zas-agent 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-09-06
+
+### Added
+
+- A channel you joined, but did not create, can now be granted to an agent.
+  Its owner has to allow the agent first. Until they answer, the grant is
+  written and waiting: the key is real and it opens nothing.
+- `grant_pending`. A tool call on a channel whose owner has not answered says
+  so, and says to ask them, rather than reporting the grant as missing.
+- `foreign_limit` on pairing. A plan allows an agent a number of channels of
+  other people, and the free plan allows fewer of those than of your own.
+- `zas_status` marks such a channel as waiting for its owner.
+
+### Fixed
+
+- Reading a channel somebody else created said `read_forbidden` on a grant
+  that plainly said `send · read`, while sending into the same channel
+  worked. Sending goes through the API, which knows which account holds a
+  channel; reading goes to Firestore directly, and the agent looked under
+  its own owner, where a shared channel is not kept. The server now says
+  where each channel lives, and reads, Directo offers and Directo fallbacks
+  all address that account. A channel of your own is unchanged: it is in
+  your own account, which is where it was always read from.
+
 ## [0.7.0] - 2026-09-05
 
 ### Added
@@ -279,7 +303,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   two separate identities that cannot read each other's keys.
 - Install snippets for Claude Code and Codex, printed by `zas-agent pair`.
 
-[Unreleased]: https://github.com/soke1556/zas-agent/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/soke1556/zas-agent/compare/v0.8.0...HEAD
+[0.8.0]: https://github.com/soke1556/zas-agent/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/soke1556/zas-agent/compare/v0.6.3...v0.7.0
 [0.6.3]: https://github.com/soke1556/zas-agent/compare/v0.6.2...v0.6.3
 [0.6.2]: https://github.com/soke1556/zas-agent/compare/v0.6.1...v0.6.2

package/dist/cli.js

@@ -159,6 +159,7 @@ var SENTENCES = {
   agent_forbidden: "This agent cannot do that; only the account owner can.",
   agent_revoked: "The owner revoked this agent. Pair again with \u201Czas-agent pair\u201D.",
   grant_missing: "This agent has no access to that channel. The owner adds it from Settings \u2192 Agents.",
+  grant_pending: "That channel belongs to somebody else, and its owner has not allowed this agent yet. Ask them to allow it in Zas.",
   not_found: "That item is not in the channel.",
   invalid_cap: "That file is no longer available.",
   write_failed: "The file could not be saved to the destination.",
@@ -187,6 +188,7 @@ var SENTENCES = {
   pairing_claimed: "This pairing was already claimed. Pair again with \u201Czas-agent pair\u201D.",
   agent_limit: "The account cannot take another agent. The owner deletes one from Settings \u2192 Agents.",
   grant_limit: "The plan allows fewer channels per agent than this pairing grants.",
+  foreign_limit: "The plan allows this agent fewer channels of other people than this pairing asks for.",
   feature_disabled: "Agents are not enabled for this account yet.",
   upload_failed: "The upload failed. Try again.",
   oprf_failed: "Zas did not answer correctly while preparing the file. Try again.",
@@ -1036,8 +1038,8 @@ function keepUrls(servers, keep) {
   const kept = [];
   for (const server of servers) {
     const urls = typeof server.urls === "string" ? [server.urls] : server.urls ?? [];
-    const usable = urls.filter(keep);
-    if (usable.length > 0) kept.push({ ...server, urls: usable });
+    const usable2 = urls.filter(keep);
+    if (usable2.length > 0) kept.push({ ...server, urls: usable2 });
   }
   return kept;
 }
@@ -2075,15 +2077,22 @@ function channelNameOf(identity, grant) {
     throw new ZasError("key_stale", 0);
   }
 }
+function channelAccountOf(identity, grant) {
+  return grant.channel_owner_uid !== void 0 && grant.channel_owner_uid !== "" ? grant.channel_owner_uid : identity.owner_uid;
+}
 var fold = (value) => value.trim().toLowerCase();
+function usable(grant) {
+  if (grant.pending) throw new ZasError("grant_pending", 0);
+  return grant;
+}
 function resolveChannel(identity, grants, channel) {
   if (channel === void 0 || fold(channel) === "") {
-    if (grants.length === 1) return grants[0];
+    if (grants.length === 1) return usable(grants[0]);
     throw new ZasError("grant_missing", 0);
   }
   const wanted = channel.trim();
   const byId = grants.find((g) => g.channel_id === wanted);
-  if (byId) return byId;
+  if (byId) return usable(byId);
   const folded = fold(wanted);
   const byName = grants.filter((g) => {
     try {
@@ -2092,7 +2101,7 @@ function resolveChannel(identity, grants, channel) {
       return false;
     }
   });
-  if (byName.length === 1) return byName[0];
+  if (byName.length === 1) return usable(byName[0]);
   throw new ZasError("grant_missing", 0);
 }
 
@@ -2784,7 +2793,7 @@ async function sendDirect(ctx, input, report2, deps = {}) {
     ...stamp
   });
   const route = `/direct/${cid}/${id}`;
-  const offerPath = `accounts/${owner}/channels/${cid}/direct/${id}`;
+  const offerPath = `accounts/${channelAccountOf(ctx.identity, grant)}/channels/${cid}/direct/${id}`;
   const setState = (state) => ctx.client.api("POST", `${route}/state`, { state, ...stamp }).then(() => void 0, () => void 0);
   const claimBy = startedAt + (deps.offerWaitMs ?? OFFER_WAIT_MS);
   for (; ; ) {
@@ -3060,7 +3069,7 @@ function nameFrom(channelKey, grant) {
   }
 }
 function linksParent(identity, grant) {
-  return `accounts/${identity.owner_uid}/channels/${grant.channel_id}`;
+  return `accounts/${channelAccountOf(identity, grant)}/channels/${grant.channel_id}`;
 }
 function linkPath(identity, grant, id) {
   return `projects/${identity.firestore_project}/databases/(default)/documents/${linksParent(identity, grant)}/links/${id}`;
@@ -3341,11 +3350,12 @@ async function receiveDirect(ctx, input, report2, deps = {}) {
   const channelName = channelLabel(ctx, grant);
   const cid = grant.channel_id;
   const owner = ctx.identity.owner_uid;
+  const account = channelAccountOf(ctx.identity, grant);
   const device = deps.device ?? newDeviceToken();
   const { seal, open } = sealer(key, grant.key_version);
   const stamp = { device, owner_uid: owner };
   const startedAt = now();
-  const channelPath = `accounts/${owner}/channels/${cid}`;
+  const channelPath = `accounts/${account}/channels/${cid}`;
   report2("waiting");
   const waitUntil = startedAt + (deps.offerWaitMs ?? OFFER_WAIT_MS2);
   let id;
@@ -3480,6 +3490,7 @@ async function receiveDirect(ctx, input, report2, deps = {}) {
     channel_name: channelName,
     offer_id: offerId,
     owner_uid: owner,
+    channel_account: account,
     device,
     ...input.dest !== void 0 ? { dest: input.dest } : {},
     meta: offered,
@@ -3495,7 +3506,7 @@ async function receiveDirectFallback(ctx, record, report2, deps = {}) {
   const { open } = sealer(record.key, record.key_version);
   const stamp = { device: record.device, owner_uid: record.owner_uid };
   const base = `/direct/${record.channel_id}/${record.offer_id}/fallback`;
-  const offerPath = `accounts/${record.owner_uid}/channels/${record.channel_id}/direct/${record.offer_id}`;
+  const offerPath = `accounts/${record.channel_account}/channels/${record.channel_id}/direct/${record.offer_id}`;
   const doc = await ctx.client.firestoreGet(offerPath);
   const enc = stringField2(doc, "fallback_meta_enc");
   let meta;
@@ -4088,7 +4099,7 @@ async function report(client, properties) {
 
 // src/server.ts
 function agentVersion() {
-  return true ? "0.7.0" : "0.0.0-dev";
+  return true ? "0.8.0" : "0.0.0-dev";
 }
 var AGENT_CUE = " The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.";
 var PAIR_ANNOUNCE_MS = 15e3;
@@ -4098,6 +4109,7 @@ var delay = (ms) => new Promise((resolve2) => {
   setTimeout(resolve2, ms);
 });
 function rightsOf(grant) {
+  if (grant.pending) return "waiting for the channel\u2019s owner";
   const rights = [];
   if (grant.send && grant.mode !== "view") rights.push(grant.direct_mode ? "send (Directo)" : "send");
   if (grant.read) rights.push(grant.direct_mode ? "receive (Directo)" : "read");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zas-agent",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "MCP server that lets a coding agent send files and notes into your Zas channels, and send or receive files live through Directo.",
   "type": "module",
   "license": "MIT",