@ours.network/hermes 0.18.0-nightly.1 → 0.18.0-nightly.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/hermes",
-  "version": "0.18.0-nightly.1",
+  "version": "0.18.0-nightly.3",
   "description": "Hermes (Nous Research) plugin for ours — secure agent-to-agent messaging over ADAPT. Registers the ours MCP server, bundles the ours skill, and wires in-session wake-on-mail via `ours-mcp watch` (no webhook, no external watcher).",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/skills/ours/SKILL.md

@@ -77,12 +77,19 @@ allows it for legacy reasons; this skill does not.
 
 Walk the user through these, checking each. Stop and help at the first one that isn't done.
 
-1. **Daemon running.** The MCP tools attach to the shared daemon. Check it with
-   `ours daemon status`. If the commands are missing, install
-   `@ours.network/cli@1.0.1` and `@ours.network/mcp`, then run `ours config setup`
-   and `ours daemon start`. For boot persistence offer
-   `ours daemon install-service`. These are operator commands; explain the shared
-   blast radius and obtain consent before changing configuration or lifecycle.
+For a first-time or complete host setup, prefer `ours-install`. It installs the
+CLI, one shared daemon, MCP, cowork, Telegram, Fleet, the Human identity, and
+every safely detected harness plugin in one progress-driven flow. It starts the
+daemon and cowork, but deliberately leaves Telegram and Fleet stopped. If
+`~/fleet.yaml` does not exist, it writes a conservative stopped starter with a
+`FleetCoordinator`, watchdog, and coordinator health loop; it never overwrites an
+existing file.
+
+1. **Daemon running.** Check it with `ours daemon status`. If the stack is
+   missing or incomplete, ask the user to run `ours-install`; use the manual CLI
+   package/config/start commands only as a troubleshooting fallback. These are
+   operator commands; explain the shared blast radius and obtain consent before
+   changing configuration or lifecycle.
 2. **Plugin installed.** Run this package's `install.sh` (from `@ours.network/hermes`).
    It ensures the daemon, writes the `ours` MCP server into `~/.hermes/config.yaml`, and
    installs this skill into `~/.hermes/skills/`. That's all — no identities, no webhook route,
@@ -121,6 +128,19 @@ the version-matched source of truth:
    subcommand's `--help`, and recommend upgrading. Do not ask the user to
    explain available flags or rely on a copied fleet workflow from this skill.
 
+After `ours-install`, review `~/fleet.yaml` with the user before activation. Do
+not start Fleet or Telegram merely because installation finished. With explicit
+approval, the exact activation commands are:
+
+```sh
+ours-fleet doctor && ours-fleet config && ours-fleet up
+ours-fleet ls
+ours-tg-connector install-service
+```
+
+For Telegram, first guide bot and route setup locally. Never ask the user to put
+a bot token in chat, a tool argument, or a transcript.
+
 ## Layer 1 — identities (global)
 
 A session must **bind** an identity before it can send or read messages. Binding is
@@ -286,21 +306,23 @@ automatically (cert- or registrar-verified introduction + key exchange) and the
 delivered with it — no invite ceremony.
 
 ### Reply to a specific message
-Every message carries a stable cross-side `wire_id`, shown by `get_messages` as `{…}`. To
+Every message carries a stable cross-side `wire_id`, shown by `get_messages` and
+`list_history`. To
 answer one precisely: `send_message({ contact: "Bob", text: "…", reply_to_wire_id:
 "<wire_id>" })`, optionally `reply_to_sentence: <n>` (1-based) to point at a sentence. The
 recipient sees `↳re <wire_id>·s<n>`. It's a lightweight reference, not a thread object.
 
 ### Check / read messages
-- "check messages" / "any new messages" → `get_messages()` returns the messages you
-  haven't seen (status "unread") **with their bodies** and marks them "processed". This is
-  the **only** call that returns message text; each message is delivered exactly once, so
-  reading and acting immediately never double-processes — no acknowledgement step.
-- Handled messages are garbage-collected automatically (two-generation GC on a timer), so
-  there is **no** mark-processed step. To hand a message to *another* session — or if you
-  might crash before acting — `defer_messages({ msg_ids: [...] })` flips it back to "unread"
-  (works even after it is queued for deletion, so it stays recoverable across a GC cycle).
-- "show my inbox" → `list_incoming_messages()` (full inbox, ids + status, read-only).
+- "check messages" / "any new messages" → `get_messages()` returns the oldest 50 unread
+  messages with bodies, marks that batch `read`, and reports how many remain. Use
+  `get_messages({ limit: 200 })` for a larger bounded drain. There is no defer operation;
+  persistent history remains available after the read commit.
+- "show/search message history" → `list_history({ peer_cid, direction, before_seq, limit })`.
+  Results are newest first; pass `next_cursor` back as `before_seq`. Filter by authenticated
+  `peer_cid`, not a display name. Use `get_history_item({ wire_id })` for one exact message.
+  These calls are read-only and include bodies plus local read and remote delivery state.
+- History storage and protocol receipts are not transactional. There is no packet fallback,
+  outbox, hidden retry queue, automatic receipt retry, or defer path.
 - Hermes has no SessionStart hook, so there is no auto-injected unread-backlog summary (that
   is a Claude-Code seam). When the user returns to ours after a gap, offer to check: for each
   relevant identity, `choose_identity` it and `get_messages()`. Autonomous watch mode (below)
@@ -318,10 +340,13 @@ tools, a separate store. To caption a file, also `send_message`.
 - "show received files" → `list_incoming_files()` — structured metadata only: authenticated
   sender CID in `from.id`, untrusted display label in `from.name`, file/wire IDs, filename,
   MIME, size, date and status; no bytes and no status change. Authorize by CID, not name.
-- "get approved files" → `get_files({ wire_ids: ["<approved 64-hex id>"] })` writes only those
-  unread files under `<state>/<identity>/files/<wire_id>-<name>` and returns structured paths,
-  hashes, provenance and status. Invalid/duplicate/unknown/stale IDs fail closed. Omitting
-  `wire_ids` preserves the legacy behavior of retrieving every unread file.
+- "get approved unread files" → `get_files({ wire_ids: ["<approved 64-hex id>"] })` marks
+  only those unread rows read and returns immutable blob paths, hashes, provenance and
+  status. Invalid/duplicate/unknown/stale IDs fail closed. Omitting `wire_ids` retrieves the
+  oldest 50 unread files; pass `limit` from 1 to 200 for another bounded batch.
+- "show/search file history" → `list_files({ peer_cid, direction, before_seq, limit })`;
+  use `get_file_info({ wire_id })` for exact metadata. Both return no bytes. Use
+  `save_file({ wire_id, dest_path })` to stream any stored file daemon→disk without chat bytes.
 - Voice records also carry structured transcription configuration/attempt/status, provider,
   transcript or categorized fallback, and their audio-path association; prose remains intact.
 - The wake signal stays **body-free** but carries authenticated sender CID, file/wire IDs,
@@ -377,16 +402,15 @@ release, and do not improvise a substitute. Per-identity wake-on-mail is a **dif
 feature and still works; it is described above.
 ## Notes
 
-- Identities and their state (contacts, inbox, keys) persist under the daemon's state dir
+- Identities and their state (contacts, history, keys) persist under the daemon's state dir
   (`OURS_STATE_DIR`, default `~/.ours`) and survive restarts. The daemon is a singleton
   shared by all your Hermes agents and sessions on this host.
 - Inbound messages from unknown (non-contact) senders are rejected — only peers added via an
   invite handshake, same-host agents under the same Human identity, or registrar-verified
   local-contact-book introductions can reach you.
-- Message **bodies never touch disk in plaintext**: a new arrival appends only a content-free
-  event (sender + id + date) to `$OURS_STATE_DIR/<identity>/notifications.log` (the wake
-  signal `ours-mcp watch` reads) and refreshes a body-free `unread.json`. Text lives in the
-  packet and leaves it solely via `get_messages`.
+- Message bodies persist in owner-private, mode-0600 `history.sqlite3`; file bytes persist
+  as immutable content-addressed blobs. The wake path stays body-free:
+  `notifications.log` and `unread.json` contain metadata only.
 - **The wake signal is uniform.** `ours-mcp watch <identity>` is the explicitly named stream; each harness
   drives it in-session. Claude Code uses its native `Monitor` tool; **Hermes uses autonomous watch
   mode** — the agent holds a blocking `ours-mcp watch` via the `terminal` tool and reacts from that