@luckydraw/cumulus 0.31.65 → 1.0.0

package/LICENSE

@@ -0,0 +1,150 @@
+Cumulus Gateway Software License Agreement
+
+Copyright (c) 2026 Lucky Draw LLC. All rights reserved.
+
+This software and its accompanying documentation ("the Software") are the
+proprietary property of Lucky Draw LLC ("Licensor"). The Software is licensed,
+not sold. Except for the limited rights expressly granted below, Licensor
+reserves all right, title, and interest in and to the Software, including all
+intellectual property rights.
+
+Versions of this software published prior to 1.0.0 were released under the MIT
+License. This Agreement governs version 1.0.0 and all later versions only; it
+does not modify or revoke the terms under which any earlier version was
+obtained.
+
+---
+
+1. LIMITED FREE GRANT
+
+Subject to your compliance with this Agreement, Licensor grants you a
+non-exclusive, non-transferable, non-sublicensable, royalty-free, revocable
+license to download, install, execute, and internally evaluate the Software
+solely for:
+
+  (a) evaluation and assessment of the Software's suitability;
+  (b) development, prototyping, and testing;
+  (c) personal use; and
+  (d) other non-commercial use.
+
+This grant includes the right to run the Software on your own machines and to
+configure and integrate it for the purposes above.
+
+2. USES REQUIRING A PAID LICENSE
+
+You may NOT do any of the following without a separate written commercial
+license agreement executed with Licensor:
+
+  (a) use the Software in production, or in support of any commercial,
+      business, or revenue-generating activity;
+  (b) use the Software to provide any product or service to a third party,
+      whether or not for a fee;
+  (c) host, operate, or otherwise make the Software available to third parties
+      as a hosted, managed, or software-as-a-service offering;
+  (d) redistribute, resell, lease, lend, or otherwise transfer the Software, in
+      whole or in part, alone or bundled with other software; or
+  (e) sublicense the Software to any third party.
+
+To obtain a commercial license, contact ops@luckydrawdesign.com.
+
+3. RESTRICTIONS
+
+Under the free grant in Section 1, you may not:
+
+  (a) modify, adapt, translate, or create derivative works of the Software,
+      except as permitted by Section 3.1 (Example Code and Integration Code);
+  (b) reverse engineer, decompile, or disassemble the Software, or otherwise
+      attempt to derive its source code, except to the extent that applicable
+      law expressly permits this notwithstanding this limitation;
+  (c) remove, obscure, or alter any copyright, trademark, or other proprietary
+      notice contained in the Software;
+  (d) use Licensor's names, logos, or trademarks without prior written
+      permission; or
+  (e) disable, circumvent, or modify the license verification and demonstration
+      limits described in Section 4.
+
+3.1 EXAMPLE CODE AND INTEGRATION CODE
+
+The Software includes example, starter-kit, and template files (including,
+without limitation, everything under the "examples/" directory) that the
+Software's documentation directs you to copy into your own applications and
+edit. Notwithstanding Section 3(a), you may copy, modify, and create derivative
+works of those files, and you may distribute them as part of your own
+application, without restriction under this Agreement.
+
+You may also write, modify, and distribute your own code that configures,
+calls, or otherwise interoperates with the Software, including code that runs
+against its documented interfaces. Such code is yours.
+
+This Section grants no rights in the rest of the Software. Copying or modifying
+example code does not permit production or commercial use of the Software
+itself, which continues to require a paid agreement under Section 2, and does
+not permit anything restricted by Sections 3(b) through 3(e).
+
+4. LICENSE KEYS AND DEMONSTRATION LIMITS
+
+Without a valid license key, the Software operates in DEMONSTRATION MODE. In
+demonstration mode:
+
+  (a) each configured thread namespace may create at most five (5) distinct
+      namespaced threads; requests that would create additional namespaced
+      threads are refused. Threads that already exist continue to function, and
+      no data is deleted or withheld;
+  (b) threads outside any configured namespace are not limited; and
+  (c) the Software records its unlicensed state in its logs.
+
+A license key issued by Licensor removes these limits for the namespaces and the
+major version it names. A key is valid only for the whole-number (major) release
+for which it was issued; use with a different major release requires a new key.
+
+License verification is performed locally. The Software does not transmit usage
+information to Licensor.
+
+Nothing in this Section grants any right to use the Software beyond the free
+grant in Section 1. Demonstration mode is a convenience, not a license: use for
+any purpose listed in Section 2 requires a paid license whether or not the
+demonstration limits are reached.
+
+5. THIRD-PARTY COMPONENTS
+
+The Software depends on third-party open-source components, each governed by
+its own license. Those licenses apply to those components, not to the Software,
+and nothing in this Agreement limits your rights under them.
+
+6. TERM AND TERMINATION
+
+This Agreement takes effect when you first download, install, or use the
+Software and continues until terminated. It terminates automatically and
+immediately if you breach any term. Licensor may also terminate the free grant
+in Section 1 at any time on written notice. On termination you must cease all
+use of the Software and destroy all copies in your possession. Sections 3, 7,
+8, and 9 survive termination.
+
+7. NO WARRANTY
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NONINFRINGEMENT. LICENSOR DOES NOT
+WARRANT THAT THE SOFTWARE WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE.
+
+8. LIMITATION OF LIABILITY
+
+IN NO EVENT SHALL LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM,
+OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE. WITHOUT LIMITING THE FOREGOING, LICENSOR SHALL NOT BE LIABLE FOR ANY
+INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, OR FOR ANY
+LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL.
+
+9. GENERAL
+
+This Agreement is the entire agreement between you and Licensor regarding the
+Software and supersedes all prior understandings on its subject matter. If any
+provision is held unenforceable, it shall be modified to the minimum extent
+necessary to make it enforceable and the remaining provisions shall remain in
+full force. Licensor's failure to enforce any provision is not a waiver of it.
+
+---
+
+Lucky Draw LLC
+Licensing inquiries: ops@luckydrawdesign.com

package/README.md

@@ -9,6 +9,7 @@ Originally a CLI wrapper for Claude, Cumulus has grown into a full gateway platf
 - **Gateway daemon** (`cumulus-gateway`) — HTTP + WebSocket server with per-thread conversations, streaming responses, and an admin API.
 - **Web chat widget** — embeddable `/chat` interface with voice mode, push notifications, file uploads with progress, and rich [blex block](https://www.npmjs.com/package/@luckydraw/blex) rendering (tables, forms, charts, kanban, diagrams).
 - **Channel adapters** — Slack and Discord bots, inbound email webhooks (Resend), and generic HTTP webhooks — all injecting into the same thread model.
+- **Persistent web-app agents** — embed an agent into any web app that can _drive its UI_, answer questions about its data, and remember every conversation per visitor. See [Persistent web-app agents](#persistent-web-app-agents).
 - **Inter-agent messaging** — threads can talk to each other via `send_to_agent`, with support for CC/BCC visibility.
 - **Per-thread model selection** — Claude (via CLI) or any HuggingFace model (GLM-5, Kimi-K2.5, Qwen3, etc.) with tool calling.
 - **Scheduled triggers, email, push, media serving** — built-in MCP tools so agents can send emails, schedule themselves, notify you, and upload files.
@@ -77,9 +78,11 @@ cumulus-gateway setup --project-root ~/projects --port 8080
 # Start / stop / reload (if you skip the service install):
 cumulus-gateway start
 cumulus-gateway stop
-cumulus-gateway reload     # SIGHUP — drains active streams before restart
+cumulus-gateway reload     # graceful restart — see the note below
 ```
 
+**About `reload`:** it sends SIGHUP, which drains active streams (up to 120s) and then **exits the process**. A supervisor is what brings it back. If you installed the service, prefer your service manager — `sudo systemctl reload cumulus-gateway` (Linux) or `launchctl kickstart -k gui/$UID/com.luckydraw.cumulus` (macOS). If you started the gateway by hand, it will stay down; run `cumulus-gateway start` again.
+
 Setup writes `~/.cumulus/gateway.config.json`, generates VAPID keys for push, scaffolds a systemd (Linux) or LaunchAgent (macOS) unit, and prints the generated API key.
 
 Open `http://localhost:8080/chat`, paste the API key, and start talking. Messages hit your thread; responses stream back token-by-token.
@@ -110,7 +113,7 @@ Open `http://localhost:8080/chat`, paste the API key, and start talking. Message
 }
 ```
 
-Reload the daemon (`cumulus-gateway reload`) after editing. It waits for active streams to finish before restarting, so in-flight responses aren't dropped.
+Reload the daemon after editing (`sudo systemctl reload cumulus-gateway`, or `cumulus-gateway reload` — see the note in Quickstart). It waits for active streams to finish first, so in-flight responses aren't dropped.
 
 ## Gateway features
 
@@ -189,7 +192,7 @@ Rate-limited per thread (default 10/hour). All sends are logged to thread histor
 
 ### Reliability
 
-- **Graceful restart** — `cumulus-gateway reload` (SIGHUP) drains active Claude/HF streams up to 120s before restarting; no truncated responses on deploy.
+- **Graceful restart** — SIGHUP drains active Claude/HF streams up to 120s, then exits for the supervisor to restart; no truncated responses on deploy.
 - **Auto-resume after restart** — interrupted threads get a resume nudge on startup so the agent picks back up with full RAG context.
 - **Persistent streaming buffer** — partial responses are flushed to disk every 5s during streaming and recovered on restart.
 - **Truncation continuation** — `finish_reason: "length"` triggers max-token escalation (8k → 16k → 32k) and seamless continuation stitching.
@@ -207,6 +210,139 @@ cumulus-gateway rollback           # restores the previous version
 
 The widget's top bar also shows an "Update available" indicator (with a manual ↻ check button) when a new version lands on npm.
 
+## Persistent web-app agents
+
+Cumulus can embed a persistent agent into any web app — one that **drives the app's UI**, **answers questions about the app and its data**, and **remembers every conversation per visitor**. No fork of the gateway, no per-app backend beyond a static file server.
+
+A runnable starter kit lives in [`examples/web-app-agent`](./examples/web-app-agent) — copy it and replace the demo app with yours.
+
+### How it works
+
+```
+ Browser tab (your app)                        cumulus gateway
+┌───────────────────────────────┐             ┌──────────────────────────────────┐
+│ your app UI                   │             │  one thread per visitor:         │
+│  ├─ command registry          │   wss       │   myapp-<deviceId>               │
+│  │   (window.MyAppAgent)      │  /bridge    │   ├─ full history + RAG          │
+│  ├─ BridgeClient  ────────────┼────────────▶│   ├─ per-thread config           │
+│  ├─ agent panel (chat UI)     │   https     │   │   (inherited from            │
+│  │   POST /api/thread/…  ─────┼────────────▶│   │    myapp.config.json)        │
+│  └─ selection / right-click   │   SSE       │   └─ model turn per message      │
+│     feedback capture          │             │        └─ MCP shim ──────────────┼──┐
+└───────────────────────────────┘             └──────────────────────────────────┘  │
+                                                    ▲                               │
+                                              POST /bridge/call ◀───────────────────┘
+                                              (agent tool call → executes in the tab)
+```
+
+Three moving parts:
+
+1. **The gateway** — owns history, RAG retrieval, and prompt assembly, and runs a model turn per message. One config block per app; no code changes.
+2. **Your front end** — registers a typed **command registry** (what the agent can see and do in the UI), mounts the **bridge client** (a WebSocket back to the gateway), and renders the agent panel.
+3. **An MCP shim** — a small stdio script the gateway spawns per turn. It fetches the app's command manifest and exposes each command as a model-callable tool; calls are forwarded to `POST /bridge/call`, which dispatches them into the live browser tab.
+
+The loop that makes the agent "drive the app": the model calls a tool → shim → `POST /bridge/call` → gateway pushes `call` over the tab's WebSocket → the tab executes it through the app's own actions (so guards, routing, and notifications all still fire) → the result flows back to the model.
+
+Because the manifest is re-fetched every turn, **shipping a new UI command makes it agent-callable with zero gateway or backend changes.**
+
+### Key concepts
+
+| Concept                            | What it is                                                                                                                                             |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Namespace**                      | A config block grouping an app's threads (`myapp-*`), scoping its API key, and carrying its per-app settings (proxy, MCP servers).                     |
+| **Base thread** (`myapp`)          | Your own management thread for the app, visible only to your admin key. Never used by visitors — but it _is_ the config template they inherit.         |
+| **Visitor threads** (`myapp-<id>`) | One per browser/device, minted client-side. Full persistent history + RAG each. Hidden from the default thread list.                                   |
+| **Bridge**                         | The gateway↔tab WebSocket: the tab registers its command manifest; the gateway dispatches agent tool calls into the tab.                               |
+| **Command registry**               | The app-side catalog of typed commands (`{ name, description, params, risk, execute }`) — one capability surface shared by the UI and the agent.       |
+| **Capability-by-name**             | The security model: a scoped key can only touch threads in its namespace, can enumerate nothing, and the random thread name is the per-visitor secret. |
+
+### Gateway setup
+
+One edit to `~/.cumulus/gateway.config.json` (annotated below; the real file is strict JSON):
+
+```jsonc
+{
+  "bridge": { "enabled": true }, // global, default off — every bridge surface is inert until enabled
+
+  "namespaces": [
+    {
+      "name": "myapp", // covers threads matching myapp-*
+      "label": "My App",
+      "apiKeys": ["sk-myapp-<random>"], // the app's OWN key — mint a fresh one
+
+      // OPTIONAL: reverse-proxy selected paths to the app's backend through the
+      // gateway origin, so the front end needs only one origin.
+      "executorProxy": {
+        "origin": "http://127.0.0.1:8097",
+        "pathPrefixes": ["/state", "/journal"],
+      },
+
+      // OPTIONAL, but required for "drive the app": the MCP shim that turns the
+      // app's command manifest into model-callable tools. Spawned per turn, only
+      // for threads in this namespace. {thread} is substituted with the real
+      // thread name (myapp-<deviceId>) in both args and env.
+      "extraMcpServers": {
+        "myapp-tools": {
+          "command": "node",
+          "args": ["/path/to/myapp/mcp-shim.js"],
+          "env": {
+            "GATEWAY_ORIGIN": "http://127.0.0.1:8080",
+            "GATEWAY_API_KEY": "sk-myapp-<same-scoped-key>",
+            "BRIDGE_THREAD": "{thread}",
+          },
+        },
+      },
+    },
+  ],
+}
+```
+
+Then give visitor threads their persona and working directory via the base thread config, `~/.cumulus/threads/myapp.config.json`:
+
+```json
+{
+  "projectDir": "/home/you/projects/myapp",
+  "model": "claude",
+  "effort": "high",
+  "alwaysInclude": ["docs/myapp-system-prompt.md"]
+}
+```
+
+A turn on `myapp-a3f8c2d1` with no config of its own inherits this by prefix-fallback. Writes stay exact, so a visitor session can never mutate the base. `alwaysInclude` is where the app's product knowledge and persona live.
+
+### Front-end integration
+
+Your app ships four small pieces (all vanilla-JS-able, no framework required):
+
+| Piece                | Job                                                                                                                              |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| **Device thread id** | Mint `myapp-<random hex>` once, persist in `localStorage`. This _is_ the visitor's identity — use 16+ hex chars of entropy.      |
+| **Command registry** | Expose `window.MyAppAgent` with typed commands. Include a `describeView`-style command so the agent can read the current screen. |
+| **Bridge mount**     | Open `wss://<gateway>/bridge`, register the manifest, execute inbound `call` frames against the registry.                        |
+| **Chat client**      | `POST /api/thread/<thread>/message` and render the SSE stream. Mark risky commands so they route through a confirm step.         |
+
+Serve the gateway URL and scoped key from a **session-gated endpoint** your app already protects (`GET /api/agent-config` → `401` until the visitor is logged in), and fetch it at runtime. Never commit the key into the repo, and prefer this over injecting it into the served HTML: injected config ships the key to every visitor of the page, including anonymous ones, and it lands in caches and view-source. The starter kit in [`examples/web-app-agent`](./examples/web-app-agent) does it the gated way.
+
+### Security model
+
+The browser must hold a credential — the bridge sends its key inside a WebSocket frame, which no reverse proxy can inject. So the model is _confinement_, not concealment:
+
+- A **scoped key** can read/write only `myapp-*` threads; everything else is `403`.
+- A scoped key **enumerates nothing** — `/api/threads`, `/api/agents`, and the dashboard all return empty. Reaching another visitor's thread means guessing its random name.
+- The **thread name is the per-visitor secret**, the same capability-URL pattern as content-hashed `/media/*` filenames, one notch stricter (unguessable _and_ key-gated).
+
+Mint fresh device ids with at least 16 hex characters; 8 is too thin against a determined brute-forcer.
+
+### Checklist
+
+1. Enable `bridge` and add the namespace + scoped key to the gateway config; reload.
+2. Create the base thread config with `projectDir`, `model`, and the `alwaysInclude` system-prompt document.
+3. Verify the scoped key: in-namespace `200`, out-of-namespace `403`, `/api/threads` empty.
+4. Inject the gateway URL + scoped key into the page at serve time.
+5. Ship the device thread id, command registry, bridge mount, and chat client.
+6. Point the namespace's `extraMcpServers` shim at your manifest endpoint.
+7. End-to-end check: ask the agent a question about the current screen, then ask it to navigate.
+
 ## Classic CLI mode
 
 The original RLM chat loop still works. Great for quick terminal work without running the gateway.
@@ -291,28 +427,36 @@ All `/api/*` routes require `X-API-Key: <key>` (from `apiKeys[]`).
 
 WebSocket (`/chat/ws`) carries the same semantics with streaming, interjection, `inject`, and voice-mode audio frames.
 
-## Development
+## Upgrading
 
 ```bash
-git clone https://github.com/soapko/cumulus
-cd cumulus
-npm install
-npm run build
-npm test            # vitest
-npm run lint
-npm run type-check
+npm install -g @luckydraw/cumulus@latest
+sudo systemctl reload cumulus-gateway    # or `cumulus-gateway reload` if self-managed
 ```
 
-- **Build:** `dist/` compiled TypeScript plus static assets (widget HTML/CSS/JS, blex bundles).
-- **Tests:** vitest, 700+ tests covering agentic loop, retriever, adapters, scheduler, push.
-- **Deploy workflow:** bump version, `npm publish`, then `cumulus-gateway reload` on the host (SIGHUP drains active streams — see `docs/tasks/050-graceful-restart.md`).
+Or use the built-in updater (`cumulus-gateway update` / `rollback`), which does the same thing and keeps the previous version for a one-command rollback. See [CHANGELOG.md](./CHANGELOG.md) for release notes.
 
 ## Background
 
 Cumulus implements the **Recursive Language Model** pattern: treat conversation history as an external environment the model queries programmatically, rather than stuffing everything into context. This enables reasoning over contexts 2+ orders of magnitude beyond the model's window, with graceful cost scaling.
 
-See `docs/` for task documents, ADRs, and implementation notes.
-
 ## License
 
-MIT
+Cumulus is **proprietary software**, copyright © 2026 Lucky Draw LLC. It is licensed, not sold. See [LICENSE](./LICENSE) for the full terms — the summary:
+
+|                                        |                                                                                                                                                                                            |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Free, no agreement needed**          | Evaluation, development, prototyping, testing, personal and other non-commercial use. Install it, run it, integrate it, try it against your own app.                                       |
+| **Requires a paid commercial license** | Production use · commercial or revenue-generating use · providing a product or service to third parties · hosting it as a managed/SaaS offering · redistribution or resale · sublicensing. |
+
+**Demonstration mode.** Without a license key, cumulus runs fully but each configured thread namespace may create at most **5 namespaced threads** — enough to evaluate a web-app agent end to end, not enough to serve real visitors. Threads outside a namespace (your own threads, the CLI, the TUI) are never limited, and existing threads keep working when a namespace is at its limit. Add a key to `gateway.config.json` and reload:
+
+```json
+{ "licenseKey": "cumulus-lic-v1...." }
+```
+
+Keys are verified offline — nothing is transmitted — and are issued per whole-number release: a `1.x` key covers every `1.x.y`.
+
+Commercial licensing: **ops@luckydrawdesign.com**
+
+Versions up to and including `0.31.66` were published under the MIT License and remain available under those terms. This license applies to `1.0.0` and later.

package/dist/gateway/adapters/webchat.d.ts

@@ -14,6 +14,8 @@ export interface WebChatAdapterConfig {
     apiKeys: string[];
     /** Thread namespaces — prefix-scoped list visibility for app/test threads (task 097 P2). */
     namespaces?: NamespaceConfig[];
+    /** Lucky Draw licence key (task 127) — absent = demo mode, namespaces capped. */
+    licenseKey?: string;
     /** Gateway pipeline options (basePath, claudePath, sharedMcpPort) */
     pipelineOpts?: Partial<Pick<MessagePipelineOptions, 'basePath' | 'claudePath' | 'sharedMcpPort' | 'projectRoot' | 'gatewayAgentsConfig' | 'hfApiKey' | 'openaiApiKey' | 'models' | 'claudeModels'>>;
 }

package/dist/gateway/adapters/webchat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webchat.d.ts","sourceRoot":"","sources":["../../../src/gateway/adapters/webchat.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAe7B,OAAO,EAIL,KAAK,sBAAsB,EAE5B,MAAM,sBAAsB,CAAC;AAO9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAkBpD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,wCAAwC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,qEAAqE;IACrE,YAAY,CAAC,EAAE,OAAO,CACpB,IAAI,CACF,sBAAsB,EACpB,UAAU,GACV,YAAY,GACZ,eAAe,GACf,aAAa,GACb,qBAAqB,GACrB,UAAU,GACV,cAAc,GACd,QAAQ,GACR,cAAc,CACjB,CACF,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,oFAAoF;IACpF,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChF,6EAA6E;IAC7E,uBAAuB,EAAE,MAAM,MAAM,EAAE,CAAC;CACzC;AAoLD,mCAAmC;AACnC,wBAAgB,WAAW,IAAI,MAAM,CAGpC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CA2ET;AA2DD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,oBAAoB,CAyVvF"}
+{"version":3,"file":"webchat.d.ts","sourceRoot":"","sources":["../../../src/gateway/adapters/webchat.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAe7B,OAAO,EAIL,KAAK,sBAAsB,EAE5B,MAAM,sBAAsB,CAAC;AAS9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAqBpD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,wCAAwC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,YAAY,CAAC,EAAE,OAAO,CACpB,IAAI,CACF,sBAAsB,EACpB,UAAU,GACV,YAAY,GACZ,eAAe,GACf,aAAa,GACb,qBAAqB,GACrB,UAAU,GACV,cAAc,GACd,QAAQ,GACR,cAAc,CACjB,CACF,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,oFAAoF;IACpF,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChF,6EAA6E;IAC7E,uBAAuB,EAAE,MAAM,MAAM,EAAE,CAAC;CACzC;AAoLD,mCAAmC;AACnC,wBAAgB,WAAW,IAAI,MAAM,CAGpC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CA2ET;AA2DD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,oBAAoB,CAoXvF"}

package/dist/gateway/adapters/webchat.js

@@ -12,10 +12,12 @@ import { WebSocketServer } from 'ws';
 import { listAlwaysIncludeFiles, addAlwaysIncludeFile, removeAlwaysIncludeFile, saveThreadConfig, loadThreadConfig, } from '../../lib/config.js';
 import { loadEmbeddings, generateMissingEmbeddings } from '../../lib/embeddings.js';
 import { sendMessage, getOrCreateThread, clearThreadCache, } from '../../lib/gateway.js';
+import { verifyLicense, majorOf } from '../../lib/license.js';
 import { executeRevert } from '../../lib/revert.js';
 import { catchUpSegmentation, loadSegmentBoundaries, saveSegmentBoundaries, } from '../../lib/segments.js';
-import { allNamespaceKeys, extraMcpServersForThread, namespaceForKey, threadAccessibleToScope, threadVisibleToScope, } from '../namespaces.js';
-import { markThreadBusy, enqueueAgentMessage, formatAgentMessageForRecipient, isAgentSender, } from '../server.js';
+import { getCurrentVersion } from '../../lib/version-check.js';
+import { allNamespaceKeys, demoMintDenial, extraMcpServersForThread, namespaceForKey, threadAccessibleToScope, threadVisibleToScope, } from '../namespaces.js';
+import { markThreadBusy, enqueueAgentMessage, formatAgentMessageForRecipient, isAgentSender, demoCapMessage, listExistingThreadNames, } from '../server.js';
 import { VoiceTTSSession, isPiperAvailable, SAMPLE_RATE } from '../voice-tts.js';
 // ─── Rate limiting ───────────────────────────────────────────────────────────
 const RATE_LIMIT_WINDOW = 60_000; // 1 minute
@@ -198,6 +200,9 @@ export function createWebChatAdapter(config) {
     const { server, pipelineOpts } = config;
     const namespaces = config.namespaces ?? [];
     resolvedNamespaces = namespaces;
+    // Task 127: same offline verification as the REST server, so both transports
+    // agree. No banner here — the server logs it once for the whole gateway.
+    const licenseStatus = verifyLicense(config.licenseKey, majorOf(getCurrentVersion()));
     // Namespace-scoped keys (task 097 P2) authenticate like base keys.
     const apiKeys = Array.from(new Set([...config.apiKeys, ...allNamespaceKeys(namespaces)]));
     // Set module-level basePath for functions defined outside this closure
@@ -365,6 +370,21 @@ export function createWebChatAdapter(config) {
                 });
                 return;
             }
+            // Demo capacity gate (task 127) — the WS mirror of the REST 402. Same
+            // ordering rationale: after the access check, so occupancy never leaks to
+            // an out-of-namespace caller.
+            if (typeof wsThread === 'string' && wsThread.length > 0) {
+                const capDenial = demoMintDenial(wsThread, namespaces, listExistingThreadNames(), licenseStatus);
+                if (capDenial) {
+                    wsSend(ws, {
+                        type: 'error',
+                        error: demoCapMessage(capDenial),
+                        demoMode: true,
+                        threadName: wsThread,
+                    });
+                    return;
+                }
+            }
             // Handle history request
             if (data.type === 'history') {
                 if (data.threadName)