openmates 0.29.0-alpha.0 → 0.29.0-alpha.10

package/CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog — `openmates` npm package (CLI and SDK)
+
+Only SDK-relevant compatibility notes are recorded here. Release versions follow
+the product line (`0.29.x` alpha prereleases from `dev`, stable from `main`).
+
+## 0.29.x
+
+### Deprecated
+
+- **Implicit CLI login in the root `OpenMatesClient`.** Constructing
+  `OpenMatesClient` (or calling `OpenMatesClient.load()`) from the root
+  `openmates` export without a `session` still loads the stored CLI login, but now
+  emits one `DeprecationWarning` per process with code `OPENMATES_SDK_CLI_SESSION`.
+  SDK credentials must be explicit. Migrate by passing `session` explicitly,
+  setting `loadStoredSession: false`, or using `SessionClient` from
+  `openmates/sdk/v1` (`loginPassword()` / `importSession()`).
+  A future minor release (planned 0.30.0) will require explicit credentials for
+  the root export; the `openmates` command line is unaffected.
+
+### Added
+
+- `openmates/sdk` and `openmates/sdk/v1` entrypoints backed by the shared Rust
+  core. Privacy helpers, task ordering and embed-version reconstruction use the
+  portable WebAssembly build; `SessionClient` uses the Node-API build for now.
+  A missing artifact raises `native_binding_unavailable` (no fallback).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenMates contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -375,6 +375,31 @@ Use `chats.send()` for anonymous AI chat with automatic routing; `apps.ai.ask()`
 requires an account. With an API key, use `saveToAccount: true` when you want the
 chat saved to the OpenMates account.
 
+### Deprecated: implicit CLI login in the root `OpenMatesClient`
+
+`new OpenMatesClient()` / `OpenMatesClient.load()` from the root `openmates`
+export still load the stored CLI login when no `session` is passed, but this is
+deprecated: SDK credentials must be explicit. It emits one `DeprecationWarning`
+with code `OPENMATES_SDK_CLI_SESSION` per process. Pass `session` explicitly,
+set `loadStoredSession: false`, or use `SessionClient` from `openmates/sdk/v1`.
+A later minor release will require explicit credentials (see `CHANGELOG.md`).
+The `openmates` command line is unaffected.
+
+### Native session SDK (preview)
+
+`openmates/sdk/v1` exports `SessionClient`, `RustApiKeyClient` and related
+types. Every operation runs in the shared OpenMates Rust core through a native
+Node-API module loaded from `native/<platform>-<arch>.node`; the SDK never
+launches the CLI and never reads CLI login state. Credentials are explicit:
+log in with `loginPassword()` or import a caller-owned session. If the native
+module for your platform is missing or incompatible, construction throws
+`SessionClientError` with code `native_binding_unavailable` (no TypeScript
+fallback). The SDK is moving to one portable WebAssembly build of the core
+(`wasm/openmates_sdk_bg.wasm`, for Node, Deno, Bun, edge and browsers): privacy
+helpers, task ordering and embed-version reconstruction already use it. Prebuilt
+artifacts are not yet published; from a source checkout run
+`npm run build:sdk:wasm` and `npm run build:sdk:native`.
+
 ## Versioning
 
 OpenMates shows the short product line, for example `v0.29`, in the web app.

package/dist/{chunk-5OCI636P.js → chunk-67U3XD2B.js}

@@ -740,7 +740,8 @@ var DEFAULT_STANDALONE_PREFIX = "TASK";
 var PRIORITY_LEVELS = ["none", "low", "medium", "high", "urgent"];
 var LABEL_INDEX_INFO = "openmates-task-label-index-v1";
 var EXTERNAL_CHAT_INDEX_INFO = "openmates-task-external-chat-index-v1";
-var EXTERNAL_CHAT_PROVIDERS = ["codex"];
+var EXTERNAL_CHAT_PROVIDERS = ["codex", "claude"];
+var CLAUDE_SESSION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var BLOCKED_REASON_CODES = [
   "needs_user_input",
   "waiting_for_approval",
@@ -773,10 +774,15 @@ function parseExternalChatRef(value) {
   const provider = value.slice(0, separator).trim().toLowerCase();
   const id = value.slice(separator + 1).trim();
   if (separator <= 0 || !id) throw new Error("--external-chat requires provider:id.");
-  if (!EXTERNAL_CHAT_PROVIDERS.includes(provider)) throw new Error(`Unsupported external chat provider '${provider}'. Use codex.`);
-  return { provider, id };
+  return assertExternalChatRef({ provider, id });
+}
+function assertExternalChatRef(ref) {
+  if (!EXTERNAL_CHAT_PROVIDERS.includes(ref.provider)) throw new Error(`Unsupported external chat provider '${ref.provider}'. Use codex or claude.`);
+  if (ref.provider === "claude" && !CLAUDE_SESSION_ID.test(ref.id)) throw new Error("Claude Code external chat ids must be session UUIDs (CLAUDE_CODE_SESSION_ID).");
+  return ref;
 }
 function externalChatLookupHash(masterKey, context) {
+  assertExternalChatRef(context);
   const indexKey = Buffer.from(hkdfSync2("sha256", Buffer.from(masterKey), Buffer.alloc(0), EXTERNAL_CHAT_INDEX_INFO, 32));
   return createHmac3("sha256", indexKey).update(`${context.provider}\0${context.id}`).digest("hex");
 }
@@ -1345,6 +1351,7 @@ export {
   taskEditLookupScope,
   workflowProjectionDeleteGuidance,
   parseExternalChatRef,
+  assertExternalChatRef,
   externalChatLookupHash,
   normalizeBlockedReasonCode,
   normalizeTaskStatus,