@aopslabs/aops 0.3.9 → 0.3.10

package/dist/utils/chatv3-session-store.js

@@ -7,6 +7,10 @@ import { getAopsCliConfigFilePath } from './config.js';
 import { decryptWithPassword, encryptWithPassword, } from './password-crypto.js';
 const STORE_FILENAME = 'chatv3-sessions.json';
 const SECRET_FILENAME = 'chatv3-session.key';
+const OWNER_STORE_DIRECTORY = 'chatv3';
+const OWNER_STORE_FILENAME = 'sessions.json';
+const OWNER_SECRET_FILENAME = 'session.key';
+const LEGACY_CLAIMS_DIRECTORY = 'chatv3-legacy-claims';
 function normalizeNonEmpty(value) {
     if (typeof value !== 'string')
         return undefined;
@@ -19,14 +23,45 @@ function baseDirFromConfig() {
     }
     return path.join(os.homedir(), '.aops');
 }
-export function resolveChatv3SessionStorePath(explicitPath) {
-    return path.resolve(normalizeNonEmpty(explicitPath) ??
-        normalizeNonEmpty(process.env.AOPS_CHATV3_SESSION_STORE_PATH) ??
-        path.join(baseDirFromConfig(), STORE_FILENAME));
+function ownerKey(value) {
+    return `sha256:${crypto.createHash('sha256').update(value, 'utf8').digest('hex')}`;
 }
-function resolveChatv3SessionSecretPath() {
+export function resolveChatv3SessionOwner(explicitOwner) {
+    const explicit = normalizeNonEmpty(explicitOwner);
+    if (explicit)
+        return { key: ownerKey(`explicit:${explicit}`), source: 'explicit' };
+    const configured = normalizeNonEmpty(process.env.AOPS_CHATV3_SESSION_OWNER);
+    if (configured)
+        return { key: ownerKey(`environment:${configured}`), source: 'environment' };
+    const codexThread = normalizeNonEmpty(process.env.CODEX_THREAD_ID);
+    if (codexThread)
+        return { key: ownerKey(`codex-thread:${codexThread}`), source: 'codex-thread' };
+    const claudeSession = normalizeNonEmpty(process.env.CLAUDE_SESSION_ID) ??
+        normalizeNonEmpty(process.env.CLAUDE_CODE_SESSION_ID);
+    if (claudeSession)
+        return { key: ownerKey(`claude-session:${claudeSession}`), source: 'claude-session' };
+    const operator = `${os.userInfo().username}@${os.hostname()}`;
+    return { key: ownerKey(`operator:${operator}`), source: 'operator' };
+}
+function ownerDirectoryName(owner) {
+    return owner.key.slice('sha256:'.length, 'sha256:'.length + 24);
+}
+export function resolveChatv3SessionStorePath(explicitPath, explicitOwner) {
+    const configuredPath = normalizeNonEmpty(explicitPath) ?? normalizeNonEmpty(process.env.AOPS_CHATV3_SESSION_STORE_PATH);
+    if (configuredPath)
+        return path.resolve(configuredPath);
+    const owner = resolveChatv3SessionOwner(explicitOwner);
+    return path.resolve(baseDirFromConfig(), OWNER_STORE_DIRECTORY, ownerDirectoryName(owner), OWNER_STORE_FILENAME);
+}
+function resolveLegacyChatv3SessionStorePath() {
+    return path.join(baseDirFromConfig(), STORE_FILENAME);
+}
+function resolveLegacyChatv3SessionSecretPath() {
     return path.join(baseDirFromConfig(), SECRET_FILENAME);
 }
+function resolveChatv3SessionSecretPath(storePath) {
+    return path.join(path.dirname(storePath), OWNER_SECRET_FILENAME);
+}
 async function ensureDir(filePath) {
     await fs.mkdir(path.dirname(filePath), { recursive: true });
 }
@@ -35,18 +70,34 @@ async function enforceOwnerOnlyFileMode(filePath) {
         return;
     await fs.chmod(filePath, 0o600);
 }
-async function readStore(storePath) {
+function emptyStore(owner) {
+    return {
+        version: 2,
+        ownerKey: owner.key,
+        ownerSource: owner.source,
+        sessions: {},
+    };
+}
+async function readStore(storePath, owner) {
     try {
         const raw = await fs.readFile(storePath, 'utf8');
         const parsed = JSON.parse(raw);
+        if (parsed.version !== 2 || !normalizeNonEmpty(parsed.ownerKey)) {
+            throw new Error(`ChatV3 session store is not an agent-owned v2 store: ${storePath}`);
+        }
+        if (parsed.ownerKey !== owner.key) {
+            throw new Error(`ChatV3 session store owner mismatch: ${storePath}`);
+        }
         return {
-            version: 1,
+            version: 2,
+            ownerKey: parsed.ownerKey,
+            ownerSource: parsed.ownerSource ?? owner.source,
             sessions: parsed && typeof parsed.sessions === 'object' && parsed.sessions ? parsed.sessions : {},
         };
     }
     catch (error) {
         if (error.code === 'ENOENT') {
-            return { version: 1, sessions: {} };
+            return emptyStore(owner);
         }
         throw error;
     }
@@ -56,13 +107,12 @@ async function writeStore(storePath, store) {
     await fs.writeFile(storePath, `${JSON.stringify(store, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
     await enforceOwnerOnlyFileMode(storePath);
 }
-async function resolveSessionSecret() {
+async function resolveSessionSecret(secretPath) {
     const envSecret = normalizeNonEmpty(process.env.AOPS_CHATV3_SESSION_SECRET) ??
         normalizeNonEmpty(process.env.AOPS_MCP_TOKEN_SECRET) ??
         normalizeNonEmpty(process.env.AOPS_MCP_CONFIG_SECRET);
     if (envSecret)
         return envSecret;
-    const secretPath = resolveChatv3SessionSecretPath();
     try {
         const raw = await fs.readFile(secretPath, 'utf8');
         const secret = normalizeNonEmpty(raw);
@@ -87,43 +137,45 @@ function encodeEncryptedPayload(payload) {
 function decodeEncryptedPayload(value) {
     return JSON.parse(Buffer.from(value, 'base64').toString('utf8'));
 }
-async function encryptSecret(value) {
-    const { payload } = await encryptWithPassword(value, await resolveSessionSecret());
+async function encryptSecret(value, secretPath) {
+    const { payload } = await encryptWithPassword(value, await resolveSessionSecret(secretPath));
     return encodeEncryptedPayload(payload);
 }
-async function decryptSecret(value) {
-    return decryptWithPassword(decodeEncryptedPayload(value), await resolveSessionSecret());
+async function decryptSecret(value, secretPath) {
+    return decryptWithPassword(decodeEncryptedPayload(value), await resolveSessionSecret(secretPath));
 }
-async function encryptEpochKeys(keys) {
+async function encryptEpochKeys(keys, secretPath) {
     if (!keys || keys.length === 0)
         return undefined;
     return Promise.all(keys.map(async ({ rawEpochKey, ...rest }) => ({
         ...rest,
-        rawEpochKeyEnc: await encryptSecret(rawEpochKey),
+        rawEpochKeyEnc: await encryptSecret(rawEpochKey, secretPath),
     })));
 }
-async function decryptEpochKeys(keys) {
+async function decryptEpochKeys(keys, secretPath) {
     if (!keys || keys.length === 0)
         return undefined;
     return Promise.all(keys.map(async ({ rawEpochKeyEnc, ...rest }) => ({
         ...rest,
-        rawEpochKey: await decryptSecret(rawEpochKeyEnc),
+        rawEpochKey: await decryptSecret(rawEpochKeyEnc, secretPath),
     })));
 }
 export async function saveChatv3Session(input, secrets, options = {}) {
-    const storePath = resolveChatv3SessionStorePath(options.storePath);
-    const store = await readStore(storePath);
+    const owner = resolveChatv3SessionOwner(options.owner);
+    const storePath = resolveChatv3SessionStorePath(options.storePath, options.owner);
+    const secretPath = resolveChatv3SessionSecretPath(storePath);
+    const store = await readStore(storePath, owner);
     const existing = store.sessions[input.id];
     const now = new Date().toISOString();
-    const wrapSecretEnc = secrets.wrapSecret ? await encryptSecret(secrets.wrapSecret) : undefined;
-    const epochKeysEnc = await encryptEpochKeys(secrets.epochKeys);
+    const wrapSecretEnc = secrets.wrapSecret ? await encryptSecret(secrets.wrapSecret, secretPath) : undefined;
+    const epochKeysEnc = await encryptEpochKeys(secrets.epochKeys, secretPath);
     const record = {
         version: 1,
         ...input,
         rooms: input.rooms,
         createdAt: input.createdAt ?? existing?.createdAt ?? now,
         updatedAt: input.updatedAt ?? now,
-        memberTokenEnc: await encryptSecret(secrets.memberToken),
+        memberTokenEnc: await encryptSecret(secrets.memberToken, secretPath),
         ...(wrapSecretEnc ? { wrapSecretEnc } : {}),
         ...(epochKeysEnc ? { epochKeysEnc } : {}),
     };
@@ -131,31 +183,108 @@ export async function saveChatv3Session(input, secrets, options = {}) {
     await writeStore(storePath, store);
     return record;
 }
+async function readLegacySessionRecord(id) {
+    const legacyStorePath = resolveLegacyChatv3SessionStorePath();
+    let parsed;
+    try {
+        parsed = JSON.parse(await fs.readFile(legacyStorePath, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    const record = parsed.sessions?.[id];
+    return record ?? null;
+}
+async function claimLegacySession(id, owner, options) {
+    if (normalizeNonEmpty(options.storePath) || normalizeNonEmpty(process.env.AOPS_CHATV3_SESSION_STORE_PATH)) {
+        return null;
+    }
+    const legacyRecord = await readLegacySessionRecord(id);
+    if (!legacyRecord)
+        return null;
+    const claimDirectory = path.join(baseDirFromConfig(), LEGACY_CLAIMS_DIRECTORY);
+    const claimPath = path.join(claimDirectory, `${ownerKey(`legacy-session:${id}`).slice('sha256:'.length)}.json`);
+    await fs.mkdir(claimDirectory, { recursive: true });
+    const claim = `${JSON.stringify({ version: 1, sessionId: id, ownerKey: owner.key }, null, 2)}\n`;
+    try {
+        await fs.writeFile(claimPath, claim, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+        await enforceOwnerOnlyFileMode(claimPath);
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        const existing = JSON.parse(await fs.readFile(claimPath, 'utf8'));
+        if (existing.ownerKey !== owner.key) {
+            throw new Error(`Legacy ChatV3 session "${id}" is already owned by another local agent session.`);
+        }
+    }
+    const legacySecretPath = resolveLegacyChatv3SessionSecretPath();
+    const legacy = {
+        record: legacyRecord,
+        secrets: {
+            memberToken: await decryptSecret(legacyRecord.memberTokenEnc, legacySecretPath),
+            wrapSecret: legacyRecord.wrapSecretEnc
+                ? await decryptSecret(legacyRecord.wrapSecretEnc, legacySecretPath)
+                : undefined,
+            epochKeys: await decryptEpochKeys(legacyRecord.epochKeysEnc, legacySecretPath),
+        },
+    };
+    await saveChatv3Session({
+        id: legacy.record.id,
+        serverBaseUrl: legacy.record.serverBaseUrl,
+        handle: legacy.record.handle,
+        channel: legacy.record.channel,
+        keyId: legacy.record.keyId,
+        activeRoomId: legacy.record.activeRoomId,
+        rooms: legacy.record.rooms,
+        createdAt: legacy.record.createdAt,
+        updatedAt: legacy.record.updatedAt,
+    }, legacy.secrets, options);
+    return legacy;
+}
 export async function loadChatv3Session(id, options = {}) {
-    const store = await readStore(resolveChatv3SessionStorePath(options.storePath));
-    const record = store.sessions[id];
-    if (!record)
-        throw new Error(`ChatV3 session not found: ${id}`);
+    const owner = resolveChatv3SessionOwner(options.owner);
+    const storePath = resolveChatv3SessionStorePath(options.storePath, options.owner);
+    const store = await readStore(storePath, owner);
+    let record = store.sessions[id];
+    if (!record) {
+        const claimed = await claimLegacySession(id, owner, options);
+        if (!claimed)
+            throw new Error(`ChatV3 session not found for the current local agent owner: ${id}`);
+        const migrated = await readStore(storePath, owner);
+        record = migrated.sessions[id];
+    }
+    const secretPath = resolveChatv3SessionSecretPath(storePath);
     return {
         record,
         secrets: {
-            memberToken: await decryptSecret(record.memberTokenEnc),
-            wrapSecret: record.wrapSecretEnc ? await decryptSecret(record.wrapSecretEnc) : undefined,
-            epochKeys: await decryptEpochKeys(record.epochKeysEnc),
+            memberToken: await decryptSecret(record.memberTokenEnc, secretPath),
+            wrapSecret: record.wrapSecretEnc ? await decryptSecret(record.wrapSecretEnc, secretPath) : undefined,
+            epochKeys: await decryptEpochKeys(record.epochKeysEnc, secretPath),
         },
     };
 }
 export async function getChatv3SessionRecord(id, options = {}) {
-    const store = await readStore(resolveChatv3SessionStorePath(options.storePath));
-    return store.sessions[id] ?? null;
+    try {
+        return (await loadChatv3Session(id, options)).record;
+    }
+    catch (error) {
+        if (error.message.startsWith('ChatV3 session not found for the current local agent owner:'))
+            return null;
+        throw error;
+    }
 }
 export async function listChatv3SessionRecords(options = {}) {
-    const store = await readStore(resolveChatv3SessionStorePath(options.storePath));
+    const owner = resolveChatv3SessionOwner(options.owner);
+    const store = await readStore(resolveChatv3SessionStorePath(options.storePath, options.owner), owner);
     return Object.values(store.sessions).sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
 }
 export async function deleteChatv3Session(id, options = {}) {
-    const storePath = resolveChatv3SessionStorePath(options.storePath);
-    const store = await readStore(storePath);
+    const owner = resolveChatv3SessionOwner(options.owner);
+    const storePath = resolveChatv3SessionStorePath(options.storePath, options.owner);
+    const store = await readStore(storePath, owner);
     const existed = Boolean(store.sessions[id]);
     delete store.sessions[id];
     await writeStore(storePath, store);
@@ -178,8 +307,9 @@ export function summarizeChatv3Session(record) {
     };
 }
 export async function readChatv3SessionStoreRaw(options = {}) {
-    const storePath = resolveChatv3SessionStorePath(options.storePath);
+    const storePath = resolveChatv3SessionStorePath(options.storePath, options.owner);
     if (!fsSync.existsSync(storePath))
         return '';
+    await readStore(storePath, resolveChatv3SessionOwner(options.owner));
     return fs.readFile(storePath, 'utf8');
 }

package/native/manifest.json

@@ -6,7 +6,7 @@
       "platform": "darwin",
       "architecture": "arm64",
       "relativePath": "bin/darwin-arm64/aops-agent-assets-fs",
-      "sha256": "4aa16057593e089d2772145d853507a151514e51af38db6b1af4c20e3be0ba91",
+      "sha256": "c10dfde3b28f8c6c4d5fbc885fc6fa626763b961580e1676af6692342b2c11db",
       "capabilityClass": "macos-exclusive-durable-v1",
       "qualification": null
     },
@@ -14,7 +14,7 @@
       "platform": "darwin",
       "architecture": "x64",
       "relativePath": "bin/darwin-x64/aops-agent-assets-fs",
-      "sha256": "0b556a6155fe7df01d15ff5944e625bd270702c43c02529fcafa625e74b01176",
+      "sha256": "92cb610782d9d53a2ca43ccf8ffbcef2dd03ec684ce19f2252e3a55eda45e22a",
       "capabilityClass": "macos-exclusive-durable-v1",
       "qualification": null
     },
@@ -22,7 +22,7 @@
       "platform": "linux",
       "architecture": "arm64",
       "relativePath": "bin/linux-arm64/aops-agent-assets-fs",
-      "sha256": "50914d0d35490bba40f749a023eefa8f0bda2ef017ea2e9281eb0678997492d5",
+      "sha256": "8e8457f64e9552a3094a910f3e2214ff2e309b8d2b4754af6fe30fd7fd674ff4",
       "capabilityClass": "linux-posix-durable-v1",
       "qualification": null
     },
@@ -30,7 +30,7 @@
       "platform": "linux",
       "architecture": "x64",
       "relativePath": "bin/linux-x64/aops-agent-assets-fs",
-      "sha256": "59a3d9c11cc30111a85e5fa16e2fd198894530529ed336731a3bc635d6b2e91d",
+      "sha256": "a313faedbbb5e4ebd570750ce567ab7e42b23077a8ddf60a4c61ba24965dc01c",
       "capabilityClass": "linux-posix-durable-v1",
       "qualification": null
     },
@@ -38,11 +38,11 @@
       "platform": "win32",
       "architecture": "x64",
       "relativePath": "bin/win32-x64/aops-agent-assets-fs.exe",
-      "sha256": "2097b2cdfda37416115901fe5d0b1712243b200eacb993391e2ecc71ddce65f4",
+      "sha256": "f7b0fa243092c5c7fbcddf13ab7e6601566dd8f40078667d262c2a70588dd443",
       "capabilityClass": "windows-ntfs-crash-recoverable-v1",
       "qualification": {
         "relativePath": "qualifications/win32-x64.json",
-        "sha256": "cbd967ac77e87ea6e48a318521fbfcf2e430b76c4c1ae8d2597bd2095e56f3d1"
+        "sha256": "36fe11856fe825462846197238926c508a8753f39b6eb306b3c0e638659ef0c7"
       }
     }
   ]

package/native/qualifications/win32-x64.json

@@ -7,7 +7,7 @@
   "filesystem": "NTFS",
   "primitiveProfile": "windows-createfile-flush-movefileex-v1",
   "capabilityClass": "windows-ntfs-crash-recoverable-v1",
-  "evidenceSha256": "4351fff0b54c3e87837eb08460d135f2efd083bf61a24942f3acaf4a2e353a03",
+  "evidenceSha256": "86523b4e9d51c687d3386aaa006ce6bee7c8483b0c745d88fcceaf8ad22ae8aa",
   "crashInjectionPoints": [
     "authority-history",
     "authority-current",

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@aopslabs/aops",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "type": "module",
   "description": "AOPS CLI and terminal setup application.",
-  "aopsDockerServerVersion": "0.2.10",
+  "aopsDockerServerVersion": "0.2.11",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
@@ -32,6 +32,8 @@
     "test:commercial-managed-postgres-docker-effects": "node --test test/commercial-managed-postgres-docker-effects.test.mjs",
     "test:existing-postgres-statement-log-effects": "node --test test/existing-postgres-statement-log-effects.test.mjs",
     "test:chatv3-keyring-parameter-log-effects": "node --test test/chatv3-keyring-parameter-log-effects.test.mjs",
+    "test:chatv3-session-store": "node --test test/chatv3-session-store.test.mjs",
+    "test:projectman-review-evidence": "node --test test/projectman-review-evidence.test.mjs",
     "test:commercial-lifecycle-scale-effects": "node --test test/commercial-lifecycle-scale-effects.test.mjs",
     "test:commercial-lifecycle-managed-effects": "node --test test/commercial-lifecycle-managed-effects.test.mjs",
     "test:commercial-lifecycle-negative-effects": "node --test test/commercial-lifecycle-negative-effects.test.mjs",
@@ -51,12 +53,12 @@
     "test:hosted-contract-hardening": "node --test test/hosted-contract-hardening.test.mjs",
     "test:home": "node --test test/home-menu.test.mjs",
     "test:launchers": "node --test test/terminal-launchers.test.mjs",
-    "test:shortcuts": "pnpm run test:home && pnpm run test:cockpit && pnpm run test:launchers && pnpm run test:assets-menu && pnpm run test:agent-assets-content && pnpm run test:setup-install && pnpm run test:container-runtime && pnpm run test:native-lifecycle && pnpm run test:operation-journal && pnpm run test:commercial-canonical-order && pnpm run test:commercial-runtime-closure && pnpm run test:commercial-artifact && pnpm run test:commercial-final-readiness && pnpm run test:commercial-admission && pnpm run test:commercial-license && pnpm run test:commercial-runbook && pnpm run test:package-identity && pnpm run test:skill-discovery && pnpm run test:target-transport && pnpm run test:target-auth && pnpm run test:r6-auth-cutover && pnpm run test:r6-cutover-baseline && pnpm run test:hosted-contract-hardening",
+    "test:shortcuts": "pnpm --dir ../.. run build && pnpm run test:home && pnpm run test:cockpit && pnpm run test:launchers && pnpm run test:assets-menu && pnpm run test:agent-assets-content && pnpm run test:chatv3-session-store && pnpm run test:projectman-review-evidence && pnpm run test:setup-install && pnpm run test:container-runtime && pnpm run test:native-lifecycle && pnpm run test:operation-journal && pnpm run test:commercial-canonical-order && pnpm run test:commercial-runtime-closure && pnpm run test:commercial-artifact && pnpm run test:commercial-final-readiness && pnpm run test:commercial-admission && pnpm run test:commercial-license && pnpm run test:commercial-runbook && pnpm run test:package-identity && pnpm run test:skill-discovery && pnpm run test:target-transport && pnpm run test:target-auth && pnpm run test:r6-auth-cutover && pnpm run test:r6-cutover-baseline && pnpm run test:hosted-contract-hardening",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "start": "node dist/main.js"
   },
   "dependencies": {
-    "@aopslabs/aops-server": "0.2.10",
+    "@aopslabs/aops-server": "0.2.11",
     "@aopslabs/artifact-trust-contracts": "0.3.1",
     "@aopslabs/cli-kit": "0.1.0",
     "@aopslabs/aops-host-registration": "0.2.1",

package/agent-assets-release/agent-assets/core/0ffc854a8e32500f3d82c10a1e1ee6376d57e616201a323638f0f9caf8fb2706/files/references/chatv3/SKILL.md

@@ -1,49 +0,0 @@
----
-name: aops-cli-chatv3
-description: Use for encrypted ChatV3 product channels, invitations, local session context, membership, presence, epochs, and message operations through the AOPS CLI.
----
-
-# ChatV3
-
-Use `aops chatv3` for product-facing encrypted channel/session operations.
-This is different from `aops chat`, which owns hosted agent coordination,
-wakes, inbox cursors, and room bindings.
-
-Read only the relevant section of `../../user-guides/chatv3.md`. Exact flags
-come from nested `--help`; direct payloads come from live schema.
-
-## Common entry points
-
-```bash
-aops chatv3 --help
-aops chatv3 channel --help
-aops chatv3 session --help
-aops chatv3 member --help
-aops chatv3 send --help
-aops chatv3 read --help
-```
-
-Typical discovery and read flow:
-
-```bash
-aops chatv3 session list --json
-aops chatv3 channels --json
-aops agent tools --domain chatv3 --summary --json
-aops agent schema --tool chatv3.channel.list --summary --json
-```
-
-ChatV3 may keep invite, member-token, and room-key context in a private local
-session store. Never paste those values into chat, logs, source files, or raw
-shell history. Use supported secure-store, input-file, or environment
-mechanisms; the CLI does not collect secrets through terminal prompts.
-
-For a write not exposed by sugar, inspect the exact live schema before invoke:
-
-```bash
-aops agent schema --tool chatv3.<operation> --summary --json
-aops agent invoke --tool chatv3.<operation> --input '@payload.json' --preview --json
-```
-
-Do not use ChatV3 as the durable Projectman review record or the structured
-`discuss` transcript. Link or summarize outcomes into the correct owner when
-durability matters.

package/agent-assets-release/agent-assets/core/0ffc854a8e32500f3d82c10a1e1ee6376d57e616201a323638f0f9caf8fb2706/files/references/hosted-chat/SKILL.md

@@ -1,64 +0,0 @@
----
-name: aops-cli-chat
-description: Use for hosted Agentspace coordination rooms and direct messages, membership, bindings, messages, inbox/listen/catchup cursors, manifests, and agent onboarding briefs.
----
-
-# Hosted AOPS chat
-
-`aops chat` is the coordination and wake channel for agents/operators. It is
-not ChatV3 encrypted product messaging, the structured `discuss` transcript,
-or the Projectman review record.
-
-Deep semantics and troubleshooting are in the hosted-chat sections of
-`../../user-guides/agentspace.md`.
-
-## Room lifecycle
-
-```bash
-aops chat --help
-aops chat room list --json
-aops chat room create --slug <slug> --title "<purpose>" \
-  --created-by <agent> --member "<agent>:<role>" --apply --json
-aops chat room get --id <id> --json
-aops chat room brief --room-id <id> --for <agent>
-aops chat room manifest --room-id <id> --json
-```
-
-Use stable agent/operator identities and explicit role keys. Room closeout is
-operator-controlled; ordinary task completion should not silently close it.
-
-## Bind durable references
-
-```bash
-aops chat binding add --room-id <id> \
-  --binding-type projectman.board --ref-id <board-id> \
-  --title "PM board" --created-by <agent> --apply --json
-aops chat room manifest --room-id <id> --json
-```
-
-Bindings orient participants; they do not move canonical truth out of
-Projectman, Docman, or Agentspace.
-
-## Messages and unread work
-
-```bash
-aops chat message send --help
-aops chat inbox --for <agent> --json
-aops chat listen --for <agent> --room-id <id> \
-  --timeout-sec 570 --interval-sec 15 --json
-aops chat catchup --for <agent> --room-id <id> --apply --summary --json
-```
-
-Send a message to wake/coordinate a peer, then use Projectman for review status
-or Discuss for a decision stance. Read cursors are per participant; acknowledge
-directives and advance cursors only after processing the message.
-
-## Schema fallback
-
-```bash
-aops agent tools --domain agentspace --q chat --limit 20 --summary --json
-aops agent schema --tool agentspace.chat-message.send --summary --json
-```
-
-Do not guess member, cursor, or binding payloads. Never put database passwords,
-auth tokens, or ChatV3 room keys into hosted room messages.