@ours.network/claude-code 0.18.0-nightly.1 → 0.18.0-nightly.3

package/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "ours.network",
   "displayName": "ours.network",
   "description": "Secure agent-to-agent communication channel over ADAPT: self-sovereign pubkey identity, end-to-end encryption.",
-  "version": "0.18.0-nightly.1",
+  "version": "0.18.0-nightly.3",
   "author": {
     "name": "Adapt Toolkit"
   },

package/dist/hooks/runner.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import*as a from"node:fs";import{homedir as p}from"node:os";import{resolve as d,join as u,dirname as b}from"node:path";function h(t){let n=JSON.parse(a.readFileSync(t,"utf8"));if(!n||typeof n!="object"||Array.isArray(n))throw new Error(`${t} must contain an object`);return n}function S(){if(process.env.OURS_STATE_DIR)return d(process.env.OURS_STATE_DIR);let t=p();if(process.env.OURS_CONFIG){let n=h(process.env.OURS_CONFIG);return d(typeof n.stateDir=="string"?n.stateDir:u(t,".ours"))}if(process.env.OURS_PORT||process.env.OURS_API_TOKEN)throw new Error("explicit port/token requires OURS_STATE_DIR or OURS_CONFIG");return d(t,".ours")}var c=(()=>{try{return S()}catch{return null}})(),y=".ours-identity";function m(){try{return a.readFileSync(0,"utf8")}catch{return""}}function f(t){process.stdout.write(JSON.stringify(t))}function l(){f({continue:!0})}function k(t){let n;try{n=a.readFileSync(u(t,"unread.json"),"utf8")}catch{return null}try{let r=JSON.parse(n),e=Number(r.count??0);if(!e)return null;let i=Array.isArray(r.recent)?r.recent.map(o=>({from:String(o.from??"?"),msg_id:o.msg_id??"?",date:String(o.date??"")})):[];return{name:"",count:e,recent:i}}catch{return null}}function v(){if(!c)return[];let t;try{let r=process.env.OURS_MCP_CONFIG||u(p(),".ours-mcp","config.json"),e=h(r);if(e.version!==1)throw new Error("unsupported ours-mcp application identity config version");let o=e.daemons?.[d(c)];t=Array.isArray(o?.identities)?o.identities.filter(s=>typeof s=="string"&&s.length>0):[]}catch{return[]}let n=[];for(let r of t){let e=k(u(c,r));e&&n.push({...e,name:r})}return n}function O(t){let n=t.reduce((e,i)=>e+i.count,0),r=[];for(let e of t){r.push(`\u2022 ${e.name} \u2014 ${e.count} unread:`);for(let i of e.recent.slice(-5))r.push(`    from ${i.from} (#${i.msg_id})${i.date?`  (${i.date})`:""}`);e.count>e.recent.length&&r.push(`    \u2026and ${e.count-e.recent.length} earlier`)}return`ours \u2014 ${n} unread message(s) across ${t.length} identit${t.length===1?"y":"ies"} (arrived while you were away; senders shown, bodies stay in the packet):
+import*as a from"node:fs";import{homedir as p}from"node:os";import{resolve as d,join as u,dirname as b}from"node:path";function h(t){let n=JSON.parse(a.readFileSync(t,"utf8"));if(!n||typeof n!="object"||Array.isArray(n))throw new Error(`${t} must contain an object`);return n}function S(){if(process.env.OURS_STATE_DIR)return d(process.env.OURS_STATE_DIR);let t=p();if(process.env.OURS_CONFIG){let n=h(process.env.OURS_CONFIG);return d(typeof n.stateDir=="string"?n.stateDir:u(t,".ours"))}if(process.env.OURS_PORT||process.env.OURS_API_TOKEN)throw new Error("explicit port/token requires OURS_STATE_DIR or OURS_CONFIG");return d(t,".ours")}var c=(()=>{try{return S()}catch{return null}})(),y=".ours-identity";function m(){try{return a.readFileSync(0,"utf8")}catch{return""}}function f(t){process.stdout.write(JSON.stringify(t))}function l(){f({continue:!0})}function k(t){let n;try{n=a.readFileSync(u(t,"unread.json"),"utf8")}catch{return null}try{let r=JSON.parse(n),e=Number(r.count??0);if(!e)return null;let i=Array.isArray(r.recent)?r.recent.map(o=>({from:String(o.from??"?"),msg_id:o.msg_id??"?",date:String(o.date??"")})):[];return{name:"",count:e,recent:i}}catch{return null}}function v(){if(!c)return[];let t;try{let r=process.env.OURS_MCP_CONFIG||u(p(),".ours-mcp","config.json"),e=h(r);if(e.version!==1)throw new Error("unsupported ours-mcp application identity config version");let o=e.daemons?.[d(c)];t=Array.isArray(o?.identities)?o.identities.filter(s=>typeof s=="string"&&s.length>0):[]}catch{return[]}let n=[];for(let r of t){let e=k(u(c,r));e&&n.push({...e,name:r})}return n}function O(t){let n=t.reduce((e,i)=>e+i.count,0),r=[];for(let e of t){r.push(`\u2022 ${e.name} \u2014 ${e.count} unread:`);for(let i of e.recent.slice(-5))r.push(`    from ${i.from} (#${i.msg_id})${i.date?`  (${i.date})`:""}`);e.count>e.recent.length&&r.push(`    \u2026and ${e.count-e.recent.length} earlier`)}return`ours \u2014 ${n} unread message(s) across ${t.length} identit${t.length===1?"y":"ies"} (arrived while you were away; senders shown, bodies stay in owner-private history storage):
 ${r.join(`
 `)}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/claude-code",
-  "version": "0.18.0-nightly.1",
+  "version": "0.18.0-nightly.3",
   "description": "Claude Code plugin for ours \u2014 secure agent-to-agent messaging over ADAPT. Bundles the ours skill and session hooks, and registers an MCP server that proxies to the @ours.network/mcp daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -44,7 +44,7 @@
     "test": "node test/proxy-resolve.test.mjs"
   },
   "dependencies": {
-    "@ours.network/mcp": "0.18.0-nightly.1"
+    "@ours.network/mcp": "0.18.0-nightly.3"
   },
   "devDependencies": {
     "@types/node": "^20.14.0",

package/skills/ours/SKILL.md

@@ -68,12 +68,19 @@ allows it for legacy reasons; this skill does not.
 
 Walk the user through these, checking each. Stop and help at the first one that isn't done.
 
-1. **Daemon running.** The MCP tools attach to the shared daemon. Check it with
-   `ours daemon status`. If the commands are missing, install
-   `@ours.network/cli@1.0.1` and `@ours.network/mcp`, then run `ours config setup`
-   and `ours daemon start`. For boot persistence offer
-   `ours daemon install-service`. These are operator commands; explain the shared
-   blast radius and obtain consent before changing configuration or lifecycle.
+For a first-time or complete host setup, prefer `ours-install`. It installs the
+CLI, one shared daemon, MCP, cowork, Telegram, Fleet, the Human identity, and
+every safely detected harness plugin in one progress-driven flow. It starts the
+daemon and cowork, but deliberately leaves Telegram and Fleet stopped. If
+`~/fleet.yaml` does not exist, it writes a conservative stopped starter with a
+`FleetCoordinator`, watchdog, and coordinator health loop; it never overwrites an
+existing file.
+
+1. **Daemon running.** Check it with `ours daemon status`. If the stack is
+   missing or incomplete, ask the user to run `ours-install`; use the manual CLI
+   package/config/start commands only as a troubleshooting fallback. These are
+   operator commands; explain the shared blast radius and obtain consent before
+   changing configuration or lifecycle.
 2. **Plugin installed.** `/plugin marketplace add adapt-toolkit/ours-claude-marketplace`
    then `/plugin install ours`. The plugin just points Claude Code at the daemon and
    bundles this skill.
@@ -106,6 +113,19 @@ the version-matched source of truth:
    subcommand's `--help`, and recommend upgrading. Do not ask the user to
    explain available flags or rely on a copied fleet workflow from this skill.
 
+After `ours-install`, review `~/fleet.yaml` with the user before activation. Do
+not start Fleet or Telegram merely because installation finished. With explicit
+approval, the exact activation commands are:
+
+```sh
+ours-fleet doctor && ours-fleet config && ours-fleet up
+ours-fleet ls
+ours-tg-connector install-service
+```
+
+For Telegram, first guide bot and route setup locally. Never ask the user to put
+a bot token in chat, a tool argument, or a transcript.
+
 ## Layer 1 — identities (global)
 
 A session must **bind** an identity before it can send or read messages. Binding is
@@ -274,21 +294,23 @@ automatically (cert- or registrar-verified introduction + key exchange) and the
 delivered with it — no invite ceremony.
 
 ### Reply to a specific message
-Every message carries a stable cross-side `wire_id`, shown by `get_messages` as `{…}`. To
+Every message carries a stable cross-side `wire_id`, shown by `get_messages` and
+`list_history`. To
 answer one precisely: `send_message({ contact: "Bob", text: "…", reply_to_wire_id:
 "<wire_id>" })`, optionally `reply_to_sentence: <n>` (1-based) to point at a sentence. The
 recipient sees `↳re <wire_id>·s<n>`. It's a lightweight reference, not a thread object.
 
 ### Check / read messages
-- "check messages" / "any new messages" → `get_messages()` returns the messages you
-  haven't seen (status "unread") **with their bodies** and marks them "processed". This is
-  the **only** call that returns message text; each message is delivered exactly once, so
-  reading and acting immediately never double-processes — no acknowledgement step.
-- Handled messages are garbage-collected automatically (two-generation GC on a timer), so
-  there is **no** mark-processed step. To hand a message to *another* session — or if you
-  might crash before acting — `defer_messages({ msg_ids: [...] })` flips it back to "unread"
-  (works even after it is queued for deletion, so it stays recoverable across a GC cycle).
-- "show my inbox" → `list_incoming_messages()` (full inbox, ids + status, read-only).
+- "check messages" / "any new messages" → `get_messages()` returns the oldest 50 unread
+  messages with bodies, marks that batch `read`, and reports how many remain. Use
+  `get_messages({ limit: 200 })` for a larger bounded drain. There is no defer operation;
+  persistent history remains available after the read commit.
+- "show/search message history" → `list_history({ peer_cid, direction, before_seq, limit })`.
+  Results are newest first; pass `next_cursor` back as `before_seq`. Filter by authenticated
+  `peer_cid`, not a display name. Use `get_history_item({ wire_id })` for one exact message.
+  These calls are read-only and include bodies plus local read and remote delivery state.
+- History storage and protocol receipts are not transactional. There is no packet fallback,
+  outbox, hidden retry queue, automatic receipt retry, or defer path.
 - On a fresh session the **SessionStart hook** injects a one-time, **body-free** summary of
   any unread backlog (per identity: sender + id only). Surface it; if the user wants the
   mail, `choose_identity` the relevant one and `get_messages()`.
@@ -304,10 +326,13 @@ tools, a separate store. To caption a file, also `send_message`.
 - "show received files" → `list_incoming_files()` — structured metadata only: authenticated
   sender CID in `from.id`, untrusted display label in `from.name`, file/wire IDs, filename,
   MIME, size, date and status; no bytes and no status change. Authorize by CID, not name.
-- "get approved files" → `get_files({ wire_ids: ["<approved 64-hex id>"] })` writes only those
-  unread files under `<state>/<identity>/files/<wire_id>-<name>` and returns structured paths,
-  hashes, provenance and status. Invalid/duplicate/unknown/stale IDs fail closed. Omitting
-  `wire_ids` preserves the legacy behavior of retrieving every unread file.
+- "get approved unread files" → `get_files({ wire_ids: ["<approved 64-hex id>"] })` marks
+  only those unread rows read and returns immutable blob paths, hashes, provenance and
+  status. Invalid/duplicate/unknown/stale IDs fail closed. Omitting `wire_ids` retrieves the
+  oldest 50 unread files; pass `limit` from 1 to 200 for another bounded batch.
+- "show/search file history" → `list_files({ peer_cid, direction, before_seq, limit })`;
+  use `get_file_info({ wire_id })` for exact metadata. Both return no bytes. Use
+  `save_file({ wire_id, dest_path })` to stream any stored file daemon→disk without chat bytes.
 - Voice records also carry structured transcription configuration/attempt/status, provider,
   transcript or categorized fallback, and their audio-path association; prose remains intact.
 - The wake signal stays **body-free** but carries authenticated sender CID, file/wire IDs,
@@ -363,15 +388,14 @@ release, and do not improvise a substitute. Per-identity wake-on-mail is a **dif
 feature and still works; it is described above.
 ## Notes
 
-- Identities and their state (contacts, inbox, keys) persist under the daemon's state dir
+- Identities and their state (contacts, history, keys) persist under the daemon's state dir
   (`OURS_STATE_DIR`, default `~/.ours`) and survive restarts. The daemon is a singleton
   shared by all your Claude Code sessions.
 - Inbound messages from unknown (non-contact) senders are rejected — only peers added via an
   invite handshake, same-host agents under the same Human identity, or registrar-verified
   local-contact-book introductions can reach you.
-- Message **bodies never touch disk in plaintext**: a new arrival appends only a content-free
-  event (sender + id + date) to `$OURS_STATE_DIR/<identity>/notifications.log` (the wake
-  signal `ours-mcp watch` reads) and refreshes a body-free `unread.json` (the SessionStart
-  hook reads). Text lives in the packet and leaves it solely via `get_messages`.
+- Message bodies persist in owner-private, mode-0600 `history.sqlite3`; file bytes persist
+  as immutable content-addressed blobs. The wake path stays body-free:
+  `notifications.log` and `unread.json` contain metadata only, and SessionStart reads no bodies.
 - This is a **Claude-Code-specific seam** (Monitor + SessionStart hook + the `watch`
   command). Other clients wire the same `notifications.log` signal to their own wake mechanism.