@kontextmind/kxm 0.7.45 → 0.7.47

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.45",
+      "version": "0.7.47",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/docs/kb/qa-authentik-authentication.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "KB-HUB-001"
+type: "kb"
+title: "Q&A: Authentik (OIDC) for user/role/agent authentication"
+project: "kxm"
+status: "draft"
+owner: "@operator"
+created: "2026-09-17"
+updated: "2026-09-18"
+authority: "instruction"
+confidence: "reviewed"
+summary: "Yes, but not by swapping the hub's checks for OIDC — the safest hook is a token broker that exchanges Authentik identity for the kxm tokens the hub already understands."
+tags: ["hub", "authentik", "oidc", "auth"]
+related: ["docs/operations.md", "docs/kb/qa-hub-on-a-public-host.md"]
+---
+
 # Q&A: Authentik (OIDC) for user/role/agent authentication
 
 > Researched by `claude --model fable` (planner, read-only) · 2026-09-17 · task_c0bb05339e15 · root review: pending

package/docs/kb/qa-extension-install-and-hub-bootstrap.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "KB-HUB-002"
+type: "kb"
+title: "Q&A: Extension install → kxm CLI bootstrap + hub auto-connect"
+project: "kxm"
+status: "draft"
+owner: "@operator"
+created: "2026-09-17"
+updated: "2026-09-18"
+authority: "instruction"
+confidence: "reviewed"
+summary: "Extension load attempts a hub connection and can auto-start a local hub with generated keys, but it does not bootstrap a global kxm CLI and failure warnings are diagnostic rather than actionable."
+tags: ["hub", "extension", "bootstrap", "cli"]
+related: ["docs/operations.md", "docs/getting-started.md"]
+---
+
 # Q&A: Extension install → kxm CLI bootstrap + hub auto-connect
 
 > Researched by `codex gpt-5.6-sol` (reviewer-cli, read-only) · 2026-09-17 · task_634d24e1225d · root review: pending

package/docs/kb/qa-hub-on-a-public-host.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "KB-HUB-003"
+type: "kb"
+title: "Q&A: Hub on a public host — multiple users and projects?"
+project: "kxm"
+status: "draft"
+owner: "@operator"
+created: "2026-09-17"
+updated: "2026-09-18"
+authority: "instruction"
+confidence: "reviewed"
+summary: "One hub is one process and one SQLite database behind a TLS proxy; it is not multi-tenant and must never be exposed directly to the public internet."
+tags: ["hub", "deployment", "security"]
+related: ["docs/operations.md", "docs/kb/qa-authentik-authentication.md", "docs/kb/qa-what-the-hub-stores.md"]
+---
+
 # Q&A: Hub on a public host — multiple users and projects?
 
 > Researched by `claude --model fable` (planner, read-only) · 2026-09-17 · task_40b9d5015537 · root review: pending

package/docs/kb/qa-sqlite-vs-duckdb.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "KB-HUB-004"
+type: "kb"
+title: "Q&A: Storage engine — SQLite vs DuckDB"
+project: "kxm"
+status: "draft"
+owner: "@operator"
+created: "2026-09-17"
+updated: "2026-09-18"
+authority: "instruction"
+confidence: "reviewed"
+summary: "The hub already uses SQLite; there is no DuckDB in this repository, and DuckDB should not become the hub's primary store."
+tags: ["hub", "sqlite", "storage"]
+related: ["docs/operations.md", "docs/kb/qa-what-the-hub-stores.md"]
+---
+
 # Q&A: Storage engine — SQLite vs DuckDB
 
 > Answered by root from direct repo evidence · 2026-09-17 · task_279246b4dddb

package/docs/kb/qa-what-the-hub-stores.md

@@ -1,3 +1,20 @@
+---
+schema: "kxm.doc.v1"
+id: "KB-HUB-005"
+type: "kb"
+title: "Q&A: What is all stored on the hub?"
+project: "kxm"
+status: "draft"
+owner: "@operator"
+created: "2026-09-17"
+updated: "2026-09-18"
+authority: "instruction"
+confidence: "reviewed"
+summary: "The hub persists agent records, message bodies, workflow runs, journal/evidence, context items, runtime events, and raw tokens in user-state hub-env.json."
+tags: ["hub", "storage", "privacy"]
+related: ["docs/operations.md", "docs/kb/qa-sqlite-vs-duckdb.md"]
+---
+
 # Q&A: What is all stored on the hub?
 
 > Researched by `codex gpt-5.6-sol` (reviewer-cli, read-only) · 2026-09-17 · task_85bd0119c40a · root review: pending

package/docs/operations.md

@@ -18,7 +18,7 @@ kxm hub start
 ```
 
 These operator commands assume the packed release CLI installation from
-[Getting started](getting-started.md#install-the-operator-command). From a
+[Getting started](getting-started.md#1-install). From a
 source clone, use `npm run hub` instead.
 
 When `KXM_AUTH_TOKEN` is not set, `kxm hub start` loads the persisted hub
@@ -227,3 +227,11 @@ place from v0.4 databases.
 - **Rollback**: schema downgrades are not supported (a newer database refuses
   to open on an older runtime). Restore a database backup taken before the
   upgrade instead.
+
+## Hub Q&A / knowledge base
+
+- [What is all stored on the hub?](kb/qa-what-the-hub-stores.md)
+- [Storage engine — SQLite vs DuckDB](kb/qa-sqlite-vs-duckdb.md)
+- [Hub on a public host — multiple users and projects?](kb/qa-hub-on-a-public-host.md)
+- [Authentik (OIDC) for user/role/agent authentication](kb/qa-authentik-authentication.md)
+- [Extension install → kxm CLI bootstrap + hub auto-connect](kb/qa-extension-install-and-hub-bootstrap.md)

package/docs/troubleshooting.md

@@ -115,7 +115,7 @@ CLI matches source.
 `pi install git:github.com/kontextmind/kxm@main` installs the Pi extension
 and Agent Skill, not a global operator command. Install the versioned `.tgz`
 release asset through the authenticated `gh release download` flow in
-[Getting started](getting-started.md#install-the-operator-command), or run
+[Getting started](getting-started.md#1-install), or run
 `node scripts/kxm.mjs` from a clone after `npm ci`. `npx kxm` and a
 global `git+https` npm install are not supported installation paths.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.45",
+  "version": "0.7.47",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.45",
+  "version": "0.7.47",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -22051,6 +22051,8 @@ var KxmSchemaRegistry = class {
   permissionDiffValidator;
   runEventValidator;
   driveReceiptValidator;
+  coordinatorValidator;
+  intakeMessageValidator;
   constructor(schemasDir = DEFAULT_SCHEMA_DIR) {
     this.schemasDir = resolve3(schemasDir);
     this.ajv = new import__.Ajv2020({ allErrors: true, strict: true, strictRequired: false });
@@ -22068,6 +22070,8 @@ var KxmSchemaRegistry = class {
     const permissionDiffFile = "permission-diff.schema.json";
     const runEventFile = "run-event.schema.json";
     const driveReceiptFile = "drive-receipt.schema.json";
+    const coordinatorFile = "coordinator.schema.json";
+    const intakeMessageFile = "intake-message.schema.json";
     this.ajv.addSchema(readJsonObject(join6(this.schemasDir, localBindingsFile)));
     this.ajv.addSchema(readJsonObject(join6(this.schemasDir, templateProvenanceFile)));
     this.ajv.addSchema(readJsonObject(join6(this.schemasDir, initOperationFile)));
@@ -22077,6 +22081,8 @@ var KxmSchemaRegistry = class {
     this.ajv.addSchema(readJsonObject(join6(this.schemasDir, permissionDiffFile)));
     this.ajv.addSchema(readJsonObject(join6(this.schemasDir, runEventFile)));
     this.ajv.addSchema(readJsonObject(join6(this.schemasDir, driveReceiptFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, coordinatorFile)));
+    this.ajv.addSchema(readJsonObject(join6(this.schemasDir, intakeMessageFile)));
     for (const [kind, definition] of Object.entries(RESOURCE_SCHEMA)) {
       const validator = this.ajv.getSchema(`https://schemas.kxm.dev/${definition.file}`);
       if (!validator) throw new Error(`schema did not compile: ${definition.file}`);
@@ -22091,6 +22097,8 @@ var KxmSchemaRegistry = class {
     const permissionDiffValidator = this.ajv.getSchema(`https://schemas.kxm.dev/${permissionDiffFile}`);
     const runEventValidator = this.ajv.getSchema(`https://schemas.kxm.dev/${runEventFile}`);
     const driveReceiptValidator = this.ajv.getSchema(`https://schemas.kxm.dev/${driveReceiptFile}`);
+    const coordinatorValidator = this.ajv.getSchema(`https://schemas.kxm.dev/${coordinatorFile}`);
+    const intakeMessageValidator = this.ajv.getSchema(`https://schemas.kxm.dev/${intakeMessageFile}`);
     if (!localBindingsValidator) throw new Error(`schema did not compile: ${localBindingsFile}`);
     if (!templateProvenanceValidator) throw new Error(`schema did not compile: ${templateProvenanceFile}`);
     if (!initOperationValidator) throw new Error(`schema did not compile: ${initOperationFile}`);
@@ -22100,6 +22108,8 @@ var KxmSchemaRegistry = class {
     if (!permissionDiffValidator) throw new Error(`schema did not compile: ${permissionDiffFile}`);
     if (!runEventValidator) throw new Error(`schema did not compile: ${runEventFile}`);
     if (!driveReceiptValidator) throw new Error(`schema did not compile: ${driveReceiptFile}`);
+    if (!coordinatorValidator) throw new Error(`schema did not compile: ${coordinatorFile}`);
+    if (!intakeMessageValidator) throw new Error(`schema did not compile: ${intakeMessageFile}`);
     this.localBindingsValidator = localBindingsValidator;
     this.templateProvenanceValidator = templateProvenanceValidator;
     this.initOperationValidator = initOperationValidator;
@@ -22109,6 +22119,8 @@ var KxmSchemaRegistry = class {
     this.permissionDiffValidator = permissionDiffValidator;
     this.runEventValidator = runEventValidator;
     this.driveReceiptValidator = driveReceiptValidator;
+    this.coordinatorValidator = coordinatorValidator;
+    this.intakeMessageValidator = intakeMessageValidator;
   }
   validate(kind, value, file) {
     const definition = RESOURCE_SCHEMA[kind];
@@ -24018,7 +24030,7 @@ function restoreBackup(manifestPathOrDir, options = {}) {
     if (store.storeId === "registry" || store.storeId === "binding-store") {
       maxSupported = 1;
     } else if (store.storeId.startsWith("events:")) {
-      maxSupported = 4;
+      maxSupported = 5;
     }
     let targetPath = store.sourcePath;
     if (options.projectRoot && manifest.projectRoot && targetPath.startsWith(manifest.projectRoot)) {
@@ -24260,6 +24272,111 @@ var KxmRuntimeRegistry = class {
   }
 };
 var DRIVE_RECEIPT_MAX_BYTES = 8 * 1024;
+var EVENT_STORE_TABLES = {
+  runs: ["run_id", "project_id", "home_runtime_id", "workflow_id", "prompt_sha256", "status", "config_revision", "memory_revision", "executor_policy_revision", "tool_policy_revision", "created_at", "updated_at"],
+  events: ["project_id", "run_id", "sequence", "event_id", "event_type", "command_id", "occurred_at", "recorded_at", "monotonic_ns", "config_revision", "memory_revision", "executor_policy_revision", "tool_policy_revision", "payload", "schema", "home_runtime_id"],
+  commands: ["command_id", "run_id", "kind", "result", "recorded_at"],
+  run_plans: ["run_id", "run_plan_hash", "envelope", "pinned_sequence"],
+  run_state: ["run_id", "last_sequence", "state"],
+  attempt_capabilities: ["attempt_id", "run_id", "assignment_id", "step_id", "step_attempt", "producer_id", "capability_hash", "state"],
+  gate_attempts: [
+    "attempt_id",
+    "run_id",
+    "project_id",
+    "home_runtime_id",
+    "step_id",
+    "step_attempt",
+    "assignment_id",
+    "effect_id",
+    "gate_id",
+    "gate_kind",
+    "expect",
+    "gate_definition_hash",
+    "registry_hash",
+    "run_plan_hash",
+    "control_project_key",
+    "producer_id",
+    "intent_event_id",
+    "content_hash"
+  ],
+  gate_observations: [
+    "observation_id",
+    "attempt_id",
+    "run_id",
+    "project_id",
+    "home_runtime_id",
+    "step_id",
+    "step_attempt",
+    "assignment_id",
+    "effect_id",
+    "completeness",
+    "spawned",
+    "pid",
+    "exit_code",
+    "signal",
+    "exit_observed",
+    "close_observed",
+    "stop_cause",
+    "signals_attempted",
+    "error_class",
+    "stdout_sha256",
+    "stdout_bytes",
+    "stdout_complete",
+    "stderr_sha256",
+    "stderr_bytes",
+    "stderr_complete",
+    "checked_count",
+    "failed_count",
+    "elapsed_ms",
+    "started_at",
+    "finished_at",
+    "recorded_event_id",
+    "content_hash"
+  ],
+  gate_evidence: [
+    "evidence_id",
+    "attempt_id",
+    "observation_id",
+    "run_id",
+    "project_id",
+    "home_runtime_id",
+    "step_id",
+    "step_attempt",
+    "assignment_id",
+    "effect_id",
+    "evidence_key",
+    "kind",
+    "expect",
+    "outcome",
+    "settled_event_id",
+    "content_hash"
+  ],
+  drive_receipts: ["drive_id", "run_id", "project_id", "opened_sequence", "last_sequence", "closed_at", "schema", "receipt"],
+  coordinators: [
+    "coordinator_id",
+    "project_id",
+    "role",
+    "channel",
+    "ceiling_hash",
+    "config_revision",
+    "bound_at",
+    "schema",
+    "record"
+  ],
+  intake_messages: [
+    "message_id",
+    "project_id",
+    "coordinator_id",
+    "idempotency_key",
+    "content_hash",
+    "received_at",
+    "dispatch_state",
+    "schema",
+    "record"
+  ],
+  project_controls: ["project_id", "paused", "reason", "updated_at", "actor", "schema", "record"]
+};
+var KXM_EVENT_STORE_TABLE_NAMES = Object.keys(EVENT_STORE_TABLES).sort();
 
 // plugins/kxm/src/engine-compile.ts
 var KXM_COMPILED_WORKFLOW_SCHEMA = "kxm.compiled-workflow.v1";

package/plugins/kxm/dist/mcp-server.js

@@ -17121,7 +17121,7 @@ async function deliverInboxNotification(messageId, delivered, notify) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.45";
+var VERSION = "0.7.47";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();
 var meshClient;