@cotal-ai/pi 0.31.0 → 0.32.0

package/dist/index.js

@@ -16068,7 +16068,7 @@ import { isConcreteChannel as isConcreteChannel3, channelInAllow as channelInAll
 
 // ../connector-core/dist/docs-bundle.generated.js
 var DOCS_BUNDLE = {
-  "version": "0.31.0",
+  "version": "0.32.0",
   "generatedFrom": "docs/*.md + SPEC.md + spec/cotal-lang.md + spec/cotal.schema.json",
   "pages": [
     {
@@ -16328,7 +16328,7 @@ var DOCS_BUNDLE = {
       "title": "Watch a mesh",
       "kind": "Guide (informative)",
       "summary": "A running mesh is a stream of live activity: who is present, what they are doing, what they are saying to each other.",
-      "body": "# Watch a mesh\n\n> **Guide** (informative) \xB7 **For:** operators \xB7 **Prereqs:** [Quickstart](getting-started.md)\n\nA running mesh is a stream of live activity: who is present, what they are doing, what they\nare saying to each other. Cotal gives you three read-only surfaces onto one space. All three\nrender the *same* observer model ([`MeshView`](mesh-view.md)); none opens its own connection or\nre-implements the wire. Pick by where you are:\n\n| Surface | Command | Use it to |\n|---|---|---|\n| **console (TUI)** | `cotal console` | drive it interactively in the terminal: drill into agents, channels, DMs |\n| **stream** | `cotal console --plain`, or any pipe | tail a passive line log: grep it, pipe it, watch it in CI |\n| **web dashboard** | `cotal web` | a god-view browser dashboard: see at a glance what needs a human |\n\nThe console ships with the CLI; the web dashboard is an extension (`cotal setup` installs it).\n\n## `cotal console`: the terminal view\n\n`cotal console` auto-selects its renderer: a real TTY gets the lazygit-style Ink TUI; a pipe or\n`--plain` gets the line stream. Both read from one invisible observer over the space.\n\n```bash\ncotal console --space main       # the TUI for one space\ncotal console --plain            # the passive line stream (also the default when piped)\ncotal console                    # no --space on an open mesh \u2192 the admin overview first\n```\n\n![The cotal console: a live roster of agents and their all-activity feed in a terminal TUI](../assets/quickstart.gif)\n\n**Admin overview.** On an open mesh, `cotal console` with **no `--space`** opens a space picker:\nevery space on the server (enumerated from its `CHAT_*` streams and presence buckets) with its\nagents, channels, and message counts. Pick one to drop into its console; `b` returns to the\noverview. `--space X` skips the picker. Under auth a server hosts a single space, so the console\nenters it directly (no overview).\n\n**Lenses and keys** (TUI). The layout is a roster, a live feed, per-channel tabs, a golden-signal\ntiles strip, and toggleable lenses:\n\n| Key | Does |\n|---|---|\n| `1`\u2013`9`, `[` `]` | select a channel tab |\n| `n` | the NEEDS-YOU rail: agents currently blocked or waiting |\n| `d` | the DM lens: per-peer roll-up and threads (god-view only; shows \"DMs hidden\" under chat-only creds) |\n| `t`, then `v` / `1`\u2013`3` | the topology lens: who-talks-to-whom, as a swimlane, a heat matrix, or a ring map |\n| `/` | search / filter the feed |\n| `:` | the command palette |\n| arrows / `h` `l` | move focus; select a row for its detail card |\n| `?` \xB7 `b` \xB7 `q` | help \xB7 back to overview \xB7 quit |\n\nThe stream is line-oriented, so the signals stay out of it; it is just a timestamped log of\npresence changes and messages, ready for `grep`.\n\n## `cotal web`: the browser dashboard\n\nThe dashboard ships inside `cotal-ai` as the `@cotal-ai/web` extension and is seeded automatically on\nfirst run (like the built-in connectors), so `cotal web` is there out of the box and tracks your CLI\nversion on upgrade. If a seeded copy is damaged, `cotal ext seed --repair` restores it.\n\n![The web dashboard: roster, all-activity feed, golden-signal tiles, and the NEEDS-YOU lane](../assets/dashboard.png)\n\n```bash\ncotal web --space main                       # opens http://cotal.localhost:7799/\ncotal web --space main --detach              # background; stop with cotal down web\ncotal web --space main --port 8080 --no-open\ncotal web --space main --creds ./admin.creds # use a cred you minted yourself\n```\n\nFlags: `--space` (default `main`), `--server` (the mesh's broker, resolved from the registry),\n`--port` (default `7799`), `--detach` (run in the background), `--no-open` (skip auto-launching the\nbrowser), `--creds` (override the self-minted cred). It binds loopback only. Detached mode waits for\nthe real HTTP server before returning, logs to `<mesh-root>/.cotal/web.log`, and is stopped by\n`cotal down web` or bare `cotal down`. It requires a recorded mesh root; after `cotal up` records the\nmesh, it can be launched from any directory. The branded URL `http://cotal.localhost:7799/` resolves\nto loopback with no DNS setup in Chrome, Firefox, and Edge; Safari may not resolve `*.localhost`,\nso use `http://127.0.0.1:7799`. A custom `--port` uses the plain loopback address.\n\n**A god-view, minimal privilege.** The dashboard is always the full god-view; there is no\nread-only viewer mode. In auth mode it self-mints its own **admin** read cred (the scope that lets\nit tap DMs and anycast), then *drops the space signing seed* so a dashboard compromise can't mint\nidentities; it keeps only one narrow cred for its single write path. In open mode it connects bare.\nPass `--creds` to use a cred you minted yourself instead. On a per-user-auth mesh there is nothing\nto mint: the dashboard rides the read-only admin view over your login, and the channel-delete\nwrite path asks for its own channel-purger view per click (both need ledger scope `admin`;\n[identity & auth](identity-and-auth.md)).\n\nThe dashboard is read-only except that one write path: **deleting a channel and its content**\n(a filtered history purge plus the channel-registry key), which is POST-gated and confirm-guarded\nin the UI.\n\n**The views.** Every view keeps the same skeleton: navigation on the left (roster, channels,\nDMs), the selected content in the centre, the NEEDS-YOU lane always on the right.\n\n- **Monitor**: the all-activity feed (two-line messages with a delivery-mode badge, per-mode\n  filter chips, and pause), the roster (status as shape *and* colour, role, a one-line activity,\n  and the agent's harness: claude / opencode / hermes), and the golden-signal tiles\n  (working / waiting / idle / offline / oldest-unattended).\n- **Channel view**: one channel's message list, members folded into the header.\n- **Direct messages**: a per-peer roll-up (one row per peer, not the n\xB2 pair list); expand a peer\n  for its conversations.\n- **Agent Detail.** A per-agent drill-down rendered from the peer's card: name, role, the harness\n  and model, capabilities, and what it's working on or blocked on.\n- **Graph view** (`/graph`, linked from the Monitor header): the same feed as a live\n  force-directed constellation. Channels and agents are both nodes; a wire is drawn per\n  **membership** (a spoke to every channel an agent subscribes to) and glows when a message flows.\n  Membership is **broker-sourced and authoritative**, reconstructed by the delivery daemon from\n  the broker's connection view unioned with the durable-members registry, so *silent* subscribers\n  show too. A header pill reports the feed as *live*, *stale*, *traffic-only* (no daemon, e.g.\n  open mode; the graph then degrades to traffic-derived spokes), or *unreadable* \u2014 the last\n  meaning the read itself did not answer, which is a fact about the viewer rather than about the\n  mesh, and is kept distinct from *traffic-only* for exactly that reason. A **hide-offline** control\n  collapses durable-but-away members. The live feed opens as the page loads rather than after it, so\n  the pill reports the connection honestly from the first moment instead of sitting in its down\n  state for as long as the first read takes. What the feed says outranks the page's own startup reads: a\n  read issued before a live update cannot overwrite it when it lands afterwards, whether it answers\n  or refuses, so a slow link cannot make the pill contradict what the feed already reported.\n  Broker-sourced membership needs the delivery daemon (auth mode) and is provisioned on a fresh\n  `cotal up`.\n\n**When a read does not land.** A poll that fails never blanks the page. The dashboard keeps the\nlast values it actually read and marks them stale in the header, naming which source is stale and\nwhy (`stale: peers, activity`, with the server's own reason on hover); the next successful read\nreplaces the data and clears the mark. The all-activity read is bounded, so on a slow link it can\ncome back SHORT rather than late: the header then says `partial: activity`, and the page reports how\nmany sources answered out of how many were asked and names the ones that did not. A short page and a\ncomplete one are never the same bytes. On a link too slow to finish anything the honest answer is\nzero sources answered, and you keep looking at the last good data with the marker up.\n\nThe open channel's own history read is bounded by the same deadline. It is a single read, so there\nis no short page to serve: it either produced the messages or it refuses, naming the channel and the\nbound it exceeded, and the view keeps the messages it already had rather than emptying. Every one of\nthese routes takes an optional `limit`, and a value that is not a whole number is refused outright\nrather than guessed at. The same holds for the channel name in the URL: an escape the decoder cannot\nread is the caller's typo, not a broken server. Either way a malformed request is answered as a bad\nrequest and never as the dashboard having broken.\n\nA refusal names the value it received, and it renders that value so you can read it. Characters that\nwould otherwise be invisible, rearrange the text around them, or mark part of it as an annotation\ncome back as their escape in both the response and the line printed in the terminal, so what you\nread is what was actually sent. Ordinary text, accents and non-Latin scripts included, is left\nalone: a character that renders as itself is left as itself.\n\nA channel name has to be the name the mesh actually uses: dotted segments of letters, digits, `_`\nand `-`, or a `*` or `>` where the mesh reads a whole subtree. Anything else is refused rather than\nquietly rewritten, because the wire rewrites what it cannot use and two different names would then\nbe one channel. That matters most on the delete button: a name that had to be rewritten would have\npurged a channel you did not name, while the answer showed you the name you typed. Delete takes no\nwildcard at all, so the one destructive control names exactly one channel.\n\nThe delete request itself is capped at 8 KiB, which is far more than a channel name can be and far\nless than a machine can spend. A larger body is refused with a `413` naming the limit, the server\nstops reading it rather than taking it all in first and complaining afterwards, and the connection\nthat body arrived on is closed so the rest of it cannot be sent. It is never shortened to fit: a\ntrimmed name is a name you did not type, which is the thing the paragraph above exists to prevent.\nOrdinary requests keep their connection as usual.\n\n**Message bodies render Markdown** (headings, lists, **bold**, `code`, blockquotes, links) across\nthe Monitor, channel, and DM views, parsed and sanitized client-side. Agent text is untrusted, so\nraw HTML is stripped and only http(s)/mailto links survive. Long bodies still clamp to a few lines\nwith a per-message *show more*; a channel-wide **expand / collapse all** in the header opens or\ncloses every message at once.\n\nAppend `?demo` (`http://127.0.0.1:7799/?demo`) to render the design reference as a static\nshowcase with no mesh, including forward-looking elements that have no protocol backing yet\n(intent badges, approval requests, task-failed alerts). Live mode renders only what the god-view\ncan actually read.\n\n## What each surface can see\n\nEvery surface is a read-only observer; what it *sees* depends on its credential:\n\n- **console TUI** and **web** self-mint an **admin** god-view cred under auth, so both show the\n  whole space: chat, DMs, and anycast (`dmVisible: true`).\n- **`console --plain`** deliberately narrows to the chat subtree, so DMs and anycast stay\n  confidential in a line log even under an admin cred.\n- An explicit **`--creds`** scopes any surface to exactly what that cred allows; a chat-only\n  observer cred hides the DM lens.\n\nSee [identity and auth](identity-and-auth.md) for the observer vs admin scopes, and\n[MeshView](mesh-view.md) for the shared model behind all three surfaces. Normative delivery and\nvisibility rules live in the [SPEC](../SPEC.md).\n"
+      "body": "# Watch a mesh\n\n> **Guide** (informative) \xB7 **For:** operators \xB7 **Prereqs:** [Quickstart](getting-started.md)\n\nA running mesh is a stream of live activity: who is present, what they are doing, what they\nare saying to each other. Cotal gives you three read-only surfaces onto one space. All three\nrender the *same* observer model ([`MeshView`](mesh-view.md)); none opens its own connection or\nre-implements the wire. Pick by where you are:\n\n| Surface | Command | Use it to |\n|---|---|---|\n| **console (TUI)** | `cotal console` | drive it interactively in the terminal: drill into agents, channels, DMs |\n| **stream** | `cotal console --plain`, or any pipe | tail a passive line log: grep it, pipe it, watch it in CI |\n| **web dashboard** | `cotal web` | a god-view browser dashboard: see at a glance what needs a human |\n\nThe console ships with the CLI; the web dashboard is an extension (`cotal setup` installs it).\n\n## `cotal console`: the terminal view\n\n`cotal console` auto-selects its renderer: a real TTY gets the lazygit-style Ink TUI; a pipe or\n`--plain` gets the line stream. Both read from one invisible observer over the space.\n\n```bash\ncotal console --space main       # the TUI for one space\ncotal console --plain            # the passive line stream (also the default when piped)\ncotal console                    # no --space on an open mesh \u2192 the admin overview first\n```\n\n![The cotal console: a live roster of agents and their all-activity feed in a terminal TUI](../assets/quickstart.gif)\n\n**Admin overview.** On an open mesh, `cotal console` with **no `--space`** opens a space picker:\nevery space on the server (enumerated from its `CHAT_*` streams and presence buckets) with its\nagents, channels, and message counts. Pick one to drop into its console; `b` returns to the\noverview. `--space X` skips the picker. Under auth a server hosts a single space, so the console\nenters it directly (no overview).\n\n**Lenses and keys** (TUI). The layout is a roster, a live feed, per-channel tabs, a golden-signal\ntiles strip, and toggleable lenses:\n\n| Key | Does |\n|---|---|\n| `1`\u2013`9`, `[` `]` | select a channel tab |\n| `n` | the NEEDS-YOU rail: agents currently blocked or waiting |\n| `d` | the DM lens: per-peer roll-up and threads (god-view only; shows \"DMs hidden\" under chat-only creds) |\n| `t`, then `v` / `1`\u2013`3` | the topology lens: who-talks-to-whom, as a swimlane, a heat matrix, or a ring map |\n| `/` | search / filter the feed |\n| `:` | the command palette |\n| arrows / `h` `l` | move focus; select a row for its detail card |\n| `?` \xB7 `b` \xB7 `q` | help \xB7 back to overview \xB7 quit |\n\nThe stream is line-oriented, so the signals stay out of it; it is just a timestamped log of\npresence changes and messages, ready for `grep`.\n\n## `cotal web`: the browser dashboard\n\nThe dashboard ships inside `cotal-ai` as the `@cotal-ai/web` extension and is seeded automatically on\nfirst run (like the built-in connectors), so `cotal web` is there out of the box and tracks your CLI\nversion on upgrade. If a seeded copy is damaged, `cotal ext seed --repair` restores it.\n\n![The web dashboard: roster, all-activity feed, golden-signal tiles, and the NEEDS-YOU lane](../assets/dashboard.png)\n\n```bash\ncotal web --space main                       # opens http://cotal.localhost:7799/\ncotal web --space main --detach              # background; stop with cotal down web\ncotal web --space main --port 8080 --no-open\ncotal web --space main --creds ./admin.creds # use a cred you minted yourself\n```\n\nFlags: `--space` (default `main`), `--server` (the mesh's broker, resolved from the registry),\n`--port` (default `7799`), `--detach` (run in the background), `--no-open` (skip auto-launching the\nbrowser), `--creds` (override the self-minted cred). It binds loopback only. Detached mode waits for\nthe real HTTP server before returning, logs to `<mesh-root>/.cotal/web.log`, and is stopped by\n`cotal down web` or bare `cotal down`. It requires a recorded mesh root; after `cotal up` records the\nmesh, it can be launched from any directory. The branded URL `http://cotal.localhost:7799/` resolves\nto loopback with no DNS setup in Chrome, Firefox, and Edge; Safari may not resolve `*.localhost`,\nso use `http://127.0.0.1:7799`. A custom `--port` uses the plain loopback address.\n\n**The link is single-use, and the surface authenticates the caller.** Starting the dashboard prints a\nURL carrying a one-time token; opening it exchanges the token for a session cookie and the token is\nthen spent. Binding loopback keeps other *hosts* out, but it never kept out other *processes* on your\nmachine, nor a page in your own browser posting to `http://127.0.0.1:7799` \u2014 so the token is what\nmakes the session yours. Requests without it are refused with the reason named (`unauthenticated`,\n`launch-token-already-used`, or `cross-origin`) rather than silently returning nothing.\n\nPractical consequences: open the printed link in the browser you want to use it in, because the\ntoken is spent on first use \u2014 re-opening it **in another browser or profile** is refused with\n`launch-token-already-used`. (In the browser that already holds the session, re-opening the link\nstill works: the session is checked before the spent token, so the page loads on the session you\nalready have.) If you lose the line, the link is also written to `<mesh-root>/.cotal/web.session`,\nmode `0600` on every write. The session is bound to the origin you opened, so one started on\n`http://cotal.localhost` does not carry over to `http://127.0.0.1`. Restarting `cotal web` mints a\nfresh link and invalidates every earlier session.\n\n**A god-view, minimal privilege.** The dashboard is always the full god-view; there is no\nread-only viewer mode. In auth mode it self-mints its own **admin** read cred (the scope that lets\nit tap DMs and anycast), then *drops the space signing seed* so a dashboard compromise can't mint\nidentities; it keeps only one narrow cred for its single write path. In open mode it connects bare.\nPass `--creds` to use a cred you minted yourself instead. On a per-user-auth mesh there is nothing\nto mint: the dashboard rides the read-only admin view over your login, and the channel-delete\nwrite path asks for its own channel-purger view per click (both need ledger scope `admin`;\n[identity & auth](identity-and-auth.md)).\n\nThe dashboard is read-only except that one write path: **deleting a channel and its content**\n(a filtered history purge plus the channel-registry key), which is POST-gated and confirm-guarded\nin the UI.\n\n**The views.** Every view keeps the same skeleton: navigation on the left (roster, channels,\nDMs), the selected content in the centre, the NEEDS-YOU lane always on the right.\n\n- **Monitor**: the all-activity feed (two-line messages with a delivery-mode badge, per-mode\n  filter chips, and pause), the roster (status as shape *and* colour, role, a one-line activity,\n  and the agent's harness: claude / opencode / hermes), and the golden-signal tiles\n  (working / waiting / idle / offline / oldest-unattended).\n- **Channel view**: one channel's message list, members folded into the header.\n- **Direct messages**: a per-peer roll-up (one row per peer, not the n\xB2 pair list); expand a peer\n  for its conversations.\n- **Agent Detail.** A per-agent drill-down rendered from the peer's card: name, role, the harness\n  and model, capabilities, and what it's working on or blocked on.\n- **Graph view** (`/graph`, linked from the Monitor header): the same feed as a live\n  force-directed constellation. Channels and agents are both nodes; a wire is drawn per\n  **membership** (a spoke to every channel an agent subscribes to) and glows when a message flows.\n  Membership is **broker-sourced and authoritative**, reconstructed by the delivery daemon from\n  the broker's connection view unioned with the durable-members registry, so *silent* subscribers\n  show too. A header pill reports the feed as *live*, *stale*, *traffic-only* (no daemon, e.g.\n  open mode; the graph then degrades to traffic-derived spokes), or *unreadable* \u2014 the last\n  meaning the read itself did not answer, which is a fact about the viewer rather than about the\n  mesh, and is kept distinct from *traffic-only* for exactly that reason. A **hide-offline** control\n  collapses durable-but-away members. The live feed opens as the page loads rather than after it, so\n  the pill reports the connection honestly from the first moment instead of sitting in its down\n  state for as long as the first read takes. What the feed says outranks the page's own startup reads: a\n  read issued before a live update cannot overwrite it when it lands afterwards, whether it answers\n  or refuses, so a slow link cannot make the pill contradict what the feed already reported.\n  Broker-sourced membership needs the delivery daemon (auth mode) and is provisioned on a fresh\n  `cotal up`.\n\n**When a read does not land.** A poll that fails never blanks the page. The dashboard keeps the\nlast values it actually read and marks them stale in the header, naming which source is stale and\nwhy (`stale: peers, activity`, with the server's own reason on hover); the next successful read\nreplaces the data and clears the mark. The all-activity read is bounded, so on a slow link it can\ncome back SHORT rather than late: the header then says `partial: activity`, and the page reports how\nmany sources answered out of how many were asked and names the ones that did not. A short page and a\ncomplete one are never the same bytes. On a link too slow to finish anything the honest answer is\nzero sources answered, and you keep looking at the last good data with the marker up.\n\nThe open channel's own history read is bounded by the same deadline. It is a single read, so there\nis no short page to serve: it either produced the messages or it refuses, naming the channel and the\nbound it exceeded, and the view keeps the messages it already had rather than emptying. Every one of\nthese routes takes an optional `limit`, and a value that is not a whole number is refused outright\nrather than guessed at. The same holds for the channel name in the URL: an escape the decoder cannot\nread is the caller's typo, not a broken server. Either way a malformed request is answered as a bad\nrequest and never as the dashboard having broken.\n\nA refusal names the value it received, and it renders that value so you can read it. Characters that\nwould otherwise be invisible, rearrange the text around them, or mark part of it as an annotation\ncome back as their escape in both the response and the line printed in the terminal, so what you\nread is what was actually sent. Ordinary text, accents and non-Latin scripts included, is left\nalone: a character that renders as itself is left as itself.\n\nA channel name has to be the name the mesh actually uses: dotted segments of letters, digits, `_`\nand `-`, or a `*` or `>` where the mesh reads a whole subtree. Anything else is refused rather than\nquietly rewritten, because the wire rewrites what it cannot use and two different names would then\nbe one channel. That matters most on the delete button: a name that had to be rewritten would have\npurged a channel you did not name, while the answer showed you the name you typed. Delete takes no\nwildcard at all, so the one destructive control names exactly one channel.\n\nThe delete request itself is capped at 8 KiB, which is far more than a channel name can be and far\nless than a machine can spend. A larger body is refused with a `413` naming the limit, the server\nstops reading it rather than taking it all in first and complaining afterwards, and the connection\nthat body arrived on is closed so the rest of it cannot be sent. It is never shortened to fit: a\ntrimmed name is a name you did not type, which is the thing the paragraph above exists to prevent.\nOrdinary requests keep their connection as usual.\n\n**Message bodies render Markdown** (headings, lists, **bold**, `code`, blockquotes, links) across\nthe Monitor, channel, and DM views, parsed and sanitized client-side. Agent text is untrusted, so\nraw HTML is stripped and only http(s)/mailto links survive. Long bodies still clamp to a few lines\nwith a per-message *show more*; a channel-wide **expand / collapse all** in the header opens or\ncloses every message at once.\n\nAppend `?demo` (`http://127.0.0.1:7799/?demo`) to render the design reference as a static\nshowcase with no mesh, including forward-looking elements that have no protocol backing yet\n(intent badges, approval requests, task-failed alerts). Live mode renders only what the god-view\ncan actually read.\n\n## What each surface can see\n\nEvery surface is a read-only observer; what it *sees* depends on its credential:\n\n- **console TUI** and **web** self-mint an **admin** god-view cred under auth, so both show the\n  whole space: chat, DMs, and anycast (`dmVisible: true`).\n- **`console --plain`** deliberately narrows to the chat subtree, so DMs and anycast stay\n  confidential in a line log even under an admin cred.\n- An explicit **`--creds`** scopes any surface to exactly what that cred allows; a chat-only\n  observer cred hides the DM lens.\n\nSee [identity and auth](identity-and-auth.md) for the observer vs admin scopes, and\n[MeshView](mesh-view.md) for the shared model behind all three surfaces. Normative delivery and\nvisibility rules live in the [SPEC](../SPEC.md).\n"
     },
     {
       "slug": "workflows",

package/dist/standalone.js

@@ -56020,7 +56020,7 @@ config(en_default());
 
 // ../connector-core/dist/docs-bundle.generated.js
 var DOCS_BUNDLE = {
-  "version": "0.31.0",
+  "version": "0.32.0",
   "generatedFrom": "docs/*.md + SPEC.md + spec/cotal-lang.md + spec/cotal.schema.json",
   "pages": [
     {
@@ -56280,7 +56280,7 @@ var DOCS_BUNDLE = {
       "title": "Watch a mesh",
       "kind": "Guide (informative)",
       "summary": "A running mesh is a stream of live activity: who is present, what they are doing, what they are saying to each other.",
-      "body": "# Watch a mesh\n\n> **Guide** (informative) \xB7 **For:** operators \xB7 **Prereqs:** [Quickstart](getting-started.md)\n\nA running mesh is a stream of live activity: who is present, what they are doing, what they\nare saying to each other. Cotal gives you three read-only surfaces onto one space. All three\nrender the *same* observer model ([`MeshView`](mesh-view.md)); none opens its own connection or\nre-implements the wire. Pick by where you are:\n\n| Surface | Command | Use it to |\n|---|---|---|\n| **console (TUI)** | `cotal console` | drive it interactively in the terminal: drill into agents, channels, DMs |\n| **stream** | `cotal console --plain`, or any pipe | tail a passive line log: grep it, pipe it, watch it in CI |\n| **web dashboard** | `cotal web` | a god-view browser dashboard: see at a glance what needs a human |\n\nThe console ships with the CLI; the web dashboard is an extension (`cotal setup` installs it).\n\n## `cotal console`: the terminal view\n\n`cotal console` auto-selects its renderer: a real TTY gets the lazygit-style Ink TUI; a pipe or\n`--plain` gets the line stream. Both read from one invisible observer over the space.\n\n```bash\ncotal console --space main       # the TUI for one space\ncotal console --plain            # the passive line stream (also the default when piped)\ncotal console                    # no --space on an open mesh \u2192 the admin overview first\n```\n\n![The cotal console: a live roster of agents and their all-activity feed in a terminal TUI](../assets/quickstart.gif)\n\n**Admin overview.** On an open mesh, `cotal console` with **no `--space`** opens a space picker:\nevery space on the server (enumerated from its `CHAT_*` streams and presence buckets) with its\nagents, channels, and message counts. Pick one to drop into its console; `b` returns to the\noverview. `--space X` skips the picker. Under auth a server hosts a single space, so the console\nenters it directly (no overview).\n\n**Lenses and keys** (TUI). The layout is a roster, a live feed, per-channel tabs, a golden-signal\ntiles strip, and toggleable lenses:\n\n| Key | Does |\n|---|---|\n| `1`\u2013`9`, `[` `]` | select a channel tab |\n| `n` | the NEEDS-YOU rail: agents currently blocked or waiting |\n| `d` | the DM lens: per-peer roll-up and threads (god-view only; shows \"DMs hidden\" under chat-only creds) |\n| `t`, then `v` / `1`\u2013`3` | the topology lens: who-talks-to-whom, as a swimlane, a heat matrix, or a ring map |\n| `/` | search / filter the feed |\n| `:` | the command palette |\n| arrows / `h` `l` | move focus; select a row for its detail card |\n| `?` \xB7 `b` \xB7 `q` | help \xB7 back to overview \xB7 quit |\n\nThe stream is line-oriented, so the signals stay out of it; it is just a timestamped log of\npresence changes and messages, ready for `grep`.\n\n## `cotal web`: the browser dashboard\n\nThe dashboard ships inside `cotal-ai` as the `@cotal-ai/web` extension and is seeded automatically on\nfirst run (like the built-in connectors), so `cotal web` is there out of the box and tracks your CLI\nversion on upgrade. If a seeded copy is damaged, `cotal ext seed --repair` restores it.\n\n![The web dashboard: roster, all-activity feed, golden-signal tiles, and the NEEDS-YOU lane](../assets/dashboard.png)\n\n```bash\ncotal web --space main                       # opens http://cotal.localhost:7799/\ncotal web --space main --detach              # background; stop with cotal down web\ncotal web --space main --port 8080 --no-open\ncotal web --space main --creds ./admin.creds # use a cred you minted yourself\n```\n\nFlags: `--space` (default `main`), `--server` (the mesh's broker, resolved from the registry),\n`--port` (default `7799`), `--detach` (run in the background), `--no-open` (skip auto-launching the\nbrowser), `--creds` (override the self-minted cred). It binds loopback only. Detached mode waits for\nthe real HTTP server before returning, logs to `<mesh-root>/.cotal/web.log`, and is stopped by\n`cotal down web` or bare `cotal down`. It requires a recorded mesh root; after `cotal up` records the\nmesh, it can be launched from any directory. The branded URL `http://cotal.localhost:7799/` resolves\nto loopback with no DNS setup in Chrome, Firefox, and Edge; Safari may not resolve `*.localhost`,\nso use `http://127.0.0.1:7799`. A custom `--port` uses the plain loopback address.\n\n**A god-view, minimal privilege.** The dashboard is always the full god-view; there is no\nread-only viewer mode. In auth mode it self-mints its own **admin** read cred (the scope that lets\nit tap DMs and anycast), then *drops the space signing seed* so a dashboard compromise can't mint\nidentities; it keeps only one narrow cred for its single write path. In open mode it connects bare.\nPass `--creds` to use a cred you minted yourself instead. On a per-user-auth mesh there is nothing\nto mint: the dashboard rides the read-only admin view over your login, and the channel-delete\nwrite path asks for its own channel-purger view per click (both need ledger scope `admin`;\n[identity & auth](identity-and-auth.md)).\n\nThe dashboard is read-only except that one write path: **deleting a channel and its content**\n(a filtered history purge plus the channel-registry key), which is POST-gated and confirm-guarded\nin the UI.\n\n**The views.** Every view keeps the same skeleton: navigation on the left (roster, channels,\nDMs), the selected content in the centre, the NEEDS-YOU lane always on the right.\n\n- **Monitor**: the all-activity feed (two-line messages with a delivery-mode badge, per-mode\n  filter chips, and pause), the roster (status as shape *and* colour, role, a one-line activity,\n  and the agent's harness: claude / opencode / hermes), and the golden-signal tiles\n  (working / waiting / idle / offline / oldest-unattended).\n- **Channel view**: one channel's message list, members folded into the header.\n- **Direct messages**: a per-peer roll-up (one row per peer, not the n\xB2 pair list); expand a peer\n  for its conversations.\n- **Agent Detail.** A per-agent drill-down rendered from the peer's card: name, role, the harness\n  and model, capabilities, and what it's working on or blocked on.\n- **Graph view** (`/graph`, linked from the Monitor header): the same feed as a live\n  force-directed constellation. Channels and agents are both nodes; a wire is drawn per\n  **membership** (a spoke to every channel an agent subscribes to) and glows when a message flows.\n  Membership is **broker-sourced and authoritative**, reconstructed by the delivery daemon from\n  the broker's connection view unioned with the durable-members registry, so *silent* subscribers\n  show too. A header pill reports the feed as *live*, *stale*, *traffic-only* (no daemon, e.g.\n  open mode; the graph then degrades to traffic-derived spokes), or *unreadable* \u2014 the last\n  meaning the read itself did not answer, which is a fact about the viewer rather than about the\n  mesh, and is kept distinct from *traffic-only* for exactly that reason. A **hide-offline** control\n  collapses durable-but-away members. The live feed opens as the page loads rather than after it, so\n  the pill reports the connection honestly from the first moment instead of sitting in its down\n  state for as long as the first read takes. What the feed says outranks the page's own startup reads: a\n  read issued before a live update cannot overwrite it when it lands afterwards, whether it answers\n  or refuses, so a slow link cannot make the pill contradict what the feed already reported.\n  Broker-sourced membership needs the delivery daemon (auth mode) and is provisioned on a fresh\n  `cotal up`.\n\n**When a read does not land.** A poll that fails never blanks the page. The dashboard keeps the\nlast values it actually read and marks them stale in the header, naming which source is stale and\nwhy (`stale: peers, activity`, with the server's own reason on hover); the next successful read\nreplaces the data and clears the mark. The all-activity read is bounded, so on a slow link it can\ncome back SHORT rather than late: the header then says `partial: activity`, and the page reports how\nmany sources answered out of how many were asked and names the ones that did not. A short page and a\ncomplete one are never the same bytes. On a link too slow to finish anything the honest answer is\nzero sources answered, and you keep looking at the last good data with the marker up.\n\nThe open channel's own history read is bounded by the same deadline. It is a single read, so there\nis no short page to serve: it either produced the messages or it refuses, naming the channel and the\nbound it exceeded, and the view keeps the messages it already had rather than emptying. Every one of\nthese routes takes an optional `limit`, and a value that is not a whole number is refused outright\nrather than guessed at. The same holds for the channel name in the URL: an escape the decoder cannot\nread is the caller's typo, not a broken server. Either way a malformed request is answered as a bad\nrequest and never as the dashboard having broken.\n\nA refusal names the value it received, and it renders that value so you can read it. Characters that\nwould otherwise be invisible, rearrange the text around them, or mark part of it as an annotation\ncome back as their escape in both the response and the line printed in the terminal, so what you\nread is what was actually sent. Ordinary text, accents and non-Latin scripts included, is left\nalone: a character that renders as itself is left as itself.\n\nA channel name has to be the name the mesh actually uses: dotted segments of letters, digits, `_`\nand `-`, or a `*` or `>` where the mesh reads a whole subtree. Anything else is refused rather than\nquietly rewritten, because the wire rewrites what it cannot use and two different names would then\nbe one channel. That matters most on the delete button: a name that had to be rewritten would have\npurged a channel you did not name, while the answer showed you the name you typed. Delete takes no\nwildcard at all, so the one destructive control names exactly one channel.\n\nThe delete request itself is capped at 8 KiB, which is far more than a channel name can be and far\nless than a machine can spend. A larger body is refused with a `413` naming the limit, the server\nstops reading it rather than taking it all in first and complaining afterwards, and the connection\nthat body arrived on is closed so the rest of it cannot be sent. It is never shortened to fit: a\ntrimmed name is a name you did not type, which is the thing the paragraph above exists to prevent.\nOrdinary requests keep their connection as usual.\n\n**Message bodies render Markdown** (headings, lists, **bold**, `code`, blockquotes, links) across\nthe Monitor, channel, and DM views, parsed and sanitized client-side. Agent text is untrusted, so\nraw HTML is stripped and only http(s)/mailto links survive. Long bodies still clamp to a few lines\nwith a per-message *show more*; a channel-wide **expand / collapse all** in the header opens or\ncloses every message at once.\n\nAppend `?demo` (`http://127.0.0.1:7799/?demo`) to render the design reference as a static\nshowcase with no mesh, including forward-looking elements that have no protocol backing yet\n(intent badges, approval requests, task-failed alerts). Live mode renders only what the god-view\ncan actually read.\n\n## What each surface can see\n\nEvery surface is a read-only observer; what it *sees* depends on its credential:\n\n- **console TUI** and **web** self-mint an **admin** god-view cred under auth, so both show the\n  whole space: chat, DMs, and anycast (`dmVisible: true`).\n- **`console --plain`** deliberately narrows to the chat subtree, so DMs and anycast stay\n  confidential in a line log even under an admin cred.\n- An explicit **`--creds`** scopes any surface to exactly what that cred allows; a chat-only\n  observer cred hides the DM lens.\n\nSee [identity and auth](identity-and-auth.md) for the observer vs admin scopes, and\n[MeshView](mesh-view.md) for the shared model behind all three surfaces. Normative delivery and\nvisibility rules live in the [SPEC](../SPEC.md).\n"
+      "body": "# Watch a mesh\n\n> **Guide** (informative) \xB7 **For:** operators \xB7 **Prereqs:** [Quickstart](getting-started.md)\n\nA running mesh is a stream of live activity: who is present, what they are doing, what they\nare saying to each other. Cotal gives you three read-only surfaces onto one space. All three\nrender the *same* observer model ([`MeshView`](mesh-view.md)); none opens its own connection or\nre-implements the wire. Pick by where you are:\n\n| Surface | Command | Use it to |\n|---|---|---|\n| **console (TUI)** | `cotal console` | drive it interactively in the terminal: drill into agents, channels, DMs |\n| **stream** | `cotal console --plain`, or any pipe | tail a passive line log: grep it, pipe it, watch it in CI |\n| **web dashboard** | `cotal web` | a god-view browser dashboard: see at a glance what needs a human |\n\nThe console ships with the CLI; the web dashboard is an extension (`cotal setup` installs it).\n\n## `cotal console`: the terminal view\n\n`cotal console` auto-selects its renderer: a real TTY gets the lazygit-style Ink TUI; a pipe or\n`--plain` gets the line stream. Both read from one invisible observer over the space.\n\n```bash\ncotal console --space main       # the TUI for one space\ncotal console --plain            # the passive line stream (also the default when piped)\ncotal console                    # no --space on an open mesh \u2192 the admin overview first\n```\n\n![The cotal console: a live roster of agents and their all-activity feed in a terminal TUI](../assets/quickstart.gif)\n\n**Admin overview.** On an open mesh, `cotal console` with **no `--space`** opens a space picker:\nevery space on the server (enumerated from its `CHAT_*` streams and presence buckets) with its\nagents, channels, and message counts. Pick one to drop into its console; `b` returns to the\noverview. `--space X` skips the picker. Under auth a server hosts a single space, so the console\nenters it directly (no overview).\n\n**Lenses and keys** (TUI). The layout is a roster, a live feed, per-channel tabs, a golden-signal\ntiles strip, and toggleable lenses:\n\n| Key | Does |\n|---|---|\n| `1`\u2013`9`, `[` `]` | select a channel tab |\n| `n` | the NEEDS-YOU rail: agents currently blocked or waiting |\n| `d` | the DM lens: per-peer roll-up and threads (god-view only; shows \"DMs hidden\" under chat-only creds) |\n| `t`, then `v` / `1`\u2013`3` | the topology lens: who-talks-to-whom, as a swimlane, a heat matrix, or a ring map |\n| `/` | search / filter the feed |\n| `:` | the command palette |\n| arrows / `h` `l` | move focus; select a row for its detail card |\n| `?` \xB7 `b` \xB7 `q` | help \xB7 back to overview \xB7 quit |\n\nThe stream is line-oriented, so the signals stay out of it; it is just a timestamped log of\npresence changes and messages, ready for `grep`.\n\n## `cotal web`: the browser dashboard\n\nThe dashboard ships inside `cotal-ai` as the `@cotal-ai/web` extension and is seeded automatically on\nfirst run (like the built-in connectors), so `cotal web` is there out of the box and tracks your CLI\nversion on upgrade. If a seeded copy is damaged, `cotal ext seed --repair` restores it.\n\n![The web dashboard: roster, all-activity feed, golden-signal tiles, and the NEEDS-YOU lane](../assets/dashboard.png)\n\n```bash\ncotal web --space main                       # opens http://cotal.localhost:7799/\ncotal web --space main --detach              # background; stop with cotal down web\ncotal web --space main --port 8080 --no-open\ncotal web --space main --creds ./admin.creds # use a cred you minted yourself\n```\n\nFlags: `--space` (default `main`), `--server` (the mesh's broker, resolved from the registry),\n`--port` (default `7799`), `--detach` (run in the background), `--no-open` (skip auto-launching the\nbrowser), `--creds` (override the self-minted cred). It binds loopback only. Detached mode waits for\nthe real HTTP server before returning, logs to `<mesh-root>/.cotal/web.log`, and is stopped by\n`cotal down web` or bare `cotal down`. It requires a recorded mesh root; after `cotal up` records the\nmesh, it can be launched from any directory. The branded URL `http://cotal.localhost:7799/` resolves\nto loopback with no DNS setup in Chrome, Firefox, and Edge; Safari may not resolve `*.localhost`,\nso use `http://127.0.0.1:7799`. A custom `--port` uses the plain loopback address.\n\n**The link is single-use, and the surface authenticates the caller.** Starting the dashboard prints a\nURL carrying a one-time token; opening it exchanges the token for a session cookie and the token is\nthen spent. Binding loopback keeps other *hosts* out, but it never kept out other *processes* on your\nmachine, nor a page in your own browser posting to `http://127.0.0.1:7799` \u2014 so the token is what\nmakes the session yours. Requests without it are refused with the reason named (`unauthenticated`,\n`launch-token-already-used`, or `cross-origin`) rather than silently returning nothing.\n\nPractical consequences: open the printed link in the browser you want to use it in, because the\ntoken is spent on first use \u2014 re-opening it **in another browser or profile** is refused with\n`launch-token-already-used`. (In the browser that already holds the session, re-opening the link\nstill works: the session is checked before the spent token, so the page loads on the session you\nalready have.) If you lose the line, the link is also written to `<mesh-root>/.cotal/web.session`,\nmode `0600` on every write. The session is bound to the origin you opened, so one started on\n`http://cotal.localhost` does not carry over to `http://127.0.0.1`. Restarting `cotal web` mints a\nfresh link and invalidates every earlier session.\n\n**A god-view, minimal privilege.** The dashboard is always the full god-view; there is no\nread-only viewer mode. In auth mode it self-mints its own **admin** read cred (the scope that lets\nit tap DMs and anycast), then *drops the space signing seed* so a dashboard compromise can't mint\nidentities; it keeps only one narrow cred for its single write path. In open mode it connects bare.\nPass `--creds` to use a cred you minted yourself instead. On a per-user-auth mesh there is nothing\nto mint: the dashboard rides the read-only admin view over your login, and the channel-delete\nwrite path asks for its own channel-purger view per click (both need ledger scope `admin`;\n[identity & auth](identity-and-auth.md)).\n\nThe dashboard is read-only except that one write path: **deleting a channel and its content**\n(a filtered history purge plus the channel-registry key), which is POST-gated and confirm-guarded\nin the UI.\n\n**The views.** Every view keeps the same skeleton: navigation on the left (roster, channels,\nDMs), the selected content in the centre, the NEEDS-YOU lane always on the right.\n\n- **Monitor**: the all-activity feed (two-line messages with a delivery-mode badge, per-mode\n  filter chips, and pause), the roster (status as shape *and* colour, role, a one-line activity,\n  and the agent's harness: claude / opencode / hermes), and the golden-signal tiles\n  (working / waiting / idle / offline / oldest-unattended).\n- **Channel view**: one channel's message list, members folded into the header.\n- **Direct messages**: a per-peer roll-up (one row per peer, not the n\xB2 pair list); expand a peer\n  for its conversations.\n- **Agent Detail.** A per-agent drill-down rendered from the peer's card: name, role, the harness\n  and model, capabilities, and what it's working on or blocked on.\n- **Graph view** (`/graph`, linked from the Monitor header): the same feed as a live\n  force-directed constellation. Channels and agents are both nodes; a wire is drawn per\n  **membership** (a spoke to every channel an agent subscribes to) and glows when a message flows.\n  Membership is **broker-sourced and authoritative**, reconstructed by the delivery daemon from\n  the broker's connection view unioned with the durable-members registry, so *silent* subscribers\n  show too. A header pill reports the feed as *live*, *stale*, *traffic-only* (no daemon, e.g.\n  open mode; the graph then degrades to traffic-derived spokes), or *unreadable* \u2014 the last\n  meaning the read itself did not answer, which is a fact about the viewer rather than about the\n  mesh, and is kept distinct from *traffic-only* for exactly that reason. A **hide-offline** control\n  collapses durable-but-away members. The live feed opens as the page loads rather than after it, so\n  the pill reports the connection honestly from the first moment instead of sitting in its down\n  state for as long as the first read takes. What the feed says outranks the page's own startup reads: a\n  read issued before a live update cannot overwrite it when it lands afterwards, whether it answers\n  or refuses, so a slow link cannot make the pill contradict what the feed already reported.\n  Broker-sourced membership needs the delivery daemon (auth mode) and is provisioned on a fresh\n  `cotal up`.\n\n**When a read does not land.** A poll that fails never blanks the page. The dashboard keeps the\nlast values it actually read and marks them stale in the header, naming which source is stale and\nwhy (`stale: peers, activity`, with the server's own reason on hover); the next successful read\nreplaces the data and clears the mark. The all-activity read is bounded, so on a slow link it can\ncome back SHORT rather than late: the header then says `partial: activity`, and the page reports how\nmany sources answered out of how many were asked and names the ones that did not. A short page and a\ncomplete one are never the same bytes. On a link too slow to finish anything the honest answer is\nzero sources answered, and you keep looking at the last good data with the marker up.\n\nThe open channel's own history read is bounded by the same deadline. It is a single read, so there\nis no short page to serve: it either produced the messages or it refuses, naming the channel and the\nbound it exceeded, and the view keeps the messages it already had rather than emptying. Every one of\nthese routes takes an optional `limit`, and a value that is not a whole number is refused outright\nrather than guessed at. The same holds for the channel name in the URL: an escape the decoder cannot\nread is the caller's typo, not a broken server. Either way a malformed request is answered as a bad\nrequest and never as the dashboard having broken.\n\nA refusal names the value it received, and it renders that value so you can read it. Characters that\nwould otherwise be invisible, rearrange the text around them, or mark part of it as an annotation\ncome back as their escape in both the response and the line printed in the terminal, so what you\nread is what was actually sent. Ordinary text, accents and non-Latin scripts included, is left\nalone: a character that renders as itself is left as itself.\n\nA channel name has to be the name the mesh actually uses: dotted segments of letters, digits, `_`\nand `-`, or a `*` or `>` where the mesh reads a whole subtree. Anything else is refused rather than\nquietly rewritten, because the wire rewrites what it cannot use and two different names would then\nbe one channel. That matters most on the delete button: a name that had to be rewritten would have\npurged a channel you did not name, while the answer showed you the name you typed. Delete takes no\nwildcard at all, so the one destructive control names exactly one channel.\n\nThe delete request itself is capped at 8 KiB, which is far more than a channel name can be and far\nless than a machine can spend. A larger body is refused with a `413` naming the limit, the server\nstops reading it rather than taking it all in first and complaining afterwards, and the connection\nthat body arrived on is closed so the rest of it cannot be sent. It is never shortened to fit: a\ntrimmed name is a name you did not type, which is the thing the paragraph above exists to prevent.\nOrdinary requests keep their connection as usual.\n\n**Message bodies render Markdown** (headings, lists, **bold**, `code`, blockquotes, links) across\nthe Monitor, channel, and DM views, parsed and sanitized client-side. Agent text is untrusted, so\nraw HTML is stripped and only http(s)/mailto links survive. Long bodies still clamp to a few lines\nwith a per-message *show more*; a channel-wide **expand / collapse all** in the header opens or\ncloses every message at once.\n\nAppend `?demo` (`http://127.0.0.1:7799/?demo`) to render the design reference as a static\nshowcase with no mesh, including forward-looking elements that have no protocol backing yet\n(intent badges, approval requests, task-failed alerts). Live mode renders only what the god-view\ncan actually read.\n\n## What each surface can see\n\nEvery surface is a read-only observer; what it *sees* depends on its credential:\n\n- **console TUI** and **web** self-mint an **admin** god-view cred under auth, so both show the\n  whole space: chat, DMs, and anycast (`dmVisible: true`).\n- **`console --plain`** deliberately narrows to the chat subtree, so DMs and anycast stay\n  confidential in a line log even under an admin cred.\n- An explicit **`--creds`** scopes any surface to exactly what that cred allows; a chat-only\n  observer cred hides the DM lens.\n\nSee [identity and auth](identity-and-auth.md) for the observer vs admin scopes, and\n[MeshView](mesh-view.md) for the shared model behind all three surfaces. Normative delivery and\nvisibility rules live in the [SPEC](../SPEC.md).\n"
     },
     {
       "slug": "workflows",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cotal-ai/pi",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -34,8 +34,8 @@
     "esbuild": "^0.28.0",
     "typebox": "^1.1.0",
     "zod": "^4.4.3",
-    "@cotal-ai/connector-core": "0.31.0",
-    "@cotal-ai/core": "0.31.0"
+    "@cotal-ai/core": "0.32.0",
+    "@cotal-ai/connector-core": "0.32.0"
   },
   "files": [
     "dist"