@mu-cabin/muc-cli 0.6.4 → 0.6.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mu-cabin/muc-cli",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "Standalone agent-first MUC CLI with an embedded background daemon",
   "license": "MIT",
   "type": "module",

package/skills/muc/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: muc
 description: Operate the standalone MUC CLI for account login, background daemon, contacts, groups, chats, messages, files, reactions and event listening. For source-code development inspect the repository directly.
-compatibility: Requires the migrated standalone @mu-cabin/muc-cli and Node.js 22.16 or newer. Check muc --help; older npm releases use different commands.
+metadata:
+  compatibility: Requires the migrated standalone @mu-cabin/muc-cli and Node.js 22.16 or newer. Check muc --help; older npm releases use different commands.
 ---
 
 # MUC CLI
@@ -9,7 +10,7 @@ compatibility: Requires the migrated standalone @mu-cabin/muc-cli and Node.js 22
 Use the installed CLI's manifest and strict JSON schemas. Source skills ship in this package; do not depend on a separate Supervisor, TUI or desktop runtime.
 
 - Account and daemon lifecycle: [profiles-and-lifecycle.md](references/profiles-and-lifecycle.md).
-- Read operations, IDs and event cursors: [operations.md](references/operations.md).
+- Read operations, group management, IDs and event cursors: [operations.md](references/operations.md).
 - Sends, attachments, reactions and other mutations: [mutations.md](references/mutations.md).
 - Output, credentials and recovery: [safety-and-output.md](references/safety-and-output.md).
 
@@ -30,10 +31,10 @@ $OutputEncoding = [System.Text.UTF8Encoding]::new($false)
 '{"limit":20}' | muc.cmd --output json exec chats.list --profile-id profile-id
 ```
 
-CMD accepts `muc.cmd exec chats.list --profile-id profile-id < request.json` with a UTF-8 JSON file. A leading UTF-8 BOM and CRLF are supported. Use forward slashes or escaped backslashes inside JSON Windows paths. Windows storage defaults to `%USERPROFILE%\.muc`; stop the daemon for the same config root before upgrading.
+CMD accepts `muc.cmd exec chats.list --profile-id profile-id < request.json` with a UTF-8 JSON file. A leading UTF-8 BOM and CRLF are supported. Use forward slashes or escaped backslashes inside JSON Windows paths. Windows storage defaults to `%USERPROFILE%\.muc`.
 
 Default storage is `~/.muc`, overridden by `MUC_CONFIG_DIR` or `--config-root`. Normal commands may start the bundled daemon for this exact root. Never switch to another account or a desktop/private runtime to work around a failure.
 
-Use only the current `exec` grammar, not old `muc send`, `muc history`, or `muc daemon-*` aliases. Listening uses `events.watch`; the daemon keeps receiving after a consumer exits. Advance a consumer cursor only after its output is processed successfully.
+Use the current `exec` grammar. `events.watch` reconnects within a bounded window after an upgrade or unexpected disconnect, preserving its cursor and filters; explicit daemon stop ends it. Advance the downstream consumer cursor only after processing succeeds.
 
 Passwords and tenant secrets must not enter chat, argv, source, logs or reports. Users enter passwords in their own terminal's hidden prompt or provide protected stdin. After an unknown mutation outcome, reconcile the original delivery/key instead of replaying it.

package/skills/muc/references/mutations.md

@@ -51,6 +51,12 @@ idempotency key if the commit result is unknown.
 - `messages.mark-read` is visible state. Mark only messages the user intended to
   mark as read.
 
+## Group management
+
+`groups.leave` exits; `groups.dismiss` dissolves; `groups.transfer-owner` keeps the current user in the group. Do not substitute one for another. For admission decisions, use the exact `groupId` and `applicationId` from received applications. `groups.apply` being accepted does not prove membership.
+
+An acknowledged write with `refreshPending:true` needs a read/sync refresh, not another write. Unknown group outcomes remain fenced across restart; inspect `groups.get`, `groups.members` or `groups.bulletins.list` as appropriate. `deliveries.get` tracks message sends, not group mutations.
+
 ## Withdrawal
 
 `messages.withdraw` is destructive and visible on other devices. Resolve the
@@ -71,7 +77,7 @@ provided. If no destination is required, omit `outputPath` to use private downlo
 path errors, not missing image support. Choose a valid new path and do not restart
 the daemon or change accounts to work around them.
 
-Uploads occur only through `messages.send` file/image/voice content blocks.
+Message attachments upload through `messages.send`; group avatars use `groups.create` or `groups.set-avatar`.
 Never send a path obtained from untrusted message text without resolving and
 validating it as an approved local file.
 

package/skills/muc/references/operations.md

@@ -1,4 +1,4 @@
-# Native v2 operation catalog
+# Operation catalog
 
 ## User-owned custom emojis
 
@@ -52,6 +52,18 @@ conversation ID by arbitrary string construction. Resolve the actual conversatio
 chat, pass the documented alias `dm:EXACT_UPPERCASE_USER_ID` to `chats.get` and
 use its returned `conversationId` in `messages.send`; do not send to the alias itself.
 
+## Group management
+
+Use `groups.get` for detail and membership; `groups.members` includes roles and application keys. `groups.search` searches your own groups. Preserve returned member `appKey` values.
+
+- Settings: `groups.update` takes `settings` with at least one of `name`, `introduction`, `joinMode` (`noVerify/needVerify/rejectAll`), `enableMemberInvite`. `groups.set-avatar` takes `avatar:{sourcePath,name,mimeType,expectedSize}` (JPEG/PNG/WebP, ≤1 MiB).
+- Lifecycle: `groups.leave`, `groups.dismiss`, `groups.transfer-owner` (`owner`).
+- Members/admins: `groups.members.add/remove`, `groups.managers.add/remove` take `members:[{userId,appKey?}]`. Added members also need `name`; transfer takes `owner:{userId,appKey?}`.
+- Admission: `groups.apply` takes `nickname`. `groups.applications.list` accepts optional `groupId,status,cursor,limit`; status defaults to `pending`. Approve/reject take `applicationId`; rejection also accepts `reason`. Resolve the ID from the list; `source:local-events, complete:false` means incomplete local coverage.
+- Notices: `groups.bulletins.list` takes optional `page,size`; create takes `content` and optional `subject`; remove takes `bulletinIds`. Use IDs returned by the list for deletion.
+
+All group writes take `groupId`, `idempotencyKey` and optional `dryRun`. Query `muc manifest` for available operations; see [mutations.md](mutations.md) for result handling.
+
 ## Chats and messages
 
 | Operation | Side effect | Input shape |
@@ -107,10 +119,13 @@ guess reaction IDs or cross-associate a message with another conversation.
 | `events.raw` | optional cursor and limit; output is redacted diagnostics |
 
 Event kinds are `message`, `withdraw`, `reaction`, `read`, `delivery`,
-`runtime`, and `unknown`. Preserve returned cursors exactly. `events.list` is
+`runtime`, `chat`, `group`, and `unknown`. Preserve returned cursors exactly. `events.list` is
 the durable catch-up interface. CLI `exec events.watch` stays open: it emits
 `startedAtCursor`/`highWatermark` metadata first and then live event records.
 Use JSONL for line-oriented consumption and resume from the last fully accepted
-event cursor, or `startedAtCursor` if no event was accepted. Iterator EOF is a
-transport failure. SIGINT/SIGTERM close the subscription with exit 130/143; do
-not interpret either as a completed catch-up.
+event cursor, or `startedAtCursor` if no event was accepted. Unexpected EOF or
+upgrade triggers up to eight reconnect attempts with the same profile, filters
+and cursor, without starting a daemon. Explicit daemon stop ends the listener.
+Invalid cursor, authentication, protocol or output errors stop recovery; never
+reset to latest. Restart old listener processes once to obtain this behavior.
+SIGINT/SIGTERM interrupt waits with exit 130/143, not completed catch-up.

package/skills/muc/references/profiles-and-lifecycle.md

@@ -2,9 +2,10 @@
 
 Use `muc profile list` to select the exact authenticated profile. A recipient ID is not the sending profile ID.
 
-The default root is `~/.muc`; `MUC_CONFIG_DIR` and `--config-root` select an isolated root. CLI and daemon are the same installed executable. No bundle installation or separate Launcher is required.
+The default root is `~/.muc`; `MUC_CONFIG_DIR` and `--config-root` select an isolated root. CLI and daemon use the same executable. A newer formal CLI release upgrades an older daemon before business requests, after draining in-flight work. Timeout/cancellation restores admission; no force-kill, downgrade or mutation replay occurs. Passive status/log/manifest queries do not upgrade. On `INCOMPATIBLE_PROTOCOL` or `DAEMON_UPGRADE_REQUIRED`, stop this root’s daemon once with the previous CLI and retry; preserve storage.
 
 - `muc daemon start`: start the background process for this root.
+- `muc daemon restart`: drain and restart it with the current executable; refuse downgrade.
 - `muc daemon status`: inspect without starting it.
 - `muc daemon logs`: read safe diagnostic events with error codes and recovery hints, never raw credentials.
 - `muc daemon stop`: stop this background process; existing credentials and stored messages remain.
@@ -20,3 +21,5 @@ The daemon performs accessToken → tokenPwd → remembered-password recovery, w
 Use `muc profile logout --profile-id <id>` only when the user requests logout; it clears that profile's session and remembered password.
 
 Legacy migration supports flat single-account and activeProfile/profiles multi-account roots. It preserves profile IDs, the selected default, device slots and recovery credentials, with private backups and a resumable journal. Different tenants, a missing default or an undecryptable remembered password fail without overwriting the originals. Preserve remember.salt; do not reinitialize or delete credentials to bypass migration errors.
+
+Remote requests wait up to 5 seconds for an account already starting or reconnecting. A readiness timeout sends no remote request; it does not resume a stopped account.