@rikaidev/yomi 0.4.1 → 0.5.0

package/dist/line/core/message-preview.js

@@ -0,0 +1,60 @@
+/**
+ * Convert raw/decrypted LINE payloads into safe user-facing preview text.
+ *
+ * E2EE media envelopes are transport data, not message text. They commonly
+ * contain keyMaterial, keys, chunks, ciphertext, or nonce fields. This
+ * boundary must be shared by every conversation/message output path so a raw
+ * message cannot bypass the decrypted-path sanitizer.
+ */
+const OPAQUE_FIELD = /(?:^|["'\s,{])(keymaterial|keys|chunks|ciphertext|nonce)\s*["']?\s*:/i;
+const OPAQUE_TOKEN = /\b(?:keymaterial|ciphertext|nonce)\b/i;
+function isRecord(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+function containsOpaqueField(value) {
+    if (typeof value === 'string') {
+        return (OPAQUE_FIELD.test(value) ||
+            (value.trim().startsWith('{') && OPAQUE_TOKEN.test(value)));
+    }
+    if (Array.isArray(value))
+        return value.some(containsOpaqueField);
+    if (!isRecord(value))
+        return false;
+    return Object.entries(value).some(([key, nested]) => /^(keymaterial|keys|chunks|ciphertext|nonce)$/i.test(key) ||
+        containsOpaqueField(nested));
+}
+/** Return only actual user text; opaque E2EE envelopes return an empty string. */
+export function sanitizeMessagePreview(value) {
+    if (containsOpaqueField(value))
+        return '';
+    if (typeof value !== 'string') {
+        if (!isRecord(value))
+            return '';
+        for (const key of ['text', 'message', 'body', 'content', 'caption']) {
+            const nested = sanitizeMessagePreview(value[key]);
+            if (nested)
+                return nested;
+        }
+        return '';
+    }
+    const text = value.trim();
+    if (!text)
+        return '';
+    if (!text.startsWith('{') && !text.startsWith('['))
+        return text;
+    try {
+        const parsed = JSON.parse(text);
+        if (!isRecord(parsed))
+            return '';
+        for (const key of ['text', 'message', 'body', 'content', 'caption']) {
+            const nested = sanitizeMessagePreview(parsed[key]);
+            if (nested)
+                return nested;
+        }
+        return '';
+    }
+    catch {
+        // A non-JSON message beginning with punctuation is still normal text.
+        return text;
+    }
+}

package/dist/line/core/message-query-service.js

@@ -137,25 +137,5 @@ export function createMessageQueryService(getClient, e2eeManager) {
             });
             return decryptLineMessages(e2eeManager, messages, chatId);
         },
-        /**
-         * Download the original LINE content bytes for one message.
-         *
-         * @param messageId - LINE message identifier
-         * @param requestId - Optional request identifier
-         * @returns Original message content bytes
-         */
-        async downloadMessageContent(messageId, requestId = `yomi-${Date.now()}`) {
-            return requireLineClient(getClient).downloadMessageContent(messageId, requestId);
-        },
-        /**
-         * Download the LINE preview bytes for one message.
-         *
-         * @param messageId - LINE message identifier
-         * @param requestId - Optional request identifier
-         * @returns Preview content bytes
-         */
-        async downloadMessageContentPreview(messageId, requestId = `yomi-${Date.now()}`) {
-            return requireLineClient(getClient).downloadMessageContentPreview(messageId, requestId);
-        },
     };
 }

package/dist/line/core/service.js

@@ -62,6 +62,7 @@ export class LineProtocolService extends EventEmitter {
     getContact;
     getGroup;
     listStickerPackages;
+    getAllMessageBoxes;
     searchStickerPackages;
     sendMessage;
     sendImage;
@@ -73,8 +74,6 @@ export class LineProtocolService extends EventEmitter {
     sendLocation;
     getRecentMessages;
     getPreviousMessages;
-    downloadMessageContent;
-    downloadMessageContentPreview;
     markChatRead;
     renameGroup;
     inviteToGroup;

package/dist/mcp/handlers/conversations.js

@@ -1,3 +1,4 @@
+import { sanitizeMessagePreview } from '../../line/core/message-preview.js';
 import { decryptLineMessage } from '../../line/core/message-query-service.js';
 import { getExcludedChatIds } from '../../search/scope.js';
 import { createCliLogger } from '../../util/log.js';
@@ -6,6 +7,16 @@ import { resolveConversationNames, resolveSenderNames } from '../names.js';
 import { createPhiAccumulator, maskInto, phiNote } from '../phi-guard.js';
 import { jsonResult, toolError, toonText } from './shared.js';
 const log = createCliLogger('Yomi');
+function messageTimestamp(message) {
+    return Number(message?.deliveredTime || message?.createdTime || 0);
+}
+function latestMessage(messages) {
+    if (!Array.isArray(messages) || messages.length === 0)
+        return null;
+    return messages.reduce((latest, candidate) => messageTimestamp(candidate) >= messageTimestamp(latest)
+        ? candidate
+        : latest);
+}
 /**
  * Handle `list_conversations` — list LINE conversations (chats, groups, rooms)
  * with unread counts, a last-message preview, and a resolved display name.
@@ -15,6 +26,13 @@ const log = createCliLogger('Yomi');
  * @returns MCP tool result.
  */
 export async function handleListConversations(service, args) {
+    try {
+        await service.client.syncLongPoll(50, 1000);
+        if (service.sessionState?.saveSyncRevisions) {
+            await service.sessionState.saveSyncRevisions(Number(service.client.revision || 0), Number(service.client.globalRevision || 0), Number(service.client.individualRevision || 0));
+        }
+    }
+    catch { }
     const result = await service.client.getMessageBoxes({
         lastMessagesPerMessageBoxCount: 1,
         messageBoxCountLimit: args.limit ?? 20,
@@ -30,13 +48,27 @@ export async function handleListConversations(service, args) {
     // decrypted.
     const acc = createPhiAccumulator();
     const conversations = await Promise.all(boxes.map(async (box) => {
-        const lastMessage = box.lastMessages?.[box.lastMessages.length - 1] || null;
+        let lastMessage = latestMessage(box.lastMessages);
+        const cursorTime = Number(box.lastDeliveredMessageId?.deliveredTime || 0);
+        if (box.id &&
+            (!lastMessage || messageTimestamp(lastMessage) < cursorTime)) {
+            try {
+                const recent = await service.getRecentMessages(box.id, 1);
+                const candidate = latestMessage(recent);
+                if (candidate &&
+                    messageTimestamp(candidate) >= messageTimestamp(lastMessage)) {
+                    lastMessage = candidate;
+                }
+            }
+            catch { }
+        }
         const decryptedLastMessage = lastMessage
             ? await decryptLineMessage(service.e2eeManager, lastMessage, box.id)
             : null;
+        const previewText = sanitizeMessagePreview(decryptedLastMessage?.text ?? lastMessage?.text);
         return {
             id: box.id,
-            lastMessagePreview: maskInto(acc, decryptedLastMessage?.text ?? null),
+            lastMessagePreview: maskInto(acc, previewText || (lastMessage?.text ? '[加密訊息]' : null)),
             name: names.get(box.id) ?? null,
             unreadCount: box.unreadCount ?? 0,
         };
@@ -104,7 +136,8 @@ export async function handleGetChatMessages(service, args) {
         // be observed against a live mentioning message before anyone builds
         // the outbound (send-a-mention) side.
         mentions: message.contentMetadata?.MENTION ?? null,
-        text: maskInto(acc, message.text),
+        text: maskInto(acc, sanitizeMessagePreview(message.text) ||
+            (message.text ? '[加密訊息]' : null)),
         e2eeDecrypted: message.e2eeDecrypted ?? null,
         // Emitted ONLY when the message decrypted but could not be authenticated
         // (LINE E2EE v1 — AES-CBC, no tag, no AAD), so its presence is a signal
@@ -175,7 +208,7 @@ export async function handleGetUnreadDigest(service, args) {
                 mediaType: resolveLineMediaDescriptor(m) !== null
                     ? resolveLineMediaType(Number(m.contentType))
                     : null,
-                text: maskInto(acc, m.text),
+                text: maskInto(acc, sanitizeMessagePreview(m.text) || (m.text ? '[加密訊息]' : null)),
             })),
         };
     }));

package/dist/mcp/handlers/login.js

@@ -44,7 +44,7 @@ function elicitPinAcknowledgement(server, pin, onDeclined) {
  * Handle `login` on a LEGACY-era connection whose client supports form
  * elicitation — drive the passwordless flow entirely through pushed
  * elicitation requests, with no out-of-band channel required. A pre-flight
- * form confirms the 允許自其他裝置登入 prerequisite (and collects
+ * form confirms the allow-login-from-other-devices prerequisite (and collects
  * phone/region when missing) BEFORE any PIN is issued; the PIN is then
  * surfaced through a second elicitation fired without blocking
  * `runPwlessLogin`, which keeps running while the human acts on their phone.

package/dist/mcp/handlers/message-actions.js

@@ -4,7 +4,7 @@ const log = createCliLogger('Yomi');
 /**
  * Handle `react_message` — REALLY adds a predefined reaction to a real LINE
  * message now (TalkService react). Visible to the conversation. `reactionType`:
- * 2=LIKE 👍, 3=LOVE ❤️, 4=LAUGH 😆, 5=SURPRISE 😮, 6=SAD 😢, 7=ANGRY 😡
+ * Protocol emoji mapping: 2=LIKE 👍, 3=LOVE ❤️, 4=LAUGH 😆, 5=SURPRISE 😮, 6=SAD 😢, 7=ANGRY 😡
  * (default 2).
  *
  * @param service - Resumed LineProtocolService.

package/dist/mcp/handlers/search.js

@@ -17,7 +17,7 @@
  * result that either method ranks highly surfaces near the top. This is
  * deliberately not "semantic OR keyword": pure semantic over a partially-
  * embedded index silently drops exact matches that live in un-embedded
- * messages (the "search 台東 misses the chat that literally says 台東" bug),
+ * messages (the "search for a place name misses the exact same place name" bug),
  * and pure keyword misses paraphrases. Which methods actually contributed
  * is always reported via the `mode` field (`hybrid` | `semantic` |
  * `keyword`), never hidden.

package/dist/mcp/handlers/shared.js

@@ -6,7 +6,7 @@ import { encode } from '@toon-format/toon';
  * under src/mcp/handlers/ can import these without a circular dependency.
  */
 // Yomi logs in on its own (via the `login`/`login_complete` tools, or
-// `npx @rikaidev/yomi login`); it does not depend on inboxd for anything.
+// `npx @rikaidev/yomi login`); session is shared with Yomi Desktop.
 export const NO_CREDENTIALS_MESSAGE = 'No persisted LINE session. Call the `login` tool, or run `npx @rikaidev/yomi login` in a terminal.';
 // Shown when LINE invalidated a previously working session — distinct from
 // "never logged in" so the model tells the user the right story: the MCP

package/dist/mcp/integrator.js

@@ -0,0 +1,168 @@
+/**
+ * Universal 1-Click MCP Integrator for Claude Desktop, Claude Cowork, Codex, Cursor, Windsurf, VS Code (Cline/Roo).
+ * Also automatically generates and registers Yomi Skills for AI Agent assistants.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+export function getClientTargets() {
+    const home = homedir();
+    return [
+        {
+            id: 'claude-desktop',
+            name: 'Claude Desktop & Cowork',
+            configPath: join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'),
+            configType: 'mcpServers',
+            requiresApp: '/Applications/Claude.app',
+        },
+        {
+            id: 'codex-desktop',
+            name: 'Codex Desktop & CLI',
+            configPath: join(home, '.codex', 'mcp.json'),
+            configType: 'mcpServers',
+        },
+        {
+            id: 'cursor',
+            name: 'Cursor IDE',
+            configPath: join(home, '.cursor', 'mcp.json'),
+            configType: 'mcpServers',
+            requiresApp: '/Applications/Cursor.app',
+        },
+        {
+            id: 'windsurf',
+            name: 'Windsurf (Codeium)',
+            configPath: join(home, '.codeium', 'windsurf', 'mcp_config.json'),
+            configType: 'mcpServers',
+            requiresApp: '/Applications/Windsurf.app',
+        },
+        {
+            id: 'cline',
+            name: 'VS Code (Cline)',
+            configPath: join(home, 'Library', 'Application Support', 'Code', 'User', 'globalStorage', 'saoudrizwan.claude-dev', 'settings', 'cline_mcp_settings.json'),
+            configType: 'mcpServers',
+        },
+        {
+            id: 'roo-code',
+            name: 'VS Code (Roo Code)',
+            configPath: join(home, 'Library', 'Application Support', 'Code', 'User', 'globalStorage', 'rooveterinaryinc.roo-cline', 'settings', 'cline_mcp_settings.json'),
+            configType: 'mcpServers',
+        },
+        {
+            id: 'claude-cli',
+            name: 'Claude Code CLI',
+            configPath: join(home, '.claude.json'),
+            configType: 'mcpServers',
+        },
+    ];
+}
+export function getYomiMcpDefinition() {
+    const home = homedir();
+    const npxPath = existsSync('/opt/homebrew/bin/npx')
+        ? '/opt/homebrew/bin/npx'
+        : existsSync('/usr/local/bin/npx')
+            ? '/usr/local/bin/npx'
+            : 'npx';
+    return {
+        command: npxPath,
+        args: ['-y', '@rikaidev/yomi'],
+        env: {
+            PATH: `${home}/.local/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`,
+        },
+    };
+}
+export function installYomiAgentSkill() {
+    const home = homedir();
+    const skillContent = `---
+name: yomi-line-manager
+description: Manage and interact with user's LINE account via Yomi E2EE MCP Server. Query messages, summarize chats, search history, find contacts, and draft replies.
+---
+
+# Yomi LINE Copilot Skill
+
+You have real-time access to the user's LINE account through the Yomi Letter-Sealing E2EE MCP Server.
+
+## Capabilities
+1. \`get_recent_messages\`: Retrieve recent decrypted messages.
+2. \`search_messages\`: Full-text search across conversations.
+3. \`list_contacts\`: Retrieve friends and group information.
+4. \`send_message\`: Send messages to chats with confirmation.
+
+## Guidelines
+- Summarize conversations concisely and highlight action items or mentions needing attention.
+- When drafting a reply, ask the user for confirmation before executing \`send_message\`.
+`;
+    const skillDirs = [
+        join(home, '.claude', 'skills', 'yomi-line-manager'),
+        join(home, '.gemini', 'antigravity-cli', 'builtin', 'skills', 'yomi-line-manager'),
+        join(home, '.codex', 'skills', 'yomi-line-manager'),
+    ];
+    let installedPath = '';
+    for (const dir of skillDirs) {
+        try {
+            if (!existsSync(dir)) {
+                mkdirSync(dir, { recursive: true, mode: 0o755 });
+            }
+            const skillFile = join(dir, 'SKILL.md');
+            writeFileSync(skillFile, skillContent, { mode: 0o644 });
+            installedPath = skillFile;
+        }
+        catch {
+            // Ignore directory write failures for optional tools
+        }
+    }
+    return { success: true, path: installedPath };
+}
+export function integrateClient(target) {
+    try {
+        const dir = dirname(target.configPath);
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true, mode: 0o755 });
+        }
+        let config = {};
+        if (existsSync(target.configPath)) {
+            try {
+                const raw = readFileSync(target.configPath, 'utf8');
+                config = JSON.parse(raw);
+            }
+            catch {
+                config = {};
+            }
+        }
+        if (!config.mcpServers || typeof config.mcpServers !== 'object') {
+            config.mcpServers = {};
+        }
+        config.mcpServers.yomi = getYomiMcpDefinition();
+        writeFileSync(target.configPath, JSON.stringify(config, null, 2), {
+            mode: 0o600,
+        });
+        return {
+            success: true,
+            message: `Integrated Yomi MCP into ${target.name}`,
+            path: target.configPath,
+        };
+    }
+    catch (err) {
+        return {
+            success: false,
+            message: `Failed to configure ${target.name}: ${err.message}`,
+            path: target.configPath,
+        };
+    }
+}
+export function integrateAllClients() {
+    const skillResult = installYomiAgentSkill();
+    const targets = getClientTargets();
+    const results = targets.map((t) => {
+        const res = integrateClient(t);
+        return {
+            id: t.id,
+            name: t.name,
+            ...res,
+        };
+    });
+    return {
+        results,
+        totalSuccess: results.filter((r) => r.success).length,
+        skillInstalled: skillResult.success,
+    };
+}

package/dist/mcp/media.js

@@ -13,7 +13,7 @@
  * missing, or the message's content type is not a downloadable media type,
  * callers get an honest error naming the reason.
  */
-import { downloadLineObsMediaObject } from '../line/client/obs-media-client.js';
+import { downloadLineMessageData, downloadLineObsMediaObject, } from '../line/client/obs-media-client.js';
 import { CONTENT_TYPE } from '../line/core/constants.js';
 import { decryptLineMediaBytes } from '../line/core/media-decrypt.js';
 /** LINE content types this server can download and decrypt via the OBS path. */
@@ -98,6 +98,16 @@ function resolveMimeType(extension, contentType) {
     }
     return DEFAULT_MIME_BY_CONTENT_TYPE[contentType] || null;
 }
+/**
+ * Resolve a legacy message's filename extension without requiring an OBS
+ * descriptor.  Older Talk messages expose MEDIA_CONTENT_INFO but omit OID/SID.
+ */
+function resolveMediaInfoExtension(message) {
+    const info = parseJson(message?.contentMetadata?.MEDIA_CONTENT_INFO, {});
+    return typeof info.extension === 'string' && info.extension.trim()
+        ? info.extension.trim()
+        : null;
+}
 /**
  * Build a LINE media descriptor from a decrypted message.
  *
@@ -166,7 +176,29 @@ export async function fetchLineMessageMedia(service, chatId, messageId, preview)
     }
     const descriptor = resolveLineMediaDescriptor(message);
     if (!descriptor) {
-        throw new MissingDecryptMaterialError(`message ${messageId} is missing OBS object metadata (OID/SID)`);
+        // Older/non-E2EE Talk messages carry MEDIA_CONTENT_INFO but omit OID/SID.
+        // Their object is addressed by message id at OBS /r/talk/m/{id}; the
+        // similarly named TalkService methods are not real `/S4` methods and
+        // return Invalid method name.  Keep the request at the OBS layer.
+        const downloaded = await downloadLineMessageData(service.client, {
+            messageId,
+            preview,
+        });
+        const contentMetadata = message?.contentMetadata || {};
+        const fileName = (typeof contentMetadata.FILE_NAME === 'string' &&
+            contentMetadata.FILE_NAME) ||
+            (typeof contentMetadata.FILE_NAME_ORIGINAL === 'string' &&
+                contentMetadata.FILE_NAME_ORIGINAL) ||
+            (typeof contentMetadata.name === 'string' && contentMetadata.name) ||
+            null;
+        return {
+            bytes: downloaded.bytes,
+            contentType,
+            fileName,
+            mimeType: downloaded.mimeType ||
+                resolveMimeType(resolveMediaInfoExtension(message), contentType) ||
+                'application/octet-stream',
+        };
     }
     const encryptedBytes = await downloadLineObsMediaObject(service.client, {
         messageId,

package/dist/mcp/phi-guard.js

@@ -14,7 +14,7 @@
  * extra response content block reporting how many values were masked and of
  * what types, so the redaction is visible rather than a quiet rewrite.
  */
-/** Middle-redaction marker used in masked values (Q12〇〇9 style). */
+/** Middle-redaction marker used in masked values (for example, Q12••9). */
 const MASK_MIDDLE = '〇〇';
 /**
  * Luhn check for candidate payment-card digit strings.
@@ -37,7 +37,7 @@ function passesLuhn(digits) {
     return digits.length >= 13 && digits.length <= 19 && sum % 10 === 0;
 }
 /**
- * Mask one matched value, preserving a little edge context (Q12〇〇9): the
+ * Mask one matched value, preserving a little edge context (for example, Q12••9): the
  * first few characters and, for longer values, the last one.
  * @param value - The raw matched substring.
  * @returns The masked substring.

package/dist/search/bigram.js

@@ -3,11 +3,11 @@
  *
  * The FTS5 `unicode61` tokenizer has no Chinese/Japanese/Korean word
  * segmentation: a whole CJK run collapses into a single opaque token, so a
- * substring like "會議" inside "會議通知" never matches. Yomi has no ICU
+ * two-character CJK substring inside a longer CJK term never matches. Yomi has no ICU
  * tokenizer available and takes on no new dependency to get one, so instead
  * both the indexed text and the search query are rewritten into overlapping
  * character bigrams for CJK runs before ever reaching FTS5. Overlapping
- * bigrams turn "會議通知" into "會議 議通 通知" — searching for "會議"
+ * overlapping bigrams preserve exact two-character search terms inside longer CJK text
  * (itself a single bigram once transformed) becomes a plain token match.
  * This covers the common case of 2+ character CJK words; single-character
  * CJK terms still match via the emitted unigram.

package/dist/search/collector.js

@@ -20,7 +20,7 @@
  * Also batch-embeds each chat's collected messages (when an Embedder is
  * supplied) so semantic search has vectors to rank over. The embedder is
  * always caller-injected — never imported directly here — so the MCP
- * server can pass its DefaultEmbedder while a host app (e.g. inboxd) can
+ * server can pass its DefaultEmbedder while a host app (e.g. Yomi Desktop) can
  * pass its own local model instead. Embedding failure (model unavailable,
  * offline first run, etc.) is caught per-chat and never aborts collection:
  * messages + bigram search_text are always stored regardless of whether

package/dist/search/embedder.js

@@ -6,7 +6,7 @@
  * a default implementation (./default-embedder.ts, transformers.js/ONNX) so
  * the MCP server works standalone, but nothing in store.ts/collector.ts
  * imports that default directly — they only depend on this interface, so a
- * host app (e.g. inboxd) can inject its own embedder (its local MLX
+ * host app (e.g. Yomi Desktop) can inject its own embedder (its local MLX
  * `generateEmbedding`) instead. See ./default-embedder.ts's doc comment for
  * the exact adapter shape.
  */

package/dist/version.js

@@ -4,4 +4,4 @@
  * virtual filesystem). MUST stay equal to the "version" field in
  * package.json — the test in version.test.ts enforces that.
  */
-export const YOMI_VERSION = '0.4.1';
+export const YOMI_VERSION = '0.5.0';

package/package.json

@@ -3,7 +3,7 @@
   "engines": {
     "node": ">=22.13.0 <23.0.0 || >=23.4.0"
   },
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Open-source personal LINE MCP server for AI agents. Read, reply, send images, and search LINE conversations locally with Letter-Sealing E2EE.",
   "type": "module",
   "license": "MIT",
@@ -43,6 +43,9 @@
     "start": "node run.mjs",
     "lint": "biome check src/",
     "lint:fix": "biome check --write src/",
+    "lint:comments": "node scripts/lint-comments.mjs",
+    "hooks:install": "git config core.hooksPath .githooks",
+    "pretest": "npm run lint:comments",
     "format": "biome format --write src/",
     "test": "bun test",
     "version": "node scripts/sync-version.mjs && git add src/version.ts",