@ours.network/cowork 0.4.0 → 0.4.1-nightly.20260816.4aaf940

package/README.md

@@ -1,6 +1,6 @@
 # ours-cowork
 
-`ours-cowork` is a standalone daemon for durable ours mission rooms. It owns one ordinary packet per room, an ordered local archive, a private Unix management socket, and a localhost web console with room RPC.
+`ours-cowork` is a standalone standard-SDK daemon for durable ours mission rooms. It owns one ordinary ours identity per room through an embedded `@ours.network/sdk` runtime by default, an ordered local archive, a private Unix management socket, and a localhost web console with room RPC.
 
 ```sh
 ours-cowork web
@@ -9,23 +9,23 @@ ours-cowork docs
 
 `ours-cowork web` starts the daemon if it is absent, waits for the console, and opens `http://127.0.0.1:3052/`. Create a room with a friendly display name first, then add each invitation requirement from its Invite panel. Names are trimmed, normalized to Unicode NFC, and may contain 1–64 Unicode characters excluding control and format characters. Duplicate names are allowed. The Communication view contains the human-readable room chat; operational records remain in Events and the complete ordered stream remains in Archive.
 
-The friendly `room_name` is presentation metadata. New rooms announce the technical identity `ours-cowork-room:<initial room_name>`; that authenticated announced name is frozen when the display name later changes. Duplicate display and announced names are allowed because identity CIDs, not names, are the authorization and routing keys. The opaque `room_id` remains the stable key for URLs, storage, and identity correlation. Existing `cowork-room-<room_id>` identities are never renamed or recreated, and rooms created before friendly names existed migrate only their display metadata to `Room <first 8 room_id characters>`.
+The friendly `room_name` is presentation metadata. New rooms use the globally unique SDK identity `ours-cowork-<room_id>`; that authenticated name is independent of later display-name changes. Duplicate display names are allowed because identity CIDs and room IDs, not names, are the authorization and routing keys. Pre-1.0 rooms using `cowork-room-<room_id>` or `ours-cowork-room:<name>` custom packet state are detected and refused: back them up with the old release, recreate them, and re-invite their participants.
 
 The localhost HTTP console has no authentication. Keep it bound to `127.0.0.1`; do not proxy, forward, or expose the port to other hosts. Room state is refreshed by periodic polling, not pushed to the browser.
 
-The same listener describes its own room management REST API: `http://127.0.0.1:3052/openapi.json` is the OpenAPI 3.1 document and `http://127.0.0.1:3052/docs` is the browser UI for it. Both are read-only, load no remote assets, and follow the console's loopback-only exposure rules.
+By default the runtime is embedded and no configuration changes. A `daemon` block with `mode: "external"` instead hosts the room identities on an ours daemon you already run — the common one, or a dedicated one on its own port and state directory. See the configuration topic.
 
 The package runs independently with its own config and state directory. Operator room commands use one JSONL request over `management.sock`. Use `--json` for automation; its stdout is a single JSON value and diagnostics are included in that value.
 
 Ordinary ours-mcp identities can join only as remote participants over the ours protocol.
 
-Active participants can also send files through the room packet. Cowork treats
-them as opaque bytes, archives them before consuming packet state, and relays a
-signed metadata envelope plus the core binary file to every other active seat.
+Active participants can also send files through the room identity. Cowork treats
+them as opaque bytes, archives them before consuming SDK inbox state, and relays an
+SDK-authenticated metadata envelope plus the binary file to every other active seat.
 Files are limited to 2 MiB; larger inputs fail loudly instead of weakening
 crash recovery guarantees.
 
-The release package contains the standalone daemon, operator CLI, compiled room packet, deterministic web assets, and all eleven offline operator topics. It has no dependency on another agent daemon.
+The release package contains the standalone daemon, operator CLI, deterministic web assets, and all eleven offline operator topics. Standard identity, messaging, reply, file, and lifecycle behavior comes from the public `@ours.network/sdk`; no custom MUFL room actor is shipped.
 
 Licensed under [FSL-1.1-Apache-2.0](./LICENSE).
 

package/dist/cli.js

@@ -4065,6 +4065,33 @@ var NEVER = INVALID;
 var DIRECTORY_MODE = 448;
 var FILE_MODE = 384;
 var NO_FOLLOW = nodeFs.constants.O_NOFOLLOW ?? 0;
+var CoworkDaemonSchema = external_exports.object({
+  mode: external_exports.enum(["embedded", "external"]),
+  endpoint: external_exports.string().url().refine(isDaemonOrigin, "daemon.endpoint must be an http(s) origin with no credentials, path, query, or fragment").refine(isConfidentialDaemonEndpoint, "daemon.endpoint must use https:// unless the daemon is on this host (http:// is allowed only for localhost, 127.0.0.0/8, or [::1])").transform(normalizeDaemonEndpoint).optional(),
+  stateDir: external_exports.string().min(1).transform((value) => resolve(value)).optional()
+}).strict().superRefine((value, ctx) => {
+  if (value.mode === "external") {
+    for (const field of ["endpoint", "stateDir"]) {
+      if (value[field] === void 0) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [field],
+          message: `daemon.${field} is required when daemon.mode is "external"`
+        });
+      }
+    }
+    return;
+  }
+  for (const field of ["endpoint", "stateDir"]) {
+    if (value[field] !== void 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `daemon.${field} is only valid when daemon.mode is "external"`
+      });
+    }
+  }
+});
 var CoworkConfigSchema = external_exports.object({
   version: external_exports.literal(1),
   brokerUrl: external_exports.string().url().refine((value) => {
@@ -4075,7 +4102,10 @@ var CoworkConfigSchema = external_exports.object({
   rest: external_exports.object({
     enabled: external_exports.boolean(),
     port: external_exports.number().int().min(1).max(65535)
-  }).strict()
+  }).strict(),
+  // Absent unless an operator selected a daemon explicitly, so an untouched
+  // deployment keeps producing byte-identical effective configuration.
+  daemon: CoworkDaemonSchema.optional()
 }).strict();
 var CoworkConfigError = class extends Error {
   constructor(message, options) {
@@ -4114,6 +4144,7 @@ function loadConfig(env = process.env, io = {}) {
     throw new CoworkConfigError(`configured cowork config does not exist: ${configPath}`);
   }
   const restPort = env.OURS_COWORK_REST_PORT === void 0 ? void 0 : parsePort(env.OURS_COWORK_REST_PORT);
+  const daemon = mergeDaemonSelection(env, file.daemon);
   try {
     return CoworkConfigSchema.parse({
       version: 1,
@@ -4122,12 +4153,69 @@ function loadConfig(env = process.env, io = {}) {
       rest: {
         enabled: restPort === void 0 ? file.rest.enabled : true,
         port: restPort ?? file.rest.port
-      }
+      },
+      ...daemon === void 0 ? {} : { daemon }
     });
   } catch (error) {
     throw new CoworkConfigError("invalid effective cowork config", { cause: error });
   }
 }
+function mergeDaemonSelection(env, file) {
+  const mode = env.OURS_COWORK_DAEMON_MODE;
+  const endpoint = env.OURS_COWORK_DAEMON_ENDPOINT;
+  const stateDir = env.OURS_COWORK_DAEMON_STATE_DIR;
+  if (mode === void 0 && endpoint === void 0 && stateDir === void 0) return file;
+  if (mode !== void 0 && mode !== "embedded" && mode !== "external") {
+    throw new CoworkConfigError('OURS_COWORK_DAEMON_MODE must be "embedded" or "external"');
+  }
+  const effectiveMode = mode ?? file?.mode ?? "external";
+  if (effectiveMode === "embedded") {
+    if (endpoint !== void 0 || stateDir !== void 0) {
+      throw new CoworkConfigError(
+        'OURS_COWORK_DAEMON_ENDPOINT and OURS_COWORK_DAEMON_STATE_DIR require daemon mode "external"'
+      );
+    }
+    return { mode: "embedded" };
+  }
+  const effectiveEndpoint = endpoint ?? file?.endpoint;
+  const effectiveStateDir = stateDir ?? file?.stateDir;
+  return {
+    mode: "external",
+    ...effectiveEndpoint === void 0 ? {} : { endpoint: effectiveEndpoint },
+    ...effectiveStateDir === void 0 ? {} : { stateDir: effectiveStateDir }
+  };
+}
+function isDaemonOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.search === "" && url.hash === "" && (url.pathname === "" || url.pathname === "/");
+}
+function isConfidentialDaemonEndpoint(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  return url.protocol === "https:" || isLoopbackHost(url.hostname);
+}
+function isLoopbackHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1");
+  if (host === "localhost") return true;
+  if (host === "::1" || host === "0:0:0:0:0:0:0:1") return true;
+  const octets = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!octets) return false;
+  const parts = octets.slice(1).map(Number);
+  return parts.every((part) => part <= 255) && parts[0] === 127;
+}
+function normalizeDaemonEndpoint(value) {
+  const url = new URL(value);
+  return `${url.protocol}//${url.host}`;
+}
 function ensureRuntimeState(config, io = {}) {
   const parsed = CoworkConfigSchema.parse(config);
   const fs2 = io.fs ?? nodeFs;
@@ -4328,9 +4416,9 @@ var RoomNameSchema = external_exports.string().refine(
     });
   }
 });
-var ROOM_IDENTITY_PREFIX = "ours-cowork-room:";
-function roomIdentityName(roomName) {
-  return `${ROOM_IDENTITY_PREFIX}${RoomNameSchema.parse(roomName)}`;
+var ROOM_IDENTITY_PREFIX = "ours-cowork-";
+function roomIdentityName(roomId) {
+  return `${ROOM_IDENTITY_PREFIX}${LowerCrockfordUlidSchema.parse(roomId)}`;
 }
 function legacyRoomIdentityName(roomId) {
   return `cowork-room-${LowerCrockfordUlidSchema.parse(roomId)}`;
@@ -4510,7 +4598,7 @@ var RoleBriefingSchema = external_exports.object({
 }).strict();
 function refineRoomLineage(room, context) {
   const pendingIdentityName = legacyRoomIdentityName(room.room_id);
-  const currentPendingIdentityName = room.room_name === void 0 ? void 0 : roomIdentityName(room.room_name);
+  const currentPendingIdentityName = roomIdentityName(room.room_id);
   const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && (room.identity_name === pendingIdentityName || room.identity_name === currentPendingIdentityName) && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
   if (room.identity_cid === "" && !exactPacketPending) {
     context.addIssue({
@@ -4738,6 +4826,10 @@ var AuthorAliasSchema = external_exports.object({
   participant_id: LowerCrockfordUlidSchema,
   alias: NonEmptyStringSchema
 }).strict();
+var ReplyReferenceSchema = external_exports.object({
+  wire_id: NonEmptyStringSchema,
+  sentence: PositiveSafeIntegerSchema.optional()
+}).strict();
 var MessageShape = {
   kind: external_exports.literal("message"),
   message_id: LowerCrockfordUlidSchema,
@@ -4762,7 +4854,8 @@ var MessageShape = {
     }
   }),
   source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
-  source_wire_id: NonEmptyStringSchema.optional()
+  source_wire_id: NonEmptyStringSchema.optional(),
+  source_reply_to: ReplyReferenceSchema.optional()
 };
 var RelayIntentShape = {
   kind: external_exports.literal("relay_intent"),
@@ -4805,7 +4898,8 @@ var FileShape = {
     }
   }),
   source_file_id: external_exports.number().int().nonnegative().safe(),
-  source_wire_id: NonEmptyStringSchema.optional()
+  source_wire_id: NonEmptyStringSchema.optional(),
+  source_reply_to: ReplyReferenceSchema.optional()
 };
 var MembershipIntentShape = {
   kind: external_exports.literal("membership_intent"),
@@ -5620,7 +5714,14 @@ function serviceEnvironment(config) {
   return {
     OURS_COWORK_BROKER_URL: config.brokerUrl,
     OURS_COWORK_STATE_DIR: config.stateDir,
-    ...config.rest.enabled ? { OURS_COWORK_REST_PORT: String(config.rest.port) } : {}
+    ...config.rest.enabled ? { OURS_COWORK_REST_PORT: String(config.rest.port) } : {},
+    // Endpoint and state directory only. The daemon's API token stays where the
+    // SDK finds it and never reaches a service definition.
+    ...config.daemon === void 0 ? {} : {
+      OURS_COWORK_DAEMON_MODE: config.daemon.mode,
+      ...config.daemon.endpoint === void 0 ? {} : { OURS_COWORK_DAEMON_ENDPOINT: config.daemon.endpoint },
+      ...config.daemon.stateDir === void 0 ? {} : { OURS_COWORK_DAEMON_STATE_DIR: config.daemon.stateDir }
+    }
   };
 }
 function validateServiceConfiguration(config) {
@@ -5662,13 +5763,14 @@ function installSystemd(config) {
 Description=ours-cowork standalone mission-room daemon
 After=network-online.target
 Wants=network-online.target
+StartLimitIntervalSec=0
 
 [Service]
 Type=simple
 ExecStart=${systemdExecutableQuote(SELF)} serve
 ${environment}
 Restart=on-failure
-RestartSec=2
+RestartSec=5
 
 [Install]
 WantedBy=default.target