@ours.network/cowork 1.0.6 → 1.0.8

package/README.md

@@ -7,9 +7,9 @@ ours-cowork web
 ours-cowork docs
 ```
 
-`ours-cowork web` starts the daemon if it is absent, waits for the console, and opens `http://127.0.0.1:3052/`. Create a room with a name first, then add each invitation requirement from its Invite panel. Names are trimmed, normalized to Unicode NFC, and may contain 1–64 Unicode characters excluding control and format characters. A normalized name must be unique among identities in the shared daemon. The Communication view contains the human-readable room chat; operational records remain in Events and the complete ordered stream remains in Archive.
+`ours-cowork web` starts the daemon if it is absent, waits for the console, and opens `http://127.0.0.1:3052/`. Create a room with a name first, then add each invitation requirement from its Invite panel. Names are trimmed, normalized to Unicode NFC, and may contain 1–64 Unicode characters excluding control and format characters. The bounded identity name must not collide with an identity in the shared daemon. The Communication view contains the human-readable room chat; operational records remain in Events and the complete ordered stream remains in Archive.
 
-Each room identity is exactly `ours-cowork:<room name>`, preserving the normalized name supplied at creation so Messenger can display it directly without separate `room_name` metadata. The authenticated identity name is frozen at creation; later room settings may change `room_name` but do not rename the identity, CID, contacts, or history. Identity CIDs, not names, remain the authorization and routing keys. Because identity names are daemon-global, creating another room with the same normalized name fails closed. Earlier unreleased ID- and slug-based identity formats are unsupported; no migration is provided for this unreleased major.
+Each room identity is `ours-cowork:<bounded room name>`. Cowork NFC-normalizes the creation name and retains its first 52 Unicode code points so the complete SDK identity stays within 64 code points. The authenticated identity name is frozen at creation; later room settings may change `room_name` but do not rename the identity, CID, contacts, or history. Identity CIDs, not names, remain the authorization and routing keys. Because identity names are daemon-global, equal names—including distinct long titles with the same retained prefix—collide cleanly. Earlier unreleased ID- and slug-based identity formats are unsupported; no migration is provided for this unreleased major.
 
 The localhost HTTP console has no authentication. Keep it bound to `127.0.0.1`; do not proxy, forward, or expose the port to other hosts. Room state is refreshed by periodic polling, not pushed to the browser.
 

package/dist/cli.js

@@ -4298,6 +4298,7 @@ var MAX_FILE_NAME_BYTES = 255;
 var MAX_MIME_BYTES = 255;
 var MAX_ROLE_BYTES = 256;
 var MAX_ROOM_NAME_CHARACTERS = 64;
+var MAX_ROOM_IDENTITY_NAME_CHARACTERS = 64;
 function utf8Bounded(label, maximumBytes) {
   return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
     (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
@@ -4345,6 +4346,7 @@ var RoomNameSchema = external_exports.string().refine(
   }
 });
 var ROOM_IDENTITY_PREFIX = "ours-cowork:";
+var MAX_ROOM_IDENTITY_TITLE_CHARACTERS = MAX_ROOM_IDENTITY_NAME_CHARACTERS - Array.from(ROOM_IDENTITY_PREFIX).length;
 function isPersistedRoomIdentityName(roomId, identityName) {
   if (!LowerCrockfordUlidSchema.safeParse(roomId).success || !identityName.startsWith(ROOM_IDENTITY_PREFIX)) {
     return false;
@@ -5717,7 +5719,11 @@ function serviceEnvironment(config) {
   };
 }
 function validateServiceConfiguration(config) {
-  const values = { cowork_cli: SELF, ...serviceEnvironment(config) };
+  const values = {
+    node_executable: process.execPath,
+    cowork_cli: SELF,
+    ...serviceEnvironment(config)
+  };
   for (const [label, value] of Object.entries(values)) {
     if (/[\x00-\x1f\x7f-\x9f]/.test(value)) {
       throw new CliError(EXIT.invalidState, "invalid_state", `${label} contains a control character unsafe for a service definition`);
@@ -5729,7 +5735,7 @@ function systemdValueQuote(value) {
 }
 function systemdExecutableQuote(value) {
   if (value.includes('"') || /[\0\n\r]/.test(value)) {
-    throw new CliError(EXIT.invalidState, "invalid_state", "cowork CLI path contains a character unsupported by systemd ExecStart");
+    throw new CliError(EXIT.invalidState, "invalid_state", "node_executable contains a character unsupported by systemd ExecStart");
   }
   return `"${value.replaceAll("\\", "\\\\").replaceAll("%", "%%")}"`;
 }
@@ -5759,7 +5765,7 @@ StartLimitIntervalSec=0
 
 [Service]
 Type=simple
-ExecStart=${systemdExecutableQuote(SELF)} serve
+ExecStart=${systemdExecutableQuote(process.execPath)} ${systemdValueQuote(SELF)} serve
 ${environment}
 Restart=on-failure
 RestartSec=5
@@ -5796,7 +5802,7 @@ function installLaunchd(config) {
 <plist version="1.0"><dict>
   <key>Label</key><string>${LAUNCHD_LABEL}</string>
   <key>ProgramArguments</key><array>
-    <string>${xml(SELF)}</string><string>serve</string>
+    <string>${xml(process.execPath)}</string><string>${xml(SELF)}</string><string>serve</string>
   </array>
   <key>EnvironmentVariables</key><dict>
 ${environment}

package/dist/daemon.js

@@ -4540,8 +4540,27 @@ function isStrictRfc3339(value) {
 function normalizeRoomName(value) {
   return value.trim().normalize("NFC");
 }
+function sdkIdentityNameError(identityName) {
+  const length = Array.from(identityName).length;
+  if (length < 1 || length > MAX_ROOM_IDENTITY_NAME_CHARACTERS) {
+    return `name must be 1-${MAX_ROOM_IDENTITY_NAME_CHARACTERS} Unicode characters`;
+  }
+  if (identityName !== identityName.normalize("NFC")) return "name must use Unicode NFC normalization";
+  if (SDK_IDENTITY_NAME_FORBIDDEN.test(identityName)) {
+    return "name must not contain control, format, surrogate, line-separator, or path-separator characters";
+  }
+  if (SDK_IDENTITY_NAME_RESERVED.has(identityName)) return `name ${JSON.stringify(identityName)} is reserved`;
+  return void 0;
+}
 function roomIdentityName(roomName) {
-  return `${ROOM_IDENTITY_PREFIX}${RoomNameSchema.parse(roomName)}`;
+  const normalized = RoomNameSchema.parse(roomName);
+  const boundedTitle = Array.from(normalized).slice(0, MAX_ROOM_IDENTITY_TITLE_CHARACTERS).join("");
+  const identityName = `${ROOM_IDENTITY_PREFIX}${boundedTitle}`;
+  const detail = sdkIdentityNameError(identityName);
+  if (detail !== void 0) {
+    throw new CoworkIdentityNameError(`generated room identity name is invalid: ${detail}`);
+  }
+  return identityName;
 }
 function isPersistedRoomIdentityName(roomId, identityName) {
   if (!LowerCrockfordUlidSchema.safeParse(roomId).success || !identityName.startsWith(ROOM_IDENTITY_PREFIX)) {
@@ -4551,7 +4570,7 @@ function isPersistedRoomIdentityName(roomId, identityName) {
   return parsed.success && identityName === `${ROOM_IDENTITY_PREFIX}${parsed.data}`;
 }
 function isStandardRoomIdentityName(roomId, identityName) {
-  return isPersistedRoomIdentityName(roomId, identityName);
+  return isPersistedRoomIdentityName(roomId, identityName) && sdkIdentityNameError(identityName) === void 0;
 }
 function refineRoomLineage(room, context) {
   const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && isPersistedRoomIdentityName(room.room_id, room.identity_name) && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
@@ -4681,7 +4700,7 @@ function refineMessageCategory(message, context) {
     }
   }
 }
-var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, RoleSchema, ROOM_ROLE, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, MAX_ROOM_IDENTITY_TITLE_CHARACTERS, SDK_IDENTITY_NAME_FORBIDDEN, SDK_IDENTITY_NAME_RESERVED, CoworkIdentityNameError, RoleSchema, ROOM_ROLE, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
 var init_contracts = __esm({
   "src/contracts.ts"() {
     "use strict";
@@ -4695,6 +4714,7 @@ var init_contracts = __esm({
     MAX_MIME_BYTES = 255;
     MAX_ROLE_BYTES = 256;
     MAX_ROOM_NAME_CHARACTERS = 64;
+    MAX_ROOM_IDENTITY_NAME_CHARACTERS = 64;
     NonEmptyStringSchema = external_exports.string().min(1);
     PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
     LowerCrockfordUlidSchema = external_exports.string().regex(
@@ -4715,6 +4735,16 @@ var init_contracts = __esm({
       }
     });
     ROOM_IDENTITY_PREFIX = "ours-cowork:";
+    MAX_ROOM_IDENTITY_TITLE_CHARACTERS = MAX_ROOM_IDENTITY_NAME_CHARACTERS - Array.from(ROOM_IDENTITY_PREFIX).length;
+    SDK_IDENTITY_NAME_FORBIDDEN = /[\\/\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}]/u;
+    SDK_IDENTITY_NAME_RESERVED = /* @__PURE__ */ new Set([".", "..", "contact-book", "root.json", "bindings.json"]);
+    CoworkIdentityNameError = class extends Error {
+      code = "NAME_INVALID";
+      constructor(message) {
+        super(message);
+        this.name = "CoworkIdentityNameError";
+      }
+    };
     RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
     ROOM_ROLE = "room";
     MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
@@ -5267,6 +5297,16 @@ import { createHash as createHash2 } from "node:crypto";
 import * as fs from "node:fs";
 import { join as join2 } from "node:path";
 import { brotliCompressSync, brotliDecompressSync, constants as zlibConstants } from "node:zlib";
+async function sdkNameError(code, message) {
+  const { OursError } = await import("@ours.network/sdk");
+  return new OursError(code, message);
+}
+async function isTypedNameRefusal(error) {
+  const { OursError } = await import("@ours.network/sdk");
+  if (!(error instanceof OursError)) return false;
+  const code = error.code;
+  return code === "NAME_INVALID" || code === "NAME_TAKEN";
+}
 function sdkErrorCode(error) {
   if (error === null || typeof error !== "object" || !("code" in error)) return void 0;
   return typeof error.code === "string" ? error.code : void 0;
@@ -5450,18 +5490,22 @@ var init_packets = __esm({
       get(roomId) {
         return this.packets.get(roomId);
       }
-      async create(roomId, identityName, bio = `ours-cowork mission room ${roomId}`) {
+      async preflightCreate(roomId, identityName) {
         validateRoomId(roomId);
-        this.assertStandardIdentity(roomId, identityName);
+        await this.assertStandardIdentity(roomId, identityName);
         this.assertNoLegacyState(roomId);
         if (this.packets.has(roomId)) throw new Error(`room identity "${roomId}" is already hosted`);
         const localNames = /* @__PURE__ */ new Set([identityName]);
         const available = await this.host.listIdentityNames(localNames);
         if (available.has(identityName)) {
-          throw new Error(
+          throw await sdkNameError(
+            "NAME_TAKEN",
             `shared ours daemon already contains unproven room identity "${identityName}"; refusing to adopt it without a durably recorded CID`
           );
         }
+      }
+      async create(roomId, identityName, bio = `ours-cowork mission room ${roomId}`) {
+        await this.preflightCreate(roomId, identityName);
         const client = await this.host.createClient();
         try {
           const created = await client.createIdentity({
@@ -5484,12 +5528,15 @@ var init_packets = __esm({
         } catch (error) {
           await client.releaseLease().catch(() => {
           });
+          if (await isTypedNameRefusal(error)) {
+            throw error;
+          }
           throw new Error(`failed to provision standard SDK identity for room "${roomId}"`, { cause: error });
         }
       }
       async restore(roomId, expectedCid, identityName) {
         validateRoomId(roomId);
-        this.assertStandardIdentity(roomId, identityName);
+        await this.assertStandardIdentity(roomId, identityName);
         this.assertNoLegacyState(roomId);
         if (expectedCid === void 0 || expectedCid.length === 0) {
           throw new Error(`refusing to restore room identity "${identityName}" without a durably recorded expected CID`);
@@ -5584,7 +5631,9 @@ var init_packets = __esm({
           throw new LegacyCoworkStateError(roomId);
         }
       }
-      assertStandardIdentity(roomId, identityName) {
+      async assertStandardIdentity(roomId, identityName) {
+        const detail = sdkIdentityNameError(identityName);
+        if (detail !== void 0) throw await sdkNameError("NAME_INVALID", `generated room identity name is invalid: ${detail}`);
         if (!isStandardRoomIdentityName(roomId, identityName)) throw new LegacyCoworkStateError(roomId);
       }
     };
@@ -6345,6 +6394,12 @@ function byteBoundedHistoryPage(records) {
   }
   return page;
 }
+async function isCleanIdentityRefusal(error) {
+  const { OursError } = await import("@ours.network/sdk");
+  if (!(error instanceof OursError)) return false;
+  const code = error.code;
+  return code === "NAME_INVALID" || code === "NAME_TAKEN";
+}
 function activeSeats(room) {
   return room.seats.filter((seat) => seat.state === "active");
 }
@@ -6430,6 +6485,7 @@ var init_service = __esm({
       nextMessageId;
       intake;
       provisioningCheckpoint;
+      identityNameTails = /* @__PURE__ */ new Map();
       constructor(store, packets, options = {}) {
         this.store = store;
         this.packets = packets;
@@ -6448,7 +6504,8 @@ var init_service = __esm({
         const roomId = LowerCrockfordUlidSchema.parse(this.nextRoomId());
         const roomName = settings.name ?? defaultRoomName(roomId);
         const identityName = roomIdentityName(roomName);
-        return this.lock(roomId, async () => {
+        return this.lockIdentityName(identityName, () => this.lock(roomId, async () => {
+          await this.packets.preflightCreate(roomId, identityName);
           const provisional = RoomSchema.parse({
             version: 2,
             room_id: roomId,
@@ -6471,15 +6528,30 @@ var init_service = __esm({
             created_at: this.now()
           });
           await this.store.create(provisional);
-          const packet = await this.packets.create(
-            roomId,
-            identityName,
-            `ours-cowork mission room ${roomId}`
-          );
+          let packet;
+          try {
+            packet = await this.packets.create(
+              roomId,
+              identityName,
+              `ours-cowork mission room ${roomId}`
+            );
+          } catch (error) {
+            if (await isCleanIdentityRefusal(error)) {
+              try {
+                await this.store.discardPendingProvisioning(roomId, identityName);
+              } catch (rollbackError) {
+                throw new AggregateError(
+                  [error, rollbackError],
+                  `room "${roomId}" identity provisioning was refused and its fresh sentinel could not be discarded`
+                );
+              }
+            }
+            throw error;
+          }
           this.provisioningCheckpoint("metadata");
           const { status: _packetPending, ...created } = provisional;
           return this.store.save(RoomSchema.parse({ ...created, identity_cid: packet.cid }));
-        });
+        }));
       }
       async recoverRoom(roomId) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
@@ -6520,7 +6592,13 @@ var init_service = __esm({
       async recoverPacketUnlocked(id, initial) {
         let room = initial;
         if (room.state === "closed") return room;
-        const packetPending = this.isPacketPending(room);
+        let packetPending = this.isPacketPending(room);
+        if (packetPending && isPersistedRoomIdentityName(id, room.identity_name) && !isStandardRoomIdentityName(id, room.identity_name)) {
+          const storedCreationName = room.identity_name.slice(ROOM_IDENTITY_PREFIX.length);
+          const correctedIdentityName = roomIdentityName(storedCreationName);
+          room = await this.store.save(RoomSchema.parse({ ...room, identity_name: correctedIdentityName }));
+          packetPending = this.isPacketPending(room);
+        }
         let packet = this.packets.get(id);
         if (packet) {
           if (!packetPending && packet.cid !== room.identity_cid) {
@@ -7679,6 +7757,17 @@ var init_service = __esm({
       lock(roomId, work) {
         return this.store.mutex(roomId).runExclusive(work);
       }
+      async lockIdentityName(identityName, work) {
+        const previous = this.identityNameTails.get(identityName) ?? Promise.resolve();
+        const result = previous.then(work, work);
+        const tail = result.then(() => void 0, () => void 0);
+        this.identityNameTails.set(identityName, tail);
+        try {
+          return await result;
+        } finally {
+          if (this.identityNameTails.get(identityName) === tail) this.identityNameTails.delete(identityName);
+        }
+      }
       packet(roomId) {
         const packet = this.packets.get(roomId);
         if (!packet) throw new RoomServiceError(`room packet "${roomId}" is not hosted`);
@@ -8025,6 +8114,45 @@ var init_storage = __esm({
           synchronous: db.pragma("synchronous", { simple: true })
         })));
       }
+      /** Roll back only a fresh, empty provisioning sentinel after a proven no-side-effect SDK refusal. */
+      async discardPendingProvisioning(roomId, expectedIdentityName) {
+        const id = this.roomId(roomId);
+        await this.mutex(id, () => {
+          this.ensureBaseDirectories();
+          const roomDir = this.roomDirectory(id);
+          this.ensurePrivateDirectory(roomDir, false, `room "${id}" directory`);
+          const room = this.loadUnlocked(id);
+          if (room.state !== "provisioning" || room.status !== "packet_pending" || room.identity_cid !== "" || room.identity_name !== expectedIdentityName || room.invites.length !== 0 || room.seats.length !== 0) {
+            throw new CoworkStorageError(`room "${id}" is not the exact empty provisioning sentinel`);
+          }
+          const blobs = this.blobsDirectory(id);
+          this.ensurePrivateDirectory(blobs, false, `room "${id}" blobs directory`);
+          if (this.fs.readdirSync(blobs).length !== 0) {
+            throw new CoworkStorageError(`room "${id}" provisioning sentinel has file blobs`);
+          }
+          const recordCount = this.withDatabase(id, (db) => db.prepare(
+            "SELECT COUNT(*) AS count FROM records"
+          ).get().count);
+          if (recordCount !== 0) throw new CoworkStorageError(`room "${id}" provisioning sentinel has archive records`);
+          const expected = /* @__PURE__ */ new Set(["archive.sqlite3", "archive.sqlite3-wal", "archive.sqlite3-shm", "blobs", "room.json"]);
+          const unexpected = this.fs.readdirSync(roomDir).filter((name) => !expected.has(name));
+          if (unexpected.length !== 0) {
+            throw new CoworkStorageError(`room "${id}" provisioning sentinel has unexpected residue: ${unexpected.join(", ")}`);
+          }
+          for (const name of ["archive.sqlite3-wal", "archive.sqlite3-shm", "archive.sqlite3", "room.json"]) {
+            const path = join3(roomDir, name);
+            if (this.lstatIfPresent(path)) {
+              this.assertRegularFile(path, name);
+              this.fs.unlinkSync(path);
+            }
+          }
+          this.fs.rmdirSync(blobs);
+          this.fsyncDirectory(roomDir);
+          this.fs.rmdirSync(roomDir);
+          this.fsyncDirectory(this.roomsDirectory());
+          this.reconciledBlobRooms.delete(id);
+        });
+      }
       async delete(roomId) {
         const id = this.roomId(roomId);
         await this.mutex(id, () => {