can2cup 0.10.0

package/dist/protocol/principal.js

@@ -0,0 +1,80 @@
+/**
+ * Principal-signed messages — the principal → agent channel, end to end.
+ *
+ * v0.2 and earlier: whatever the bridge put in an agent's inbox was shown to the model as
+ * "principal instructions", and the only thing standing between an attacker and that label
+ * was the bot's shared BRIDGE_KEY (2026-08-19 review, F1/F7). v0.3 gives the principal an
+ * ed25519 keypair of their own (`~/.parley/principal.json`). An instruction or a pause that
+ * carries a valid signature by THAT key — addressed to THIS agent, with a fresh nonce — is
+ * the only thing the MCP server will ever label as verified. The relay and the bot can still
+ * write unsigned items; those stay explicitly unverified.
+ *
+ * The signature covers `agent`, so a message signed for one agent cannot be replayed to
+ * another; `nonce` lets the receiver refuse the same message twice; `at` orders pauses.
+ * `approve` binds an approval to a concrete envelope (room, seq, hash), so an approval can
+ * never be re-aimed at a different decision than the one the principal looked at (F6).
+ */
+import { canon } from "./canon.js";
+import { randomHex, signHex, verifyHex } from "./crypto.js";
+export function principalSigningBytes(m) {
+    const { kind, agent, at, nonce, text, paused, approve } = m;
+    return canon({ kind, agent, at, nonce, text, paused, approve });
+}
+export function signPrincipal(m, priv, pub) {
+    const full = { ...m, at: m.at ?? new Date().toISOString(), nonce: m.nonce ?? randomHex(16) };
+    return { ...full, pub, sig: signHex(principalSigningBytes(full), priv) };
+}
+/** Structural + cryptographic check. `expectedPub` = the principal key the verifier trusts
+ *  (the agent pins its own principal.json pubkey; the bridge pins what the agent registered);
+ *  `expectedAgent` = the verifier's own agent pubkey. */
+export function verifyPrincipal(s, expectedPub, expectedAgent) {
+    if (!s || typeof s !== "object")
+        return { ok: false, error: "not a message" };
+    if (s.kind !== "say" && s.kind !== "pause")
+        return { ok: false, error: "bad kind" };
+    if (!/^[0-9a-f]{64}$/.test(s.pub ?? ""))
+        return { ok: false, error: "bad pub" };
+    if (s.pub !== expectedPub)
+        return { ok: false, error: "signed by a key that is not your principal's" };
+    if (s.agent !== expectedAgent)
+        return { ok: false, error: "addressed to a different agent" };
+    if (typeof s.nonce !== "string" || s.nonce.length < 16)
+        return { ok: false, error: "bad nonce" };
+    if (!Number.isFinite(Date.parse(s.at ?? "")))
+        return { ok: false, error: "bad timestamp" };
+    if (s.kind === "say" && typeof s.text !== "string")
+        return { ok: false, error: "say without text" };
+    if (s.kind === "pause" && typeof s.paused !== "boolean")
+        return { ok: false, error: "pause without paused flag" };
+    if (!verifyHex(s.sig, principalSigningBytes(s), s.pub))
+        return { ok: false, error: "bad principal signature" };
+    return { ok: true };
+}
+// ------------------------------------------------ signed HTTP requests ---
+/** Requests that must prove possession of a key (agent → bridge, agent → room admin ops,
+ *  principal → bridge) carry three headers and sign "METHOD\nPATH\nTS\nBODY". The relay
+ *  checks the timestamp is within ±5 minutes. Same scheme for every key role, so one helper. */
+export const REQ_SIG_SKEW_MS = 5 * 60 * 1000;
+export function requestSigningBytes(method, path, ts, body) {
+    return `${method}\n${path}\n${ts}\n${body}`;
+}
+export function signRequestHeaders(method, path, body, key, prefix = "x-parley") {
+    const ts = new Date().toISOString();
+    return {
+        [`${prefix}-pub`]: key.pub,
+        [`${prefix}-ts`]: ts,
+        [`${prefix}-sig`]: signHex(requestSigningBytes(method, path, ts, body), key.priv),
+    };
+}
+export function verifyRequestHeaders(h, method, path, body, prefix = "x-parley", now = Date.now()) {
+    const pub = h(`${prefix}-pub`) ?? "";
+    const ts = h(`${prefix}-ts`) ?? "";
+    const sig = h(`${prefix}-sig`) ?? "";
+    if (!/^[0-9a-f]{64}$/.test(pub) || !ts || !sig)
+        return { ok: false, error: "missing signature headers" };
+    if (Math.abs(now - Date.parse(ts)) > REQ_SIG_SKEW_MS)
+        return { ok: false, error: "signature timestamp too old" };
+    if (!verifyHex(sig, requestSigningBytes(method, path, ts, body), pub))
+        return { ok: false, error: "bad signature" };
+    return { ok: true, pub };
+}

package/dist/protocol/release.js

@@ -0,0 +1,25 @@
+// v0.10.0 (security G-3, P2): release signing.
+//
+// The relay serves the install tarball; the maintainer SIGNS it. These are different people in the threat model
+// (or the same person on different days), so the key that vouches for a release must not live on the relay.
+// The private half stays offline on the maintainer's machine (scripts/release-key.mjs); this file carries the
+// public half, compiled into every client. A client trusts a release only if manifest.sig verifies against one
+// of these keys. Rotation: add the new key here, ship, drop the old one in the following release.
+import { canon } from "./canon.js";
+import { verifyHex } from "./crypto.js";
+export const RELEASE_PUBS = [
+    "7a025a45418ea95d0aaf6738749cf72d40207965610d1a31cb3db6233f50d571", // 2026-09-05, the maintainer's home machine
+];
+/** Signature over canon(manifest) — the same canonical JSON every envelope uses; no new format. */
+export function verifyManifest(m, sigHex, pubs) {
+    const x = m;
+    if (!x || typeof x !== "object" || x.v !== 1 || typeof x.version !== "string" || !x.files || typeof x.files !== "object")
+        return { ok: false, reason: "release manifest is malformed" };
+    if (!/^[0-9a-f]{128}$/.test(sigHex))
+        return { ok: false, reason: "release manifest signature is malformed" };
+    const msg = canon(x);
+    for (const pub of pubs)
+        if (verifyHex(sigHex, msg, pub))
+            return { ok: true, pub };
+    return { ok: false, reason: `release manifest signature does not verify against any release key this client trusts (${pubs.map((p) => p.slice(0, 8) + "…").join(", ")}) — release key not trusted by this client, or the manifest was altered` };
+}

package/dist/protocol/room.js

@@ -0,0 +1,59 @@
+export const DEFAULT_POLICY = { maxMessages: 200, ttlSec: 6 * 3600 };
+const PREFIX = "parley1.";
+const TOKEN_RE = /parley1.[A-Za-z0-9_-]{16,}/;
+const URL_RE = /https?:\/\/[^\s"'<>]+\/j\/[0-9a-f]{12}[^\s"'<>]*/;
+export function encodeInvite(i) {
+    return PREFIX + b64url(JSON.stringify(i));
+}
+export function encodeInviteUrl(i) {
+    const base = i.u.replace(/\/+$/, "");
+    const qs = new URLSearchParams();
+    if (i.n)
+        qs.set("n", i.n);
+    if (i.p)
+        qs.set("p", i.p);
+    const qstr = qs.toString();
+    const q = qstr ? `?${qstr}` : "";
+    return `${base}/j/${i.r}${q}#${i.s}${i.k ? "." + i.k : ""}`;
+}
+/** Accepts a token, a URL, or any text that contains one of them (agents paste whole chat lines). */
+export function decodeInvite(s) {
+    const t = s.trim();
+    const url = URL_RE.exec(t)?.[0];
+    if (url)
+        return decodeInviteUrl(url);
+    const tok = TOKEN_RE.exec(t)?.[0] ?? (t.startsWith(PREFIX) ? t : undefined);
+    if (!tok)
+        throw new Error("not a can2cup invite (expected a https://…/j/<room>#<secret> link or a parley1.… token)");
+    const i = JSON.parse(unb64url(tok.slice(PREFIX.length)));
+    if (!i.u || !i.r || !i.s)
+        throw new Error("malformed invite");
+    return i;
+}
+export function decodeInviteUrl(url) {
+    const u = new URL(url);
+    const m = /^(.*)\/j\/([0-9a-f]{12})$/.exec(u.pathname);
+    if (!m)
+        throw new Error("malformed invite link (expected /j/<room>)");
+    const [s, k] = u.hash.replace(/^#/, "").split(".");
+    if (!/^[0-9a-f]{16,}$/.test(s))
+        throw new Error("invite link is missing its secret (the part after #) — copy the whole link");
+    const n = u.searchParams.get("n") ?? undefined;
+    const p = u.searchParams.get("p") ?? undefined;
+    return { u: u.origin + m[1], r: m[2], s, ...(n ? { n } : {}), ...(p && /^[0-9a-f]{64}$/.test(p) ? { p } : {}), ...(k && /^[0-9a-f]{64}$/.test(k) ? { k } : {}) };
+}
+function b64url(s) {
+    const bytes = new TextEncoder().encode(s);
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function unb64url(s) {
+    const b = s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - (s.length % 4)) % 4);
+    const bin = atob(b);
+    const bytes = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        bytes[i] = bin.charCodeAt(i);
+    return new TextDecoder().decode(bytes);
+}

package/dist/protocol/semver.js

@@ -0,0 +1,14 @@
+/** v0.9.0 upgrade protocol: the only comparison both relay and client need. "1.2.3" style; unknown → 0.0.0. */
+export function parseSemver(v) {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec((v ?? "").trim());
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : [0, 0, 0];
+}
+/** negative when a < b, 0 when equal, positive when a > b. */
+export function cmpSemver(a, b) {
+    const x = parseSemver(a), y = parseSemver(b);
+    for (let i = 0; i < 3; i++)
+        if (x[i] !== y[i])
+            return x[i] - y[i];
+    return 0;
+}
+export const NO_VERSION = "0.0.0";

package/dist/viewer/index.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+/**
+ * can2cup viewer — the principal's window onto the rooms their agent is in.
+ * Local only (binds 127.0.0.1). Reads CAN2CUP_HOME, proxies the relay with the
+ * stored room secrets, verifies the chain with the shared protocol code, and
+ * merges the local audit log (private rationale, blocked attempts) into the
+ * transcript. Also exposes the PAUSED brake.
+ *
+ *   node dist/viewer/index.js [--port 7777]
+ *   CAN2CUP_NOTIFY_URL=https://ntfy.sh/<topic>   also push inbound events / blocks / escalations (see notify.ts)
+ */
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+import QRCode from "qrcode";
+import { verifyEnvelope, genesis, encodeInvite, encodeInviteUrl, decryptBody, isEncrypted } from "../protocol/index.js";
+import { HOME, loadIdentity, loadRooms, loadMandate, isPaused } from "../mcp/state.js";
+import { relay } from "../mcp/relay-client.js";
+import { PAGE } from "./page.js";
+import { notifyEnabled, startWatcher } from "./notify.js";
+const port = Number(process.argv[process.argv.indexOf("--port") + 1]) || 7777;
+const me = loadIdentity();
+const cache = new Map();
+async function roomDelta(room, wait) {
+    let c = cache.get(room.id);
+    if (!c) {
+        c = { msgs: [], ok: [], head: genesis(room.id), names: {}, state: room.state, namesAt: 0 };
+        cache.set(room.id, c);
+    }
+    const since = c.msgs.length ? c.msgs[c.msgs.length - 1].seq : 0;
+    const res = await relay.poll(room.relay, room.id, room.cap ?? room.secret, since, since === 0 ? 0 : wait);
+    const delta = [];
+    for (const m of res.messages) {
+        const v = verifyEnvelope(m, c.head, { relayPub: room.relayPub, pastRelayPubs: room.relayPubHistory });
+        c.head = m.hash;
+        // E2E rooms: verify the wire form above, show the plaintext below.
+        let shown = m;
+        if (room.key && isEncrypted(m.body)) {
+            const d = await decryptBody(room.key, room.id, m.body);
+            shown = { ...m, body: d === undefined ? { text: "[E2E: body did not decrypt]" } : d };
+        }
+        c.msgs.push(shown);
+        c.ok.push(v.ok);
+        delta.push({ ...shown, ok: v.ok, errors: v.errors });
+    }
+    c.state = res.state;
+    if (Date.now() - c.namesAt > 15000 || delta.some((m) => m.type === "system")) {
+        try {
+            const info = await relay.info(room.relay, room.id, room.cap ?? room.secret);
+            c.names = Object.fromEntries(Object.entries(info.participants).map(([pk, p]) => [pk, p.name || pk.slice(0, 8)]));
+        }
+        catch { /* keep old names */ }
+        c.namesAt = Date.now();
+    }
+    return { delta, c };
+}
+function readAudit(roomId) {
+    const p = path.join(HOME, "audit.jsonl");
+    if (!fs.existsSync(p))
+        return [];
+    return fs.readFileSync(p, "utf8").split("\n").filter(Boolean).map((l) => { try {
+        return JSON.parse(l);
+    }
+    catch {
+        return null;
+    } })
+        .filter((e) => !!e && e.room === roomId);
+}
+function json(res, status, body) {
+    res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+    res.end(JSON.stringify(body));
+}
+const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    try {
+        if (url.pathname === "/") {
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            return res.end(PAGE);
+        }
+        if (url.pathname === "/api/state") {
+            const rooms = Object.values(loadRooms()).sort((a, b) => b.joinedAt.localeCompare(a.joinedAt));
+            return json(res, 200, { me: { name: me.name, pub: me.pub }, home: HOME, paused: isPaused(), notify: notifyEnabled, mandate: loadMandate(), rooms });
+        }
+        const inv = /^\/api\/rooms\/([0-9a-f]{12})\/invite$/.exec(url.pathname);
+        if (inv) {
+            const room = loadRooms()[inv[1]];
+            if (!room)
+                return json(res, 404, { error: "unknown room" });
+            const i = { u: room.relay, r: room.id, s: room.secret, n: room.name || undefined, p: room.relayPub };
+            const link = encodeInviteUrl(i);
+            const qr = await QRCode.toDataURL(link, { margin: 1, width: 240, color: { dark: "#000000", light: "#ffffff" } });
+            return json(res, 200, { link, token: encodeInvite(i), qr });
+        }
+        const m = /^\/api\/rooms\/([0-9a-f]{12})$/.exec(url.pathname);
+        if (m) {
+            const room = loadRooms()[m[1]];
+            if (!room)
+                return json(res, 404, { error: "unknown room" });
+            const wait = Math.min(30, Number(url.searchParams.get("wait") ?? 0) || 0);
+            const full = url.searchParams.get("full") === "1";
+            const { delta, c } = await roomDelta(room, wait);
+            const audit = readAudit(room.id);
+            const rationale = {};
+            for (const e of audit)
+                if (e.kind === "send" && e.seq != null && e.rationale)
+                    rationale[e.seq] = e.rationale;
+            const blocked = audit.filter((e) => e.kind === "blocked").map((e) => ({ at: e.at, type: e.type, body: e.body, reason: e.reason, rationale: e.rationale ?? null }));
+            const msgs = full ? c.msgs.map((x, i) => ({ ...x, ok: c.ok[i], errors: [] })) : delta;
+            return json(res, 200, { room: { id: room.id, name: room.name, relay: room.relay, state: c.state }, me: me.pub, names: c.names, msgs, rationale, blocked, chainOk: c.ok.every(Boolean), lastSeq: c.msgs.length ? c.msgs[c.msgs.length - 1].seq : 0 });
+        }
+        if (url.pathname === "/api/pause" && req.method === "POST") {
+            let body = "";
+            for await (const ch of req)
+                body += ch;
+            const on = !!JSON.parse(body || "{}").on;
+            const p = path.join(HOME, "PAUSED");
+            if (on)
+                fs.writeFileSync(p, new Date().toISOString() + "\n");
+            else if (fs.existsSync(p))
+                fs.unlinkSync(p);
+            return json(res, 200, { paused: isPaused() });
+        }
+        json(res, 404, { error: "not found" });
+    }
+    catch (e) {
+        json(res, 500, { error: e instanceof Error ? e.message : String(e) });
+    }
+});
+server.listen(port, "127.0.0.1", () => {
+    console.log(`can2cup viewer for ${me.name} (${me.pub.slice(0, 8)}) — http://127.0.0.1:${port}/   home=${HOME}`);
+    startWatcher(me.pub, me.name);
+});

package/dist/viewer/notify.js

@@ -0,0 +1,113 @@
+/**
+ * Principal notification. The viewer is the principal's "phone app": while it runs it
+ * watches every open room (its own cursor, independent of the UI) and the local audit
+ * log, and pushes one line per event to a webhook.
+ *
+ *   CAN2CUP_NOTIFY_URL    where to POST. Recognised shapes:
+ *                          https://ntfy.sh/<topic>                       → plain-text POST with a Title header
+ *                          https://api.telegram.org/bot<t>/sendMessage?chat_id=<id>  → JSON {chat_id,text}
+ *                          anything else                                  → JSON {title,text,room,type,from}
+ *   CAN2CUP_NOTIFY_TYPES  comma list of inbound types to push (default: question,proposal,counter,accept,
+ *                        grant,revoke,escalate,attachment,close). Blocked attempts and your own agent's
+ *                        `escalate` are always pushed — those are the moments the principal must act.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { HOME, loadRooms } from "../mcp/state.js";
+import { relay } from "../mcp/relay-client.js";
+const URL_ = process.env.CAN2CUP_NOTIFY_URL ?? process.env.CAN2CAN_NOTIFY_URL ?? process.env.PARLEY_NOTIFY_URL ?? "";
+const TYPES = new Set((process.env.CAN2CUP_NOTIFY_TYPES ?? process.env.CAN2CAN_NOTIFY_TYPES ?? process.env.PARLEY_NOTIFY_TYPES ?? "question,proposal,counter,accept,grant,revoke,escalate,attachment,close").split(",").map((s) => s.trim()).filter(Boolean));
+export const notifyEnabled = !!URL_;
+export async function push(title, text, extra = {}) {
+    if (!URL_)
+        return;
+    try {
+        if (/ntfy\.sh|\/ntfy/.test(URL_)) {
+            await fetch(URL_, { method: "POST", headers: { Title: title.replace(/[^\x20-\x7e]/g, "?"), Tags: "speech_balloon" }, body: `${title}\n${text}` });
+        }
+        else if (URL_.includes("api.telegram.org")) {
+            const u = new URL(URL_);
+            const chat_id = u.searchParams.get("chat_id");
+            u.search = "";
+            await fetch(u.toString(), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ chat_id, text: `${title}\n${text}` }) });
+        }
+        else {
+            await fetch(URL_, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ title, text, ...extra }) });
+        }
+    }
+    catch (e) {
+        console.error("notify failed:", e instanceof Error ? e.message : e);
+    }
+}
+function summarize(m) {
+    const b = (m.body ?? {});
+    const bits = [typeof b.text === "string" ? b.text.slice(0, 200) : JSON.stringify(b).slice(0, 200)];
+    if (b.amount != null)
+        bits.push(`amount ${b.amount}`);
+    if (m.type === "grant")
+        bits.push(`scope ${b.scope} until ${b.expires}`);
+    if (m.type === "attachment")
+        bits.push(String(b.url ?? ""));
+    return bits.join(" · ");
+}
+/** Start the watcher. Cursors begin at each room's current lastSeq so a restart does not replay history. */
+export function startWatcher(mePub, myName) {
+    if (!URL_)
+        return;
+    const cursors = new Map();
+    for (const r of Object.values(loadRooms()))
+        cursors.set(r.id, r.lastSeq);
+    let auditPos = 0;
+    try {
+        auditPos = fs.statSync(path.join(HOME, "audit.jsonl")).size;
+    }
+    catch { /* none yet */ }
+    console.log(`notify → ${URL_.replace(/bot[^/]+/, "bot***")}  types=${[...TYPES].join(",")}`);
+    const tickRooms = async () => {
+        const rooms = Object.values(loadRooms()).filter((r) => r.state === "open");
+        await Promise.all(rooms.map(async (room) => {
+            const since = cursors.get(room.id) ?? room.lastSeq;
+            try {
+                const res = await relay.poll(room.relay, room.id, room.cap ?? room.secret, since, 0);
+                let last = since;
+                for (const m of res.messages) {
+                    last = m.seq;
+                    if (m.from === mePub || m.from === "relay" || !TYPES.has(m.type))
+                        continue;
+                    await push(`can2cup · ${room.name || room.id} · ${m.type}`, summarize(m), { room: room.id, seq: m.seq, type: m.type, from: m.from });
+                }
+                cursors.set(room.id, last);
+            }
+            catch { /* relay hiccup; try next tick */ }
+        }));
+    };
+    const tickAudit = async () => {
+        const p = path.join(HOME, "audit.jsonl");
+        if (!fs.existsSync(p))
+            return;
+        const size = fs.statSync(p).size;
+        if (size <= auditPos)
+            return;
+        const fd = fs.openSync(p, "r");
+        const buf = Buffer.alloc(size - auditPos);
+        fs.readSync(fd, buf, 0, buf.length, auditPos);
+        fs.closeSync(fd);
+        auditPos = size;
+        for (const line of buf.toString("utf8").split("\n").filter(Boolean)) {
+            try {
+                const e = JSON.parse(line);
+                if (e.kind === "blocked")
+                    await push(`can2cup · ${myName}'s agent BLOCKED (${e.type})`, `${e.reason ?? ""}\n${e.body?.text ?? ""}`.slice(0, 300), { room: e.room, kind: "blocked" });
+                else if (e.kind === "send" && e.type === "escalate")
+                    await push(`can2cup · ${myName}'s agent needs you`, (e.body?.text ?? "").slice(0, 300), { room: e.room, kind: "escalate" });
+            }
+            catch { /* skip */ }
+        }
+    };
+    const loop = async () => {
+        await tickRooms();
+        await tickAudit();
+        setTimeout(loop, 8000);
+    };
+    void loop();
+}

package/dist/viewer/page.js

@@ -0,0 +1,97 @@
+/** The viewer's single page. Kept as a string so the viewer has zero build/asset steps. */
+export const PAGE = /* html */ `<!doctype html>
+<html lang="zh-Hant"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>can2cup viewer</title>
+<style>
+:root{--bg:#0f1115;--panel:#161a21;--line:#262c36;--fg:#e6e6e6;--mute:#8a93a3;--me:#2f4f8f;--them:#232a35;--sys:#1b1f27;--ok:#3ecf8e;--bad:#ff5c5c;--warn:#f0b429;--accent:#f4a26b}
+*{box-sizing:border-box}html,body{height:100%;margin:0}
+body{background:var(--bg);color:var(--fg);font:14px/1.45 ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,"Noto Sans TC",sans-serif;display:grid;grid-template-columns:260px 1fr;grid-template-rows:48px 1fr}
+header{grid-column:1/3;display:flex;align-items:center;gap:14px;padding:0 16px;border-bottom:1px solid var(--line);background:var(--panel)}
+header b{color:var(--accent);letter-spacing:.04em}
+header .id{color:var(--mute);font-family:ui-monospace,Menlo,Consolas,monospace;font-size:12px}
+header .sp{flex:1}
+button{background:transparent;color:var(--fg);border:1px solid var(--line);border-radius:6px;padding:5px 10px;cursor:pointer;font:inherit}
+button.pause{border-color:var(--warn);color:var(--warn)}button.pause.on{background:var(--bad);border-color:var(--bad);color:#fff}
+aside{border-right:1px solid var(--line);background:var(--panel);overflow:auto}
+aside .room{padding:10px 14px;border-bottom:1px solid var(--line);cursor:pointer}
+aside .room:hover,aside .room.sel{background:#1c2129}
+aside .room .n{font-weight:600}aside .room .m{color:var(--mute);font-size:12px;font-family:ui-monospace,Menlo,Consolas,monospace}
+main{display:flex;flex-direction:column;min-height:0}
+.bar{display:flex;gap:12px;align-items:center;padding:8px 16px;border-bottom:1px solid var(--line);color:var(--mute);font-size:12px;flex-wrap:wrap}
+.bar .ok{color:var(--ok)}.bar .bad{color:var(--bad)}.bar .st{padding:1px 8px;border:1px solid var(--line);border-radius:10px}
+#log{flex:1;overflow:auto;padding:16px;display:flex;flex-direction:column;gap:8px}
+.msg{max-width:72%;padding:8px 12px;border-radius:12px;background:var(--them);align-self:flex-start;position:relative}
+.msg.me{background:var(--me);align-self:flex-end}
+.msg.sys{align-self:center;background:var(--sys);color:var(--mute);font-size:12px;max-width:90%;padding:4px 10px}
+.msg.blocked{align-self:flex-end;background:transparent;border:1px dashed var(--bad);color:var(--bad)}
+.meta{font-size:11px;color:var(--mute);display:flex;gap:8px;align-items:center;margin-bottom:3px}
+.msg.me .meta{color:#c9d4ea}
+.type{font-family:ui-monospace,Menlo,Consolas,monospace;padding:0 6px;border-radius:8px;background:rgba(255,255,255,.08)}
+.type.accept,.type.grant{background:var(--ok);color:#052}.type.close,.type.reject,.type.withdraw,.type.revoke{background:#444}.type.proposal,.type.counter{background:var(--accent);color:#3a1d05}.type.escalate{background:var(--warn);color:#3a2a05}.type.attachment,.type.question{background:#3b4a6b;color:#dfe7ff}
+.att a{color:var(--accent)}.grantline{font-size:12px;color:#bfe9d3;margin-top:3px;font-family:ui-monospace,Menlo,Consolas,monospace}
+#invite{display:none;position:fixed;right:16px;top:56px;width:340px;background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:14px;z-index:5;box-shadow:0 8px 30px rgba(0,0,0,.5)}
+#invite.on{display:block}#invite h3{margin:0 0 8px;font-size:13px;color:var(--accent);letter-spacing:.06em}
+#invite img{display:block;margin:0 auto 8px;background:#fff;padding:6px;border-radius:8px}
+#invite textarea{width:100%;height:64px;background:#0b0d11;color:var(--fg);border:1px solid var(--line);border-radius:6px;font:12px ui-monospace,Menlo,Consolas,monospace;padding:6px;resize:none}
+#invite .warn{font-size:11px;color:var(--mute);margin:6px 0 0}
+.amt{font-weight:700;font-variant-numeric:tabular-nums}
+.v{margin-left:auto}.v.ok{color:var(--ok)}.v.bad{color:var(--bad)}
+.rat{margin-top:6px;padding:6px 8px;border-left:2px solid var(--warn);background:rgba(0,0,0,.25);font-size:12px;color:#e8d9a8;font-style:italic}
+.rat b{font-style:normal;color:var(--warn);font-size:10px;letter-spacing:.06em}
+.empty{margin:auto;color:var(--mute)}
+</style></head><body>
+<header><b>can2cup</b><span id="who" class="id"></span><span class="sp"></span>
+<span id="pausedTxt" style="color:var(--mute);font-size:12px"></span>
+<button id="inviteBtn" title="Invite link + QR for the selected room">INVITE</button>
+<button id="pauseBtn" class="pause" title="Create/remove the PAUSED file: while paused your agent cannot send anything.">PAUSE</button></header>
+<div id="invite"><h3>INVITE · <span id="invRoom"></span></h3><img id="invQr" width="240" height="240" alt="QR of the invite link"><textarea id="invLink" readonly></textarea><button id="invCopy">copy link</button> <span id="invCopied" style="color:var(--ok);font-size:12px"></span><div class="warn">This link is the room key — whoever holds it can read and post. Hand it to the other principal out-of-band (LINE, mail, in person via the QR); never post it publicly.</div></div>
+<aside id="rooms"></aside>
+<main><div class="bar" id="bar">選一間房</div><div id="log"><div class="empty">no room selected</div></div></main>
+<script>
+const $=s=>document.querySelector(s);
+let state=null, cur=null, names={}, me="", seen=new Set(), blockedSeen=new Set(), poller=0;
+const esc=s=>String(s).replace(/[&<>"]/g,c=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"}[c]));
+const t=(iso)=>{const d=new Date(iso);return d.toLocaleTimeString("zh-TW",{hour12:false})};
+async function loadState(){state=await (await fetch("/api/state")).json();me=state.me.pub;
+ $("#who").textContent=state.me.name+" · "+me.slice(0,8)+" · "+state.home+(state.notify?" · 🔔":"");
+ setPaused(state.paused);
+ const el=$("#rooms");el.innerHTML="";
+ for(const r of state.rooms){const d=document.createElement("div");d.className="room"+(cur&&cur.id===r.id?" sel":"");
+  d.innerHTML='<div class="n">'+esc(r.name||"(unnamed)")+'</div><div class="m">'+esc(r.id)+" · "+esc(r.state)+" · seq "+esc(r.lastSeq)+"</div>";
+  d.onclick=()=>openRoom(r);el.appendChild(d);}
+ if(!cur&&state.rooms.length)openRoom(state.rooms[0]);}
+function setPaused(on){$("#pauseBtn").classList.toggle("on",on);$("#pauseBtn").textContent=on?"PAUSED — click to resume":"PAUSE";$("#pausedTxt").textContent=on?"⛔ your agent cannot send":"";}
+$("#inviteBtn").onclick=async()=>{const p=$("#invite");if(p.classList.contains("on")){p.classList.remove("on");return;}if(!cur)return;
+ const r=await (await fetch("/api/rooms/"+cur.id+"/invite")).json();$("#invRoom").textContent=(cur.name||cur.id);$("#invQr").src=r.qr;$("#invLink").value=r.link;$("#invCopied").textContent="";p.classList.add("on");};
+$("#invCopy").onclick=async()=>{try{await navigator.clipboard.writeText($("#invLink").value);$("#invCopied").textContent="copied ✓";}catch(e){$("#invLink").select();}};
+$("#pauseBtn").onclick=async()=>{const on=!$("#pauseBtn").classList.contains("on");const r=await (await fetch("/api/pause",{method:"POST",body:JSON.stringify({on})})).json();setPaused(r.paused);};
+function extra(m){const b=m.body||{};let h="";
+ if(m.type==="grant")h+='<div class="grantline">scope '+esc(b.scope||"")+' · until '+esc(b.expires||"")+(b.revocable===false?" · irrevocable":"")+'</div>';
+ if(m.type==="revoke")h+='<div class="grantline">revokes #'+esc(b.ref)+'</div>';
+ if(m.type==="attachment")h+='<div class="att">📎 '+esc(b.name||"")+' <a href="'+esc(b.url||"#")+'" target="_blank" rel="noopener">'+esc(b.url||"")+'</a>'+(b.sha256?' <span class="mute" style="font-size:11px">sha256 '+esc(String(b.sha256).slice(0,12))+'…</span>':"")+'</div>';
+ return h;}
+function bubble(m){const mine=m.from===me, sys=m.from==="relay";
+ const d=document.createElement("div");d.className="msg"+(mine?" me":"")+(sys?" sys":"");
+ if(sys){const b=m.body||{};d.textContent=t(m.ts)+" · "+(b.event||"system")+" · "+(b.name||"")+" ("+String(b.by||"").slice(0,8)+")";return d;}
+ const who=mine?"you":(names[m.from]||m.from.slice(0,8));const body=m.body||{};
+ d.innerHTML='<div class="meta"><span>'+esc(who)+'</span><span class="type '+esc(m.type)+'">'+esc(m.type)+'</span><span>'+t(m.ts)+'</span><span>#'+esc(m.seq)+'</span><span class="v '+(m.ok?"ok":"bad")+'" title="'+esc((m.errors||[]).join("; "))+'">'+(m.ok?"✓ verified":"✗ "+esc((m.errors||[]).join("; ")))+'</span></div>'
+  +'<div>'+esc(typeof body==="string"?body:(body.text||JSON.stringify(body)))+(body.amount!=null?' <span class="amt">'+esc(body.amount)+'</span>':"")+'</div>'+extra(m);
+ return d;}
+function blockedBubble(b){const d=document.createElement("div");d.className="msg blocked";
+ d.innerHTML='<div class="meta"><span>NOT SENT</span><span class="type '+esc(b.type)+'">'+esc(b.type)+'</span><span>'+t(b.at)+'</span></div><div>'+esc((b.body&&b.body.text)||JSON.stringify(b.body))+(b.body&&b.body.amount!=null?' <span class="amt">'+esc(b.body.amount)+'</span>':"")+'</div><div class="rat"><b>BLOCKED</b> '+esc(b.reason||"")+(b.rationale?'<br><b>RATIONALE</b> '+esc(b.rationale):"")+'</div>';return d;}
+function render(data){const log=$("#log");if(log.querySelector(".empty"))log.innerHTML="";names=data.names||names;
+ const items=[];
+ for(const m of data.msgs){if(seen.has(m.seq))continue;seen.add(m.seq);items.push({at:m.ts,el:bubble(m),seq:m.seq,m});}
+ for(const b of data.blocked||[]){const k=b.at+"|"+JSON.stringify(b.body);if(blockedSeen.has(k))continue;blockedSeen.add(k);items.push({at:b.at,el:blockedBubble(b)});}
+ items.sort((a,b)=>a.at.localeCompare(b.at));
+ for(const it of items){if(it.m&&it.m.from===me&&data.rationale&&data.rationale[it.seq]){const r=document.createElement("div");r.className="rat";r.innerHTML="<b>PRIVATE RATIONALE</b> "+esc(data.rationale[it.seq]);it.el.appendChild(r);}log.appendChild(it.el);}
+ if(items.length)log.scrollTop=log.scrollHeight;
+ const parts=Object.entries(names).map(([pk,n])=>esc(n)+(pk===me?" (you)":"")+" "+pk.slice(0,8)).join(" · ");
+ $("#bar").innerHTML='<b>'+esc(data.room.name||"(unnamed)")+'</b><span class="st">'+esc(data.room.state)+'</span><span>'+esc(data.room.id)+'</span><span>'+parts+'</span><span class="sp"></span><span class="'+(data.chainOk?"ok":"bad")+'">'+(data.chainOk?"chain ✓ ("+esc(data.lastSeq)+")":"CHAIN BROKEN")+'</span>';}
+async function openRoom(r){cur=r;seen=new Set();blockedSeen=new Set();$("#log").innerHTML="";clearTimeout(poller);$("#invite").classList.remove("on");
+ document.querySelectorAll(".room").forEach(e=>e.classList.toggle("sel",e.querySelector(".m").textContent.startsWith(r.id)));
+ const first=await (await fetch("/api/rooms/"+r.id+"?full=1")).json();render(first);poll();}
+async function poll(){if(!cur)return;const id=cur.id;try{const d=await (await fetch("/api/rooms/"+id+"?wait=25")).json();if(cur&&cur.id===id)render(d);}catch(e){}
+ if(cur&&cur.id===id)poller=setTimeout(poll,300);}
+loadState();setInterval(async()=>{const s=await (await fetch("/api/state")).json();setPaused(s.paused);if(s.rooms.length!==(state?state.rooms.length:0))loadState();},5000);
+</script></body></html>`;

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "can2cup",
+  "version": "0.10.0",
+  "description": "can2cup 傳聲罐罐 — a tin can, a paper cup, one string: signed rooms where two people's AI agents talk under their principals' mandates.",
+  "type": "module",
+  "homepage": "https://can2cup.com",
+  "repository": { "type": "git", "url": "git+https://github.com/ccqqder/can2cup.git" },
+  "bugs": { "url": "https://can2cup.com/guide/#faq" },
+  "keywords": ["mcp", "agent", "a2a", "line", "ed25519", "claude-code", "can2cup", "傳聲罐罐"],
+  "engines": { "node": ">=18" },
+  "publishConfig": { "access": "public" },
+  "bin": {
+    "can2cup": "dist/cli/index.js",
+    "can2cup-mcp": "dist/mcp/index.js",
+    "can2can": "dist/cli/index.js",
+    "parley": "dist/cli/index.js"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check:relay": "tsc -p tsconfig.relay.json --noEmit",
+    "dev:relay": "wrangler dev --local-upstream 127.0.0.1 --upstream-protocol http",
+    "deploy:relay": "wrangler deploy",
+    "release:relay": "node scripts/routes-check.mjs && node scripts/stage-tarball.mjs && node scripts/release-sign.mjs && wrangler deploy",
+    "release:key": "node scripts/release-key.mjs",
+    "check:routes": "node scripts/routes-check.mjs",
+    "smoke": "node dist/scripts/smoke.js",
+    "view": "node dist/viewer/index.js",
+    "pack": "npm run build && npm pack"
+  },
+  "license": "Apache-2.0",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@noble/ed25519": "^3.1.0",
+    "@noble/hashes": "^2.3.0",
+    "hono": "^4.13.2",
+    "qrcode": "^1.5.4",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^5.20260818.1",
+    "@types/node": "^26.2.0",
+    "@types/qrcode": "^1.5.6",
+    "typescript": "^5.9.3",
+    "wrangler": "^4.123.0"
+  },
+  "files": [
+    "dist",
+    "!dist/scripts",
+    "README.md",
+    "SKILL.md",
+    "INSTALL.zh-tw.md",
+    "LICENSE",
+    "NOTICE"
+  ]
+}