role, opts) {
     this.assertConnected();
     return this.ep.requestControl(CONTROL_PRIVILEGED, {
       op: "start",
-      args: { name, role, agent: opts?.agent, model: opts?.model }
+      args: { name, role, agent: opts?.agent, model: opts?.model, cwd: opts?.cwd }
     });
   }
   /** Ask the manager to tear a teammate down (its `stop` op). Graceful by default —
@@ -34718,11 +34787,12 @@ ${info}${caught}`);
         name: external_exports.string().describe("Which persona to spawn \u2014 the persona FILENAME in .cotal/agents (e.g. `review-critic`), without the .md. The new peer joins under the persona's own `name:` (auto-numbered, e.g. socrates-2, if that's taken). Fails if no such persona file exists \u2014 spawn an existing persona, don't invent a name."),
         role: external_exports.string().optional().describe("Optional role for the new peer (e.g. worker, reviewer); overrides the persona file's role."),
         agent: external_exports.string().optional().describe("Optional harness the new peer runs on \u2014 the agent/connector type (claude, opencode, hermes), NOT the persona to spawn (that's `name`). Defaults to the manager's default (Claude)."),
-        model: external_exports.string().optional().describe("Optional model override (e.g. opus, sonnet) \u2014 wins over the persona file's model:.")
+        model: external_exports.string().optional().describe("Optional model override (e.g. opus, sonnet) \u2014 wins over the persona file's model:."),
+        cwd: external_exports.string().optional().describe("Optional working directory to root the new peer at (e.g. a different repo). A relative path resolves against the manager's workspace; omitted \u2192 it shares the manager's workspace.")
       },
-      async run(agent, _config, { name, role, agent: agentType, model }) {
+      async run(agent, _config, { name, role, agent: agentType, model, cwd }) {
         try {
-          const reply = await agent.spawn(name, role, { agent: agentType, model });
+          const reply = await agent.spawn(name, role, { agent: agentType, model, cwd });
           if (!reply.ok)
             return err(`Couldn't spawn ${name}: ${reply.error ?? "manager refused"}`);
           const d = reply.data;