@m8tes/sdk 0.1.0-alpha.6 → 0.1.0-alpha.8

package/CHANGELOG.md

@@ -13,6 +13,40 @@ All notable changes to `@m8tes/sdk`.
 > While the version is a `-alpha.N` prerelease, publish with dist-tag `alpha`.
 > The first stable release is published with `--tag latest` deliberately.
 
+## [0.1.0-alpha.8] - 2026-09-06
+
+### Added
+
+- **`client.groups` for recursive shared Teams.** Create and move nested groups, inspect visible
+  ancestor paths and management capabilities, manage direct and inherited viewer, runner, or
+  editor roles, and run the verified-email invitation lifecycle. New invitations default to
+  editor, while migrated grants remain viewer. Membership calls are account-scoped and independent
+  of organization membership and the legacy bulk Mate visibility operation exposed by
+  `groups.share()`.
+- Agent responses expose `can_manage`, `can_execute`, and owner-only `can_share` so clients can
+  present the effective capabilities of a scoped Team member.
+
+## [0.1.0-alpha.7] - 2026-09-06
+
+### Fixed
+
+- **`runs.reply()` forwards every per-reply override.** The body was hard-coded to `{ message }`,
+  so `tools`, `permission_mode`, `task_setup_tools`, `feedback` and `human_in_the_loop` never
+  reached the server, though `RunReply` accepts all five and the Python SDK sends them. An object
+  literal was a compile error, so the silent path was narrow but real: an options object built in a
+  variable that ALSO sets `raiseOnError` or `idempotencyKey` — an SDK wrapper forwarding caller
+  options is the obvious shape — type-checks clean and dropped the rest. `human_in_the_loop: false`
+  is the one that bites: it is the documented way to pin non-interactive behaviour, so an unattended
+  TypeScript reply loop could still pause on a question. `RunReplyOptions` now declares all five and
+  is the single source of truth for the body; `test/server-drift.test.ts` pins it against the
+  server's own `RunReply` model. `stream` is now sent explicitly, as `sdk/py` and `@m8tes/react`
+  already do.
+- **A mid-turn override 409 is `ConflictError`, not `RunNotStreamingError`.** Sending any
+  per-reply override while the current turn is still executing is refused with 409 so the
+  override cannot be silently dropped. `http.stream()` used to map every stream 409 to
+  "the run already finished, fall back to `get()`" — true for `GET /runs/{id}/stream`,
+  false for POST reply/create. Callers pinning `human_in_the_loop: false` mid-turn would
+  have been told the run ended while it was still executing under the old settings.
 ## [0.1.0-alpha.6] - 2026-09-05
 
 ### Fixed

package/README.md

@@ -109,6 +109,35 @@ await client.tasks.triggers.create(task.id, { type: "app", app: "github", trigge
 const { url } = await client.tasks.enableWebhook(task.id);
 ```
 
+## Recursive Teams
+
+Organize agents into nested Teams and grant a role across one subtree:
+
+```ts
+const marketing = await client.groups.create({ name: "Marketing" });
+const paidAds = await client.groups.create({ name: "Paid Ads", parent_id: marketing.id });
+const google = await client.groups.create({ name: "Google", parent_id: paidAds.id });
+await client.agents.update(agent.id, { group_id: google.id });
+
+const invite = await client.groups.invite(marketing.id, {
+  email: "ada@example.com",
+  role: "runner",
+});
+const members = await client.groups.members(google.id); // includes inherited roles
+await client.groups.updateMember(marketing.id, members.data[0]!.member_id, { role: "editor" });
+```
+
+New invitations default to `editor`; choose `viewer` for read access or `runner` for read plus
+run/chat/reply/cancel/approve. Editors can also edit Mates, tasks, documents, and work inside the
+subtree. Existing grants remain `viewer`. Roles inherit through child Teams. Editors cannot manage
+members or roles, self-escalate, reorganize Teams, or move a Mate out of the shared scope.
+
+Team sharing is account-scoped and does not make someone an organization member. Runs use the
+shared Mate owner's bound tools and billing while auditing the human requester separately;
+credentials stay opaque. Group CRUD still accepts `user_id` for end-user isolation, while
+membership and invitation methods do not. `groups.share()` remains the separate legacy bulk
+operation for direct Mates' visibility.
+
 ## Human-in-the-loop
 
 When a run pauses, the stream emits an `approval-request` or `question` event. Answer it and the run resumes.

package/dist/{chunk-F6B6R3SP.js → chunk-5X7I2XPE.js}

@@ -1117,5 +1117,5 @@ function seg(value) {
 }
 
 export { APIError, AuthenticationError, BillingError, ConflictError, M8tesApiError, NotFoundError, PROTOCOL_VERSION, PermissionDeniedError, RateLimitError, RunFailedError, RunNotStreamingError, TERMINAL_EVENT_TYPES, ValidationError, accumulate, createAccumulator, createNormalizer, createSseDecoder, errorClassForStatus, errorFromResponse, initialConversationState, isTerminalEvent, parseErrorEnvelope, parseRetryAfter, parseSse, seg, splitConcatenatedJson };
-//# sourceMappingURL=chunk-F6B6R3SP.js.map
-//# sourceMappingURL=chunk-F6B6R3SP.js.map
+//# sourceMappingURL=chunk-5X7I2XPE.js.map
+//# sourceMappingURL=chunk-5X7I2XPE.js.map