agent-coord-mcp 0.13.0 → 0.15.0

package/hooks/tmux-pusher.mjs

@@ -171,6 +171,24 @@ function readJsonl(file) {
 // sender can't smuggle an arbitrary slash command past the guard below.
 const CONTROL_COMMANDS = new Set(["/clear", "/compact"]);
 
+// Shells we refuse to inject into: if the pane's foreground command is one of
+// these, the agent CLI has exited and typing would run pasted text as commands.
+const SHELL_COMMANDS = new Set(["bash", "zsh", "sh", "fish", "dash", "ksh"]);
+
+// Foreground command of the target pane, or null if it can't be determined
+// (in which case we do NOT block — fall back to the bracketed-paste protection).
+function paneCurrentCommand() {
+  const r = spawnSync("tmux", [
+    "display-message",
+    "-p",
+    "-t",
+    TMUX_TARGET,
+    "#{pane_current_command}",
+  ]);
+  if (r.status !== 0) return null;
+  return (r.stdout ?? "").toString().trim() || null;
+}
+
 function isControl(m) {
   return (
     !!m &&
@@ -328,17 +346,28 @@ async function flush() {
 // its own as a RAW line so the TUI runs it as a slash command — a banner or
 // `[DM …]` prefix would turn it into plain chat text instead.
 async function injectViaTmux(batch) {
+  // Fail-closed pane guard: never type into a pane that has dropped to a shell
+  // (crashed/exited agent CLI). Bracketed paste protects a compliant TUI, but a
+  // raw shell would execute pasted lines — so refuse and let the at-least-once
+  // cursor redeliver once the agent CLI is back.
+  const cmd = paneCurrentCommand();
+  if (cmd !== null && SHELL_COMMANDS.has(cmd)) {
+    process.stderr.write(
+      `[tmux-pusher] pane '${TMUX_TARGET}' is at a shell ('${cmd}'), not the agent CLI — skipping inject (will redeliver)\n`,
+    );
+    return;
+  }
   let run = [];
   const flushRun = async () => {
     if (run.length === 0) return;
-    await pasteAndSubmit(formatBatch(run));
+    await pasteAndSubmit(formatBatch(run), true); // peer content: inert bracketed paste
     writeReceipts(run); // stamp only AFTER the paste+submit resolves
     run = [];
   };
   for (const m of batch) {
     if (isControl(m)) {
       await flushRun();
-      await pasteAndSubmit(m.text.trim());
+      await pasteAndSubmit(m.text.trim(), false); // validated control: raw slash command
       writeReceipts([m]);
     } else {
       run.push(m);
@@ -373,7 +402,11 @@ function writeReceipts(msgs) {
   }
 }
 
-function pasteAndSubmit(payload) {
+// bracketed=true wraps the paste in bracketed-paste markers (paste-buffer -p) so
+// a compliant TUI treats the payload as inert data — embedded newlines can't
+// submit lines or smuggle a "/command". Control commands (/clear, /compact) must
+// paste RAW (bracketed=false) so the TUI still runs them as slash commands.
+function pasteAndSubmit(payload, bracketed = false) {
   return new Promise((resolve, reject) => {
     const load = spawn("tmux", ["load-buffer", "-b", BUFFER_NAME, "-"]);
     load.on("error", reject);
@@ -381,6 +414,7 @@ function pasteAndSubmit(payload) {
       if (code !== 0) return reject(new Error(`tmux load-buffer exit ${code}`));
       const paste = spawnSync("tmux", [
         "paste-buffer",
+        ...(bracketed ? ["-p"] : []),
         "-b",
         BUFFER_NAME,
         "-t",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-coord-mcp",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "File-backed MCP server for coordinating multiple AI coding agents (Claude Code, Cursor, Cline, etc.). Local stdio or networked over Streamable HTTP.",
   "type": "module",
   "bin": {

package/scripts/coord-chat.mjs

@@ -762,7 +762,7 @@ async function postStatus(status) {
 async function runDoctor(fix, emit) {
   let doctorTool;
   try {
-    ({ doctorTool } = await import(new URL("../dist/tools.js", import.meta.url)));
+    ({ doctorTool } = await import(new URL("../dist/tools/index.js", import.meta.url)));
   } catch (e) {
     emit(A.red(`/doctor unavailable: could not load the doctor tool (${e?.message ?? e}).`));
     emit(A.dim("  This build may be missing dist/ — run `npm run build` in the package."));

package/scripts/coord-node.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# coord-node.sh — one-command onboarding for a REMOTE machine to join the coord bus.
+#
+# The networked counterpart to spawn-agent.sh. spawn-agent.sh wires a LOCAL agent
+# to a bus on the same box (hooks/tmux-pusher.mjs, reads the filesystem);
+# coord-node wires a REMOTE agent to a networked bus over HTTP
+# (scripts/coord-pusher.mjs). It:
+#   1. starts a tmux session running your agent CLI,
+#   2. auto-resolves that pane's tmux target,
+#   3. launches the coord-pusher daemon pointed at the bus with this node's token.
+#
+# MVP daemon: per-node token. The operator mints a per-agent entry in the bus's
+# tokens.json and passes that token here (single-use enrollment tokens + mTLS are
+# a later step). It reuses spawn-agent.sh's tmux/pid conventions, so
+# `scripts/stop-agent.sh --id <id>` also tears a coord-node down.
+#
+# Usage:
+#   scripts/coord-node.sh --server <url> --token <tok> --id <agent-id> \
+#                         [--cmd 'claude'] [--allowlist a,b] [--no-room] [--dir <coord-dir>]
+#
+# Prefer the AGENT_COORD_TOKEN env var over --token so the secret never lands in
+# your shell history or this script's argv:
+#   AGENT_COORD_TOKEN=tk_abc scripts/coord-node.sh --server https://bus:8765/mcp --id worker-2
+
+set -euo pipefail
+
+SERVER="${AGENT_COORD_SERVER:-}"
+TOKEN="${AGENT_COORD_TOKEN:-}"
+ID=""
+CMD="claude"
+ALLOWLIST=""
+NO_ROOM=""
+COORD_DIR=""
+
+# tolerate an optional leading 'up' verb for symmetry with future subcommands
+[[ "${1:-}" == "up" ]] && shift
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --server)     SERVER="$2"; shift 2 ;;
+    --token)      TOKEN="$2"; shift 2 ;;
+    --id|--agent) ID="$2"; shift 2 ;;
+    --cmd)        CMD="$2"; shift 2 ;;
+    --allowlist)  ALLOWLIST="$2"; shift 2 ;;
+    --no-room)    NO_ROOM=1; shift ;;
+    --dir)        COORD_DIR="$2"; shift 2 ;;
+    -h|--help)    sed -n '2,29p' "$0"; exit 0 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+[[ -z "$SERVER" ]] && { echo "--server (or AGENT_COORD_SERVER) required" >&2; exit 2; }
+[[ -z "$TOKEN"  ]] && { echo "--token (or AGENT_COORD_TOKEN) required"  >&2; exit 2; }
+[[ -z "$ID"     ]] && { echo "--id required" >&2; exit 2; }
+
+command -v tmux >/dev/null || { echo "tmux not installed" >&2; exit 1; }
+command -v node >/dev/null || { echo "node not installed" >&2; exit 1; }
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PUSHER="$REPO_DIR/scripts/coord-pusher.mjs"
+[[ -f "$PUSHER" ]] || { echo "missing $PUSHER" >&2; exit 1; }
+
+ROOT="${COORD_DIR:-${AGENT_COORD_DIR:-$HOME/agent-coord}}"
+LOGDIR="$ROOT/logs"
+PIDDIR="$ROOT/pids"
+mkdir -p "$LOGDIR" "$PIDDIR"
+
+SESSION="coord-$ID"
+PID_FILE="$PIDDIR/pusher-$ID.pid"
+
+if [[ -f "$PID_FILE" ]] && kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then
+  echo "node daemon already running for '$ID' (pid $(cat "$PID_FILE"))" >&2
+  exit 0
+fi
+
+if tmux has-session -t "$SESSION" 2>/dev/null; then
+  echo "tmux session '$SESSION' already exists — attach with: tmux attach -t $SESSION" >&2
+else
+  tmux new-session -d -s "$SESSION" -n agent "$CMD"
+fi
+
+TARGET="$(tmux display-message -p -t "$SESSION:agent" '#{pane_id}')"
+[[ -n "$TARGET" ]] || { echo "failed to resolve tmux pane id" >&2; exit 1; }
+
+# Token travels via env, not argv, so it does not appear in `ps` for the daemon.
+ARGS=(--server "$SERVER" --agent "$ID" --tmux "$TARGET")
+[[ -n "$ALLOWLIST" ]] && ARGS+=(--allowlist "$ALLOWLIST")
+[[ -n "$NO_ROOM"   ]] && ARGS+=(--no-room)
+
+AGENT_COORD_TOKEN="$TOKEN" nohup node "$PUSHER" "${ARGS[@]}" \
+  >> "$LOGDIR/pusher-$ID.log" 2>&1 &
+echo $! > "$PID_FILE"
+
+echo "coord-node '$ID' up:"
+echo "  agent:  tmux attach -t $SESSION   (running: $CMD)"
+echo "  bus:    $SERVER"
+echo "  daemon: pid $(cat "$PID_FILE")  log: $LOGDIR/pusher-$ID.log"
+echo "  stop:   scripts/stop-agent.sh --id $ID"

package/scripts/coord-pusher.mjs

@@ -128,6 +128,24 @@ let sending = false;
 // Allowlisted control commands (mirrors CONTROL_COMMANDS in src/tools.ts).
 const CONTROL_COMMANDS = new Set(["/clear", "/compact"]);
 
+// Shells we refuse to inject into: if the pane's foreground command is one of
+// these, the agent CLI has exited and typing would run pasted text as commands.
+const SHELL_COMMANDS = new Set(["bash", "zsh", "sh", "fish", "dash", "ksh"]);
+
+// Foreground command of the target pane, or null if it can't be determined
+// (in which case we do NOT block — fall back to the bracketed-paste protection).
+function paneCurrentCommand() {
+  const r = spawnSync("tmux", [
+    "display-message",
+    "-p",
+    "-t",
+    TMUX_TARGET,
+    "#{pane_current_command}",
+  ]);
+  if (r.status !== 0) return null;
+  return (r.stdout ?? "").toString().trim() || null;
+}
+
 function isControl(m) {
   return (
     !!m &&
@@ -168,13 +186,23 @@ async function flush() {
   }
 }
 
+// The per-message PARSE CONTRACT line — MUST stay byte-identical to
+// hooks/tier.mjs's injectLine (agent harnesses parse from/room/text out of
+// it). Compact form (v0.14.0): `  [<kind> <HH:MM> <from>] <text>`, kind drops
+// the leading "room ", timestamp is HH:MM UTC, no "from=" label. This pusher
+// is standalone (may deploy without hooks/), so the helper is duplicated
+// rather than imported; test/tier.test.mjs locks both to the same shape.
+function injectLine(m) {
+  const tag = String(m.kind ?? "").replace(/^room /, "");
+  const d = new Date(m.ts ?? 0);
+  const hhmm = `${String(d.getUTCHours()).padStart(2, "0")}:${String(d.getUTCMinutes()).padStart(2, "0")}`;
+  return `  [${tag} ${hhmm} ${m.from}] ${m.text ?? ""}`;
+}
+
 function formatBatch(batch) {
-  const lines = [
-    "[agent-coord] incoming peer messages — already consumed from your inbox, do not call read_messages for them:",
-  ];
+  const lines = ["[agent-coord] msgs (pre-consumed, don't re-read):"];
   for (const m of batch) {
-    const ts = new Date(m.ts ?? Date.now()).toISOString();
-    lines.push(`  [${m.kind} ${ts} from=${m.from}] ${m.text ?? ""}`);
+    lines.push(injectLine(m));
   }
   return lines.join("\n");
 }
@@ -183,16 +211,27 @@ function formatBatch(batch) {
 // control command (/clear, /compact) goes in on its own as a RAW line so the
 // CLI runs it as a slash command rather than echoing it as chat text.
 async function injectViaTmux(batch) {
+  // Fail-closed pane guard: never type into a pane that has dropped to a shell
+  // (crashed/exited agent CLI). Bracketed paste protects a compliant TUI, but a
+  // raw shell would execute pasted lines — so refuse and let the at-least-once
+  // cursor redeliver once the agent CLI is back.
+  const cmd = paneCurrentCommand();
+  if (cmd !== null && SHELL_COMMANDS.has(cmd)) {
+    process.stderr.write(
+      `[coord-pusher] pane '${TMUX_TARGET}' is at a shell ('${cmd}'), not the agent CLI — skipping inject (will redeliver)\n`,
+    );
+    return;
+  }
   let run = [];
   const flushRun = async () => {
     if (run.length === 0) return;
-    await pasteAndSubmit(formatBatch(run));
+    await pasteAndSubmit(formatBatch(run), true); // peer content: inert bracketed paste
     run = [];
   };
   for (const m of batch) {
     if (isControl(m)) {
       await flushRun();
-      await pasteAndSubmit(m.text.trim());
+      await pasteAndSubmit(m.text.trim(), false); // validated control: raw slash command
     } else {
       run.push(m);
     }
@@ -200,13 +239,17 @@ async function injectViaTmux(batch) {
   await flushRun();
 }
 
-function pasteAndSubmit(payload) {
+// bracketed=true wraps the paste in bracketed-paste markers (paste-buffer -p) so
+// a compliant TUI treats the payload as inert data — embedded newlines can't
+// submit lines or smuggle a "/command". Control commands (/clear, /compact) must
+// paste RAW (bracketed=false) so the TUI still runs them as slash commands.
+function pasteAndSubmit(payload, bracketed = false) {
   return new Promise((resolve, reject) => {
     const load = spawn("tmux", ["load-buffer", "-b", BUFFER_NAME, "-"]);
     load.on("error", reject);
     load.on("exit", (code) => {
       if (code !== 0) return reject(new Error(`tmux load-buffer exit ${code}`));
-      const paste = spawnSync("tmux", ["paste-buffer", "-b", BUFFER_NAME, "-t", TMUX_TARGET, "-d"]);
+      const paste = spawnSync("tmux", ["paste-buffer", ...(bracketed ? ["-p"] : []), "-b", BUFFER_NAME, "-t", TMUX_TARGET, "-d"]);
       if (paste.status !== 0) return reject(new Error(`tmux paste-buffer: ${(paste.stderr ?? "").toString().trim()}`));
       const enter = spawnSync("tmux", ["send-keys", "-t", TMUX_TARGET, "Enter"]);
       if (enter.status !== 0) return reject(new Error(`tmux send-keys: ${(enter.stderr ?? "").toString().trim()}`));

package/scripts/coord-token.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+// coord-token — mint / list / revoke per-agent bearer tokens in tokens.json.
+//
+// Closes the operator side of low-barrier node onboarding: instead of
+// hand-editing tokens.json (and getting its perms right), mint a token for a
+// node in one command, then paste it into coord-node on that machine.
+//
+// Usage:
+//   scripts/coord-token.mjs add <agent-id>       mint (or rotate) a token, print it
+//   scripts/coord-token.mjs list                 list agent ids (never prints tokens)
+//   scripts/coord-token.mjs revoke <agent-id>    remove a token
+//   [--dir <coord-dir>]                          override AGENT_COORD_DIR
+//
+// tokens.json is created 0600 (and re-chmod'd on every write) so secrets are
+// never group/other-readable. After add/revoke, SIGHUP the running bus to
+// reload its token map (kill -HUP <bus-pid>).
+
+import { randomBytes } from "node:crypto";
+import {
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  chmodSync,
+  mkdirSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+
+const argv = process.argv.slice(2);
+function opt(name) {
+  const i = argv.indexOf(name);
+  return i >= 0 ? argv[i + 1] : undefined;
+}
+function die(msg) {
+  process.stderr.write(`coord-token: ${msg}\n`);
+  process.exit(1);
+}
+
+// Must match store.ts ROOT/TOKENS_FILE resolution exactly, or we'd write a file
+// the bus never reads.
+const ROOT =
+  opt("--dir") ??
+  process.env.AGENT_COORD_DIR ??
+  process.env.CLAUDE_COORD_DIR ??
+  path.join(homedir(), "agent-coord");
+const TOKENS_FILE = path.join(ROOT, "tokens.json");
+
+const AGENT_ID_RE = /^[a-zA-Z0-9._-]{1,64}$/;
+
+function load() {
+  if (!existsSync(TOKENS_FILE)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(TOKENS_FILE, "utf8"));
+  } catch (e) {
+    die(`${TOKENS_FILE} is not valid JSON: ${e.message}`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    die(`${TOKENS_FILE} must be a JSON object of { "agent-id": "token" }`);
+  }
+  return parsed;
+}
+
+function save(map) {
+  mkdirSync(ROOT, { recursive: true, mode: 0o700 });
+  writeFileSync(TOKENS_FILE, JSON.stringify(map, null, 2) + "\n", {
+    mode: 0o600,
+  });
+  chmodSync(TOKENS_FILE, 0o600); // enforce even when the file pre-existed looser
+}
+
+const positional = argv.filter((a) => !a.startsWith("--"));
+const cmd = positional[0];
+const id = positional[1];
+
+switch (cmd) {
+  case "add": {
+    if (!id || !AGENT_ID_RE.test(id)) {
+      die("usage: coord-token add <agent-id>  (id: [a-zA-Z0-9._-], <=64 chars)");
+    }
+    const map = load();
+    const rotating = id in map;
+    const token = "tk_" + randomBytes(24).toString("base64url");
+    // Guard the astronomically unlikely collision that would collapse two
+    // identities onto one token in the bus's reverse map.
+    if (Object.values(map).includes(token)) die("token collision — rerun");
+    map[id] = token;
+    save(map);
+    process.stderr.write(
+      `${rotating ? "rotated" : "minted"} token for '${id}' in ${TOKENS_FILE}\n`,
+    );
+    process.stderr.write(
+      `SIGHUP the running bus to load it (kill -HUP <bus-pid>), then on the node:\n` +
+        `  AGENT_COORD_TOKEN=${token} scripts/coord-node.sh --server <url> --id ${id} --cmd claude\n`,
+    );
+    process.stdout.write(token + "\n"); // token alone on stdout, pipe/capture-friendly
+    break;
+  }
+  case "list": {
+    const ids = Object.keys(load());
+    if (ids.length === 0) {
+      process.stderr.write("no tokens configured\n");
+      break;
+    }
+    for (const a of ids) process.stdout.write(a + "\n");
+    break;
+  }
+  case "revoke": {
+    if (!id) die("usage: coord-token revoke <agent-id>");
+    const map = load();
+    if (!(id in map)) die(`no token for '${id}'`);
+    delete map[id];
+    save(map);
+    process.stderr.write(`revoked '${id}'. SIGHUP the bus to apply.\n`);
+    break;
+  }
+  default:
+    process.stderr.write(
+      "coord-token — per-agent bus tokens\n" +
+        "  coord-token add <agent-id>     mint/rotate a token (prints it)\n" +
+        "  coord-token list               list agent ids\n" +
+        "  coord-token revoke <agent-id>  remove a token\n" +
+        "  [--dir <coord-dir>]\n",
+    );
+    process.exit(cmd ? 1 : 0);
+}

package/src/server.ts

@@ -62,7 +62,7 @@ import {
   quitTool,
   waitForMessageSchema,
   waitForMessageTool,
-} from "./tools.js";
+} from "./tools/index.js";
 
 function jsonResult(data: unknown) {
   return {
@@ -186,7 +186,7 @@ function buildServer(initialBound?: string): McpServer {
 
   server.tool(
     "send_message",
-    "Send a message. If 'to' is set, goes to that agent's inbox (DM); otherwise to a channel — pass 'room' (e.g. 'seo' or '#seo') to target a specific channel, or omit it for the default 'general' channel. The 'from' field is enforced against the session's bound identity when binding is configured.",
+    "Send a message. If 'to' is set, goes to that agent's inbox (DM); otherwise to a channel — pass 'room' (e.g. 'seo' or '#seo') to target a specific channel, or omit it for the default 'general' channel. For channel posts, tag 'kind': 'decision' for GOs/verdicts/agreements that must outlive routine cleanup (kept ~30 days, quoted verbatim in digests), 'status' for progress notes, omit for ordinary chatter. The 'from' field is enforced against the session's bound identity when binding is configured.",
     sendMessageSchema,
     gate("from", sendMessageTool as (a: Record<string, unknown>) => Promise<unknown>),
   );
@@ -221,7 +221,7 @@ function buildServer(initialBound?: string): McpServer {
 
   server.tool(
     "prune",
-    "Trim room/status/inbox JSONL to entries newer than `olderThanDays` (default 7). Removes inbox files for agents no longer in the registry unless removeOrphanInboxes=false. Pass dryRun=true to preview.",
+    "Trim room/status/inbox JSONL to entries newer than `olderThanDays` (default 7); kind='decision' posts keep a longer `decisionDays` retention (default 30). Nothing is lost: aged-out entries are archived under archive/ (rooms/<chan>.jsonl, status.jsonl, inbox/<agent>.jsonl) — only receipts are truly deleted. Pass `room` to prune a single channel, or `targets` (rooms|status|inbox|receipts|members) to narrow the sweep. Sweeps room members that are unregistered or haven't heartbeated since the cutoff, and archives+removes non-default rooms left empty and inactive (disable via archiveEmptyRooms=false). Removes inbox files for agents no longer in the registry unless removeOrphanInboxes=false. Pass dryRun=true to preview.",
     pruneSchema,
     gate(null, pruneTool as (a: Record<string, unknown>) => Promise<unknown>),
   );
@@ -422,12 +422,41 @@ async function startHttp(port: number): Promise<void> {
   const bindAddr = process.env.AGENT_COORD_BIND ?? "127.0.0.1";
   const sharedExpected = sharedToken ? `Bearer ${sharedToken}` : null;
 
+  // Fail-closed network gate. A non-loopback bind is a real network listener, so
+  // it must have (a) enforced per-agent identity and (b) a secured transport. We
+  // refuse rather than warn: a shared/advisory token lets any node impersonate
+  // any agent, and plaintext leaks bearer tokens to anyone on the path.
+  const isLoopbackBind =
+    bindAddr === "127.0.0.1" || bindAddr === "localhost" || bindAddr === "::1";
+  if (!isLoopbackBind) {
+    if (!bound) {
+      console.error(
+        `[agent-coord-mcp] refusing to bind ${bindAddr} without per-agent tokens: a ` +
+          `shared/advisory token lets any node impersonate any agent. Create ` +
+          `~/agent-coord/tokens.json (per-agent, enforced identity) for network binds.`,
+      );
+      process.exit(1);
+    }
+    if (process.env.AGENT_COORD_INSECURE !== "1") {
+      console.error(
+        `[agent-coord-mcp] refusing plaintext bind to ${bindAddr}: bearer tokens would ` +
+          `travel in cleartext. Put the bus behind TLS or a private overlay ` +
+          `(Tailscale/WireGuard), then set AGENT_COORD_INSECURE=1 to acknowledge the ` +
+          `transport is secured out-of-band.`,
+      );
+      process.exit(1);
+    }
+  }
+
   // One transport+server pair per client session. The SDK exposes session
   // affinity via the `mcp-session-id` header: a new request without it is
   // an init (create new pair); follow-ups carry the id (look up the pair).
   // We cannot share one stateful transport across clients (it errors with
   // "Server already initialized"), and stateless mode rejects reuse.
   const sessions = new Map<string, StreamableHTTPServerTransport>();
+  // Which bound agent each session id belongs to, so a session can't be driven
+  // by a *different* bearer that merely presents its id (session hijack).
+  const sessionAgents = new Map<string, string | undefined>();
 
   async function makeSessionTransport(boundAgent?: string): Promise<StreamableHTTPServerTransport> {
     // `let` + explicit type lets the SDK callbacks close over the binding
@@ -435,10 +464,16 @@ async function startHttp(port: number): Promise<void> {
     let transport: StreamableHTTPServerTransport;
     transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: () => randomUUID(),
-      onsessioninitialized: (id: string) => { sessions.set(id, transport); },
+      onsessioninitialized: (id: string) => {
+        sessions.set(id, transport);
+        sessionAgents.set(id, boundAgent);
+      },
     });
     transport.onclose = () => {
-      if (transport.sessionId) sessions.delete(transport.sessionId);
+      if (transport.sessionId) {
+        sessions.delete(transport.sessionId);
+        sessionAgents.delete(transport.sessionId);
+      }
     };
     const server = buildServer(boundAgent);
     await server.connect(transport);
@@ -487,6 +522,20 @@ async function startHttp(port: number): Promise<void> {
       // bearer's agent; anything else is a protocol error.
       const sid = req.headers["mcp-session-id"];
       let transport = typeof sid === "string" ? sessions.get(sid) : undefined;
+      // Re-bind check: a session is pinned to the agent whose bearer opened it.
+      // In bound mode, reject a request whose bearer resolves to a *different*
+      // agent than the session was created for — otherwise any valid token plus
+      // a leaked session id could drive that session's identity (session hijack).
+      if (
+        transport &&
+        tokenMap &&
+        typeof sid === "string" &&
+        sessionAgents.get(sid) !== resolved.agent
+      ) {
+        res.writeHead(403, { "Content-Type": "text/plain" });
+        res.end("session/identity mismatch\n");
+        return;
+      }
       if (!transport) {
         if (req.method !== "POST") {
           res.writeHead(400, { "Content-Type": "text/plain" });

package/src/store.ts

@@ -44,6 +44,17 @@ export const ROOMS_DIR = path.join(ROOT, "rooms");
 export const ROOMS_FILE = path.join(ROOT, "rooms.json");
 export const DEFAULT_ROOM = "general";
 
+// Cold storage (v0.15.0). Nothing on the bus is ever deleted by prune or
+// compaction — aged-out entries are APPENDED here first, one file per room
+// (general included, despite its live file being the legacy room.jsonl), plus
+// status.jsonl and inbox/<agent>.jsonl. The server never reads these back;
+// they exist for offline analysis of what happened in a room. Receipts are
+// the one exception: delivery proofs carry no analysis value and are deleted.
+export const ARCHIVE_DIR = path.join(ROOT, "archive");
+export const ARCHIVE_ROOMS_DIR = path.join(ARCHIVE_DIR, "rooms");
+export const ARCHIVE_INBOX_DIR = path.join(ARCHIVE_DIR, "inbox");
+export const ARCHIVE_STATUS_FILE = path.join(ARCHIVE_DIR, "status.jsonl");
+
 // Per-agent token map for identity-bound bus auth (v0.7.0). Shape on disk:
 //   { "alice": "tk_<random-secret>", "bob": "tk_<another-secret>" }
 // HTTP transport reverse-looks-up the bearer to bind the session to an
@@ -339,6 +350,57 @@ export async function rewriteJsonl<T>(
   });
 }
 
+// Archive destinations for each live JSONL stream.
+export function archiveRoomFile(chan: string): string {
+  return path.join(ARCHIVE_ROOMS_DIR, `${sanitize(normalizeRoom(chan))}.jsonl`);
+}
+
+export function archiveInboxFile(agentId: string): string {
+  return path.join(ARCHIVE_INBOX_DIR, `${sanitize(agentId)}.jsonl`);
+}
+
+// Like rewriteJsonl, but entries failing the filter are appended to
+// archiveFile instead of discarded. The archive append happens under the
+// source-file lock and BEFORE the rewrite, so a crash mid-operation can at
+// worst duplicate entries into the archive — never lose them. Malformed
+// lines are archived verbatim rather than parsed.
+export async function archiveJsonl<T>(
+  file: string,
+  archiveFile: string,
+  filter: (entry: T) => boolean
+): Promise<{ kept: number; removed: number; archived: number }> {
+  if (!existsSync(file)) return { kept: 0, removed: 0, archived: 0 };
+  return withLock(file, async () => {
+    const raw = await fs.readFile(file, "utf8");
+    let kept = 0;
+    let removed = 0;
+    const keep: string[] = [];
+    const archive: string[] = [];
+    for (const line of raw.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        const entry = JSON.parse(line) as T;
+        if (filter(entry)) {
+          keep.push(line);
+          kept++;
+        } else {
+          archive.push(line);
+          removed++;
+        }
+      } catch {
+        archive.push(line);
+        removed++;
+      }
+    }
+    if (archive.length) {
+      await fs.mkdir(path.dirname(archiveFile), { recursive: true });
+      await fs.appendFile(archiveFile, archive.join("\n") + "\n", "utf8");
+    }
+    await fs.writeFile(file, keep.length ? keep.join("\n") + "\n" : "", "utf8");
+    return { kept, removed, archived: archive.length };
+  });
+}
+
 export async function deleteFile(file: string): Promise<boolean> {
   if (!existsSync(file)) return false;
   await fs.unlink(file);