@needmoretruth/nmts-cli 0.36.1 → 0.36.2

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 Each version's entry is what changed for the person or the program using `nmts`. The product's own
 update history, which covers the site and the server too, is at https://nmts.me/updates.
 
+## 0.36.2 — 2026-09-19
+
+- On Windows, `platform keygen` now restricts the key file instead of only reporting that no file
+  mode applies: it removes the permissions inherited from the folder and grants your account
+  alone (`icacls`). The file is written wherever the command runs, which may be a shared folder.
+  If that step fails the command says so and the file is still written.
+- Three filler words are gone from the advice printed by `share`, a resumed upload and a wallet
+  agreement that asks for too long a term.
+
 ## 0.36.1 — 2026-09-19
 
 - On Windows, `platform keygen` says that the key file inherits its folder's permissions, because

package/README.ko.md

@@ -50,7 +50,7 @@ nmts --help
 
 ```sh
 npm install -g github:needmoretruth/nmts-cli            # 기본 브랜치
-npm install -g github:needmoretruth/nmts-cli#v0.36.1    # 버전을 고정할 때
+npm install -g github:needmoretruth/nmts-cli#v0.36.2    # 버전을 고정할 때
 npm install -g https://github.com/needmoretruth/nmts-cli/releases/latest/download/nmts.tgz
 ```
 

package/README.md

@@ -51,7 +51,7 @@ default branch, from a pinned version, or from the tarball attached to the
 
 ```sh
 npm install -g github:needmoretruth/nmts-cli            # the default branch
-npm install -g github:needmoretruth/nmts-cli#v0.36.1    # a pinned version
+npm install -g github:needmoretruth/nmts-cli#v0.36.2    # a pinned version
 npm install -g https://github.com/needmoretruth/nmts-cli/releases/latest/download/nmts.tgz
 ```
 

package/dist/artifact-about.d.ts

@@ -11,7 +11,7 @@ export declare const CRYPTO_SPEC_URL = "https://github.com/needmoretruth/nmts-re
  *   is the field's own contract — what the writer says about itself — and a person holding two
  *   copies of one account's artefacts can then tell which program made each.
  */
-export declare const WRITTEN_BY = "nmts-cli 0.36.1";
+export declare const WRITTEN_BY = "nmts-cli 0.36.2";
 /** Which of the three artefacts a wrapper is. A reader holding several can sort them. */
 export type ArtifactKind = "recovery-list" | "file-list" | "recovery-kit";
 /**

package/dist/commands/platform.js

@@ -12,7 +12,9 @@
 // ⛔ AND THE FILE IS NEVER REPLACED. `--force` does not open it: the file it would overwrite may
 //    hold the only copy of a key a business is already registered under, and replacing it locks
 //    that business out of its own door with nothing able to bring the key back.
+import { spawnSync } from "node:child_process";
 import { mkdirSync, statSync, writeFileSync } from "node:fs";
+import { userInfo } from "node:os";
 import { isAbsolute, resolve } from "node:path";
 import { modesAreEnforced } from "../credentials.js";
 import { NmtsError } from "../errors.js";
@@ -45,14 +47,42 @@ function keygen(out, say) {
     writeKeyFile(path, keys);
     say(`Public key: ${keys.publicKey}`);
     say(`Written to: ${path}`);
-    // The same sentence `nmts doctor` uses for a stored key: where no mode applies, say so.
     if (!modesAreEnforced()) {
-        say(`Windows applies no POSIX file mode, so this file inherits its folder's permissions ` +
-            `rather than being restricted to one user.`);
+        // ⚠ THIS FILE LANDS WHEREVER THE COMMAND WAS RUN, which may be a shared folder — unlike the
+        //   stored NMTS key, which lives under the user's own profile. So on Windows the mode is not
+        //   merely reported as absent: the file is cut off from the folder's permissions.
+        say(restrictToCurrentUser(path)
+            ? `Inherited permissions were removed; only your Windows account can open this file.`
+            : `Windows applies no POSIX file mode, and restricting the file with icacls failed, so it ` +
+                `inherits its folder's permissions. Move it somewhere only you can read.`);
     }
     say(`Register the public key at ${HOME_URL} — ${REGISTER_PATH}. The private half stays in that file.`);
     return 0;
 }
+/**
+ * Windows only: drop the inherited entries and grant the current account alone.
+ *
+ * ⛔ `icacls`, NOT A HAND-ROLLED ACL. It ships with every supported Windows, and this is the shape
+ *    OpenSSH asks of a private key there. One invocation does both halves, so there is no moment
+ *    with the inheritance gone and nobody granted.
+ * ⚠ A FAILURE IS REPORTED, NOT THROWN: the pair is already written and is the only copy, so the
+ *   command must still print the public half and say plainly what protects the file.
+ */
+function restrictToCurrentUser(path) {
+    try {
+        const name = userInfo().username;
+        const domain = process.env.USERDOMAIN;
+        const account = domain === undefined || domain === "" ? name : `${domain}\\${name}`;
+        const done = spawnSync("icacls", [path, "/inheritance:r", "/grant:r", `${account}:F`], {
+            windowsHide: true,
+            stdio: "ignore",
+        });
+        return done.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Say where registering happens, and stop.
  *
@@ -101,9 +131,8 @@ function targetFor(out) {
  * ⚠ `wx` FAILS IF THE NAME APPEARED SINCE THE CHECK ABOVE, which is the point of using it rather
  *   than trusting that check: between the two, something else may have written there.
  *
- * ⚠ ON WINDOWS THE MODE IS IGNORED and the file inherits the folder's permissions — the same limit
- *   every other file this tool writes has, and claiming otherwise would claim a guarantee the
- *   platform does not give.
+ * ⚠ ON WINDOWS THE MODE IS IGNORED; `keygen` restricts the file afterwards with `icacls` and says
+ *   which of the two happened.
  */
 function writeKeyFile(path, keys) {
     mkdirSync(resolve(path, ".."), { recursive: true, mode: 0o700 });

package/dist/commands/share.js

@@ -114,7 +114,7 @@ export async function share(target, typedAddress, options = {}) {
         if (typeof identityB64 !== "string") {
             throw new NmtsError("That public code has never published an identity to share to.", {
                 exitCode: 4,
-                nextStep: "Nothing was shared. The code may be right and simply unused — somebody has to open " +
+                nextStep: "Nothing was shared. The code may be right and unused — somebody has to open " +
                     "their account once before anything can be encrypted to them.",
             });
         }

package/dist/product.d.ts

@@ -9,7 +9,7 @@ export declare const BINARY_NAME = "nmts";
  *    beside it. Here rather than in `main.ts` because the MCP server has to say it too, and a
  *    command importing the entry point is a cycle waiting to bite.
  */
-export declare const VERSION = "0.36.1";
+export declare const VERSION = "0.36.2";
 /** Where the product lives, for messages that need to send somebody somewhere real. */
 export declare const HOME_URL = "https://nmts.me";
 /** The source, so a person holding only the built program can find what it was built from. */

package/dist/product.js

@@ -18,7 +18,7 @@ export const BINARY_NAME = "nmts";
  *    beside it. Here rather than in `main.ts` because the MCP server has to say it too, and a
  *    command importing the entry point is a cycle waiting to bite.
  */
-export const VERSION = "0.36.1";
+export const VERSION = "0.36.2";
 /** Where the product lives, for messages that need to send somebody somewhere real. */
 export const HOME_URL = "https://nmts.me";
 /** The source, so a person holding only the built program can find what it was built from. */

package/dist/upload-steps.js

@@ -49,7 +49,7 @@ export async function pushPart(input, step) {
             message: why(error),
             paid: true,
             nextStep: "The bytes are on the network. Certifying moves no money, so running the same command " +
-                "again simply finishes the job.",
+                "again finishes the job.",
         });
     }
 }

package/dist/wallet-grant.js

@@ -80,7 +80,7 @@ export function parseWalletGrant(input, now, version) {
     if (expiresMs > ceiling) {
         throw new NmtsError(`A wallet agreement lasts at most ${MAX_GRANT_DAYS} days.`, {
             exitCode: 2,
-            nextStep: `Grant it again when it runs out. That is the point: a grant nobody remembers giving should run out on its own.`,
+            nextStep: `Grant it again when it runs out. An agreement ends on its own so that one nobody remembers giving does not stay open.`,
         });
     }
     return {

package/docs/commands/platform.md

@@ -4,7 +4,8 @@ Commands: platform
 Tiers: platform=none · platform.keygen=medium
 
 `platform keygen` makes an Ed25519 key pair and writes both halves to `nmts-business-key.json`, or
-to `--out <file>`, with mode 0600 (Windows applies no file mode, and the command says so). It
+to `--out <file>`, with mode 0600 (on Windows, where no file mode applies, it removes the inherited
+permissions with `icacls` and leaves your account alone on the file, and says so if that fails). It
 refuses a name that already exists, whatever `--force` says, and prints only the public half.
 `platform register` cannot register it: that needs a signed-in browser session at nmts.me, under
 Settings › Developer › Platform, and the command prints that path and exits 2.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@needmoretruth/nmts-cli",
-  "version": "0.36.1",
+  "version": "0.36.2",
   "description": "Command-line and MCP access to NMTS (NeedMoreTruthStorage, https://nmts.me): open-source, end-to-end encrypted storage on the Walrus network. No fee to NMTS; you pay the network from your own wallet. For people and for their agents.",
   "license": "Apache-2.0",
   "publishConfig": {