@ours.network/cowork 1.1.4 → 1.3.0

package/README.md

@@ -23,6 +23,8 @@ The package keeps room metadata and a per-room indexed `archive.sqlite3` in its
 
 Ordinary ours-mcp identities can join only as remote participants over the ours protocol.
 
+Granted room members can create message-only scoped reply threads for an explicit subset of stable room participant IDs through the generic Ours command catalog's `start_thread` command. Selected members receive separate root copies and reply with the SDK's native `reply_to_wire_id`; Cowork maps each descendant to the recipient's local immediate-parent copy. The selected participant-ID/CID pairs are immutable, later members are not backfilled, and excluded members receive no scoped message, file notice, notification, participant-history row, command result, or routing metadata. A message without `reply_to_wire_id` remains an ordinary whole-room message. See [Room workflow](./docs/05-room-workflow.md#scoped-reply-threads) for command discovery, schema, errors, and retry behavior, and [Messaging and history](./docs/07-messaging-history.md#reply-threading) for reply and history semantics.
+
 Active participants can also send files through the room identity. Cowork treats
 them as opaque bytes, archives them before consuming SDK inbox state, and relays an
 SDK-authenticated metadata envelope plus the binary file to every other active seat.
@@ -42,3 +44,4 @@ ours-cowork docs web
 
 Before production use, read the limitations topic. In particular, backups require a stopped daemon and restore uses the complete state directory.
 Lost room identity leases are recovered automatically with a non-force bind and exact persisted-CID proof. Operators can invoke the same safe path explicitly with `ours-cowork room rebind <room-id>`; it never recreates an established identity or steals a live lease.
+The localhost host-management CLI/API and web Archive retain full scoped-thread visibility for administrators, including excluded-member traffic that participant APIs hide. Runtime `room.history` is an authenticated, grant-gated participant view with viewer-local cursors; host cursors and participant cursors are not interchangeable. The shared SDK history remains local to each identity and does not define Cowork routing or host archive retention.

package/dist/cli.js

@@ -4351,11 +4351,85 @@ var SHARED_ROOM_COMMANDS = [
   "room.role.rest.remove"
 ];
 var RUNTIME_COMMAND_NAMES = [
+  "start_thread",
   "list-members",
   "remove-member",
   ...SHARED_ROOM_COMMANDS
 ];
 
+// src/thread-contracts.ts
+var ParticipantIdSchema = external_exports.string().regex(
+  /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
+  "must be a 26-character lowercase Crockford ULID"
+);
+var ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
+var TopicTextSchema = external_exports.string().refine(
+  (value) => Array.from(value).length >= 1 && Array.from(value).length <= 120 && value.trim().length > 0 && !/[\p{Cc}\p{Cf}]/u.test(value),
+  "topic must contain 1-120 Unicode characters without control or format characters"
+);
+var InputTopicSchema = TopicTextSchema.transform((value) => value.trim());
+var StoredTopicSchema = TopicTextSchema.refine(
+  (value) => value === value.trim(),
+  "stored topic must already be trimmed"
+);
+var IdempotencyKeySchema = external_exports.string().regex(
+  /^[A-Za-z0-9._:-]{1,128}$/,
+  "must contain 1-128 portable idempotency-key characters"
+);
+var ThreadMemberSchema = external_exports.object({
+  participant_id: ParticipantIdSchema,
+  identity: ContainerIdSchema
+}).strict();
+var ThreadRootSchema = external_exports.object({
+  schema_version: external_exports.literal(1),
+  thread_id: ParticipantIdSchema,
+  topic: StoredTopicSchema,
+  creator_participant_id: ParticipantIdSchema,
+  members: external_exports.array(ThreadMemberSchema).min(1),
+  idempotency_key: IdempotencyKeySchema,
+  fingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase SHA-256 digest")
+}).strict().superRefine((root, context) => {
+  const participantIds = /* @__PURE__ */ new Set();
+  const identities = /* @__PURE__ */ new Set();
+  for (const [index, member] of root.members.entries()) {
+    if (participantIds.has(member.participant_id)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["members", index, "participant_id"],
+        message: "thread member participant IDs must be unique"
+      });
+    }
+    participantIds.add(member.participant_id);
+    if (identities.has(member.identity)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["members", index, "identity"],
+        message: "thread member identities must be unique"
+      });
+    }
+    identities.add(member.identity);
+  }
+  if (!participantIds.has(root.creator_participant_id)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["creator_participant_id"],
+      message: "thread creator must be a member"
+    });
+  }
+});
+var ThreadScopeSchema = external_exports.object({
+  thread_id: ParticipantIdSchema,
+  parent_key: external_exports.string().regex(
+    /^(?:message|file):[0-7][0-9a-hjkmnp-tv-z]{25}$/,
+    "must identify an immediate message or file parent"
+  ).optional()
+}).strict();
+var StartThreadInputSchema = external_exports.object({
+  topic: InputTopicSchema,
+  participant_ids: external_exports.array(ParticipantIdSchema).min(1),
+  idempotency_key: IdempotencyKeySchema
+}).strict();
+
 // src/contracts.ts
 var MAX_TEXT_BYTES = 262144;
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
@@ -4379,11 +4453,17 @@ var LowerCrockfordUlidSchema = external_exports.string().regex(
   /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
   "must be a 26-character lowercase Crockford ULID"
 );
-var ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
+var ContainerIdSchema2 = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
 var RuntimeCommandNameSchema = external_exports.union([external_exports.enum(RUNTIME_COMMAND_NAMES), ConsumerCommandNameSchema]);
+var RuntimeCommandNamespacePatternSchema = external_exports.string().max(128).regex(/^(?:[a-z0-9][a-z0-9-]*\.)+\*$/);
+var RuntimeCommandGrantPatternSchema = external_exports.union([
+  RuntimeCommandNameSchema,
+  external_exports.literal("*"),
+  RuntimeCommandNamespacePatternSchema
+]);
 var RuntimeCommandGrantSchema = external_exports.object({
-  caller_cid: ContainerIdSchema,
-  command: RuntimeCommandNameSchema
+  caller_cid: ContainerIdSchema2,
+  command: RuntimeCommandGrantPatternSchema
 }).strict();
 function isStrictRfc3339(value) {
   const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
@@ -4432,7 +4512,7 @@ var RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
 var ROOM_ROLE = "room";
 var RuntimeRoleCommandGrantSchema = external_exports.object({
   role: RoleSchema,
-  commands: external_exports.array(RuntimeCommandNameSchema).superRefine((commands, context) => {
+  commands: external_exports.array(RuntimeCommandGrantPatternSchema).superRefine((commands, context) => {
     const seen = /* @__PURE__ */ new Set();
     for (const [index, command] of commands.entries()) {
       if (seen.has(command)) {
@@ -4727,7 +4807,7 @@ var CurrentRoomSchema = external_exports.object({
   lifecycle_request: external_exports.object({
     request_id: external_exports.string().min(1).max(256),
     command: external_exports.enum(["room.close", "room.delete"]),
-    caller_cid: ContainerIdSchema,
+    caller_cid: ContainerIdSchema2,
     accepted_at: Rfc3339Schema,
     state: external_exports.enum(["pending", "failed", "completed"]),
     error: external_exports.literal("lifecycle_failed").optional()
@@ -4881,7 +4961,7 @@ var AcceptExternalInviteInputSchema = external_exports.object({
     (value) => Buffer.byteLength(value, "utf8") <= MAX_EXTERNAL_INVITE_BYTES,
     `invite input must be at most ${MAX_EXTERNAL_INVITE_BYTES} UTF-8 bytes`
   ),
-  expected_cid: ContainerIdSchema.optional()
+  expected_cid: ContainerIdSchema2.optional()
 }).strict();
 var ListMembersCommandInputSchema = external_exports.object({}).strict();
 var CommandIdempotencyKeySchema = external_exports.string().regex(
@@ -4956,7 +5036,9 @@ var MessageShape = {
   }),
   source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
   source_wire_id: NonEmptyStringSchema.optional(),
-  source_reply_to: ReplyReferenceSchema.optional()
+  source_reply_to: ReplyReferenceSchema.optional(),
+  scope: ThreadScopeSchema.optional(),
+  thread_root: ThreadRootSchema.optional()
 };
 var RelayIntentShape = {
   kind: external_exports.literal("relay_intent"),
@@ -4964,7 +5046,12 @@ var RelayIntentShape = {
   file_id: LowerCrockfordUlidSchema.optional(),
   recipient_identity: NonEmptyStringSchema
 };
-var RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
+var RelayResultStatusSchema = external_exports.enum([
+  "queued",
+  "send_failed",
+  "skipped_removed",
+  "skipped_reply_unavailable"
+]);
 var RelayResultShape = {
   kind: external_exports.literal("relay_result"),
   intent_record_id: NonEmptyStringSchema,
@@ -5002,6 +5089,18 @@ var FileShape = {
   source_wire_id: NonEmptyStringSchema.optional(),
   source_reply_to: ReplyReferenceSchema.optional()
 };
+var IntakeRejectionShape = {
+  kind: external_exports.literal("intake_rejection"),
+  source_kind: external_exports.enum(["message", "file"]),
+  source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
+  source_file_id: external_exports.number().int().nonnegative().safe().optional(),
+  source_wire_id: NonEmptyStringSchema,
+  sender_identity: NonEmptyStringSchema,
+  sender_participant_id: LowerCrockfordUlidSchema,
+  fingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  error: external_exports.enum(["reply_target_unavailable", "thread_files_unsupported"]),
+  notification_attempt_claimed: external_exports.literal(true)
+};
 var MembershipIntentShape = {
   kind: external_exports.literal("membership_intent"),
   action: external_exports.enum(["remove"]),
@@ -5039,6 +5138,7 @@ var MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...Mes
 var FileRecordSchema = external_exports.object({ ...RecordCommonShape, ...FileShape }).strict();
 var RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
 var RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
+var IntakeRejectionRecordSchema = external_exports.object({ ...RecordCommonShape, ...IntakeRejectionShape }).strict();
 var MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
 var MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
 var CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
@@ -5048,6 +5148,7 @@ var RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
   FileRecordSchema,
   RelayIntentRecordSchema,
   RelayResultRecordSchema,
+  IntakeRejectionRecordSchema,
   MembershipIntentRecordSchema,
   MembershipResultRecordSchema,
   CloseNoticeIntentRecordSchema,
@@ -5063,6 +5164,18 @@ function refineRelaySubject(record, context) {
     });
   }
 }
+function refineIntakeRejection(record, context) {
+  if (record.kind !== "intake_rejection") return;
+  const hasMessage = record.source_msg_id !== void 0;
+  const hasFile = record.source_file_id !== void 0;
+  if (hasMessage === hasFile || (record.source_kind === "message" ? !hasMessage : !hasFile)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["source_kind"],
+      message: "intake rejections require exactly one numeric source field matching source_kind"
+    });
+  }
+}
 function refineFileRecord(record, context) {
   if (record.kind !== "file" || record.data_base64 === void 0) return;
   const bytes = Buffer.from(record.data_base64, "base64");
@@ -5113,6 +5226,102 @@ function refineMessageCategory(message, context) {
     }
   }
 }
+function refineMessageThread(message, context) {
+  if (message.thread_root !== void 0) {
+    if (message.scope === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["scope"],
+        message: "thread root messages require scope"
+      });
+      return;
+    }
+    if (message.scope.thread_id !== message.message_id || message.thread_root.thread_id !== message.message_id) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["thread_root", "thread_id"],
+        message: "thread root thread_id and scope thread_id must equal message_id"
+      });
+    }
+    if (message.scope.parent_key !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["scope", "parent_key"],
+        message: "parent_key is forbidden on thread root messages"
+      });
+    }
+    if (message.category !== "chat") {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["category"],
+        message: "thread root messages must be chat messages"
+      });
+    }
+    if (message.text !== `Thread: ${message.thread_root.topic}`) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["text"],
+        message: "thread root message text must identify its topic"
+      });
+    }
+    const creator = message.thread_root.members.find(
+      (member) => member.participant_id === message.thread_root?.creator_participant_id
+    );
+    if (creator?.identity !== message.author.identity) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["thread_root", "creator_participant_id"],
+        message: "thread root creator must match the message author"
+      });
+    }
+    if (message.author_alias !== void 0 && message.author_alias.participant_id !== message.thread_root.creator_participant_id) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["author_alias", "participant_id"],
+        message: "thread root author alias must identify the creator"
+      });
+    }
+    for (const field of ["source_msg_id", "source_wire_id", "source_reply_to"]) {
+      if (message[field] !== void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [field],
+          message: `${field} is forbidden on thread root messages`
+        });
+      }
+    }
+    return;
+  }
+  if (message.scope === void 0) return;
+  if (message.scope.parent_key === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["scope", "parent_key"],
+      message: "thread descendants require an immediate parent_key"
+    });
+  }
+  if (message.scope.thread_id === message.message_id) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["scope", "thread_id"],
+      message: "thread descendant thread_id must identify a distinct root message"
+    });
+  }
+  if (message.source_reply_to === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["source_reply_to"],
+      message: "thread descendants require source_reply_to"
+    });
+  }
+  if (message.category !== "chat") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["category"],
+      message: "thread descendants must be chat messages"
+    });
+  }
+}
 var CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
   if (record.record_id !== `${record.room_id}:${record.seq}`) {
     context.addIssue({
@@ -5121,8 +5330,12 @@ var CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record
       message: 'record_id must equal room_id + ":" + seq'
     });
   }
-  if (record.kind === "message") refineMessageCategory(record, context);
+  if (record.kind === "message") {
+    refineMessageCategory(record, context);
+    refineMessageThread(record, context);
+  }
   refineRelaySubject(record, context);
+  refineIntakeRejection(record, context);
   refineFileRecord(record, context);
 });
 var AppendRecordSchema = external_exports.discriminatedUnion("kind", [
@@ -5130,11 +5343,16 @@ var AppendRecordSchema = external_exports.discriminatedUnion("kind", [
   external_exports.object({ ...AppendCommonShape, ...FileShape }).strict(),
   external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
   external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
+  external_exports.object({ ...AppendCommonShape, ...IntakeRejectionShape }).strict(),
   external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
   external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
 ]).superRefine((record, context) => {
-  if (record.kind === "message") refineMessageCategory(record, context);
+  if (record.kind === "message") {
+    refineMessageCategory(record, context);
+    refineMessageThread(record, context);
+  }
   refineRelaySubject(record, context);
+  refineIntakeRejection(record, context);
   refineFileRecord(record, context);
 });
 
@@ -5431,8 +5649,8 @@ async function roomRequest(command, args) {
       const role = requiredFlag(parsed, "--role", "room role-command-set");
       const value = requiredFlag(parsed, "--commands", "room role-command-set");
       const commands = value === "none" ? [] : value.split(",");
-      if (new Set(commands).size !== commands.length || commands.some((item) => !RuntimeCommandNameSchema.safeParse(item).success)) {
-        usageError("--commands must be a unique comma-separated list of built-in command names or none");
+      if (new Set(commands).size !== commands.length || commands.some((item) => !RuntimeCommandGrantPatternSchema.safeParse(item).success)) {
+        usageError("--commands must be a unique comma-separated list of command names, * or namespace.* patterns, or none");
       }
       return { method: "room.command.role.set", params: { room_id: roomId, role, commands } };
     }
@@ -5443,8 +5661,8 @@ async function roomRequest(command, args) {
         3,
         `room ${command}`
       );
-      if (!RuntimeCommandNameSchema.safeParse(runtimeCommand).success) {
-        usageError("runtime command must be a supported built-in command name");
+      if (!RuntimeCommandGrantPatternSchema.safeParse(runtimeCommand).success) {
+        usageError("runtime command must be a supported command name, * or namespace.* pattern");
       }
       return {
         method: command === "command-grant" ? "room.command.grant" : "room.command.revoke",