@ours.network/cowork 1.0.5 → 1.0.6

package/README.md

@@ -41,3 +41,4 @@ ours-cowork docs web
 ```
 
 Before production use, read the limitations topic. In particular, backups require a stopped daemon and restore uses the complete state directory.
+Lost room identity leases are recovered automatically with a non-force bind and exact persisted-CID proof. Operators can invoke the same safe path explicitly with `ours-cowork room rebind <room-id>`; it never recreates an established identity or steals a live lease.

package/dist/cli.js

@@ -5053,6 +5053,7 @@ var NATIVE_MUTATION_METHODS = /* @__PURE__ */ new Set([
   "room.close",
   "room.recover",
   "room.recover.confirm",
+  "room.rebind",
   "room.participant.remove",
   "room.participant.replace"
 ]);
@@ -5105,6 +5106,7 @@ Room commands:
   close <room-id>
   delete <room-id> --yes
   recover <room-id> [--confirm <old-invite-id> <new-invite-id>]
+  rebind <room-id>
 
 Run \u2018ours-cowork docs\u2019 for the offline documentation index.`;
 }
@@ -5349,6 +5351,11 @@ async function roomRequest(command, args) {
       exactPositionals(parsed, 1, "room recover");
       return { method: "room.recover", params: { room_id: roomId } };
     }
+    case "rebind": {
+      const parsed = parseOptions(args, []);
+      const [roomId] = exactPositionals(parsed, 1, "room rebind");
+      return { method: "room.rebind", params: { room_id: roomId } };
+    }
     default:
       usageError(`unknown room command: ${command}`);
   }

package/dist/daemon.js

@@ -5267,6 +5267,14 @@ import { createHash as createHash2 } from "node:crypto";
 import * as fs from "node:fs";
 import { join as join2 } from "node:path";
 import { brotliCompressSync, brotliDecompressSync, constants as zlibConstants } from "node:zlib";
+function sdkErrorCode(error) {
+  if (error === null || typeof error !== "object" || !("code" in error)) return void 0;
+  return typeof error.code === "string" ? error.code : void 0;
+}
+function isTransientTransportError(error) {
+  if (error === null || typeof error !== "object" || !("code" in error)) return false;
+  return (/* @__PURE__ */ new Set(["ECONNRESET", "ECONNREFUSED", "EPIPE", "ETIMEDOUT", "UND_ERR_CONNECT_TIMEOUT"])).has(String(error.code));
+}
 function sendResult(result) {
   if (result.kind === "refused" || result.kind === "migrating") {
     return { status: "send_failed" };
@@ -5386,7 +5394,7 @@ function unpackInvite(encoded, maximumBytes) {
   if (compressed.length === 0) throw new Error("the invite blob is empty or invalid base64url");
   return Buffer.from(maximumBytes === void 0 ? brotliDecompressSync(compressed) : brotliDecompressSync(compressed, { maxOutputLength: maximumBytes }));
 }
-var LegacyCoworkStateError, PacketRegistry, SdkRoomPacket;
+var LegacyCoworkStateError, RoomIdentityMismatchError, PacketRegistry, SdkRoomPacket;
 var init_packets = __esm({
   "src/packets.ts"() {
     "use strict";
@@ -5399,6 +5407,12 @@ var init_packets = __esm({
         this.name = "LegacyCoworkStateError";
       }
     };
+    RoomIdentityMismatchError = class extends Error {
+      constructor(expected, found) {
+        super(`room identity CID mismatch during rebind: expected "${expected}", found "${found}"`);
+        this.name = "RoomIdentityMismatchError";
+      }
+    };
     PacketRegistry = class {
       packets = /* @__PURE__ */ new Map();
       trackers = /* @__PURE__ */ new Map();
@@ -5407,6 +5421,8 @@ var init_packets = __esm({
       fs;
       log;
       onNotify;
+      rebindSleep;
+      rebindRandom;
       unsubscribe;
       constructor(host, stateDir, options = {}) {
         this.host = host;
@@ -5416,6 +5432,8 @@ var init_packets = __esm({
         });
         this.onNotify = options.onNotify ?? (() => {
         });
+        this.rebindSleep = options.rebindSleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+        this.rebindRandom = options.rebindRandom ?? Math.random;
         this.unsubscribe = host.onIdentityNotify((name) => {
           const found = [...this.packets.entries()].find(([, packet2]) => packet2.name === name);
           if (!found) return;
@@ -5453,7 +5471,12 @@ var init_packets = __esm({
             localAutoAccept: true
           });
           const cid = created.info.cid;
-          const packet = new SdkRoomPacket(identityName, cid, client);
+          const packet = new SdkRoomPacket(identityName, cid, client, {
+            roomId,
+            log: this.log,
+            sleep: this.rebindSleep,
+            random: this.rebindRandom
+          });
           await packet.refresh();
           this.packets.set(roomId, packet);
           this.track(roomId, identityName);
@@ -5482,7 +5505,12 @@ var init_packets = __esm({
           if (expectedCid !== void 0 && bound.cid !== expectedCid) {
             throw new Error(`restored room identity CID mismatch: expected "${expectedCid}", found "${bound.cid}"`);
           }
-          const packet = new SdkRoomPacket(identityName, bound.cid, client);
+          const packet = new SdkRoomPacket(identityName, bound.cid, client, {
+            roomId,
+            log: this.log,
+            sleep: this.rebindSleep,
+            random: this.rebindRandom
+          });
           await packet.refresh();
           this.packets.set(roomId, packet);
           this.track(roomId, identityName);
@@ -5493,6 +5521,21 @@ var init_packets = __esm({
           throw error;
         }
       }
+      async rebind(roomId) {
+        validateRoomId(roomId);
+        const packet = this.packets.get(roomId);
+        if (!packet) throw new Error(`room packet "${roomId}" is not hosted`);
+        return packet.rebind();
+      }
+      /** Release one local SDK lease without deleting the persisted daemon identity. */
+      async unhost(roomId) {
+        validateRoomId(roomId);
+        const packet = this.packets.get(roomId);
+        if (!packet) return;
+        this.untrack(roomId);
+        this.packets.delete(roomId);
+        await packet.close();
+      }
       async destroy(roomId) {
         validateRoomId(roomId);
         const packet = this.packets.get(roomId);
@@ -5549,28 +5592,87 @@ var init_packets = __esm({
       name;
       cid;
       client;
+      roomId;
+      log;
+      rebindSleep;
+      rebindRandom;
+      rebindWork;
       contacts = [];
       hasInviteProvenance = false;
       invites = [];
       refreshWork;
       contactRefreshWork;
-      constructor(name, cid, client) {
+      constructor(name, cid, client, recovery = {}) {
+        this.roomId = recovery.roomId ?? name;
         this.name = name;
         this.cid = cid;
         this.client = client;
+        this.log = recovery.log ?? (() => {
+        });
+        this.rebindSleep = recovery.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+        this.rebindRandom = recovery.random ?? Math.random;
+      }
+      rebind() {
+        this.rebindWork ??= this.rebindUnlocked().finally(() => {
+          this.rebindWork = void 0;
+        });
+        return this.rebindWork;
+      }
+      async rebindUnlocked() {
+        this.observe("identity_rebind_detected");
+        let lastError;
+        for (let attempt = 1; attempt <= 3; attempt += 1) {
+          this.observe("identity_rebind_attempt", { attempt });
+          try {
+            const bound = await this.client.chooseIdentity({ name: this.name, force: false });
+            if (bound.cid !== this.cid) {
+              throw new RoomIdentityMismatchError(this.cid, bound.cid);
+            }
+            await this.refreshUnlocked();
+            this.observe("identity_rebind_succeeded", { attempt });
+            return { name: this.name, cid: this.cid, status: "rebound" };
+          } catch (error) {
+            lastError = error;
+            const code = sdkErrorCode(error);
+            if (error instanceof RoomIdentityMismatchError || !isTransientTransportError(error) || attempt === 3) {
+              this.observe("identity_rebind_failed", {
+                attempt,
+                code: code ?? (error instanceof RoomIdentityMismatchError ? "CID_MISMATCH" : "RECOVERY_FAILED")
+              });
+              throw error;
+            }
+            const delay_ms = Math.round(100 * 2 ** (attempt - 1) * (0.75 + this.rebindRandom() * 0.5));
+            this.observe("identity_rebind_retry", { attempt, delay_ms });
+            await this.rebindSleep(delay_ms);
+          }
+        }
+        throw lastError;
+      }
+      async runBound(operation) {
+        try {
+          return await operation();
+        } catch (error) {
+          const code = sdkErrorCode(error);
+          if (code !== "NOT_BOUND" && code !== "BINDING_REASSIGNED") throw error;
+          await this.rebind();
+          return operation();
+        }
+      }
+      observe(event, detail = {}) {
+        this.log(JSON.stringify({ event, room_id: this.roomId, identity_name: this.name, identity_cid: this.cid, ...detail }));
       }
       refresh() {
-        this.refreshWork ??= this.refreshUnlocked().finally(() => {
+        this.refreshWork ??= this.runBound(() => this.refreshUnlocked()).finally(() => {
           this.refreshWork = void 0;
         });
         return this.refreshWork;
       }
       async refreshUnlocked() {
-        await this.refreshContacts();
+        await this.refreshContactsUnlocked();
         this.invites = (await this.client.listInvites()).flatMap((invite) => invite.mode === "one_time" || invite.mode === "public" ? [{ invite_id: invite.invite_id, mode: invite.mode }] : []);
       }
       refreshContacts() {
-        this.contactRefreshWork ??= this.refreshContactsUnlocked().finally(() => {
+        this.contactRefreshWork ??= this.runBound(() => this.refreshContactsUnlocked()).finally(() => {
           this.contactRefreshWork = void 0;
         });
         return this.contactRefreshWork;
@@ -5584,13 +5686,13 @@ var init_packets = __esm({
         }));
       }
       async mintInvite(mode) {
-        const result = await this.client.generateInvite({ mode });
+        const result = await this.runBound(() => this.client.generateInvite({ mode }));
         await this.refresh();
         return { blob: result.blob, invite_id: result.inviteId, reusable: mode === "public" };
       }
       async addContact(invite) {
         const decoded = unpackInvite(invite, MAX_EXTERNAL_INVITE_BYTES);
-        const result = await this.client.addContact({ invite });
+        const result = await this.runBound(() => this.client.addContact({ invite }));
         await this.refresh();
         return {
           invite_id: createHash2("sha256").update(decoded).digest("hex"),
@@ -5600,7 +5702,7 @@ var init_packets = __esm({
         };
       }
       async revokeInvite(inviteId) {
-        const result = await this.client.revokeInvite({ invite_id: inviteId });
+        const result = await this.runBound(() => this.client.revokeInvite({ invite_id: inviteId }));
         await this.refresh();
         return { revoked: result.revoked };
       }
@@ -5615,9 +5717,9 @@ var init_packets = __esm({
       }
       async listUnreadMessages(limit) {
         validateBatchLimit(limit);
-        const metadata = (await this.client.listIncomingMessages()).filter((message) => message.status === "unread").sort((left, right) => left.seq - right.seq).slice(0, limit);
+        const metadata = (await this.runBound(() => this.client.listIncomingMessages())).filter((message) => message.status === "unread").sort((left, right) => left.seq - right.seq).slice(0, limit);
         return Promise.all(metadata.map(async (listed) => {
-          const history = await this.client.getHistoryItem({ wire_id: listed.wire_id });
+          const history = await this.runBound(() => this.client.getHistoryItem({ wire_id: listed.wire_id }));
           if (history === null) throw new Error(`SDK history is missing unread message ${listed.wire_id}`);
           assertListedMessage(listed, history);
           return messageItem(history);
@@ -5625,7 +5727,7 @@ var init_packets = __esm({
       }
       async acknowledgeMessage(expected, onUnexpected) {
         for (; ; ) {
-          const pulled = await this.client.getMessages({ limit: 1 });
+          const pulled = await this.runBound(() => this.client.getMessages({ limit: 1 }));
           if (pulled.messages.length > 1) throw new Error("SDK returned more than one message for limit 1");
           const [history] = pulled.messages;
           if (history === void 0) return;
@@ -5639,31 +5741,31 @@ var init_packets = __esm({
       }
       async listUnreadFiles(limit) {
         validateBatchLimit(limit);
-        const unread = (await this.client.listIncomingFiles()).filter((file) => file.status === "unread").sort((left, right) => left.seq - right.seq).slice(0, limit);
-        return Promise.all(unread.map(async (file) => fileItem(file, await this.client.fetchFile(file.wire_id))));
+        const unread = (await this.runBound(() => this.client.listIncomingFiles())).filter((file) => file.status === "unread").sort((left, right) => left.seq - right.seq).slice(0, limit);
+        return Promise.all(unread.map(async (file) => fileItem(file, await this.runBound(() => this.client.fetchFile(file.wire_id)))));
       }
       async acknowledgeFile(expected) {
-        const pulled = await this.client.getFiles({ wire_ids: [expected.wire_id] });
+        const pulled = await this.runBound(() => this.client.getFiles({ wire_ids: [expected.wire_id] }));
         if (pulled.files.length !== 1) {
           throw new Error(`SDK did not acknowledge selected file ${expected.wire_id}`);
         }
         assertReceivedFile(expected, pulled.files[0]);
       }
       async send(contactCid, body, replyTo) {
-        return sendResult(await this.client.sendMessage({
+        return sendResult(await this.runBound(() => this.client.sendMessage({
           contact: contactCid,
           text: body,
           ...replyTo === void 0 ? {} : {
             reply_to_wire_id: replyTo.wire_id,
             ...replyTo.sentence === void 0 ? {} : { reply_to_sentence: replyTo.sentence }
           }
-        }));
+        })));
       }
       async sendFile(contactCid, filename, mime, data, replyTo) {
         const validName = FileNameSchema.parse(filename);
         const validMime = FileMimeSchema.parse(mime);
         if (data.length > MAX_FILE_BYTES) throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
-        return sendResult(await this.client.sendFile({
+        return sendResult(await this.runBound(() => this.client.sendFile({
           contact: contactCid,
           data_base64: data.toString("base64"),
           filename: validName,
@@ -5672,10 +5774,10 @@ var init_packets = __esm({
             reply_to_wire_id: replyTo.wire_id,
             ...replyTo.sentence === void 0 ? {} : { reply_to_sentence: replyTo.sentence }
           }
-        }));
+        })));
       }
       async removeContact(contactCid) {
-        const result = await this.client.removeContact({ contact: contactCid });
+        const result = await this.runBound(() => this.client.removeContact({ contact: contactCid }));
         const notified = result.notified === true;
         this.contacts = this.contacts.filter((contact) => contact.container_id !== contactCid);
         return { status: notified ? "queued" : "send_failed", notified, key_material_retained: true };
@@ -6392,6 +6494,29 @@ var init_service = __esm({
         const id = LowerCrockfordUlidSchema.parse(roomId);
         return this.lock(id, async () => this.recoverPacketUnlocked(id, await this.store.load(id)));
       }
+      /** Canonical operator recovery for an established room identity lease. */
+      async rebindIdentity(roomId) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        let room = await this.store.load(id);
+        if (room.state === "closed" || room.state === "closing") {
+          throw new RoomServiceError(`cannot rebind room "${id}" while it is ${room.state}`);
+        }
+        if (this.isPacketPending(room) || !this.packets.get(id)) {
+          room = await this.recoverPacket(id);
+        } else {
+          if (!this.packets.rebind) throw new RoomServiceError("room packet registry does not support explicit rebind");
+          await this.packets.rebind(id);
+        }
+        await this.reconcileRoom(id);
+        await this.resumePending(id);
+        return {
+          room_id: id,
+          identity_name: room.identity_name,
+          identity_cid: room.identity_cid,
+          status: "rebound",
+          fanout: "resumed"
+        };
+      }
       async recoverPacketUnlocked(id, initial) {
         let room = initial;
         if (room.state === "closed") return room;
@@ -7074,6 +7199,11 @@ var init_service = __esm({
           if (room.state === "closed") {
             return this.store.save(room);
           }
+          if (this.isPacketPending(room)) {
+            throw new RoomServiceError(
+              `cannot close room "${id}" while its identity CID is unproven; run room rebind first, or verify and remove a colliding orphan identity before retrying recovery`
+            );
+          }
           if (room.state === "closing") {
             room = await this.store.save(room);
           } else {
@@ -8765,6 +8895,14 @@ var init_openapi = __esm({
         result: "The updated room record with the confirmed recovery.",
         example: { room_id: EXAMPLE_ROOM_ID, recovery_of: "inv-01", invite_id: "inv-02" }
       },
+      {
+        method: "room.rebind",
+        summary: "Rebind an established room identity",
+        description: "Safely restores the exact persisted room identity with a non-force lease claim and CID proof, then resumes durable room fanout. It never creates or renames an identity.",
+        params: params({ room_id: roomIdProperty }, ["room_id"]),
+        result: "A structured rebind receipt after identity proof, reconciliation, and pending fanout resumption.",
+        example: { room_id: EXAMPLE_ROOM_ID }
+      },
       {
         method: "room.list",
         summary: "List rooms",
@@ -9298,6 +9436,7 @@ function createServiceRoutes(service) {
       const value = RecoverConfirmParams.parse(params2);
       return service.confirmRecoveredInvite(value.room_id, value.recovery_of, value.invite_id);
     } },
+    "room.rebind": { auth: true, run: (params2) => service.rebindIdentity(RoomIdParams.parse(params2).room_id) },
     "room.list": { auth: true, run: (params2) => {
       external_exports.object({}).strict().parse(params2);
       return service.listRooms();
@@ -10330,21 +10469,43 @@ var init_daemon_runtime = __esm({
           const rooms = await this.store.list();
           this.checkpoint();
           const recoverable = rooms.filter((room) => room.state !== "closed");
+          const healthy = new Set(recoverable.map((room) => room.room_id));
+          const recoverPhase = async (roomId, phase, work) => {
+            if (!healthy.has(roomId)) return;
+            try {
+              await work();
+              this.checkpoint();
+            } catch (error) {
+              healthy.delete(roomId);
+              const unhost = this.registry?.unhost;
+              if (unhost) {
+                await unhost.call(this.registry, roomId).catch((unhostError) => {
+                  this.options.log?.(JSON.stringify({
+                    event: "startup_room_unhost_failed",
+                    room_id: roomId,
+                    error: unhostError instanceof Error ? unhostError.message : String(unhostError)
+                  }));
+                });
+              }
+              this.options.log?.(JSON.stringify({
+                event: "startup_room_recovery_failed",
+                room_id: roomId,
+                phase,
+                error: error instanceof Error ? error.message : String(error)
+              }));
+            }
+          };
           for (const room of recoverable) {
-            await this.service.recoverPacket(room.room_id);
-            this.checkpoint();
+            await recoverPhase(room.room_id, "restore", () => this.service.recoverPacket(room.room_id));
           }
           for (const room of recoverable.filter((candidate) => candidate.state !== "closing")) {
-            await this.service.reconcileRoom(room.room_id);
-            this.checkpoint();
+            await recoverPhase(room.room_id, "reconcile", () => this.service.reconcileRoom(room.room_id));
           }
           for (const room of recoverable.filter((candidate) => candidate.state === "closing")) {
-            await this.service.closeRoom(room.room_id);
-            this.checkpoint();
+            await recoverPhase(room.room_id, "close", () => this.service.closeRoom(room.room_id));
           }
           for (const room of recoverable.filter((candidate) => candidate.state !== "closing")) {
-            await this.service.resumePending(room.room_id);
-            this.checkpoint();
+            await recoverPhase(room.room_id, "fanout", () => this.service.resumePending(room.room_id));
           }
           const realService = this.service;
           const serviceRoutes = createServiceRoutes(realService);

package/docs/05-room-workflow.md

@@ -14,4 +14,8 @@ Update the display name with `ours-cowork room settings <room-id> --name "New na
 
 Close with `ours-cowork room close <room-id>`. Close is forward-only and removes the live standard SDK room identity while retaining the local archive. Archive deletion is a separate explicit operation described in the limitations topic.
 
+If the shared daemon restarts or a room SDK lease is lost, Cowork automatically attempts a non-force rebind of the room's exact persisted identity name and verifies its pinned CID before resuming the rejected operation. Concurrent recovery joins one attempt; transient connection failures use bounded exponential backoff. A live competing session, missing identity, or CID mismatch fails closed and is never force-bound or recreated. Startup isolates rooms that cannot be safely restored, releases their local leases, and continues serving healthy rooms.
+
+Use `ours-cowork room rebind <room-id>` for explicit recovery. This canonical operation applies the same name-and-CID proof, refreshes SDK contact/invite state, reconciles the room, and resumes durable pending fanout before reporting success. It refuses closing or closed rooms. Structured daemon logs emit `identity_rebind_*` and `startup_room_recovery_failed` events for diagnosis.
+
 Every web action has an equivalent CLI fallback in the room commands above and in the invites and messaging topics.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/cowork",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Durable ours mission rooms on the shared ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",