@ours.network/cowork 0.3.5 → 0.3.6

package/dist/cli.js

@@ -4277,6 +4277,7 @@ var MAX_TEXT_BYTES = 262144;
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
 var MAX_HISTORY_PAGE_BYTES = 3 * 1024 * 1024;
 var MAX_MANAGEMENT_RESPONSE_BYTES = MAX_HISTORY_PAGE_BYTES + 1024 * 1024;
+var MAX_EXTERNAL_INVITE_BYTES = 48 * 1024;
 var MAX_FILE_NAME_BYTES = 255;
 var MAX_MIME_BYTES = 255;
 var MAX_ROLE_BYTES = 256;
@@ -4343,7 +4344,7 @@ var FileMimeSchema = external_exports.string().refine(
   `file MIME metadata must be at most ${MAX_MIME_BYTES} UTF-8 bytes`
 );
 var RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
-var SeatStateSchema = external_exports.enum(["active", "removed"]);
+var SeatStateSchema = external_exports.enum(["pending", "active", "removed"]);
 var InviteModeSchema = external_exports.enum(["one_time", "public"]);
 var InviteStateSchema = external_exports.enum([
   "live",
@@ -4365,7 +4366,9 @@ var SeatSchema = external_exports.object({
   display_name: NonEmptyStringSchema,
   role: RoleSchema,
   invite_id: NonEmptyStringSchema,
-  accepted_at: Rfc3339Schema,
+  accepted_at: Rfc3339Schema.optional(),
+  requested_at: Rfc3339Schema.optional(),
+  invite_sha256: external_exports.string().regex(/^[0-9a-f]{64}$/).optional(),
   participant_id: LowerCrockfordUlidSchema,
   state: SeatStateSchema,
   alias: NonEmptyStringSchema.optional(),
@@ -4374,7 +4377,25 @@ var SeatSchema = external_exports.object({
   replaces_seat: LowerCrockfordUlidSchema.optional(),
   bounced_at: Rfc3339Schema.optional()
 }).strict().superRefine((seat, context) => {
-  if (seat.state === "removed") {
+  if (seat.state === "pending") {
+    for (const field of ["requested_at", "invite_sha256"]) {
+      if (seat[field] === void 0) {
+        context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `pending seats require ${field}` });
+      }
+    }
+    for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at"]) {
+      if (seat[field] !== void 0) {
+        context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `${field} is forbidden on pending seats` });
+      }
+    }
+  } else if (seat.state === "removed") {
+    if (seat.accepted_at === void 0 && seat.requested_at === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["accepted_at"],
+        message: "removed seats require accepted_at unless they are cancelled external admissions"
+      });
+    }
     if (seat.removed_at === void 0) {
       context.addIssue({
         code: external_exports.ZodIssueCode.custom,
@@ -4390,6 +4411,9 @@ var SeatSchema = external_exports.object({
       });
     }
   } else {
+    if (seat.accepted_at === void 0) {
+      context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["accepted_at"], message: "active seats require accepted_at" });
+    }
     for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
       if (seat[field] !== void 0) {
         context.addIssue({
@@ -4400,6 +4424,13 @@ var SeatSchema = external_exports.object({
       }
     }
   }
+  if (seat.requested_at === void 0 !== (seat.invite_sha256 === void 0)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["invite_sha256"],
+      message: "external admission metadata requires both requested_at and invite_sha256"
+    });
+  }
 });
 var RoomInviteSchema = external_exports.object({
   invite_id: NonEmptyStringSchema,
@@ -4558,6 +4589,7 @@ var CurrentRoomSchema = external_exports.object({
   refineRoomLineage(room, context);
   const byParticipant = /* @__PURE__ */ new Map();
   const activeAliases = /* @__PURE__ */ new Set();
+  const authorizedCids = /* @__PURE__ */ new Set();
   for (const [index, seat] of room.seats.entries()) {
     if (byParticipant.has(seat.participant_id)) {
       context.addIssue({
@@ -4567,6 +4599,16 @@ var CurrentRoomSchema = external_exports.object({
       });
     }
     byParticipant.set(seat.participant_id, seat);
+    if (seat.state === "pending" || seat.state === "active") {
+      if (authorizedCids.has(seat.identity)) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["seats", index, "identity"],
+          message: "at most one pending or active seat may exist per CID"
+        });
+      }
+      authorizedCids.add(seat.identity);
+    }
     if (room.anonymous && seat.alias === void 0) {
       context.addIssue({
         code: external_exports.ZodIssueCode.custom,
@@ -4659,6 +4701,16 @@ var RoleBriefingDeleteInputSchema = external_exports.object({
 var PostMessageInputSchema = external_exports.object({
   text: MessageTextSchema
 }).strict();
+var ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
+var AcceptExternalInviteInputSchema = external_exports.object({
+  role: RoleSchema,
+  invite: external_exports.string().refine(
+    (value) => Buffer.byteLength(value, "utf8") <= MAX_EXTERNAL_INVITE_BYTES,
+    `invite input must be at most ${MAX_EXTERNAL_INVITE_BYTES} UTF-8 bytes`
+  ),
+  expected_cid: ContainerIdSchema.optional(),
+  replaces_seat: LowerCrockfordUlidSchema.optional()
+}).strict();
 var AuthorSnapshotSchema = external_exports.object({
   identity: NonEmptyStringSchema,
   display_name: NonEmptyStringSchema,
@@ -4932,6 +4984,7 @@ var RpcTransportError = class extends CliError {
 var NATIVE_MUTATION_METHODS = /* @__PURE__ */ new Set([
   "room.create",
   "room.invite",
+  "room.accept",
   "room.revoke",
   "room.message",
   "room.close",
@@ -4975,6 +5028,7 @@ Room commands:
   settings <room-id> [--name <display-name>] [--goal <text>] [--briefing <text>] [--status <text>] [--quiet-membership true|false]
   role-briefing <room-id> --role <label> (--text <text> | --delete)
   invite <room-id> [--role <label>] [--mode one_time|public] [--min-accepts <n>]
+  accept <room-id> --role <label> (--invite-file <path> | --invite-stdin) [--expected-cid <64-hex>] [--replaces <participant-id>]
   revoke <room-id> <invite-id>
   remove <room-id> <participant> [--silent]
   replace <room-id> <participant> [--mode one_time|public] [--min-accepts <n>] [--silent]
@@ -5057,7 +5111,7 @@ function loadCliConfig() {
     throw new CliError(EXIT.internal, "internal", error instanceof Error ? error.message : "failed to load config", { cause: error });
   }
 }
-function roomRequest(command, args) {
+async function roomRequest(command, args) {
   if (!command) usageError("room requires a command");
   switch (command) {
     case "create": {
@@ -5115,6 +5169,27 @@ function roomRequest(command, args) {
         min_accepts: minimum
       } };
     }
+    case "accept": {
+      const parsed = parseOptions(
+        args,
+        ["--role", "--invite-file", "--expected-cid", "--replaces"],
+        ["--invite-stdin"]
+      );
+      const [roomId] = exactPositionals(parsed, 1, "room accept");
+      const inviteFile = parsed.values["--invite-file"];
+      const inviteStdin = parsed.booleans.has("--invite-stdin");
+      if ((inviteFile === void 0 ? 0 : 1) + (inviteStdin ? 1 : 0) !== 1) {
+        usageError("room accept requires exactly one of --invite-file or --invite-stdin");
+      }
+      const invite = inviteFile === void 0 ? await readBoundedStdin() : readSecureInviteFile(inviteFile);
+      return { method: "room.accept", params: {
+        room_id: roomId,
+        role: requiredFlag(parsed, "--role", "room accept"),
+        invite,
+        ...parsed.values["--expected-cid"] === void 0 ? {} : { expected_cid: parsed.values["--expected-cid"] },
+        ...parsed.values["--replaces"] === void 0 ? {} : { replaces_seat: parsed.values["--replaces"] }
+      } };
+    }
     case "remove": {
       const parsed = parseOptions(args, [], ["--silent"]);
       const [roomId, participant] = exactPositionals(parsed, 2, "room remove");
@@ -5197,6 +5272,75 @@ function roomRequest(command, args) {
       usageError(`unknown room command: ${command}`);
   }
 }
+function readSecureInviteFile(path) {
+  const noFollow = fs.constants.O_NOFOLLOW ?? 0;
+  let fd;
+  try {
+    const observed = fs.lstatSync(path);
+    if (observed.isSymbolicLink() || !observed.isFile() || observed.nlink !== 1 || (observed.mode & 511) !== 384 || typeof process.getuid === "function" && observed.uid !== process.getuid()) {
+      throw new Error("invite file must be an owned 0600 single-link regular file");
+    }
+    if (observed.size > MAX_EXTERNAL_INVITE_BYTES) throw new Error("invite input exceeds 48 KiB");
+    fd = fs.openSync(path, fs.constants.O_RDONLY | noFollow);
+    const opened = fs.fstatSync(fd);
+    const current = fs.lstatSync(path);
+    if (!opened.isFile() || opened.nlink !== 1 || (opened.mode & 511) !== 384 || typeof process.getuid === "function" && opened.uid !== process.getuid() || current.isSymbolicLink() || current.dev !== opened.dev || current.ino !== opened.ino) {
+      throw new Error("invite file changed while opening");
+    }
+    const bytes = fs.readFileSync(fd);
+    if (bytes.length > MAX_EXTERNAL_INVITE_BYTES) throw new Error("invite input exceeds 48 KiB");
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch (error) {
+    throw new CliError(
+      EXIT.invalidState,
+      "invalid_params",
+      error instanceof Error && /48 KiB/.test(error.message) ? "invite input exceeds 48 KiB" : "invite file is unavailable or insecure"
+    );
+  } finally {
+    if (fd !== void 0) fs.closeSync(fd);
+  }
+}
+function readBoundedStdin() {
+  return new Promise((resolveInput, rejectInput) => {
+    const chunks = [];
+    let size = 0;
+    const fail = () => {
+      cleanup();
+      process.stdin.pause();
+      rejectInput(new CliError(EXIT.invalidState, "invalid_params", "invite input exceeds 48 KiB"));
+    };
+    const cleanup = () => {
+      process.stdin.off("data", onData);
+      process.stdin.off("end", onEnd);
+      process.stdin.off("error", onError);
+    };
+    const onData = (chunk) => {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      size += bytes.length;
+      if (size > MAX_EXTERNAL_INVITE_BYTES) {
+        fail();
+        return;
+      }
+      chunks.push(bytes);
+    };
+    const onEnd = () => {
+      cleanup();
+      try {
+        resolveInput(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)));
+      } catch {
+        rejectInput(new CliError(EXIT.invalidState, "invalid_params", "invite input is not valid UTF-8"));
+      }
+    };
+    const onError = () => {
+      cleanup();
+      rejectInput(new CliError(EXIT.invalidState, "invalid_params", "could not read invite input"));
+    };
+    process.stdin.on("data", onData);
+    process.stdin.once("end", onEnd);
+    process.stdin.once("error", onError);
+    process.stdin.resume();
+  });
+}
 function rpcCall(socketPath, method, params, timeoutMs = RPC_TIMEOUT_MS) {
   const id = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
   const request = `${JSON.stringify({ version: 1, id, method, params })}
@@ -5656,7 +5800,7 @@ async function execute(args, output) {
     return;
   }
   if (command === "room") {
-    const request = roomRequest(args[1], args.slice(2));
+    const request = await roomRequest(args[1], args.slice(2));
     const config2 = loadCliConfig();
     const socketPath = join2(config2.stateDir, "management.sock");
     const result = request.method === "room.history" ? await readHistoryPages(socketPath, request.params) : await rpcCall(