@joe-broadhead/messaging 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -6,6 +6,156 @@ Versions follow [Semantic Versioning](https://semver.org); see
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-11-11
+
+**What Jelly asked for in opencode-messaging #17, #18, #19 and #24.** The person sees their agents' tasks as a view
+(who does the task, for whom, a sign-in it waits on, why it was refused) and stops one with a source-issued action.
+Inbound tasks become notices. A resting Jelly host wakes for a teammate's dm. The person answers two questions about
+who may reach them. The 0.8.0 follow-ups for mixed versions, the `conv.caps` presence oracle and the control-op drain
+are here too.
+
+**Upgrade the relay, then the daemons, in any order after it.** 0.9.0 and 0.8.0 daemons interoperate (below). Stores
+only grow: the daemon store goes to schema 5 and the relay database to schema 4, and a rollback keeps the data.
+
+### Compatibility
+
+- **0.9.0 and 0.8.0 daemons interoperate** (spec §8.3). Nothing on the wire between daemons was removed or tightened.
+  - Conversations, message requests and tasks work in both directions. Both releases advertise the
+    `conversations` feature that `conv.caps` checks, so neither answers the other with `peer_outdated`.
+  - A 0.9.0 executor's sign-in names its tool in the task status as A2A extension data
+    (`metadata["urn:messaging:ext:sign-in:v1"]`, spec §6.2, "Sign-in"). A 0.8.0 requester still reads a valid status
+    and its text.
+  - A 0.9.0 device advertises the new presence feature `reach` (spec §6.5). A 0.8.0 device does not, and **does not
+    enforce the reach choices** (spec §6.9, "Older daemons do not enforce the choices"). A relation grant synced to a
+    0.8.0 device of the same person is skipped there (`grant.sync.skipped`), and it keeps working.
+- **dm wakes need the relay at 0.9.0** (relay schema 4). A 0.8.0 relay parses `wake.arm` without `dms` and still arms
+  the host's agents and awaited tasks, so a 0.9.0 host behind it arms no dm and wakes as before. A 0.8.0 daemon never
+  sends `dms`, and a 0.9.0 relay arms it as before.
+- **A 0.8.0 daemon behind a 0.9.0 relay** gets the new optional `unknown` in a `conv.caps` answer only over the new
+  budget (below). It cannot parse that answer and goes ahead without one, as 0.8.0 already did when `conv.caps` was
+  refused.
+- **Rollback keeps the data.** Daemon schema 5 and relay schema 4 are additive, with generation 2 and `min_reader` 1,
+  so 0.8.0 opens both. A 0.8.0 daemon ignores the reach tables and does not enforce the choices; a 0.8.0 relay
+  ignores `dir_wake_dms`, and the rows it leaves name a ticket that no longer counts.
+
+### Added
+
+- **The task view (#17)** (spec §8.2, "The task view"). Every `TaskRecord` the daemon projects carries fields it
+  computes and never stores or sends:
+  - `agent`, the counterpart session; `person: {id, name}`, verified by the realm, never parsed from an agent's name;
+    `org` (`same`, `other` or `none`);
+  - `signIn: {tool?, by}` in `AUTH_REQUIRED`, where `by` (`you` or `them`) is computed by the viewer's own daemon and
+    never read from the peer. An executor names the tool with `task.update {signIn: {tool}}`;
+  - `refusal: {reason}` in `REJECTED`.
+  - `tool` and `reason` come only from the executor itself, through `cleanPeerText`, capped at
+    `TASK_SIGN_IN_TOOL_CHARS` and `TASK_REFUSAL_CHARS`. Agent tools show them fenced when the peer wrote them.
+- **Task notices (#18)** (spec §8.2, "Notices"). A task another person's agent asked of one of this person's agents
+  files a `message` notice with `key: "task:<task id>"` when this device accepts it. It copies no text and is never a
+  `request`. An ask held for consent stays a `request` until its person answers. A task between the person's own
+  agents files none.
+- **dm wakes (#19)** (spec §7 and §8.11, "Wake tickets").
+  - `wake.arm` takes `dms`, at most `WAKE_DMS` (256). The relay presents the ticket for a line in an armed dm by its
+    other person while the host is offline, within the existing budget (1 a minute, 6 an hour, 48 a day).
+  - The daemon arms the verified dms whose other person shares a channel with this person as a member, and returns
+    their count (`dms`). It never arms a person this person blocked or muted, or one their reach choices hide.
+  - It reads the candidates' directory views in batches (`LIMITS.dirLookupPersons` to a lookup) before it decides.
+  - The list is what held at the arm: a block while the host sleeps applies at the next arm, so at most one wake.
+  - Neither side logs a dm's id. The relay can't tell a line from other sealed events in an armed dm, so a reaction or
+    edit there may also wake the host, within the budget.
+- **Consent choices (#24)** (spec §6.9, "Reach choices").
+  - `reach.get`, `reach.set {revision, changes}` and `reach.set.preview`, on the human tier only. "Who can message
+    you" is Open, Ask me first (the default) or Never for people outside the org. "How agents may ask yours" is Open,
+    Ask me first or Never for the org's agents.
+  - Each choice is the person's own signed grant on a relation subject (`{relation: "outside" | "org"}`). A grant for
+    one person or conversation wins over it.
+  - A stale `revision` is the new error `conflict`, and nothing changes.
+  - Under Never, an outsider whose person grant sets no `chat` is refused, and their lines are hidden in existing
+    conversations at read time. Choosing again shows them. The org, the person's own lines and outsiders' agents are
+    never hidden. A person the realm no longer knows stays visible.
+  - CLI: `messaging reach`.
+- **Action tokens** (spec §8.2, "Action tokens"; design §12.5).
+  - On the human tier the daemon puts `{name, token}` on what it renders: `actions` on every `request.list` item, one
+    per answer its kind takes, and `cancel` on a task this person's agent asked that has not ended. The executor side
+    never gets `cancel`.
+  - A token binds the action, the item and the view: the admin connection, and under a Jelly host the grant's `dev`
+    and `mbr`. It is spent at its first presentation, matched or not, and lives 10 minutes. At most 256 are held per
+    view and 4,096 in all. They are in memory only, so a restart invalidates every one.
+  - A token is never logged or printed, and the agent tier never receives one or redeems one.
+  - `request.answer` and `request.answer.preview` take `token`, never with `all`. Under a Jelly host `request.answer`
+    requires it. `task.cancel` takes exactly one of `key` (the requester session) and `token` (the person, human
+    tier). A preview checks a token without spending it. Every failure is `grant_invalid`.
+- **The person's tasks, and Stop** (spec §8.2, "The person's tasks").
+  - `tasks.list` and `tasks.get`, on the admin socket with no session key, Jelly class `view`, read every side of a
+    task this device's sessions hold, as `PersonTask`. That is the task view as the owner sees it, the agent's
+    `session` name and never its key, and `cancel`, which stops the task through `task.cancel {taskId, token}`.
+  - A person-level `conv.sync` carries `task` entries, rendered for each reader. Task changes share the replay
+    buffer with conversation changes.
+  - Only this device's tasks are listed.
+- **`task.question`** (spec §8.2, "The task view").
+  - On the agent tier, from the executing session only. It ties a task in `AUTH_REQUIRED` or `INPUT_REQUIRED` to the
+    host's own pending approval or question, `{sessionId, approvalId}`.
+  - It is held in memory only and untied by any later status. It is shown only on the person's own reads, never on
+    the agent tier, in an event, or to the peer.
+  - When the session registered a host session, `sessionId` must be that one (`forbidden`).
+- **The `reach` presence feature** (spec §6.5): a device that enforces the reach choices says so.
+- **`device.list` features** (spec §8.2, "Devices"). Each of the person's own devices lists the presence features last
+  verified from it. They are absent when none was seen, which means unknown, not none.
+- **`request.waiting` states `resend` and `outdated`** (spec §8.2, §8.3 "Mixed versions").
+  - `resend`: a message request sent from 0.7.1 that its recipient held and nobody answered is shown, not re-signed
+    or resent. A request still in flight at the upgrade can't be told from a line and is not shown.
+  - `outdated`: a request whose recipient device answered with a `delivered` receipt, which only an older client sends
+    on accepting. It must be sent again once they update.
+
+### Fixed
+
+- **Presence for people who only talk in conversations** (spec §15.10). The presence audience, and the relation
+  `conv.caps` uses, counts accepted members of one conversation the relay sequences: an external dm only once
+  activated, never an invited participant. A cross-org contact no longer drops out of presence 30 days after their
+  last envelope.
+- **A control op no longer fails with a spurious `conv_conflict`** when maintenance queues a share while it drains. It
+  drains until nothing is pending, up to 3 drains. A conversation that refills on every drain is `conv_conflict`, "the
+  conversation is busy sending; try again", which can be retried as is (spec §13).
+
+### Security
+
+- **The engine always sends the strictest cut asked for a removed device** (spec §16.4, "Device cuts"). This was
+  an ordering bug in the daemon's conversation engine, present since 0.8.0, that no 0.8.0 IPC call could reach.
+  - Asked to rekey a device with an earlier `until` while a weaker rekey of that device was already queued or in
+    flight, the engine returned the queued one and dropped the earlier cut.
+  - No IPC method passes `until`, the engine isn't part of the package's exports, and the daemon's automatic rekeys
+    after a removal never ask for a stricter cut than the one they queue.
+  - Fixed and guarded by tests:
+    - a queued rekey stands in only when its cut is at least as strict;
+    - two cuts of one device combine as a union in the verifier;
+    - a cut covers the device's held entries.
+- **`conv.caps` is no longer a free presence oracle** (spec §7). Answers about unrelated persons count against
+  `LIMITS.requestsPerDay` (20) distinct persons per asking person per UTC day, shared by that person's devices.
+  Related persons, and persons already asked about that day, are always answered. Past the budget the answer names
+  the rest in `unknown`, and `peer_outdated` still applies to anyone named `outdated`.
+- **A token answers only what it was offered for.** A forged, spent, expired, dropped or mismatched token, or one
+  from another view or an earlier start, does nothing. Under a Jelly host a call that carries a token needs an action
+  grant, even for an agent-tier method.
+- **Action tokens and the question association never leave the person's own clients**, and neither is ever logged.
+
+### Stores
+
+**Stores only grow** (spec §8.8). Generation stays 2 and `min_reader` stays 1.
+
+- **Daemon store, schema 5** (`packages/daemon/store-schemas/5.json`) adds `reach_grants` and `reach_reviews`: the
+  reach choices, apart from `grants`. A daemon before schema 5 would delete a `grants` row it cannot parse, so it
+  ignores these tables instead.
+- **Relay database, schema 4** (`packages/relay/store-schemas/4.json`) adds `dir_wake_dms` and an index on `exp`. A
+  row counts only with its ticket's `exp`, and goes with it.
+- Action tokens and the question association add no table: they are held in memory only.
+
+### Tests
+
+- Each new check has a test that goes red when the check is removed: the token bindings, single use, expiry,
+  restart, tier and log; the executor never gets `cancel`; Never in existing conversations; the arm's block, mute and
+  reach rules; the expiry purge of armed dms; the question on one device holding both sides of a task.
+- The mixed-version e2e with message requests runs in both realms against `@joe-broadhead/messaging@0.7.1` when
+  `MESSAGING_E2E_OLD` is set. The gates skip it.
+
 ## [0.8.0] - 2026-11-10
 
 **Conversations replace chat and mail.** A dm, a group, a channel and a mail between two agents are now all one

package/dist/bin/messaging-mcp.js

@@ -6746,7 +6746,8 @@ const DOMAIN = {
 const URI = {
 	binding: "urn:messaging:binding:relay:v1",
 	provenance: "urn:messaging:ext:provenance:v1",
-	presence: "urn:messaging:ext:presence:v1"
+	presence: "urn:messaging:ext:presence:v1",
+	signIn: "urn:messaging:ext:sign-in:v1"
 };
 const Base64Url = string().regex(/^[A-Za-z0-9_-]*$/, "base64url without padding");
 const Key32 = string().regex(/^[A-Za-z0-9_-]{43}$/, "32 bytes, base64url without padding");
@@ -6917,6 +6918,7 @@ const ErrorCode = _enum([
 	"jelly_unavailable",
 	"log_conflict",
 	"conv_conflict",
+	"conflict",
 	"stale_epoch",
 	"device_limit",
 	"admission_required",
@@ -7866,7 +7868,12 @@ const AskLevel = _enum([
 	"request",
 	"no"
 ]);
-const GrantSubject = union$1([strictObject({ person: PersonId }), strictObject({ conv: ConvId })]);
+const GrantRelation = _enum(["outside", "org"]);
+const GrantSubject = union$1([
+	strictObject({ person: PersonId }),
+	strictObject({ conv: ConvId }),
+	strictObject({ relation: GrantRelation })
+]);
 object$1({
 	v: literal(PROTOCOL),
 	realm: RealmId,
@@ -7893,6 +7900,12 @@ const GrantSync = strictObject({ grants: array(record(string(), unknown())).min(
 function grantProblem(grant) {
 	const own = "person" in grant.subject && grant.subject.person === grant.person;
 	if ("conv" in grant.subject && (grant.chat !== void 0 || grant.trustedUntil !== void 0 || grant.discoverable !== void 0)) return "a conversation grant sets only ask and agentMail";
+	if ("relation" in grant.subject) {
+		if (grant.agentMail !== void 0 || grant.trustedUntil !== void 0 || grant.discoverable !== void 0) return "a relation grant sets only chat or ask";
+		if (grant.subject.relation === "outside" && grant.ask !== void 0) return "the outside relation grant sets only chat";
+		if (grant.subject.relation === "outside" && grant.chat === "muted") return "the outside relation grant sets chat open or blocked";
+		if (grant.subject.relation === "org" && grant.chat !== void 0) return "the org relation grant sets only ask";
+	}
 	if (own && (grant.chat !== void 0 || grant.agentMail !== void 0 || grant.ask !== void 0 || grant.trustedUntil !== void 0)) return "a grant about its own person sets only discoverable";
 	if (!own && grant.discoverable !== void 0) return "discoverable is set only on a grant about its own person";
 	if (grant.trustedUntil !== void 0) {
@@ -8356,7 +8369,8 @@ discriminatedUnion("t", [
 		url: WakeUrl,
 		ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
 		agents: array(SessionName).max(64),
-		awaiting: array(Ulid).max(500)
+		awaiting: array(Ulid).max(500),
+		dms: array(ConvId).max(256).optional()
 	}),
 	object$1({
 		t: literal("wake.disarm"),
@@ -8471,6 +8485,7 @@ const DeviceChangeView = object$1({
 	approver: MachineLabel.optional(),
 	at: Millis
 });
+const PresenceFeature = string().regex(/^[a-z][a-z0-9-]{0,31}$/, "a feature name");
 const DeviceListEntry = object$1({
 	device: MachineId,
 	label: MachineLabel,
@@ -8489,7 +8504,8 @@ const DeviceListEntry = object$1({
 		at: Millis,
 		reason: UnbindReason,
 		by: MachineId
-	}).optional()
+	}).optional(),
+	features: array(PresenceFeature).max(32).optional()
 });
 const LinkText = string().min(1).max(2048);
 const Sas = string().regex(/^[0-9]{6}$/, "six digits");
@@ -8696,6 +8712,7 @@ const DEVICE_METHODS = {
 };
 // packages/core/dist/schema/ipc/shapes.js
 const SessionKey = string().min(1).max(200);
+const ActionToken = string().regex(/^[A-Za-z0-9_-]{43}$/, "action token");
 const SendExpect = _enum([
 	"next_turn",
 	"wake",
@@ -8766,7 +8783,14 @@ const TaskFollowUp = object$1({
 	stage: DeliveryStage,
 	at: Millis
 });
-const TaskRecord = object$1({
+const TASK_SIGN_IN_TOOL_CHARS = LIMITS.previewChars;
+const TASK_REFUSAL_CHARS = LIMITS.requestChars;
+const HostLocalId = string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/, "a plain identifier of at most 200 characters");
+const TaskQuestion = strictObject({
+	sessionId: HostLocalId,
+	approvalId: HostLocalId
+});
+const TaskRecordFields = object$1({
 	task: Task$1.extend({ id: Ulid }),
 	role: _enum(["requester", "executor"]),
 	key: SessionKey.describe("local session that owns this side of the task"),
@@ -8774,8 +8798,36 @@ const TaskRecord = object$1({
 	createdAt: Millis,
 	updatedAt: Millis,
 	chain: DelegationSummary.optional(),
-	followUps: array(TaskFollowUp).min(1).max(LIMITS.taskFollowUps).optional()
-});
+	followUps: array(TaskFollowUp).min(1).max(LIMITS.taskFollowUps).optional(),
+	agent: SessionName.optional(),
+	person: object$1({
+		id: PersonId,
+		name: string().max(200)
+	}).optional(),
+	org: _enum([
+		"same",
+		"other",
+		"none"
+	]).optional(),
+	signIn: object$1({
+		tool: string().min(1).max(TASK_SIGN_IN_TOOL_CHARS).optional(),
+		by: _enum(["you", "them"])
+	}).optional(),
+	refusal: object$1({ reason: string().min(1).max(TASK_REFUSAL_CHARS) }).optional(),
+	question: TaskQuestion.optional()
+});
+function taskViewRules(schema) {
+	return schema.refine((r) => r.signIn === void 0 || r.task.status.state === "TASK_STATE_AUTH_REQUIRED", "signIn is for an AUTH_REQUIRED task").refine((r) => r.refusal === void 0 || r.task.status.state === "TASK_STATE_REJECTED", "refusal is for a REJECTED task").refine((r) => r.question === void 0 || r.role === "executor" && (r.task.status.state === "TASK_STATE_AUTH_REQUIRED" || r.task.status.state === "TASK_STATE_INPUT_REQUIRED"), "question is for the executor's side of an AUTH_REQUIRED or INPUT_REQUIRED task");
+}
+const TaskRecord = taskViewRules(TaskRecordFields);
+const PersonTask = taskViewRules(TaskRecordFields.omit({ key: true }).extend({
+	key: never().optional(),
+	session: SessionName.describe("this person's agent on this device that holds this side of the task"),
+	cancel: strictObject({
+		name: literal("cancel"),
+		token: ActionToken
+	}).optional()
+})).refine((r) => r.cancel === void 0 || r.role === "requester", "cancel is for the requester side");
 const SendTarget = SessionAddress;
 const SendResult = object$1({
 	to: SendTarget,
@@ -8818,6 +8870,17 @@ const GrantSetParams = strictObject({
 	...Levels,
 	trust: literal(true).optional()
 });
+const RequestAnswer = _enum([
+	"once",
+	"always",
+	"accept",
+	"decline",
+	"block"
+]);
+const Actions = { actions: array(strictObject({
+	name: RequestAnswer,
+	token: ActionToken
+})).max(4).optional() };
 const AskRequest = object$1({
 	id: Ulid,
 	kind: _enum(["message", "task"]),
@@ -8831,7 +8894,8 @@ const AskRequest = object$1({
 	to: SessionName,
 	preview: string().max(LIMITS.previewChars),
 	at: Millis,
-	exp: Millis
+	exp: Millis,
+	...Actions
 });
 const ContactRequestView = object$1({
 	id: Ulid,
@@ -8857,7 +8921,8 @@ const ContactRequestView = object$1({
 	}),
 	text: string().max(LIMITS.requestChars),
 	at: Millis,
-	exp: Millis
+	exp: Millis,
+	...Actions
 });
 const AgentInvitationRequest = strictObject({
 	kind: literal("agent-invitation"),
@@ -8865,7 +8930,8 @@ const AgentInvitationRequest = strictObject({
 	cid: ConvId,
 	from: ParticipantId,
 	to: ParticipantId,
-	at: Millis
+	at: Millis,
+	...Actions
 });
 const HeldRequest = union$1([
 	AskRequest,
@@ -8875,17 +8941,11 @@ const HeldRequest = union$1([
 		kind: literal("suggestion"),
 		agent: SessionName,
 		email: Email,
-		at: Millis
+		at: Millis,
+		...Actions
 	}),
 	AgentInvitationRequest
 ]);
-const RequestAnswer = _enum([
-	"once",
-	"always",
-	"accept",
-	"decline",
-	"block"
-]);
 const RequestText = string().min(1).refine((text) => text.length <= LIMITS.requestChars, { message: `at most ${LIMITS.requestChars} UTF-16 code units` });
 const PersonReach = object$1({
 	person: PersonId,
@@ -8897,14 +8957,57 @@ const PersonReach = object$1({
 const RequestAnswerParams = strictObject({
 	id: Ulid,
 	answer: RequestAnswer,
-	all: boolean().optional()
-});
+	all: boolean().optional(),
+	token: ActionToken.optional()
+}).refine((p) => p.token === void 0 || p.all !== true, "an action token answers one request: drop all");
 const ContactRequestParams = strictObject({
 	email: Email,
 	text: RequestText,
 	suggestion: Ulid.optional()
 });
+const ReachGroupId = _enum(["message", "ask"]);
+const ReachValue = _enum([
+	"open",
+	"ask",
+	"never"
+]);
+const ReachOption = object$1({
+	value: ReachValue,
+	label: string().max(40),
+	description: string().max(300)
+});
+const ReachGroup = object$1({
+	id: ReachGroupId,
+	label: string().max(80),
+	options: array(ReachOption).length(3),
+	value: ReachValue.nullable(),
+	lapsed: ReachValue.optional()
+});
+const ReachSnapshot = object$1({
+	revision: string().min(1).max(64),
+	available: boolean(),
+	groups: array(ReachGroup).length(2)
+});
+const ReachSetParams = strictObject({
+	revision: string().min(1).max(64),
+	changes: strictObject({
+		message: ReachValue.optional(),
+		ask: ReachValue.optional()
+	})
+});
 const CONSENT_METHODS = {
+	"reach.get": {
+		params: strictObject({}),
+		result: ReachSnapshot
+	},
+	"reach.set": {
+		params: ReachSetParams,
+		result: ReachSnapshot
+	},
+	"reach.set.preview": {
+		params: ReachSetParams,
+		result: object$1({ sentence: string().max(500) })
+	},
 	"grant.list": {
 		params: strictObject({ subject: GrantTarget.optional() }),
 		result: object$1({
@@ -9068,6 +9171,7 @@ const Notice = object$1({
 	}).optional(),
 	line: string().max(120).optional(),
 	device: NoticeDevice.optional(),
+	key: string().regex(/^task:[0-9A-HJKMNP-TV-Z]{26}$/, "task:<task id>").optional(),
 	at: Millis
 });
 const NoticeCounts = object$1({ requests: number().int().nonnegative() });
@@ -9138,7 +9242,8 @@ const JELLY_METHODS = {
 		}),
 		result: object$1({
 			relay: _enum(["armed", "pending"]),
-			awaiting: number().int().nonnegative()
+			awaiting: number().int().nonnegative(),
+			dms: number().int().nonnegative()
 		})
 	},
 	"wake.disarm": {
@@ -9251,7 +9356,11 @@ const FileView = object$1({
 });
 const TaskView = object$1({
 	id: Ulid,
-	state: TaskState
+	state: TaskState,
+	cancel: strictObject({
+		name: literal("cancel"),
+		token: ActionToken
+	}).optional()
 });
 const EventView = object$1({
 	cid: ConvId,
@@ -9410,6 +9519,11 @@ const ConvStreamEvent = discriminatedUnion("type", [
 	object$1({
 		type: literal("gap"),
 		pos: Seq$1
+	}),
+	object$1({
+		type: literal("task"),
+		pos: Seq$1,
+		task: PersonTask
 	})
 ]).refine((entry) => entry.type !== "event.update" || entry.cid === entry.event.cid && entry.id === entry.event.id, { message: "event.update names the same conversation and event as its projection" });
 // packages/core/dist/schema/ipc/conversations.js
@@ -9516,7 +9630,12 @@ const WaitingOnThemView = object$1({
 	at: Millis,
 	cid: ConvId.optional(),
 	agent: SessionName.optional(),
-	state: _enum(["held", "pending-delivery"])
+	state: _enum([
+		"held",
+		"pending-delivery",
+		"resend",
+		"outdated"
+	])
 });
 const ConvListParams = strictObject({
 	key: Key,
@@ -10131,16 +10250,47 @@ const IPC_METHODS = {
 			message: strictObject({ parts: array(Part$1).min(1).max(LIMITS.partsPerMessage) }).optional(),
 			artifact: Artifact.optional(),
 			append: boolean().optional(),
-			lastChunk: boolean().optional()
-		}),
+			lastChunk: boolean().optional(),
+			signIn: strictObject({ tool: string().min(1).max(TASK_SIGN_IN_TOOL_CHARS) }).optional()
+		}).refine((p) => p.signIn === void 0 || p.state === "TASK_STATE_AUTH_REQUIRED", "signIn goes with TASK_STATE_AUTH_REQUIRED"),
 		result: TaskRecord
 	},
-	"task.cancel": {
+	"task.question": {
 		params: strictObject({
 			key: SessionKey,
 			taskId: Ulid,
-			reason: string().max(1e3).optional()
+			question: TaskQuestion.nullable()
 		}),
+		result: object$1({ ok: literal(true) })
+	},
+	"tasks.list": {
+		params: strictObject({
+			role: _enum(["requester", "executor"]).optional(),
+			state: TaskState.optional(),
+			session: SessionName.optional().describe("only this agent's tasks"),
+			cursor: string().min(1).max(200).optional().describe("opaque; from a previous nextCursor"),
+			limit: number().int().min(1).max(100).optional()
+		}),
+		result: object$1({
+			tasks: array(PersonTask),
+			nextCursor: string().max(200).optional().describe("absent when there are no more pages"),
+			total: number().int().nonnegative()
+		})
+	},
+	"tasks.get": {
+		params: strictObject({
+			taskId: Ulid,
+			role: _enum(["requester", "executor"]).optional()
+		}),
+		result: PersonTask
+	},
+	"task.cancel": {
+		params: strictObject({
+			key: SessionKey.optional(),
+			taskId: Ulid,
+			reason: string().max(1e3).optional(),
+			token: ActionToken.optional()
+		}).refine((p) => p.key === void 0 !== (p.token === void 0), "give exactly one of key or token"),
 		result: TaskRecord
 	},
 	"events.subscribe": {
@@ -10293,7 +10443,8 @@ const AGENT_METHODS = [
 	"task.list",
 	"task.get",
 	"task.update",
-	"task.cancel"
+	"task.cancel",
+	"task.question"
 ];
 const HUMAN_METHODS = [
 	...conversationTier("human"),
@@ -10302,6 +10453,9 @@ const HUMAN_METHODS = [
 	"grant.list",
 	"grant.set",
 	"grant.set.preview",
+	"reach.get",
+	"reach.set",
+	"reach.set.preview",
 	"request.list",
 	"request.answer",
 	"request.answer.preview",
@@ -10311,6 +10465,8 @@ const HUMAN_METHODS = [
 	"notice.subscribe",
 	"notice.list",
 	"notice.ack",
+	"tasks.list",
+	"tasks.get",
 	"device.approve.preview",
 	"device.remove.preview",
 	"identity.replace.preview",
@@ -10461,7 +10617,8 @@ strictObject({
 strictObject({
 	t: literal("conv.capabilities"),
 	req: Req,
-	outdated: array(PersonId).max(LIMITS.convOpParticipants)
+	outdated: array(PersonId).max(LIMITS.convOpParticipants),
+	unknown: array(PersonId).min(1).max(LIMITS.convOpParticipants).optional()
 });
 union$1([strictObject({
 	t: literal("conv.push"),
@@ -10575,6 +10732,7 @@ const TOOL_REMEDIES = {
 	login_denied: "tell your person: the sign-in at Jelly ID was denied.",
 	log_conflict: "try again: their devices changed at the same time.",
 	conv_conflict: "try again: the conversation changed at the same time.",
+	conflict: "tell your person: their settings changed at the same time; they choose again.",
 	stale_epoch: "try again: the conversation's keys changed at the same time.",
 	device_limit: "ask your person to remove one of their devices first.",
 	admission_required: "ask your person to open Messaging in Jelly once: this device is not bound to their Jelly account yet.",
@@ -10752,6 +10910,11 @@ const Task = object$1({
 	titleAuthor: Author$1.optional().describe("With title: who wrote the request; ours when you asked (mine)"),
 	status: authored("The latest status message").optional(),
 	statusAuthor: Author$1.optional().describe("With status: who wrote it; ours when you run the task (asked)"),
+	signIn: object$1({
+		tool: authored("The tool the executor named").optional(),
+		by: _enum(["you", "them"]).describe("Whose sign-in it is: you (your person, for an agent of theirs) or them (the other person); your Messaging daemon decides, never the peer")
+	}).optional().describe("auth_required only: the task waits on a sign-in; the tool was written by the executor, as statusAuthor says"),
+	refusal: object$1({ reason: authored("The executor's reason") }).optional().describe("rejected only: why the executor declined, in its words, as statusAuthor says"),
 	createdAt: iso,
 	updatedAt: iso,
 	consent: ToolConsentSchema.optional(),
@@ -11312,8 +11475,11 @@ const VIEW_METHODS = [
 	"people.search",
 	"people.get",
 	"grant.list",
+	"reach.get",
 	"request.list",
 	"sessions.list",
+	"tasks.list",
+	"tasks.get",
 	"notice.subscribe",
 	"notice.list",
 	"device.list"
@@ -12623,6 +12789,11 @@ function presentTask(framer, record, consent) {
 			status: shown$1(framer, statusAuthor, peerAttributes(record))(status, PART_CHARS),
 			statusAuthor
 		} : {},
+		...record.signIn !== void 0 ? { signIn: {
+			...record.signIn.tool !== void 0 ? { tool: shown$1(framer, statusAuthor, peerAttributes(record))(record.signIn.tool, TASK_SIGN_IN_TOOL_CHARS) } : {},
+			by: record.signIn.by
+		} } : {},
+		...record.refusal !== void 0 ? { refusal: { reason: shown$1(framer, statusAuthor, peerAttributes(record))(record.refusal.reason, TASK_REFUSAL_CHARS) } } : {},
 		updatedAt: isoOf(record.updatedAt),
 		...consent !== void 0 && record.role === "executor" ? { consent } : {},
 		...record.chain !== void 0 ? { chain: presentChain(framer, record.chain) } : {}
@@ -13445,7 +13616,7 @@ var MessagingClient = class MessagingClient {
 				timer = setTimeout(() => reject(new DaemonMismatchError(`the process on the Messaging daemon socket did not say which version it is within ${wait} ms: it is a messagingd from before this version, or it is stuck. ${REMEDY}`)), wait);
 			})]);
 			if (pointer !== void 0 && hello.pid !== pointer.pid) throw new MessagingError("forbidden", "the process on the Messaging daemon's pipe is not the daemon that published it");
-			const expected = options.version ?? "0.8.0";
+			const expected = options.version ?? "0.9.0";
 			if (hello.protocol !== 1 || hello.version !== expected) throw new DaemonMismatchError(`the Messaging daemon for this home is version ${shown(hello.version)} (IPC protocol ${hello.protocol}), and this client is version ${shown(expected)} (IPC protocol 1). ${REMEDY}`, hello);
 			client.daemonHello = hello;
 			return client;
@@ -27335,7 +27506,7 @@ function registerTools(server, deps) {
 	}
 }
 // packages/mcp/dist/version.js
-const VERSION = "0.8.0";
+const VERSION = "0.9.0";
 // packages/mcp/dist/server.js
 function createMessagingMcpServer(options) {
 	if (!options.client && !options.connect) throw new TypeError("createMessagingMcpServer needs `client` or `connect`");