antenna-fyi 1.3.41 → 1.3.42

package/README.md

@@ -26,7 +26,10 @@ antenna checkin --id <platform>:<user_id> --lat 39.99 --lng 116.48
 
 # View/edit your profile
 antenna profile --id <platform>:<user_id>
-antenna profile --id <platform>:<user_id> --name Yi --emoji 🦦 --line1 'Product Designer'
+antenna config --key <ant_xxx>
+antenna profile --id <platform>:<user_id> --name Yi --line1 'Product Designer'
+
+Profile writes require the user's Antenna API key from antenna.fyi/me. The CLI verifies the key and writes to the dashboard-linked `user:<uuid>` profile; agents should not create profiles from `channel:sender_id`.
 
 # Accept a match
 antenna accept --id <platform>:<user_id> --target <ref_or_id> --contact 'WeChat: yi'

package/lib/cli.js

@@ -68,10 +68,14 @@ export async function handleScan(f) {
 
 export async function handleProfile(f) {
   const id = resolveId(f);
-  if (!id) return console.error("Usage: antenna profile --id <platform>:<user_id> [--name Yi --personal-description '...' --looking-for '...' --conversation-style '...' --more-information '...' --tags 'AI,design,music' --city 'Beijing' --contact 'WeChat: yi' --slug mira --hide --visible true]");
+  if (!id) return console.error("Usage: antenna profile --id <platform>:<user_id> [--name Yi --personal-description '...' --looking-for '...' --conversation-style '...' --more-information '...' --tags 'AI,design,music' --city 'Beijing' --contact 'WeChat: yi' --slug mira --hide --visible true]\n  Writes require: antenna config --key <your-api-key>");
   if (f.name || f["personal-description"] !== undefined || f.line1 !== undefined || f["looking-for"] !== undefined || f.line2 !== undefined || f["conversation-style"] !== undefined || f.line3 !== undefined || f["more-information"] !== undefined || f.contact !== undefined || f.slug !== undefined || f.tags !== undefined || f.city !== undefined || f.visible !== undefined || f.hide !== undefined) {
+    const config = loadConfig();
+    if (!config.key) {
+      return console.error("❌ Profile writes require a dashboard API key. Run: antenna config --key <your-api-key>");
+    }
     const visible = f.hide ? false : (f.visible !== undefined ? f.visible === 'true' || f.visible === true : undefined);
-    const payload = { device_id: id };
+    const payload = { device_id: config.device_id || id, api_key: config.key };
     if (f.name) payload.display_name = f.name;
     if (f["personal-description"] !== undefined) payload.line1 = f["personal-description"];
     else if (f.line1 !== undefined) payload.line1 = f.line1;
@@ -85,8 +89,6 @@ export async function handleProfile(f) {
     if (f.tags !== undefined) payload.interest_tags = typeof f.tags === 'string' ? f.tags.split(',').map(t => t.trim()).filter(Boolean) : [f.tags];
     if (f.city !== undefined) payload.city = f.city;
         if (visible !== undefined) payload.visible = visible;
-    const config = loadConfig();
-    if (config.key) payload.api_key = config.key;
     const data = await setProfile(payload);
     if (data?.error) {
       console.error("❌ " + data.error);
@@ -445,7 +447,7 @@ export async function handleConfig(f) {
       }
       const config = loadConfig();
       config.key = f.key;
-      config.device_id = result.device_id;
+      config.device_id = result.user_id ? `user:${result.user_id}` : result.device_id;
       config.user_id = result.user_id;
       config.display_name = result.display_name;
       saveConfig(config);
@@ -1107,7 +1109,7 @@ Agent shortcuts:
 Usage:
   antenna scan       --lat 39.99 --lng 116.48 [--radius 500] (max 1000) [--id <platform>:<user_id>]
   antenna checkin    --id <platform>:<user_id> --lat 39.99 --lng 116.48
-  antenna profile    --id <platform>:<user_id> [--name Yi --personal-description '...' --looking-for '...' --conversation-style '...' --more-information '...' --tags 'AI,design,music' --city 'Beijing' --contact 'WeChat: yi' --slug mira --hide --visible true]
+  antenna profile    --id <platform>:<user_id> [--name Yi --personal-description '...' --looking-for '...' --conversation-style '...' --more-information '...' --tags 'AI,design,music' --city 'Beijing' --contact 'WeChat: yi' --slug mira --hide --visible true] (writes require antenna config --key)
   antenna accept     --id <platform>:<user_id> --target <ref_or_device_id> [--contact 'WeChat: yi']
   antenna pass       --id <platform>:<user_id> --target <ref_or_device_id> (or --ref 1)
   antenna matches    --id <platform>:<user_id>

package/lib/core.js

@@ -301,6 +301,18 @@ export async function setProfile({
   supabaseKey,
 }) {
   const sb = getClient(supabaseUrl, supabaseKey);
+  if (!api_key) {
+    throw new Error("Profile writes require the user's Antenna API key from antenna.fyi/me. Do not create an agent-only profile from sender_id/channel.");
+  }
+  const auth = await verifyApiKey({ key: api_key, supabaseUrl, supabaseKey });
+  if (!auth?.valid) {
+    throw new Error(auth?.error || "Invalid Antenna API key");
+  }
+  const dashboardDeviceId = auth.user_id ? `user:${auth.user_id}` : auth.device_id;
+  if (!dashboardDeviceId) {
+    throw new Error("API key verified but did not return a dashboard device_id");
+  }
+  device_id = dashboardDeviceId;
 
   // Pack structured fields into matching_context JSON
   let contextJson = matching_context;
@@ -411,6 +423,7 @@ export async function setProfile({
               p_device_id: device_id,
               p_matching_context: JSON.stringify(ctx),
               p_visible: profile?.visible ?? true,
+              p_api_key: api_key,
             });
           } catch {}
         }
@@ -432,6 +445,8 @@ export async function setProfile({
     public_url: publicUrl,
     gps_bind_url: bindUrl,
     archetype: archetypeResult || null,
+    api_key_verified: true,
+    dashboard_device_id: device_id,
     next_step: "Send the public_url and gps_bind_url to the user. The GPS link should be opened on their phone to share location.",
   };
 }

package/lib/hermes-plugin/schemas.py

@@ -56,6 +56,7 @@ PROFILE_SCHEMA = {
             "line3": {"type": "string", "description": "What you're looking for"},
             "visible": {"type": "boolean", "description": "Visible to others"},
             "matching_context": {"type": "string", "description": "Free-form context for AI matching (interests, goals, etc.)"},
+            "api_key": {"type": "string", "description": "Required for action='set': user's Antenna API key from antenna.fyi/me. Profile writes use the dashboard-linked user:<uuid> profile."},
         },
         "required": ["action", "sender_id", "channel", "chat_id"],
     },

package/lib/hermes-plugin/tools.py

@@ -43,6 +43,19 @@ def _profile_slug_candidate(display_name: str | None, device_id: str) -> str:
     return f"user-{digest}"
 
 
+def _dashboard_device_id(sb, api_key: str | None) -> tuple[str | None, str | None]:
+    if not api_key:
+        return None, "Profile writes require the user's Antenna API key from antenna.fyi/me. Do not create an agent-only profile from sender_id/channel."
+    resp = sb.rpc("verify_api_key", {"p_key": api_key}).execute()
+    data = resp.data or {}
+    if not data.get("valid"):
+        return None, data.get("error") or "Invalid Antenna API key"
+    device_id = f"user:{data.get('user_id')}" if data.get("user_id") else data.get("device_id")
+    if not device_id:
+        return None, "API key verified but did not return a dashboard device_id"
+    return device_id, None
+
+
 def _get_url():
     return os.environ.get("ANTENNA_SUPABASE_URL") or os.environ.get("ANTENNA_URL") or BUILTIN_URL
 
@@ -191,6 +204,9 @@ def handle_profile(params: dict) -> str:
         return _ok({"exists": True, "profile": resp.data})
 
     # set
+    did, auth_error = _dashboard_device_id(sb, params.get("api_key"))
+    if auth_error:
+        return _ok({"error": auth_error})
     rpc_params = {
         "p_device_id": did,
         "p_display_name": params.get("display_name"),
@@ -224,6 +240,8 @@ def handle_profile(params: dict) -> str:
             "updated": True,
             "profile": resp.data,
             "public_url": public_url,
+            "api_key_verified": True,
+            "dashboard_device_id": did,
             "next_step": "IMPORTANT: 1) Send public_url to the user — this is their shareable profile link. 2) Call antenna_bind to generate a GPS link. Do not skip either step.",
         })
     return _ok({"error": "upsert_profile failed"})

package/lib/mcp.js

@@ -128,8 +128,9 @@ export async function startMcpServer() {
       links: z.array(z.string()).optional().describe("Social links shown on the card footer (up to 3)"),
       is_active: z.boolean().optional().describe("Whether the profile is active or quiet"),
       visible: z.boolean().optional().default(true),
+      api_key: z.string().optional().describe("Required for action='set': the user's Antenna API key from antenna.fyi/me. Profile writes use this key and the dashboard-linked user:<uuid> device_id."),
     },
-    async ({ action, sender_id, channel, display_name, personal_description, looking_for, conversation_style, more_information, interest_tags, city, links, is_active, visible }) => {
+    async ({ action, sender_id, channel, display_name, personal_description, looking_for, conversation_style, more_information, interest_tags, city, links, is_active, visible, api_key }) => {
       const deviceId = deriveDeviceId(sender_id, channel);
       try {
         if (action === "get") {
@@ -139,8 +140,8 @@ export async function startMcpServer() {
             : { profile: null, message: "还没有名片。跟用户聊聊他们是谁、做什么、想认识什么人，然后帮他们创建。", fields: PROFILE_FIELDS };
           return jsonResult(await withMatchNotifications(deviceId, result));
         }
-        const data = await setProfile({ device_id: deviceId, display_name, line1: personal_description, line2: looking_for, line3: conversation_style, matching_context: more_information, interest_tags, city, links, is_active, visible });
-        return jsonResult(await withMatchNotifications(deviceId, { saved: true, profile: data }));
+        const data = await setProfile({ device_id: deviceId, display_name, line1: personal_description, line2: looking_for, line3: conversation_style, matching_context: more_information, interest_tags, city, links, is_active, visible, api_key });
+        return jsonResult(await withMatchNotifications(data.dashboard_device_id || deviceId, { saved: true, profile: data }));
       } catch (e) {
         return jsonResult({ error: e.message });
       }

package/lib/plugin-template/index.ts

@@ -77,6 +77,18 @@ function profileSlugCandidate(displayName: string | null | undefined, deviceId:
   return `user-${createHash("sha1").update(deviceId).digest("hex").slice(0, 10)}`;
 }
 
+async function resolveDashboardDeviceId(supabase: SupabaseClient, apiKey: string | null | undefined) {
+  if (!apiKey) {
+    return { error: "Profile writes require the user's Antenna API key from antenna.fyi/me. Do not create an agent-only profile from sender_id/channel." };
+  }
+  const { data, error } = await supabase.rpc("verify_api_key", { p_key: apiKey });
+  if (error) return { error: error.message };
+  if (!data?.valid) return { error: data?.error || "Invalid Antenna API key" };
+  const deviceId = data.user_id ? `user:${data.user_id}` : data.device_id;
+  if (!deviceId) return { error: "API key verified but did not return a dashboard device_id" };
+  return { deviceId, userId: data.user_id, displayName: data.display_name };
+}
+
 function isRateLimited(deviceId: string): boolean {
   const now = Date.now();
   const last = _lastScanTime.get(deviceId);
@@ -411,13 +423,14 @@ export default function register(api: any) {
         line2: { type: "string", description: "Second line (what you're into)" },
         line3: { type: "string", description: "Third line (what you're looking for)" },
         visible: { type: "boolean", description: "Whether to be visible to others" },
+        api_key: { type: "string", description: "Required for action='set': user's Antenna API key from antenna.fyi/me. Profile writes use the dashboard-linked user:<uuid> profile." },
       },
       required: ["action", "sender_id", "channel"],
     },
     async execute(_id: string, params: any) {
       const cfg = getConfig(api);
       const supabase = getSupabase(cfg);
-      const deviceId = deriveDeviceId(params.sender_id, params.channel);
+      let deviceId = deriveDeviceId(params.sender_id, params.channel);
 
       if (params.action === "get") {
         const { data, error } = await supabase.rpc("get_profile", { p_device_id: deviceId });
@@ -431,12 +444,16 @@ export default function register(api: any) {
         });
       }
 
+      const resolved = await resolveDashboardDeviceId(supabase, params.api_key);
+      if (resolved.error) return ok({ error: resolved.error });
+      deviceId = resolved.deviceId!;
+
       const { data, error } = await supabase.rpc("upsert_profile", {
         p_device_id: deviceId,
         p_display_name: params.display_name ?? null, p_emoji: null,
         p_line1: params.line1 ?? null, p_line2: params.line2 ?? null,
         p_line3: params.line3 ?? null, p_visible: params.visible ?? true,
-        p_api_key: null,
+        p_api_key: params.api_key,
       });
 
       if (error) return ok({ error: error.message });
@@ -447,7 +464,7 @@ export default function register(api: any) {
         let profileSlug = profile?.profile_slug || null;
         if (!profileSlug) {
           const targetSlug = profileSlugCandidate(params.display_name, deviceId);
-          const { data: slugResult } = await supabase.rpc("set_profile_slug", { p_device_id: deviceId, p_slug: targetSlug, p_api_key: null });
+          const { data: slugResult } = await supabase.rpc("set_profile_slug", { p_device_id: deviceId, p_slug: targetSlug, p_api_key: params.api_key });
           if (slugResult?.set) profileSlug = targetSlug;
         }
         if (profileSlug) publicUrl = `https://www.antenna.fyi/p/${profileSlug}`;
@@ -458,6 +475,8 @@ export default function register(api: any) {
         profile: { display_name: data.display_name,
           line1: data.line1, line2: data.line2, line3: data.line3, visible: data.visible },
         public_url: publicUrl,
+        api_key_verified: true,
+        dashboard_device_id: deviceId,
         next_step: "IMPORTANT: Send the public_url to the user — this is their shareable profile link. Then call antenna_bind to generate a GPS link. Do not skip either step.",
       });
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "antenna-fyi",
-  "version": "1.3.41",
+  "version": "1.3.42",
   "description": "Antenna — nearby people discovery. CLI + MCP server + OpenClaw skill & plugin, all in one package.",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -38,9 +38,9 @@ Plugin 安装后,agent **主动**开始引导,不要等用户问。
 **第一步:拿到 API key → 配置**
 > "嘿,你装了 Antenna--它能帮你发现有意思的人。先确认一下,你在 antenna.fyi 注册过了吗?拿到 API key 了吗?"
 
-用户给了 API key 后,调 `antenna config --key <key>` 验证。这会返回 `user_id` 和 `device_id`。
+用户给了 API key 后,调 `antenna config --key <key>` 验证。这会返回 `user_id` 和 dashboard 绑定的 `device_id`。
 
-**⚠️ 之后所有操作必须用 API key 验证返回的 device_id(格式 `user:xxx`)。不要自己拼 `channel:sender_id`。** 这样 agent 创建的 profile 才能在 dashboard 上显示。
+**⚠️ Profile 写入必须通过用户的 Antenna API key。** 调 `antenna_profile(action="set")` 时传 `api_key`，tool 会验证 API key 并使用返回的 dashboard `device_id`(格式 `user:xxx`) 写入。不要自己拼 `channel:sender_id`，不要在用户拿到 API key 前凭空创建 profile。这样 agent 填的内容才会显示在 dashboard。
 
 **第二步:聊天收集 → 生成名片 → 确认**
 
@@ -58,9 +58,9 @@ Plugin 安装后,agent **主动**开始引导,不要等用户问。
 >
 > 这样可以吗?要改哪里告诉我。
 
-确认后用 config 里的 device_id 调 `antenna_profile(action="set")` 保存。**不要跳过确认。**
+确认后调 `antenna_profile(action="set", api_key="ant_xxx")` 保存。**不要跳过确认。**
 
-**⚠️ sender_id 用 config 里的 device_id,不要用 channel:sender_id。**
+**⚠️ 保存 profile 时以 API key 为准；sender_id/channel 只用于上下文，不作为 profile 归属来源。**
 
 **第三步:立刻推荐 2-3 个人**
 
@@ -96,12 +96,12 @@ openclaw cron add --every 1h --message "Check antenna matches: call antenna_chec
 
 ### Linking to antenna.fyi account
 
-如果用户之前通过 agent 创建过 profile(没有网站账号),现在注册了 antenna.fyi:
+Legacy only: 如果用户之前通过旧版 agent 创建过 profile(没有网站账号),现在注册了 antenna.fyi:
 1. 让用户从 antenna.fyi/me 复制 API key
 2. 调 `antenna_link_account(api_key = "ant_xxx")`
 3. 确认:"关联成功!你现在可以在 dashboard 上看到完整的 profile 和匹配记录了。"
 
-这把 agent 创建的 profile(带全部历史)关联到网站账号。
+这只用于迁移旧数据。新流程禁止先创建 agent-only profile 再绑定；必须先拿 API key，再通过 API 写入 dashboard profile。
 
 ## When to use
 
@@ -164,6 +164,7 @@ openclaw cron add --every 1h --message "Check antenna matches: call antenna_chec
 - `action`:"get" 或 "set"
 - `sender_id`, `channel`, `chat_id`
 - "set" 时传:`display_name`, `personal_description`, `looking_for`, `conversation_style`, `visible`, `matching_context`
+- "set" 必须传 `api_key`。tool 会验证 key，并写入 API key 绑定的 dashboard profile；不要用 `sender_id/channel` 创建独立 profile。
 
 名片内容:
 - **display_name**:显示名称