@joe-broadhead/opencode-messaging 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -6,6 +6,49 @@ All notable changes to `@joe-broadhead/opencode-messaging`. Versions follow
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-11-07
+
+Published on npm (public). The release that carries the `jelly` declaration (hey-jelly#36, A13) and runs
+inside Jelly (A3, A4). Built against `@joe-broadhead/messaging` **0.5.0** (vendored, release commit `0462258`:
+`37723bf`, which includes the Jelly mode lane `10438fe`, plus three fixes), and ships with the 0.5.0 daemon: the five
+platform packages `@joe-broadhead/messaging-bin-{darwin-arm64,darwin-x64,linux-arm64-gnu,linux-x64-gnu,win32-x64}`
+are pinned at exactly 0.5.0, each by the registry's integrity in the lockfile and by its executable's sha256 in
+the launcher, both equal to the release's `SHA256SUMS` and provenance. A 0.4.x daemon is refused at the IPC
+hello (`daemon_mismatch`). Messaging 0.5.0 brings the environment start contract, `cls` required with `view`
+on reads, `notice.ack` as `chat`, previews taking their action's whole input, `request.answer.preview`,
+`daemon.woke`, `person.attached`, `daemon.snapshot`, wake tickets, `ACTION_CLASSES`, and renewal of a
+session ticket by key. Nothing is removed: outside Jelly the plugin behaves as in 0.4.0.
+
+- **The `jelly` declaration** in `package.json`, as Jelly's master reads it: title, summary and icon
+  (`assets/icon.svg`); the eight tools (`messaging.read` or `messaging.send`, `allow`, read-only where
+  they only read); `asks: ["messaging.send"]`; `resources: ["messaging"]`; the `messaging` service
+  (`agent.sock`, `admin.sock`, `daemon.health` on the agent socket, wakes, `identity.json` and
+  `pairing.json` left out of backups); the section (`views/section.html`: People, Chats, Requests,
+  Devices, Your agents) with its eleven read-only methods; twelve service actions with Jelly's
+  classes and confirmations (`person.send` chat/session; `conv.markRead`, `notice.ack` chat/never;
+  `request.answer`, `grant.set`, `contact.request`, `channel.*`, `device.approve`, `device.remove`
+  local/always, with the daemon's previews); notices (Message, Request, Messaging alert); `turns`
+  labelled "Messages"; and `requires` `service`, `section`, `actions`, `turns`, `notices` and
+  `resources`, never `act`. It is built from the vendored daemon's IPC schemas
+  (`npm run jelly:update`), `check:package` validates it with Jelly's rules, and a test holds every
+  action's class, every section read (`view`, or agent tier with no grant) and every preview's class
+  equal to the daemon's `ACTION_CLASSES`.
+- **Inside Jelly** (Jelly's services accessor is present): the plugin connects to the agent socket
+  Jelly names, never starts a daemon, never resolves a home or reads `~/.messaging`, and registers
+  exactly the session name Jelly's ticket names, with the ticket. Every OpenCode session of the agent
+  shares that one Messaging session. Renewal is messaging 0.5.0's: when the agent's ticket ends, the
+  daemon keeps the session and its mail and answers `ticket_invalid`; the plugin re-reads Jelly's
+  accessor, registers the same key with the fresh ticket on the same connection, and makes the call
+  again. If the accessor still holds the ended ticket, the tool says to restart the agent in Jelly.
+- **Turns through Jelly:** inside Jelly a wake files a `turn` request with Jelly's core plugin (the
+  sender person as key, `own`, `trusted` or `guarded` from the daemon's record, a fixed prompt)
+  instead of prompting a session; every refusal falls back to notes. A guarded turn keeps the plugin's
+  Messaging send and read limit; Jelly's `jelly.peer` mark fences the rest.
+- Inside Jelly there is no console (the `config` RPC refuses) and no setup note.
+- Without the accessor nothing changes.
+- **Not yet:** the plugin does not raise the declared notices itself (Jelly reads the service's
+  counts for its badge), and the section page has no search and no card refresh.
+
 ## [0.4.0] - 2026-11-07
 
 Published on npm (public). Built against `@joe-broadhead/messaging` **0.4.0** (vendored, release commit `da50b5d`:

package/README.md

@@ -73,10 +73,10 @@ the executable (without it, the plugin uses the Node fallback):
 
 ```bash
 mkdir -p ~/.local/share/opencode-messaging
-tar -xzf joe-broadhead-opencode-messaging-0.4.0.tgz -C ~/.local/share/opencode-messaging --strip-components=1
-npm pack @joe-broadhead/messaging-bin-darwin-arm64@0.4.0           # your platform's package
+tar -xzf joe-broadhead-opencode-messaging-0.5.0.tgz -C ~/.local/share/opencode-messaging --strip-components=1
+npm pack @joe-broadhead/messaging-bin-darwin-arm64@0.5.0           # your platform's package
 mkdir -p ~/.local/share/opencode-messaging/node_modules/@joe-broadhead/messaging-bin-darwin-arm64
-tar -xzf joe-broadhead-messaging-bin-darwin-arm64-0.4.0.tgz \
+tar -xzf joe-broadhead-messaging-bin-darwin-arm64-0.5.0.tgz \
   -C ~/.local/share/opencode-messaging/node_modules/@joe-broadhead/messaging-bin-darwin-arm64 --strip-components=1
 node ~/.local/share/opencode-messaging/dist/messaging.js --help    # the messaging CLI of this version
 ```
@@ -85,7 +85,7 @@ node ~/.local/share/opencode-messaging/dist/messaging.js --help    # the messagi
 { "plugins": [{ "package": "/Users/you/.local/share/opencode-messaging" }] }
 ```
 
-`npm install ./joe-broadhead-opencode-messaging-0.4.0.tgz` into a folder OpenCode loads works too: it
+`npm install ./joe-broadhead-opencode-messaging-0.5.0.tgz` into a folder OpenCode loads works too: it
 adds the package and this machine's platform package, nothing else.
 
 ## Install from a local path
@@ -229,6 +229,66 @@ cannot. **Until Jelly ID offers browser sign-in** (Jelly's contract v1.2), the d
 `login_unsupported`, and the console says so in one sentence and points to Link this device; it never
 retries. Agent tools never sign in: `device.login` is on the daemon's admin socket only.
 
+## Running inside Jelly
+
+Jelly installs this package as a curated plugin with a service: Jelly's host runs the pinned
+`messagingd` itself, as the host owner's, and hands each agent's engine its place in it. The
+package's `jelly` declaration (in `package.json`) says what Jelly runs and draws. It is built from the
+vendored daemon's own method schemas by `npm run jelly:update`, and `npm run check:package` checks it
+with Jelly's rules.
+
+**How the plugin knows.** In a Jelly engine,
+`globalThis[Symbol.for("jelly.services")]?.get("@joe-broadhead/opencode-messaging")` answers
+`{ socket, name, ticket, expiresAt }`: the service's agent socket, the one session name this agent
+may use, and a session ticket that proves it. When that accessor is present, the plugin:
+
+- connects to that socket and **never starts a daemon** (`daemon.autostart`, `daemon.bin` and
+  `daemon.node` do nothing there), and never resolves a Messaging home, reads `~/.messaging` or looks
+  for `identity.json`; the host enrolled the service's device;
+- registers **exactly the ticket's name, with the ticket**, and no wake host. Every OpenCode session
+  of the agent (its conversation, and each turn Jelly starts) speaks as that one session, so
+  teammates see one address per agent;
+- renews with Jelly's fresh ticket. Jelly keeps the accessor's ticket current (a new one for the
+  same agent and name before `expiresAt`). Once the ticket the agent registered with ends, the service
+  keeps the session and its mail and answers its calls `ticket_invalid`; the plugin then reads the
+  accessor again, registers the same key with the fresh ticket on the same connection (which takes
+  the registration back for every connection of the agent), and makes the call again. A refused
+  `session.register` is retried the same way. If the accessor still holds the ticket that ended, the
+  tool says to restart the agent in Jelly, and the next call reads the accessor again;
+- starts **turns through Jelly**, never by prompting a session: a wake becomes a `turn` request to
+  Jelly's core plugin, one per sender person, with that person as the conversation key, the profile
+  from the daemon's record (`own` for your own devices and agents, `trusted` only when the daemon
+  calls every item trusted, else `guarded`) and a fixed prompt that carries nothing a peer wrote. Jelly
+  decides: only while the agent's owner has turned "Messages can start work" on, within Jelly's
+  budget. Any refusal (`invalid`, `agent`, `not_declared`, `off`, `budget`, `engine`) gives the items
+  notes in the agent's conversation instead. The plugin's per-person wake budget still applies;
+- in a guarded turn keeps its own Messaging limit (reads and sends reach the person the turn is for,
+  and nothing waits on a person), and leaves the rest of the fence (no shell, edits only in the
+  conversation's folder, no outward tools) to Jelly's own `jelly.peer` mark. It sets no session
+  permissions and removes no tools there. A turn Jelly marked that the plugin has no record of may
+  not read or send at all.
+
+Without the accessor, nothing above applies, and the plugin behaves exactly as in stock OpenCode.
+
+**What Jelly draws instead of `/messaging`.** Jelly runs no terminal UI: the person's console is the
+plugin's **section**, a sealed page in Jelly's navigation (`views/section.html`) with People, Chats,
+Requests, Devices and Your agents. It reads through the service's admin socket (each read is a
+declared read-only method; Jelly signs it with class `view`) and changes things only through the
+declared actions, each under the confirmation Jelly draws in its own words:
+
+| Action | Class | Confirmation |
+|---|---|---|
+| `person.send` | `chat` | once per opening |
+| `conv.markRead`, `notice.ack` | `chat` | none |
+| `request.answer`, `grant.set`, `contact.request`, `device.approve`, `device.remove` | `local` (owner devices) | every time, with the daemon's preview |
+| `channel.create`, `channel.invite`, `channel.remove`, `channel.leave` | `local` | every time |
+
+Under Jelly the plugin's `config` RPC refuses, so a TUI part loaded there anyway connects to nothing
+and starts nothing. The section's badge is Jelly's own count from the service (`notice.list`, unread and
+waiting). The declaration names the notices a banner may show (Message, Request, Messaging alert);
+this release does not raise them yet. The service's key files (`identity.json`, `pairing.json`) are
+left out of Jelly's backups.
+
 ## Docs
 
 - [Configuration](docs/configuration.md): every option and its default.

package/assets/icon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><title>Messaging</title><path d="M4 5.5A2.5 2.5 0 0 1 6.5 3h11A2.5 2.5 0 0 1 20 5.5v7a2.5 2.5 0 0 1-2.5 2.5H11l-4.5 4v-4h0A2.5 2.5 0 0 1 4 12.5z"/><path d="M8 8h8"/><path d="M8 11h5"/></svg>