@kontextmind/kxm 0.7.128 → 0.7.131

package/plugins/kxm/dist/server.js

@@ -19567,22 +19567,25 @@ function ensureWalJournalMode(database, file, description, timeoutMs = 5e3) {
     Atomics.wait(sleeper, 0, 0, 10);
   }
 }
+function assertDatabaseFile(file, description) {
+  checkedParent(file, description);
+  const stat = lstatSync2(file, { throwIfNoEntry: false });
+  if (stat) {
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw databaseError("runtime_path_invalid", description, `${description} must be a regular file, not a link or directory`);
+    }
+  }
+  for (const sidecar of [`${file}-wal`, `${file}-shm`]) {
+    const info = lstatSync2(sidecar, { throwIfNoEntry: false });
+    if (info?.isSymbolicLink()) {
+      throw databaseError("runtime_path_invalid", description, `${description} sidecar must not be a link`);
+    }
+  }
+}
 function openDatabase(file, description, spec) {
   const isMemory = file === ":memory:";
   if (!isMemory) {
-    checkedParent(file, description);
-    const stat = lstatSync2(file, { throwIfNoEntry: false });
-    if (stat) {
-      if (stat.isSymbolicLink() || !stat.isFile()) {
-        throw databaseError("runtime_path_invalid", description, `${description} must be a regular file, not a link or directory`);
-      }
-    }
-    for (const sidecar of [`${file}-wal`, `${file}-shm`]) {
-      const info = lstatSync2(sidecar, { throwIfNoEntry: false });
-      if (info?.isSymbolicLink()) {
-        throw databaseError("runtime_path_invalid", description, `${description} sidecar must not be a link`);
-      }
-    }
+    assertDatabaseFile(file, description);
   }
   const database = new DatabaseSync(file);
   let transaction = false;
@@ -19611,7 +19614,7 @@ function openDatabase(file, description, spec) {
       throw databaseError(
         "runtime_schema_outdated",
         file,
-        `${description} is schema version ${version}; this build requires ${spec.version}. Delete the state file to start fresh and let its owning process recreate it (\`kxm hub start\` for hub state, the Runtime for registry/event stores); \`kxm init\` is project-only and rebuilds no database \u2014 upgrading old state in place is deliberately unsupported`
+        `${description} is schema version ${version}; this build requires ${spec.version}. Delete the state file to start fresh and let its owning process recreate it (\`kxm hub start\` for hub state, the Runtime for event stores). The Runtime registry copy from schema 1 to 2 is the one exception. \`kxm init\` is project-only and rebuilds no database. Upgrading any other old state in place is deliberately unsupported`
       );
     }
     if (spec.tables) {

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.128",
+  "version": "0.7.131",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/skills/kxm/SKILL.md

@@ -7,7 +7,7 @@ description: Entry point for KXM, the kxm CLI and the Claude Code plugin kxm_* M
 
 Pick the skill that owns the request, then follow it. These bundled skills
 document the current CLI. They do not switch runtime YAML authority, admit
-writers, or replace `.kxm/roster.yaml` trusted policy.
+writers, or replace the trusted role and model policy.
 
 ## Route by request
 

package/plugins/kxm/skills/kxm-definitions/SKILL.md

@@ -10,6 +10,14 @@ references skills, constrains tools, and declares harness/model choices.
 A model appearing in a roster is not proof of authentication, capability,
 or permission to execute an assignment.
 
+Dispatch reads `.kxm/roles/*.yaml` and `.kxm/models/*.yaml`. An agent binds
+a role with `role:` and does not pin `harness` or `model`. An agent
+`tools.preset` must be a registered preset. Narrowing that preset against
+the role preset is not validated yet (P3). `kxm routes` prints
+admission from `.kxm/routes.yaml` and membership from the role files.
+The developer runner builds its policy object from those same files at
+`refs/remotes/origin/main`.
+
 ## Inspect Before Editing
 
 ```bash

package/plugins/kxm/src/cli/lanes.ts

@@ -1,8 +1,9 @@
 import { spawnSync } from "node:child_process";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
-import { discoverKxmProjectRoot, kxmResourceIdentifier } from "../project-config.ts";
-import { attachKxmSupervisor, ensureKxmSupervisor, kxmRuntimeRequest } from "../runtime-supervisor.ts";
+import { discoverKxmProjectRoot, kxmResourceIdentifier, loadKxmProject } from "../project-config.ts";
+import { KxmRunEventStore, KxmRuntimeRegistry, kxmProjectRunEventsPath, kxmRuntimePaths } from "../runtime-store.ts";
+import { attachKxmSupervisor, ensureKxmSupervisor, kxmRuntimeRequest, kxmSupervisorRecordIsLive } from "../runtime-supervisor.ts";
 import { print, printPlan, workspaceDirs, type Runtime } from "./types.ts";
 
 /** One worktree lane recorded in the control checkout. The sha is the base,
@@ -33,6 +34,7 @@ const LANE_SCHEMA = "kxm.lanes.v1";
 const SHA_RE = /^[a-f0-9]{40,64}$/;
 const TIMESTAMP_RE = /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,9})?Z$/;
 const SETTLED_RUN = new Set(["completed", "failed", "cancelled"]);
+const LANE_RUN_LIST_LIMIT = 10_000;
 
 function lanesFile(runtime: Runtime): string {
   return join(runtime.dirs.state, "lanes.json");
@@ -316,6 +318,65 @@ function isSettled(status: string): boolean {
   return SETTLED_RUN.has(status);
 }
 
+/** Runs in the lane event store. Undefined when the lane has no store and no supervisor list. */
+async function laneStoreRuns(runtime: Runtime, lanePath: string): Promise<Array<{ runId: string; status: string }> | undefined> {
+  const project = await import("./project.ts");
+  const request = project.kxmDriveCliSeams.runtimeRequest ?? kxmRuntimeRequest;
+  const handle = await attachKxmSupervisor({ env: runtime.env });
+  const projectId = (): string => String(loadKxmProject(lanePath, {}).project.value.id);
+  if (handle) {
+    try {
+      const result = await request(
+        handle,
+        "GET",
+        `/v1/projects/${encodeURIComponent(projectId())}/runs?projectRoot=${encodeURIComponent(lanePath)}&limit=${LANE_RUN_LIST_LIMIT}`,
+      );
+      const runs = Array.isArray(result.runs) ? result.runs : [];
+      return runs.flatMap((run) => {
+        if (!run || typeof run !== "object" || Array.isArray(run)) return [];
+        const record = run as { runId?: unknown; status?: unknown };
+        if (typeof record.runId !== "string" || record.runId.length === 0) return [];
+        const status = typeof record.status === "string" && record.status.length > 0 ? record.status : "unknown";
+        return [{ runId: record.runId, status }];
+      });
+    } catch {
+      // The supervisor could not list this root. The file read below still can.
+    }
+  }
+  const eventsPath = kxmProjectRunEventsPath(lanePath, runtime.env);
+  if (!existsSync(eventsPath)) return undefined;
+  const store = new KxmRunEventStore(eventsPath);
+  try {
+    return store.runsForProject(projectId(), LANE_RUN_LIST_LIMIT).map((run) => ({ runId: run.runId, status: run.status }));
+  } finally {
+    store.close();
+  }
+}
+
+async function refuseIfLaneStoreRunsOpen(runtime: Runtime, unit: string, command: string): Promise<number | undefined> {
+  const loaded = loadLanes(runtime, command);
+  if (typeof loaded === "number") return loaded;
+  const lane = loaded.lanes[unit];
+  if (!lane) return undefined;
+  let runs: Array<{ runId: string; status: string }> | undefined;
+  try {
+    runs = await laneStoreRuns(runtime, lane.path);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : "run list failed";
+    return refuse(runtime, command, "lane_run_open", `lane ${unit} runs could not be read: ${detail.slice(0, 200)}`, { unit });
+  }
+  if (!runs) return undefined;
+  const unsettled = runs.filter((run) => !isSettled(run.status)).map((run) => run.runId);
+  if (unsettled.length === 0) return undefined;
+  return refuse(
+    runtime,
+    command,
+    "lane_run_open",
+    `lane ${unit} run ${unsettled.join(", ")} is unsettled`,
+    { unit, runIds: unsettled },
+  );
+}
+
 export async function refuseIfLaneRunOpen(runtime: Runtime, unit: string, command: string): Promise<number | undefined> {
   const loaded = loadLanes(runtime, command);
   if (typeof loaded === "number") return loaded;
@@ -431,12 +492,49 @@ export async function cmdLaneStatus(runtime: Runtime, unit: string): Promise<num
   print(
     runtime.io,
     runtime.json,
-    { ok: true, command, lane: { ...view, status: runStatus } },
-    `${formatLaneLine(view)} status=${runStatus}`,
+    { ok: true, command, root: record.path, lane: { ...view, status: runStatus } },
+    `${formatLaneLine(view)} status=${runStatus} root=${record.path}`,
   );
   return 0;
 }
 
+/** Remove the lane root from the Runtime registry. A stopped supervisor is not
+ * an error: the row is deleted from the registry file when that file exists.
+ * The delete holds the write lock and rechecks the supervisor row; a live
+ * supervisor is left for the unregister route. */
+async function unregisterLaneRoot(runtime: Runtime, projectRoot: string, force: boolean): Promise<string | undefined> {
+  const body = force ? { projectRoot, force: true as const } : { projectRoot };
+  try {
+    const project = await import("./project.ts");
+    const request = project.kxmDriveCliSeams.runtimeRequest ?? kxmRuntimeRequest;
+    const post = async (handle: { runtimeId: string; port: number; token: string; started: boolean }): Promise<void> => {
+      await request(handle, "POST", "/v1/projects/unregister", body);
+    };
+    const handle = await attachKxmSupervisor({ env: runtime.env });
+    if (handle) {
+      await post(handle);
+      return undefined;
+    }
+    const paths = kxmRuntimePaths({ env: runtime.env });
+    if (!existsSync(paths.registryDb)) return undefined;
+    const registry = new KxmRuntimeRegistry(paths.registryDb);
+    let outcome: "removed" | "absent" | "supervisor_live";
+    try {
+      outcome = registry.unregisterProjectIfIdle(projectRoot, kxmSupervisorRecordIsLive);
+    } finally {
+      registry.close();
+    }
+    if (outcome === "supervisor_live") {
+      const live = await attachKxmSupervisor({ env: runtime.env });
+      if (!live) return "runtime supervisor is live but could not be reached";
+      await post(live);
+    }
+    return undefined;
+  } catch (error) {
+    return error instanceof Error ? error.message : "lane root could not be unregistered";
+  }
+}
+
 export async function cmdLaneDrop(runtime: Runtime, unit: string, options: { force?: boolean } = {}): Promise<number> {
   const command = "lane drop";
   const invalid = refuseUnit(runtime, command, unit);
@@ -458,16 +556,23 @@ export async function cmdLaneDrop(runtime: Runtime, unit: string, options: { for
         return refuse(runtime, command, "lane_dirty", `lane ${unit} has ${dirty} uncommitted change(s)`, { unit, dirty });
       }
     }
+    const listed = await refuseIfLaneStoreRunsOpen(runtime, unit, command);
+    if (listed !== undefined) return listed;
     const open = await refuseIfLaneRunOpen(runtime, unit, command);
     if (open !== undefined) return open;
   }
   if (runtime.dryRun) {
     printPlan(runtime, { command, unit, branchKept: record.branch }, [
+      { action: "delete", target: `runtime registry ${record.path}` },
       { action: "delete", target: record.path },
       { action: "write", target: lanesFile(runtime) },
     ], `drop lane ${unit}; branch ${record.branch} is not deleted`);
     return 0;
   }
+  const unregistered = await unregisterLaneRoot(runtime, record.path, force);
+  if (unregistered !== undefined) {
+    return refuse(runtime, command, "lane_unregister_failed", `lane ${unit} could not be unregistered: ${unregistered.slice(0, 300)}`, { unit });
+  }
   if (existsSync(record.path)) {
     const removed = git(root, ["worktree", "remove", ...(force ? ["--force"] : []), record.path]);
     if (removed.status !== 0) {

package/plugins/kxm/src/cli/project.ts

@@ -6,7 +6,7 @@ import { createInterface } from "node:readline";
 import { applyRestorePlan, createBackup, databaseError, planBackup, planRestore, type RestorePlan } from "../database.ts";
 import { readLiveHubClaim } from "../hub-autostart.ts";
 import { refreshModelInventory } from "../model-inventory.ts";
-import { listInventoryModels, listRoleBindings, loadRoutePolicy, setRouteState, updateRouteState } from "../routes.ts";
+import { listInventoryModels, listRoleBindings, loadRoutePolicy, rolesForInventoryModel, setRouteState, updateRouteState } from "../routes.ts";
 import {
   KxmConfigError,
   discoverKxmProjectRoot,
@@ -600,8 +600,8 @@ export async function cmdKxmRunStatus(runtime: Runtime, runId: string): Promise<
     print(
       runtime.io,
       runtime.json,
-      { ok: true, command: "runs status", run, ...(drive !== undefined ? { drive } : {}) },
-      `${formatRunStatusLine(run, drive)}${driveLine ? `\n${driveLine}` : ""}`,
+      { ok: true, command: "runs status", projectRoot, run, ...(drive !== undefined ? { drive } : {}) },
+      `${formatRunStatusLine(run, drive)}\nroot ${projectRoot}${driveLine ? `\n${driveLine}` : ""}`,
     );
     return 0;
   } catch (error) {
@@ -889,8 +889,7 @@ export async function cmdModelsScreen(runtime: Runtime): Promise<number> {
   try {
     while (true) {
       const policy = loadRoutePolicy(runtime.dirs.workdir);
-      const roleBindings = listRoleBindings(runtime.dirs.workdir);
-      runtime.io.stdout(models.map((m, i) => `${i + 1}. ${m} [${policy.admitted.includes(m) ? "admitted" : policy.disabled.includes(m) ? "disabled" : "unset"}] roles:${Object.entries(roleBindings).filter(([, xs]) => xs.includes(m)).map(([r]) => r).join(",") || "-"}`).join("\n") + "\n");
+      runtime.io.stdout(models.map((m, i) => `${i + 1}. ${m} [${policy.admitted.includes(m) ? "admitted" : policy.disabled.includes(m) ? "disabled" : "unset"}] roles:${rolesForInventoryModel(runtime.dirs.workdir, m).join(",") || "-"}`).join("\n") + "\n");
       const command = (await ask("[a]dmit [d]isable [r]ole-add [x]ole-remove [q]uit: ")).trim().toLowerCase();
       if (command === "q" || command === "quit") return 0;
       const index = Number.parseInt((await ask("model number: ")).trim(), 10) - 1;
@@ -910,7 +909,8 @@ export async function cmdModelsScreen(runtime: Runtime): Promise<number> {
 
 export async function cmdRouteList(runtime: Runtime): Promise<number> {
   const policy = loadRoutePolicy(runtime.dirs.workdir);
-  print(runtime.io, runtime.json, { ok: true, command: "routes list", policy }, [...policy.admitted.map((x) => `admitted ${x}`), ...policy.disabled.map((x) => `disabled ${x}`)].join("\n") || "no route decisions");
+  const membership = Object.entries(listRoleBindings(runtime.dirs.workdir)).flatMap(([role, ids]) => ids.map((id) => `${role} ${id}`));
+  print(runtime.io, runtime.json, { ok: true, command: "routes list", policy, membership }, [...policy.admitted.map((x) => `admitted ${x}`), ...policy.disabled.map((x) => `disabled ${x}`), ...membership].join("\n") || "no route decisions");
   return 0;
 }
 

package/plugins/kxm/src/database.ts

@@ -154,22 +154,27 @@ export function ensureWalJournalMode(database: DatabaseSync, file: string, descr
   }
 }
 
+/** Parent, file, and WAL sidecar must be regular filesystem objects. A symlink is refused before the file is opened. */
+export function assertDatabaseFile(file: string, description: string): void {
+  checkedParent(file, description);
+  const stat = lstatSync(file, { throwIfNoEntry: false });
+  if (stat) {
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw databaseError("runtime_path_invalid", description, `${description} must be a regular file, not a link or directory`);
+    }
+  }
+  for (const sidecar of [`${file}-wal`, `${file}-shm`]) {
+    const info = lstatSync(sidecar, { throwIfNoEntry: false });
+    if (info?.isSymbolicLink()) {
+      throw databaseError("runtime_path_invalid", description, `${description} sidecar must not be a link`);
+    }
+  }
+}
+
 export function openDatabase(file: string, description: string, spec: DatabaseSchemaSpec): DatabaseSync {
   const isMemory = file === ":memory:";
   if (!isMemory) {
-    checkedParent(file, description);
-    const stat = lstatSync(file, { throwIfNoEntry: false });
-    if (stat) {
-      if (stat.isSymbolicLink() || !stat.isFile()) {
-        throw databaseError("runtime_path_invalid", description, `${description} must be a regular file, not a link or directory`);
-      }
-    }
-    for (const sidecar of [`${file}-wal`, `${file}-shm`]) {
-      const info = lstatSync(sidecar, { throwIfNoEntry: false });
-      if (info?.isSymbolicLink()) {
-        throw databaseError("runtime_path_invalid", description, `${description} sidecar must not be a link`);
-      }
-    }
+    assertDatabaseFile(file, description);
   }
 
   const database = new DatabaseSync(file);
@@ -199,14 +204,15 @@ export function openDatabase(file: string, description: string, spec: DatabaseSc
       database.exec(spec.schema);
       database.exec(`PRAGMA user_version = ${spec.version}`);
     } else if (version < spec.version) {
-      // No migration lanes. This is a single-operator tool: an older database is
-      // re-initialised, not upgraded in place, and the code never carries two schema
-      // shapes at once. Silently accepting an older file would mean every query has to
-      // work against shapes it no longer tests.
+      // No migration lanes, except the Runtime registry copy from schema 1 to 2
+      // (migrateRegistryLanes). This is a single-operator tool: every other older
+      // database is re-initialised, not upgraded in place, and the code never carries
+      // two schema shapes at once. Silently accepting an older file would mean every
+      // query has to work against shapes it no longer tests.
       throw databaseError(
         "runtime_schema_outdated",
         file,
-        `${description} is schema version ${version}; this build requires ${spec.version}. Delete the state file to start fresh and let its owning process recreate it (\`kxm hub start\` for hub state, the Runtime for registry/event stores); \`kxm init\` is project-only and rebuilds no database — upgrading old state in place is deliberately unsupported`,
+        `${description} is schema version ${version}; this build requires ${spec.version}. Delete the state file to start fresh and let its owning process recreate it (\`kxm hub start\` for hub state, the Runtime for event stores). The Runtime registry copy from schema 1 to 2 is the one exception. \`kxm init\` is project-only and rebuilds no database. Upgrading any other old state in place is deliberately unsupported`,
       );
     }
 
@@ -628,7 +634,7 @@ export function restoreDatabaseFile(
  */
 export const KXM_BACKUP_CEILINGS = {
   "hub-store": 5,
-  registry: 1,
+  registry: 2,
   "binding-store": 1,
   events: 7,
 } as const;