@getdial/cli 0.37.0 → 0.37.2

package/dist/commands/auth/verify-otp.js

@@ -116,7 +116,7 @@ function reportPendingPhone(result, json) {
                 action: "ask_user",
                 kind: "phone_number_required",
                 question: "What phone number should this Dial account be registered to?",
-                rationale: "Creating a Dial account requires a verified phone number as well as a verified email. Dial texts a 6-digit code to the number, and the user reads it back. The number is linked to the account permanently — a number can register only one Dial account — so it should be one the user keeps. It must be able to receive SMS, and a Dial number cannot be used.",
+                rationale: "Creating a Dial account requires a verified phone number as well as a verified email. Dial texts a 6-digit code to the number, and the user reads it back. It should be a number the user keeps, it must be able to receive SMS, and a Dial number cannot be used.",
                 presentation: "Ask for the number in international form including the country code. Don't invent one, and don't reuse a Dial number.",
                 useStructuredToolIfAvailable: true,
                 onAnswer: REGISTER_NUMBER_COMMAND,
@@ -134,8 +134,7 @@ function reportPendingPhone(result, json) {
     console.log(``);
     console.log(`    ${REGISTER_NUMBER_COMMAND}`);
     console.log(``);
-    console.log(`That number is linked to the account permanently — a number can register only one`);
-    console.log(`Dial account — so use one the user keeps. A Dial number can't be used here.`);
+    console.log(`Use a number the user keeps. A Dial number can't be used here.`);
     console.log(``);
     console.log(`Dial texts a 6-digit code to it; then run:`);
     console.log(``);

package/dist/lib/versioned-file.js

@@ -2,6 +2,14 @@ import { chmodSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, w
 import { join } from "node:path";
 import { logger } from "./log.js";
 const CHMOD_UNSUPPORTED_CODES = new Set(["ENOTSUP", "EOPNOTSUPP", "EPERM"]);
+/**
+ * Windows has no POSIX permission bits: Node synthesizes mode 0o666 (or 0o444
+ * for read-only files) regardless of the file's ACL, and chmod can only toggle
+ * the read-only flag. Enforcing `secure` there would reject every file we just
+ * wrote ourselves, so access control falls to the ACL on the per-user state
+ * directory instead.
+ */
+const hasPosixModes = () => process.platform !== "win32";
 function ensureDir(dir) {
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     try {
@@ -41,7 +49,7 @@ export function defineVersionedFile(opts) {
     /** v0 is the legacy unversioned `<base>.json`. */
     const filePath = (version) => join(opts.dir(), version === 0 ? `${opts.base}.json` : `${opts.base}.v${version}.json`);
     function parseAt(path) {
-        if (opts.secure) {
+        if (opts.secure && hasPosixModes()) {
             const fileMode = statSync(path).mode & 0o777;
             if (fileMode & 0o077) {
                 throw new Error(`${path} has insecure permissions (mode ${fileMode.toString(8)})`);

package/dist/mcp/tools/auth-register-number.js

@@ -17,9 +17,8 @@ export const authRegisterNumberTool = {
         title: "Auth Register Number",
         description: "Text a 6-digit verification code to the phone number that will own the account. Required to " +
             "CREATE an account (never needed to sign in), and only valid after auth_verify_otp reported " +
-            "that a phone number is still required. The number becomes permanently bound to this " +
-            "account — a number can register only one Dial account. Submit the texted code with " +
-            "auth_verify_otp using number: true.",
+            "that a phone number is still required. It should be a number the user keeps. Submit the " +
+            "texted code with auth_verify_otp using number: true.",
         inputSchema,
         outputSchema: {
             registrationId: z.string(),

package/dist/mcp/tools/auth-verify-otp.js

@@ -121,7 +121,7 @@ export const authVerifyOtpTool = {
                 email: r.email,
                 skills: r.skills,
                 nextTool: "auth_register_number",
-                note: "The email is verified, but creating an account also requires a verified phone number. ASK THE USER for a phone number that can receive SMS, then call auth_register_number with it. No API key has been issued yet. The number is bound to the account permanently, and a Dial number cannot be used.",
+                note: "The email is verified, but creating an account also requires a verified phone number. ASK THE USER for a phone number that can receive SMS, then call auth_register_number with it. No API key has been issued yet. It should be a number the user keeps, and a Dial number cannot be used.",
             });
         }
         // Never surface the raw API key to the model; it's saved to disk for the CLI to read.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getdial/cli",
-  "version": "0.37.0",
+  "version": "0.37.2",
   "description": "Dial CLI — install, sign up, and run the local listen service.",
   "license": "MIT",
   "repository": {