CLI 0.6.0 — hosted Threads and Vaults

CLI 0.6.0 — hosted Threads and Vaults

The CLI can now name, read and answer a hosted Thread, list your Vaults, and run under an
app that holds its own sign-in.

• ideaspaces vaults --json lists the Vaults you can reach (GET /vaults, unchanged).
• ideaspaces threads list --hosted, threads open x_<32 hex> (the head and one page;
  --cursor pages back or forward), threads post x_<32 hex> --reply-to <post> --message …,
  threads new --hosted and threads ack x_<32 hex> --cursor|--seq. A post is sent as
  text/plain and never retried on its own; --post-id resends the same bytes. A post's
  author and date come from the service's record. A 404 means absent or no access.
• The exchange posts feed (threads posts) is unchanged and still calls GET /threads/posts.
• A local Thread folder without its own _agent/agreement.md can be read and answered; the
  CLI warns once that it has none. A symlinked or dangling Agreement is still refused, and so
  is a reply to a post that is not in the Thread. The enclosing Space still needs its
  Agreement.
• IDEASPACES_AUTH=host, for an app that runs this CLI inside agent sessions: the process
  never reads, locks, refreshes, writes or deletes credentials.json, ignores IS_API_KEY,
  and refuses every remote call, public reads included. login, power logout and the Git
  credential helper refuse explicitly. Only the hosted Thread and Vault verbs above can call
  out, and only with a token passed on --token-fd <n>: read once to EOF before the command
  runs, then closed, held in memory, never refreshed, written, logged or echoed. This keeps a
  session from spending or changing the terminal's sign-in; it is not a wall against a
  same-user process reading the file.

vaults --json passes the service's response through unchanged, by design: the CLI does not
own the Vaults shape. --token-fd consumes its descriptor: the CLI closes it once read.

What has been checked against the service

Verb	Route	Checked
threads open x_<32 hex>	GET /threads/{id}, GET /threads/{id}/posts	Yes: the same calls the desktop app's own hosted Thread client makes.
threads list --hosted	GET /threads	Yes: listed a real hosted Thread, read-only, on 2026-10-30.
threads post x_<32 hex>	POST /threads/{id}/posts	The desktop app's client makes the same call. No post was sent from this CLI.
threads new --hosted, threads ack, vaults	POST /threads, POST /threads/{id}/ack, GET /vaults	Not yet. Covered by tests against recorded responses only. These verbs are new, so no existing command depends on them. A route the service does not serve fails as a named not_found or unavailable state, never as a silent write.

Install: npm install -g @ideaspaces/cli@0.6.0 (Node 20+ and Git).

Consumer handoff

Publication is approved for the standalone CLI. It opens no Claude Code plugin batch.

Consumer	Decision / follow-up
MCP server	Unchanged. It never sets IDEASPACES_AUTH=host. is_threads still shells threads open/reply for exchange ids (x_ + 24 hex), which route as before; it does not offer the 32-hex hosted Thread verbs in this cut.
Skills	Unchanged. No skill teaches the new verbs yet; the existing threads commands keep their names and flags.
Pi integration	Still pins CLI commit 75efa91f (0.2.21); unchanged here. The pin moves with the next Pi change.
Claude Code plugin	Still vendors CLI 0.5.0 (d402284). Re-vendoring waits for the human to open the next batch.

The desktop app is the consumer this cut is for: it runs the CLI with IDEASPACES_AUTH=host
and passes its own token on --token-fd. It vendors this release by its merge commit.

Source: the hosted Thread, Vault and host-auth commits, reviewed and merged with this
release's version bump. The bundle is byte-identical to the one built from those commits
before the bump; the version is not embedded in it.