@joe-broadhead/opencode-messaging 0.4.0 → 0.5.0

package/dist/tui.js

@@ -5779,7 +5779,8 @@ looseObject({
 	jti: string$1().regex(/^[\x21-\x7e]{1,128}$/, "printable jti"),
 	iss: string$1().max(2048).optional(),
 	dev: string$1().max(200).optional(),
-	cls: string$1().max(32).optional()
+	cls: string$1().max(32).optional(),
+	mbr: string$1().max(200).optional()
 });
 looseObject({
 	aud: string$1().min(1).max(2048),
@@ -6305,78 +6306,104 @@ const Size = number$1().int().positive();
 const Handle = string$1().regex(/^[a-z][a-z0-9-]{0,31}$/, "lowercase handle");
 const Email = string$1().max(254).regex(/^[^\s@A-Z]{1,64}@(?:[a-z0-9-]+\.)+[a-z0-9-]+$/, "lower-case email address");
 const OrgId = string$1().min(1).max(200);
-discriminatedUnion("t", [
-	object({
-		t: literal("dir.bind"),
-		req: Req,
-		entry: LogEntry
-	}),
-	object({
-		t: literal("hello"),
-		realm: RealmId,
+const DirBindFrame = object({
+	t: literal("dir.bind"),
+	req: Req,
+	entry: LogEntry
+});
+const HostedHelloFrame = object({
+	t: literal("hello"),
+	realm: RealmId,
+	person: HostedPersonId,
+	device: DeviceId,
+	ts: Millis,
+	sig: Base64Url
+});
+const DirAppendFrame = object({
+	t: literal("dir.append"),
+	req: Req,
+	entry: LogEntry
+});
+const DirKeysFrame = object({
+	t: literal("dir.keys"),
+	req: Req,
+	stmt: KeysStatement
+});
+const DirSthFrame = object({
+	t: literal("dir.sth"),
+	req: Req,
+	size: Size.optional(),
+	from: Size.optional(),
+	epoch: number$1().int().nonnegative().optional()
+});
+const DirLookupFrame = object({
+	t: literal("dir.lookup"),
+	req: Req,
+	persons: array(object({
 		person: HostedPersonId,
-		device: DeviceId,
-		ts: Millis,
-		sig: Base64Url
-	}),
-	object({
-		t: literal("dir.append"),
-		req: Req,
-		entry: LogEntry
-	}),
-	object({
-		t: literal("dir.keys"),
-		req: Req,
-		stmt: KeysStatement
-	}),
-	object({
-		t: literal("dir.sth"),
-		req: Req,
-		size: Size.optional(),
-		from: Size.optional(),
-		epoch: number$1().int().nonnegative().optional()
-	}),
-	object({
-		t: literal("dir.lookup"),
-		req: Req,
-		persons: array(object({
-			person: HostedPersonId,
-			knownSeq: number$1().int().nonnegative().optional()
-		})).min(1).max(LIMITS.dirLookupPersons),
-		size: Size.optional()
-	}),
-	object({
-		t: literal("dir.device"),
-		req: Req,
-		device: DeviceId
-	}),
-	object({
-		t: literal("dir.resolve"),
-		req: Req,
-		handle: Handle.optional(),
-		email: Email.optional()
-	}).refine((frame) => frame.handle === void 0 !== (frame.email === void 0), { message: "exactly one of handle and email" }),
-	object({
-		t: literal("dir.search"),
-		req: Req,
-		query: string$1().min(1).max(64),
-		limit: number$1().int().min(1).max(LIMITS.dirSearchResults)
-	}),
-	object({
-		t: literal("dir.watch"),
-		req: Req,
-		persons: array(HostedPersonId).max(LIMITS.watchPersons)
-	}),
+		knownSeq: number$1().int().nonnegative().optional()
+	})).min(1).max(LIMITS.dirLookupPersons),
+	size: Size.optional()
+});
+const DirDeviceFrame = object({
+	t: literal("dir.device"),
+	req: Req,
+	device: DeviceId
+});
+const DirResolveFrame = object({
+	t: literal("dir.resolve"),
+	req: Req,
+	handle: Handle.optional(),
+	email: Email.optional()
+}).refine((frame) => frame.handle === void 0 !== (frame.email === void 0), { message: "exactly one of handle and email" });
+const DirSearchFrame = object({
+	t: literal("dir.search"),
+	req: Req,
+	query: string$1().min(1).max(64),
+	limit: number$1().int().min(1).max(LIMITS.dirSearchResults)
+});
+const DirWatchFrame = object({
+	t: literal("dir.watch"),
+	req: Req,
+	persons: array(HostedPersonId).max(LIMITS.watchPersons)
+});
+const PresenceWatchFrame = object({
+	t: literal("presence.watch"),
+	req: Req,
+	persons: array(HostedPersonId).max(LIMITS.watchPersons)
+});
+const DirEraseFrame = object({
+	t: literal("dir.erase"),
+	req: Req,
+	entries: array(LogEntry).min(1).max(LIMITS.devicesPerPerson),
+	token: Jws
+});
+const WAKE_TICKET_BYTES = 4096;
+const WakeUrl = string$1().max(2048).regex(/^https?:\/\/[^/?#@\s]+\/hosts\/hst_[A-Za-z0-9._:-]{1,123}\/wake$/, "a Jelly ID wake URL");
+discriminatedUnion("t", [
+	DirBindFrame,
+	HostedHelloFrame,
+	DirAppendFrame,
+	DirKeysFrame,
+	DirSthFrame,
+	DirLookupFrame,
+	DirDeviceFrame,
+	DirResolveFrame,
+	DirSearchFrame,
+	DirWatchFrame,
+	PresenceWatchFrame,
+	DirEraseFrame,
 	object({
-		t: literal("presence.watch"),
+		t: literal("wake.arm"),
 		req: Req,
-		persons: array(HostedPersonId).max(LIMITS.watchPersons)
+		url: WakeUrl,
+		ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
+		agents: array(SessionName).max(64),
+		awaiting: array(Ulid).max(500)
 	}),
 	object({
-		t: literal("dir.erase"),
-		req: Req,
-		entries: array(LogEntry).min(1).max(LIMITS.devicesPerPerson),
-		token: Jws
+		t: literal("wake.disarm"),
+		req: Req
 	})
 ]);
 const HostedWelcomeFrame = object({
@@ -6525,6 +6552,19 @@ const LoginState = discriminatedUnion("state", [
 		purpose: LoginPurpose
 	})
 ]);
+const DeviceRemoveParams = strictObject({
+	device: MachineId,
+	reason: _enum([
+		"self",
+		"removed",
+		"lost"
+	]).optional(),
+	token: Jws.optional()
+});
+const DeviceApproveParams = strictObject({
+	link: LinkText,
+	sas: Sas
+});
 const DEVICE_METHODS = {
 	"device.status": {
 		params: strictObject({}),
@@ -6547,15 +6587,7 @@ const DEVICE_METHODS = {
 		result: object({ devices: array(DeviceListEntry) })
 	},
 	"device.remove": {
-		params: strictObject({
-			device: MachineId,
-			reason: _enum([
-				"self",
-				"removed",
-				"lost"
-			]).optional(),
-			token: Jws.optional()
-		}),
+		params: DeviceRemoveParams,
 		result: object({ seq: number$1().int().nonnegative() })
 	},
 	"device.link": {
@@ -6592,14 +6624,11 @@ const DEVICE_METHODS = {
 		result: object({ ok: literal(true) })
 	},
 	"device.approve.preview": {
-		params: strictObject({ link: LinkText }),
+		params: DeviceApproveParams.partial({ sas: true }),
 		result: LinkPreview
 	},
 	"device.approve": {
-		params: strictObject({
-			link: LinkText,
-			sas: Sas
-		}),
+		params: DeviceApproveParams,
 		result: object({
 			device: MachineId,
 			seq: number$1().int().nonnegative()
@@ -6824,6 +6853,16 @@ const PersonReach = object({
 	source: _enum(["card", "default"]),
 	at: Millis.optional()
 });
+const RequestAnswerParams = strictObject({
+	id: Ulid,
+	answer: RequestAnswer,
+	all: boolean().optional()
+});
+const ContactRequestParams = strictObject({
+	email: Email,
+	text: RequestText,
+	suggestion: Ulid.optional()
+});
 const CONSENT_METHODS = {
 	"grant.list": {
 		params: strictObject({ subject: GrantTarget.optional() }),
@@ -6845,19 +6884,35 @@ const CONSENT_METHODS = {
 		result: object({ requests: array(HeldRequest).max(LIMITS.heldTotal * 3) })
 	},
 	"request.answer": {
-		params: strictObject({
-			id: Ulid,
-			answer: RequestAnswer,
-			all: boolean().optional()
-		}),
+		params: RequestAnswerParams,
 		result: object({ answered: array(Ulid).max(LIMITS.heldTotal) })
 	},
+	"request.answer.preview": {
+		params: RequestAnswerParams,
+		result: object({
+			kind: _enum([
+				"message",
+				"task",
+				"contact",
+				"suggestion"
+			]),
+			from: object({
+				name: string$1().max(200),
+				email: string$1().max(320).optional(),
+				org: _enum([
+					"same",
+					"other",
+					"none"
+				])
+			}),
+			agent: SessionName.optional(),
+			to: SessionName.optional(),
+			count: number$1().int().positive(),
+			sentence: string$1().max(500)
+		})
+	},
 	"contact.request": {
-		params: strictObject({
-			email: Email,
-			text: RequestText,
-			suggestion: Ulid.optional()
-		}),
+		params: ContactRequestParams,
 		result: object({
 			id: Ulid,
 			conversation: RoomRef,
@@ -6865,7 +6920,7 @@ const CONSENT_METHODS = {
 		})
 	},
 	"contact.request.preview": {
-		params: strictObject({ email: Email }),
+		params: ContactRequestParams.partial({ text: true }),
 		result: object({ found: boolean() })
 	},
 	"card.get": {
@@ -7033,7 +7088,8 @@ const SURFACE_METHODS = {
 		result: PersonSummary.extend({ devices: array(object({
 			device: MachineId,
 			label: MachineLabel,
-			self: boolean()
+			self: boolean(),
+			away: literal(true).optional()
 		})) })
 	}
 };
@@ -7151,8 +7207,45 @@ const JELLY_METHODS = {
 		params: strictObject({ ids: array(NoticeId).min(1).max(200) }),
 		result: object({ ok: literal(true) })
 	},
+	"daemon.woke": {
+		params: strictObject({}),
+		result: object({ ok: literal(true) })
+	},
+	"person.attached": {
+		params: strictObject({ attached: boolean() }),
+		result: object({ ok: literal(true) })
+	},
+	"wake.arm": {
+		params: strictObject({
+			url: WakeUrl,
+			ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
+			agents: array(SessionName).max(64)
+		}),
+		result: object({
+			relay: _enum(["armed", "pending"]),
+			awaiting: number$1().int().nonnegative()
+		})
+	},
+	"wake.disarm": {
+		params: strictObject({}),
+		result: object({ relay: _enum(["disarmed", "pending"]) })
+	},
+	"daemon.snapshot": {
+		params: strictObject({ done: literal(true).optional() }),
+		result: union$1([object({
+			folder: string$1().max(4096),
+			files: array(object({
+				name: string$1().max(64),
+				bytes: number$1().int().nonnegative(),
+				sha256: string$1().regex(/^[0-9a-f]{64}$/)
+			})).max(8),
+			storeSchema: number$1().int().positive(),
+			at: Millis,
+			until: Millis
+		}), object({ released: boolean() })])
+	},
 	"device.remove.preview": {
-		params: strictObject({ device: MachineId }),
+		params: DeviceRemoveParams,
 		result: object({
 			label: MachineLabel,
 			kind: DeviceKind.optional(),
@@ -9756,7 +9849,7 @@ var MessagingClient = class MessagingClient {
 				timer = setTimeout(() => reject(new DaemonMismatchError(`the process on the Messaging daemon socket did not say which version it is within ${wait} ms: it is a messagingd from before this version, or it is stuck. ${REMEDY}`)), wait);
 			})]);
 			if (pointer !== void 0 && hello.pid !== pointer.pid) throw new MessagingError("forbidden", "the process on the Messaging daemon's pipe is not the daemon that published it");
-			const expected = options.version ?? "0.4.0";
+			const expected = options.version ?? "0.5.0";
 			if (hello.protocol !== 1 || hello.version !== expected) throw new DaemonMismatchError(`the Messaging daemon for this home is version ${shown(hello.version)} (IPC protocol ${hello.protocol}), and this client is version ${shown(expected)} (IPC protocol 1). ${REMEDY}`, hello);
 			client.daemonHello = hello;
 			return client;
@@ -9891,39 +9984,39 @@ function toolError(code, message) {
 	return new MessagingError(code, JSON.stringify(toolErrorBody(code, message.slice(0, MAX_MESSAGE))));
 }
 // build/domain/platforms.js
-const DAEMON_VERSION = "0.4.0";
+const DAEMON_VERSION = "0.5.0";
 const DAEMON_TARGETS = {
 	"darwin-arm64": {
 		os: "darwin",
 		cpu: "arm64",
 		file: "bin/messagingd",
-		sha256: "2e9b9b4092507e00fa754b8f2d529c67597a53c74cba7bd8ded8405e235b5459"
+		sha256: "5cb51ae058c4b83cd18a56bc6c9c5a54505ee952a6cab72c5876ed570ed3e863"
 	},
 	"darwin-x64": {
 		os: "darwin",
 		cpu: "x64",
 		file: "bin/messagingd",
-		sha256: "586dae07a46eede9e75c3227f20f23c089d094878c542436aa43aef5420979be"
+		sha256: "fd767f2fbe80c2140d12adb134b32f790a1f668acf11b4354a5e75dac14fe25c"
 	},
 	"linux-arm64-gnu": {
 		os: "linux",
 		cpu: "arm64",
 		libc: "glibc",
 		file: "bin/messagingd",
-		sha256: "217d97c06a6cfff017a32ddf3c5ac3f0c07020e4263266efc7a22e0dd61de694"
+		sha256: "eddf27a9fdd55f1fbf62b5bdf6718c442790684a0f959f330ccfb03f68e91a02"
 	},
 	"linux-x64-gnu": {
 		os: "linux",
 		cpu: "x64",
 		libc: "glibc",
 		file: "bin/messagingd",
-		sha256: "8bf49cd428a461ceb01c87c0e7d49427331cac1773724e59bb164810267d9adb"
+		sha256: "17c9fef1eef307ffca13a1151dd708eaf6f63dda4e448339ac991162abed1317"
 	},
 	"win32-x64": {
 		os: "win32",
 		cpu: "x64",
 		file: "bin/messagingd.exe",
-		sha256: "eaa652a089683ba6bcce61b7bdcef2244051a7bea6bb167b488e5ce32b8825b3"
+		sha256: "363da65dcea1fe161438b05660ca15c3c05655e7539ce4463797698a2cb3f844"
 	}
 };
 function daemonTarget(platform, targets = DAEMON_TARGETS) {
@@ -10014,7 +10107,7 @@ async function packagedExecutable(target, entry, from) {
 	} catch {
 		throw refuse("has an unreadable package.json");
 	}
-	if (manifest.name !== name || manifest.version !== "0.4.0") throw refuse(`is not version ${DAEMON_VERSION}`);
+	if (manifest.name !== name || manifest.version !== "0.5.0") throw refuse(`is not version ${DAEMON_VERSION}`);
 	const path = join(dirname(manifestPath), ...entry.file.split("/"));
 	let stats;
 	try {

package/docs/architecture.md

@@ -32,6 +32,7 @@ src/
   connection.ts     the daemon link: connect, autostart hook, reconnect, agent-method allowlist
   host/             everything that imports @opencode/plugin
     context.ts        host types derived once
+    jelly.ts          inside Jelly: the services accessor, turn requests to jelly.core, the record of Jelly turns
     tools.ts          namespace + tool adapters: validate, local checks, assert, runtime, render
     permissions.ts    assert request builders; default rules (send ask, shell asks, home denies, DM read ask) via an agent transform
     peers.ts          peer sessions (find or create, stored rules, quarantine folder) and the guard's evaluate and context hooks
@@ -47,6 +48,7 @@ src/
     inbound.ts        delivery decision, wake prompts, notices, task notes, the mid-turn note
     peers.ts          peer-turn policy: the guard's verdicts, stored rules, tool allowlist, session marker
     setup.ts          the setup note for a machine that has not joined a team
+    jelly.ts          inside Jelly: the accessor entry, the shared session key, turn profile, key, prompt and answers
     managed.ts        Messaging by Jelly: the pinned realm, and the check of its messaging.json
     budget.ts         per-peer wake budget (sliding window)
     naming.ts         keys, session names, addresses, ids
@@ -72,6 +74,9 @@ src/
     status.ts         This device and /messaging-status
     qr.ts             terminal QR codes
 skills/opencode-messaging/SKILL.md
+assets/icon.svg     the plugin's mark in Jelly
+views/section.html  Jelly's section page (a sealed page: People, Chats, Requests, Devices, Your agents)
+scripts/jelly-declaration.mjs  builds package.json `jelly` from the vendored daemon's IPC schemas
 ```
 
 | Layer | May import |
@@ -127,6 +132,30 @@ the socket protocol.
 - `Link.call` refuses any method not in `AGENT_METHODS`. It turns `MessagingError` and JSON-RPC
   errors into code-prefixed tool errors (`daemon_unavailable: …`).
 
+## Inside Jelly
+
+`src/index.ts` reads `globalThis[Symbol.for("jelly.services")]` once at setup (`host/jelly.ts`). Its
+presence is Jelly mode, and changes four things; without it nothing changes.
+
+- **The link.** `DaemonConnection` gets an `endpoint` (the accessor's socket, asked on every
+  connect) and no `start`: nothing ever spawns a daemon, and no home is resolved. `Runtime.home` is
+  the socket's folder, for the permission defaults only.
+- **Registration.** `Sessions` gives every OpenCode session of the engine one key, `jelly:<name>`,
+  and registers it once per connection with the accessor's `name` and `ticket` and no `host`; a
+  second session of the agent reuses that registration. `ensure` skips the `identity.json` check: the
+  daemon answers for itself. A `ticket_invalid` on `session.register` re-reads the accessor and
+  retries only with a different ticket. On any other call (the ticket ended; the daemon keeps the
+  session), `DaemonConnection` runs its `renew` hook, `Sessions.renew`: register the same key with the
+  accessor's ticket on that connection, then make the call once more. Busy/idle is the agent's: busy while any of its sessions is.
+- **Wakes.** Delivery decides a wake as if the working session were idle (a turn runs in its own
+  conversation), keeps the coalescing window and the per-person budget, and, when the window
+  closes, files one `turn` request per sender person through `HostBridge.turn` (`jelly.core`
+  `request` `{ id, kind: "turn", body: { package, key, profile, prompt }, keep: true }`). A started
+  turn acks the items `handed_to_agent`; any refusal posts notes instead. The setup note is off.
+- **The guard.** `registerJellyGuard` replaces the peer guard: only `messaging.*` checks, only in a
+  session recorded as a guarded Jelly turn (or marked `jelly.peer` with no record, which is
+  refused). No session rules, no tool removal. The `config` RPC refuses, so no console runs.
+
 ## The `/messaging` console
 
 The TUI part is a separate entry (`./tui`) with its own connection, `ConsoleLink`

package/docs/configuration.md

@@ -51,6 +51,12 @@ where a console started a daemon in `~/.messaging` while the configured home was
 | `inbound.wakeBudget.perPeer` | integer, 1–1000 | `6` | Wakes one teammate may cause in this OpenCode process per window. Over it, their mail gets a note instead. |
 | `inbound.wakeBudget.windowMs` | integer, 60000–86400000 | `3600000` (1 h) | The sliding window of the wake budget, in milliseconds. |
 
+**Inside Jelly** (Jelly's services accessor is present; [README](../README.md#running-inside-jelly)),
+`home`, `daemon.autostart`, `daemon.bin`, `daemon.node` and `session.name` do nothing: the socket,
+the session name and its ticket come from Jelly, and Jelly's host runs the daemon. The `inbound`
+options still apply, with `inbound.wake` deciding whether a wake files a turn with Jelly, and the
+wake budget bounding those requests.
+
 ### `home`
 
 The plugin uses the first one that is set: the `home` option, then the `MESSAGING_HOME` environment
@@ -83,7 +89,7 @@ The plugin picks the first that applies (`src/process/daemon.ts`, the one place
    | Linux x64, glibc | `@joe-broadhead/messaging-bin-linux-x64-gnu` | `bin/messagingd` |
    | Windows x64 | `@joe-broadhead/messaging-bin-win32-x64` | `bin/messagingd.exe` (not code-signed; see [Windows](#windows)) |
 
-   Each is pinned at exactly the messaging release the plugin is built against (0.4.0), and npm
+   Each is pinned at exactly the messaging release the plugin is built against (0.5.0), and npm
    installs only the one whose `os` and `cpu` match. The plugin finds it from its own install
    location the way Node resolves a package, and admits it only when the package is that version,
    the executable is a regular file (not a link) with owner read and execute and no permission

package/docs/security.md

@@ -322,6 +322,31 @@ that they hold even if an earlier turn ran without them; a trusted turn names th
 they no longer apply. The guard itself never depends on the model reading this: it is enforced per
 check and per request.
 
+### Inside Jelly
+
+In a Jelly engine (Jelly's services accessor is present; [README](../README.md#running-inside-jelly)),
+the plugin creates no peer sessions and stores no session rules. A teammate's wake is a `turn`
+request to Jelly's host, which starts it in the conversation's own engine session and marks that
+session `jelly.peer` by the profile the plugin chose from the daemon's record (`guarded`, or
+`trusted` only when the daemon called every item trusted; never from the peer's text). Jelly's core
+plugin then denies, for a guarded turn, a shell, edits outside the conversation's folder, outward
+tools and changes to sign-ins, permissions or plugins; for a trusted turn, only those changes.
+
+The plugin keeps one layer of its own there: a `permission.evaluate` hook that applies the
+Messaging rows of the table above (`messaging.send` only back to the turn's person, `messaging.read`
+only of that person, nothing that would ask), and Messaging tool results scoped to that person. It
+records which engine session each started turn runs in, in plugin storage, so a reload keeps the
+limit. A session Jelly marked that the plugin has no record of may not read or send at all, and a
+session the host cannot look up is refused (fail closed). Every other action is Jelly's fence to
+decide; the plugin leaves it alone so the two fences never disagree about, say, the conversation's
+folder.
+
+**The session ticket.** On a Jelly host every engine can open the service's agent socket, so a
+name alone would let one agent take over another's inbox. The plugin registers only the name
+Jelly's ticket names, with the ticket; the daemon verifies it against the host's action key and
+refuses any other name. The ticket is never logged, and it is read from the accessor at each
+registration, never stored.
+
 ## Untrusted content framing
 
 Everything a peer authored reaches the model inside a fence. That covers message parts,