@ours.network/cowork 1.3.0 → 1.3.1

package/dist/cli.js

@@ -4562,6 +4562,7 @@ var SeatSchema = external_exports.object({
   participant_id: LowerCrockfordUlidSchema,
   state: SeatStateSchema,
   alias: NonEmptyStringSchema.optional(),
+  removal_reason: external_exports.literal("contact_absent").optional(),
   removed_at: Rfc3339Schema.optional(),
   removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
   // Read and discard prerelease successor lineage. New rooms expose only
@@ -4575,7 +4576,7 @@ var SeatSchema = external_exports.object({
         context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `pending seats require ${field}` });
       }
     }
-    for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at"]) {
+    for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at", "removal_reason"]) {
       if (seat[field] !== void 0) {
         context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `${field} is forbidden on pending seats` });
       }
@@ -4606,7 +4607,7 @@ var SeatSchema = external_exports.object({
     if (seat.accepted_at === void 0) {
       context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["accepted_at"], message: "active seats require accepted_at" });
     }
-    for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+    for (const field of ["removed_at", "removed_epoch", "bounced_at", "removal_reason"]) {
       if (seat[field] !== void 0) {
         context.addIssue({
           code: external_exports.ZodIssueCode.custom,

package/dist/daemon.js

@@ -11594,7 +11594,7 @@ var init_ours_runtime = __esm({
             }
             for (let settled = await step; !settled.done; settled = await step) {
               backoffMs = WATCH_RETRY_MIN_MS;
-              this.announce(identityName);
+              this.announce(identityName, settled.value);
               step = stream.next();
             }
             if (!signal.aborted) {
@@ -11611,10 +11611,10 @@ var init_ours_runtime = __esm({
           backoffMs = Math.min(backoffMs * 2, WATCH_RETRY_MAX_MS);
         }
       }
-      announce(identityName) {
+      announce(identityName, event) {
         for (const listener of this.listeners) {
           try {
-            listener(identityName);
+            listener(identityName, event);
           } catch (error) {
             this.log(`cowork SDK notification listener failed for ${identityName}:`, error);
           }
@@ -12168,6 +12168,7 @@ var init_contracts = __esm({
       participant_id: LowerCrockfordUlidSchema,
       state: SeatStateSchema,
       alias: NonEmptyStringSchema.optional(),
+      removal_reason: external_exports.literal("contact_absent").optional(),
       removed_at: Rfc3339Schema.optional(),
       removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
       // Read and discard prerelease successor lineage. New rooms expose only
@@ -12181,7 +12182,7 @@ var init_contracts = __esm({
             context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `pending seats require ${field}` });
           }
         }
-        for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at"]) {
+        for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at", "removal_reason"]) {
           if (seat[field] !== void 0) {
             context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `${field} is forbidden on pending seats` });
           }
@@ -12212,7 +12213,7 @@ var init_contracts = __esm({
         if (seat.accepted_at === void 0) {
           context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["accepted_at"], message: "active seats require accepted_at" });
         }
-        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+        for (const field of ["removed_at", "removed_epoch", "bounced_at", "removal_reason"]) {
           if (seat[field] !== void 0) {
             context.addIssue({
               code: external_exports.ZodIssueCode.custom,
@@ -13790,12 +13791,13 @@ var init_packets = __esm({
         });
         this.rebindSleep = options.rebindSleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
         this.rebindRandom = options.rebindRandom ?? Math.random;
-        this.unsubscribe = host.onIdentityNotify((name) => {
+        this.unsubscribe = host.onIdentityNotify((name, event) => {
           const found = [...this.packets.entries()].find(([, packet2]) => packet2.name === name);
           if (!found) return;
           const [roomId, packet] = found;
+          if (event?.event === "contact_removed" && event.identity_cid !== packet.cid) return;
           void packet.refresh().then(
-            () => this.onNotify(roomId, "message_received"),
+            () => this.onNotify(roomId, event?.event === "contact_removed" ? "contact_removed" : "message_received"),
             (error) => this.log(`[${name}] failed to refresh SDK state after notification:`, error)
           );
         });
@@ -15043,6 +15045,17 @@ var init_intake = __esm({
         const room = await this.store.load(roomId);
         const activeCids = new Set(room.seats.filter((seat) => seat.state === "active").map((seat) => seat.identity));
         const removedCids = new Set(room.seats.filter((seat) => seat.state === "removed").map((seat) => seat.identity));
+        let firstDeliveryError;
+        let deliveryFailed = false;
+        const attempt = async (send) => {
+          try {
+            return await send();
+          } catch (error) {
+            if (!deliveryFailed) firstDeliveryError = error;
+            deliveryFailed = true;
+            return void 0;
+          }
+        };
         let after = 0;
         for (; ; ) {
           const pending = await queryStore(this.store, roomId, {
@@ -15051,7 +15064,10 @@ var init_intake = __esm({
             after,
             limit: JOURNAL_WORK_BATCH_SIZE
           });
-          if (pending.length === 0) return;
+          if (pending.length === 0) {
+            if (deliveryFailed) throw firstDeliveryError;
+            return;
+          }
           for (const intent of pending) {
             after = intent.seq;
             const [message] = intent.message_id === void 0 ? [] : await queryStore(this.store, roomId, { kind: "message", messageId: intent.message_id, limit: 1 });
@@ -15098,7 +15114,7 @@ var init_intake = __esm({
             const replyTo = decision.replyTo;
             if (file !== void 0) {
               const uploader = file.author_alias?.alias ?? file.author.display_name;
-              const notice = await sendRoomBody(packet, intent.recipient_identity, {
+              const notice = await attempt(() => sendRoomBody(packet, intent.recipient_identity, {
                 version: 1,
                 kind: "room_msg",
                 room_id: roomId,
@@ -15111,7 +15127,8 @@ var init_intake = __esm({
                 },
                 text: `${uploader} sent a file`,
                 at: file.at
-              }, replyTo);
+              }, replyTo));
+              if (notice === void 0) continue;
               if (notice.status === "send_failed") {
                 const failed = await this.store.append(roomId, {
                   version: 1,
@@ -15126,13 +15143,14 @@ var init_intake = __esm({
                 if (failed.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
                 continue;
               }
-              const outcome2 = await packet.sendFile(
+              const outcome2 = await attempt(() => packet.sendFile(
                 intent.recipient_identity,
                 file.filename,
                 file.mime,
                 Buffer.from(file.data_base64, "base64"),
                 replyTo
-              );
+              ));
+              if (outcome2 === void 0) continue;
               const appended2 = await this.store.append(roomId, {
                 version: 1,
                 kind: "relay_result",
@@ -15167,7 +15185,8 @@ var init_intake = __esm({
               ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
               ...message.membership === void 0 ? {} : { membership: message.membership }
             };
-            const outcome = await sendRoomBody(packet, intent.recipient_identity, unsigned, replyTo);
+            const outcome = await attempt(() => sendRoomBody(packet, intent.recipient_identity, unsigned, replyTo));
+            if (outcome === void 0) continue;
             const appended = await this.store.append(roomId, {
               version: 1,
               kind: "relay_result",
@@ -16992,6 +17011,7 @@ var init_service = __esm({
       }
       async reconcileUnlocked(room, packet) {
         if (room.state === "closed" || room.state === "closing") return room;
+        await packet.refreshContacts();
         const contactsByCid = /* @__PURE__ */ new Map();
         for (const contact of packet.listContacts()) {
           if (contactsByCid.has(contact.container_id)) continue;
@@ -17001,6 +17021,27 @@ var init_service = __esm({
             ...authenticatedInvite === void 0 ? {} : { inviteId: authenticatedInvite }
           });
         }
+        let epoch = room.membership_epoch;
+        const departed = /* @__PURE__ */ new Set();
+        const reconciledSeats = room.seats.map((seat) => {
+          if (seat.state !== "active" || contactsByCid.has(seat.identity)) return seat;
+          departed.add(seat.identity);
+          return {
+            ...seat,
+            state: "removed",
+            removed_at: this.now(),
+            removed_epoch: ++epoch,
+            removal_reason: "contact_absent"
+          };
+        });
+        if (departed.size > 0) {
+          room = await this.store.save(RoomSchema.parse({
+            ...room,
+            seats: reconciledSeats,
+            membership_epoch: epoch,
+            command_grants: room.command_grants.filter((grant) => !departed.has(grant.caller_cid))
+          }));
+        }
         const inviteById = new Map(room.invites.map((invite) => [invite.invite_id, invite]));
         const existingCids = new Set(room.seats.filter((seat) => seat.state === "active" || seat.state === "pending").map((seat) => seat.identity));
         const lastRemovedAt = /* @__PURE__ */ new Map();
@@ -18994,7 +19035,7 @@ import * as nodeFs5 from "node:fs";
 import { join as join7 } from "node:path";
 import { fileURLToPath } from "node:url";
 function isIntakeNotification(event) {
-  return event === "message_received" || event === "file_received" || event === "contact_accepted" || event === "contact_added";
+  return event === "message_received" || event === "file_received" || event === "contact_accepted" || event === "contact_added" || event === "contact_removed";
 }
 function createDaemonControlRoutes(control) {
   if (!/^[0-9a-f]{32}$/.test(control.session)) throw new TypeError("invalid daemon control session");

package/docs/05-room-workflow.md

@@ -115,3 +115,17 @@ Use the RPC arguments without `room_id`; the receiving room fixes the target. Fo
 Host lifecycle and global room creation/listing are excluded. `room.accept` accepts invitation input through its separate grant and remains unavailable through REST. Ours close/delete return a durable accepted receipt before closing the reply channel; verify completion through management. Close retains archive/files; delete requires `confirm:true`, closes first, and erases local room data. Pending lifecycle requests resume after restart; failed requests remain visible in room metadata for explicit management retry. Missing replies do not prove a mutation failed.
 
 The SDK owns command reply delivery and its size limits. Large history pages or a single large file record may exceed that transport's capacity; use CLI/REST for those results. No additional result-omission contract is introduced.
+
+## Contact deletion and room membership
+
+Cowork subscribes to SDK notifications for each hosted room identity. A typed `contact_removed` with a different local identity CID is ignored, even when the identity name matches. The room packet refreshes state and forwards the wake. Under the room mutex, reconciliation refreshes contacts again and removes only active seats whose exact peer CID is absent. The same path runs on startup, watch reconnection and the existing periodic resync, covering missed notifications and a crash between core deletion and room persistence.
+
+A departed seat stays in durable room metadata with its participant ID, CID, role, accepted_at, invite provenance, removed_at, removed_epoch and `removal_reason: 'contact_absent'`. Each transition increments membership_epoch once and revokes that CID's explicit command grants. Accepted invite history remains accepted: a departure is not an invitation/admission failure. Pending asynchronous admissions without contacts stay pending. Removal reason deliberately does not claim peer intent: contact absence can also follow local removal or crash recovery. This persisted lifecycle record remains available even in quiet rooms and when nobody remains to receive a membership message.
+
+Duplicate wakes and restarts do not change an already-removed seat's epoch or timestamp. An old event with a currently present/re-added contact cannot remove it. No attempt is made to infer an unobserved remove-and-readd cycle from a surviving contact snapshot. Each room identity reconciles its own contact book; deleting a contact in one room does not authorize removal in another where that contact still exists.
+
+Future broadcasts use active membership; pending relays already addressed to departed participants use the existing `skipped_removed` outcome. If a contact disappears during delivery, independent recipients are still attempted (text, file metadata and file bytes, including later journal batches). A thrown send remains result-less and is retried under existing recovery semantics; the first error is reported after other recipients have been attempted. Storage errors stop immediately. No durable append receipt or relay outcome schema was changed. This boundary was coordinated with backlog task `0mtzfmkqra63687cd`, which remains owner of durable receipts and per-recipient outcome design.
+
+### Rollout
+
+No core protocol or room-version migration is required. Existing version-2 rooms load with optional `removal_reason` absent; reconciliation fills it only on newly observed contact departures. Older Cowork versions strip this optional field on parse/save and do not perform automatic reconciliation; retain the upgraded version to preserve reason metadata. Admission and removal fields use the existing room lifecycle schema. An older SDK daemon supplies a legacy/sync wake; authoritative periodic reconciliation still works. The enriched typed event requires the accompanying SDK daemon change. No dependency bump to an unpublished package is made by this patch; release the SDK enhancement before or alongside Cowork.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/cowork",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Durable ours mission rooms on the shared ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",