@ours.network/cowork 1.2.0 → 1.3.1

package/dist/cli.js

@@ -4455,9 +4455,15 @@ var LowerCrockfordUlidSchema = external_exports.string().regex(
 );
 var ContainerIdSchema2 = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
 var RuntimeCommandNameSchema = external_exports.union([external_exports.enum(RUNTIME_COMMAND_NAMES), ConsumerCommandNameSchema]);
+var RuntimeCommandNamespacePatternSchema = external_exports.string().max(128).regex(/^(?:[a-z0-9][a-z0-9-]*\.)+\*$/);
+var RuntimeCommandGrantPatternSchema = external_exports.union([
+  RuntimeCommandNameSchema,
+  external_exports.literal("*"),
+  RuntimeCommandNamespacePatternSchema
+]);
 var RuntimeCommandGrantSchema = external_exports.object({
   caller_cid: ContainerIdSchema2,
-  command: RuntimeCommandNameSchema
+  command: RuntimeCommandGrantPatternSchema
 }).strict();
 function isStrictRfc3339(value) {
   const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
@@ -4506,7 +4512,7 @@ var RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
 var ROOM_ROLE = "room";
 var RuntimeRoleCommandGrantSchema = external_exports.object({
   role: RoleSchema,
-  commands: external_exports.array(RuntimeCommandNameSchema).superRefine((commands, context) => {
+  commands: external_exports.array(RuntimeCommandGrantPatternSchema).superRefine((commands, context) => {
     const seen = /* @__PURE__ */ new Set();
     for (const [index, command] of commands.entries()) {
       if (seen.has(command)) {
@@ -4556,6 +4562,7 @@ var SeatSchema = external_exports.object({
   participant_id: LowerCrockfordUlidSchema,
   state: SeatStateSchema,
   alias: NonEmptyStringSchema.optional(),
+  removal_reason: external_exports.literal("contact_absent").optional(),
   removed_at: Rfc3339Schema.optional(),
   removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
   // Read and discard prerelease successor lineage. New rooms expose only
@@ -4569,7 +4576,7 @@ var SeatSchema = external_exports.object({
         context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `pending seats require ${field}` });
       }
     }
-    for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at"]) {
+    for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at", "removal_reason"]) {
       if (seat[field] !== void 0) {
         context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `${field} is forbidden on pending seats` });
       }
@@ -4600,7 +4607,7 @@ var SeatSchema = external_exports.object({
     if (seat.accepted_at === void 0) {
       context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["accepted_at"], message: "active seats require accepted_at" });
     }
-    for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+    for (const field of ["removed_at", "removed_epoch", "bounced_at", "removal_reason"]) {
       if (seat[field] !== void 0) {
         context.addIssue({
           code: external_exports.ZodIssueCode.custom,
@@ -5643,8 +5650,8 @@ async function roomRequest(command, args) {
       const role = requiredFlag(parsed, "--role", "room role-command-set");
       const value = requiredFlag(parsed, "--commands", "room role-command-set");
       const commands = value === "none" ? [] : value.split(",");
-      if (new Set(commands).size !== commands.length || commands.some((item) => !RuntimeCommandNameSchema.safeParse(item).success)) {
-        usageError("--commands must be a unique comma-separated list of built-in command names or none");
+      if (new Set(commands).size !== commands.length || commands.some((item) => !RuntimeCommandGrantPatternSchema.safeParse(item).success)) {
+        usageError("--commands must be a unique comma-separated list of command names, * or namespace.* patterns, or none");
       }
       return { method: "room.command.role.set", params: { room_id: roomId, role, commands } };
     }
@@ -5655,8 +5662,8 @@ async function roomRequest(command, args) {
         3,
         `room ${command}`
       );
-      if (!RuntimeCommandNameSchema.safeParse(runtimeCommand).success) {
-        usageError("runtime command must be a supported built-in command name");
+      if (!RuntimeCommandGrantPatternSchema.safeParse(runtimeCommand).success) {
+        usageError("runtime command must be a supported command name, * or namespace.* pattern");
       }
       return {
         method: command === "command-grant" ? "room.command.grant" : "room.command.revoke",

package/dist/daemon.js

@@ -11594,7 +11594,7 @@ var init_ours_runtime = __esm({
             }
             for (let settled = await step; !settled.done; settled = await step) {
               backoffMs = WATCH_RETRY_MIN_MS;
-              this.announce(identityName);
+              this.announce(identityName, settled.value);
               step = stream.next();
             }
             if (!signal.aborted) {
@@ -11611,10 +11611,10 @@ var init_ours_runtime = __esm({
           backoffMs = Math.min(backoffMs * 2, WATCH_RETRY_MAX_MS);
         }
       }
-      announce(identityName) {
+      announce(identityName, event) {
         for (const listener of this.listeners) {
           try {
-            listener(identityName);
+            listener(identityName, event);
           } catch (error) {
             this.log(`cowork SDK notification listener failed for ${identityName}:`, error);
           }
@@ -11625,6 +11625,9 @@ var init_ours_runtime = __esm({
 });
 
 // src/command-names.ts
+function commandGrantMatches(pattern, command) {
+  return pattern === command || pattern === "*" || pattern.endsWith(".*") && command.startsWith(pattern.slice(0, -1)) && command.length > pattern.length - 1;
+}
 var SHARED_ROOM_COMMANDS, RUNTIME_COMMAND_NAMES;
 var init_command_names = __esm({
   "src/command-names.ts"() {
@@ -12050,7 +12053,7 @@ function refineMessageThread(message, context) {
     });
   }
 }
-var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, ContainerIdSchema2, RuntimeCommandNameSchema, RuntimeCommandGrantSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, MAX_ROOM_IDENTITY_TITLE_CHARACTERS, SDK_IDENTITY_NAME_FORBIDDEN, SDK_IDENTITY_NAME_RESERVED, CoworkIdentityNameError, RoleSchema, ROOM_ROLE, RuntimeRoleCommandGrantSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, AcceptExternalInviteInputSchema, ListMembersCommandInputSchema, CommandIdempotencyKeySchema, RemoveMemberCommandInputSchema, RuntimeCommandGrantInputSchema, RuntimeRoleCommandGrantInputSchema, RuntimeCommandAuditSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, IntakeRejectionShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, IntakeRejectionRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, ContainerIdSchema2, RuntimeCommandNameSchema, RuntimeCommandNamespacePatternSchema, RuntimeCommandGrantPatternSchema, RuntimeCommandGrantSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, MAX_ROOM_IDENTITY_TITLE_CHARACTERS, SDK_IDENTITY_NAME_FORBIDDEN, SDK_IDENTITY_NAME_RESERVED, CoworkIdentityNameError, RoleSchema, ROOM_ROLE, RuntimeRoleCommandGrantSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, AcceptExternalInviteInputSchema, ListMembersCommandInputSchema, CommandIdempotencyKeySchema, RemoveMemberCommandInputSchema, RuntimeCommandGrantInputSchema, RuntimeRoleCommandGrantInputSchema, RuntimeCommandAuditSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, IntakeRejectionShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, IntakeRejectionRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
 var init_contracts = __esm({
   "src/contracts.ts"() {
     "use strict";
@@ -12076,9 +12079,15 @@ var init_contracts = __esm({
     );
     ContainerIdSchema2 = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
     RuntimeCommandNameSchema = external_exports.union([external_exports.enum(RUNTIME_COMMAND_NAMES), ConsumerCommandNameSchema]);
+    RuntimeCommandNamespacePatternSchema = external_exports.string().max(128).regex(/^(?:[a-z0-9][a-z0-9-]*\.)+\*$/);
+    RuntimeCommandGrantPatternSchema = external_exports.union([
+      RuntimeCommandNameSchema,
+      external_exports.literal("*"),
+      RuntimeCommandNamespacePatternSchema
+    ]);
     RuntimeCommandGrantSchema = external_exports.object({
       caller_cid: ContainerIdSchema2,
-      command: RuntimeCommandNameSchema
+      command: RuntimeCommandGrantPatternSchema
     }).strict();
     Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
     RoomNameSchema = external_exports.string().refine(
@@ -12108,7 +12117,7 @@ var init_contracts = __esm({
     ROOM_ROLE = "room";
     RuntimeRoleCommandGrantSchema = external_exports.object({
       role: RoleSchema,
-      commands: external_exports.array(RuntimeCommandNameSchema).superRefine((commands, context) => {
+      commands: external_exports.array(RuntimeCommandGrantPatternSchema).superRefine((commands, context) => {
         const seen = /* @__PURE__ */ new Set();
         for (const [index, command] of commands.entries()) {
           if (seen.has(command)) {
@@ -12159,6 +12168,7 @@ var init_contracts = __esm({
       participant_id: LowerCrockfordUlidSchema,
       state: SeatStateSchema,
       alias: NonEmptyStringSchema.optional(),
+      removal_reason: external_exports.literal("contact_absent").optional(),
       removed_at: Rfc3339Schema.optional(),
       removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
       // Read and discard prerelease successor lineage. New rooms expose only
@@ -12172,7 +12182,7 @@ var init_contracts = __esm({
             context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `pending seats require ${field}` });
           }
         }
-        for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at"]) {
+        for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at", "removal_reason"]) {
           if (seat[field] !== void 0) {
             context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `${field} is forbidden on pending seats` });
           }
@@ -12203,7 +12213,7 @@ var init_contracts = __esm({
         if (seat.accepted_at === void 0) {
           context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["accepted_at"], message: "active seats require accepted_at" });
         }
-        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+        for (const field of ["removed_at", "removed_epoch", "bounced_at", "removal_reason"]) {
           if (seat[field] !== void 0) {
             context.addIssue({
               code: external_exports.ZodIssueCode.custom,
@@ -12973,7 +12983,7 @@ function apiDocsAsset(pathname) {
       return void 0;
   }
 }
-var RPC_PATH, OPENAPI_DOCUMENT_PATH, API_DOCS_PATH, API_DOCS_SCRIPT_PATH, API_DOCS_STYLESHEET_PATH, API_VERSION, EXAMPLE_ROOM_ID, roomIdProperty, roleProperty, restRoleProperty, missionTextProperty, roomNameProperty, inviteModeProperty, notifyProperty, PRIVATE_ROOM_RPC_METHODS, ROOM_RPC_METHODS, RPC_ERROR_CODES, DOCS_PAGE, DOCS_STYLESHEET, DOCS_SCRIPT;
+var RPC_PATH, OPENAPI_DOCUMENT_PATH, API_DOCS_PATH, API_DOCS_SCRIPT_PATH, API_DOCS_STYLESHEET_PATH, API_VERSION, commandGrantPatternProperty, EXAMPLE_ROOM_ID, roomIdProperty, roleProperty, restRoleProperty, missionTextProperty, roomNameProperty, inviteModeProperty, notifyProperty, PRIVATE_ROOM_RPC_METHODS, ROOM_RPC_METHODS, RPC_ERROR_CODES, DOCS_PAGE, DOCS_STYLESHEET, DOCS_SCRIPT;
 var init_openapi = __esm({
   "src/openapi.ts"() {
     "use strict";
@@ -12984,6 +12994,15 @@ var init_openapi = __esm({
     API_DOCS_SCRIPT_PATH = "/docs/ui.js";
     API_DOCS_STYLESHEET_PATH = "/docs/ui.css";
     API_VERSION = "1";
+    commandGrantPatternProperty = {
+      anyOf: [
+        { type: "string", enum: [...RUNTIME_COMMAND_NAMES] },
+        { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" },
+        { type: "string", enum: ["*"] },
+        { type: "string", maxLength: 128, pattern: "^(?:[a-z0-9][a-z0-9-]*\\.)+\\*$" }
+      ],
+      description: "Exact command, * for all runtime commands, or terminal namespace.*. Patterns also cover future matching commands."
+    };
     EXAMPLE_ROOM_ID = "01jd7q4h9m2v8xk3znbc5regty";
     roomIdProperty = {
       type: "string",
@@ -13048,7 +13067,7 @@ var init_openapi = __esm({
       {
         method: "room.command.definition.put",
         summary: "Register or replace a consumer command",
-        description: "Registers a consumer.* command for the ours catalog using an exact host-configured handler reference. Replacement clears grants for that name. Local definitions cannot be replaced here. A published:false result means desired state is committed; use reload to retry publication.",
+        description: "Registers a consumer.* command for the ours catalog using an exact host-configured handler reference. Replacement clears exact grants for that name; wildcard grants remain effective. Local definitions cannot be replaced here. A published:false result means desired state is committed; use reload to retry publication.",
         params: params({ room_id: roomIdProperty, expected_revision: { type: "integer", minimum: 0 }, definition: {
           type: "object",
           additionalProperties: false,
@@ -13061,7 +13080,7 @@ var init_openapi = __esm({
       {
         method: "room.command.definition.delete",
         summary: "Delete a REST consumer command",
-        description: "Deletes the desired definition and its CID/role grants. Requires the current registry revision. Local commands must be removed from their file and reloaded.",
+        description: "Deletes the desired definition and its exact CID/role grants; wildcard grants remain stored. Requires the current registry revision. Local commands must be removed from their file and reloaded.",
         params: params({ room_id: roomIdProperty, expected_revision: { type: "integer", minimum: 0 }, name: { type: "string" } }, ["room_id", "expected_revision", "name"]),
         result: "Updated revision, published and definitions.",
         example: { room_id: EXAMPLE_ROOM_ID, expected_revision: 1, name: "consumer.orders" }
@@ -13231,7 +13250,7 @@ var init_openapi = __esm({
       {
         method: "room.command.grants",
         summary: "List runtime-command grants",
-        description: "Lists the default-deny grants that bind one active participant CID to one room runtime command.",
+        description: "Lists the default-deny grants that bind one active participant CID to one room runtime command name or stored wildcard pattern.",
         params: params({ room_id: roomIdProperty }, ["room_id"]),
         result: "An array of `{caller_cid, command}` grants.",
         example: { room_id: EXAMPLE_ROOM_ID }
@@ -13247,13 +13266,11 @@ var init_openapi = __esm({
       {
         method: "room.command.role.set",
         summary: "Set a role runtime-command policy",
-        description: "Atomically replaces the command policy for one exact role. An empty command list removes the policy without removing independent per-CID grants.",
+        description: "Atomically replaces the command policy for one exact role. An empty command list removes the policy without removing independent per-CID grants. Accepts exact names, * and namespace.* patterns.",
         params: params({
           room_id: roomIdProperty,
           role: { type: "string", minLength: 1, description: "Exact admitted seat role." },
-          commands: { type: "array", uniqueItems: true, items: {
-            anyOf: [{ type: "string", enum: [...RUNTIME_COMMAND_NAMES] }, { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" }]
-          } }
+          commands: { type: "array", uniqueItems: true, items: commandGrantPatternProperty }
         }, ["room_id", "role", "commands"]),
         result: "The complete sorted role-policy list after the idempotent update.",
         example: { room_id: EXAMPLE_ROOM_ID, role: "Owner", commands: ["list-members", "remove-member"] }
@@ -13261,11 +13278,11 @@ var init_openapi = __esm({
       {
         method: "room.command.grant",
         summary: "Authorize a runtime command caller",
-        description: "Idempotently grants one command to one exact active participant CID. Display names and roles are never authority.",
+        description: "Idempotently grants one command name or dynamic pattern to one exact active participant CID. Display names and caller-supplied roles are never authority. * and room.* include permission administration and room lifecycle commands; * also covers future or replaced consumer commands.",
         params: params({
           room_id: roomIdProperty,
           caller_cid: { type: "string", pattern: "^[0-9A-Fa-f]{64}$", description: "Authenticated caller CID." },
-          command: { anyOf: [{ type: "string", enum: [...RUNTIME_COMMAND_NAMES] }, { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" }] }
+          command: commandGrantPatternProperty
         }, ["room_id", "caller_cid", "command"]),
         result: "The complete sorted grant list after the idempotent update.",
         example: { room_id: EXAMPLE_ROOM_ID, caller_cid: "A".repeat(64), command: "list-members" }
@@ -13273,11 +13290,11 @@ var init_openapi = __esm({
       {
         method: "room.command.revoke",
         summary: "Revoke a runtime command caller",
-        description: "Idempotently removes one exact CID/command grant. Revocation is persisted before subsequent command dispatch can acquire the room mutex.",
+        description: "Idempotently removes only the exact stored CID/name or CID/pattern entry; overlapping grants remain effective. Revocation is persisted before subsequent command dispatch can acquire the room mutex.",
         params: params({
           room_id: roomIdProperty,
           caller_cid: { type: "string", pattern: "^[0-9A-Fa-f]{64}$", description: "Authenticated caller CID." },
-          command: { anyOf: [{ type: "string", enum: [...RUNTIME_COMMAND_NAMES] }, { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" }] }
+          command: commandGrantPatternProperty
         }, ["room_id", "caller_cid", "command"]),
         result: "The complete sorted grant list after the idempotent update.",
         example: { room_id: EXAMPLE_ROOM_ID, caller_cid: "A".repeat(64), command: "remove-member" }
@@ -13774,12 +13791,13 @@ var init_packets = __esm({
         });
         this.rebindSleep = options.rebindSleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
         this.rebindRandom = options.rebindRandom ?? Math.random;
-        this.unsubscribe = host.onIdentityNotify((name) => {
+        this.unsubscribe = host.onIdentityNotify((name, event) => {
           const found = [...this.packets.entries()].find(([, packet2]) => packet2.name === name);
           if (!found) return;
           const [roomId, packet] = found;
+          if (event?.event === "contact_removed" && event.identity_cid !== packet.cid) return;
           void packet.refresh().then(
-            () => this.onNotify(roomId, "message_received"),
+            () => this.onNotify(roomId, event?.event === "contact_removed" ? "contact_removed" : "message_received"),
             (error) => this.log(`[${name}] failed to refresh SDK state after notification:`, error)
           );
         });
@@ -15027,6 +15045,17 @@ var init_intake = __esm({
         const room = await this.store.load(roomId);
         const activeCids = new Set(room.seats.filter((seat) => seat.state === "active").map((seat) => seat.identity));
         const removedCids = new Set(room.seats.filter((seat) => seat.state === "removed").map((seat) => seat.identity));
+        let firstDeliveryError;
+        let deliveryFailed = false;
+        const attempt = async (send) => {
+          try {
+            return await send();
+          } catch (error) {
+            if (!deliveryFailed) firstDeliveryError = error;
+            deliveryFailed = true;
+            return void 0;
+          }
+        };
         let after = 0;
         for (; ; ) {
           const pending = await queryStore(this.store, roomId, {
@@ -15035,7 +15064,10 @@ var init_intake = __esm({
             after,
             limit: JOURNAL_WORK_BATCH_SIZE
           });
-          if (pending.length === 0) return;
+          if (pending.length === 0) {
+            if (deliveryFailed) throw firstDeliveryError;
+            return;
+          }
           for (const intent of pending) {
             after = intent.seq;
             const [message] = intent.message_id === void 0 ? [] : await queryStore(this.store, roomId, { kind: "message", messageId: intent.message_id, limit: 1 });
@@ -15082,7 +15114,7 @@ var init_intake = __esm({
             const replyTo = decision.replyTo;
             if (file !== void 0) {
               const uploader = file.author_alias?.alias ?? file.author.display_name;
-              const notice = await sendRoomBody(packet, intent.recipient_identity, {
+              const notice = await attempt(() => sendRoomBody(packet, intent.recipient_identity, {
                 version: 1,
                 kind: "room_msg",
                 room_id: roomId,
@@ -15095,7 +15127,8 @@ var init_intake = __esm({
                 },
                 text: `${uploader} sent a file`,
                 at: file.at
-              }, replyTo);
+              }, replyTo));
+              if (notice === void 0) continue;
               if (notice.status === "send_failed") {
                 const failed = await this.store.append(roomId, {
                   version: 1,
@@ -15110,13 +15143,14 @@ var init_intake = __esm({
                 if (failed.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
                 continue;
               }
-              const outcome2 = await packet.sendFile(
+              const outcome2 = await attempt(() => packet.sendFile(
                 intent.recipient_identity,
                 file.filename,
                 file.mime,
                 Buffer.from(file.data_base64, "base64"),
                 replyTo
-              );
+              ));
+              if (outcome2 === void 0) continue;
               const appended2 = await this.store.append(roomId, {
                 version: 1,
                 kind: "relay_result",
@@ -15151,7 +15185,8 @@ var init_intake = __esm({
               ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
               ...message.membership === void 0 ? {} : { membership: message.membership }
             };
-            const outcome = await sendRoomBody(packet, intent.recipient_identity, unsigned, replyTo);
+            const outcome = await attempt(() => sendRoomBody(packet, intent.recipient_identity, unsigned, replyTo));
+            if (outcome === void 0) continue;
             const appended = await this.store.append(roomId, {
               version: 1,
               kind: "relay_result",
@@ -15375,12 +15410,12 @@ var init_command_routes = __esm({
     RuntimeCommandGrantParams = external_exports.object({
       room_id: external_exports.string(),
       caller_cid: ContainerIdSchema2,
-      command: RuntimeCommandNameSchema
+      command: RuntimeCommandGrantPatternSchema
     }).strict();
     RuntimeRoleCommandGrantParams = external_exports.object({
       room_id: external_exports.string(),
       role: external_exports.string(),
-      commands: external_exports.array(RuntimeCommandNameSchema)
+      commands: external_exports.array(RuntimeCommandGrantPatternSchema)
     }).strict();
     ParticipantRemoveParams = external_exports.object({
       room_id: external_exports.string(),
@@ -16265,9 +16300,9 @@ var init_service = __esm({
         return seat;
       }
       hasRuntimeCommandGrant(room, callerCid, command) {
-        if (room.command_grants.some((grant) => grant.caller_cid === callerCid && grant.command === command)) return true;
+        if (room.command_grants.some((grant) => grant.caller_cid === callerCid && commandGrantMatches(grant.command, command))) return true;
         const caller = room.seats.find((seat) => seat.state === "active" && seat.identity === callerCid);
-        return caller !== void 0 && room.role_command_grants.some((grant) => grant.role === caller.role && grant.commands.includes(command));
+        return caller !== void 0 && room.role_command_grants.some((grant) => grant.role === caller.role && grant.commands.some((pattern) => commandGrantMatches(pattern, command)));
       }
       async beginRemovalUnlocked(room, seat, notify) {
         if (seat.state === "pending" || isCancelledExternalSeat(seat)) {
@@ -16575,7 +16610,7 @@ var init_service = __esm({
       }
       /** List the operator-managed runtime-command grants for one room. */
       assertRegisteredConsumerName(room, name) {
-        if (name.startsWith("consumer.") && !(room.consumer_commands ?? []).some((definition) => definition.name === name)) {
+        if (name.startsWith("consumer.") && !name.endsWith(".*") && !(room.consumer_commands ?? []).some((definition) => definition.name === name)) {
           throw new RoomServiceError("consumer command is not registered");
         }
       }
@@ -16719,7 +16754,7 @@ var init_service = __esm({
           return saved.role_command_grants.map((grant) => ({ role: grant.role, commands: [...grant.commands] }));
         });
       }
-      /** Grant one exact command to one active authenticated room identity. Idempotent. */
+      /** Grant one command selector to one active authenticated room identity. Idempotent. */
       async grantRuntimeCommand(roomId, input) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const request = RuntimeCommandGrantInputSchema.parse(input);
@@ -16738,7 +16773,7 @@ var init_service = __esm({
           return saved.command_grants.map((grant) => ({ ...grant }));
         });
       }
-      /** Revoke one exact command grant. Absence is already the requested state. */
+      /** Remove only the exact stored selector; overlapping grants remain effective. */
       async revokeRuntimeCommand(roomId, input) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const request = RuntimeCommandGrantInputSchema.parse(input);
@@ -16976,6 +17011,7 @@ var init_service = __esm({
       }
       async reconcileUnlocked(room, packet) {
         if (room.state === "closed" || room.state === "closing") return room;
+        await packet.refreshContacts();
         const contactsByCid = /* @__PURE__ */ new Map();
         for (const contact of packet.listContacts()) {
           if (contactsByCid.has(contact.container_id)) continue;
@@ -16985,6 +17021,27 @@ var init_service = __esm({
             ...authenticatedInvite === void 0 ? {} : { inviteId: authenticatedInvite }
           });
         }
+        let epoch = room.membership_epoch;
+        const departed = /* @__PURE__ */ new Set();
+        const reconciledSeats = room.seats.map((seat) => {
+          if (seat.state !== "active" || contactsByCid.has(seat.identity)) return seat;
+          departed.add(seat.identity);
+          return {
+            ...seat,
+            state: "removed",
+            removed_at: this.now(),
+            removed_epoch: ++epoch,
+            removal_reason: "contact_absent"
+          };
+        });
+        if (departed.size > 0) {
+          room = await this.store.save(RoomSchema.parse({
+            ...room,
+            seats: reconciledSeats,
+            membership_epoch: epoch,
+            command_grants: room.command_grants.filter((grant) => !departed.has(grant.caller_cid))
+          }));
+        }
         const inviteById = new Map(room.invites.map((invite) => [invite.invite_id, invite]));
         const existingCids = new Set(room.seats.filter((seat) => seat.state === "active" || seat.state === "pending").map((seat) => seat.identity));
         const lastRemovedAt = /* @__PURE__ */ new Map();
@@ -18978,7 +19035,7 @@ import * as nodeFs5 from "node:fs";
 import { join as join7 } from "node:path";
 import { fileURLToPath } from "node:url";
 function isIntakeNotification(event) {
-  return event === "message_received" || event === "file_received" || event === "contact_accepted" || event === "contact_added";
+  return event === "message_received" || event === "file_received" || event === "contact_accepted" || event === "contact_added" || event === "contact_removed";
 }
 function createDaemonControlRoutes(control) {
   if (!/^[0-9a-f]{32}$/.test(control.session)) throw new TypeError("invalid daemon control session");

package/docs/05-room-workflow.md

@@ -14,9 +14,51 @@ Update the display name with `ours-cowork room settings <room-id> --name "New na
 
 Runtime commands are default-deny. Per-CID grants use `command-grant` and `command-revoke`. An operator may instead register a durable role policy with `role-command-set <room-id> --role <label> --commands <comma-list>` and inspect it with `role-command-grants`; use `--commands none` to remove it. A role policy authorizes only an authenticated, active seat whose durable admission role exactly matches the policy. Display names, message labels, pending seats, removed seats, and caller-supplied role text never confer authority. Removing a role policy does not remove an independently configured per-CID grant.
 
+### Wildcard command grants
+
+CID grants and role policies accept exact command names, `*`, and a terminal
+`namespace.*` pattern. Quote patterns in the shell:
+
+```sh
+ours-cowork room command-grant <room-id> <caller-cid> '*'
+ours-cowork room command-grant <room-id> <caller-cid> 'room.*'
+ours-cowork room role-command-set <room-id> --role Reviewer --commands 'room.briefing.*,consumer.orders.*'
+ours-cowork room command-revoke <room-id> <caller-cid> 'room.*'
+```
+
+Use the same strings in the `command` field of `room.command.grant` / `revoke`
+and the `commands` array of `room.command.role.set` over RPC or ours transport.
+Invocation still requires a concrete command name; patterns are permissions only.
+
+`*` covers all room runtime commands, including `start_thread`, `list-members`,
+`remove-member`, shared `room.*` commands and registered `consumer.*` commands.
+`room.*` covers only names beginning with `room.`; it excludes those dedicated
+commands and consumer commands. `room.command.*` includes deeper descendants.
+Namespace segments use lowercase ASCII letters, digits and hyphens, start with a
+letter or digit, and are separated by dots; a namespace pattern is at most 128
+characters. Empty segments, internal stars, `room*`, `*.show`, regex, whitespace
+and case folding are unsupported. A valid namespace need not exist yet.
+
+Patterns are stored and listed verbatim, and match future commands dynamically.
+Consumer replacement/deletion still clears exact grants for the changed name,
+but retains wildcard grants: once a matching consumer is registered and published
+again, the wildcard authorizes it. Registration and publication checks still apply.
+
+`*` and `room.*` include permission administration and room close/delete commands,
+so their holders can delegate privileges. Granting them requires the same management
+access or existing permission to invoke the relevant grant command. Patterns never
+bypass authenticated CID, active membership, room scope, lifecycle checks, or
+participant result visibility; they do not authorize host/global management APIs.
+
+Granting an identical CID/pattern is idempotent. Revocation removes only the exact
+stored entry, not all matching names: revoking `room.show` does not override a retained
+`room.*`, and revoking `room.*` leaves independent exact or role grants in effect.
+Patterns survive restart, and per-CID grants are removed with participant removal
+just like exact grants. Empty role command lists remove the role policy.
+
 ## Scoped reply threads
 
-The dedicated `start_thread` runtime command creates a scoped reply thread after an operator grants that exact command name. Discover and invoke it through the SDK's generic command APIs, then use the SDK's native reply field:
+The dedicated `start_thread` runtime command creates a scoped reply thread after an operator grants `start_thread` or `*`. Discover and invoke it through the SDK's generic command APIs, then use the SDK's native reply field:
 
 ```ts
 const definitions = await client.listContactCommands({ contact: roomCid });
@@ -66,10 +108,24 @@ Every web action has an equivalent CLI fallback in the room commands above and i
 
 Room-scoped operations also appear in the room identity's ours catalog with their RPC names: `room.settings`, `room.briefing.role.set`, `room.briefing.role.delete`, `room.invite`, `room.participant.remove`, `room.revoke`, `room.recover`, `room.recover.confirm`, `room.show`, `room.participants`, `room.command.grants`, `room.command.role.grants`, `room.command.role.set`, `room.command.grant`, `room.command.revoke`, `room.history`, `room.message`, `room.say`, `room.role.rest.add`, `room.role.rest.remove`, `room.accept`, `room.rebind`, `room.close`, and `room.delete`.
 
-Use the RPC arguments without `room_id`; the receiving room fixes the target. For example, an operator grants `ours-cowork room command-grant <room-id> <caller-cid> room.settings`, then that active member calls `room.settings` with `{"status":"review"}` using ours command transport. A grant for one name grants none of the other names. The SDK returns a correlated result containing `{ok:true,result:<service value>}` or `{ok:false,error:<code>}`. History returns one page; follow `seq` with `after` to fetch more.
+Use the RPC arguments without `room_id`; the receiving room fixes the target. For example, an operator grants `ours-cowork room command-grant <room-id> <caller-cid> room.settings`, then that active member calls `room.settings` with `{"status":"review"}` using ours command transport. An exact-name grant grants none of the other names. The SDK returns a correlated result containing `{ok:true,result:<service value>}` or `{ok:false,error:<code>}`. History returns one page; follow `seq` with `after` to fetch more.
 
 `start_thread`, `list-members`, and `remove-member` are dedicated runtime commands rather than shared management routes. `list-members` retains its contact-safe roster. `remove-member` retains its epoch, confirm and no-self-removal gates. The separate `room.participant.remove` command instead grants the full operator removal behavior. `room.show` returns only public room settings and mission content; `room.participants` returns participant IDs, roles, and states. Runtime `room.history` returns only messages visible to the authenticated active seat, with viewer-local cursors, and rejects operator view. Runtime `room.message` and `room.say` return only an accepted message-ID receipt. Host management routes retain their full operator results. Policy-administration commands can delegate more privileges; `room.message` and `room.say` authorize room/role authorship. Assign these permissions deliberately. Command results may include invite material; do not relay them into chat.
 
 Host lifecycle and global room creation/listing are excluded. `room.accept` accepts invitation input through its separate grant and remains unavailable through REST. Ours close/delete return a durable accepted receipt before closing the reply channel; verify completion through management. Close retains archive/files; delete requires `confirm:true`, closes first, and erases local room data. Pending lifecycle requests resume after restart; failed requests remain visible in room metadata for explicit management retry. Missing replies do not prove a mutation failed.
 
 The SDK owns command reply delivery and its size limits. Large history pages or a single large file record may exceed that transport's capacity; use CLI/REST for those results. No additional result-omission contract is introduced.
+
+## Contact deletion and room membership
+
+Cowork subscribes to SDK notifications for each hosted room identity. A typed `contact_removed` with a different local identity CID is ignored, even when the identity name matches. The room packet refreshes state and forwards the wake. Under the room mutex, reconciliation refreshes contacts again and removes only active seats whose exact peer CID is absent. The same path runs on startup, watch reconnection and the existing periodic resync, covering missed notifications and a crash between core deletion and room persistence.
+
+A departed seat stays in durable room metadata with its participant ID, CID, role, accepted_at, invite provenance, removed_at, removed_epoch and `removal_reason: 'contact_absent'`. Each transition increments membership_epoch once and revokes that CID's explicit command grants. Accepted invite history remains accepted: a departure is not an invitation/admission failure. Pending asynchronous admissions without contacts stay pending. Removal reason deliberately does not claim peer intent: contact absence can also follow local removal or crash recovery. This persisted lifecycle record remains available even in quiet rooms and when nobody remains to receive a membership message.
+
+Duplicate wakes and restarts do not change an already-removed seat's epoch or timestamp. An old event with a currently present/re-added contact cannot remove it. No attempt is made to infer an unobserved remove-and-readd cycle from a surviving contact snapshot. Each room identity reconciles its own contact book; deleting a contact in one room does not authorize removal in another where that contact still exists.
+
+Future broadcasts use active membership; pending relays already addressed to departed participants use the existing `skipped_removed` outcome. If a contact disappears during delivery, independent recipients are still attempted (text, file metadata and file bytes, including later journal batches). A thrown send remains result-less and is retried under existing recovery semantics; the first error is reported after other recipients have been attempted. Storage errors stop immediately. No durable append receipt or relay outcome schema was changed. This boundary was coordinated with backlog task `0mtzfmkqra63687cd`, which remains owner of durable receipts and per-recipient outcome design.
+
+### Rollout
+
+No core protocol or room-version migration is required. Existing version-2 rooms load with optional `removal_reason` absent; reconciliation fills it only on newly observed contact departures. Older Cowork versions strip this optional field on parse/save and do not perform automatic reconciliation; retain the upgraded version to preserve reason metadata. Admission and removal fields use the existing room lifecycle schema. An older SDK daemon supplies a legacy/sync wake; authoritative periodic reconciliation still works. The enriched typed event requires the accompanying SDK daemon change. No dependency bump to an unpublished package is made by this patch; release the SDK enhancement before or alongside Cowork.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/cowork",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Durable ours mission rooms on the shared ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",