@ours.network/cowork 1.2.0 → 1.3.0

package/dist/cli.js

@@ -4455,9 +4455,15 @@ var LowerCrockfordUlidSchema = external_exports.string().regex(
 );
 var ContainerIdSchema2 = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
 var RuntimeCommandNameSchema = external_exports.union([external_exports.enum(RUNTIME_COMMAND_NAMES), ConsumerCommandNameSchema]);
+var RuntimeCommandNamespacePatternSchema = external_exports.string().max(128).regex(/^(?:[a-z0-9][a-z0-9-]*\.)+\*$/);
+var RuntimeCommandGrantPatternSchema = external_exports.union([
+  RuntimeCommandNameSchema,
+  external_exports.literal("*"),
+  RuntimeCommandNamespacePatternSchema
+]);
 var RuntimeCommandGrantSchema = external_exports.object({
   caller_cid: ContainerIdSchema2,
-  command: RuntimeCommandNameSchema
+  command: RuntimeCommandGrantPatternSchema
 }).strict();
 function isStrictRfc3339(value) {
   const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
@@ -4506,7 +4512,7 @@ var RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
 var ROOM_ROLE = "room";
 var RuntimeRoleCommandGrantSchema = external_exports.object({
   role: RoleSchema,
-  commands: external_exports.array(RuntimeCommandNameSchema).superRefine((commands, context) => {
+  commands: external_exports.array(RuntimeCommandGrantPatternSchema).superRefine((commands, context) => {
     const seen = /* @__PURE__ */ new Set();
     for (const [index, command] of commands.entries()) {
       if (seen.has(command)) {
@@ -5643,8 +5649,8 @@ async function roomRequest(command, args) {
       const role = requiredFlag(parsed, "--role", "room role-command-set");
       const value = requiredFlag(parsed, "--commands", "room role-command-set");
       const commands = value === "none" ? [] : value.split(",");
-      if (new Set(commands).size !== commands.length || commands.some((item) => !RuntimeCommandNameSchema.safeParse(item).success)) {
-        usageError("--commands must be a unique comma-separated list of built-in command names or none");
+      if (new Set(commands).size !== commands.length || commands.some((item) => !RuntimeCommandGrantPatternSchema.safeParse(item).success)) {
+        usageError("--commands must be a unique comma-separated list of command names, * or namespace.* patterns, or none");
       }
       return { method: "room.command.role.set", params: { room_id: roomId, role, commands } };
     }
@@ -5655,8 +5661,8 @@ async function roomRequest(command, args) {
         3,
         `room ${command}`
       );
-      if (!RuntimeCommandNameSchema.safeParse(runtimeCommand).success) {
-        usageError("runtime command must be a supported built-in command name");
+      if (!RuntimeCommandGrantPatternSchema.safeParse(runtimeCommand).success) {
+        usageError("runtime command must be a supported command name, * or namespace.* pattern");
       }
       return {
         method: command === "command-grant" ? "room.command.grant" : "room.command.revoke",

package/dist/daemon.js

@@ -11625,6 +11625,9 @@ var init_ours_runtime = __esm({
 });
 
 // src/command-names.ts
+function commandGrantMatches(pattern, command) {
+  return pattern === command || pattern === "*" || pattern.endsWith(".*") && command.startsWith(pattern.slice(0, -1)) && command.length > pattern.length - 1;
+}
 var SHARED_ROOM_COMMANDS, RUNTIME_COMMAND_NAMES;
 var init_command_names = __esm({
   "src/command-names.ts"() {
@@ -12050,7 +12053,7 @@ function refineMessageThread(message, context) {
     });
   }
 }
-var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, ContainerIdSchema2, RuntimeCommandNameSchema, RuntimeCommandGrantSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, MAX_ROOM_IDENTITY_TITLE_CHARACTERS, SDK_IDENTITY_NAME_FORBIDDEN, SDK_IDENTITY_NAME_RESERVED, CoworkIdentityNameError, RoleSchema, ROOM_ROLE, RuntimeRoleCommandGrantSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, AcceptExternalInviteInputSchema, ListMembersCommandInputSchema, CommandIdempotencyKeySchema, RemoveMemberCommandInputSchema, RuntimeCommandGrantInputSchema, RuntimeRoleCommandGrantInputSchema, RuntimeCommandAuditSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, IntakeRejectionShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, IntakeRejectionRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, ContainerIdSchema2, RuntimeCommandNameSchema, RuntimeCommandNamespacePatternSchema, RuntimeCommandGrantPatternSchema, RuntimeCommandGrantSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, MAX_ROOM_IDENTITY_TITLE_CHARACTERS, SDK_IDENTITY_NAME_FORBIDDEN, SDK_IDENTITY_NAME_RESERVED, CoworkIdentityNameError, RoleSchema, ROOM_ROLE, RuntimeRoleCommandGrantSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, AcceptExternalInviteInputSchema, ListMembersCommandInputSchema, CommandIdempotencyKeySchema, RemoveMemberCommandInputSchema, RuntimeCommandGrantInputSchema, RuntimeRoleCommandGrantInputSchema, RuntimeCommandAuditSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, IntakeRejectionShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, IntakeRejectionRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
 var init_contracts = __esm({
   "src/contracts.ts"() {
     "use strict";
@@ -12076,9 +12079,15 @@ var init_contracts = __esm({
     );
     ContainerIdSchema2 = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
     RuntimeCommandNameSchema = external_exports.union([external_exports.enum(RUNTIME_COMMAND_NAMES), ConsumerCommandNameSchema]);
+    RuntimeCommandNamespacePatternSchema = external_exports.string().max(128).regex(/^(?:[a-z0-9][a-z0-9-]*\.)+\*$/);
+    RuntimeCommandGrantPatternSchema = external_exports.union([
+      RuntimeCommandNameSchema,
+      external_exports.literal("*"),
+      RuntimeCommandNamespacePatternSchema
+    ]);
     RuntimeCommandGrantSchema = external_exports.object({
       caller_cid: ContainerIdSchema2,
-      command: RuntimeCommandNameSchema
+      command: RuntimeCommandGrantPatternSchema
     }).strict();
     Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
     RoomNameSchema = external_exports.string().refine(
@@ -12108,7 +12117,7 @@ var init_contracts = __esm({
     ROOM_ROLE = "room";
     RuntimeRoleCommandGrantSchema = external_exports.object({
       role: RoleSchema,
-      commands: external_exports.array(RuntimeCommandNameSchema).superRefine((commands, context) => {
+      commands: external_exports.array(RuntimeCommandGrantPatternSchema).superRefine((commands, context) => {
         const seen = /* @__PURE__ */ new Set();
         for (const [index, command] of commands.entries()) {
           if (seen.has(command)) {
@@ -12973,7 +12982,7 @@ function apiDocsAsset(pathname) {
       return void 0;
   }
 }
-var RPC_PATH, OPENAPI_DOCUMENT_PATH, API_DOCS_PATH, API_DOCS_SCRIPT_PATH, API_DOCS_STYLESHEET_PATH, API_VERSION, EXAMPLE_ROOM_ID, roomIdProperty, roleProperty, restRoleProperty, missionTextProperty, roomNameProperty, inviteModeProperty, notifyProperty, PRIVATE_ROOM_RPC_METHODS, ROOM_RPC_METHODS, RPC_ERROR_CODES, DOCS_PAGE, DOCS_STYLESHEET, DOCS_SCRIPT;
+var RPC_PATH, OPENAPI_DOCUMENT_PATH, API_DOCS_PATH, API_DOCS_SCRIPT_PATH, API_DOCS_STYLESHEET_PATH, API_VERSION, commandGrantPatternProperty, EXAMPLE_ROOM_ID, roomIdProperty, roleProperty, restRoleProperty, missionTextProperty, roomNameProperty, inviteModeProperty, notifyProperty, PRIVATE_ROOM_RPC_METHODS, ROOM_RPC_METHODS, RPC_ERROR_CODES, DOCS_PAGE, DOCS_STYLESHEET, DOCS_SCRIPT;
 var init_openapi = __esm({
   "src/openapi.ts"() {
     "use strict";
@@ -12984,6 +12993,15 @@ var init_openapi = __esm({
     API_DOCS_SCRIPT_PATH = "/docs/ui.js";
     API_DOCS_STYLESHEET_PATH = "/docs/ui.css";
     API_VERSION = "1";
+    commandGrantPatternProperty = {
+      anyOf: [
+        { type: "string", enum: [...RUNTIME_COMMAND_NAMES] },
+        { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" },
+        { type: "string", enum: ["*"] },
+        { type: "string", maxLength: 128, pattern: "^(?:[a-z0-9][a-z0-9-]*\\.)+\\*$" }
+      ],
+      description: "Exact command, * for all runtime commands, or terminal namespace.*. Patterns also cover future matching commands."
+    };
     EXAMPLE_ROOM_ID = "01jd7q4h9m2v8xk3znbc5regty";
     roomIdProperty = {
       type: "string",
@@ -13048,7 +13066,7 @@ var init_openapi = __esm({
       {
         method: "room.command.definition.put",
         summary: "Register or replace a consumer command",
-        description: "Registers a consumer.* command for the ours catalog using an exact host-configured handler reference. Replacement clears grants for that name. Local definitions cannot be replaced here. A published:false result means desired state is committed; use reload to retry publication.",
+        description: "Registers a consumer.* command for the ours catalog using an exact host-configured handler reference. Replacement clears exact grants for that name; wildcard grants remain effective. Local definitions cannot be replaced here. A published:false result means desired state is committed; use reload to retry publication.",
         params: params({ room_id: roomIdProperty, expected_revision: { type: "integer", minimum: 0 }, definition: {
           type: "object",
           additionalProperties: false,
@@ -13061,7 +13079,7 @@ var init_openapi = __esm({
       {
         method: "room.command.definition.delete",
         summary: "Delete a REST consumer command",
-        description: "Deletes the desired definition and its CID/role grants. Requires the current registry revision. Local commands must be removed from their file and reloaded.",
+        description: "Deletes the desired definition and its exact CID/role grants; wildcard grants remain stored. Requires the current registry revision. Local commands must be removed from their file and reloaded.",
         params: params({ room_id: roomIdProperty, expected_revision: { type: "integer", minimum: 0 }, name: { type: "string" } }, ["room_id", "expected_revision", "name"]),
         result: "Updated revision, published and definitions.",
         example: { room_id: EXAMPLE_ROOM_ID, expected_revision: 1, name: "consumer.orders" }
@@ -13231,7 +13249,7 @@ var init_openapi = __esm({
       {
         method: "room.command.grants",
         summary: "List runtime-command grants",
-        description: "Lists the default-deny grants that bind one active participant CID to one room runtime command.",
+        description: "Lists the default-deny grants that bind one active participant CID to one room runtime command name or stored wildcard pattern.",
         params: params({ room_id: roomIdProperty }, ["room_id"]),
         result: "An array of `{caller_cid, command}` grants.",
         example: { room_id: EXAMPLE_ROOM_ID }
@@ -13247,13 +13265,11 @@ var init_openapi = __esm({
       {
         method: "room.command.role.set",
         summary: "Set a role runtime-command policy",
-        description: "Atomically replaces the command policy for one exact role. An empty command list removes the policy without removing independent per-CID grants.",
+        description: "Atomically replaces the command policy for one exact role. An empty command list removes the policy without removing independent per-CID grants. Accepts exact names, * and namespace.* patterns.",
         params: params({
           room_id: roomIdProperty,
           role: { type: "string", minLength: 1, description: "Exact admitted seat role." },
-          commands: { type: "array", uniqueItems: true, items: {
-            anyOf: [{ type: "string", enum: [...RUNTIME_COMMAND_NAMES] }, { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" }]
-          } }
+          commands: { type: "array", uniqueItems: true, items: commandGrantPatternProperty }
         }, ["room_id", "role", "commands"]),
         result: "The complete sorted role-policy list after the idempotent update.",
         example: { room_id: EXAMPLE_ROOM_ID, role: "Owner", commands: ["list-members", "remove-member"] }
@@ -13261,11 +13277,11 @@ var init_openapi = __esm({
       {
         method: "room.command.grant",
         summary: "Authorize a runtime command caller",
-        description: "Idempotently grants one command to one exact active participant CID. Display names and roles are never authority.",
+        description: "Idempotently grants one command name or dynamic pattern to one exact active participant CID. Display names and caller-supplied roles are never authority. * and room.* include permission administration and room lifecycle commands; * also covers future or replaced consumer commands.",
         params: params({
           room_id: roomIdProperty,
           caller_cid: { type: "string", pattern: "^[0-9A-Fa-f]{64}$", description: "Authenticated caller CID." },
-          command: { anyOf: [{ type: "string", enum: [...RUNTIME_COMMAND_NAMES] }, { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" }] }
+          command: commandGrantPatternProperty
         }, ["room_id", "caller_cid", "command"]),
         result: "The complete sorted grant list after the idempotent update.",
         example: { room_id: EXAMPLE_ROOM_ID, caller_cid: "A".repeat(64), command: "list-members" }
@@ -13273,11 +13289,11 @@ var init_openapi = __esm({
       {
         method: "room.command.revoke",
         summary: "Revoke a runtime command caller",
-        description: "Idempotently removes one exact CID/command grant. Revocation is persisted before subsequent command dispatch can acquire the room mutex.",
+        description: "Idempotently removes only the exact stored CID/name or CID/pattern entry; overlapping grants remain effective. Revocation is persisted before subsequent command dispatch can acquire the room mutex.",
         params: params({
           room_id: roomIdProperty,
           caller_cid: { type: "string", pattern: "^[0-9A-Fa-f]{64}$", description: "Authenticated caller CID." },
-          command: { anyOf: [{ type: "string", enum: [...RUNTIME_COMMAND_NAMES] }, { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" }] }
+          command: commandGrantPatternProperty
         }, ["room_id", "caller_cid", "command"]),
         result: "The complete sorted grant list after the idempotent update.",
         example: { room_id: EXAMPLE_ROOM_ID, caller_cid: "A".repeat(64), command: "remove-member" }
@@ -15375,12 +15391,12 @@ var init_command_routes = __esm({
     RuntimeCommandGrantParams = external_exports.object({
       room_id: external_exports.string(),
       caller_cid: ContainerIdSchema2,
-      command: RuntimeCommandNameSchema
+      command: RuntimeCommandGrantPatternSchema
     }).strict();
     RuntimeRoleCommandGrantParams = external_exports.object({
       room_id: external_exports.string(),
       role: external_exports.string(),
-      commands: external_exports.array(RuntimeCommandNameSchema)
+      commands: external_exports.array(RuntimeCommandGrantPatternSchema)
     }).strict();
     ParticipantRemoveParams = external_exports.object({
       room_id: external_exports.string(),
@@ -16265,9 +16281,9 @@ var init_service = __esm({
         return seat;
       }
       hasRuntimeCommandGrant(room, callerCid, command) {
-        if (room.command_grants.some((grant) => grant.caller_cid === callerCid && grant.command === command)) return true;
+        if (room.command_grants.some((grant) => grant.caller_cid === callerCid && commandGrantMatches(grant.command, command))) return true;
         const caller = room.seats.find((seat) => seat.state === "active" && seat.identity === callerCid);
-        return caller !== void 0 && room.role_command_grants.some((grant) => grant.role === caller.role && grant.commands.includes(command));
+        return caller !== void 0 && room.role_command_grants.some((grant) => grant.role === caller.role && grant.commands.some((pattern) => commandGrantMatches(pattern, command)));
       }
       async beginRemovalUnlocked(room, seat, notify) {
         if (seat.state === "pending" || isCancelledExternalSeat(seat)) {
@@ -16575,7 +16591,7 @@ var init_service = __esm({
       }
       /** List the operator-managed runtime-command grants for one room. */
       assertRegisteredConsumerName(room, name) {
-        if (name.startsWith("consumer.") && !(room.consumer_commands ?? []).some((definition) => definition.name === name)) {
+        if (name.startsWith("consumer.") && !name.endsWith(".*") && !(room.consumer_commands ?? []).some((definition) => definition.name === name)) {
           throw new RoomServiceError("consumer command is not registered");
         }
       }
@@ -16719,7 +16735,7 @@ var init_service = __esm({
           return saved.role_command_grants.map((grant) => ({ role: grant.role, commands: [...grant.commands] }));
         });
       }
-      /** Grant one exact command to one active authenticated room identity. Idempotent. */
+      /** Grant one command selector to one active authenticated room identity. Idempotent. */
       async grantRuntimeCommand(roomId, input) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const request = RuntimeCommandGrantInputSchema.parse(input);
@@ -16738,7 +16754,7 @@ var init_service = __esm({
           return saved.command_grants.map((grant) => ({ ...grant }));
         });
       }
-      /** Revoke one exact command grant. Absence is already the requested state. */
+      /** Remove only the exact stored selector; overlapping grants remain effective. */
       async revokeRuntimeCommand(roomId, input) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const request = RuntimeCommandGrantInputSchema.parse(input);

package/docs/05-room-workflow.md

@@ -14,9 +14,51 @@ Update the display name with `ours-cowork room settings <room-id> --name "New na
 
 Runtime commands are default-deny. Per-CID grants use `command-grant` and `command-revoke`. An operator may instead register a durable role policy with `role-command-set <room-id> --role <label> --commands <comma-list>` and inspect it with `role-command-grants`; use `--commands none` to remove it. A role policy authorizes only an authenticated, active seat whose durable admission role exactly matches the policy. Display names, message labels, pending seats, removed seats, and caller-supplied role text never confer authority. Removing a role policy does not remove an independently configured per-CID grant.
 
+### Wildcard command grants
+
+CID grants and role policies accept exact command names, `*`, and a terminal
+`namespace.*` pattern. Quote patterns in the shell:
+
+```sh
+ours-cowork room command-grant <room-id> <caller-cid> '*'
+ours-cowork room command-grant <room-id> <caller-cid> 'room.*'
+ours-cowork room role-command-set <room-id> --role Reviewer --commands 'room.briefing.*,consumer.orders.*'
+ours-cowork room command-revoke <room-id> <caller-cid> 'room.*'
+```
+
+Use the same strings in the `command` field of `room.command.grant` / `revoke`
+and the `commands` array of `room.command.role.set` over RPC or ours transport.
+Invocation still requires a concrete command name; patterns are permissions only.
+
+`*` covers all room runtime commands, including `start_thread`, `list-members`,
+`remove-member`, shared `room.*` commands and registered `consumer.*` commands.
+`room.*` covers only names beginning with `room.`; it excludes those dedicated
+commands and consumer commands. `room.command.*` includes deeper descendants.
+Namespace segments use lowercase ASCII letters, digits and hyphens, start with a
+letter or digit, and are separated by dots; a namespace pattern is at most 128
+characters. Empty segments, internal stars, `room*`, `*.show`, regex, whitespace
+and case folding are unsupported. A valid namespace need not exist yet.
+
+Patterns are stored and listed verbatim, and match future commands dynamically.
+Consumer replacement/deletion still clears exact grants for the changed name,
+but retains wildcard grants: once a matching consumer is registered and published
+again, the wildcard authorizes it. Registration and publication checks still apply.
+
+`*` and `room.*` include permission administration and room close/delete commands,
+so their holders can delegate privileges. Granting them requires the same management
+access or existing permission to invoke the relevant grant command. Patterns never
+bypass authenticated CID, active membership, room scope, lifecycle checks, or
+participant result visibility; they do not authorize host/global management APIs.
+
+Granting an identical CID/pattern is idempotent. Revocation removes only the exact
+stored entry, not all matching names: revoking `room.show` does not override a retained
+`room.*`, and revoking `room.*` leaves independent exact or role grants in effect.
+Patterns survive restart, and per-CID grants are removed with participant removal
+just like exact grants. Empty role command lists remove the role policy.
+
 ## Scoped reply threads
 
-The dedicated `start_thread` runtime command creates a scoped reply thread after an operator grants that exact command name. Discover and invoke it through the SDK's generic command APIs, then use the SDK's native reply field:
+The dedicated `start_thread` runtime command creates a scoped reply thread after an operator grants `start_thread` or `*`. Discover and invoke it through the SDK's generic command APIs, then use the SDK's native reply field:
 
 ```ts
 const definitions = await client.listContactCommands({ contact: roomCid });
@@ -66,7 +108,7 @@ Every web action has an equivalent CLI fallback in the room commands above and i
 
 Room-scoped operations also appear in the room identity's ours catalog with their RPC names: `room.settings`, `room.briefing.role.set`, `room.briefing.role.delete`, `room.invite`, `room.participant.remove`, `room.revoke`, `room.recover`, `room.recover.confirm`, `room.show`, `room.participants`, `room.command.grants`, `room.command.role.grants`, `room.command.role.set`, `room.command.grant`, `room.command.revoke`, `room.history`, `room.message`, `room.say`, `room.role.rest.add`, `room.role.rest.remove`, `room.accept`, `room.rebind`, `room.close`, and `room.delete`.
 
-Use the RPC arguments without `room_id`; the receiving room fixes the target. For example, an operator grants `ours-cowork room command-grant <room-id> <caller-cid> room.settings`, then that active member calls `room.settings` with `{"status":"review"}` using ours command transport. A grant for one name grants none of the other names. The SDK returns a correlated result containing `{ok:true,result:<service value>}` or `{ok:false,error:<code>}`. History returns one page; follow `seq` with `after` to fetch more.
+Use the RPC arguments without `room_id`; the receiving room fixes the target. For example, an operator grants `ours-cowork room command-grant <room-id> <caller-cid> room.settings`, then that active member calls `room.settings` with `{"status":"review"}` using ours command transport. An exact-name grant grants none of the other names. The SDK returns a correlated result containing `{ok:true,result:<service value>}` or `{ok:false,error:<code>}`. History returns one page; follow `seq` with `after` to fetch more.
 
 `start_thread`, `list-members`, and `remove-member` are dedicated runtime commands rather than shared management routes. `list-members` retains its contact-safe roster. `remove-member` retains its epoch, confirm and no-self-removal gates. The separate `room.participant.remove` command instead grants the full operator removal behavior. `room.show` returns only public room settings and mission content; `room.participants` returns participant IDs, roles, and states. Runtime `room.history` returns only messages visible to the authenticated active seat, with viewer-local cursors, and rejects operator view. Runtime `room.message` and `room.say` return only an accepted message-ID receipt. Host management routes retain their full operator results. Policy-administration commands can delegate more privileges; `room.message` and `room.say` authorize room/role authorship. Assign these permissions deliberately. Command results may include invite material; do not relay them into chat.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/cowork",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Durable ours mission rooms on the shared ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",