@kontextmind/kxm 0.7.51 → 0.7.53

package/plugins/kxm/src/hub-env.ts

@@ -200,6 +200,34 @@ export function resolveHubCredentials(options: ResolveHubCredentialsOptions = {}
  * matches the credential precedence `kxm hub start` announces, so a hub
  * started fresh (generated token persisted) accepts authenticated client
  * commands without the operator exporting the token. */
+/**
+ * Can this machine authenticate to a hub at all, following the same precedence one-shot
+ * clients use: explicit `KXM_AUTH_TOKEN`, else the persisted record's admin token, else a
+ * persisted **project** token. Read-only on purpose — a refusal has to tell the operator
+ * to configure something, not reveal that the tool quietly configured it for them.
+ *
+ * Pass `project` when the caller knows which project will authenticate. A record holding
+ * only another project's token cannot authorise this one, and a guard that counts it as a
+ * credential stores a binding that will fail exactly like the one it prevented.
+ */
+export function hasClientHubCredential(env: NodeJS.ProcessEnv = process.env, project?: string): boolean {
+  if (env.KXM_AUTH_TOKEN?.trim()) return true;
+  let record: HubEnvRecord | undefined;
+  try {
+    record = readHubEnvRecord(env);
+  } catch (error) {
+    // A malformed or invalid record is a configuration failure, not "no credential".
+    // Letting it surface as an uncaught throw would print neither JSON nor prose.
+    throw new HubEnvError(
+      `${error instanceof Error ? error.message : String(error)}; refusing to guess a credential — repair or remove ${hubEnvFile(env)}`,
+    );
+  }
+  if (record?.authToken?.trim()) return true;
+  const tokens = record?.projectTokens ?? {};
+  if (project !== undefined) return typeof tokens[project] === "string" && tokens[project].trim().length > 0;
+  return Object.values(tokens).some((token) => typeof token === "string" && token.trim().length > 0);
+}
+
 export function resolveClientHubAuthToken(env: NodeJS.ProcessEnv, project: string): string | undefined {
   const envToken = env.KXM_AUTH_TOKEN?.trim();
   if (envToken) return envToken;

package/plugins/kxm/src/intake.ts

@@ -102,20 +102,15 @@ export function kxmCeilingHash(authority: KxmCoordinatorAuthority): string {
 }
 
 /**
- * Does an already-stored coordinator express this ceiling?
+ * Does a stored coordinator already express the ceiling being requested?
  *
- * A row written before set normalisation existed carries a fingerprint that
- * `kxmCeilingHash` no longer reproduces, so comparing the stored hash alone is
- * not enough: recompute over the authority it kept. Every path that asks this
- * question — the initial slot lookup and **both** lost-write read-backs — must
- * go through here, or an upgrade makes the same row equivalent on lookup and a
- * `coordinator_write_lost` conflict on the race path.
- *
- * A legacy row is returned as stored, so its `ceilingHash` is historical: a
- * caller must not assume every persisted hash uses today's algorithm.
+ * Stored fingerprint only. Recomputing the fingerprint over the stored authority — the
+ * previous behaviour — existed to tolerate rows written before set canonicalisation, and
+ * that compatibility is gone with the single-operator decision: no migration lanes, no
+ * second schema or hash shape carried forward. A stale row is re-bound, not forgiven.
  */
 function ceilingsMatch(stored: KxmCoordinatorRecord, ceilingHash: string): boolean {
-  return stored.ceilingHash === ceilingHash || kxmCeilingHash(stored.authority) === ceilingHash;
+  return stored.ceilingHash === ceilingHash;
 }
 
 function normalizeAuthority(authority: KxmCoordinatorAuthority): KxmCoordinatorAuthority {

package/plugins/kxm/src/mcp-server.ts

@@ -8,7 +8,7 @@ import { AGENT_COMMANDS_MAP, enforceToolPolicy, getMcpTools, reconcileInbox } fr
 import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 
-const VERSION = "0.7.51";
+const VERSION = "0.7.53";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();
 let meshClient: HubClient | undefined;

package/plugins/kxm/src/runtime-store.ts

@@ -782,74 +782,6 @@ CREATE TABLE project_controls (
 ) STRICT;
 `;
 
-const COORDINATOR_INTAKE_DDL = `
-CREATE TABLE IF NOT EXISTS coordinators (
-  coordinator_id TEXT PRIMARY KEY,
-  project_id TEXT NOT NULL,
-  role TEXT NOT NULL,
-  channel TEXT NOT NULL,
-  ceiling_hash TEXT NOT NULL,
-  config_revision TEXT NOT NULL,
-  bound_at TEXT NOT NULL,
-  schema TEXT NOT NULL,
-  record TEXT NOT NULL
-) STRICT;
-CREATE UNIQUE INDEX IF NOT EXISTS coordinators_slot ON coordinators(project_id, role, channel);
-CREATE TABLE IF NOT EXISTS intake_messages (
-  message_id TEXT PRIMARY KEY,
-  project_id TEXT NOT NULL,
-  coordinator_id TEXT NOT NULL,
-  idempotency_key TEXT NOT NULL,
-  content_hash TEXT NOT NULL,
-  received_at TEXT NOT NULL,
-  dispatch_state TEXT NOT NULL CHECK (dispatch_state IN ('ready','held_paused','admitted','refused')),
-  schema TEXT NOT NULL,
-  record TEXT NOT NULL
-) STRICT;
-CREATE UNIQUE INDEX IF NOT EXISTS intake_idempotency ON intake_messages(project_id, coordinator_id, idempotency_key);
-CREATE INDEX IF NOT EXISTS intake_dispatch ON intake_messages(project_id, dispatch_state, received_at, message_id);
-CREATE TABLE IF NOT EXISTS project_controls (
-  project_id TEXT PRIMARY KEY,
-  paused INTEGER NOT NULL CHECK (paused IN (0, 1)),
-  reason TEXT,
-  updated_at TEXT NOT NULL,
-  actor TEXT NOT NULL,
-  schema TEXT NOT NULL,
-  record TEXT NOT NULL
-) STRICT;
-`;
-
-const DRIVE_RECEIPTS_DDL = `
-CREATE TABLE IF NOT EXISTS drive_receipts (
-  drive_id TEXT PRIMARY KEY,
-  run_id TEXT NOT NULL,
-  project_id TEXT NOT NULL,
-  opened_sequence INTEGER NOT NULL,
-  last_sequence INTEGER NOT NULL,
-  closed_at TEXT NOT NULL,
-  schema TEXT NOT NULL,
-  receipt TEXT NOT NULL
-) STRICT;
-CREATE INDEX IF NOT EXISTS drive_receipts_run ON drive_receipts(run_id);
-`;
-
-const EVENT_STORE_MIGRATIONS = [
-  {
-    fromVersion: 3,
-    toVersion: 4,
-    migrate(database: DatabaseSync): void {
-      database.exec(DRIVE_RECEIPTS_DDL);
-    },
-  },
-  {
-    fromVersion: 4,
-    toVersion: 5,
-    migrate(database: DatabaseSync): void {
-      database.exec(COORDINATOR_INTAKE_DDL);
-    },
-  },
-];
-
 /** One persisted coordinator identity (`kxm.coordinator.v1`). */
 export interface KxmCoordinatorRow {
   coordinatorId: string;
@@ -894,7 +826,6 @@ export class KxmRunEventStore {
       schema: EVENT_STORE_SCHEMA,
       version: KXM_EVENT_STORE_SCHEMA_VERSION,
       tables: EVENT_STORE_TABLES,
-      migrations: EVENT_STORE_MIGRATIONS,
     });
   }
 

package/plugins/kxm/src/session-work.ts

@@ -42,6 +42,8 @@ export interface SessionHubStatus {
   evidence: "probed" | "bound" | "cached" | "unconfigured" | "process" | "timeout";
   online?: boolean;
   url?: string;
+  /** Loopback or remote, so a brief never reads the same on both. */
+  scope?: "loopback" | "remote";
 }
 
 export interface SessionShipStatus {
@@ -65,9 +67,13 @@ export interface SessionBrief {
 }
 
 function hubPrefix(hub?: Partial<SessionHubStatus>): string {
-  if (hub?.state === "on" || (hub?.state === undefined && hub?.online === true)) return "kxm hub:on";
-  if (hub?.state === "off" || (hub?.state === undefined && hub?.online === false)) return "kxm hub:off";
-  if (hub?.state === "unknown") return "kxm hub:unknown";
+  // A remote hub carries a bearer over a network; a loopback one does not. The JSON
+  // said so while every text surface printed the same bytes for both, which is the
+  // distinction an operator actually reads.
+  const suffix = hub?.scope === "remote" ? "/remote" : "";
+  if (hub?.state === "on" || (hub?.state === undefined && hub?.online === true)) return `kxm hub:on${suffix}`;
+  if (hub?.state === "off" || (hub?.state === undefined && hub?.online === false)) return `kxm hub:off${suffix}`;
+  if (hub?.state === "unknown") return `kxm hub:unknown${suffix}`;
   return "kxm";
 }
 

package/plugins/kxm/src/store.ts

@@ -6,7 +6,6 @@ import type { WorkflowJournalEntry, WorkflowRun } from "./workflow.ts";
 import {
   openDatabase,
   withDatabaseTransaction,
-  type DatabaseMigrationStep,
   type DatabaseSchemaSpec,
 } from "./database.ts";
 
@@ -73,101 +72,10 @@ export const HUB_STORE_SCHEMA_V3 = `
   CREATE INDEX IF NOT EXISTS context_items_project ON context_items(project);
 `;
 
-export const HUB_STORE_MIGRATIONS: readonly DatabaseMigrationStep[] = Object.freeze([
-  {
-    fromVersion: 1,
-    toVersion: 2,
-    migrate: (db: DatabaseSync) => {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS agents (
-          id TEXT PRIMARY KEY,
-          record TEXT NOT NULL
-        ) STRICT;
-        CREATE TABLE IF NOT EXISTS messages (
-          id TEXT PRIMARY KEY,
-          record TEXT NOT NULL
-        ) STRICT;
-        CREATE TABLE IF NOT EXISTS workflow_runs (
-          id TEXT PRIMARY KEY,
-          definition_id TEXT NOT NULL,
-          delivery_id TEXT NOT NULL,
-          record TEXT NOT NULL,
-          UNIQUE(definition_id, delivery_id)
-        ) STRICT;
-        CREATE TABLE IF NOT EXISTS workflow_journal (
-          id TEXT PRIMARY KEY,
-          run_id TEXT NOT NULL,
-          category TEXT NOT NULL,
-          area TEXT NOT NULL,
-          record TEXT NOT NULL
-        ) STRICT;
-        CREATE INDEX IF NOT EXISTS workflow_journal_run_id ON workflow_journal(run_id);
-      `);
-    },
-  },
-  {
-    fromVersion: 2,
-    toVersion: 3,
-    migrate: (db: DatabaseSync) => {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS agents (
-          id TEXT PRIMARY KEY,
-          record TEXT NOT NULL
-        ) STRICT;
-        CREATE TABLE IF NOT EXISTS messages (
-          id TEXT PRIMARY KEY,
-          record TEXT NOT NULL
-        ) STRICT;
-        CREATE TABLE IF NOT EXISTS workflow_runs (
-          id TEXT PRIMARY KEY,
-          definition_id TEXT NOT NULL,
-          delivery_id TEXT NOT NULL,
-          record TEXT NOT NULL,
-          UNIQUE(definition_id, delivery_id)
-        ) STRICT;
-        CREATE TABLE IF NOT EXISTS workflow_journal (
-          id TEXT PRIMARY KEY,
-          run_id TEXT NOT NULL,
-          category TEXT NOT NULL,
-          area TEXT NOT NULL,
-          record TEXT NOT NULL
-        ) STRICT;
-        CREATE INDEX IF NOT EXISTS workflow_journal_run_id ON workflow_journal(run_id);
-        CREATE TABLE IF NOT EXISTS context_items (
-          id TEXT PRIMARY KEY,
-          project TEXT NOT NULL,
-          kind TEXT NOT NULL,
-          record TEXT NOT NULL
-        ) STRICT;
-        CREATE INDEX IF NOT EXISTS context_items_project ON context_items(project);
-        CREATE UNIQUE INDEX IF NOT EXISTS messages_from_idempotency
-        ON messages(
-          json_extract(record, '$.from'),
-          json_extract(record, '$.idempotencyKey')
-        ) WHERE json_extract(record, '$.idempotencyKey') IS NOT NULL;
-        CREATE INDEX IF NOT EXISTS messages_to_seq
-        ON messages(
-          json_extract(record, '$.to'),
-          COALESCE(json_extract(record, '$.seq'), 0)
-        );
-        CREATE TABLE IF NOT EXISTS consumer_cursors (
-          agent_id TEXT PRIMARY KEY,
-          cursor INTEGER NOT NULL
-        ) STRICT;
-        CREATE TABLE IF NOT EXISTS agent_sequences (
-          agent_id TEXT PRIMARY KEY,
-          next_seq INTEGER NOT NULL
-        ) STRICT;
-      `);
-    },
-  },
-]);
-
 export const HUB_STORE_SCHEMA_SPEC: DatabaseSchemaSpec = Object.freeze({
   schema: HUB_STORE_SCHEMA_V3,
   version: HUB_STORE_SCHEMA_VERSION,
   tables: HUB_STORE_TABLES,
-  migrations: HUB_STORE_MIGRATIONS,
 });
 
 export interface StoredAgent extends AgentRecord {