cotal-ai 0.92.1 → 0.93.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cotal-ai",
-  "version": "0.92.1",
+  "version": "0.93.0",
   "description": "Cotal — lateral agent coordination over NATS. Run `npx cotal-ai` for the CLI.",
   "license": "Apache-2.0",
   "keywords": [
@@ -33,25 +33,25 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@cotal-ai/auth": "0.92.1",
-    "@cotal-ai/cli": "0.92.1",
-    "@cotal-ai/connector-core": "0.92.1",
-    "@cotal-ai/core": "0.92.1",
-    "@cotal-ai/delivery": "0.92.1",
-    "@cotal-ai/manager": "0.92.1",
-    "@cotal-ai/runtime": "0.92.1",
-    "@cotal-ai/workspace": "0.92.1"
+    "@cotal-ai/auth": "0.93.0",
+    "@cotal-ai/cli": "0.93.0",
+    "@cotal-ai/connector-core": "0.93.0",
+    "@cotal-ai/core": "0.93.0",
+    "@cotal-ai/delivery": "0.93.0",
+    "@cotal-ai/manager": "0.93.0",
+    "@cotal-ai/runtime": "0.93.0",
+    "@cotal-ai/workspace": "0.93.0"
   },
   "devDependencies": {
-    "@cotal-ai/connector-claude-code": "0.92.1",
-    "@cotal-ai/connector-codex": "0.92.1",
-    "@cotal-ai/connector-hermes": "0.92.1",
-    "@cotal-ai/connector-jcode": "0.92.1",
-    "@cotal-ai/connector-opencode": "0.92.1",
-    "@cotal-ai/linear": "0.92.1",
-    "@cotal-ai/pi": "0.92.1",
+    "@cotal-ai/connector-claude-code": "0.93.0",
+    "@cotal-ai/connector-codex": "0.93.0",
+    "@cotal-ai/connector-hermes": "0.93.0",
+    "@cotal-ai/connector-jcode": "0.93.0",
+    "@cotal-ai/connector-opencode": "0.93.0",
+    "@cotal-ai/linear": "0.93.0",
+    "@cotal-ai/pi": "0.93.0",
     "@cotal-ai/smoke-kit": "0.0.0",
-    "@cotal-ai/web": "0.92.1",
+    "@cotal-ai/web": "0.93.0",
     "@nats-io/jetstream": "^3.4.0",
     "@nats-io/transport-node": "^3.4.0",
     "typescript": "^5.9.3"

package/seeded-connectors/claude/README.md

@@ -18,8 +18,11 @@ Claude Code documents every hook event and its matchers in its
 The plugin registers the nine hooks below in [`hooks/hooks.json`](hooks/hooks.json). Each runs
 `dist/hook.cjs`, which relays the event to the session's connector over its authenticated control
 socket. A Cotal session, one that Cotal launched, carries a mesh identity in its environment. A
-plain session, such as a `claude` you started yourself, carries none and has no connector, so there
-the hook only runs the hosted connection checks in the `PreToolUse` and `PostToolUse` rows. The presence states are described in
+plain session, such as a `claude` you started yourself, carries none until it connects. Its command
+hooks capture session and transcript metadata, then relay lifecycle events to the personal gateway
+after the native module binds that session. This does not intercept the `classic.*` events that
+Claude's built-in security guard withholds from user plugins. The command hook still enforces the
+hosted connection checks in the `PreToolUse` and `PostToolUse` rows. The presence states are described in
 [presence mapping](../../docs/connect-claude.md#presence-mapping).
 
 | Hook | Matcher | What the plugin does |

package/seeded-connectors/claude/dist/app-host.d.ts

@@ -1,16 +1,13 @@
 import { type GatewayHost } from "@cotal-ai/connector-core";
 export interface AppHostOptions {
-    /** The argv that runs the CLI. Read when a conversation connects, so a server whose record is
-     *  missing still answers MCP and refuses `cotal_connect` with the remedy. */
     cotal: () => readonly string[];
-    /** Where `app-identity` runs. A Claude Code session passes its own directory, so a project's mesh
-     *  is found as `cotal spawn` finds it; Claude Desktop passes a directory that is no project. */
     cwd: string;
     env: NodeJS.ProcessEnv;
 }
 export interface AppHost extends GatewayHost {
-    /** Disconnect and retire every connection. Safe to call more than once. */
     closeAll(): Promise<void>;
+    nativeEvent(event: Record<string, unknown>): Promise<void>;
+    sessionFor(id: string): string | undefined;
 }
 export declare function createAppHost(o: AppHostOptions): AppHost;
 //# sourceMappingURL=app-host.d.ts.map

package/seeded-connectors/claude/dist/app-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-host.d.ts","sourceRoot":"","sources":["../src/app-host.ts"],"names":[],"mappings":"AASA,OAAO,EAA+D,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAMzH,MAAM,WAAW,cAAc;IAC7B;iFAC6E;IAC7E,KAAK,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAC/B;oGACgG;IAChG,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,OAAQ,SAAQ,WAAW;IAC1C,2EAA2E;IAC3E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAkBD,wBAAgB,aAAa,CAAC,CAAC,EAAE,cAAc,GAAG,OAAO,CA0ExD"}
+{"version":3,"file":"app-host.d.ts","sourceRoot":"","sources":["../src/app-host.ts"],"names":[],"mappings":"AAKA,OAAO,EAAiH,KAAK,WAAW,EAAkB,MAAM,0BAA0B,CAAC;AAS3L,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,OAAQ,SAAQ,WAAW;IAC1C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAC5C;AA4CD,wBAAgB,aAAa,CAAC,CAAC,EAAE,cAAc,GAAG,OAAO,CA+IxD"}

package/seeded-connectors/claude/dist/claude-events.d.ts

@@ -0,0 +1,8 @@
+import { AguiEmitterHolder, type AgentConfig, type DurableSource, type MeshAgent } from "@cotal-ai/connector-core";
+import { type ClaudeEntry } from "./agui-map.js";
+/** The managed and personal native paths use the same transcript, WAL and recovery semantics. */
+export declare function createClaudeEventPlane(agent: MeshAgent, config: AgentConfig, env: NodeJS.ProcessEnv, initialSource?: DurableSource<ClaudeEntry>): {
+    events: AguiEmitterHolder<ClaudeEntry, unknown>;
+    stop(): void;
+};
+//# sourceMappingURL=claude-events.d.ts.map

package/seeded-connectors/claude/dist/claude-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-events.d.ts","sourceRoot":"","sources":["../src/claude-events.ts"],"names":[],"mappings":"AAGA,OAAO,EACQ,iBAAiB,EACa,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAChG,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAsB,KAAK,WAAW,EAAqB,MAAM,eAAe,CAAC;AAGxF,iGAAiG;AACjG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAClG,aAAa,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG;IAAE,MAAM,EAAE,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,IAAI,IAAI,CAAA;CAAE,CA0C/G"}

package/seeded-connectors/claude/dist/hook.cjs

@@ -4,10 +4,133 @@
 var import_node_net = require("node:net");
 
 // ../../packages/core/dist/launch-material.js
-var import_node_fs = require("node:fs");
+var import_node_fs2 = require("node:fs");
 
 // ../../packages/core/dist/secret-fs.js
+var import_node_fs = require("node:fs");
+var import_node_child_process = require("node:child_process");
+var import_node_path = require("node:path");
 var isWin = process.platform === "win32";
+function sys32(exe) {
+  const root = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+  return (0, import_node_path.join)(root, "System32", exe);
+}
+var cachedSid;
+function ownerSid() {
+  if (cachedSid)
+    return cachedSid;
+  const out = (0, import_node_child_process.execFileSync)(sys32("whoami.exe"), ["/user", "/fo", "csv", "/nh"], { encoding: "utf8" });
+  const sid = out.trim().split(",").pop()?.replace(/^"|"$/g, "").trim();
+  if (!sid || !/^S-1-/.test(sid))
+    throw new Error(`could not determine the current user's SID from \`whoami\` (got: ${out.trim()})`);
+  cachedSid = sid;
+  return sid;
+}
+var BROAD_SIDS = ["S-1-1-0", "S-1-5-11", "S-1-5-32-545"];
+function hardenPrivate(path, kind) {
+  if (!isWin) {
+    if (kind === "file")
+      (0, import_node_fs.closeSync)(openPrivate(path, import_node_fs.constants.O_RDONLY));
+    else
+      (0, import_node_fs.chmodSync)(path, 448);
+    return;
+  }
+  const perm = kind === "dir" ? "(OI)(CI)(F)" : "(F)";
+  const removeBroad = BROAD_SIDS.flatMap((sid) => ["/remove:g", `*${sid}`]);
+  const grant = (sid) => ["/grant:r", `*${sid}:${perm}`];
+  try {
+    (0, import_node_child_process.execFileSync)(sys32("icacls.exe"), [
+      path,
+      "/inheritance:r",
+      ...removeBroad,
+      ...grant(ownerSid()),
+      ...grant("S-1-5-18"),
+      ...grant("S-1-5-32-544")
+    ], { stdio: ["ignore", "ignore", "pipe"] });
+  } catch (e) {
+    throw new Error(`failed to harden ${kind} "${path}" to private via icacls: ${e.message.trim()}. Cotal will not leave a secret with a permissive ACL - ensure the path is on an NTFS volume and %SystemRoot%\\System32\\icacls.exe is available.`);
+  }
+}
+function notPrivate(path, why) {
+  const refused = new Error(`refusing to write "${path}": it ${why}; it was left unchanged`);
+  refused.code = "EPERM";
+  return refused;
+}
+function openPrivate(path, flags) {
+  if (isWin) {
+    const fd2 = (0, import_node_fs.openSync)(path, flags, 384);
+    try {
+      (0, import_node_fs.fchmodSync)(fd2, 384);
+    } catch (e) {
+      (0, import_node_fs.closeSync)(fd2);
+      throw e;
+    }
+    return fd2;
+  }
+  let fd;
+  try {
+    fd = (0, import_node_fs.openSync)(path, flags | import_node_fs.constants.O_NOFOLLOW | import_node_fs.constants.O_NONBLOCK, 384);
+  } catch (e) {
+    if (e.code === "ELOOP")
+      throw notPrivate(path, "is a symlink");
+    throw e;
+  }
+  try {
+    const info = (0, import_node_fs.fstatSync)(fd);
+    if (!info.isFile())
+      throw notPrivate(path, "is not a regular file");
+    if (info.uid !== process.getuid())
+      throw notPrivate(path, `is owned by uid ${info.uid}, not this user`);
+    (0, import_node_fs.fchmodSync)(fd, 384);
+    return fd;
+  } catch (e) {
+    (0, import_node_fs.closeSync)(fd);
+    throw e;
+  }
+}
+function writeSecretFile(path, data) {
+  writePrivate(path, data, false);
+}
+function writeBytes(path, data, exclusive) {
+  const fd = openPrivate(path, import_node_fs.constants.O_WRONLY | import_node_fs.constants.O_CREAT | (exclusive ? import_node_fs.constants.O_EXCL : 0));
+  try {
+    (0, import_node_fs.ftruncateSync)(fd);
+    (0, import_node_fs.writeFileSync)(fd, data);
+  } finally {
+    (0, import_node_fs.closeSync)(fd);
+  }
+}
+function writePrivate(path, data, exclusive) {
+  writeBytes(path, data, exclusive);
+  if (!isWin)
+    return;
+  try {
+    hardenPrivate(path, "file");
+  } catch (e) {
+    try {
+      (0, import_node_fs.unlinkSync)(path);
+    } catch {
+    }
+    throw e;
+  }
+}
+function writeSecretFileAtomic(path, data) {
+  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeSecretFile(tmp, data);
+    (0, import_node_fs.renameSync)(tmp, path);
+  } catch (e) {
+    try {
+      (0, import_node_fs.unlinkSync)(tmp);
+    } catch {
+    }
+    throw e;
+  }
+}
+function mkSecretDir(path) {
+  (0, import_node_fs.mkdirSync)(path, { recursive: true, mode: 448 });
+  hardenPrivate(path, "dir");
+}
 
 // ../../packages/core/dist/launch-material.js
 var LAUNCH_MATERIAL_ENV = "COTAL_LAUNCH_MATERIAL";
@@ -15,11 +138,11 @@ function readLaunchMaterial(path) {
   let raw;
   try {
     if (process.platform !== "win32") {
-      const mode = (0, import_node_fs.statSync)(path).mode & 511;
+      const mode = (0, import_node_fs2.statSync)(path).mode & 511;
       if (mode & 63)
         throw new Error(`is readable beyond its owner (mode ${mode.toString(8)}) - refusing to read connection material out of a file other local users can open`);
     }
-    raw = (0, import_node_fs.readFileSync)(path, "utf8");
+    raw = (0, import_node_fs2.readFileSync)(path, "utf8");
   } catch (e) {
     throw new Error(`launch material: cannot read ${path} (${e instanceof Error ? e.message : String(e)})`);
   }
@@ -170,9 +293,9 @@ function done(out, confirm) {
   });
   setTimeout(exit, 1e3);
 }
-async function runHookRelay(answer) {
+async function runHookRelay(answer, observe) {
   const managed = hasIdentity();
-  if (!managed && !answer)
+  if (!managed && !answer && !observe)
     return done("");
   const raw = (await readStdin()).trim() || "{}";
   let event = {};
@@ -187,6 +310,10 @@ async function runHookRelay(answer) {
   }
   if (local)
     return done(JSON.stringify(local));
+  try {
+    await observe?.(event, { managed });
+  } catch {
+  }
   if (!managed)
     return done("");
   let control;
@@ -309,8 +436,8 @@ var otherCotalPath = (event, session) => {
 };
 
 // src/connection-owner.ts
-var import_node_fs2 = require("node:fs");
-var import_node_path = require("node:path");
+var import_node_fs3 = require("node:fs");
+var import_node_path2 = require("node:path");
 var CONNECTED = /^connection_id: (\S+)$/m;
 var SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
 var FORKED_REASON = "This connection_id was opened by another Claude Code session. This session is a fork or a copy of that one, so it needs its own connection: call cotal_connect, then use the connection_id it returns.";
@@ -324,7 +451,7 @@ function connectedId(response) {
   return void 0;
 }
 function connectionOwner(dataDir) {
-  const dir = dataDir ? (0, import_node_path.join)(dataDir, "hosted-connections") : void 0;
+  const dir = dataDir ? (0, import_node_path2.join)(dataDir, "hosted-connections") : void 0;
   return (event, session) => {
     if (session.managed || !dir) return void 0;
     const ev = event;
@@ -335,7 +462,7 @@ function connectionOwner(dataDir) {
     const id = typeof given === "string" && SAFE_ID.test(given) ? given : void 0;
     const owner2 = () => {
       try {
-        return (0, import_node_fs2.readFileSync)((0, import_node_path.join)(dir, id), "utf8");
+        return (0, import_node_fs3.readFileSync)((0, import_node_path2.join)(dir, id), "utf8");
       } catch {
         return void 0;
       }
@@ -343,13 +470,13 @@ function connectionOwner(dataDir) {
     if (ev?.hook_event_name === "PostToolUse" && tool === "cotal_connect") {
       const opened = connectedId(ev.tool_response);
       if (opened === void 0) return void 0;
-      (0, import_node_fs2.mkdirSync)(dir, { recursive: true, mode: 448 });
-      (0, import_node_fs2.writeFileSync)((0, import_node_path.join)(dir, opened), sessionId, { mode: 384 });
+      (0, import_node_fs3.mkdirSync)(dir, { recursive: true, mode: 448 });
+      (0, import_node_fs3.writeFileSync)((0, import_node_path2.join)(dir, opened), sessionId, { mode: 384 });
       return void 0;
     }
     if (id === void 0) return void 0;
     if (ev?.hook_event_name === "PostToolUse" && tool === "cotal_disconnect") {
-      if (owner2() === sessionId) (0, import_node_fs2.rmSync)((0, import_node_path.join)(dir, id), { force: true });
+      if (owner2() === sessionId) (0, import_node_fs3.rmSync)((0, import_node_path2.join)(dir, id), { force: true });
       return void 0;
     }
     if (ev?.hook_event_name !== "PreToolUse") return void 0;
@@ -365,6 +492,130 @@ function connectionOwner(dataDir) {
   };
 }
 
+// src/native-binding.ts
+var import_node_fs5 = require("node:fs");
+var import_node_net2 = require("node:net");
+var import_node_os2 = require("node:os");
+var import_node_path4 = require("node:path");
+
+// src/wake-feed.ts
+var import_node_fs4 = require("node:fs");
+var import_node_os = require("node:os");
+var import_node_path3 = require("node:path");
+var WAKE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+var WIN_PIPES = "\\\\.\\pipe\\";
+var WIN_PREFIX = "cotal-claude-wake-";
+function wakeDir() {
+  if (process.platform === "win32") return WIN_PIPES;
+  const uid = process.getuid();
+  const dir = (0, import_node_path3.join)((0, import_node_os.tmpdir)(), `cotal-claude-wake-${uid}`);
+  (0, import_node_fs4.mkdirSync)(dir, { recursive: true, mode: 448 });
+  const st = (0, import_node_fs4.lstatSync)(dir);
+  if (!st.isDirectory() || st.uid !== uid || (st.mode & 63) !== 0) throw new Error(`${dir} is not a private directory of this user's`);
+  return dir;
+}
+var entryName = (claudePid, serverPid) => process.platform === "win32" ? `${WIN_PREFIX}${claudePid}-${serverPid}` : `${claudePid}-${serverPid}.sock`;
+var ENTRY = process.platform === "win32" ? new RegExp(`^${WIN_PREFIX}(\\d+)-(\\d+)$`) : /^(\d+)-(\d+)\.sock$/;
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+function wakeSocketPath(claudePid, serverPid = process.pid) {
+  const dir = wakeDir();
+  return process.platform === "win32" ? `${dir}${entryName(claudePid, serverPid)}` : (0, import_node_path3.join)(dir, entryName(claudePid, serverPid));
+}
+function wakeSockets(claudePid) {
+  const dir = wakeDir();
+  return (0, import_node_fs4.readdirSync)(dir).flatMap((name) => {
+    const m = ENTRY.exec(name);
+    return m?.[1] === String(claudePid) && alive(Number(m[2])) ? [wakeSocketPath(claudePid, Number(m[2]))] : [];
+  });
+}
+function nativeSocketPath(feed) {
+  return `${feed}.native`;
+}
+
+// src/native-binding.ts
+function stateFile(session) {
+  if (!WAKE_ID.test(session)) throw new Error("invalid native session identity");
+  const root = (0, import_node_path4.join)((0, import_node_os2.tmpdir)(), `cotal-claude-native-${process.getuid?.() ?? "local"}`);
+  const st = (0, import_node_fs5.lstatSync)(root, { throwIfNoEntry: false });
+  if (st && (!st.isDirectory() || process.getuid && st.uid !== process.getuid()))
+    throw new Error("native session state is not this user's private directory");
+  mkSecretDir(root);
+  return (0, import_node_path4.join)(root, `${session}.json`);
+}
+function readRecord(file) {
+  const st = (0, import_node_fs5.lstatSync)(file, { throwIfNoEntry: false });
+  if (!st) return void 0;
+  if (!st.isFile() || st.size > 16384 || process.getuid && (st.uid !== process.getuid() || (st.mode & 63) !== 0))
+    throw new Error("native session state is not an owner-private bounded regular file");
+  const value = JSON.parse((0, import_node_fs5.readFileSync)(file, "utf8"));
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid native session state");
+  return value;
+}
+function transcriptMatches(session, path) {
+  return typeof path === "string" && (0, import_node_path4.isAbsolute)(path) && (0, import_node_path4.basename)(path) === `${session}.jsonl`;
+}
+async function forward(event, hostPid) {
+  const paths = wakeSockets(hostPid);
+  if (!paths.length) throw new Error("no local native lifecycle server");
+  await Promise.all(paths.map((path) => new Promise((resolve, reject) => {
+    const socket = (0, import_node_net2.createConnection)(nativeSocketPath(path));
+    let reply = "";
+    socket.setEncoding("utf8");
+    socket.setTimeout(2e3, () => socket.destroy(new Error("native lifecycle relay timed out")));
+    socket.on("connect", () => socket.write(`${JSON.stringify({ op: "native", event })}
+`));
+    socket.on("data", (data) => {
+      reply += data;
+      if (reply.length > 128) socket.destroy();
+    });
+    socket.on("error", reject);
+    socket.on("close", () => {
+      try {
+        if (JSON.parse(reply).ok === true) resolve();
+        else reject(new Error("native lifecycle binding refused"));
+      } catch {
+        reject(new Error("native lifecycle binding was not confirmed"));
+      }
+    });
+  })));
+}
+async function observePersonalHook(value) {
+  if (!value || typeof value !== "object") return;
+  const event = value;
+  if (event.agent_id !== void 0 || typeof event.session_id !== "string" || !WAKE_ID.test(event.session_id) || !transcriptMatches(event.session_id, event.transcript_path) || typeof event.hook_event_name !== "string") return;
+  if (!["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolBatch", "Notification", "Stop", "StopFailure", "SessionEnd"].includes(event.hook_event_name)) return;
+  const file = stateFile(event.session_id);
+  const previous = readRecord(file);
+  if (previous && previous.transcript_path !== event.transcript_path)
+    throw new Error("native command hook changed its session transcript");
+  const safe = {};
+  for (const key of ["hook_event_name", "session_id", "transcript_path", "cwd", "source", "notification_type", "error", "model"])
+    if (typeof event[key] === "string" && event[key].length <= 4096) safe[key] = event[key];
+  if (JSON.stringify(safe).length > 8192) throw new Error("native command-hook metadata is too large");
+  writeSecretFileAtomic(file, JSON.stringify(safe));
+  const target = readRecord(`${file}.host`);
+  if (target) {
+    if (!Number.isInteger(target.hostPid) || target.hostPid <= 0) throw new Error("invalid native lifecycle host");
+    await forward(safe, target.hostPid);
+  }
+  if (event.hook_event_name === "SessionEnd") {
+    (0, import_node_fs5.unlinkSync)(file);
+    if (target) (0, import_node_fs5.unlinkSync)(`${file}.host`);
+  }
+}
+
 // src/hook.ts
 var owner = connectionOwner(process.env.CLAUDE_PLUGIN_DATA);
-void runHookRelay((event, session) => otherCotalPath(event, session) ?? owner(event, session)).catch(() => process.exit(0));
+void runHookRelay(
+  (event, session) => otherCotalPath(event, session) ?? owner(event, session),
+  async (event, session) => {
+    if (!session.managed) await observePersonalHook(event);
+  }
+).catch(() => process.exit(0));

package/seeded-connectors/claude/dist/hooks.d.ts

@@ -8,11 +8,16 @@ export interface ClaudeHandleDeps {
     events?: () => AguiEmitterHolder<ClaudeEntry, unknown> | undefined;
     /** Told which inbox items a frame surfaced; pass {@link WakePolicy.surfaced}. */
     surfaced?: (items: readonly InboxItem[]) => void;
+    /** False when native ingress owns delivery and these hooks observe lifecycle only. */
+    delivery?: boolean;
 }
 /** The hook side of the connector: the handler plus the delivery callback that commits what it
  *  injected. Both must be wired into {@link startControlServer} — the handler surfaces, the
  *  callback is the only place a peer message is ever acked. */
 export interface ClaudeHooks {
+    /** Adopt a native transcript when a personal connection starts mid-session. No synthetic
+     * lifecycle event is needed, and the source decides the pre-connection privacy boundary. */
+    adoptTranscript(path: string, source: unknown): void;
     handle: HookHandle;
     /** Pass as {@link ControlServerOpts.onReply}. */
     onReply: (ev: HookEvent, delivered: boolean) => void;

package/seeded-connectors/claude/dist/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAcA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA+EjD,MAAM,WAAW,gBAAgB;IAC/B,mGAAmG;IACnG,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IACnE,iFAAiF;IACjF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,KAAK,IAAI,CAAC;CAClD;AAOD;;+DAE+D;AAC/D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,iDAAiD;IACjD,OAAO,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,gBAAqB,GAAG,WAAW,CAyU3E;AAED,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5H,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACxC;+FAC2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAAC;IAC5C,sCAAsC;IACtC,IAAI,IAAI,IAAI,CAAC;CACd;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,GAAG,UAAU,CAsH3H"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAcA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA+EjD,MAAM,WAAW,gBAAgB;IAC/B,mGAAmG;IACnG,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IACnE,iFAAiF;IACjF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,KAAK,IAAI,CAAC;IACjD,sFAAsF;IACtF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAOD;;+DAE+D;AAC/D,MAAM,WAAW,WAAW;IAC1B;gGAC4F;IAC5F,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACrD,MAAM,EAAE,UAAU,CAAC;IACnB,iDAAiD;IACjD,OAAO,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,gBAAqB,GAAG,WAAW,CA2U3E;AAED,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5H,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACxC;+FAC2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAAC;IAC5C,sCAAsC;IACtC,IAAI,IAAI,IAAI,CAAC;CACd;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,GAAG,UAAU,CAsH3H"}

package/seeded-connectors/claude/dist/index.js

@@ -6906,7 +6906,7 @@ import { DEFAULT_SERVER, DEV_OWNER, LAUNCH_MATERIAL_ENV as LAUNCH_MATERIAL_ENV2,
 import { LAUNCH_MATERIAL_ENV, readLaunchMaterial } from "@cotal-ai/core/launch-material";
 
 // ../connector-core/dist/agent.js
-import { normalizeMentions, RUN_LAUNCH_DEADLINE_MS, subjectMatches, isConcreteChannel as isConcreteChannel2, assertValidChannel as assertValidChannel2, channelInAllow as channelInAllow2, resolvePeer as resolvePeerInRoster, peerLabel as peerLabel2, CotalEndpoint, acquireLocalConsumer, BASELINE_LIFECYCLE_ENDPOINT as BASELINE_LIFECYCLE_ENDPOINT2, BIND_SPLIT_REISSUES, assertLifecycleToken as assertLifecycleToken2, EpEnvelopeError as EpEnvelopeError2, isPublishPermissionDenied, unansweredRequest, controlReplyFrom, controlReplyFromThrown, runAgentBearer, partsToText, assertValidRole } from "@cotal-ai/core";
+import { normalizeMentions, RUN_LAUNCH_DEADLINE_MS, subjectMatches, isConcreteChannel as isConcreteChannel2, assertValidChannel as assertValidChannel2, channelInAllow as channelInAllow2, eventChannelPrincipal, resolvePeer as resolvePeerInRoster, peerLabel as peerLabel2, CotalEndpoint, acquireLocalConsumer, BASELINE_LIFECYCLE_ENDPOINT as BASELINE_LIFECYCLE_ENDPOINT2, BIND_SPLIT_REISSUES, assertLifecycleToken as assertLifecycleToken2, EpEnvelopeError as EpEnvelopeError2, isPublishPermissionDenied, unansweredRequest, controlReplyFrom, controlReplyFromThrown, runAgentBearer, partsToText, assertValidRole } from "@cotal-ai/core";
 
 // ../connector-core/dist/framing.js
 import { peerLabel } from "@cotal-ai/core/peer-label";
@@ -6937,7 +6937,7 @@ function controlEndpoint(space, name, token = randomBytes(32).toString("base64ur
 // ../connector-core/dist/launch.js
 import { eventChannel as eventChannel2, LAUNCH_MATERIAL_ENV as LAUNCH_MATERIAL_ENV3, parsePrincipalKey, principalKey, writeLaunchMaterial } from "@cotal-ai/core";
 import { dirname } from "node:path";
-import { EVENT_CHANNEL_PREFIX, eventChannel as eventChannel3, eventChannelPrincipal, isEventChannel } from "@cotal-ai/core";
+import { EVENT_CHANNEL_PREFIX, eventChannel as eventChannel3, eventChannelPrincipal as eventChannelPrincipal2, isEventChannel } from "@cotal-ai/core";
 var OS_ENV_ALLOW = [
   "PATH",
   "HOME",
@@ -7264,6 +7264,9 @@ function registerAguiFramePartRenderer() {
 }
 registerAguiFramePartRenderer();
 
+// ../connector-core/dist/control.js
+var MAX_FRAME_BYTES = 1 << 20;
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -23524,15 +23527,42 @@ if (typeof global.crypto === "undefined") {
 var MAX_DRAIN_BYTES = 64 * 1024 * 1024;
 
 // ../connector-core/dist/gateway.js
-import { assertValidName } from "@cotal-ai/core";
+import { assertValidName, conversationSelection, SELECTION_MAX_ITEMS } from "@cotal-ai/core";
+var GATEWAY_TOOLS = /* @__PURE__ */ new Set([
+  "cotal_orientation",
+  "cotal_connection_status",
+  "cotal_roster",
+  "cotal_docs",
+  "cotal_inbox",
+  "cotal_send",
+  "cotal_dm",
+  "cotal_anycast",
+  "cotal_status",
+  "cotal_channel_info",
+  "cotal_channels",
+  "cotal_channel_mode",
+  "cotal_join",
+  "cotal_leave"
+]);
+var NATIVE_GATEWAY_TOOLS = /* @__PURE__ */ new Set([
+  ...GATEWAY_TOOLS,
+  "cotal_spawn",
+  "cotal_persona",
+  "cotal_personas",
+  "cotal_despawn",
+  "cotal_run",
+  "cotal_reconnect"
+]);
+var SELECTION_SHAPE = {
+  channels: external_exports.array(external_exports.strictObject({ channel: external_exports.string().min(1), access: external_exports.enum(["read", "read-post"]) })).max(SELECTION_MAX_ITEMS).optional().describe("Channels this connection may join and read, or read and post to. No wildcards."),
+  role: external_exports.string().min(1).optional().describe("A role to hold, so role requests (cotal_anycast) reach this connection."),
+  capabilities: external_exports.array(external_exports.enum(["spawn", "run"])).optional().describe("spawn: start and stop agents through a manager. run: start and manage workflow runs.")
+};
 var CONNECTION_ID = external_exports.string().min(1).describe("The connection_id cotal_connect returned in THIS conversation. Never reuse another conversation's.");
 var GATEWAY_LISTENING = "Messages reach you only when you call a tool: to listen, call cotal_wait, which returns as soon as a message arrives. When the person asks you to stay on Cotal or keep listening, call cotal_wait again each time it returns and handle each message as it arrives, until they ask you to stop.";
-var GATEWAY_CONNECTING = "Cotal connects this conversation to the person's Cotal space. Call cotal_connect once with a short name for this conversation, then pass the returned connection_id on every other cotal tool call. Each conversation needs its own connection. Never reuse another conversation's connection_id.";
+var GATEWAY_CONNECTING = "Cotal connects this conversation to the person's Cotal space after they approve its permissions. Call cotal_connect with a short name. If approval is pending, show the person its link and wait for their decision; do not approve for them or poll. Then resume the same request as directed. Only a successful connection returns connection_id, required on every other cotal tool call. Each conversation needs its own connection. Never reuse another conversation's connection_id or approval_id.";
 var GATEWAY_INSTRUCTIONS = `${GATEWAY_CONNECTING} ${GATEWAY_LISTENING}`;
 
-// ../connector-core/dist/control.js
-var MAX_FRAME_BYTES = 1 << 20;
-
 // src/cli-record.ts
 var CLI_RECORD = "cli.json";