volute 0.17.0 → 0.19.0

package/templates/_base/src/lib/startup.ts

@@ -102,6 +102,49 @@ export async function handleStartupContext(sendMessage: (content: string) => voi
   }
 }
 
+export type MindPrompts = {
+  compaction_warning: string;
+  reply_instructions: string;
+  channel_invite: string;
+};
+
+const DEFAULT_PROMPTS: MindPrompts = {
+  compaction_warning:
+    "Context is getting long — compaction is about to summarize this conversation. Before that happens, save anything important to files (MEMORY.md, memory/journal/${date}.md, etc.) since those survive compaction. Focus on: decisions made, open tasks, and anything you'd need to pick up where you left off.",
+  reply_instructions: 'To reply to this message, use: volute send ${channel} "your message"',
+  channel_invite: `[Channel Invite]
+\${headers}
+
+[\${sender} — \${time}]
+\${preview}
+
+Further messages will be saved to \${filePath}
+
+To accept, add to .config/routes.json:
+  Rule: { "channel": "\${channel}", "session": "\${suggestedSession}" }
+\${batchRecommendation}To respond, use: volute send \${channel} "your message"
+To reject, delete \${filePath}`,
+};
+
+export function loadPrompts(): MindPrompts {
+  try {
+    const raw = readFileSync(resolve("home/.config/prompts.json"), "utf-8");
+    const parsed = JSON.parse(raw);
+    const result = { ...DEFAULT_PROMPTS };
+    for (const key of Object.keys(DEFAULT_PROMPTS) as (keyof MindPrompts)[]) {
+      if (typeof parsed[key] === "string") {
+        result[key] = parsed[key];
+      }
+    }
+    return result;
+  } catch (err: any) {
+    if (err?.code !== "ENOENT") {
+      log("startup", "failed to load prompts.json, using defaults:", err);
+    }
+    return DEFAULT_PROMPTS;
+  }
+}
+
 export function setupShutdown(): void {
   function shutdown() {
     log("server", "shutdown signal received");

package/templates/_base/src/lib/types.ts

@@ -13,6 +13,10 @@ export type ChannelMeta = {
   participants?: string[];
   participantCount?: number;
   typing?: string[];
+  signature?: string;
+  signatureTimestamp?: string;
+  signerFingerprint?: string;
+  verified?: boolean;
 };
 
 /** ChannelMeta enriched by the router with dispatch info. */

package/templates/_base/src/lib/volute-server.ts

@@ -1,7 +1,8 @@
+import { createHash, verify } from "node:crypto";
 import { createServer, type IncomingMessage, type Server } from "node:http";
 import { log } from "./logger.js";
 import type { Router } from "./router.js";
-import type { VoluteRequest } from "./types.js";
+import type { VoluteContentPart, VoluteRequest } from "./types.js";
 
 function readBody(req: IncomingMessage): Promise<string> {
   return new Promise((resolve, reject) => {
@@ -12,6 +13,71 @@ function readBody(req: IncomingMessage): Promise<string> {
   });
 }
 
+function extractText(content: VoluteContentPart[] | string): string {
+  if (typeof content === "string") return content;
+  return content
+    .filter((p): p is { type: "text"; text: string } => p.type === "text")
+    .map((p) => p.text)
+    .join("\n");
+}
+
+/** Normalize content to VoluteContentPart[] — connectors may send plain strings. */
+function normalizeContent(content: unknown): VoluteContentPart[] {
+  if (Array.isArray(content)) return content as VoluteContentPart[];
+  if (typeof content === "string") return [{ type: "text", text: content }];
+  return [{ type: "text", text: JSON.stringify(content) }];
+}
+
+/** Verify an Ed25519 signature against a public key */
+function verifySignature(
+  publicKeyPem: string,
+  content: string,
+  timestamp: string,
+  signature: string,
+): boolean {
+  try {
+    const data = `${content}\n${timestamp}`;
+    return verify(null, Buffer.from(data), publicKeyPem, Buffer.from(signature, "base64"));
+  } catch {
+    return false;
+  }
+}
+
+/** Look up a mind's public key via the daemon API */
+async function fetchPublicKey(fingerprint: string): Promise<string | null> {
+  const daemonPort = process.env.VOLUTE_DAEMON_PORT;
+  const daemonToken = process.env.VOLUTE_DAEMON_TOKEN;
+  if (!daemonPort || !daemonToken) return null;
+
+  try {
+    const res = await fetch(
+      `http://127.0.0.1:${daemonPort}/api/keys/${encodeURIComponent(fingerprint)}`,
+      { headers: { Authorization: `Bearer ${daemonToken}` }, signal: AbortSignal.timeout(2000) },
+    );
+    if (!res.ok) return null;
+    const data = (await res.json()) as { publicKey?: string };
+    return data.publicKey ?? null;
+  } catch (err) {
+    log("identity", "failed to fetch public key:", err);
+    return null;
+  }
+}
+
+/** Best-effort signature verification */
+async function verifyRequest(body: VoluteRequest): Promise<boolean | undefined> {
+  if (!body.signature || !body.signatureTimestamp || !body.signerFingerprint) return undefined;
+
+  const publicKey = await fetchPublicKey(body.signerFingerprint);
+  if (!publicKey) return false;
+
+  // Verify the fingerprint matches
+  const expectedFingerprint = createHash("sha256").update(publicKey).digest("hex");
+  if (expectedFingerprint !== body.signerFingerprint) return false;
+
+  const text = extractText(body.content);
+  return verifySignature(publicKey, text, body.signatureTimestamp, body.signature);
+}
+
 export function createVoluteServer(options: {
   router: Router;
   port: number;
@@ -32,7 +98,30 @@ export function createVoluteServer(options: {
     if (req.method === "POST" && url.pathname === "/message") {
       try {
         const body = JSON.parse(await readBody(req)) as VoluteRequest;
-        router.route(body.content, body);
+
+        // Strip any sender-provided verified field to prevent spoofing
+        delete body.verified;
+
+        // Best-effort signature verification (non-blocking)
+        const verified = await verifyRequest(body);
+        if (verified !== undefined) body.verified = verified;
+
+        // Normalize content — connectors may send plain strings
+        body.content = normalizeContent(body.content);
+
+        // Handle batch payloads from delivery manager
+        if ((body as any).batch) {
+          const batch = (body as any).batch as {
+            channels: Record<string, any[]>;
+          };
+          router.dispatchBatch(batch, body.session ?? "main", body);
+        } else if (body.session) {
+          // Pre-routed by daemon delivery manager — dispatch directly
+          router.dispatch(body.content, body.session, body);
+        } else {
+          // Legacy: local routing (for minds running with old daemon)
+          router.route(body.content, body);
+        }
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ok: true }));
       } catch (err) {

package/templates/claude/src/agent.ts

@@ -9,6 +9,7 @@ import { createSessionContextHook } from "./lib/hooks/session-context.js";
 import { log } from "./lib/logger.js";
 import { createMessageChannel } from "./lib/message-channel.js";
 import { createSessionStore } from "./lib/session-store.js";
+import { loadPrompts } from "./lib/startup.js";
 import { consumeStream } from "./lib/stream-consumer.js";
 import type {
   HandlerMeta,
@@ -47,10 +48,10 @@ export function createMind(options: {
   ];
 
   const sessions = new Map<string, Session>();
-  const today = new Date().toISOString().slice(0, 10);
+  const prompts = loadPrompts();
+  const today = new Date().toLocaleDateString("en-CA");
   const compactionMessage =
-    options.compactionMessage ??
-    `Context is getting long — compaction is about to summarize this conversation. Before that happens, save anything important to files (MEMORY.md, memory/journal/${today}.md, etc.) since those survive compaction. Focus on: decisions made, open tasks, and anything you'd need to pick up where you left off.`;
+    options.compactionMessage ?? prompts.compaction_warning.replace("${date}", today);
 
   // --- Event broadcasting ---
 

package/templates/claude/src/lib/hooks/reply-instructions.ts

@@ -1,7 +1,9 @@
 import type { HookCallback } from "@anthropic-ai/claude-agent-sdk";
+import { loadPrompts } from "../startup.js";
 
 export function createReplyInstructionsHook(messageChannels: Map<string, string>) {
   let fired = false;
+  const prompts = loadPrompts();
 
   const hook: HookCallback = async () => {
     if (fired) return {};
@@ -14,7 +16,7 @@ export function createReplyInstructionsHook(messageChannels: Map<string, string>
     return {
       hookSpecificOutput: {
         hookEventName: "UserPromptSubmit" as const,
-        additionalContext: `To reply to this message, use: volute send ${channel} "your message"`,
+        additionalContext: prompts.reply_instructions.replace(/\$\{channel\}/g, channel),
       },
     };
   };

package/templates/claude/src/server.ts

@@ -20,10 +20,10 @@ if (config.model) log("server", `using model: ${config.model}`);
 if (config.maxThinkingTokens) log("server", `max thinking tokens: ${config.maxThinkingTokens}`);
 
 const systemPrompt = loadSystemPrompt();
-const sessionsDir = resolve(".volute/sessions");
+const sessionsDir = resolve(".mind/sessions");
 
 // Migrate old single session.json → sessions/main.json
-const oldSessionPath = resolve(".volute/session.json");
+const oldSessionPath = resolve(".mind/session.json");
 if (existsSync(oldSessionPath) && !existsSync(resolve(sessionsDir, "main.json"))) {
   mkdirSync(sessionsDir, { recursive: true });
   renameSync(oldSessionPath, resolve(sessionsDir, "main.json"));

package/templates/claude/volute-template.json

@@ -4,6 +4,5 @@
     "biome.json.tmpl": "biome.json",
     "home/.config/config.json.tmpl": "home/.config/config.json"
   },
-  "substitute": ["package.json", ".init/SOUL.md", "home/.config/routes.json"],
-  "skillsDir": "home/.claude/skills"
+  "substitute": ["package.json", ".init/SOUL.md", "home/.config/routes.json"]
 }

package/templates/pi/src/agent.ts

@@ -13,6 +13,7 @@ import { log } from "./lib/logger.js";
 import { createReplyInstructionsExtension } from "./lib/reply-instructions-extension.js";
 import { resolveModel } from "./lib/resolve-model.js";
 import { createSessionContextExtension } from "./lib/session-context-extension.js";
+import { loadPrompts } from "./lib/startup.js";
 import type {
   HandlerMeta,
   HandlerResolver,
@@ -35,11 +36,6 @@ type PiSession = {
   messageChannels: Map<string, string>;
 };
 
-function defaultCompactionMessage(): string {
-  const today = new Date().toISOString().slice(0, 10);
-  return `Context is getting long — compaction is about to summarize this conversation. Before that happens, save anything important to files (MEMORY.md, memory/journal/${today}.md, etc.) since those survive compaction. Focus on: decisions made, open tasks, and anything you'd need to pick up where you left off.`;
-}
-
 export function createMind(options: {
   systemPrompt: string;
   cwd: string;
@@ -48,7 +44,10 @@ export function createMind(options: {
   compactionMessage?: string;
 }): { resolve: HandlerResolver } {
   const sessions = new Map<string, PiSession>();
-  const compactionMessage = options.compactionMessage ?? defaultCompactionMessage();
+  const prompts = loadPrompts();
+  const today = new Date().toLocaleDateString("en-CA");
+  const compactionMessage =
+    options.compactionMessage ?? prompts.compaction_warning.replace("${date}", today);
 
   // Shared setup (created once)
   const modelStr = options.model || process.env.PI_MODEL || "anthropic:claude-sonnet-4-20250514";
@@ -84,7 +83,7 @@ export function createMind(options: {
 
     const sessionManager = isEphemeral
       ? SessionManager.inMemory()
-      : SessionManager.continueRecent(options.cwd, `.volute/pi-sessions/${session.name}`);
+      : SessionManager.continueRecent(options.cwd, `.mind/pi-sessions/${session.name}`);
 
     log("mind", `session "${session.name}": ${isEphemeral ? "ephemeral" : "persistent"}`);
 

package/templates/pi/src/lib/reply-instructions-extension.ts

@@ -1,8 +1,10 @@
 import type { ExtensionFactory } from "@mariozechner/pi-coding-agent";
+import { loadPrompts } from "./startup.js";
 
 export function createReplyInstructionsExtension(
   messageChannels: Map<string, string>,
 ): ExtensionFactory {
+  const prompts = loadPrompts();
   return (pi) => {
     let fired = false;
     pi.on("before_agent_start", () => {
@@ -16,7 +18,7 @@ export function createReplyInstructionsExtension(
       return {
         message: {
           customType: "reply-instructions",
-          content: `To reply to this message, use: volute send ${channel} "your message"`,
+          content: prompts.reply_instructions.replace(/\$\{channel\}/g, channel),
           display: true,
         },
       };

package/templates/pi/src/lib/session-context-extension.ts

@@ -9,11 +9,11 @@ export function createSessionContextExtension(options: {
   return (pi) => {
     pi.on("before_agent_start", () => {
       try {
-        const sessionsDir = resolve(options.cwd, ".volute/pi-sessions");
+        const sessionsDir = resolve(options.cwd, ".mind/pi-sessions");
         const summary = getSessionUpdates({
           currentSession: options.currentSession,
           sessionsDir,
-          cursorFile: resolve(options.cwd, ".volute/session-cursors.json"),
+          cursorFile: resolve(options.cwd, ".mind/session-cursors.json"),
           jsonlResolver: (name) => resolvePiJsonl(sessionsDir, name),
           format: "pi",
         });

package/templates/pi/volute-template.json

@@ -4,6 +4,5 @@
     "biome.json.tmpl": "biome.json",
     "home/.config/config.json.tmpl": "home/.config/config.json"
   },
-  "substitute": ["package.json", ".init/SOUL.md", "home/.config/routes.json"],
-  "skillsDir": "home/.claude/skills"
+  "substitute": ["package.json", ".init/SOUL.md", "home/.config/routes.json"]
 }

package/dist/chunk-PO5Q2AYN.js

@@ -1,121 +0,0 @@
-#!/usr/bin/env node
-
-// src/lib/template.ts
-import {
-  cpSync,
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  statSync,
-  writeFileSync
-} from "fs";
-import { tmpdir } from "os";
-import { dirname, join, relative, resolve } from "path";
-function findTemplatesRoot() {
-  let dir = dirname(new URL(import.meta.url).pathname);
-  for (let i = 0; i < 5; i++) {
-    const candidate = resolve(dir, "templates");
-    if (existsSync(resolve(candidate, "_base"))) return candidate;
-    dir = dirname(dir);
-  }
-  console.error(
-    "Templates directory not found. Searched up from:",
-    dirname(new URL(import.meta.url).pathname)
-  );
-  process.exit(1);
-}
-function composeTemplate(templatesRoot, templateName) {
-  const baseDir = resolve(templatesRoot, "_base");
-  const templateDir = resolve(templatesRoot, templateName);
-  if (!existsSync(baseDir)) {
-    console.error("Base template not found:", baseDir);
-    process.exit(1);
-  }
-  if (!existsSync(templateDir)) {
-    console.error(`Template not found: ${templateName}`);
-    process.exit(1);
-  }
-  const composedDir = resolve(tmpdir(), `volute-template-${Date.now()}`);
-  mkdirSync(composedDir, { recursive: true });
-  cpSync(baseDir, composedDir, { recursive: true });
-  for (const file of listFiles(templateDir)) {
-    const src = resolve(templateDir, file);
-    const dest = resolve(composedDir, file);
-    mkdirSync(dirname(dest), { recursive: true });
-    cpSync(src, dest);
-  }
-  const manifestPath = resolve(composedDir, "volute-template.json");
-  if (!existsSync(manifestPath)) {
-    rmSync(composedDir, { recursive: true, force: true });
-    console.error(`Template manifest not found: ${templateName}/volute-template.json`);
-    process.exit(1);
-  }
-  const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-  const skillsSrc = resolve(composedDir, "_skills");
-  if (existsSync(skillsSrc)) {
-    const skillsDest = resolve(composedDir, manifest.skillsDir);
-    mkdirSync(skillsDest, { recursive: true });
-    cpSync(skillsSrc, skillsDest, { recursive: true });
-    rmSync(skillsSrc, { recursive: true, force: true });
-  }
-  rmSync(manifestPath);
-  return { composedDir, manifest };
-}
-function copyTemplateToDir(composedDir, destDir, mindName, manifest) {
-  cpSync(composedDir, destDir, { recursive: true });
-  for (const [from, to] of Object.entries(manifest.rename)) {
-    const fromPath = resolve(destDir, from);
-    if (existsSync(fromPath)) {
-      renameSync(fromPath, resolve(destDir, to));
-    }
-  }
-  for (const file of manifest.substitute) {
-    const path = resolve(destDir, file);
-    if (existsSync(path)) {
-      const content = readFileSync(path, "utf-8");
-      writeFileSync(path, content.replaceAll("{{name}}", mindName));
-    }
-  }
-}
-function applyInitFiles(destDir) {
-  const initDir = resolve(destDir, ".init");
-  if (!existsSync(initDir)) return;
-  const homeDir = resolve(destDir, "home");
-  for (const file of listFiles(initDir)) {
-    const src = resolve(initDir, file);
-    const dest = resolve(homeDir, file);
-    const parent = dirname(dest);
-    if (!existsSync(parent)) {
-      mkdirSync(parent, { recursive: true });
-    }
-    cpSync(src, dest);
-  }
-  rmSync(initDir, { recursive: true, force: true });
-}
-function listFiles(dir) {
-  const results = [];
-  function walk(current) {
-    for (const entry of readdirSync(current)) {
-      const full = join(current, entry);
-      if (statSync(full).isDirectory()) {
-        if (entry === ".git") continue;
-        walk(full);
-      } else {
-        results.push(relative(dir, full));
-      }
-    }
-  }
-  walk(dir);
-  return results;
-}
-
-export {
-  findTemplatesRoot,
-  composeTemplate,
-  copyTemplateToDir,
-  applyInitFiles,
-  listFiles
-};

package/dist/down-A56B5JLK.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-import {
-  run,
-  stopDaemon
-} from "./chunk-QJIIHU32.js";
-import "./chunk-6BDNWYKG.js";
-import "./chunk-2Y77MCFG.js";
-import "./chunk-ZCEYUUID.js";
-import "./chunk-M77QBTEH.js";
-import "./chunk-K3NQKI34.js";
-export {
-  run,
-  stopDaemon
-};

package/dist/mind-manager-ETNCPQJN.js

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-import {
-  MindManager,
-  getMindManager,
-  initMindManager
-} from "./chunk-CE7WMOVW.js";
-import "./chunk-OYSZNX5I.js";
-import "./chunk-ZCEYUUID.js";
-import "./chunk-M77QBTEH.js";
-import "./chunk-K3NQKI34.js";
-export {
-  MindManager,
-  getMindManager,
-  initMindManager
-};