cotal-ai 0.96.1 → 0.97.0

package/dist/daemon/register.js

@@ -21,12 +21,12 @@ import { join } from "node:path";
 import { contractDigest, resolveAuthProvider, ServiceAuthorityTransportError, singleDocumentClosure, VOID_SCHEMA_DIGEST } from "@cotal-ai/core";
 import { claimIdentityRecord, findMesh, homeCotalDir, spaceSegment, userAuthStateDir, workspaceSecretStore } from "@cotal-ai/workspace";
 import { connectCheck, DAEMON_ENDPOINT } from "./connect.js";
-/** The daemon's contract: one cluster with one read command, declared for the later telemetry slice.
- *  It is ephemeral, untargeted and ungoverned, the only shape the service door admits. Nothing serves it yet. */
+/** The daemon's existing void liveness contract. It reports no machine metadata or vitals.
+ *  It is ephemeral, untargeted and ungoverned, the shape the service door admits. */
 const CLUSTER = { urn: DAEMON_ENDPOINT, revision: 1, attributes: [], events: [],
     commands: [{ name: "machine-status", class: "ephemeral", targeted: false, capability: "read", inputDigest: VOID_SCHEMA_DIGEST, outputDigest: VOID_SCHEMA_DIGEST }] };
 const closure = singleDocumentClosure(CLUSTER);
-const REGISTRATION = { clusterDigests: [closure.closureDigest], contractArtifacts: [closure.manifest, CLUSTER] };
+export const DAEMON_REGISTRATION = { clusterDigests: [closure.closureDigest], contractArtifacts: [closure.manifest, CLUSTER] };
 const KIND = "cotal-daemon-register-request";
 export function daemonRegisterFile(space, home = homeCotalDir()) {
     return join(home, "daemon", spaceSegment(space), "register-request.json");
@@ -92,7 +92,7 @@ async function sendRegister(space, home) {
     const base = {
         v: 1, kind: "service-endpoint-authority", operation: "register", space,
         accountPublicKey: ready.accountPublicKey, endpoint: ready.endpoint, instanceId: ready.instanceId,
-        registration: REGISTRATION, expected: { state: "unregistered" },
+        registration: DAEMON_REGISTRATION, expected: { state: "unregistered" },
     };
     const bodyDigest = contractDigest(base);
     const record = claimIdentityRecord(daemonRegisterFile(space, home), "daemon register request", parseRecord(space), () => ({

package/dist/daemon/service.js

@@ -17,16 +17,18 @@
  *   or close). Either going down withdraws `connected` at once, as `connecting`; it is claimed again
  *   only after the broker is back and the space answers a fresh `ready`.
  *
- * No liveness command is served: the registered `machine-status` command has void output and a
- * service connection gets no stock serve grant (see the connect contract). No token, proof or
- * provider text leaves this module; every message is fixed text.
+ * The stock guest seam verifies each pulled credential against the registered authority's issuer
+ * and keys and this daemon's embedded closure. Each opened transport binds the existing void
+ * `machine-status` responder before ready. Its public descriptor includes the endpoint, derived
+ * owner token and command schemas; broker caller grants still control invoke access. It reports no vitals or machine metadata. No token, proof
+ * or provider text leaves this module; every message is fixed text.
  */
 import { join } from "node:path";
 import { existsSync } from "node:fs";
 import { randomBytes } from "node:crypto";
-import { CotalEndpoint, resolveAuthProvider, ServiceAuthorityTransportError, serviceWitnessDigest, } from "@cotal-ai/core";
+import { CotalEndpoint, authorizeGuestServeGrant, compileContract, resolveAuthProvider, serveAuthenticityOf, serveEndpoint, ServiceAuthorityTransportError, serviceWitnessDigest, VOID_SCHEMA, } from "@cotal-ai/core";
 import { FsSecretStore, findMesh, homeCotalDir, spaceSegment, userAuthStateDir, workspaceSecretStore } from "@cotal-ai/workspace";
-import { daemonRegisterFile, daemonWitness } from "./register.js";
+import { DAEMON_REGISTRATION, daemonRegisterFile, daemonWitness } from "./register.js";
 const SENTENCE = {
     "not-requested": "this daemon has not requested registration with this space; run `cotal daemon register --space <s>` first",
     "not-registered": "this space is not registered on this machine; add it with `cotal meshes add`",
@@ -114,7 +116,11 @@ export function createServiceConnections(home = homeCotalDir()) {
             l.endpoint = undefined;
             l.source = undefined;
             l.brokerUp = false;
+            l.flush = undefined;
+            const drains = [...l.serving].map((handle) => handle.stop().catch(() => { }));
             await ep?.stop().catch(() => { });
+            await Promise.all(drains);
+            l.serving.clear();
             await src?.close().catch(() => { });
         })();
         await l.closing;
@@ -138,6 +144,12 @@ export function createServiceConnections(home = homeCotalDir()) {
      *  one persisted ready request per witness. Sets `connected` only if the broker is still up. */
     async function ready(l, space, witness, store, dir) {
         const provider = resolveAuthProvider();
+        const flush = l.flush;
+        if (!flush) {
+            l.state = "unavailable";
+            return;
+        }
+        await flush();
         const requestId = await readyRequestId(store, witness);
         if (requestId === undefined) {
             l.state = "unavailable";
@@ -162,7 +174,7 @@ export function createServiceConnections(home = homeCotalDir()) {
             return;
         }
         if (answer.state === "ready") {
-            l.state = l.brokerUp && l.endpoint ? "connected" : "connecting";
+            l.state = l.brokerUp && l.endpoint && l.flush === flush && l.serving.size > 0 ? "connected" : "connecting";
             return;
         }
         if (answer.state === "denied" && answer.reason === "rate-limited") {
@@ -217,7 +229,7 @@ export function createServiceConnections(home = homeCotalDir()) {
             return result(space);
         if (current)
             await teardown(current);
-        const l = current ?? { state: "connecting", brokerUp: false };
+        const l = current ?? { state: "connecting", brokerUp: false, serving: new Set() };
         l.state = "connecting";
         l.reason = undefined;
         live.set(space, l);
@@ -238,7 +250,7 @@ export function createServiceConnections(home = homeCotalDir()) {
         const witness = w.witness;
         l.instanceId = witness.instanceId;
         const provider = resolveAuthProvider();
-        if (!provider.serviceEndpointRenewal || !provider.serviceEndpointAuthority) {
+        if (!provider.serviceEndpointRenewal || !provider.serviceEndpointAuthority || !provider.serviceEndpointInfo) {
             l.state = "unsupported";
             return result(space);
         }
@@ -246,8 +258,18 @@ export function createServiceConnections(home = homeCotalDir()) {
         const dir = userAuthStateDir(entry.root, space, { readOnly: true });
         const source = provider.serviceEndpointRenewal({ store, dir, witness });
         l.source = source;
+        let grant;
+        const pull = async () => {
+            const credential = await source.credential();
+            const info = await provider.serviceEndpointInfo({ store, dir, space });
+            if (info.accountPublicKey !== witness.accountPublicKey)
+                throw new Error("the service authority account changed");
+            grant = await authorizeGuestServeGrant({ accountPublicKey: witness.accountPublicKey, result: credential,
+                registration: DAEMON_REGISTRATION, authenticity: serveAuthenticityOf(info) });
+            return credential.accessBearer;
+        };
         try {
-            await source.bearer();
+            await pull();
         }
         catch {
             sourceFailed(l);
@@ -264,11 +286,20 @@ export function createServiceConnections(home = homeCotalDir()) {
         const endpoint = new CotalEndpoint({
             space, servers: entry.server, sentinelCreds: source.sentinelCreds,
             bearer: async () => { try {
-                return await source.bearer();
+                return await pull();
             }
             finally {
                 onEnd();
             } },
+            onConnection: (nc) => {
+                if (l.endpoint !== endpoint)
+                    return;
+                const contract = compileContract({ root: VOID_SCHEMA });
+                const handle = serveEndpoint(nc, space, grant, [{ command: "machine-status", contract: { input: contract, output: contract }, handler: () => null }], { public: true });
+                l.serving.add(handle);
+                l.flush = () => nc.flush();
+                void nc.closed().then(() => handle.stop()).catch(() => { }).finally(() => { l.serving.delete(handle); });
+            },
             card: { name: "cotal-daemon", kind: "endpoint", owner: witness.principal.owner, actor: witness.principal.actor },
             channels: [], registerPresence: false, watchPresence: false, watchChannels: false, consume: false,
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cotal-ai",
-  "version": "0.96.1",
+  "version": "0.97.0",
   "description": "Cotal — lateral agent coordination over NATS. Run `npx cotal-ai` for the CLI.",
   "license": "Apache-2.0",
   "keywords": [
@@ -33,26 +33,26 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@cotal-ai/auth": "0.96.1",
-    "@cotal-ai/cli": "0.96.1",
-    "@cotal-ai/connector-core": "0.96.1",
-    "@cotal-ai/core": "0.96.1",
-    "@cotal-ai/delivery": "0.96.1",
-    "@cotal-ai/manager": "0.96.1",
-    "@cotal-ai/runtime": "0.96.1",
-    "@cotal-ai/seat": "0.96.1",
-    "@cotal-ai/workspace": "0.96.1"
+    "@cotal-ai/auth": "0.97.0",
+    "@cotal-ai/cli": "0.97.0",
+    "@cotal-ai/connector-core": "0.97.0",
+    "@cotal-ai/core": "0.97.0",
+    "@cotal-ai/delivery": "0.97.0",
+    "@cotal-ai/manager": "0.97.0",
+    "@cotal-ai/runtime": "0.97.0",
+    "@cotal-ai/seat": "0.97.0",
+    "@cotal-ai/workspace": "0.97.0"
   },
   "devDependencies": {
-    "@cotal-ai/connector-claude-code": "0.96.1",
-    "@cotal-ai/connector-codex": "0.96.1",
-    "@cotal-ai/connector-hermes": "0.96.1",
-    "@cotal-ai/connector-jcode": "0.96.1",
-    "@cotal-ai/connector-opencode": "0.96.1",
-    "@cotal-ai/linear": "0.96.1",
-    "@cotal-ai/pi": "0.96.1",
+    "@cotal-ai/connector-claude-code": "0.97.0",
+    "@cotal-ai/connector-codex": "0.97.0",
+    "@cotal-ai/connector-hermes": "0.97.0",
+    "@cotal-ai/connector-jcode": "0.97.0",
+    "@cotal-ai/connector-opencode": "0.97.0",
+    "@cotal-ai/linear": "0.97.0",
+    "@cotal-ai/pi": "0.97.0",
     "@cotal-ai/smoke-kit": "0.0.0",
-    "@cotal-ai/web": "0.96.1",
+    "@cotal-ai/web": "0.97.0",
     "@nats-io/jetstream": "^3.4.0",
     "@nats-io/transport-node": "^3.4.0",
     "typescript": "^5.9.3"