@brmbh/tack 0.1.0 → 0.1.2

package/README.md

@@ -14,7 +14,12 @@ HTML, Vite, Next, Astro, WordPress, PHP. It runs only on your machine.
 
 ## Install
 
-**With your agent** (Claude Code, Codex, Cursor, Gemini CLI, Copilot…): paste this into it, in your project.
+**Which agent:** the coding agent that works **in your project folder**, the one that can read and
+change your files and knows your codebase (Claude Code, Codex, Cursor, Gemini CLI, Copilot,
+opened in that folder). Not a browser chat like claude.ai or ChatGPT: it can't see your code, so
+it can't act on the notes. Tack points; that agent finds the right place in your code or CMS.
+
+**With your agent:** paste this into it, in your project.
 
 ```text
 Set me up to use Tack in this project. Run `npx -y @brmbh/tack@latest init` in the project root;
@@ -61,7 +66,8 @@ Feedback is written to `<project>/.tack/`, as `notes.json` (the source of truth)
 
 1. **Skill** (Claude Code, Codex, Cursor and every agent that reads `.agents/skills`): run
    `tack init` in the project, or `tack init --global`, then tell the agent "do the tack notes".
-2. **MCP**: `claude mcp add tack -- tack mcp`. Tools: `tack_list`, `tack_get`,
+2. **MCP**: `claude mcp add tack -- tack mcp` (without a global install:
+   `claude mcp add tack -- npx -y @brmbh/tack mcp`). Tools: `tack_list`, `tack_get`,
    `tack_resolve`, `tack_reply`.
 3. **CLI** (any agent that can run shell commands):
    ```bash
@@ -123,6 +129,14 @@ in the project). Point it at notes outside the repo with `.tack/config.json`:
 It never writes files, and refuses `.env*`, keys and `.git/`. What it reads is sent to the
 model provider you chose.
 
+**Security.** tack listens on `127.0.0.1` only and answers only requests addressed to
+`localhost` / `127.0.0.1` (a foreign site re-resolved to your machine, "DNS rebinding", gets
+`421`). Every write to its API must come from tack's own pages, or from a tool without a
+browser such as the CLI, and be JSON, so other sites open in your browser can't change
+settings or spend your tokens. The key file is plain text with mode 600, like `~/.npmrc`:
+any program running as your user can read it. Prefer the env vars if you keep keys in a
+secrets manager. `--host 0.0.0.0` turns the host check off (you're exposing tack on purpose).
+
 ## Options
 
 ```
@@ -154,8 +168,15 @@ model provider you chose.
   (`is-*`, `split-*`, `line`, `word`…) never go into selectors, and a pin is only drawn if the
   element's tag and text still match. Otherwise tack looks for the element by text.
 - **Redirects** pass through with their `Location` (rewritten when it points back at the
-  target). A redirect to another host (apex → `www`, locale subdomains) leaves the proxy: use
-  the final URL as `--target`.
+  target). If the target's root redirects to another host at startup (apex → `www`,
+  http → https), tack proxies the final host instead. A later redirect to another host
+  (e.g. a locale subdomain) leaves the proxy; tack prints and logs the `--target` to use.
+- **One tack per project**: starting tack again for the same project with another `--target`
+  switches the running proxy (same port, notes kept) instead of starting a second one.
+  Tools can do the same with `POST /__tack/api/target {"target": "…"}`.
+- **For tools on the page**: `window.__tack` carries `version` and `contract` (the page-event
+  contract version); `/__tack/api/status` reports both. Nothing is added to `<html>` and the
+  console bridge removes its own `<script>`, so SSR hydration (React, Next) sees the server's markup.
 - **Revalidation**: conditional request headers are stripped, so every request gets a full
   response. A passed-through 304 had turned into an empty 200 (a broken web manifest).
 
@@ -172,12 +193,12 @@ Requires [Bun](https://bun.sh) ≥ 1.2 to develop; users get a compiled binary.
 ## Release
 
 ```bash
-bun run build          # dist/npm/tack + dist/npm/tack-<platform> (5 binaries)
-npm login              # once, account with publish rights on @brmbh
-for d in dist/npm/tack-*; do (cd "$d" && npm publish --access public); done
-(cd dist/npm/tack && npm publish --access public)    # last: it depends on the binaries
+# bump "version" in package.json, commit
+bun run release --dry-run   # checks, build of all 5 binaries, smoke test of this platform
+bun run release             # the same, then publish (platform packages first), wait for npm, tag vX.Y.Z
 ```
 
-Bump `version` in `package.json` first; every package gets the same version.
-Known limit: the darwin-x64 binary crashes under Rosetta (x64 Node on Apple Silicon), real
-Intel Macs are fine. Use an arm64 Node on Apple Silicon.
+Run it in a real terminal: with a passkey, npm confirms each package in the browser
+(`--auth-type=web`). A granular npm token with publish rights on `@brmbh/tack*` and 2FA bypass
+(in `NPM_TOKEN` or `~/.npmrc`) skips the confirmations. CI (`release-smoke`) builds and
+smoke-tests every platform on its own runner on each push.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@brmbh/tack",
-	"version": "0.1.0",
+	"version": "0.1.2",
 	"description": "Point at your running site, comment or edit text in place, and hand the feedback to your coding agent.",
 	"license": "UNLICENSED",
 	"homepage": "https://github.com/brmbh/tack",
@@ -26,10 +26,10 @@
 		"node": ">=18"
 	},
 	"optionalDependencies": {
-		"@brmbh/tack-darwin-arm64": "0.1.0",
-		"@brmbh/tack-darwin-x64": "0.1.0",
-		"@brmbh/tack-linux-x64": "0.1.0",
-		"@brmbh/tack-linux-arm64": "0.1.0",
-		"@brmbh/tack-windows-x64": "0.1.0"
+		"@brmbh/tack-darwin-arm64": "0.1.2",
+		"@brmbh/tack-darwin-x64": "0.1.2",
+		"@brmbh/tack-linux-x64": "0.1.2",
+		"@brmbh/tack-linux-arm64": "0.1.2",
+		"@brmbh/tack-windows-x64": "0.1.2"
 	}
 }