@cotal-ai/connector-hermes 0.8.2 → 0.9.0

package/dist/extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,SAAS,EAAoC,MAAM,gBAAgB,CAAC;AAW3G;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,SAkC7B,CAAC"}
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,SAAS,EAAoC,MAAM,gBAAgB,CAAC;AAW3G;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,SAuC7B,CAAC"}

package/dist/extension.js

@@ -28,6 +28,11 @@ export const hermesConnector = {
         // the manager can't drive (no Windows named-pipe bridge, no cooperative shutdown). No fallback.
         if (process.platform === "win32")
             throw new Error("the Hermes connector is Unix-only (AF_UNIX bridge + Python sidecar) — not supported on Windows");
+        // Resuming an existing session isn't supported by Hermes (no fork-from-transcript primitive in
+        // the gateway launcher). Throw rather than spawn fresh silently — this connector otherwise
+        // ignores opts it doesn't render, so without this guard `resume` would be dropped without a word.
+        if (opts.resume)
+            throw new Error("the Hermes connector does not support resuming an existing session (resume)");
         // OS allow-list + the named model-provider key (Hermes is model-agnostic; any one unlocks a
         // provider), forwarded BY NAME — never `...process.env` — so the operator's unrelated secrets
         // don't reach the gateway child (P3).

package/dist/extension.js.map

@@ -1 +1 @@
-{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAoD,MAAM,gBAAgB,CAAC;AAC3G,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAElF;;;2DAG2D;AAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAChF,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,SAAS,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEtF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAc;IACxC,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpB,WAAW,CAAC,IAAgB;QAC1B,8FAA8F;QAC9F,gGAAgG;QAChG,gGAAgG;QAChG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC9B,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACpH,4FAA4F;QAC5F,8FAA8F;QAC9F,sCAAsC;QACtC,MAAM,GAAG,GAA2B;YAClC,GAAG,SAAS,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;YACnD,GAAG,MAAM,CAAC,IAAI,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,KAAK;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI;SACtB,CAAC;QACF,IAAI,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO;YAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;QACnD,wFAAwF;QACxF,mFAAmF;QACnF,IAAI,IAAI,CAAC,UAAU;YAAE,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5D,gGAAgG;QAChG,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAClE,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC"}
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAoD,MAAM,gBAAgB,CAAC;AAC3G,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAElF;;;2DAG2D;AAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAChF,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,SAAS,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEtF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAc;IACxC,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpB,WAAW,CAAC,IAAgB;QAC1B,8FAA8F;QAC9F,gGAAgG;QAChG,gGAAgG;QAChG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC9B,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACpH,+FAA+F;QAC/F,2FAA2F;QAC3F,kGAAkG;QAClG,IAAI,IAAI,CAAC,MAAM;YACb,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,4FAA4F;QAC5F,8FAA8F;QAC9F,sCAAsC;QACtC,MAAM,GAAG,GAA2B;YAClC,GAAG,SAAS,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;YACnD,GAAG,MAAM,CAAC,IAAI,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,KAAK;YACvB,UAAU,EAAE,IAAI,CAAC,IAAI;SACtB,CAAC;QACF,IAAI,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO;YAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;QACnD,wFAAwF;QACxF,mFAAmF;QACnF,IAAI,IAAI,CAAC,UAAU;YAAE,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5D,gGAAgG;QAChG,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAClE,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/connector-hermes",
   "description": "Cotal connector for the Hermes (Nous Research) agent.",
-  "version": "0.8.2",
+  "version": "0.9.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -23,14 +23,14 @@
   "dependencies": {
     "tsx": "^4.22.4",
     "zod": "^4.4.3",
-    "@cotal-ai/connector-core": "0.8.2"
+    "@cotal-ai/connector-core": "0.9.0"
   },
   "peerDependencies": {
     "@cotal-ai/core": ">=0.1.0"
   },
   "devDependencies": {
     "esbuild": "^0.28.0",
-    "@cotal-ai/core": "0.8.2"
+    "@cotal-ai/core": "0.9.0"
   },
   "files": [
     "bin",

package/plugin/cotal/_sidecar/standalone.cjs

@@ -17067,6 +17067,7 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
   ttlMs;
   doRegister;
   doWatch;
+  doWatchChannels;
   doConsume;
   ackWaitMs;
   inactiveThresholdMs;
@@ -17182,6 +17183,7 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
     this.ttlMs = opts.ttlMs ?? 6e3;
     this.doRegister = opts.registerPresence ?? true;
     this.doWatch = opts.watchPresence ?? true;
+    this.doWatchChannels = opts.watchChannels ?? true;
     this.doConsume = opts.consume ?? true;
     this.channelModes = opts.channelModes && Object.keys(opts.channelModes).length ? opts.channelModes : void 0;
     this.ackWaitMs = opts.ackWaitMs ?? 6e4;
@@ -17221,9 +17223,10 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
       await this.startPresenceWatch();
       this.sweepTimer = setInterval(() => this.sweep(), Math.max(500, Math.floor(this.ttlMs / 3)));
     }
-    if (this.doWatch || this.doConsume) {
+    const watchChannels = this.doWatch && this.doWatchChannels;
+    if (watchChannels || this.doConsume) {
       this.channelKv = await openChannelRegistry(this.nc, this.space, { create: !this.creds });
-      if (this.doWatch)
+      if (watchChannels)
         await this.startChannelWatch();
     }
     if (this.doRegister) {
@@ -17514,8 +17517,10 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
    *  PEER's reply lane (`ctl.delivery.<victim>.reply.<n>`) and turn the responder into a confused
    *  deputy — the broker does NOT permission-check the requester's embedded reply subject. With it, a
    *  reply is published only when `m.reply` is under the AUTHENTICATED request subject
-   *  (`${m.subject}.reply.…`), binding the reply to the broker-policed sender token. (The manager's
-   *  tiers reply into the per-id `_INBOX` and leave it off.) */
+   *  (`${m.subject}.reply.…`), binding the reply to the broker-policed sender token. The manager's three
+   *  lifecycle tiers ALSO require it as of closure (i): they reply on bounded `ctl.<tier>.<caller>.reply.…`
+   *  (the manager cred holds the wildcard `ctl.<tier>.*.reply.>` pub — exactly the confused-deputy
+   *  condition above), so do NOT drop `boundReply` on them. */
   serveControl(service, handler, opts = {}) {
     if (!this.nc)
       throw new Error("endpoint not started");
@@ -17550,12 +17555,25 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
     })().catch((e) => this.emit("error", e));
     return sub;
   }
-  /** Send a control request to a service and await its reply (client side). */
+  /** Send a control request to a service and await its reply (client side). Like {@link requestDelivery},
+   *  the reply rides a BOUNDED subject UNDER the request subject (`ctl.<service>.<id>.reply.<uuid>`), not
+   *  the per-id `_INBOX` — closure (i): this frees the manager's permission set from needing a position-1
+   *  inbox wildcard, so its publish surface can be an exact self-scoped allow-list (no message forging).
+   *  `noMux` lets us name the reply subject while keeping NoResponders detection. The random suffix is
+   *  defense-in-depth (a predictable suffix would let a peer target an in-flight named reply sub). The
+   *  reply sits under the sender's OWN request subject, so the responder's `boundReply` guard accepts it.
+   *
+   *  CUTOVER (not backward-compatible): an agent cred minted BEFORE closure (i) lacks the
+   *  `ctl.<tier>.<id>.reply.>` sub grant — it can still publish the request but cannot subscribe the
+   *  reply, so its control calls (spawn/despawn/purge/definePersona, self-stop) hang. The per-user-auth
+   *  atomic cutover re-mints every agent; if this change ships ahead of that, agents must be RESPAWNED. */
   async requestControl(service, req, timeoutMs = 5e3) {
     if (!this.nc)
       throw new Error(this.notLiveMsg());
+    const reqSubject = controlServiceSubject(this.space, service, this.card.id);
+    const reply = `${reqSubject}.reply.${(0, import_node_crypto.randomUUID)()}`;
     const body = { ...req, from: req.from ?? this.ref() };
-    const m = await this.nc.request(controlServiceSubject(this.space, service, this.card.id), JSON.stringify(body), { timeout: timeoutMs });
+    const m = await this.nc.request(reqSubject, JSON.stringify(body), { timeout: timeoutMs, noMux: true, reply });
     return m.json();
   }
   /** Send a durable-membership request to the SERVER-SIDE delivery daemon (`ctl.delivery`) and await its
@@ -18010,23 +18028,29 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
       return void 0;
     }
   }
-  /** Ensure + bind the manager singleton-lease bucket. NOTE: `Kvm.open` binds LAZILY — it does NOT
-   *  verify the stream exists or throw when it's missing, so it can't "create if absent" (a fresh bucket
-   *  then fails 'stream not found' on the first write — unlike the delivery bucket, which is pre-created
-   *  at `cotal up`). `create` is the ensure-exists call: it makes the bucket (bucket-level TTL) or, when
-   *  another manager already did, throws — and we bind the now-existing one. Either way the per-KEY CAS
-   *  create stays the only single-flight gate, so a lost bucket-create race never reads as "lease held".
-   *  The manager is allow-all, so it may create. */
+  /** Ensure + bind the manager singleton-lease bucket. Mirrors the presence-bucket pattern (connectAndBind):
+   *  AUTH mode OPENs the bucket pre-created at `cotal up` (the scoped `supervisor` cred holds no
+   *  STREAM.CREATE — and `open` binds direct=false, so the CAS-conflict `kv.get` inside `acquire` rides
+   *  STREAM.MSG.GET, the verb the supervisor grants, never DIRECT.GET). OPEN mode (no creds) create-firsts:
+   *  `Kvm.open` binds LAZILY — it does NOT verify the stream exists or throw when it's missing (a fresh
+   *  bucket then fails 'stream not found' on the first write), so `create` is the ensure-exists call (it
+   *  makes the bucket or, when another endpoint already did, throws and we bind the existing one). Either
+   *  way the per-KEY CAS create stays the only single-flight gate, so a lost bucket-create race never reads
+   *  as "lease held". */
   async managerLeaseRegistry() {
     if (!this.nc)
       throw new Error("endpoint not started");
     if (this.managerLeaseKv)
       return this.managerLeaseKv;
     const kvm = new import_kv7.Kvm(this.nc);
-    try {
-      this.managerLeaseKv = await kvm.create(managerBucket(this.space), { ttl: MANAGER_LEASE_TTL_MS });
-    } catch {
+    if (this.creds) {
       this.managerLeaseKv = await kvm.open(managerBucket(this.space));
+    } else {
+      try {
+        this.managerLeaseKv = await kvm.create(managerBucket(this.space), { ttl: MANAGER_LEASE_TTL_MS });
+      } catch {
+        this.managerLeaseKv = await kvm.open(managerBucket(this.space));
+      }
     }
     return this.managerLeaseKv;
   }
@@ -19153,6 +19177,8 @@ var CotalEndpoint = class extends import_node_events.EventEmitter {
     this.applyPresence(e.key, p);
   }
   applyPresence(id, raw) {
+    if (raw.card?.id !== id)
+      return;
     const prev = this.roster.get(id);
     const stale = Date.now() - raw.ts > this.ttlMs;
     const p = stale || raw.status === "offline" ? this.toOffline(raw) : raw;
@@ -19323,7 +19349,7 @@ function configFromEnv(env = process.env) {
     description: def?.description,
     tags: def?.tags,
     meta: def?.meta,
-    capabilities: def?.capabilities,
+    capabilities: splitList(env.COTAL_CAPABILITIES).length ? splitList(env.COTAL_CAPABILITIES) : def?.capabilities,
     model: env.COTAL_MODEL?.trim() || def?.model || void 0,
     servers: env.COTAL_SERVERS?.trim() || link?.servers || DEFAULT_SERVER,
     subscribe: resolvedSubscribe,
@@ -19711,7 +19737,9 @@ var MeshAgent = class extends import_node_events2.EventEmitter {
    *  the harness (default the manager's `cotal`/Claude), `opts.model` overrides the
    *  persona file's `model:`, and `opts.cwd` roots the new peer at a different folder/repo
    *  than the manager's workspace — the same knobs the operator's `cotal start` carries, so
-   *  the agent and operator spawn doors share one control-op contract. */
+   *  the agent and operator spawn doors share one control-op contract. (Session `resume` is
+   *  intentionally NOT forwarded here: forking a host-local `~/.claude` transcript is an
+   *  operator-local intent, kept off the peer-facing spawn door — see #159.) */
   async spawn(name, role, opts) {
     this.assertConnected();
     return this.ep.requestControl(CONTROL_PRIVILEGED, {
@@ -34481,8 +34509,6 @@ function controlFailure(action, e) {
 function statusGlyph(s) {
   return s === "working" ? "\u25CF" : s === "waiting" ? "\u25D0" : s === "idle" ? "\u25CB" : "\xB7";
 }
-var FACE_TAG_RE = /\[\[\s*face\s*:\s*[\w-]+\s*\]\]\s?/gi;
-var stripFaceTags = (text) => text.replace(FACE_TAG_RE, "");
 var ATTENTION_DESC = {
   open: "open \u2014 you receive everything; untagged channel chatter wakes you when idle",
   dnd: "dnd \u2014 channel chatter no longer wakes you (it still arrives in your next turn); DMs, anycast, and @mentions still wake you",
@@ -34613,7 +34639,7 @@ ${all.map(fmtItem).join("\n")}`);
       },
       async run(agent, _config, { text: msg, channel, mentions }) {
         try {
-          const m = await agent.send(stripFaceTags(msg), channel, mentions);
+          const m = await agent.send(msg, channel, mentions);
           return ok(`Sent to #${m.channel}${m.mentions?.length ? ` (mentioned @${m.mentions.join(", @")})` : ""}.`);
         } catch (e) {
           return err(`Couldn't send: ${e.message}`);
@@ -34630,7 +34656,7 @@ ${all.map(fmtItem).join("\n")}`);
       },
       async run(agent, _config, { to, text: msg }) {
         try {
-          const { peer } = await agent.dm(to, stripFaceTags(msg));
+          const { peer } = await agent.dm(to, msg);
           return ok(`DM sent to ${peer.card.name}.`);
         } catch (e) {
           if (e instanceof AmbiguousPeerError) {
@@ -34652,7 +34678,7 @@ ${who}`);
       },
       async run(agent, _config, { role, text: msg }) {
         try {
-          await agent.anycast(role, stripFaceTags(msg));
+          await agent.anycast(role, msg);
           return ok(`Sent to one @${role}.`);
         } catch (e) {
           return err(`Couldn't send: ${e.message}`);
@@ -34794,6 +34820,11 @@ ${info}${caught}`);
         agent: external_exports.string().optional().describe("Optional harness the new peer runs on \u2014 the agent/connector type (claude, opencode, hermes), NOT the persona to spawn (that's `name`). Defaults to the manager's default (Claude)."),
         model: external_exports.string().optional().describe("Optional model override (e.g. opus, sonnet) \u2014 wins over the persona file's model:."),
         cwd: external_exports.string().optional().describe("Optional working directory to root the new peer at (e.g. a different repo). A relative path resolves against the manager's workspace; omitted \u2192 it shares the manager's workspace.")
+        // NOTE: session `resume` is deliberately NOT exposed here. Forking a host-local `~/.claude`
+        // transcript is an operator-local intent; letting a spawn-capable mesh PEER name a host
+        // session id would expand `spawn` into host-transcript disclosure with no broker-enforced
+        // boundary. Resume lives only on the operator CLI (`cotal spawn --resume` / `cotal start
+        // --resume`); a peer-facing, capability-gated resume is deferred (see #159).
       },
       async run(agent, _config, { name, role, agent: agentType, model, cwd }) {
         try {