cotal-ai 0.94.5 → 0.94.7

package/dist/daemon/client.js

@@ -10,6 +10,23 @@ import { connect as netConnect } from "node:net";
 import { randomUUID } from "node:crypto";
 import { DAEMON_PROTOCOL_VERSION, MAX_LINE_BYTES, EndpointRefusal, assertLinux, checkDir, checkSocket } from "./endpoint.js";
 import { encode } from "./protocol.js";
+/** Ask the daemon whether it could register with `space`. Nothing is registered either way. */
+export async function connectCheckViaDaemon(opts) {
+    const sock = await openVerified({ ...opts, timeoutMs: 5000 });
+    try {
+        sock.write(encode({ v: DAEMON_PROTOCOL_VERSION, id: randomUUID().replaceAll("-", ""), op: "connect-check", space: opts.space }));
+        // The daemon's own network read is bounded by the stock client (30 s); allow a little more.
+        const reply = JSON.parse(await readLine(sock, 35_000));
+        if (!reply.ok)
+            return { ok: false, code: reply.error.code, message: reply.error.message };
+        if ("event" in reply || !("outcome" in reply.result) || !("space" in reply.result))
+            return { ok: false, code: "BAD_REPLY", message: "the daemon answered the connect check with something else" };
+        return { ok: true, result: reply.result };
+    }
+    finally {
+        sock.destroy();
+    }
+}
 function connectTo(path, timeoutMs) {
     return new Promise((resolve, reject) => {
         const s = netConnect(path);

package/dist/daemon/command.js

@@ -3,10 +3,13 @@
  * in an `implementations/*` package so it can later wire `@cotal-ai/auth` and `@cotal-ai/manager`
  * without one implementation importing another (AGENTS.md, repository map).
  *
- * This slice serves a local, authenticated endpoint for status and sign-in, and nothing else: no
- * Manager, no mesh or Cloud connection, no service install. Linux only. Sign-in runs inside the
+ * This slice serves a local, authenticated endpoint for status, sign-in and a connection check, and
+ * nothing else: no registration, no Manager, no mesh or Cloud connection, no service install. Linux
+ * only. Sign-in runs inside the
  * daemon through stock `establishIdpSession`, so the session lands in the machine-home Cotal
- * directory where `cotal login` keeps it, and no token ever crosses the local endpoint. It is a
+ * directory where `cotal login` keeps it, and no token ever crosses the local endpoint. The
+ * connection check (`connect.ts`) reads the space's public account identity and keeps the daemon's
+ * own per-space identity, never a Manager's. It is a
  * foreground foundation, not a resilient machine service: a daemon killed without cleanup leaves
  * its socket behind, and the next start refuses until the operator removes it (see the
  * ALREADY_RUNNING remedy). `state: "ready"` means the local control listener is bound and
@@ -16,17 +19,18 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { registry } from "@cotal-ai/core";
-import { CommandFailure, jsonFlag, plainFlag, presentationOf, renderReport, terminalWidth, writeResult } from "@cotal-ai/workspace";
+import { CommandFailure, jsonFlag, plainFlag, presentationOf, renderReport, spaceFlag, terminalWidth, writeResult } from "@cotal-ai/workspace";
 import { peerCredentials } from "@cotal-ai/seat";
 import { normalizeIdpUrl } from "@cotal-ai/auth";
 import { EndpointRefusal, daemonPaths } from "./endpoint.js";
 import { serveDaemon } from "./server.js";
-import { loginViaDaemon, queryDaemon } from "./client.js";
+import { connectCheckViaDaemon, loginViaDaemon, queryDaemon } from "./client.js";
 export const daemonFlags = [
     jsonFlag,
     plainFlag,
     { name: "idp", type: "string", value: "<auth base URL>", description: "login: the provider's auth base URL, e.g. <origin>/api/auth" },
     { name: "client-id", type: "string", value: "<id>", description: "login: the OAuth device-flow client id" },
+    spaceFlag,
 ];
 /** This binary's own version: the nearest package.json above this module (bin/ in a source run). */
 export function binVersion() {
@@ -146,6 +150,43 @@ async function login(args) {
             { title: "Signed in", blocks: [{ kind: "fields", rows: [["Account", r.label || r.sub], ["Subject", r.sub], ["Provider", r.idp]] }, { kind: "lines", lines: [{ text: "The daemon holds this session in the machine's Cotal home. No session token is printed. Each space's grants decide access separately.", tone: "hint" }] }] },
         ] }));
 }
+/** Ask the running daemon whether it could register with a space. The daemon reads the space's
+ *  public account identity and nothing else; no registration, credential or authority results. */
+async function connectCheckCommand(args) {
+    const presentation = presentationOf(args.values);
+    const space = args.values.space;
+    if (typeof space !== "string" || !space)
+        throw new CommandFailure("refused", "USAGE_INVALID", "cotal daemon connect-check needs --space <s>");
+    let reply;
+    try {
+        reply = await connectCheckViaDaemon({ paths: daemonPaths(), peerUid, space });
+    }
+    catch (e) {
+        throw asFailure(e);
+    }
+    if (!reply.ok)
+        throw new CommandFailure("refused", "USAGE_INVALID", `the daemon refused the connect check: ${reply.code} ${reply.message}`, { native: { code: reply.code } });
+    const r = reply.result;
+    const native = { native: { code: r.outcome.toUpperCase().replaceAll("-", "_") } };
+    if (r.outcome === "not-registered")
+        throw new CommandFailure("refused", "TARGET_NOT_FOUND", r.message, native);
+    if (r.outcome === "not-user-auth" || r.outcome === "unsupported-by-space")
+        throw new CommandFailure("refused", "UNSUPPORTED", r.message, native);
+    if (r.outcome === "not-signed-in")
+        throw new CommandFailure("refused", "AUTH_REQUIRED", r.message, native);
+    if (r.outcome === "unreachable")
+        throw new CommandFailure("refused", "DEPENDENCY_UNAVAILABLE", r.message, native);
+    if (r.outcome === "account-mismatch")
+        throw new CommandFailure("refused", "CONFLICT", r.message, native);
+    if (r.outcome !== "ready-to-register")
+        throw new CommandFailure("refused", "DEPENDENCY_UNAVAILABLE", r.message, native);
+    writeResult(presentation, { command: "daemon connect-check", target: { space }, result: r }, () => ({ sections: [
+            { title: "Ready to register", blocks: [
+                    { kind: "fields", rows: [["Space", r.space], ["Service", r.endpoint], ["Instance", r.instanceId], ["Account", r.accountPublicKey]] },
+                    { kind: "lines", lines: [{ text: "Nothing was registered. The space owner must approve this daemon before it can connect.", tone: "hint" }] },
+                ] },
+        ] }));
+}
 async function serve() {
     let running;
     try {
@@ -171,22 +212,25 @@ async function run(args) {
         return serve();
     if (mode === "login")
         return login(args);
-    throw new CommandFailure("refused", "USAGE_INVALID", mode === undefined ? "cotal daemon needs a mode: status, serve or login" : `unknown daemon mode ${JSON.stringify(mode)}`, { remedy: "cotal daemon status" });
+    if (mode === "connect-check")
+        return connectCheckCommand(args);
+    throw new CommandFailure("refused", "USAGE_INVALID", mode === undefined ? "cotal daemon needs a mode: status, serve, login or connect-check" : `unknown daemon mode ${JSON.stringify(mode)}`, { remedy: "cotal daemon status" });
 }
 const daemonCommand = {
     kind: "command",
     name: "daemon",
     group: "Manager",
-    summary: "the local machine daemon (Linux): serve its control endpoint, read its status, sign it in",
-    positionals: "<status|serve|login>",
+    summary: "the local machine daemon (Linux): serve its control endpoint, read its status, sign it in, check whether it can connect to a space",
+    positionals: "<status|serve|login|connect-check>",
     flags: daemonFlags,
     subcommands: [
         { name: "status", summary: "ask the running daemon for its status over the local endpoint", flagNames: ["json", "plain"], outputs: ["json", "plain"], reads: true, prepareMeshTarget: false },
         { name: "serve", summary: "run the daemon in the foreground and serve its local endpoint (refusals honor --json)", flagNames: ["json", "plain"], outputs: ["json", "plain"], prepareMeshTarget: false },
         { name: "login", summary: "sign the running daemon in to a provider with device approval; the daemon keeps the session", flagNames: ["idp", "client-id", "json", "plain"], outputs: ["json", "plain"], prepareMeshTarget: false },
+        { name: "connect-check", summary: "ask the running daemon whether it could register with a space as its own service; registers nothing", flagNames: ["space", "json", "plain"], outputs: ["json", "plain"], reads: true, prepareMeshTarget: false },
     ],
     prepareMeshTarget: false,
-    examples: ["cotal daemon serve", "cotal daemon status", "cotal daemon status --json", "cotal daemon login --idp https://example.org/api/auth"],
+    examples: ["cotal daemon serve", "cotal daemon status", "cotal daemon status --json", "cotal daemon login --idp https://example.org/api/auth", "cotal daemon connect-check --space acme"],
     run,
 };
 registry.register(daemonCommand);

package/dist/daemon/connect.js

@@ -0,0 +1,103 @@
+/**
+ * The daemon's connection readiness for one space (A2b.1). It answers whether this machine's daemon
+ * could register with the space as its own service, and if not, exactly why. It never registers,
+ * holds no bearer and starts nothing.
+ *
+ * Every input is stock: the mesh registry entry (`findMesh`), the machine's stock IdP session
+ * (`loadIdpSession`), and the registered auth provider's `serviceEndpointInfo`, which reads the
+ * space's stock service authority route (GET only, no redirects, closed parser). A 404 there means the
+ * space does not host service endpoints (stock `serviceEndpoints` is off by default); the daemon
+ * reports that, and never falls back to a Manager view, `manager.vitals` or static credentials.
+ *
+ * The daemon's identity is its own, separate from the stock Manager identity: one record per
+ * (machine home, space) under `<COTAL_HOME>/daemon/<space segment>/service-identity.json`, created
+ * once through stock `claimIdentityRecord` (exclusive create, one winner). It pins the space's
+ * DATA account on first sight; a later different account is a mismatch, never a silent repin. It
+ * holds no credential, owner, hostname or hardware id.
+ */
+import { join } from "node:path";
+import { assertLifecycleToken, isAccountNkey, mintLifecycleUid, resolveAuthProvider } from "@cotal-ai/core";
+import { claimIdentityRecord, findMesh, homeCotalDir, spaceSegment, userAuthStateDir, workspaceSecretStore } from "@cotal-ai/workspace";
+import { loadIdpSession } from "@cotal-ai/auth";
+/** The service name the daemon proposes for itself. Single-label names are reserved for reference
+ *  endpoints and a third-party name must be reverse-DNS, so this is the reverse-DNS of cotal.ai.
+ *  Binding it still needs the space operator's `name-bind`; the daemon never claims it. */
+export const DAEMON_ENDPOINT = "ai.cotal.machine";
+const KIND = "cotal-daemon-service-identity";
+/** Where this machine's daemon keeps its identity for `space`. */
+export function daemonIdentityFile(space, home = homeCotalDir()) {
+    return join(home, "daemon", spaceSegment(space), "service-identity.json");
+}
+function parseIdentity(space) {
+    return (raw) => {
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+            return undefined;
+        const o = raw;
+        const keys = Object.keys(o).sort().join(",");
+        if (keys !== "accountPublicKey,endpoint,instanceId,kind,space,v")
+            return undefined;
+        if (o.v !== 1 || o.kind !== KIND || o.space !== space || o.endpoint !== DAEMON_ENDPOINT || !isAccountNkey(o.accountPublicKey))
+            return undefined;
+        if (typeof o.instanceId !== "string")
+            return undefined;
+        try {
+            assertLifecycleToken(o.instanceId, "instanceId");
+        }
+        catch {
+            return undefined;
+        }
+        return o;
+    };
+}
+/** The fixed sentence per failure. Nothing from the remote side is quoted. */
+const SENTENCE = {
+    "not-registered": "this space is not registered on this machine; add it with `cotal meshes add`",
+    "not-user-auth": "this space does not use user sign-in, so the daemon cannot connect to it as its own service",
+    "not-signed-in": "this machine is not signed in to the space's provider; run `cotal daemon login --idp <url>`",
+    "unsupported-by-space": "the space's auth service does not host service endpoints, so the daemon cannot register with it",
+    unreachable: "the space's auth service could not be reached",
+    refused: "the space's auth service gave an answer the daemon cannot use",
+};
+/** Check readiness for `space`. `home` is the machine home where the stock session and the daemon's
+ *  own state live. */
+export async function connectCheck(space, home = homeCotalDir()) {
+    const entry = findMesh(space);
+    if (!entry)
+        return { outcome: "not-registered", space, message: SENTENCE["not-registered"] };
+    const ua = entry.mode === "user" ? entry.userAuth : undefined;
+    if (!ua)
+        return { outcome: "not-user-auth", space, message: SENTENCE["not-user-auth"] };
+    let session;
+    try {
+        session = loadIdpSession(home, ua.idp.url);
+    }
+    catch {
+        session = undefined;
+    }
+    if (!session)
+        return { outcome: "not-signed-in", space, message: SENTENCE["not-signed-in"] };
+    let accountPublicKey;
+    try {
+        const provider = resolveAuthProvider();
+        if (!provider.serviceEndpointInfo)
+            return { outcome: "unsupported-by-space", space, message: SENTENCE["unsupported-by-space"] };
+        const info = await provider.serviceEndpointInfo({ store: workspaceSecretStore(entry.root), dir: userAuthStateDir(entry.root, space, { readOnly: true }), space });
+        accountPublicKey = info.accountPublicKey;
+    }
+    catch (e) {
+        const status = e.httpStatus;
+        if (status === 404)
+            return { outcome: "unsupported-by-space", space, message: SENTENCE["unsupported-by-space"] };
+        if (status === undefined && e.outcome === "not-executed" && /did not return a response/.test(e.message))
+            return { outcome: "unreachable", space, message: SENTENCE.unreachable };
+        return { outcome: "refused", space, message: SENTENCE.refused };
+    }
+    const identity = claimIdentityRecord(daemonIdentityFile(space, home), "daemon service identity", parseIdentity(space), () => ({
+        v: 1, kind: KIND, space, endpoint: DAEMON_ENDPOINT, instanceId: mintLifecycleUid(), accountPublicKey,
+    }));
+    if (identity.accountPublicKey !== accountPublicKey)
+        return { outcome: "account-mismatch", space, pinnedAccountPublicKey: identity.accountPublicKey, observedAccountPublicKey: accountPublicKey,
+            message: "the space now answers with a different account than this daemon pinned; nothing was changed. Confirm the space was not replaced before removing the daemon's identity for it by hand" };
+    return { outcome: "ready-to-register", space, endpoint: DAEMON_ENDPOINT, instanceId: identity.instanceId, accountPublicKey,
+        message: "this daemon can ask the space to register it; the space owner must still approve it, and nothing has been registered" };
+}

package/dist/daemon/protocol.js

@@ -13,18 +13,21 @@
  */
 import { normalizeIdpUrl } from "@cotal-ai/auth";
 import { DAEMON_PROTOCOL_VERSION, MAX_LINE_BYTES } from "./endpoint.js";
-export const DAEMON_OPS = ["status", "login-start", "login-cancel"];
+export const DAEMON_OPS = ["status", "login-start", "login-cancel", "connect-check"];
 /** The fields each op takes besides `v`, `id` and `op`. Required ones must be present. */
 const OP_FIELDS = {
     status: { required: [], optional: [] },
     "login-start": { required: ["idp"], optional: ["clientId"] },
     "login-cancel": { required: ["attempt"], optional: [] },
+    "connect-check": { required: ["space"], optional: [] },
 };
 const ENVELOPE_KEYS = new Set(["v", "id", "op"]);
 const ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 /** An attempt id is daemon-minted: 22 characters of base64url. */
 export const ATTEMPT_PATTERN = /^[A-Za-z0-9_-]{22}$/;
 const MAX_CLIENT_ID = 128;
+/** A space name as it appears in a subject token. */
+const SPACE_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
 const bad = (id, message) => ({ ok: false, id, code: "BAD_FIELD", message });
 /** Parse one line (without its newline). Pure: it decides, it does nothing. */
 export function parseRequest(line) {
@@ -61,6 +64,11 @@ export function parseRequest(line) {
             return bad(id, "attempt must be the 22-character attempt id from login-prompt");
         return { ok: true, request: { v, id, op, attempt: obj.attempt } };
     }
+    if (op === "connect-check") {
+        if (typeof obj.space !== "string" || !SPACE_PATTERN.test(obj.space))
+            return bad(id, "space must be 1-64 characters of [A-Za-z0-9_-]");
+        return { ok: true, request: { v, id, op, space: obj.space } };
+    }
     if (typeof obj.idp !== "string")
         return bad(id, "idp must be the provider's auth base URL");
     let idp;

package/dist/daemon/server.js

@@ -15,6 +15,7 @@ import { createServer } from "node:net";
 import { DAEMON_PROTOCOL_VERSION, MAX_LINE_BYTES, EndpointRefusal, assertLinux, checkSocket, ensureDir, refuseExisting } from "./endpoint.js";
 import { encode, parseRequest } from "./protocol.js";
 import { createLoginCoordinator } from "./login.js";
+import { connectCheck } from "./connect.js";
 import { homeCotalDir } from "@cotal-ai/workspace";
 /** Requests one connection may send. A sign-in needs two (start, cancel); status polling a few. */
 export const MAX_REQUESTS_PER_CONNECTION = 64;
@@ -40,8 +41,9 @@ export async function serveDaemon(opts) {
     const { paths } = opts;
     const dirOutcome = ensureDir(paths.dir, uid);
     refuseExisting(paths.socket);
-    const counters = { accepted: 0, peerRejected: 0, framesDecoded: 0, requestsRefused: 0, statusAnswered: 0, loginsStarted: 0, loginsRefused: 0, cancelsAnswered: 0 };
-    const login = opts.login ?? createLoginCoordinator({ sessionDir: opts.sessionDir ?? homeCotalDir() });
+    const counters = { accepted: 0, peerRejected: 0, framesDecoded: 0, requestsRefused: 0, statusAnswered: 0, loginsStarted: 0, loginsRefused: 0, cancelsAnswered: 0, connectChecksAnswered: 0 };
+    const machineHome = opts.sessionDir ?? homeCotalDir();
+    const login = opts.login ?? createLoginCoordinator({ sessionDir: machineHome });
     const startedAt = new Date();
     const status = () => ({
         state: "ready",
@@ -109,6 +111,14 @@ export async function serveDaemon(opts) {
                 void write({ v: DAEMON_PROTOCOL_VERSION, id: req.id, ok: true, result: status() });
                 return;
             }
+            if (req.op === "connect-check") {
+                void connectCheck(req.space, machineHome).catch(() => ({ outcome: "refused", space: req.space, message: "the daemon could not complete the check" }))
+                    .then((result) => {
+                    counters.connectChecksAnswered++;
+                    return write({ v: DAEMON_PROTOCOL_VERSION, id: req.id, ok: true, result });
+                });
+                return;
+            }
             if (req.op === "login-cancel") {
                 void login.cancel(req.attempt).then((result) => {
                     counters.cancelsAnswered++;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cotal-ai",
-  "version": "0.94.5",
+  "version": "0.94.7",
   "description": "Cotal — lateral agent coordination over NATS. Run `npx cotal-ai` for the CLI.",
   "license": "Apache-2.0",
   "keywords": [
@@ -33,26 +33,26 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@cotal-ai/auth": "0.94.5",
-    "@cotal-ai/cli": "0.94.5",
-    "@cotal-ai/connector-core": "0.94.5",
-    "@cotal-ai/core": "0.94.5",
-    "@cotal-ai/delivery": "0.94.5",
-    "@cotal-ai/manager": "0.94.5",
-    "@cotal-ai/runtime": "0.94.5",
-    "@cotal-ai/seat": "0.94.5",
-    "@cotal-ai/workspace": "0.94.5"
+    "@cotal-ai/auth": "0.94.7",
+    "@cotal-ai/cli": "0.94.7",
+    "@cotal-ai/connector-core": "0.94.7",
+    "@cotal-ai/core": "0.94.7",
+    "@cotal-ai/delivery": "0.94.7",
+    "@cotal-ai/manager": "0.94.7",
+    "@cotal-ai/runtime": "0.94.7",
+    "@cotal-ai/seat": "0.94.7",
+    "@cotal-ai/workspace": "0.94.7"
   },
   "devDependencies": {
-    "@cotal-ai/connector-claude-code": "0.94.5",
-    "@cotal-ai/connector-codex": "0.94.5",
-    "@cotal-ai/connector-hermes": "0.94.5",
-    "@cotal-ai/connector-jcode": "0.94.5",
-    "@cotal-ai/connector-opencode": "0.94.5",
-    "@cotal-ai/linear": "0.94.5",
-    "@cotal-ai/pi": "0.94.5",
+    "@cotal-ai/connector-claude-code": "0.94.7",
+    "@cotal-ai/connector-codex": "0.94.7",
+    "@cotal-ai/connector-hermes": "0.94.7",
+    "@cotal-ai/connector-jcode": "0.94.7",
+    "@cotal-ai/connector-opencode": "0.94.7",
+    "@cotal-ai/linear": "0.94.7",
+    "@cotal-ai/pi": "0.94.7",
     "@cotal-ai/smoke-kit": "0.0.0",
-    "@cotal-ai/web": "0.94.5",
+    "@cotal-ai/web": "0.94.7",
     "@nats-io/jetstream": "^3.4.0",
     "@nats-io/transport-node": "^3.4.0",
     "typescript": "^5.9.3"