zas-agent 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -7,6 +7,60 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-09-09
+
+### Added
+
+- `zas_edit_item`. An agent changes an item it sent, under the same id: the
+  title of a file or a note, or a note's text, language and secret cover.
+  The owner's activity log records the edit, and the channel's devices are
+  woken. An item somebody else sent is refused as `not_yours`.
+- `zas_replace_file`. An agent swaps the bytes under a file it sent, keeping
+  the item id, its place in the channel and its pin. The old chunks are
+  released and the new ones charged in one server transaction; a chunk in
+  both versions is left alone. A note, an item with a public share, and an
+  item somebody else sent are refused. Agents only: no web or mobile client
+  gets a replace.
+- Five codes: `not_yours`, `stale` (the item changed while the agent was
+  working on it: read it again and retry), `not_a_note`, `not_a_file`,
+  `item_shared`.
+- Both tools drop the local send receipts for the item they changed, so
+  "send that again" after an edit makes a new item.
+
+### Fixed
+
+- A machine whose agent home could not be written crashed on the way into
+  serving, before the MCP initialize response, because recording that the
+  telemetry notice had been shown threw. The notice is printed and the
+  failure to record it is logged; the server starts either way. This is the
+  crash behind "connection closed: initialize response" from a Codex-style
+  host.
+
+
+## [0.8.0] - 2026-09-06
+
+### Added
+
+- A channel you joined, but did not create, can now be granted to an agent.
+  Its owner has to allow the agent first. Until they answer, the grant is
+  written and waiting: the key is real and it opens nothing.
+- `grant_pending`. A tool call on a channel whose owner has not answered says
+  so, and says to ask them, rather than reporting the grant as missing.
+- `foreign_limit` on pairing. A plan allows an agent a number of channels of
+  other people, and the free plan allows fewer of those than of your own.
+- `zas_status` marks such a channel as waiting for its owner.
+
+### Fixed
+
+- Reading a channel somebody else created said `read_forbidden` on a grant
+  that plainly said `send · read`, while sending into the same channel
+  worked. Sending goes through the API, which knows which account holds a
+  channel; reading goes to Firestore directly, and the agent looked under
+  its own owner, where a shared channel is not kept. The server now says
+  where each channel lives, and reads, Directo offers and Directo fallbacks
+  all address that account. A channel of your own is unchanged: it is in
+  your own account, which is where it was always read from.
+
 ## [0.7.0] - 2026-09-05
 
 ### Added
@@ -279,7 +333,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   two separate identities that cannot read each other's keys.
 - Install snippets for Claude Code and Codex, printed by `zas-agent pair`.
 
-[Unreleased]: https://github.com/soke1556/zas-agent/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/soke1556/zas-agent/compare/v0.9.0...HEAD
+[0.9.0]: https://github.com/soke1556/zas-agent/compare/v0.8.0...v0.9.0
+[0.8.0]: https://github.com/soke1556/zas-agent/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/soke1556/zas-agent/compare/v0.6.3...v0.7.0
 [0.6.3]: https://github.com/soke1556/zas-agent/compare/v0.6.2...v0.6.3
 [0.6.2]: https://github.com/soke1556/zas-agent/compare/v0.6.1...v0.6.2

package/README.md

@@ -25,9 +25,10 @@ scope to the channels you choose, and that you can revoke.
 
 ## What it does
 
-Your coding agent gets eleven tools. It can send a file or a note into a channel
+Your coding agent gets thirteen tools. It can send a file or a note into a channel
 you picked, send or receive a file live through Directo, list what is in that
-channel, and pull one item back onto disk.
+channel, pull one item back onto disk, and change what it sent: an item's
+title or text, or the bytes under a file, keeping the item id.
 Everything it sends is encrypted on your machine before it leaves, lands in your
 account, and is marked in the channel as sent by that agent. The agent has an
 identity of its own and never holds your account key: pairing mints a key pair
@@ -166,6 +167,11 @@ ones marked *(server-side)* are enforced by the Zas server.
 - **No stored sending into a view-only channel, and none into a channel in
   Directo mode.** Both are refused before a byte is uploaded. A channel in
   Directo mode takes `zas_send_direct`, a live transfer that stores nothing.
+- **No changing what it did not send.** `zas_edit_item` and `zas_replace_file`
+  act only on items carrying this agent's mark; anything else is `not_yours`,
+  and the server refuses it too *(server-side)*. A replace is for agents only:
+  no web or mobile client gets one. An item with a public share is not
+  replaced until the share is removed.
 - **No receiving unless the grant says read.** Receiving through Directo
   writes a file onto this machine, so `zas_receive_direct` takes the same
   `read` switch as listing. And it only ever runs inside a tool call: the
@@ -213,6 +219,11 @@ string ever reaches a terminal.
 | `file_too_big` | The file is over the plan limit. |
 | `duplicate` | That item is already in the channel. |
 | `not_found` | That item is not in the channel. |
+| `not_yours` | That item was not sent by this agent; it can only change its own items. |
+| `stale` | That item changed while this agent was working on it; read it again and retry. |
+| `not_a_note` | That item is a file, not a note; only its title can change. |
+| `not_a_file` | That item is a note, not a file. |
+| `item_shared` | That item has a public share; the owner removes the share first. |
 | `invalid_cap` | That file is no longer available. |
 | `write_failed` | The download destination could not be written. |
 | `pairing_expired` | The pairing expired; pair again. |
@@ -243,11 +254,22 @@ stack trace.
 | `zas_receive_direct_fallback` | After a Directo receive failed in flight, downloads the encrypted copy the sender chose to store, and decrypts it to the same destination. |
 | `zas_list_items` | Lists the most recent items in one of the owner's channels. Needs a grant that includes reading. |
 | `zas_get_item` | Fetches one item. A note comes back as text; a file is written to disk. It never overwrites, so the path it answers with can differ from the one you asked for. |
+| `zas_edit_item` | Changes an item this agent sent, keeping its id: the title of a file or a note, or a note's text, language and secret cover. Needs a grant that includes reading and sending. The owner's activity log records it. |
+| `zas_replace_file` | Replaces the bytes of a file this agent sent with a file from this machine, keeping the item id, its place in the channel and its pin. Returns the item id, or a job id after a minute. Refuses notes, shared items, and items sent by anyone else. |
 | `zas_jobs` | Lists the sends and Directo transfers this server started, newest first, with the phase each one reached — and where a `job_id` from a long send is redeemed. |
 
 `channel` takes a channel name or a channel id. A name has to match exactly one
 of the channels you granted; with exactly one grant, `zas_send_file`,
-`zas_send_note`, `zas_send_direct` and `zas_receive_direct` can leave it out.
+`zas_send_note`, `zas_send_direct`, `zas_receive_direct`, `zas_edit_item` and
+`zas_replace_file` can leave it out.
+
+A replace runs the same pipeline as a send — hash, key derivation, encryption,
+then upload or proof per chunk — and posts the new set with the old one to
+release. The server moves both sets, the account's storage tally and the item
+in one transaction, so a failure leaves everything as it was; a chunk present
+in both versions is neither uploaded nor released. Both tools read the item
+first and write only over the version they read: an item that changed in
+between answers `stale`, and nothing is lost.
 
 Directo needs a native module, [node-datachannel](https://github.com/murat-dogan/node-datachannel),
 WebRTC for Node. npm installs a prebuilt binary for Windows, macOS and Linux;

package/dist/cli.js

@@ -123,7 +123,13 @@ var RENAMES = {
   // agent (expired, or cancelled from the receiving side); `direct_too_big`
   // is the plan's Directo ceiling.
   not_live: "direct_cancelled",
-  direct_too_big: "file_too_big"
+  direct_too_big: "file_too_big",
+  // The item-change routes. `not_allowed` there means the item is not this
+  // agent's; a share of any kind, armed or not, is the one reason a replace
+  // is refused that the owner fixes from the item itself.
+  not_allowed: "not_yours",
+  shared: "item_shared",
+  bar_armed: "item_shared"
 };
 var ZasError = class extends Error {
   constructor(code, status, message, retryAfterMs, serverCode) {
@@ -159,6 +165,7 @@ var SENTENCES = {
   agent_forbidden: "This agent cannot do that; only the account owner can.",
   agent_revoked: "The owner revoked this agent. Pair again with \u201Czas-agent pair\u201D.",
   grant_missing: "This agent has no access to that channel. The owner adds it from Settings \u2192 Agents.",
+  grant_pending: "That channel belongs to somebody else, and its owner has not allowed this agent yet. Ask them to allow it in Zas.",
   not_found: "That item is not in the channel.",
   invalid_cap: "That file is no longer available.",
   write_failed: "The file could not be saved to the destination.",
@@ -180,6 +187,11 @@ var SENTENCES = {
   rate_limited: "Too many sends in a row. Wait a moment.",
   file_too_big: "The file is over the plan limit.",
   duplicate: "That item is already in the channel.",
+  not_yours: "That item was not sent by this agent. It can only change its own items.",
+  stale: "That item changed while this agent was working on it. Read it again and retry.",
+  not_a_note: "That item is a file, not a note. Only its title can change; use zas_replace_file for the bytes.",
+  not_a_file: "That item is a note, not a file. Use zas_edit_item.",
+  item_shared: "That item has a public share. The owner removes the share first.",
   pairing_expired: "The pairing expired. Run \u201Czas-agent pair\u201D again.",
   pairing_cancelled: "The owner cancelled the pairing.",
   claim_mismatch: "The code does not match. Try again.",
@@ -187,6 +199,7 @@ var SENTENCES = {
   pairing_claimed: "This pairing was already claimed. Pair again with \u201Czas-agent pair\u201D.",
   agent_limit: "The account cannot take another agent. The owner deletes one from Settings \u2192 Agents.",
   grant_limit: "The plan allows fewer channels per agent than this pairing grants.",
+  foreign_limit: "The plan allows this agent fewer channels of other people than this pairing asks for.",
   feature_disabled: "Agents are not enabled for this account yet.",
   upload_failed: "The upload failed. Try again.",
   oprf_failed: "Zas did not answer correctly while preparing the file. Try again.",
@@ -1036,8 +1049,8 @@ function keepUrls(servers, keep) {
   const kept = [];
   for (const server of servers) {
     const urls = typeof server.urls === "string" ? [server.urls] : server.urls ?? [];
-    const usable = urls.filter(keep);
-    if (usable.length > 0) kept.push({ ...server, urls: usable });
+    const usable2 = urls.filter(keep);
+    if (usable2.length > 0) kept.push({ ...server, urls: usable2 });
   }
   return kept;
 }
@@ -2075,15 +2088,22 @@ function channelNameOf(identity, grant) {
     throw new ZasError("key_stale", 0);
   }
 }
+function channelAccountOf(identity, grant) {
+  return grant.channel_owner_uid !== void 0 && grant.channel_owner_uid !== "" ? grant.channel_owner_uid : identity.owner_uid;
+}
 var fold = (value) => value.trim().toLowerCase();
+function usable(grant) {
+  if (grant.pending) throw new ZasError("grant_pending", 0);
+  return grant;
+}
 function resolveChannel(identity, grants, channel) {
   if (channel === void 0 || fold(channel) === "") {
-    if (grants.length === 1) return grants[0];
+    if (grants.length === 1) return usable(grants[0]);
     throw new ZasError("grant_missing", 0);
   }
   const wanted = channel.trim();
   const byId = grants.find((g) => g.channel_id === wanted);
-  if (byId) return byId;
+  if (byId) return usable(byId);
   const folded = fold(wanted);
   const byName = grants.filter((g) => {
     try {
@@ -2092,7 +2112,7 @@ function resolveChannel(identity, grants, channel) {
       return false;
     }
   });
-  if (byName.length === 1) return byName[0];
+  if (byName.length === 1) return usable(byName[0]);
   throw new ZasError("grant_missing", 0);
 }
 
@@ -2557,32 +2577,20 @@ async function postLink(ctx, grant, manifest, placed, idempotencyKey, expiresInD
   }
   return created.link_id;
 }
-async function sendFile(ctx, input, onPhase) {
-  const stat = await fsp2.stat(input.path).catch(() => {
+async function checkFilePath(path) {
+  const stat = await fsp2.stat(path).catch(() => {
     throw new ZasError("upload_failed", 400);
   });
   if (!stat.isFile()) throw new ZasError("upload_failed", 400);
   if (stat.size > MAX_FILE_BYTES) throw new ZasError("file_too_big", 413);
-  const grant = await grantFor(ctx, input.channel);
-  const name = basename(input.path);
-  const title = input.title ?? name;
-  const file = await fsp2.readFile(input.path);
+}
+async function readFileChecked(path) {
+  await checkFilePath(path);
+  const file = await fsp2.readFile(path);
   if (file.byteLength > MAX_FILE_BYTES) throw new ZasError("file_too_big", 413);
-  const bytes = new Uint8Array(file.buffer, file.byteOffset, file.byteLength);
-  const contentHash = await sendIdentity(await blake3Hex(bytes), input.expires_in_days);
-  const key = await receiptKey(ctx, grant.channel_id, contentHash, title);
-  const stored = receiptFor(ctx, key);
-  if (stored) {
-    return {
-      link_id: stored.link_id,
-      channel_id: grant.channel_id,
-      channel_name: channelNameOf(ctx.identity, grant),
-      bytes: stored.bytes,
-      chunks: stored.chunks,
-      deduplicated: stored.deduplicated,
-      replayed: true
-    };
-  }
+  return { bytes: new Uint8Array(file.buffer, file.byteOffset, file.byteLength), name: basename(path) };
+}
+async function placeFile(ctx, bytes, onPhase) {
   onPhase?.("hashing");
   const plains = [];
   for await (const piece of chunkStream([bytes])) plains.push(piece);
@@ -2599,7 +2607,37 @@ async function sendFile(ctx, input, onPhase) {
     (plain, i) => encryptChunk(oprfFinalize(hashes[i], blinds[i].blind, b64ToBytes(evaluated[i])), plain)
   ));
   onPhase?.("uploading");
-  const placed = await placeChunks(ctx, encs);
+  return placeChunks(ctx, encs);
+}
+function forgetLink(profile, linkId) {
+  const entries = {};
+  let dropped = false;
+  for (const [k, v] of Object.entries(loadFingerprints(profile).entries)) {
+    if (v && v.link_id === linkId) dropped = true;
+    else entries[k] = v;
+  }
+  if (dropped) saveFingerprints(profile, { entries });
+}
+async function sendFile(ctx, input, onPhase) {
+  await checkFilePath(input.path);
+  const grant = await grantFor(ctx, input.channel);
+  const { bytes, name } = await readFileChecked(input.path);
+  const title = input.title ?? name;
+  const contentHash = await sendIdentity(await blake3Hex(bytes), input.expires_in_days);
+  const key = await receiptKey(ctx, grant.channel_id, contentHash, title);
+  const stored = receiptFor(ctx, key);
+  if (stored) {
+    return {
+      link_id: stored.link_id,
+      channel_id: grant.channel_id,
+      channel_name: channelNameOf(ctx.identity, grant),
+      bytes: stored.bytes,
+      chunks: stored.chunks,
+      deduplicated: stored.deduplicated,
+      replayed: true
+    };
+  }
+  const placed = await placeFile(ctx, bytes, onPhase);
   onPhase?.("finishing");
   const mime = mimeFor(input.path);
   const thumb = await thumbnailFor(bytes, mime);
@@ -2784,7 +2822,7 @@ async function sendDirect(ctx, input, report2, deps = {}) {
     ...stamp
   });
   const route = `/direct/${cid}/${id}`;
-  const offerPath = `accounts/${owner}/channels/${cid}/direct/${id}`;
+  const offerPath = `accounts/${channelAccountOf(ctx.identity, grant)}/channels/${cid}/direct/${id}`;
   const setState = (state) => ctx.client.api("POST", `${route}/state`, { state, ...stamp }).then(() => void 0, () => void 0);
   const claimBy = startedAt + (deps.offerWaitMs ?? OFFER_WAIT_MS);
   for (; ; ) {
@@ -2962,20 +3000,6 @@ async function sendDirectFallback(ctx, record, report2, deps = {}) {
   };
 }
 
-// src/receive.ts
-import { randomBytes as randomBytes3 } from "node:crypto";
-import {
-  closeSync as closeSync2,
-  existsSync as existsSync3,
-  mkdirSync as mkdirSync3,
-  openSync as openSync2,
-  renameSync as renameSync3,
-  rmdirSync as rmdirSync2,
-  unlinkSync as unlinkSync2,
-  writeSync as writeSync2
-} from "node:fs";
-import { dirname as dirname2 } from "node:path";
-
 // src/read.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import {
@@ -3015,7 +3039,8 @@ function rowOf(doc) {
     agent: stringOf(fields.agent),
     createdAt: timeOf(fields.created_at),
     expiresAt: timeOf(fields.expires_at),
-    bar: fields.bar?.booleanValue === true
+    bar: fields.bar?.booleanValue === true,
+    updateTime: timeOf({ timestampValue: document.updateTime })
   };
 }
 function readable(row) {
@@ -3060,7 +3085,7 @@ function nameFrom(channelKey, grant) {
   }
 }
 function linksParent(identity, grant) {
-  return `accounts/${identity.owner_uid}/channels/${grant.channel_id}`;
+  return `accounts/${channelAccountOf(identity, grant)}/channels/${grant.channel_id}`;
 }
 function linkPath(identity, grant, id) {
   return `projects/${identity.firestore_project}/databases/(default)/documents/${linksParent(identity, grant)}/links/${id}`;
@@ -3162,7 +3187,7 @@ function destinationOf(dest, name, fallback) {
   const at = statSync2(dest, { throwIfNoEntry: false })?.isDirectory() ? join2(dest, base) : dest;
   return { target: freeName(at) };
 }
-async function getItem(ctx, channel, id, dest) {
+async function loadItem(ctx, channel, id) {
   const grant = await readGrant(ctx, channel);
   if (!ID_SEGMENT.test(id)) throw new ZasError("not_found", 404);
   const channelKey = channelKeyOf(ctx.identity, grant);
@@ -3181,6 +3206,10 @@ async function getItem(ctx, channel, id, dest) {
   if (!row || !readable(row)) throw new ZasError("not_found", 404);
   const manifest = openFor(channelKey, row);
   if (!manifest) throw new ZasError("not_found", 404);
+  return { grant, channelKey, row, manifest };
+}
+async function getItem(ctx, channel, id, dest) {
+  const { row, manifest } = await loadItem(ctx, channel, id);
   if (manifest.kind === "text") {
     const text2 = manifest.text ?? "";
     return { text: text2, bytes: new TextEncoder().encode(text2).length };
@@ -3231,7 +3260,140 @@ async function getItem(ctx, channel, id, dest) {
   return { path: target, bytes: written };
 }
 
+// src/edit.ts
+function writable(grant) {
+  if (!grant.send || grant.mode === "view") throw new ZasError("send_forbidden", 403);
+  if (grant.direct_mode) throw new ZasError("direct_mode", 409);
+}
+async function ownItem(ctx, channel, id) {
+  const loaded = await loadItem(ctx, channel, id);
+  writable(loaded.grant);
+  if (loaded.row.agent !== ctx.identity.agent_uid) throw new ZasError("not_yours", 403);
+  return loaded;
+}
+function sealedFor(item, manifest) {
+  return bytesToB64(sealManifest(item.channelKey, manifest, item.grant.key_version));
+}
+function guardOf(item) {
+  return item.row.updateTime === null ? {} : { expected_update_time: item.row.updateTime };
+}
+async function editItem(ctx, input) {
+  const item = await ownItem(ctx, input.channel, input.id);
+  const { grant, row, manifest } = item;
+  const kind = manifest.kind === "text" ? "text" : "file";
+  const noteFields = input.text !== void 0 || input.lang !== void 0 || input.secret !== void 0;
+  if (noteFields && kind !== "text") throw new ZasError("not_a_note", 400);
+  const done = (updateTime) => ({
+    link_id: row.id,
+    channel_id: grant.channel_id,
+    channel_name: channelNameOf(ctx.identity, grant),
+    kind,
+    title: manifest.title ?? manifest.name,
+    update_time: updateTime
+  });
+  if (input.title === void 0 && !noteFields) return done(row.updateTime ?? Date.now());
+  if (input.title !== void 0) {
+    if (input.title === "") delete manifest.title;
+    else manifest.title = input.title;
+  }
+  if (input.text !== void 0) {
+    manifest.text = input.text;
+    manifest.size = new TextEncoder().encode(input.text).length;
+    delete manifest.html;
+    if (manifest.title === void 0) manifest.name = noteName(input.text);
+  }
+  if (input.lang !== void 0) {
+    if (input.lang === "") delete manifest.code;
+    else manifest.code = { lang: input.lang, auto: false };
+  }
+  if (input.secret !== void 0) {
+    if (input.secret) manifest.sensitive = true;
+    else delete manifest.sensitive;
+  }
+  const answer = await ctx.client.api(
+    "PATCH",
+    `/links/${grant.channel_id}/${row.id}`,
+    {
+      manifest_enc: sealedFor(item, manifest),
+      // The caller is changing what the item says: the server records it.
+      edit: true,
+      ...guardOf(item)
+    }
+  );
+  forgetLink(ctx.profile, row.id);
+  return done(typeof answer.update_time === "number" ? answer.update_time : Date.now());
+}
+async function replaceFile(ctx, input, onPhase) {
+  await checkFilePath(input.path);
+  const item = await ownItem(ctx, input.channel, input.id);
+  const { grant, row, manifest } = item;
+  if (manifest.kind === "text") throw new ZasError("not_a_file", 400);
+  const { bytes, name } = await readFileChecked(input.path);
+  const title = input.title ?? manifest.title;
+  const contentHash = await blake3Hex(bytes);
+  const placed = await placeFile(ctx, bytes, onPhase);
+  onPhase?.("finishing");
+  const mime = mimeFor(input.path);
+  const thumb = await thumbnailFor(bytes, mime);
+  const next = newManifest({
+    kind: "file",
+    name,
+    ...title !== void 0 ? { title } : {},
+    mime,
+    size: bytes.length,
+    // The item's own time: a replace changes what the item holds, not when the
+    // owner got it, and the row keeps its place in the channel either way.
+    created_at: manifest.created_at || (/* @__PURE__ */ new Date()).toISOString(),
+    ...thumb ? { thumb_data: thumb } : {},
+    chunks: placed.map((p) => p.entry)
+  });
+  const release = manifest.chunks.map((c) => c.cap).filter((cap) => typeof cap === "string");
+  const answer = await ctx.client.api("POST", `/links/${grant.channel_id}/${row.id}/replace`, {
+    manifest_enc: sealedFor(item, next),
+    caps: placed.map((p) => p.entry.cap).filter((cap) => typeof cap === "string"),
+    release,
+    // Scoped to the link as well as the channel: the same bytes sent as a new
+    // item are a different request from these bytes replacing this one.
+    idempotency_key: agentSendIdempotencyKey(`${grant.channel_id}/${row.id}`, contentHash, title ?? name),
+    ...guardOf(item)
+  });
+  const bound = answer.caps ?? {};
+  let patched = false;
+  for (const p of placed) {
+    const cap = bound[p.entry.blob_id];
+    if (cap) {
+      p.entry.cap = cap;
+      patched = true;
+    }
+  }
+  if (patched) {
+    await ctx.client.api("PATCH", `/links/${grant.channel_id}/${row.id}`, { manifest_enc: sealedFor(item, next) });
+  }
+  forgetLink(ctx.profile, row.id);
+  return {
+    link_id: row.id,
+    channel_id: grant.channel_id,
+    channel_name: channelNameOf(ctx.identity, grant),
+    bytes: bytes.length,
+    chunks: placed.length,
+    deduplicated: placed.filter((p) => p.proven).length,
+    replayed: answer.replayed === true
+  };
+}
+
 // src/receive.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import {
+  closeSync as closeSync2,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
+  openSync as openSync2,
+  renameSync as renameSync3,
+  rmdirSync as rmdirSync2,
+  unlinkSync as unlinkSync2,
+  writeSync as writeSync2
+} from "node:fs";
+import { dirname as dirname2 } from "node:path";
 var OFFER_WAIT_MS2 = 9.5 * 60 * 1e3;
 var OFFER_POLL_MS2 = 1e3;
 var SIGNAL_POLL_MS2 = 400;
@@ -3341,11 +3503,12 @@ async function receiveDirect(ctx, input, report2, deps = {}) {
   const channelName = channelLabel(ctx, grant);
   const cid = grant.channel_id;
   const owner = ctx.identity.owner_uid;
+  const account = channelAccountOf(ctx.identity, grant);
   const device = deps.device ?? newDeviceToken();
   const { seal, open } = sealer(key, grant.key_version);
   const stamp = { device, owner_uid: owner };
   const startedAt = now();
-  const channelPath = `accounts/${owner}/channels/${cid}`;
+  const channelPath = `accounts/${account}/channels/${cid}`;
   report2("waiting");
   const waitUntil = startedAt + (deps.offerWaitMs ?? OFFER_WAIT_MS2);
   let id;
@@ -3480,6 +3643,7 @@ async function receiveDirect(ctx, input, report2, deps = {}) {
     channel_name: channelName,
     offer_id: offerId,
     owner_uid: owner,
+    channel_account: account,
     device,
     ...input.dest !== void 0 ? { dest: input.dest } : {},
     meta: offered,
@@ -3495,7 +3659,7 @@ async function receiveDirectFallback(ctx, record, report2, deps = {}) {
   const { open } = sealer(record.key, record.key_version);
   const stamp = { device: record.device, owner_uid: record.owner_uid };
   const base = `/direct/${record.channel_id}/${record.offer_id}/fallback`;
-  const offerPath = `accounts/${record.owner_uid}/channels/${record.channel_id}/direct/${record.offer_id}`;
+  const offerPath = `accounts/${record.channel_account}/channels/${record.channel_id}/direct/${record.offer_id}`;
   const doc = await ctx.client.firestoreGet(offerPath);
   const enc = stringField2(doc, "fallback_meta_enc");
   let meta;
@@ -3647,6 +3811,8 @@ var PRODUCT_EVENTS = [
   "enterprise.invite_attach",
   "enterprise.invite_accept",
   "enterprise.invite_admin",
+  "enterprise.signin",
+  "enterprise.org_create",
   "enterprise.workspace_opened",
   "enterprise.workspace_switched",
   "enterprise.channel_created",
@@ -3691,7 +3857,17 @@ var PRODUCT_EVENTS = [
   "agent.paired",
   "agent.revoked",
   "agent.send",
-  "agent.tool_call"
+  "agent.edit",
+  "agent.replace",
+  "agent.tool_call",
+  // The public pages, which until now reported nothing at all: `capture_pageview`
+  // is off, so a visitor who read the enterprise page and left was invisible.
+  // These five are the funnel that ends at `enterprise.org_create`.
+  "marketing.page_viewed",
+  "marketing.section_viewed",
+  "marketing.scroll_depth",
+  "marketing.cta_clicked",
+  "marketing.language_switched"
 ];
 var SERVER_OWNED_PRODUCT_EVENTS = [
   "account_created",
@@ -3704,6 +3880,8 @@ var SERVER_OWNED_PRODUCT_EVENTS = [
   "share_downloaded",
   "share_signin_click",
   "agent.send",
+  "agent.edit",
+  "agent.replace",
   "agent.tool_call"
 ];
 var SERVER_OWNED_PRODUCT_EVENT_SET = new Set(SERVER_OWNED_PRODUCT_EVENTS);
@@ -3721,6 +3899,30 @@ var candidateType = oneOf("", "host", "srflx", "relay", "prflx", "other");
 var enterpriseRole = oneOf("owner", "admin", "billing_admin", "member", "guest");
 var agentKind = oneOf("claude_code", "codex", "other");
 var pairHandoff = oneOf("loopback", "manual", "unknown");
+var marketingSurface = oneOf("home", "plans", "enterprise");
+var marketingSection = oneOf(
+  "enterprise_band",
+  "hero",
+  "what",
+  "benefits",
+  "fit",
+  "billing",
+  "signin"
+);
+var marketingCta = oneOf(
+  "see_enterprise",
+  "see_plans",
+  "contact",
+  "start_org",
+  "sign_in",
+  "open_console",
+  "switch_language",
+  "footer_home"
+);
+var marketingPlacement = oneOf("nav", "hero", "band", "fit", "billing", "signin", "footer");
+var arrivalKind = oneOf("direct", "internal", "search", "social", "other");
+var uiLocale = oneOf("es-AR", "pt-BR", "en");
+var signinContext = oneOf("page", "handoff_site", "handoff_share");
 var AGENT_TOOL_NAMES = [
   "status",
   "pair",
@@ -3732,7 +3934,9 @@ var AGENT_TOOL_NAMES = [
   "receive_direct_fallback",
   "list_items",
   "get_item",
-  "jobs"
+  "jobs",
+  "edit_item",
+  "replace_file"
 ];
 var AGENT_ERROR_CODES = [
   "none",
@@ -3777,7 +3981,13 @@ var AGENT_ERROR_CODES = [
   "network",
   "sign_in_failed",
   "bad_signature",
-  "missing_token"
+  "missing_token",
+  // An agent changing its own items (2026-09-09).
+  "not_yours",
+  "stale",
+  "not_a_note",
+  "not_a_file",
+  "item_shared"
 ];
 function agentDurationBucket(ms) {
   if (ms < 1e3) return "lt_1s";
@@ -3838,6 +4048,24 @@ var EVENT_PROPERTY_RULES = {
     role: enterpriseRole,
     external: bool
   },
+  // The workspace sign-in card, wherever it is shown: the public enterprise
+  // page, a `?site=` handoff from a customer domain, or a `?share=` link.
+  "enterprise.signin": {
+    context: signinContext,
+    stage: oneOf(
+      "shown",
+      "email_submitted",
+      "email_sent",
+      "email_failed",
+      "provider_clicked",
+      "link_completed",
+      "link_failed"
+    ),
+    provider: oneOf("google.com", "apple.com", "email_link", "none")
+  },
+  // The end of the funnel. `opened` is the create form appearing, which is
+  // what someone signing in with no organization yet is shown.
+  "enterprise.org_create": { stage: oneOf("opened", "submitted", "created", "failed") },
   "enterprise.workspace_opened": { role: enterpriseRole, first_visit: bool },
   "enterprise.workspace_switched": { destination: oneOf("personal", "organization"), role: enterpriseRole },
   "enterprise.channel_created": { member_count: count },
@@ -3990,9 +4218,32 @@ var EVENT_PROPERTY_RULES = {
   },
   "agent.revoked": { agent_kind: agentKind },
   "agent.send": { size_bucket: sizeBucket, agent_kind: agentKind },
+  "agent.edit": { agent_kind: agentKind },
+  "agent.replace": { size_bucket: sizeBucket, agent_kind: agentKind },
   // What the CLI reports after every tool call: the tool, whether it worked,
   // the code when it did not, and the version that answered. No path, no file
   // name, no channel, no sentence.
+  "marketing.page_viewed": {
+    surface: marketingSurface,
+    locale: uiLocale,
+    // Whether the URL carried a language prefix. `/en/enterprise` and
+    // `/enterprise` are the same page in different languages, and which one
+    // search sends people to is worth knowing on its own.
+    prefixed: bool,
+    signed_in: bool,
+    arrival: arrivalKind
+  },
+  "marketing.section_viewed": { surface: marketingSurface, section: marketingSection },
+  "marketing.scroll_depth": {
+    surface: marketingSurface,
+    depth: oneOf("p25", "p50", "p75", "p100")
+  },
+  "marketing.cta_clicked": {
+    surface: marketingSurface,
+    cta: marketingCta,
+    placement: marketingPlacement
+  },
+  "marketing.language_switched": { surface: marketingSurface, from: uiLocale, to: uiLocale },
   "agent.tool_call": {
     tool: oneOf(...AGENT_TOOL_NAMES),
     result: oneOf("ok", "error"),
@@ -4088,7 +4339,7 @@ async function report(client, properties) {
 
 // src/server.ts
 function agentVersion() {
-  return true ? "0.7.0" : "0.0.0-dev";
+  return true ? "0.9.0" : "0.0.0-dev";
 }
 var AGENT_CUE = " The owner sees every item this agent sends with the >_ agent mark and this agent's name, on every device.";
 var PAIR_ANNOUNCE_MS = 15e3;
@@ -4098,6 +4349,7 @@ var delay = (ms) => new Promise((resolve2) => {
   setTimeout(resolve2, ms);
 });
 function rightsOf(grant) {
+  if (grant.pending) return "waiting for the channel\u2019s owner";
   const rights = [];
   if (grant.send && grant.mode !== "view") rights.push(grant.direct_mode ? "send (Directo)" : "send");
   if (grant.read) rights.push(grant.direct_mode ? "receive (Directo)" : "read");
@@ -4444,6 +4696,45 @@ ${formatDirectDiagLines(job.diag).join("\n")}`) };
       return failed(e);
     }
   });
+  server.registerTool("zas_edit_item", {
+    description: "Change an item this agent sent, keeping its id: the title of a file or a note, or a note's text, language and secret cover. Refuses items sent by anyone else. A file's bytes change with zas_replace_file. Needs a grant that includes reading and sending. Pass only the fields to change; an empty title clears it." + AGENT_CUE,
+    inputSchema: {
+      id: z.string().describe("Item id, as `zas_list_items` reports it."),
+      channel: z.string().optional().describe("Channel name or id. Optional when the agent holds exactly one channel."),
+      title: z.string().optional().describe("New label. An empty string clears it, so the file name or the first line shows again."),
+      text: z.string().optional().describe("New body, for a note."),
+      lang: z.string().optional().describe('Language of the snippet, for highlighting (for example "ts", "py"). An empty string makes it plain text.'),
+      secret: z.boolean().optional().describe("Hide the body behind a cover until the reader opens it. False removes the cover.")
+    }
+  }, async (input) => {
+    try {
+      return text2(await editItem(ctx(), input));
+    } catch (e) {
+      return failed(e);
+    }
+  });
+  server.registerTool("zas_replace_file", {
+    description: "Replace the bytes of a file this agent sent with a file from this machine, keeping the item id, its place in the channel and its pin. Refuses items sent by anyone else, notes, and an item with a public share. Returns the item id, or a job id when the upload takes longer than a minute. Sends any file this process can read; confirm with the owner before sending secrets, keys or credentials." + AGENT_CUE,
+    inputSchema: {
+      id: z.string().describe("Item id, as `zas_list_items` reports it."),
+      path: z.string().describe("Absolute or relative path of the new file."),
+      channel: z.string().optional().describe("Channel name or id. Optional when the agent holds exactly one channel."),
+      title: z.string().optional().describe("New label. Defaults to the label the item has.")
+    }
+  }, async (input) => {
+    try {
+      const c = ctx();
+      const job = runner.start(
+        "replace",
+        input.title ?? input.path,
+        input.channel ?? "",
+        (report2) => replaceFile(c, input, report2)
+      );
+      return settled(await runner.wait(job));
+    } catch (e) {
+      return failed(e);
+    }
+  });
   server.registerTool("zas_jobs", {
     description: "List the sends and Directo transfers this server started, newest first, with the phase each one reached and how it ended \u2014 including any `job_id` a send returned; a finished job keeps its result here." + AGENT_CUE
   }, async () => text2(runner.list()));
@@ -4497,6 +4788,15 @@ var USAGE = [
   "  zas-agent telemetry [on|off]                say what this machine reports, or change it",
   "  zas-agent --version"
 ].join("\n");
+function noticeOnServe(log) {
+  try {
+    if (noticeShown()) return;
+    log(TELEMETRY_NOTICE);
+    markNoticeShown();
+  } catch (e) {
+    log(`Could not record that the notice was shown (${String(e?.message ?? e)}). Serving anyway.`);
+  }
+}
 async function main(argv, log = (l) => console.error(l)) {
   const args = parseArgs(argv);
   if (args.command === "version") {
@@ -4551,10 +4851,7 @@ async function main(argv, log = (l) => console.error(l)) {
     }
     return 0;
   }
-  if (!noticeShown()) {
-    log(TELEMETRY_NOTICE);
-    markNoticeShown();
-  }
+  noticeOnServe(log);
   await buildServer(args.profile).connect(new StdioServerTransport());
   return 0;
 }
@@ -4591,5 +4888,6 @@ if (isInvokedDirectly(process.argv[1], import.meta.url)) {
 export {
   isInvokedDirectly,
   main,
+  noticeOnServe,
   parseArgs
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zas-agent",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "MCP server that lets a coding agent send files and notes into your Zas channels, and send or receive files live through Directo.",
   "type": "module",
   "license": "MIT",