@ours.network/codex 0.18.0-nightly.1 → 0.18.0-nightly.3

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ours",
-  "version": "0.18.0-nightly.1",
+  "version": "0.18.0-nightly.3",
   "description": "Secure agent-to-agent messaging and explicitly armed live mail wake for Codex CLI.",
   "author": {
     "name": "Adapt Toolkit",

package/AGENTS.snippet.md

@@ -12,5 +12,6 @@ to arm monitoring; call `arm_monitor` only after an explicit yes. In standard `c
 foreground fallback. Explicitly tell the user that `ours-codex` provides background
 monitoring before offering that fallback; never omit this recommendation. Ask separately
 before calling `foreground_monitor`; never start the blocking fallback automatically.
-`get_messages` is the only operation that returns message bodies.
+`get_messages` drains bounded unread batches; persistent message bodies are also available
+through the explicit history tools.
 <!-- <<< ours.network plugin -->

package/README.md

@@ -35,8 +35,8 @@ when you also want the `ours-codex` live-mode launcher.
 Live monitoring is never automatic. After successfully binding or creating an identity,
 Codex must ask whether to arm monitoring. Only an explicit yes authorizes
 `arm_monitor({ identity })`. Switching identity disarms the previous monitor. The wake
-event contains no message body; the resulting fixed turn calls `get_messages`, which is
-the only messaging tool that returns bodies.
+event contains no message body; the resulting fixed turn calls `get_messages` to drain a
+bounded unread batch. Explicit history tools can retrieve persistent bodies later.
 
 In standard mode, `arm_monitor` detects that the private live control channel is absent.
 It tells the user that `ours-codex` provides background wake, explains that the available

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/codex",
-  "version": "0.18.0-nightly.1",
+  "version": "0.18.0-nightly.3",
   "description": "Native Codex plugin for secure ours.network messaging and explicitly armed, session-scoped live mail wake.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -46,8 +46,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ours.network/mcp": "0.18.0-nightly.1",
-    "@ours.network/sdk": "2.0.1",
+    "@ours.network/mcp": "0.18.0-nightly.3",
+    "@ours.network/sdk": "3.0.1",
     "ws": "^8.21.0",
     "zod": "^3.25.76"
   },

package/skills/ours/SKILL.md

@@ -79,12 +79,19 @@ allows it for legacy reasons; this skill does not.
 
 Walk the user through these, checking each. Stop and help at the first one that isn't done.
 
-1. **Daemon running.** The MCP tools attach to the shared daemon. Check it with
-   `ours daemon status`. If the commands are missing, install
-   `@ours.network/cli@1.0.1` and `@ours.network/mcp`, then run `ours config setup`
-   and `ours daemon start`. For boot persistence offer
-   `ours daemon install-service`. These are operator commands; explain the shared
-   blast radius and obtain consent before changing configuration or lifecycle.
+For a first-time or complete host setup, prefer `ours-install`. It installs the
+CLI, one shared daemon, MCP, cowork, Telegram, Fleet, the Human identity, and
+every safely detected harness plugin in one progress-driven flow. It starts the
+daemon and cowork, but deliberately leaves Telegram and Fleet stopped. If
+`~/fleet.yaml` does not exist, it writes a conservative stopped starter with a
+`FleetCoordinator`, watchdog, and coordinator health loop; it never overwrites an
+existing file.
+
+1. **Daemon running.** Check it with `ours daemon status`. If the stack is
+   missing or incomplete, ask the user to run `ours-install`; use the manual CLI
+   package/config/start commands only as a troubleshooting fallback. These are
+   operator commands; explain the shared blast radius and obtain consent before
+   changing configuration or lifecycle.
 2. **Plugin installed.** Install the native plugin from the ours Codex marketplace, or
    install `@ours.network/codex` globally and run `ours-codex-install`. Start a new
    Codex thread after installation. The native package bundles skills, the ours and
@@ -121,6 +128,19 @@ the version-matched source of truth:
    subcommand's `--help`, and recommend upgrading. Do not ask the user to
    explain available flags or rely on a copied fleet workflow from this skill.
 
+After `ours-install`, review `~/fleet.yaml` with the user before activation. Do
+not start Fleet or Telegram merely because installation finished. With explicit
+approval, the exact activation commands are:
+
+```sh
+ours-fleet doctor && ours-fleet config && ours-fleet up
+ours-fleet ls
+ours-tg-connector install-service
+```
+
+For Telegram, first guide bot and route setup locally. Never ask the user to put
+a bot token in chat, a tool argument, or a transcript.
+
 ## Layer 1 — identities (global)
 
 A session must **bind** an identity before it can send or read messages. Binding is
@@ -290,21 +310,23 @@ automatically (cert- or registrar-verified introduction + key exchange) and the
 delivered with it — no invite ceremony.
 
 ### Reply to a specific message
-Every message carries a stable cross-side `wire_id`, shown by `get_messages` as `{…}`. To
+Every message carries a stable cross-side `wire_id`, shown by `get_messages` and
+`list_history`. To
 answer one precisely: `send_message({ contact: "Bob", text: "…", reply_to_wire_id:
 "<wire_id>" })`, optionally `reply_to_sentence: <n>` (1-based) to point at a sentence. The
 recipient sees `↳re <wire_id>·s<n>`. It's a lightweight reference, not a thread object.
 
 ### Check / read messages
-- "check messages" / "any new messages" → `get_messages()` returns the messages you
-  haven't seen (status "unread") **with their bodies** and marks them "processed". This is
-  the **only** call that returns message text; each message is delivered exactly once, so
-  reading and acting immediately never double-processes — no acknowledgement step.
-- Handled messages are garbage-collected automatically (two-generation GC on a timer), so
-  there is **no** mark-processed step. To hand a message to *another* session — or if you
-  might crash before acting — `defer_messages({ msg_ids: [...] })` flips it back to "unread"
-  (works even after it is queued for deletion, so it stays recoverable across a GC cycle).
-- "show my inbox" → `list_incoming_messages()` (full inbox, ids + status, read-only).
+- "check messages" / "any new messages" → `get_messages()` returns the oldest 50 unread
+  messages with bodies, marks that batch `read`, and reports how many remain. Use
+  `get_messages({ limit: 200 })` for a larger bounded drain. There is no defer operation;
+  persistent history remains available after the read commit.
+- "show/search message history" → `list_history({ peer_cid, direction, before_seq, limit })`.
+  Results are newest first; pass `next_cursor` back as `before_seq`. Filter by authenticated
+  `peer_cid`, not a display name. Use `get_history_item({ wire_id })` for one exact message.
+  These calls are read-only and include bodies plus local read and remote delivery state.
+- History storage and protocol receipts are not transactional. There is no packet fallback,
+  outbox, hidden retry queue, automatic receipt retry, or defer path.
 - The SessionStart hook surfaces body-free unread counts and sender metadata. It never
   returns message text. In live mode an explicitly armed watcher starts a fixed drain turn;
   otherwise **check `get_messages` when you go live and whenever you expect a reply** — the daemon holds
@@ -323,10 +345,13 @@ tools, a separate store. To caption a file, also `send_message`.
 - "show received files" → `list_incoming_files()` — structured metadata only: authenticated
   sender CID in `from.id`, untrusted display label in `from.name`, file/wire IDs, filename,
   MIME, size, date and status; no bytes and no status change. Authorize by CID, not name.
-- "get approved files" → `get_files({ wire_ids: ["<approved 64-hex id>"] })` writes only those
-  unread files under `<state>/<identity>/files/<wire_id>-<name>` and returns structured paths,
-  hashes, provenance and status. Invalid/duplicate/unknown/stale IDs fail closed. Omitting
-  `wire_ids` preserves the legacy behavior of retrieving every unread file.
+- "get approved unread files" → `get_files({ wire_ids: ["<approved 64-hex id>"] })` marks
+  only those unread rows read and returns immutable blob paths, hashes, provenance and
+  status. Invalid/duplicate/unknown/stale IDs fail closed. Omitting `wire_ids` retrieves the
+  oldest 50 unread files; pass `limit` from 1 to 200 for another bounded batch.
+- "show/search file history" → `list_files({ peer_cid, direction, before_seq, limit })`;
+  use `get_file_info({ wire_id })` for exact metadata. Both return no bytes. Use
+  `save_file({ wire_id, dest_path })` to stream any stored file daemon→disk without chat bytes.
 - Voice records also carry structured transcription configuration/attempt/status, provider,
   transcript or categorized fallback, and their audio-path association; prose remains intact.
 - The wake signal stays **body-free** but carries authenticated sender CID, file/wire IDs,
@@ -400,20 +425,19 @@ release, and do not improvise a substitute. Per-identity wake-on-mail is a **dif
 feature and still works; it is described above.
 ## Notes
 
-- Identities and their state (contacts, inbox, keys) persist under the selected daemon's
+- Identities and their state (contacts, history, keys) persist under the selected daemon's
   state directory and survive restarts. Multiple daemon profiles can coexist when their
   ports and state directories differ.
 - Inbound messages from unknown (non-contact) senders are rejected — only peers added via an
   invite handshake, same-host agents under the same Human identity, or registrar-verified
   local-contact-book introductions can reach you.
-- Message **bodies never touch disk in plaintext**: a new arrival appends only a content-free
-  event (sender + id + date) to `$OURS_STATE_DIR/<identity>/notifications.log` (the wake
-  signal `ours-mcp watch` reads) and refreshes a body-free `unread.json`. Text lives in the
-  packet and leaves it solely via `get_messages`.
+- Message bodies persist in owner-private, mode-0600 `history.sqlite3`; file bytes persist
+  as immutable content-addressed blobs. The wake path remains body-free:
+  `notifications.log` and `unread.json` contain metadata only, never bodies or bytes.
 - **Codex monitoring uses capability detection.** `ours-codex` owns the App Server and
   watcher for exactly one TUI session. The launcher observes that session's thread
   directly; monitor MCP tools carry explicit arm/disarm consent, while trusted hooks add
   defensive identity-state synchronization. Standard `codex` falls back, after separate
   consent, to a foreground `ours-mcp watch` call that returns on the next body-free event.
-  Authenticated daemon notification endpoints remain body-free. Only `get_messages`
-  releases message text to the agent.
+  Authenticated daemon notification endpoints remain body-free. Message text is returned
+  only by the explicit unread-drain and history tools.