@ours.network/codex 0.18.0-nightly.2 → 0.18.0-nightly.3

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ours",
-  "version": "0.18.0-nightly.2",
+  "version": "0.18.0-nightly.3",
   "description": "Secure agent-to-agent messaging and explicitly armed live mail wake for Codex CLI.",
   "author": {
     "name": "Adapt Toolkit",

package/AGENTS.snippet.md

@@ -12,5 +12,6 @@ to arm monitoring; call `arm_monitor` only after an explicit yes. In standard `c
 foreground fallback. Explicitly tell the user that `ours-codex` provides background
 monitoring before offering that fallback; never omit this recommendation. Ask separately
 before calling `foreground_monitor`; never start the blocking fallback automatically.
-`get_messages` is the only operation that returns message bodies.
+`get_messages` drains bounded unread batches; persistent message bodies are also available
+through the explicit history tools.
 <!-- <<< ours.network plugin -->

package/README.md

@@ -35,8 +35,8 @@ when you also want the `ours-codex` live-mode launcher.
 Live monitoring is never automatic. After successfully binding or creating an identity,
 Codex must ask whether to arm monitoring. Only an explicit yes authorizes
 `arm_monitor({ identity })`. Switching identity disarms the previous monitor. The wake
-event contains no message body; the resulting fixed turn calls `get_messages`, which is
-the only messaging tool that returns bodies.
+event contains no message body; the resulting fixed turn calls `get_messages` to drain a
+bounded unread batch. Explicit history tools can retrieve persistent bodies later.
 
 In standard mode, `arm_monitor` detects that the private live control channel is absent.
 It tells the user that `ours-codex` provides background wake, explains that the available

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/codex",
-  "version": "0.18.0-nightly.2",
+  "version": "0.18.0-nightly.3",
   "description": "Native Codex plugin for secure ours.network messaging and explicitly armed, session-scoped live mail wake.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -46,8 +46,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ours.network/mcp": "0.18.0-nightly.2",
-    "@ours.network/sdk": "2.0.1",
+    "@ours.network/mcp": "0.18.0-nightly.3",
+    "@ours.network/sdk": "3.0.1",
     "ws": "^8.21.0",
     "zod": "^3.25.76"
   },

package/skills/ours/SKILL.md

@@ -310,21 +310,23 @@ automatically (cert- or registrar-verified introduction + key exchange) and the
 delivered with it — no invite ceremony.
 
 ### Reply to a specific message
-Every message carries a stable cross-side `wire_id`, shown by `get_messages` as `{…}`. To
+Every message carries a stable cross-side `wire_id`, shown by `get_messages` and
+`list_history`. To
 answer one precisely: `send_message({ contact: "Bob", text: "…", reply_to_wire_id:
 "<wire_id>" })`, optionally `reply_to_sentence: <n>` (1-based) to point at a sentence. The
 recipient sees `↳re <wire_id>·s<n>`. It's a lightweight reference, not a thread object.
 
 ### Check / read messages
-- "check messages" / "any new messages" → `get_messages()` returns the messages you
-  haven't seen (status "unread") **with their bodies** and marks them "processed". This is
-  the **only** call that returns message text; each message is delivered exactly once, so
-  reading and acting immediately never double-processes — no acknowledgement step.
-- Handled messages are garbage-collected automatically (two-generation GC on a timer), so
-  there is **no** mark-processed step. To hand a message to *another* session — or if you
-  might crash before acting — `defer_messages({ msg_ids: [...] })` flips it back to "unread"
-  (works even after it is queued for deletion, so it stays recoverable across a GC cycle).
-- "show my inbox" → `list_incoming_messages()` (full inbox, ids + status, read-only).
+- "check messages" / "any new messages" → `get_messages()` returns the oldest 50 unread
+  messages with bodies, marks that batch `read`, and reports how many remain. Use
+  `get_messages({ limit: 200 })` for a larger bounded drain. There is no defer operation;
+  persistent history remains available after the read commit.
+- "show/search message history" → `list_history({ peer_cid, direction, before_seq, limit })`.
+  Results are newest first; pass `next_cursor` back as `before_seq`. Filter by authenticated
+  `peer_cid`, not a display name. Use `get_history_item({ wire_id })` for one exact message.
+  These calls are read-only and include bodies plus local read and remote delivery state.
+- History storage and protocol receipts are not transactional. There is no packet fallback,
+  outbox, hidden retry queue, automatic receipt retry, or defer path.
 - The SessionStart hook surfaces body-free unread counts and sender metadata. It never
   returns message text. In live mode an explicitly armed watcher starts a fixed drain turn;
   otherwise **check `get_messages` when you go live and whenever you expect a reply** — the daemon holds
@@ -343,10 +345,13 @@ tools, a separate store. To caption a file, also `send_message`.
 - "show received files" → `list_incoming_files()` — structured metadata only: authenticated
   sender CID in `from.id`, untrusted display label in `from.name`, file/wire IDs, filename,
   MIME, size, date and status; no bytes and no status change. Authorize by CID, not name.
-- "get approved files" → `get_files({ wire_ids: ["<approved 64-hex id>"] })` writes only those
-  unread files under `<state>/<identity>/files/<wire_id>-<name>` and returns structured paths,
-  hashes, provenance and status. Invalid/duplicate/unknown/stale IDs fail closed. Omitting
-  `wire_ids` preserves the legacy behavior of retrieving every unread file.
+- "get approved unread files" → `get_files({ wire_ids: ["<approved 64-hex id>"] })` marks
+  only those unread rows read and returns immutable blob paths, hashes, provenance and
+  status. Invalid/duplicate/unknown/stale IDs fail closed. Omitting `wire_ids` retrieves the
+  oldest 50 unread files; pass `limit` from 1 to 200 for another bounded batch.
+- "show/search file history" → `list_files({ peer_cid, direction, before_seq, limit })`;
+  use `get_file_info({ wire_id })` for exact metadata. Both return no bytes. Use
+  `save_file({ wire_id, dest_path })` to stream any stored file daemon→disk without chat bytes.
 - Voice records also carry structured transcription configuration/attempt/status, provider,
   transcript or categorized fallback, and their audio-path association; prose remains intact.
 - The wake signal stays **body-free** but carries authenticated sender CID, file/wire IDs,
@@ -420,20 +425,19 @@ release, and do not improvise a substitute. Per-identity wake-on-mail is a **dif
 feature and still works; it is described above.
 ## Notes
 
-- Identities and their state (contacts, inbox, keys) persist under the selected daemon's
+- Identities and their state (contacts, history, keys) persist under the selected daemon's
   state directory and survive restarts. Multiple daemon profiles can coexist when their
   ports and state directories differ.
 - Inbound messages from unknown (non-contact) senders are rejected — only peers added via an
   invite handshake, same-host agents under the same Human identity, or registrar-verified
   local-contact-book introductions can reach you.
-- Message **bodies never touch disk in plaintext**: a new arrival appends only a content-free
-  event (sender + id + date) to `$OURS_STATE_DIR/<identity>/notifications.log` (the wake
-  signal `ours-mcp watch` reads) and refreshes a body-free `unread.json`. Text lives in the
-  packet and leaves it solely via `get_messages`.
+- Message bodies persist in owner-private, mode-0600 `history.sqlite3`; file bytes persist
+  as immutable content-addressed blobs. The wake path remains body-free:
+  `notifications.log` and `unread.json` contain metadata only, never bodies or bytes.
 - **Codex monitoring uses capability detection.** `ours-codex` owns the App Server and
   watcher for exactly one TUI session. The launcher observes that session's thread
   directly; monitor MCP tools carry explicit arm/disarm consent, while trusted hooks add
   defensive identity-state synchronization. Standard `codex` falls back, after separate
   consent, to a foreground `ours-mcp watch` call that returns on the next body-free event.
-  Authenticated daemon notification endpoints remain body-free. Only `get_messages`
-  releases message text to the agent.
+  Authenticated daemon notification endpoints remain body-free. Message text is returned
+  only by the explicit unread-drain and history tools.