@kontextmind/kxm 0.7.43 → 0.7.45

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.43",
+      "version": "0.7.45",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -38,6 +38,10 @@ All notable user-facing changes are documented here. The project follows [Semant
   happens to share the product's version is left alone, and a workspace package
   with no lock entry fails loudly instead of releasing half-bumped.
 
+- **`kxm hub start` no longer generates and persists an admin token when it is
+  about to refuse** because another hub already owns the claim. A refused start
+  used to leave behind credentials the running hub never issued.
+
 ## 0.7.0 - 2026-09-11
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.43",
+  "version": "0.7.45",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.43",
+  "version": "0.7.45",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/mcp-server.js

@@ -17121,7 +17121,7 @@ async function deliverInboxNotification(messageId, delivered, notify) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.43";
+var VERSION = "0.7.45";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();
 var meshClient;

package/plugins/kxm/dist/runtime-supervisor.js

@@ -21865,7 +21865,8 @@ function openKxmRuntimeContext(projectRoot, options) {
       projectRoot: bundle.projectRoot,
       projectId: registration.projectId,
       homeRuntimeId: registration.homeRuntimeId,
-      eventStore
+      eventStore,
+      ...options.budgetClock ? { budgetClock: options.budgetClock } : {}
     };
   } catch (error) {
     registry.close();
@@ -25576,7 +25577,11 @@ function declaredRunDurationBudget(context, runId) {
     return void 0;
   }
 }
-function runDurationOverrunPayload(context, runId, nowIso = (/* @__PURE__ */ new Date()).toISOString()) {
+function budgetNowIso(context) {
+  if (process.env.KXM_DETERMINISTIC_TEST_CLOCK === "1" && context.budgetClock) return context.budgetClock();
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function runDurationOverrunPayload(context, runId, nowIso = budgetNowIso(context)) {
   const declared = declaredRunDurationBudget(context, runId);
   if (!declared) return void 0;
   const run = context.eventStore.run(runId);
@@ -25639,7 +25644,7 @@ function armRunDurationBudgetTimer(context, runId) {
   const fire = () => {
     timer = void 0;
     if (cleared || isKxmRuntimeContextClosed(context)) return;
-    const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+    const nowIso = budgetNowIso(context);
     const elapsedMs = elapsedMsBetween(state.runningSince, nowIso);
     if (elapsedMs < declared.budgetMs) {
       arm(declared.budgetMs - elapsedMs);

package/plugins/kxm/dist/runtime.js

@@ -22308,7 +22308,8 @@ function openKxmRuntimeContext(projectRoot, options) {
       projectRoot: bundle.projectRoot,
       projectId: registration.projectId,
       homeRuntimeId: registration.homeRuntimeId,
-      eventStore
+      eventStore,
+      ...options.budgetClock ? { budgetClock: options.budgetClock } : {}
     };
   } catch (error) {
     registry.close();
@@ -26088,7 +26089,11 @@ function declaredRunDurationBudget(context, runId) {
     return void 0;
   }
 }
-function runDurationOverrunPayload(context, runId, nowIso2 = (/* @__PURE__ */ new Date()).toISOString()) {
+function budgetNowIso(context) {
+  if (process.env.KXM_DETERMINISTIC_TEST_CLOCK === "1" && context.budgetClock) return context.budgetClock();
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function runDurationOverrunPayload(context, runId, nowIso2 = budgetNowIso(context)) {
   const declared = declaredRunDurationBudget(context, runId);
   if (!declared) return void 0;
   const run = context.eventStore.run(runId);
@@ -26151,7 +26156,7 @@ function armRunDurationBudgetTimer(context, runId) {
   const fire = () => {
     timer = void 0;
     if (cleared || isKxmRuntimeContextClosed(context)) return;
-    const nowIso2 = (/* @__PURE__ */ new Date()).toISOString();
+    const nowIso2 = budgetNowIso(context);
     const elapsedMs = elapsedMsBetween(state.runningSince, nowIso2);
     if (elapsedMs < declared.budgetMs) {
       arm(declared.budgetMs - elapsedMs);

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.43",
+  "version": "0.7.45",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/engine.ts

@@ -2352,10 +2352,25 @@ function declaredRunDurationBudget(context: KxmRuntimeContext, runId: string): K
   }
 }
 
+/**
+ * "Now" for run-duration budget accounting.
+ *
+ * Budgets are always measured from the log-derived `runningSince`; this only
+ * supplies the other side of that subtraction. An injected `budgetClock` is
+ * honoured only under `KXM_DETERMINISTIC_TEST_CLOCK=1`, so deterministic engine
+ * tests can pin a budget boundary while no production path — including the
+ * supervisor, which never passes a clock — can postpone a cancellation by
+ * feeding the engine a stale time.
+ */
+function budgetNowIso(context: KxmRuntimeContext): string {
+  if (process.env.KXM_DETERMINISTIC_TEST_CLOCK === "1" && context.budgetClock) return context.budgetClock();
+  return new Date().toISOString();
+}
+
 function runDurationOverrunPayload(
   context: KxmRuntimeContext,
   runId: string,
-  nowIso = new Date().toISOString(),
+  nowIso = budgetNowIso(context),
 ): { budgetMs: number; elapsedMs: number; source: KxmRunDurationBudget["source"] } | undefined {
   const declared = declaredRunDurationBudget(context, runId);
   if (!declared) return undefined;
@@ -2432,7 +2447,7 @@ function armRunDurationBudgetTimer(context: KxmRuntimeContext, runId: string): (
   const fire = (): void => {
     timer = undefined;
     if (cleared || isKxmRuntimeContextClosed(context)) return;
-    const nowIso = new Date().toISOString();
+    const nowIso = budgetNowIso(context);
     const elapsedMs = elapsedMsBetween(state.runningSince!, nowIso);
     if (elapsedMs < declared.budgetMs) {
       arm(declared.budgetMs - elapsedMs);

package/plugins/kxm/src/mcp-server.ts

@@ -8,7 +8,7 @@ import { AGENT_COMMANDS_MAP, enforceToolPolicy, getMcpTools, reconcileInbox } fr
 import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 
-const VERSION = "0.7.43";
+const VERSION = "0.7.45";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();
 let meshClient: HubClient | undefined;

package/plugins/kxm/src/runtime-service.ts

@@ -234,6 +234,18 @@ export interface KxmRuntimeContext {
   projectId: string;
   homeRuntimeId: string;
   eventStore: KxmRunEventStore;
+  /**
+   * Optional clock for **run-duration budget accounting only**. Budgets are
+   * measured from the log's `runningSince`; this answers "what time is it now"
+   * at the far end of that subtraction so engine tests can exercise a budget
+   * boundary without racing a loaded event loop.
+   *
+   * It is honoured only when `KXM_DETERMINISTIC_TEST_CLOCK=1` is set (see
+   * `budgetNowIso` in `engine.ts`), it is never consulted for event timestamps,
+   * and the Runtime supervisor does not pass one — so no production path can
+   * freeze a budget by supplying a stale clock.
+   */
+  readonly budgetClock?: () => string;
 }
 
 const closedRuntimeContexts = new WeakSet<KxmRuntimeContext>();
@@ -267,7 +279,12 @@ export function registerKxmRuntimeCloseHook(context: KxmRuntimeContext, hook: ()
  */
 export function openKxmRuntimeContext(
   projectRoot: string,
-  options: KxmConfigOptions & { stateRoot?: string; now?: string; homeRuntimeId: string },
+  options: KxmConfigOptions & {
+    stateRoot?: string;
+    now?: string;
+    homeRuntimeId: string;
+    budgetClock?: () => string;
+  },
 ): KxmRuntimeContext {
   const paths = kxmRuntimePaths(options.stateRoot !== undefined ? { stateRoot: options.stateRoot } : {});
   const registry = new KxmRuntimeRegistry(paths.registryDb);
@@ -289,6 +306,7 @@ export function openKxmRuntimeContext(
       projectId: registration.projectId,
       homeRuntimeId: registration.homeRuntimeId,
       eventStore,
+      ...(options.budgetClock ? { budgetClock: options.budgetClock } : {}),
     };
   } catch (error) {
     registry.close();

package/scripts/kxm-hub.mjs

@@ -39,6 +39,29 @@ function processExists(pid) {
   }
 }
 
+/**
+ * Live hub claim, if any. Read-only: returns the pid of a well-formed
+ * `hub.pid` claim whose wrapper is still alive, otherwise null.
+ *
+ * Claims that are missing, malformed, dead, or stale return null so the
+ * atomic `claimPidFile()` below keeps sole authority over those cases — it is
+ * the real single-instance guard and fails closed on them. This exists only so
+ * a start that is certainly going to be refused can refuse *before* it
+ * persists credentials.
+ */
+function liveHubClaimPid() {
+  let existing;
+  try {
+    existing = JSON.parse(readFileSync(pidPath, "utf8"));
+  } catch {
+    return null;
+  }
+  if (existing?.version === 1 && existing.role === "hub" && Number.isInteger(existing.pid) && processExists(existing.pid)) {
+    return existing.pid;
+  }
+  return null;
+}
+
 function parseHubEnvFile() {
   const file = join(resolveUserStateRoot(), "hub-env.json");
   let raw;
@@ -122,6 +145,19 @@ function resolveCredentials() {
   return { authToken, authTokenSource, projectTokens, projectTokensSource, file };
 }
 
+// Pre-flight: refuse a start that a live hub already owns before
+// resolveCredentials() can generate and persist an admin token that the
+// running hub never issued. `kxm hub start` used to mint the credential at
+// module load and only then report "already managed by PID <n>", leaving a
+// hub-env.json whose token no process trusts.
+try {
+  const livePid = liveHubClaimPid();
+  if (livePid) {
+    process.stderr.write(`kxm hub: KXM hub is already managed by PID ${livePid}. Run kxm hub stop before starting another hub.\n`);
+    process.exit(1);
+  }
+} catch { /* the atomic claim below still guards startup */ }
+
 let credentials;
 try {
   credentials = resolveCredentials();