cotal-ai 0.79.0 → 0.82.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cotal-ai",
-  "version": "0.79.0",
+  "version": "0.82.0",
   "description": "Cotal — lateral agent coordination over NATS. Run `npx cotal-ai` for the CLI.",
   "license": "Apache-2.0",
   "keywords": [
@@ -33,24 +33,24 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@cotal-ai/auth": "0.79.0",
-    "@cotal-ai/cli": "0.79.0",
-    "@cotal-ai/connector-core": "0.79.0",
-    "@cotal-ai/core": "0.79.0",
-    "@cotal-ai/delivery": "0.79.0",
-    "@cotal-ai/manager": "0.79.0",
-    "@cotal-ai/runtime": "0.79.0",
-    "@cotal-ai/workspace": "0.79.0"
+    "@cotal-ai/auth": "0.82.0",
+    "@cotal-ai/cli": "0.82.0",
+    "@cotal-ai/connector-core": "0.82.0",
+    "@cotal-ai/core": "0.82.0",
+    "@cotal-ai/delivery": "0.82.0",
+    "@cotal-ai/manager": "0.82.0",
+    "@cotal-ai/runtime": "0.82.0",
+    "@cotal-ai/workspace": "0.82.0"
   },
   "devDependencies": {
-    "@cotal-ai/connector-claude-code": "0.79.0",
-    "@cotal-ai/connector-codex": "0.79.0",
-    "@cotal-ai/connector-hermes": "0.79.0",
-    "@cotal-ai/connector-jcode": "0.79.0",
-    "@cotal-ai/connector-opencode": "0.79.0",
-    "@cotal-ai/pi": "0.79.0",
+    "@cotal-ai/connector-claude-code": "0.82.0",
+    "@cotal-ai/connector-codex": "0.82.0",
+    "@cotal-ai/connector-hermes": "0.82.0",
+    "@cotal-ai/connector-jcode": "0.82.0",
+    "@cotal-ai/connector-opencode": "0.82.0",
+    "@cotal-ai/pi": "0.82.0",
     "@cotal-ai/smoke-kit": "0.0.0",
-    "@cotal-ai/web": "0.79.0",
+    "@cotal-ai/web": "0.82.0",
     "@nats-io/jetstream": "^3.4.0",
     "@nats-io/transport-node": "^3.4.0",
     "typescript": "^5.9.3"

package/seeded-connectors/claude/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "cotal": {
       "command": "node",
-      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/mcp.cjs"]
+      "args": ["--optimize-for-size", "--max-semi-space-size=1", "${CLAUDE_PLUGIN_ROOT}/dist/mcp.cjs"]
     }
   }
 }

package/seeded-connectors/claude/dist/agui-map.d.ts

@@ -137,6 +137,13 @@ export interface ClaudeMapperOptions {
     threadId: string;
     /** Mints a `runId`. Connector-minted by §3.1, so every `RUN_STARTED` carries `runIdSource`. */
     mintRunId: () => string;
+    /**
+     * The run the write-ahead log has open when this mapper is built, so a mapper built for a
+     * re-established plane attributes the next assistant records to it. Without it the mapper
+     * opens with no run, drops every assistant record until the next prompt, and that prompt's
+     * `RUN_STARTED` is refused by brackets that still hold the earlier run open.
+     */
+    resumeRunId?: string;
     /**
      * Emit `REASONING_*` for `thinking` blocks. **Off by default (§7 Q1).** The `signature` is never
      * emitted at any setting (§3.5) and is not read by this module at all.

package/seeded-connectors/claude/dist/agui-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agui-map.d.ts","sourceRoot":"","sources":["../src/agui-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAEL,KAAK,YAAY,EAalB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE,CAAC;KAClC,CAAC;CACH;AAmHD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oBAAoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,uGAAuG;AACvG,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAiBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAwM1E"}
+{"version":3,"file":"agui-map.d.ts","sourceRoot":"","sources":["../src/agui-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAEL,KAAK,YAAY,EAalB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE,CAAC;KAClC,CAAC;CACH;AAmHD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oBAAoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,uGAAuG;AACvG,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAiBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CA2M1E"}

package/seeded-connectors/claude/dist/agui-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agui-source.d.ts","sourceRoot":"","sources":["../src/agui-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAqC,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAClH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAUjD,MAAM,WAAW,0BAA0B;IACzC;uCACmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,wBAAsB,8BAA8B,CAAC,CAAC,EACpD,IAAI,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAClC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,GAC9D,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAiCxB;AA2BD,8FAA8F;AAC9F,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,OAAO,EACtB,IAAI,GAAE,0BAA+B,GACpC,aAAa,CAAC,WAAW,CAAC,CAiB5B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,OAAO,EACtB,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAKrC"}
+{"version":3,"file":"agui-source.d.ts","sourceRoot":"","sources":["../src/agui-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAqC,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAClH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAUjD,MAAM,WAAW,0BAA0B;IACzC;uCACmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,wBAAsB,8BAA8B,CAAC,CAAC,EACpD,IAAI,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAClC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,GAC9D,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAiCxB;AA+BD,8FAA8F;AAC9F,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,OAAO,EACtB,IAAI,GAAE,0BAA+B,GACpC,aAAa,CAAC,WAAW,CAAC,CAiB5B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,OAAO,EACtB,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAKrC"}

package/seeded-connectors/claude/dist/carried.d.ts

@@ -8,7 +8,7 @@ export declare function refuseCarriedLaunch(binary: string, seatEnv: Record<stri
 /** Where a carried seat writes its fork record: the manager's {@link LaunchSpec.resumeRecordPath}. */
 export declare function carriedForkRecord(home: string): string;
 /** Fill the seat's home: the carried transcript where `--resume` finds it, and the first-run state a
- *  fresh home would otherwise prompt for, trusting only the launch directory already checked. */
+ *  fresh home would otherwise prompt for, trusting the authorized launch directory. */
 export declare function placeCarried(home: string, transcript: string, resume: string | undefined, cwd: string): Record<string, string>;
 /**
  * Write a carried seat's fork record once Claude has forked: the digest of the transcript its

package/seeded-connectors/claude/dist/carried.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"carried.d.ts","sourceRoot":"","sources":["../src/carried.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAiD9D,eAAO,MAAM,sBAAsB,EAAE,uBAqBpC,CAAC;AAUF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAWzF;AAED,sGAAsG;AACtG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;iGACiG;AACjG,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ9H;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAY3F"}
+{"version":3,"file":"carried.d.ts","sourceRoot":"","sources":["../src/carried.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAiD9D,eAAO,MAAM,sBAAsB,EAAE,uBAqBpC,CAAC;AAUF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAWzF;AAED,sGAAsG;AACtG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;uFACuF;AACvF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ9H;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAY3F"}

package/seeded-connectors/claude/dist/extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgD,KAAK,SAAS,EAAoC,MAAM,gBAAgB,CAAC;AAQhI;;;;;;;;;4FAS4F;AAC5F,eAAO,MAAM,oBAAoB,8/DA4EvB,CAAC;AAgDX;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,SAyM7B,CAAC"}
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgD,KAAK,SAAS,EAAoC,MAAM,gBAAgB,CAAC;AAQhI;;;;;;;;;4FAS4F;AAC5F,eAAO,MAAM,oBAAoB,8/DA4EvB,CAAC;AAgDX;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,SA4M7B,CAAC"}

package/seeded-connectors/claude/dist/hook.cjs

@@ -24153,6 +24153,8 @@ var AJV_PROFILE_OPTIONS = Object.freeze({
   // a caller starts reading `errors.length`, or a verdict diverges between the settings — this
   // pin must be re-measured before it stays.
   allErrors: true,
+  // JSON members are own properties. Host prototype names never satisfy required/properties.
+  ownProperties: true,
   validateFormats: false,
   loadSchema: void 0,
   // PINNED, never inherited from Ajv's default: the safe-pattern analyzer models `/u`
@@ -24622,18 +24624,6 @@ var MANAGER_ADMIN_SNAP = Object.freeze([...MANAGER_ADMIN_COMMANDS]);
 // ../../packages/core/dist/lifecycle-state.js
 var dec3 = new TextDecoder();
 
-// ../../packages/core/dist/lifecycle-saga.js
-var enc3 = new TextEncoder();
-var dec4 = new TextDecoder();
-
-// ../../packages/core/dist/endpoint-cluster.js
-var TRAIT_GUARDED = "ai.cotal.guarded";
-var TRAIT_PRICED = "ai.cotal.priced";
-var GOVERNED_TRAIT_URNS = Object.freeze([TRAIT_GUARDED, TRAIT_PRICED]);
-
-// ../../packages/core/dist/evict.js
-var import_transport_node3 = __toESM(require_transport_node(), 1);
-
 // ../../node_modules/.pnpm/@nats-io+jwt@0.0.10-5/node_modules/@nats-io/jwt/esm/jwt.js
 var Types;
 (function(Types2) {
@@ -26244,6 +26234,25 @@ var Algorithms;
 // ../../packages/core/dist/identity.js
 var import_nkeys = __toESM(require_mod2(), 1);
 
+// ../../packages/core/dist/remote-manager-authority.js
+var REMOTE_MANAGER_AUTHORITY_OPERATIONS = Object.freeze(["prepare", "activate", "renew", "session", "retire", "renewStandingBundle", "renewRunDriver", "transferReader"]);
+var MANAGED_AGENT_RUNTIME_STATES = Object.freeze(["reserved", "creating", "bound", "create-unknown", "closing", "closed"]);
+var MANAGED_AGENT_RUNTIME_READINESS = Object.freeze(["ready", "bound-not-ready", "none"]);
+var MANAGED_AGENT_RETIREMENT_PHASES = Object.freeze(["intent", "released", "retired", "deprovisioned", "terminal"]);
+var REMOTE_MANAGER_IDENTITY_NAMES = Object.freeze(["supervisor", "executor", "serve", "goalWriter", "sessionLedger"]);
+
+// ../../packages/core/dist/lifecycle-saga.js
+var enc3 = new TextEncoder();
+var dec4 = new TextDecoder();
+
+// ../../packages/core/dist/endpoint-cluster.js
+var TRAIT_GUARDED = "ai.cotal.guarded";
+var TRAIT_PRICED = "ai.cotal.priced";
+var GOVERNED_TRAIT_URNS = Object.freeze([TRAIT_GUARDED, TRAIT_PRICED]);
+
+// ../../packages/core/dist/evict.js
+var import_transport_node3 = __toESM(require_transport_node(), 1);
+
 // ../../packages/core/dist/endpoint-service.js
 var SOURCE_CHAIN_ID = "[A-Za-z0-9_-]{1,64}";
 var SOURCE_CHAIN_ELEMENT = new RegExp(`^(root|handle\\.${SOURCE_CHAIN_ID}\\.${SOURCE_CHAIN_ID}|session\\.${SOURCE_CHAIN_ID})$`);
@@ -26502,6 +26511,10 @@ var CREDENTIAL_LIFETIMES = {
   "transfer-reader": { class: "one-shot", defaultTtlSeconds: FIVE_MINUTES, note: "one transcript-receive or sweep over the minting instance's own transfer bucket" },
   "endpoint-evictor": { class: "one-shot", defaultTtlSeconds: 60, note: "one re-registration's verify-evict window: a scoped delivery-admin caller that kicks+verifies the SUPERSEDED serve family before the epoch advances; 60s bounds a copied cred to a minute" },
   "remote-manager": { class: "standing-renewable", defaultTtlSeconds: STANDING_RENEWABLE_TTL_SEC, renewalOwner: "auth-service", note: "the scoped remote manager lifecycle: own lease/presence plus same-owner agent provisioning; issued only by the typed supervise protocol, never by cotal mint or a raw view/profile string" },
+  "environment-bootstrap": { class: "one-shot", defaultTtlSeconds: FIVE_MINUTES, note: "one admitted environment's bootstrap caller; explicit expiry capped by admission and five minutes" },
+  "environment-manager-supervisor": { class: "standing-renewable", renewalOwner: "environment-authority", note: "own lease/presence/liveness; explicit expiry capped by admission, no auth-store access" },
+  "environment-manager-executor": { class: "standing-renewable", renewalOwner: "environment-authority", note: "own admitted authority instance RPC; explicit expiry capped by admission, no direct store access" },
+  "environment-manager-goal-writer": { class: "standing-renewable", renewalOwner: "environment-authority", note: "manager goal rows without the auth-read belt; explicit expiry capped by admission" },
   "membership-observer": { class: "rotation-renewed", defaultTtlSeconds: ROTATION_RENEWED_TTL_SEC, renewalOwner: "system-account rotation", note: "$SYS-account CONNZ observer; NOT online-renewable ($SYS seed dies at `up`) - bounded exp, renewed only by rotateSystemAccount + broker restart; doctor warns near expiry" },
   "connection-evictor": { class: "rotation-renewed", defaultTtlSeconds: ROTATION_RENEWED_TTL_SEC, renewalOwner: "system-account rotation", note: "$SYS-account KICK-only live-eviction cred; same rotation-renewed posture as the observer" }
 };
@@ -26619,12 +26632,18 @@ var Registry = class {
 };
 var registry2 = new Registry();
 
-// ../../packages/core/dist/remote-manager-authority.js
-var REMOTE_MANAGER_AUTHORITY_OPERATIONS = Object.freeze(["prepare", "activate", "renew", "session", "retire", "renewStandingBundle", "renewRunDriver", "transferReader"]);
-var MANAGED_AGENT_RUNTIME_STATES = Object.freeze(["reserved", "creating", "bound", "create-unknown", "closing", "closed"]);
-var MANAGED_AGENT_RUNTIME_READINESS = Object.freeze(["ready", "bound-not-ready", "none"]);
-var MANAGED_AGENT_RETIREMENT_PHASES = Object.freeze(["intent", "released", "retired", "deprovisioned", "terminal"]);
-var REMOTE_MANAGER_IDENTITY_NAMES = Object.freeze(["supervisor", "executor", "serve", "goalWriter", "sessionLedger"]);
+// ../../packages/core/dist/delegated-recovery.js
+var DELEGATED_RECOVERY_REASONS = Object.freeze([
+  "provider-unknown",
+  "store-unavailable",
+  "authority-unavailable",
+  "identity-unverified",
+  "descriptor-incomplete",
+  "retiring",
+  "authority-drift",
+  "identity-changed",
+  "scope-changed"
+]);
 
 // ../../packages/core/dist/agui-kind.js
 var AGUI_EVENT_TYPE = Object.freeze({

package/seeded-connectors/claude/dist/hooks.d.ts

@@ -2,6 +2,8 @@ import { type MeshAgent, type InboxItem, type HookEvent, type HookHandle } from
 import type { AguiEmitterHolder } from "@cotal-ai/connector-core";
 import type { ClaudeEntry } from "./agui-map.js";
 export interface ClaudeHandleDeps {
+    /** Launch environment for a hosted session's carried-fork record. Omitted uses the process env. */
+    env?: NodeJS.ProcessEnv;
     /** The session's AG-UI emitter, read lazily — `mcp.ts` assigns it after the handler exists. */
     events?: () => AguiEmitterHolder<ClaudeEntry, unknown> | undefined;
     /** Told which inbox items a frame surfaced; pass {@link WakePolicy.surfaced}. */

package/seeded-connectors/claude/dist/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAcA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA+EjD,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IACnE,iFAAiF;IACjF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,KAAK,IAAI,CAAC;CAClD;AAOD;;+DAE+D;AAC/D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,iDAAiD;IACjD,OAAO,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,gBAAqB,GAAG,WAAW,CA4S3E;AAED,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5H,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACxC;+FAC2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAAC;IAC5C,sCAAsC;IACtC,IAAI,IAAI,IAAI,CAAC;CACd;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,GAAG,UAAU,CAsH3H"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAcA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA+EjD,MAAM,WAAW,gBAAgB;IAC/B,mGAAmG;IACnG,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IACnE,iFAAiF;IACjF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,KAAK,IAAI,CAAC;CAClD;AAOD;;+DAE+D;AAC/D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,iDAAiD;IACjD,OAAO,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,gBAAqB,GAAG,WAAW,CAoU3E;AAED,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5H,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACxC;+FAC2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAAC;IAC5C,sCAAsC;IACtC,IAAI,IAAI,IAAI,CAAC;CACd;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,GAAG,UAAU,CAsH3H"}

package/seeded-connectors/claude/dist/index.js

@@ -15120,8 +15120,8 @@ var claudeSetupProvider = {
     run(prompt) {
       const sessionArgs = assistSession ? ["--resume", assistSession] : ["--session-id", assistSession = randomUUID()];
       const child = spawn("claude", [prompt, "--permission-mode", "auto", ...sessionArgs], { stdio: "inherit" });
-      return new Promise((resolve3, reject) => {
-        child.on("exit", () => resolve3());
+      return new Promise((resolve2, reject) => {
+        child.on("exit", () => resolve2());
         child.on("error", reject);
       });
     }
@@ -15138,7 +15138,7 @@ var claudeSetupProvider = {
 registry3.register(claudeSetupProvider);
 
 // src/extension.ts
-import { resolve as resolve2 } from "node:path";
+import { resolve } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { loadAgentFile as loadAgentFile2, registry as registry4, writeLaunchArtifact } from "@cotal-ai/core";
 
@@ -15234,46 +15234,10 @@ function placeCarried(home, transcript, resume, cwd) {
 }
 
 // src/trust.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync, statSync } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { basename, dirname as dirname2, join as join4, resolve } from "node:path";
-function stateFile(env) {
-  return env.CLAUDE_CONFIG_DIR ? join4(env.CLAUDE_CONFIG_DIR, ".claude.json") : join4(env.HOME || homedir3(), ".claude.json");
-}
-function repoRoot(dir) {
-  for (; ; dir = dirname2(dir)) {
-    if (existsSync2(join4(dir, ".git"))) return dir;
-    if (dirname2(dir) === dir) return void 0;
-  }
-}
-function trustKey(root) {
-  const dotGit = join4(root, ".git");
-  const link = statSync(dotGit).isFile() && /^gitdir:(.*)/.exec(readFileSync3(dotGit, "utf8").trim());
-  if (!link) return root;
-  const gitDir = resolve(root, link[1].trim());
-  const pointer = (name) => existsSync2(join4(gitDir, name)) ? resolve(gitDir, readFileSync3(join4(gitDir, name), "utf8").trim()) : void 0;
-  const common = pointer("commondir"), back = pointer("gitdir");
-  if (common === void 0 || back === void 0 || dirname2(gitDir) !== join4(common, "worktrees")) return root;
-  if (!existsSync2(back) || realpathSync(back) !== join4(realpathSync(root), ".git")) return root;
-  return basename(common) === ".git" ? dirname2(common) : common;
-}
-function refuseUntrustedCwd(cwd) {
-  let projects;
-  try {
-    projects = JSON.parse(readFileSync3(stateFile(process.env), "utf8")).projects;
-  } catch (e) {
-    if (e.code !== "ENOENT") throw e;
-  }
-  const trusted = (dir) => projects?.[dir]?.hasTrustDialogAccepted === true;
-  const root = repoRoot(cwd);
-  if (root !== void 0 && trusted(trustKey(root))) return;
-  for (let dir = cwd; !trusted(dir); dir = dirname2(dir)) {
-    if (dir === root || dirname2(dir) === dir)
-      throw new Error(
-        `claude connector: the manager's Claude home does not trust ${cwd}, and a supervised seat cannot answer Claude's workspace-trust dialog; open \`claude\` in that directory on the manager host once and trust it, then launch again`
-      );
-  }
-}
+var CLAUDE_WORKSPACE_TRUST_REPLIES = Object.freeze([
+  Object.freeze({ prompt: "\u276F No, exit\nYes, I trust this folder", key: "Down" }),
+  Object.freeze({ prompt: "No, exit\n\u276F Yes, I trust this folder", key: "Enter" })
+]);
 
 // src/extension.ts
 var MCP_SERVER_NAME = "cotal";
@@ -15356,7 +15320,7 @@ var CLAUDE_PROVIDER_KEYS = [
 ];
 var CHANNEL_REF = `server:${MCP_SERVER_NAME}`;
 var PLUGIN_ROOT = fileURLToPath2(new URL("..", import.meta.url));
-var MCP_CJS = resolve2(PLUGIN_ROOT, "dist", "mcp.cjs");
+var MCP_CJS = resolve(PLUGIN_ROOT, "dist", "mcp.cjs");
 function assertServableModel(model) {
   if (!model.includes("/") || model.startsWith("arn:")) return;
   throw new Error(
@@ -15411,8 +15375,6 @@ var claudeConnector = {
     }
     const binary = opts.resolvedBinaries?.claude ?? "claude";
     if (opts.carried) refuseCarriedLaunch(binary, env);
-    if (opts.cwd) refuseUntrustedCwd(opts.cwd);
-    if (opts.carried && opts.carried.cwd !== opts.cwd) refuseUntrustedCwd(opts.carried.cwd);
     if (opts.role) env.COTAL_ROLE = opts.role;
     if (opts.id) env.COTAL_ID = opts.id;
     if (opts.lifecycleUid) env.COTAL_LIFECYCLE_UID = opts.lifecycleUid;
@@ -15423,8 +15385,8 @@ var claudeConnector = {
       throw new Error("claude connector: an initial prompt was given but it is empty, there is no first turn to submit");
     const args = prompt ? [prompt, "--dangerously-load-development-channels", CHANNEL_REF, "--plugin-dir", PLUGIN_ROOT] : ["--dangerously-load-development-channels", CHANNEL_REF, "--plugin-dir", PLUGIN_ROOT];
     args.push("--allowedTools", "WebFetch(domain:github.com),WebFetch(domain:raw.githubusercontent.com)");
-    const mcpServers = { ...shared, [MCP_SERVER_NAME]: { command: "node", args: [MCP_CJS] } };
-    const agentFile = opts.configPath ? resolve2(opts.configPath) : void 0;
+    const mcpServers = { ...shared, [MCP_SERVER_NAME]: { command: "node", args: ["--optimize-for-size", "--max-semi-space-size=1", MCP_CJS] } };
+    const agentFile = opts.configPath ? resolve(opts.configPath) : void 0;
     const def = agentFile ? loadAgentFile2(agentFile) : void 0;
     if (opts.model) assertServableModel(opts.model);
     const passthrough = connectorLaunchOptions("claude", opts.launchOptions).map(([k, v]) => [k, String(v)]);
@@ -15446,6 +15408,8 @@ var claudeConnector = {
     }
     if (opts.resume) args.push("--resume", opts.resume, "--fork-session");
     if (opts.carried) Object.assign(env, placeCarried(opts.carried.home, opts.carried.transcript, opts.resume, opts.carried.cwd));
+    if (!passthrough.some(([k]) => k === "permission-mode" || k === "dangerously-skip-permissions"))
+      args.push("--permission-mode", "bypassPermissions");
     for (const [k, val] of passthrough) {
       if (val === "") args.push(`--${k}`);
       else args.push(`--${k}`, val);
@@ -15458,6 +15422,7 @@ var claudeConnector = {
       // "Enter to confirm" footer, which the workspace-trust dialog also renders with a different
       // default action. The runtime presses Enter once when this connector-owned text appears.
       confirm: "WARNING: Loading development channels",
+      ...opts.cwd ? { confirmBefore: CLAUDE_WORKSPACE_TRUST_REPLIES } : {},
       control,
       ...opts.carried ? { resumeRecordPath: carriedForkRecord(opts.carried.home) } : {},
       ...artifacts.length > 0 ? { artifacts } : {}