pi-daddy 0.27.3 → 0.27.4

package/CHANGELOG.md

@@ -12,6 +12,13 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
+## 0.27.4 — independent Herdr delegation names (2026-09-17)
+
+- Generate a fresh execution suffix instead of a process-local counter, preventing parallel Pi parents
+  and extension reloads from reusing globally reserved Herdr agent names.
+- Keep readable tab labels and valid agent names within Herdr's 32-character limit.
+- Regression coverage exercises parallel processes and fresh module instances; grant and cleanup behavior is unchanged.
+
 ## 0.27.3 — visible completed delegation history (2026-09-15)
 
 - Show how many completed roots and children the compact ledger dashboard hides.

package/dist/herdr-name.d.ts

@@ -1,37 +1,3 @@
-/**
- * Naming a herdr agent: the grammar herdr enforces, and uniqueness it does not.
- *
- * Split out of `src/run-herdr.ts` at the 400-line ceiling, and a real seam: both rules below come from **herdr's
- * own validation and lifecycle**, not from anything this package decides. Two shipping defects lived here, and
- * both were invisible to every test because the unit fake accepts whatever name it is handed and the integration
- * suite never reaches a real herdr spawn. They surfaced from two real spawns against the live daemon.
- */
-/**
- * Make a herdr agent name that is **valid** and cannot collide with a live one.
- *
- * **Validity is a separate, PRE-EXISTING defect, and it is the more serious half.** Callers build a name as
- * `${definition}-${childId}`, and a ledger child id is hierarchical — `d0.1`, `d0.1.2` (ADR-0008/F8). Those dots
- * are **not in herdr's grammar**, so `agent start review-d0.1 …` is rejected with `invalid_agent_name`. Every
- * `delegate({agent})` on the herdr path has therefore failed at `agent start` since the executor was written.
- *
- * Nothing could see it. The unit fake accepts any name it is handed, and the integration suite never reaches a
- * real herdr spawn — so both were green while the feature could not work. It surfaced only by running two real
- * spawns against the live daemon, which is the argument for doing that at all.
- *
- * **Measured, and a shipping defect without it.** herdr binds an agent name to its **tab**, and only closing
- * the tab frees the name: a second `agent start` with a name still held returns
- * `agent_name_taken: agent <name> is already used; … tab_id=…`. `herdr agent stop` does not exist (see
- * `cleanup`), so nothing else releases it.
- *
- * Callers build a name from the definition and the ledger child id — and for a plain blocking `delegate` that
- * id is **constant** (`d0.1`, index 0 of the session), so every delegation in a session asked for the same
- * name. That was harmless while the pane closed at the end of each call. Once ADR-0032 kept panes alive to
- * `agent_settled`, the **first** delegation of a turn worked and every later one failed with
- * `agent_name_taken`, on the executor ADR-0031 had just made the default.
- *
- * Uniquified HERE rather than at the call site, so no caller can forget: the constraint belongs to herdr, and
- * this module is the only thing that talks to herdr. The suffix is a counter rather than a random token so a
- * pane label stays readable and reproducible within a run.
- */
+/** Valid Herdr identity independent of process counters, parent labels and reloads. */
 export declare function uniqueAgentName(base: string): string;
 //# sourceMappingURL=herdr-name.d.ts.map

package/dist/herdr-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"herdr-name.d.ts","sourceRoot":"","sources":["../src/herdr-name.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAapD"}
+{"version":3,"file":"herdr-name.d.ts","sourceRoot":"","sources":["../src/herdr-name.ts"],"names":[],"mappings":"AASA,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUpD"}

package/dist/herdr-name.js

@@ -1,59 +1,20 @@
 /**
- * Naming a herdr agent: the grammar herdr enforces, and uniqueness it does not.
- *
- * Split out of `src/run-herdr.ts` at the 400-line ceiling, and a real seam: both rules below come from **herdr's
- * own validation and lifecycle**, not from anything this package decides. Two shipping defects lived here, and
- * both were invisible to every test because the unit fake accepts whatever name it is handed and the integration
- * suite never reaches a real herdr spawn. They surfaced from two real spawns against the live daemon.
- */
-/** Monotonic within this process. See `uniqueAgentName`. */
-let spawnSeq = 0;
-/**
- * herdr's agent-name grammar, measured from its own rejection message.
- *
- * `agent name must start with a lowercase letter and contain only lowercase letters, digits, '-' or '_'
- * (1-32 characters)`.
+ * Herdr reserves agent names across all parents until their tabs close.
+ * A counter alone is process-local: parallel parents and module reloads repeat it.
+ * Keep the readable base separate from a fresh, 80-bit execution suffix.
  */
+import { randomBytes } from "node:crypto";
 const AGENT_NAME_MAX = 32;
-/**
- * Make a herdr agent name that is **valid** and cannot collide with a live one.
- *
- * **Validity is a separate, PRE-EXISTING defect, and it is the more serious half.** Callers build a name as
- * `${definition}-${childId}`, and a ledger child id is hierarchical — `d0.1`, `d0.1.2` (ADR-0008/F8). Those dots
- * are **not in herdr's grammar**, so `agent start review-d0.1 …` is rejected with `invalid_agent_name`. Every
- * `delegate({agent})` on the herdr path has therefore failed at `agent start` since the executor was written.
- *
- * Nothing could see it. The unit fake accepts any name it is handed, and the integration suite never reaches a
- * real herdr spawn — so both were green while the feature could not work. It surfaced only by running two real
- * spawns against the live daemon, which is the argument for doing that at all.
- *
- * **Measured, and a shipping defect without it.** herdr binds an agent name to its **tab**, and only closing
- * the tab frees the name: a second `agent start` with a name still held returns
- * `agent_name_taken: agent <name> is already used; … tab_id=…`. `herdr agent stop` does not exist (see
- * `cleanup`), so nothing else releases it.
- *
- * Callers build a name from the definition and the ledger child id — and for a plain blocking `delegate` that
- * id is **constant** (`d0.1`, index 0 of the session), so every delegation in a session asked for the same
- * name. That was harmless while the pane closed at the end of each call. Once ADR-0032 kept panes alive to
- * `agent_settled`, the **first** delegation of a turn worked and every later one failed with
- * `agent_name_taken`, on the executor ADR-0031 had just made the default.
- *
- * Uniquified HERE rather than at the call site, so no caller can forget: the constraint belongs to herdr, and
- * this module is the only thing that talks to herdr. The suffix is a counter rather than a random token so a
- * pane label stays readable and reproducible within a run.
- */
+/** Valid Herdr identity independent of process counters, parent labels and reloads. */
 export function uniqueAgentName(base) {
-    spawnSeq += 1;
-    const suffix = `-${spawnSeq}`;
+    const suffix = "-" + randomBytes(10).toString("hex");
     const cleaned = base
         .toLowerCase()
-        .replace(/[^a-z0-9_-]+/g, "-") // dots from a child id, and anything else outside the grammar
+        .replace(/[^a-z0-9_-]+/g, "-")
         .replace(/-{2,}/g, "-")
-        .replace(/^[^a-z]+/, ""); // must START with a lowercase letter, so a leading digit or dash goes
-    // Truncated so the whole name fits, and trimmed of a trailing separator so the join stays readable. The
-    // fallback covers a base that sanitises to nothing at all (a definition named entirely in non-Latin script).
+        .replace(/^[^a-z]+/, "");
     const room = AGENT_NAME_MAX - suffix.length;
     const head = cleaned.slice(0, room).replace(/[-_]+$/, "") || "agent";
-    return `${head}${suffix}`;
+    return head + suffix;
 }
 //# sourceMappingURL=herdr-name.js.map

package/dist/herdr-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"herdr-name.js","sourceRoot":"","sources":["../src/herdr-name.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,IAAI,QAAQ,GAAG,CAAC,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,QAAQ,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,8DAA8D;SAC5F,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,sEAAsE;IAClG,wGAAwG;IACxG,6GAA6G;IAC7G,MAAM,IAAI,GAAG,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;IACrE,OAAO,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"herdr-name.js","sourceRoot":"","sources":["../src/herdr-name.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;IACrE,OAAO,IAAI,GAAG,MAAM,CAAC;AACvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.27.3",
+  "version": "0.27.4",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/herdr-name.ts

@@ -1,61 +1,21 @@
 /**
- * Naming a herdr agent: the grammar herdr enforces, and uniqueness it does not.
- *
- * Split out of `src/run-herdr.ts` at the 400-line ceiling, and a real seam: both rules below come from **herdr's
- * own validation and lifecycle**, not from anything this package decides. Two shipping defects lived here, and
- * both were invisible to every test because the unit fake accepts whatever name it is handed and the integration
- * suite never reaches a real herdr spawn. They surfaced from two real spawns against the live daemon.
+ * Herdr reserves agent names across all parents until their tabs close.
+ * A counter alone is process-local: parallel parents and module reloads repeat it.
+ * Keep the readable base separate from a fresh, 80-bit execution suffix.
  */
+import { randomBytes } from "node:crypto";
 
-/** Monotonic within this process. See `uniqueAgentName`. */
-let spawnSeq = 0;
-
-/**
- * herdr's agent-name grammar, measured from its own rejection message.
- *
- * `agent name must start with a lowercase letter and contain only lowercase letters, digits, '-' or '_'
- * (1-32 characters)`.
- */
 const AGENT_NAME_MAX = 32;
 
-/**
- * Make a herdr agent name that is **valid** and cannot collide with a live one.
- *
- * **Validity is a separate, PRE-EXISTING defect, and it is the more serious half.** Callers build a name as
- * `${definition}-${childId}`, and a ledger child id is hierarchical — `d0.1`, `d0.1.2` (ADR-0008/F8). Those dots
- * are **not in herdr's grammar**, so `agent start review-d0.1 …` is rejected with `invalid_agent_name`. Every
- * `delegate({agent})` on the herdr path has therefore failed at `agent start` since the executor was written.
- *
- * Nothing could see it. The unit fake accepts any name it is handed, and the integration suite never reaches a
- * real herdr spawn — so both were green while the feature could not work. It surfaced only by running two real
- * spawns against the live daemon, which is the argument for doing that at all.
- *
- * **Measured, and a shipping defect without it.** herdr binds an agent name to its **tab**, and only closing
- * the tab frees the name: a second `agent start` with a name still held returns
- * `agent_name_taken: agent <name> is already used; … tab_id=…`. `herdr agent stop` does not exist (see
- * `cleanup`), so nothing else releases it.
- *
- * Callers build a name from the definition and the ledger child id — and for a plain blocking `delegate` that
- * id is **constant** (`d0.1`, index 0 of the session), so every delegation in a session asked for the same
- * name. That was harmless while the pane closed at the end of each call. Once ADR-0032 kept panes alive to
- * `agent_settled`, the **first** delegation of a turn worked and every later one failed with
- * `agent_name_taken`, on the executor ADR-0031 had just made the default.
- *
- * Uniquified HERE rather than at the call site, so no caller can forget: the constraint belongs to herdr, and
- * this module is the only thing that talks to herdr. The suffix is a counter rather than a random token so a
- * pane label stays readable and reproducible within a run.
- */
+/** Valid Herdr identity independent of process counters, parent labels and reloads. */
 export function uniqueAgentName(base: string): string {
-  spawnSeq += 1;
-  const suffix = `-${spawnSeq}`;
+  const suffix = "-" + randomBytes(10).toString("hex");
   const cleaned = base
     .toLowerCase()
-    .replace(/[^a-z0-9_-]+/g, "-") // dots from a child id, and anything else outside the grammar
+    .replace(/[^a-z0-9_-]+/g, "-")
     .replace(/-{2,}/g, "-")
-    .replace(/^[^a-z]+/, ""); // must START with a lowercase letter, so a leading digit or dash goes
-  // Truncated so the whole name fits, and trimmed of a trailing separator so the join stays readable. The
-  // fallback covers a base that sanitises to nothing at all (a definition named entirely in non-Latin script).
+    .replace(/^[^a-z]+/, "");
   const room = AGENT_NAME_MAX - suffix.length;
   const head = cleaned.slice(0, room).replace(/[-_]+$/, "") || "agent";
-  return `${head}${suffix}`;
+  return head + suffix;
 }