commonswarm 0.1.17 → 0.1.19

package/README.md

@@ -1,11 +1,11 @@
-# cswarm
+# commonswarm
 
 The CommonSwarm CLI. CommonSwarm is a coordination service for teams where people and AI
 agents work side by side: agents post short, immutable *signals* of intent ("I'm about to
 refactor auth") so collaborators don't step on each other.
 
 ```sh
-npm install -g cswarm
+npm install -g commonswarm
 cswarm --help
 ```
 
@@ -20,8 +20,8 @@ able to reach the service — ask whoever controls the environment's egress allo
 permit:
 
 - `commonswarm.com` (target discovery and the web app)
-- your deployment's API host (shown by `cswarm target show`; for the hosted free tier
-  this is a `*.supabase.co` URL until it moves under `commonswarm.com`)
+- `api.commonswarm.com` — the hosted service's API host, a subdomain of the same
+  domain (a self-hosted deployment's host is shown by `cswarm target show`)
 
 If those are blocked you can install but not connect.
 

package/cswarm.cjs

@@ -21409,7 +21409,7 @@ function cloudTarget(url, anonKey) {
     throw new Error(
       /* Not "who invited you" — self-serve signup is live and that reader has no inviter.
        * See D-067 and the matching wording in current-target.ts. */
-      "--url is required: use the Supabase project base URL (https://<ref>.supabase.co) from whoever runs this deployment, or from your own project's API settings if you created it, or start with cswarm accept --link-stdin because invite links carry the Cloud target; if you already have a project, pass --url and --anon-key or set SWARM_CLOUD_URL and SWARM_CLOUD_ANON_KEY."
+      "--url is required: the hosted CommonSwarm service is https://api.commonswarm.com; a self-hosted deployment uses its Supabase project base URL (https://<ref>.supabase.co) from whoever runs it, or from your own project's API settings if you created it. Or start with cswarm accept --link-stdin because invite links carry the Cloud target; scripts and CI may pass --url and --anon-key or set SWARM_CLOUD_URL and SWARM_CLOUD_ANON_KEY."
     );
   }
   const parsed = new URL(url);
@@ -22105,7 +22105,7 @@ registerUpcaster("TaskCreated", 0, (p) => ({ task_id: p.id, slug: p.name }));
 // src/protocol/workspace-commands.ts
 var INVITATION_MAX_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var AGENT_TOKEN_DEFAULT_TTL_MS = 60 * 60 * 1e3;
-var AGENT_TOKEN_MAX_TTL_MS = 8 * 60 * 60 * 1e3;
+var AGENT_TOKEN_MAX_TTL_MS = 24 * 60 * 60 * 1e3;
 var RENEWAL_HORIZON_DEFAULT_MS = 30 * 24 * 60 * 60 * 1e3;
 var RENEWAL_HORIZON_MAX_MS = 90 * 24 * 60 * 60 * 1e3;
 
@@ -23368,7 +23368,12 @@ function missingTargetError(mode3) {
      * their own workspace has no such person and the sentence sends them to nobody. Same family
      * as the 3-project cap telling the account holder to ask an operator who is themselves —
      * instruction text written for a different reader than the one receiving it. See D-067. */
-    "no Cloud target is selected: start with cswarm accept --link-stdin because invite links carry the Cloud target and save its Supabase project base URL, or run cswarm target set --url https://<ref>.supabase.co --anon-key <key> using values from whoever runs this deployment, or from your own project's API settings if you created it; scripts and CI may instead pass --url and --anon-key or set SWARM_CLOUD_URL and SWARM_CLOUD_ANON_KEY"
+    /* The hosted reader must be able to FINISH the target-set command, not just start it: the
+     * inversion arm on this change showed every listed route was closed for the self-serve
+     * hosted reader because <key> named no source. The anon key is public (RLS-protected) and
+     * published in the meta tags of https://commonswarm.com/start — say so. Same F-1/D-067
+     * family: a route you cannot complete is not a route. */
+    "no Cloud target is selected: most commands discover the hosted target from https://commonswarm.com automatically, so seeing this usually means that fetch failed \u2014 check network or your egress allowlist. Otherwise start with cswarm accept --link-stdin because invite links carry the Cloud target and save its Supabase project base URL, or run cswarm target set --url https://api.commonswarm.com --anon-key <key> for the hosted service \u2014 the anon key is public, in the meta tags at https://commonswarm.com/start (a self-hosted deployment uses its https://<ref>.supabase.co URL from whoever runs it, or from your own project's API settings if you created it); scripts and CI may instead pass --url and --anon-key or set SWARM_CLOUD_URL and SWARM_CLOUD_ANON_KEY"
   );
 }
 function missingAnonKeyError(mode3, mismatchedStoredTarget) {
@@ -26599,7 +26604,10 @@ var CURRENT_INVITE_SCHEME = "cswarm://accept/";
 var RETIRED_INVITE_SCHEME = "coswarm://accept/";
 var INVITE_WRAPPER_ERROR = "invite link wrapper is not recognized; use https://commonswarm.com/invite#invite=<payload> or cswarm://accept/<payload>";
 var ACCEPT_INPUT_ERROR = "accept input was not recognized; use an https://...#invite=<payload> link, cswarm://accept/<payload>, or a swm_inv_ invitation capability";
-var PRODUCTION_CLOUD_ORIGIN = "https://ukezjcnxjvkpkeezxaew.supabase.co";
+var PRODUCTION_CLOUD_ORIGINS = /* @__PURE__ */ new Set([
+  "https://api.commonswarm.com",
+  "https://ukezjcnxjvkpkeezxaew.supabase.co"
+]);
 function exactKeys(value, required, optional = []) {
   const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
   return required.every((key2) => Object.hasOwn(value, key2)) && Object.keys(value).every((key2) => allowed.has(key2));
@@ -26759,7 +26767,7 @@ function equalExact(actual, expected) {
   return equal && left.length === right.length;
 }
 async function requirePinnedOrigin(target2, options) {
-  if (target2.url === PRODUCTION_CLOUD_ORIGIN || loopback(target2)) return;
+  if (PRODUCTION_CLOUD_ORIGINS.has(target2.url) || loopback(target2)) return;
   if (options.interactive && devOrigins(options.devAllowedOrigins).has(target2.url)) {
     return;
   }
@@ -29917,7 +29925,10 @@ var AcpHostSession = class _AcpHostSession {
         },
         clientInfo: {
           name: clientName ?? "cswarm-host",
-          version: clientVersion ?? "0.1.4"
+          /* "0.0.0" and not a real release number: this fallback only fires when a caller
+           * passes no version, and a hardcoded one here silently rots (it read "0.1.4"
+           * thirteen releases later). Callers that know the build version pass it. */
+          version: clientVersion ?? "0.0.0"
         }
       },
       this.requestTimeoutMs
@@ -36326,8 +36337,8 @@ var ACCEPTED_AGENT_CREDENTIAL_MESSAGES = [
   AGENT_CREDENTIAL_MESSAGE_D088
 ];
 function packageVersion() {
-  if ("0.1.17".length > 0) {
-    return "0.1.17";
+  if ("0.1.19".length > 0) {
+    return "0.1.19";
   }
   try {
     const value = JSON.parse(
@@ -36882,7 +36893,7 @@ async function runTarget(args) {
     }
     if (saved === null) {
       process.stdout.write(
-        "No current Cloud target is saved. Start with cswarm accept --link-stdin, or run cswarm target set --url <project-url> --anon-key <key>.\n"
+        "No current Cloud target is saved. Start with cswarm accept --link-stdin, or run cswarm target set --url https://api.commonswarm.com --anon-key <key> for the hosted service (the anon key is public, in the meta tags at https://commonswarm.com/start); a self-hosted deployment uses its own URL and key.\n"
       );
       return;
     }
@@ -37431,7 +37442,7 @@ async function runToken(args) {
         ...ttl === void 0 ? {} : {
           ttl_ms: integer2(args, "ttl-ms", {
             minimum: 1,
-            maximum: 288e5
+            maximum: 864e5
           })
         }
       }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "commonswarm",
-  "version": "0.1.17",
-  "description": "CommonSwarm CLI \u2014 coordination for teams where people and AI agents work side by side.",
+  "version": "0.1.19",
+  "description": "CommonSwarm CLI — coordination for teams where people and AI agents work side by side.",
   "bin": {
     "cswarm": "cswarm.cjs"
   },
@@ -24,4 +24,4 @@
     "commonswarm",
     "swarm"
   ]
-}
+}