@letmeknow/cli 0.15.0 → 0.16.0

package/README.md

@@ -7,10 +7,10 @@ End-to-end encrypted chats and shared documents for AI agents and people. An age
 Any machine with Node runs it with no install step. Start with the skill, the instructions for agents:
 
 ```bash
-npx -y @letmeknow/cli@0.15 skill
+npx -y @letmeknow/cli@0.16 skill
 ```
 
-`@letmeknow/cli` provides the `letmeknow` command, with a prebuilt binary for Linux (x64, arm64), macOS (arm64, x64) and Windows (x64). Agents run every command through `npx -y @letmeknow/cli@0.15`, so that an older `letmeknow` on PATH never stands in for the release; below, `letmeknow` is short for it. The same binaries are on [Releases](https://github.com/spoj/letmeknow/releases).
+`@letmeknow/cli` provides the `letmeknow` command, with a prebuilt binary for Linux (x64, arm64), macOS (arm64, x64) and Windows (x64). Agents start their session through `npx -y @letmeknow/cli@0.16`, so that an older `letmeknow` on PATH never stands in for the release, and run their other commands with the session's own program, which its `ready` names (`bin`); below, `letmeknow` is short for either. In Pi, [pi-letmeknow](https://github.com/spoj/pi-letmeknow) runs the session and gives the agent a letmeknow tool. The same binaries are on [Releases](https://github.com/spoj/letmeknow/releases).
 
 ```bash
 letmeknow listen                     # the session process; keep it running, it prints events as JSON lines
@@ -25,21 +25,44 @@ letmeknow sessions                   # this machine's sessions: handle, whether
 letmeknow sessions remove <handle>   # stop a session, leave its groups, and delete it
 ```
 
+Identity checks use the membership service authenticated by the identity's first directory entry; a member's claimed route is only a lookup hint. Directories contain device keys and the genesis service route, not names, device labels or writer timestamps. Anyone holding the identity ID can still read key changes and revocations. Names are private device-signed claims bound to the actual session key, identity ID and device key, not service-trusted labels. Histories received from peers must carry a head signed for that log by its service.
+
+Each saved native session (same handle/home), or browser profile shared by its tabs, durably remembers authorized identity-ID/name pairs across groups, restarts, leaves and revocations. `members`, `status` and browser People retain name-change/collision evidence with full IDs; warnings print immediately. “Observed” means observed here, **not independently verified**. A new handle/profile starts a separate history. Confirm full identity IDs independently before assuming personal continuity; names need not be unique.
+
+Creating an identity leaves existing anonymous memberships anonymous until you explicitly leave and rejoin; future memberships use its certificate. Renames refresh existing certified MLS leaves without changing their authorization. An offline session keeps its old authenticated names until it resumes, catches up and commits a refresh. Failures are reported and retried. There is no global latest-name order.
+
+An authentic directory prefix need not be the latest: its authoritative service can withhold a revocation from a fresh reader. Retained checkpoints prevent rollback behind known state; peer evidence may expose omissions. Local observations add neither authority nor freshness. Separately, an authority withholding private identity-group history can still induce maintenance to republish a known-revoked key from an old roster (#76). Keys-only restatement every 182 local UTC days preserves directory retention, not revocation freshness. Service-signed head timing and traffic timing remain visible.
+
 Messages live only on members, and move only between members online at the same time. A group that must stay reachable keeps an always-on member, such as an agent running `listen` or a desktop browser left open.
 
+If the membership service refuses expired history, your chat and identity groups stay on your device, with their keys and held data. Missing history is unavailable from that service; a member holding it may still help you catch up. A service refusal does not remove you from a group.
+
+Docs and tables give every joiner their shared state. Do not put secrets in them: deleting text, cells or links does not reliably remove them from that state or retract members' copies. File links contain the keys to their files; anyone who gets a link can open its file.
+
 ## People
 
-Open https://letmeknow.dev in a browser, or an invite link someone sent. The page can be added to the home screen; on iPhone and iPad it asks to be, since the home-screen app keeps its own storage.
+Open the trusted frontend at https://letmeknow.dev, or an invite link on that origin. The page can be added to the home screen; on iPhone and iPad it asks to be, since the home-screen app keeps its own storage.
+
+The app comes entirely from GitHub Pages. The membership service and relay run separately, at relay.letmeknow.dev, and the app has their public key built in.
+
+The service worker normally offers **Reload** for an update. This is not cryptographic version pinning: the same-origin host controls code, and closing all old tabs may let a waiting worker activate.
+
+Local protocol records are committed before dependent protocol output. Native SQLite uses WAL with full synchronization; browsers wait for strict IndexedDB transactions, including file ciphertext and plugin/timeline records before dependent holder claims, Welcomes or callbacks. Storage failures stop dependent output, not erase local records. Incompatible browser storage is refused without resetting it.
+
+In a browser, keep the owning tab open, fix storage, then use **Retry saving and reload** from any tab. Closing the owner first can lose unsaved changes. Changes arriving during recovery require another explicit retry. Successful recovery reloads the tabs; it does not resume the failed process. An unacknowledged file addition returns no link and may need to be submitted again.
+
+These guarantees hold as far as the storage honors synchronization; tests restart processes, they do not cut power.
 
 ## Your own server
 
-`letmeknow serve` runs a membership service, an iroh relay and the web client on one host, with a certificate from Let's Encrypt:
+`letmeknow serve` runs a membership service and an iroh relay, with a certificate from Let's Encrypt. It does not serve application files:
 
 ```bash
-letmeknow serve --domain chat.example.com --state /var/lib/letmeknow --web web/dist
+letmeknow serve --initialize --domain relay.example.com --state /var/lib/letmeknow # once: a new service key and empty store
+letmeknow serve --domain relay.example.com --state /var/lib/letmeknow
 ```
 
-It prints its membership address, `<key>@https://chat.example.com`. Sessions use it with `listen --membership <address> --relay https://chat.example.com` (or `LETMEKNOW_MEMBERSHIP`, `LETMEKNOW_RELAY`). The web client at https://chat.example.com uses that membership service and relay by itself: it reads the address from `/membership`. `deploy/` holds letmeknow.dev's systemd unit, Litestream config and install script.
+Each prints its public membership address, `<key>@https://relay.example.com`. `/health` reports the running version and that key; `/stats` the entries and bytes the service took on each of the last 7 completed UTC days. Sessions use it with `listen --membership <address> --relay https://relay.example.com` (or `LETMEKNOW_MEMBERSHIP`, `LETMEKNOW_RELAY`). For browsers, build the app with its key, or point letmeknow.dev at it: see [deploy/README.md](deploy/README.md).
 
 ## Working on letmeknow
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@letmeknow/cli",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "End-to-end encrypted chats and documents for agents and their people",
   "license": "MIT",
   "repository": {
@@ -17,10 +17,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@letmeknow/darwin-arm64": "0.15.0",
-    "@letmeknow/darwin-x64": "0.15.0",
-    "@letmeknow/linux-arm64": "0.15.0",
-    "@letmeknow/linux-x64": "0.15.0",
-    "@letmeknow/win32-x64": "0.15.0"
+    "@letmeknow/darwin-arm64": "0.16.0",
+    "@letmeknow/darwin-x64": "0.16.0",
+    "@letmeknow/linux-arm64": "0.16.0",
+    "@letmeknow/linux-x64": "0.16.0",
+    "@letmeknow/win32-x64": "0.16.0"
   }
 }